Mesa (mesa_7_7_branch): r6xx/r7xx: emit relocation for FRAG & TILE buffer
Alex Deucher
agd5f at kemper.freedesktop.org
Wed Feb 24 17:06:41 UTC 2010
Module: Mesa
Branch: mesa_7_7_branch
Commit: 69a94e14528854e6902e79ff63c4a4a894ce451e
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=69a94e14528854e6902e79ff63c4a4a894ce451e
Author: Jerome Glisse <jglisse at redhat.com>
Date: Mon Jan 18 11:05:50 2010 +0100
r6xx/r7xx: emit relocation for FRAG & TILE buffer
FRAG & TILE buffer are unused but still they need
to be associated with a valid relocation so that
userspace can't try to abuse them to overwritte
GART and then try to write anywhere in system
memory.
---
src/mesa/drivers/dri/r600/r700_chip.c | 24 +++++++++++++++++++++---
1 files changed, 21 insertions(+), 3 deletions(-)
diff --git a/src/mesa/drivers/dri/r600/r700_chip.c b/src/mesa/drivers/dri/r600/r700_chip.c
index 817e434..29d6e19 100644
--- a/src/mesa/drivers/dri/r600/r700_chip.c
+++ b/src/mesa/drivers/dri/r600/r700_chip.c
@@ -428,13 +428,31 @@ static void r700SendRenderTargetState(GLcontext *ctx, struct radeon_state_atom *
R600_OUT_BATCH((2 << id));
END_BATCH();
}
+ /* Set CMASK & TILE buffer to the offset of color buffer as
+ * we don't use those this shouldn't cause any issue and we
+ * then have a valid cmd stream
+ */
+ BEGIN_BATCH_NO_AUTOSTATE(3 + 2);
+ R600_OUT_BATCH_REGSEQ(CB_COLOR0_TILE + (4 * id), 1);
+ R600_OUT_BATCH(r700->render_target[id].CB_COLOR0_TILE.u32All);
+ R600_OUT_BATCH_RELOC(r700->render_target[id].CB_COLOR0_BASE.u32All,
+ rrb->bo,
+ r700->render_target[id].CB_COLOR0_BASE.u32All,
+ 0, RADEON_GEM_DOMAIN_VRAM, 0);
+ END_BATCH();
+ BEGIN_BATCH_NO_AUTOSTATE(3 + 2);
+ R600_OUT_BATCH_REGSEQ(CB_COLOR0_FRAG + (4 * id), 1);
+ R600_OUT_BATCH(r700->render_target[id].CB_COLOR0_FRAG.u32All);
+ R600_OUT_BATCH_RELOC(r700->render_target[id].CB_COLOR0_BASE.u32All,
+ rrb->bo,
+ r700->render_target[id].CB_COLOR0_BASE.u32All,
+ 0, RADEON_GEM_DOMAIN_VRAM, 0);
+ END_BATCH();
- BEGIN_BATCH_NO_AUTOSTATE(18);
+ BEGIN_BATCH_NO_AUTOSTATE(12);
R600_OUT_BATCH_REGVAL(CB_COLOR0_SIZE + (4 * id), r700->render_target[id].CB_COLOR0_SIZE.u32All);
R600_OUT_BATCH_REGVAL(CB_COLOR0_VIEW + (4 * id), r700->render_target[id].CB_COLOR0_VIEW.u32All);
R600_OUT_BATCH_REGVAL(CB_COLOR0_INFO + (4 * id), r700->render_target[id].CB_COLOR0_INFO.u32All);
- R600_OUT_BATCH_REGVAL(CB_COLOR0_TILE + (4 * id), r700->render_target[id].CB_COLOR0_TILE.u32All);
- R600_OUT_BATCH_REGVAL(CB_COLOR0_FRAG + (4 * id), r700->render_target[id].CB_COLOR0_FRAG.u32All);
R600_OUT_BATCH_REGVAL(CB_COLOR0_MASK + (4 * id), r700->render_target[id].CB_COLOR0_MASK.u32All);
END_BATCH();
More information about the mesa-commit
mailing list