diff options
| author | Marek Olšák <maraeo@gmail.com> | 2011-02-14 01:01:10 +0100 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2011-02-14 10:12:14 +1000 |
| commit | fff1ce4dc6113b6fdc4e3a815ca5fd229408f8ef (patch) | |
| tree | 67b3cf58e6b1a23a81bd45b1c98455020f6db248 /drivers/gpu/drm/radeon/r300.c | |
| parent | 501834349e872ed4115eea3beef65ca9eeb5528e (diff) | |
drm/radeon/kms: check AA resolve registers on r300
This is an important security fix because we allowed arbitrary values
to be passed to AARESOLVE_OFFSET. This also puts the right buffer address
in the register.
Signed-off-by: Marek Olšák <maraeo@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/radeon/r300.c')
| -rw-r--r-- | drivers/gpu/drm/radeon/r300.c | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c index 862b61742b8..768c60ee4ab 100644 --- a/drivers/gpu/drm/radeon/r300.c +++ b/drivers/gpu/drm/radeon/r300.c @@ -1104,6 +1104,27 @@ static int r300_packet0_check(struct radeon_cs_parser *p, track->blend_read_enable = !!(idx_value & (1 << 2)); track->cb_dirty = true; break; + case R300_RB3D_AARESOLVE_OFFSET: + r = r100_cs_packet_next_reloc(p, &reloc); + if (r) { + DRM_ERROR("No reloc for ib[%d]=0x%04X\n", + idx, reg); + r100_cs_dump_packet(p, pkt); + return r; + } + track->aa.robj = reloc->robj; + track->aa.offset = idx_value; + track->aa_dirty = true; + ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset); + break; + case R300_RB3D_AARESOLVE_PITCH: + track->aa.pitch = idx_value & 0x3FFE; + track->aa_dirty = true; + break; + case R300_RB3D_AARESOLVE_CTL: + track->aaresolve = idx_value & 0x1; + track->aa_dirty = true; + break; case 0x4f30: /* ZB_MASK_OFFSET */ case 0x4f34: /* ZB_ZMASK_PITCH */ case 0x4f44: /* ZB_HIZ_OFFSET */ |