From 8d8fd9776e23a34e0d22e489ce1f85eb5e383121 Mon Sep 17 00:00:00 2001 From: Alex Deucher Date: Fri, 4 Dec 2009 09:52:37 -0500 Subject: radeon: fix polygon stipple fixes fdo bug 25354 Signed-off-by: Alex Deucher --- src/mesa/drivers/dri/radeon/radeon_common.c | 23 ----------------------- src/mesa/drivers/dri/radeon/radeon_common.h | 1 - src/mesa/drivers/dri/radeon/radeon_context.h | 4 ++++ src/mesa/drivers/dri/radeon/radeon_state.c | 25 +++++++++++++++++++++++++ 4 files changed, 29 insertions(+), 24 deletions(-) (limited to 'src/mesa') diff --git a/src/mesa/drivers/dri/radeon/radeon_common.c b/src/mesa/drivers/dri/radeon/radeon_common.c index 8032cbcd69..5b2bcfdb24 100644 --- a/src/mesa/drivers/dri/radeon/radeon_common.c +++ b/src/mesa/drivers/dri/radeon/radeon_common.c @@ -262,29 +262,6 @@ void radeonScissor(GLcontext* ctx, GLint x, GLint y, GLsizei w, GLsizei h) } } -void radeonPolygonStipplePreKMS( GLcontext *ctx, const GLubyte *mask ) -{ - radeonContextPtr radeon = RADEON_CONTEXT(ctx); - GLuint i; - drm_radeon_stipple_t stipple; - - /* Must flip pattern upside down. - */ - for ( i = 0 ; i < 32 ; i++ ) { - stipple.mask[31 - i] = ((GLuint *) mask)[i]; - } - - /* TODO: push this into cmd mechanism - */ - radeon_firevertices(radeon); - LOCK_HARDWARE( radeon ); - - drmCommandWrite( radeon->dri.fd, DRM_RADEON_STIPPLE, - &stipple, sizeof(stipple) ); - UNLOCK_HARDWARE( radeon ); -} - - /* ================================================================ * SwapBuffers with client-side throttling */ diff --git a/src/mesa/drivers/dri/radeon/radeon_common.h b/src/mesa/drivers/dri/radeon/radeon_common.h index f3201911ac..a9e1ca49eb 100644 --- a/src/mesa/drivers/dri/radeon/radeon_common.h +++ b/src/mesa/drivers/dri/radeon/radeon_common.h @@ -10,7 +10,6 @@ void radeonRecalcScissorRects(radeonContextPtr radeon); void radeonSetCliprects(radeonContextPtr radeon); void radeonUpdateScissor( GLcontext *ctx ); void radeonScissor(GLcontext* ctx, GLint x, GLint y, GLsizei w, GLsizei h); -void radeonPolygonStipplePreKMS( GLcontext *ctx, const GLubyte *mask ); void radeonWaitForIdleLocked(radeonContextPtr radeon); extern uint32_t radeonGetAge(radeonContextPtr radeon); diff --git a/src/mesa/drivers/dri/radeon/radeon_context.h b/src/mesa/drivers/dri/radeon/radeon_context.h index 4e2c52c835..12ab33a009 100644 --- a/src/mesa/drivers/dri/radeon/radeon_context.h +++ b/src/mesa/drivers/dri/radeon/radeon_context.h @@ -331,8 +331,12 @@ struct r100_hw_state { struct radeon_state_atom stp; }; +struct radeon_stipple_state { + GLuint mask[32]; +}; struct r100_state { + struct radeon_stipple_state stipple; struct radeon_texture_state texture; }; diff --git a/src/mesa/drivers/dri/radeon/radeon_state.c b/src/mesa/drivers/dri/radeon/radeon_state.c index 4d0d35ee0c..f6c733ab20 100644 --- a/src/mesa/drivers/dri/radeon/radeon_state.c +++ b/src/mesa/drivers/dri/radeon/radeon_state.c @@ -550,6 +550,31 @@ static void radeonPolygonOffset( GLcontext *ctx, rmesa->hw.zbs.cmd[ZBS_SE_ZBIAS_CONSTANT] = constant.ui32; } +static void radeonPolygonStipplePreKMS( GLcontext *ctx, const GLubyte *mask ) +{ + r100ContextPtr rmesa = R100_CONTEXT(ctx); + GLuint i; + drm_radeon_stipple_t stipple; + + /* Must flip pattern upside down. + */ + for ( i = 0 ; i < 32 ; i++ ) { + rmesa->state.stipple.mask[31 - i] = ((GLuint *) mask)[i]; + } + + /* TODO: push this into cmd mechanism + */ + radeon_firevertices(&rmesa->radeon); + LOCK_HARDWARE( &rmesa->radeon ); + + /* FIXME: Use window x,y offsets into stipple RAM. + */ + stipple.mask = rmesa->state.stipple.mask; + drmCommandWrite( rmesa->radeon.dri.fd, DRM_RADEON_STIPPLE, + &stipple, sizeof(drm_radeon_stipple_t) ); + UNLOCK_HARDWARE( &rmesa->radeon ); +} + static void radeonPolygonMode( GLcontext *ctx, GLenum face, GLenum mode ) { r100ContextPtr rmesa = R100_CONTEXT(ctx); -- cgit v1.2.3 From fe8e18bcd41a19282ba92350a04a34866fda1d7b Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Sat, 28 Nov 2009 22:04:06 -0500 Subject: mesa: Fix array out-of-bounds access in _mesa_TexEnvf. _mesa_TexEnvf calls _mesa_TexEnvfv, which uses the param argument as an array. (cherry picked from commit a11d60d14caf8efc07f70af63b57b33273f8cf9b) --- src/mesa/main/texenv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa') diff --git a/src/mesa/main/texenv.c b/src/mesa/main/texenv.c index 6d86a4275c..4442fb8cf8 100644 --- a/src/mesa/main/texenv.c +++ b/src/mesa/main/texenv.c @@ -598,7 +598,10 @@ _mesa_TexEnvfv( GLenum target, GLenum pname, const GLfloat *param ) void GLAPIENTRY _mesa_TexEnvf( GLenum target, GLenum pname, GLfloat param ) { - _mesa_TexEnvfv( target, pname, ¶m ); + GLfloat p[4]; + p[0] = param; + p[1] = p[2] = p[3] = 0.0; + _mesa_TexEnvfv( target, pname, p ); } -- cgit v1.2.3 From 4071d065c2c32a872bb148d108252a2380c42da4 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Sun, 29 Nov 2009 18:18:23 -0500 Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameterf. _mesa_TexParameterf calls set_tex_parameteri, which uses the params argument as an array. (cherry picked from commit a201dfb6bf28b89d6f511c2ec9ae0d81ef18511d) --- src/mesa/main/texparam.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/mesa') diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c index 9d1fdd0566..416792f0e9 100644 --- a/src/mesa/main/texparam.c +++ b/src/mesa/main/texparam.c @@ -544,8 +544,10 @@ _mesa_TexParameterf(GLenum target, GLenum pname, GLfloat param) case GL_DEPTH_TEXTURE_MODE_ARB: { /* convert float param to int */ - GLint p = (GLint) param; - need_update = set_tex_parameteri(ctx, texObj, pname, &p); + GLint p[4]; + p[0] = (GLint) param; + p[1] = p[2] = p[3] = 0; + need_update = set_tex_parameteri(ctx, texObj, pname, p); } break; default: -- cgit v1.2.3 From ca8a2150c79899bad0f80e132656863822db045e Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Sun, 29 Nov 2009 21:17:44 -0500 Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameterf. _mesa_TexParameterf calls set_tex_parameterf, which uses the params argument as an array. (cherry picked from commit 270d36da146b899d39e08f830fe34b63833a3731) --- src/mesa/main/texparam.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'src/mesa') diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c index 416792f0e9..4ce8c8593a 100644 --- a/src/mesa/main/texparam.c +++ b/src/mesa/main/texparam.c @@ -551,8 +551,13 @@ _mesa_TexParameterf(GLenum target, GLenum pname, GLfloat param) } break; default: - /* this will generate an error if pname is illegal */ - need_update = set_tex_parameterf(ctx, texObj, pname, ¶m); + { + /* this will generate an error if pname is illegal */ + GLfloat p[4]; + p[0] = param; + p[1] = p[2] = p[3] = 0.0F; + need_update = set_tex_parameterf(ctx, texObj, pname, p); + } } if (ctx->Driver.TexParameter && need_update) { -- cgit v1.2.3 From d74cd04e6190ebb3a9c53d45cbb2452d92e24ad5 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Sat, 28 Nov 2009 23:47:23 -0500 Subject: mesa: Fix array out-of-bounds access by _mesa_TexGeni. _mesa_TexGeni calls _mesa_TexGeniv, which uses the params argument as an array. (cherry picked from commit d55fb7c835b56951f05a058083e7eda264ba192e) --- src/mesa/main/texgen.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa') diff --git a/src/mesa/main/texgen.c b/src/mesa/main/texgen.c index e3feb024c3..13b33745b8 100644 --- a/src/mesa/main/texgen.c +++ b/src/mesa/main/texgen.c @@ -213,7 +213,10 @@ _mesa_TexGenf( GLenum coord, GLenum pname, GLfloat param ) void GLAPIENTRY _mesa_TexGeni( GLenum coord, GLenum pname, GLint param ) { - _mesa_TexGeniv( coord, pname, ¶m ); + GLint p[4]; + p[0] = param; + p[1] = p[2] = p[3] = 0; + _mesa_TexGeniv( coord, pname, p ); } -- cgit v1.2.3 From b2953ee1a655a010f36b5fc1b47f8bd8b06ce368 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Sun, 29 Nov 2009 00:50:48 -0500 Subject: mesa: Fix array out-of-bounds access by _mesa_TexGenf. _mesa_TexGenf calls _mesa_TexGenfv, which uses the params argument as an array. (cherry picked from commit ca5a7aadb4361e7d053aea8687372cd44cbd8795) --- src/mesa/main/texgen.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa') diff --git a/src/mesa/main/texgen.c b/src/mesa/main/texgen.c index 13b33745b8..d3ea7b936b 100644 --- a/src/mesa/main/texgen.c +++ b/src/mesa/main/texgen.c @@ -206,7 +206,10 @@ _mesa_TexGendv(GLenum coord, GLenum pname, const GLdouble *params ) void GLAPIENTRY _mesa_TexGenf( GLenum coord, GLenum pname, GLfloat param ) { - _mesa_TexGenfv(coord, pname, ¶m); + GLfloat p[4]; + p[0] = param; + p[1] = p[2] = p[3] = 0.0F; + _mesa_TexGenfv(coord, pname, p); } -- cgit v1.2.3 From f622b649fb0c55b1640997f9d32ea327743519a1 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Tue, 24 Nov 2009 00:57:55 -0500 Subject: dri: Fix potential null pointer deference in dri_put_drawable. (cherry picked from commit 364070b1f2b08d43fb205ec198894a35bec6b2f3) --- src/mesa/drivers/dri/common/dri_util.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'src/mesa') diff --git a/src/mesa/drivers/dri/common/dri_util.c b/src/mesa/drivers/dri/common/dri_util.c index e48e10d7c0..439f66a7b8 100644 --- a/src/mesa/drivers/dri/common/dri_util.c +++ b/src/mesa/drivers/dri/common/dri_util.c @@ -498,11 +498,11 @@ static void dri_put_drawable(__DRIdrawable *pdp) { __DRIscreenPrivate *psp; - pdp->refcount--; - if (pdp->refcount) - return; - if (pdp) { + pdp->refcount--; + if (pdp->refcount) + return; + psp = pdp->driScreenPriv; (*psp->DriverAPI.DestroyBuffer)(pdp); if (pdp->pClipRects) { -- cgit v1.2.3 From c994f08eb1ec2a4bbaa44fbd6d35e7ff033d5c3c Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Sat, 28 Nov 2009 23:22:31 -0500 Subject: dri: Fix potential null pointer dereference in driBindContext. (cherry picked from commit 919898e92fa23ff71a59d86a46ff0886a6f34e4d) --- src/mesa/drivers/dri/common/dri_util.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/mesa') diff --git a/src/mesa/drivers/dri/common/dri_util.c b/src/mesa/drivers/dri/common/dri_util.c index 439f66a7b8..da81ec9de5 100644 --- a/src/mesa/drivers/dri/common/dri_util.c +++ b/src/mesa/drivers/dri/common/dri_util.c @@ -167,11 +167,12 @@ static int driBindContext(__DRIcontext *pcp, __DRIdrawable *pdp, __DRIdrawable *prp) { - __DRIscreenPrivate *psp = pcp->driScreenPriv; + __DRIscreenPrivate *psp; /* Bind the drawable to the context */ if (pcp) { + psp = pcp->driScreenPriv; pcp->driDrawablePriv = pdp; pcp->driReadablePriv = prp; if (pdp) { -- cgit v1.2.3 From 9dbd47fc6b1cf9ddfb318f2e05df0886cd5fe0df Mon Sep 17 00:00:00 2001 From: Ian Romanick Date: Mon, 7 Dec 2009 16:59:59 -0800 Subject: mesa: set version string to 7.6.1-rc3 --- src/mesa/main/version.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/mesa') diff --git a/src/mesa/main/version.h b/src/mesa/main/version.h index e2fed57080..8a2013229a 100644 --- a/src/mesa/main/version.h +++ b/src/mesa/main/version.h @@ -32,7 +32,7 @@ #define MESA_MAJOR 7 #define MESA_MINOR 6 #define MESA_PATCH 1 -#define MESA_VERSION_STRING "7.6.1-rc2" +#define MESA_VERSION_STRING "7.6.1-rc3" /* To make version comparison easy */ #define MESA_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c)) -- cgit v1.2.3