summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJerome Glisse <jglisse@redhat.com>2010-01-18 10:46:50 +0100
committerJerome Glisse <jglisse@redhat.com>2010-01-18 12:08:46 +0100
commit95d63e408cc88b6934bec84a0b1ef94dfe8bee7b (patch)
tree6073bfa84810dc73885031434f4c9145ae05d8bf
parentbbaf71fb46e3e0acdadcb91e9b1c73396bd9aa8e (diff)
r6xx/r7xx: emit relocation for FRAG & TILE buffer
FRAG & TILE buffer are unused but still they need to be associated with a valid relocation so that userspace can't try to abuse them to overwritte GART and then try to write anywhere in system memory.
-rw-r--r--src/r6xx_accel.c28
1 files changed, 19 insertions, 9 deletions
diff --git a/src/r6xx_accel.c b/src/r6xx_accel.c
index 0ca942ef..7a225e55 100644
--- a/src/r6xx_accel.c
+++ b/src/r6xx_accel.c
@@ -261,21 +261,31 @@ set_render_target(ScrnInfoPtr pScrn, drmBufPtr ib, cb_config_t *cb_conf)
// rv6xx workaround
if ((info->ChipFamily > CHIP_FAMILY_R600) &&
- (info->ChipFamily < CHIP_FAMILY_RV770)) {
- BEGIN_BATCH(20);
- PACK3(ib, IT_SURFACE_BASE_UPDATE, 1);
- E32(ib, (2 << cb_conf->id));
- } else
- BEGIN_BATCH(18);
-
+ (info->ChipFamily < CHIP_FAMILY_RV770)) {
+ BEGIN_BATCH(2);
+ PACK3(ib, IT_SURFACE_BASE_UPDATE, 1);
+ E32(ib, (2 << cb_conf->id));
+ END_BATCH();
+ }
+ /* Set CMASK & TILE buffer to the offset of color buffer as
+ * we don't use those this shouldn't cause any issue and we
+ * then have a valid cmd stream
+ */
+ BEGIN_BATCH(3 + 2);
+ EREG(ib, (CB_COLOR0_TILE + (4 * cb_conf->id)), (0 >> 8)); // CMASK per-tile data base/256
+ RELOC_BATCH(cb_conf->bo, RADEON_GEM_DOMAIN_VRAM, 0);
+ END_BATCH();
+ BEGIN_BATCH(3 + 2);
+ EREG(ib, (CB_COLOR0_FRAG + (4 * cb_conf->id)), (0 >> 8)); // FMASK per-tile data base/256
+ RELOC_BATCH(cb_conf->bo, RADEON_GEM_DOMAIN_VRAM, 0);
+ END_BATCH();
+ BEGIN_BATCH(12);
// pitch only for ARRAY_LINEAR_GENERAL, other tiling modes require addrlib
EREG(ib, (CB_COLOR0_SIZE + (4 * cb_conf->id)), ((pitch << PITCH_TILE_MAX_shift) |
(slice << SLICE_TILE_MAX_shift)));
EREG(ib, (CB_COLOR0_VIEW + (4 * cb_conf->id)), ((0 << SLICE_START_shift) |
(0 << SLICE_MAX_shift)));
EREG(ib, (CB_COLOR0_INFO + (4 * cb_conf->id)), cb_color_info);
- EREG(ib, (CB_COLOR0_TILE + (4 * cb_conf->id)), (0 >> 8)); // CMASK per-tile data base/256
- EREG(ib, (CB_COLOR0_FRAG + (4 * cb_conf->id)), (0 >> 8)); // FMASK per-tile data base/256
EREG(ib, (CB_COLOR0_MASK + (4 * cb_conf->id)), ((0 << CMASK_BLOCK_MAX_shift) |
(0 << FMASK_TILE_MAX_shift)));
END_BATCH();