fix for 'nasty bug' and some sanity checks to avoid buffer overruns. Bumping VSF_MAX_FRAGMENT_LENGTH as it seems a bit low otherwise.
diff --git a/src/mesa/drivers/dri/r300/r300_context.c b/src/mesa/drivers/dri/r300/r300_context.c
index ca9ee7c..b37e984 100644
--- a/src/mesa/drivers/dri/r300/r300_context.c
+++ b/src/mesa/drivers/dri/r300/r300_context.c
@@ -216,7 +216,7 @@
* texturable memory at once.
*/
- ctx = r300->radeon.glCtx;
+ ctx = r300->radeon.glCtx;
ctx->Const.MaxTextureImageUnits = driQueryOptioni(&r300->radeon.optionCache,
"texture_image_units");
diff --git a/src/mesa/drivers/dri/r300/r300_context.h b/src/mesa/drivers/dri/r300/r300_context.h
index d3dbccc..7879de1 100644
--- a/src/mesa/drivers/dri/r300/r300_context.h
+++ b/src/mesa/drivers/dri/r300/r300_context.h
@@ -122,16 +122,11 @@
int aos_reg; /* VAP register assignment */
};
-#define DUMP_DMA(rmesa) fprintf(stderr, "start=%d, end=%d, prt=%d, offset=%d, stride=%d, size=%d, format=%d, reg=%d\n",\
-rmesa->dma.current.start, rmesa->dma.current.end, rmesa->dma.current.ptr, rmesa->dma.current.aos_offset, \
-rmesa->dma.current.aos_stride, rmesa->dma.current.aos_size, rmesa->dma.current.aos_format, rmesa->dma.current.aos_reg);
-
struct r300_dma {
/* Active dma region. Allocations for vertices and retained
* regions come from here. Also used for emitting random vertices,
* these may be flushed by calling flush_current();
*/
- int dummy; /* move this below current to make arbvptorus work */
struct r300_dma_region current;
void (*flush) (r300ContextPtr);
@@ -519,7 +514,7 @@
/* Vertex shader state */
/* 64 appears to be the maximum */
-#define VSF_MAX_FRAGMENT_LENGTH 64
+#define VSF_MAX_FRAGMENT_LENGTH (64*4)
struct r300_vertex_shader_fragment {
@@ -676,11 +671,10 @@
GLuint render_inputs; /* actual render inputs that R300 was configured for.
They are the same as tnl->render_inputs for fixed pipeline */
-#if 0
+
struct {
int transform_offset; /* Transform matrix offset, -1 if none */
} vap_param; /* vertex processor parameter allocation - tells where to write parameters */
-#endif
int hw_stencil;
};
diff --git a/src/mesa/drivers/dri/r300/r300_maos.c b/src/mesa/drivers/dri/r300/r300_maos.c
index 4fd3dc6..547ab35 100644
--- a/src/mesa/drivers/dri/r300/r300_maos.c
+++ b/src/mesa/drivers/dri/r300/r300_maos.c
@@ -52,6 +52,7 @@
#define DEBUG_ALL DEBUG_VERTS
+
#if defined(USE_X86_ASM)
#define COPY_DWORDS( dst, src, nr ) \
do { \
@@ -243,6 +244,7 @@
GLuint aa_vap_reg = 0; /* VAP register assignment */
GLuint i;
GLuint inputs = 0;
+
#define CONFIGURE_AOS(r, f, v, sz, cn) { \
if (RADEON_DEBUG & DEBUG_STATE) \
@@ -291,10 +293,15 @@
inputs |= _TNL_BIT_FOG;
rmesa->state.aos[nr++].aos_reg = rmesa->current_vp->inputs[VERT_ATTRIB_FOG];
}
+ if(ctx->Const.MaxTextureUnits > 8) { /* Not sure if this can even happen... */
+ fprintf(stderr, "%s: Cant handle that many inputs\n", __FUNCTION__);
+ exit(-1);
+ }
for (i=0;i<ctx->Const.MaxTextureUnits;i++) {
- if (rmesa->current_vp->inputs[VERT_ATTRIB_TEX0+i] != -1)
+ if (rmesa->current_vp->inputs[VERT_ATTRIB_TEX0+i] != -1) {
inputs |= _TNL_BIT_TEX0<<i;
rmesa->state.aos[nr++].aos_reg = rmesa->current_vp->inputs[VERT_ATTRIB_TEX0+i];
+ }
}
nr = 0;
} else {
@@ -310,7 +317,6 @@
vic_1 |= R300_INPUT_CNTL_POS;
}
- //DUMP_DMA(rmesa);
if (inputs & _TNL_BIT_NORMAL) {
CONFIGURE_AOS(i_normal, AOS_FORMAT_FLOAT,
@@ -368,6 +374,7 @@
vic_1 |= R300_INPUT_CNTL_TC0 << i;
}
}
+
int cmd_reserved=0;
int cmd_written=0;
diff --git a/src/mesa/drivers/dri/r300/r300_state.c b/src/mesa/drivers/dri/r300/r300_state.c
index e20e34c..da953ae 100644
--- a/src/mesa/drivers/dri/r300/r300_state.c
+++ b/src/mesa/drivers/dri/r300/r300_state.c
@@ -1515,7 +1515,7 @@
int i;
/* Allocate parameters */
- //r300->state.vap_param.transform_offset=0x0; /* transform matrix */
+ r300->state.vap_param.transform_offset=0x0; /* transform matrix */
r300->state.vertex_shader.param_offset=0x0;
r300->state.vertex_shader.param_count=0x4; /* 4 vector values - 4x4 matrix */
@@ -1675,6 +1675,7 @@
int inst_count;
int param_count;
LOCAL_VARS
+
/* Reset state, in case we don't use something */
((drm_r300_cmd_header_t*)rmesa->hw.vpp.cmd)->vpu.count = 0;
@@ -2256,7 +2257,6 @@
//END: TODO
//verify_r300ResetHwState(r300, 0);
-
r300->hw.all_dirty = GL_TRUE;
}
diff --git a/src/mesa/drivers/dri/r300/r300_vertexprog.c b/src/mesa/drivers/dri/r300/r300_vertexprog.c
index f4b0d41..54aea49 100644
--- a/src/mesa/drivers/dri/r300/r300_vertexprog.c
+++ b/src/mesa/drivers/dri/r300/r300_vertexprog.c
@@ -250,7 +250,10 @@
_mesa_load_state_parameters(ctx, mesa_vp->Parameters);
//debug_vp(ctx, mesa_vp);
-
+ if(mesa_vp->Parameters->NumParameters * 4 > VSF_MAX_FRAGMENT_LENGTH){
+ fprintf(stderr, "%s:Params exhausted\n", __FUNCTION__);
+ exit(-1);
+ }
dst_index=0;
for(pi=0; pi < mesa_vp->Parameters->NumParameters; pi++){
switch(mesa_vp->Parameters->Parameters[pi].Type){
@@ -349,7 +352,21 @@
exit(0);
}
}
-
+
+void vp_dump_inputs(struct r300_vertex_program *vp, char *caller)
+{
+ int i;
+
+ if(vp == NULL)
+ return ;
+
+ fprintf(stderr, "%s:<", caller);
+ for(i=0; i < VERT_ATTRIB_MAX; i++)
+ fprintf(stderr, "%d ", vp->inputs[i]);
+ fprintf(stderr, ">\n");
+
+}
+
static unsigned long t_src_index(struct r300_vertex_program *vp, struct vp_src_register *src)
{
int i;
@@ -366,7 +383,6 @@
default: printf("unknown input index %d\n", src->Index); exit(0); break;
}*/
-
if(vp->inputs[src->Index] != -1)
return vp->inputs[src->Index];
@@ -376,6 +392,8 @@
vp->inputs[src->Index]=max_reg+1;
+ //vp_dump_inputs(vp, __FUNCTION__);
+
return vp->inputs[src->Index];
}else{
return src->Index;
