diff options
| author | Nicolai Hähnle <nicolai.haehnle@amd.com> | 2016-08-08 23:52:54 +0200 |
|---|---|---|
| committer | Nicolai Hähnle <nicolai.haehnle@amd.com> | 2016-08-10 20:25:32 +0200 |
| commit | ecd6cc40d080a00cc69ac2942cb665982684e02d (patch) | |
| tree | 2d338ac8a4db714fe0f26090899d5c20b31cda1c | |
| parent | 7fd7bf1860c2e44ee84ef5e56b3259aad968b1c2 (diff) | |
gallium/radeon: protect against out of bounds temporary array accesses
They can lead to VM faults and worse, which goes against the GL robustness
promises.
| -rw-r--r-- | src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c b/src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c index 7cdf2287d4..88c7b3c1d1 100644 --- a/src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c +++ b/src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c @@ -239,6 +239,21 @@ get_pointer_into_array(struct radeon_llvm_context *ctx, index = emit_array_index(&ctx->soa, reg_indirect, reg_index - ctx->temp_arrays[array_id - 1].range.First); + + /* Ensure that the index is within a valid range, to guard against + * VM faults and overwriting critical data (e.g. spilled resource + * descriptors). + * + * TODO It should be possible to avoid the additional instructions + * if LLVM is changed so that it guarantuees: + * 1. the scratch space descriptor isolates the current wave (this + * could even save the scratch offset SGPR at the cost of an + * additional SALU instruction) + * 2. the memory for allocas must be allocated at the _end_ of the + * scratch space (after spilled registers) + */ + index = radeon_llvm_bound_index(ctx, index, array->range.Last - array->range.First + 1); + index = LLVMBuildMul( builder, index, lp_build_const_int32(gallivm, util_bitcount(array->writemask)), |