fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-01-22 21:30:31 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

r6xx/r7xx: emit relocation for FRAG & TILE buffer

Browse source 
FRAG & TILE buffer are unused but still they need
to be associated with a valid relocation so that
userspace can't try to abuse them to overwritte
GART and then try to write anywhere in system
memory.
This commit is contained in:
Jerome Glisse 2010-01-18 11:05:50 +01:00
parent 7b82f0f67e
commit 46dc6fd3ed
1 changed files with 21 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
src/mesa/drivers/dri/r600/r700_chip.c
View file

@ -453,13 +453,31 @@ static void r700SendRenderTargetState(GLcontext *ctx, struct radeon_state_atom *
R600_OUT_BATCH((2 << id));
END_BATCH();
}
/* Set CMASK & TILE buffer to the offset of color buffer as
* we don't use those this shouldn't cause any issue and we
* then have a valid cmd stream
*/
BEGIN_BATCH_NO_AUTOSTATE(3 + 2);
R600_OUT_BATCH_REGSEQ(CB_COLOR0_TILE + (4 * id), 1);
R600_OUT_BATCH(r700->render_target[id].CB_COLOR0_TILE.u32All);
R600_OUT_BATCH_RELOC(r700->render_target[id].CB_COLOR0_BASE.u32All,
rrb->bo,
r700->render_target[id].CB_COLOR0_BASE.u32All,
0, RADEON_GEM_DOMAIN_VRAM, 0);
END_BATCH();
BEGIN_BATCH_NO_AUTOSTATE(3 + 2);
R600_OUT_BATCH_REGSEQ(CB_COLOR0_FRAG + (4 * id), 1);
R600_OUT_BATCH(r700->render_target[id].CB_COLOR0_FRAG.u32All);
R600_OUT_BATCH_RELOC(r700->render_target[id].CB_COLOR0_BASE.u32All,
rrb->bo,
r700->render_target[id].CB_COLOR0_BASE.u32All,
0, RADEON_GEM_DOMAIN_VRAM, 0);
END_BATCH();
BEGIN_BATCH_NO_AUTOSTATE(18);
BEGIN_BATCH_NO_AUTOSTATE(12);
R600_OUT_BATCH_REGVAL(CB_COLOR0_SIZE + (4 * id), r700->render_target[id].CB_COLOR0_SIZE.u32All);
R600_OUT_BATCH_REGVAL(CB_COLOR0_VIEW + (4 * id), r700->render_target[id].CB_COLOR0_VIEW.u32All);
R600_OUT_BATCH_REGVAL(CB_COLOR0_INFO + (4 * id), r700->render_target[id].CB_COLOR0_INFO.u32All);
R600_OUT_BATCH_REGVAL(CB_COLOR0_TILE + (4 * id), r700->render_target[id].CB_COLOR0_TILE.u32All);
R600_OUT_BATCH_REGVAL(CB_COLOR0_FRAG + (4 * id), r700->render_target[id].CB_COLOR0_FRAG.u32All);
R600_OUT_BATCH_REGVAL(CB_COLOR0_MASK + (4 * id), r700->render_target[id].CB_COLOR0_MASK.u32All);
END_BATCH();