fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-06 18:08:40 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

intel/decoder: Fix binding table pointer decoding with large offsets

Browse source 
XeHP supports a 20:5 pointer format, so the offset can legitimately
be more than UINT16_MAX.  Likewise, with 256B binding table mode on
Icelake/Tigerlake, we might have 18:8 pointers that exceed UINT16_MAX.

Thanks to Felix DeGrood for catching this!

Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/16538>
This commit is contained in:
Kenneth Graunke 2022-05-13 13:04:21 -07:00 • committed by Marge Bot
parent 8779a5b84c
commit b637f6c3db
1 changed files with 16 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
src/intel/common/intel_batch_decoder.c
View file

@ -281,9 +281,22 @@ dump_binding_table(struct intel_batch_decode_ctx *ctx,
return;
}
/* When 256B binding tables are enabled, we have to shift the offset */
if (ctx->use_256B_binding_tables)
/* Most platforms use a 16-bit pointer with 32B alignment in bits 15:5. */
uint32_t btp_alignment = 32;
uint32_t btp_pointer_bits = 16;
if (ctx->devinfo.verx10 >= 125) {
/* The pointer is now 21-bit with 32B alignment in bits 20:5. */
btp_pointer_bits = 21;
} else if (ctx->use_256B_binding_tables) {
/* When 256B binding tables are enabled, we have to shift the offset
* which is stored in bits 15:5 but interpreted as bits 18:8 of the
* actual offset. The effective pointer is 19-bit with 256B alignment.
*/
offset <<= 3;
btp_pointer_bits = 19;
btp_alignment = 256;
}
const uint64_t bt_pool_base = ctx->bt_pool_base ? ctx->bt_pool_base :
ctx->surface_base;
@ -293,7 +306,7 @@ dump_binding_table(struct intel_batch_decode_ctx *ctx,
bt_pool_base, 1, 8);
}
if (offset % 32 != 0 || offset >= UINT16_MAX) {
if (offset % btp_alignment != 0 || offset >= (1u << btp_pointer_bits)) {
fprintf(ctx->fp, " invalid binding table pointer\n");
return;
}