archive/rpcs3
1
0
Fork 0
mirror of https://github.com/RPCS3/rpcs3.git synced 2025-07-03 13:31:27 +12:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

rsx: Avoid out of bounds write for tiled memory

Browse source
This commit is contained in:
kd-11 2023-12-30 02:23:56 +03:00 • committed by Megamouse
parent 22d43c25b2
commit 188eefeeac
2 changed files with 15 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
rpcs3/Emu/RSX/Common/tiled_dma_copy.hpp
View file

@ -102,10 +102,11 @@ namespace rsx
tile_address ^= ((tile_address >> 11) & 1) << 10; tile_address ^= ((tile_address >> 11) & 1) << 10;
// Calculate relative addresses and sample // Calculate relative addresses and sample
uint32_t linear_image_offset = (row * conf.image_pitch) + (col * conf.image_bpp); const uint32_t linear_image_offset = (row * conf.image_pitch) + (col * conf.image_bpp);
uint32_t tile_data_offset = tile_address - (conf.tile_base_address + conf.tile_offset); const uint32_t tile_base_offset = tile_address - conf.tile_base_address; // Distance from tile base address
const uint32_t tile_data_offset = tile_base_offset - conf.tile_offset; // Distance from data base address
if (tile_data_offset >= conf.tile_size) if (tile_base_offset >= conf.tile_size)
{ {
// Do not touch anything out of bounds // Do not touch anything out of bounds
return; return;
@ -122,7 +123,7 @@ namespace rsx
} }
// Entry point. In GPU code this is handled by dispatch + main // Entry point. In GPU code this is handled by dispatch + main
template <typename T, bool Reverse = false> template <typename T, bool Decode = false>
void tile_texel_data(void* dst, const void* src, uint32_t base_address, uint32_t base_offset, uint32_t tile_size, uint8_t bank_sense, uint16_t row_pitch_in_bytes, uint16_t image_width, uint16_t image_height) void tile_texel_data(void* dst, const void* src, uint32_t base_address, uint32_t base_offset, uint32_t tile_size, uint8_t bank_sense, uint16_t row_pitch_in_bytes, uint16_t image_width, uint16_t image_height)
{ {
// Some constants // Some constants
@ -148,7 +149,7 @@ namespace rsx
const auto [prime, factor] = get_prime_factor(row_pitch_in_bytes); const auto [prime, factor] = get_prime_factor(row_pitch_in_bytes);
const uint32_t tiles_per_row = prime * factor; const uint32_t tiles_per_row = prime * factor;
constexpr int op = Reverse ? RSX_DMA_OP_DECODE_TILE : RSX_DMA_OP_ENCODE_TILE; constexpr int op = Decode ? RSX_DMA_OP_DECODE_TILE : RSX_DMA_OP_ENCODE_TILE;
auto src2 = static_cast<char*>(const_cast<void*>(src)); auto src2 = static_cast<char*>(const_cast<void*>(src));
auto dst2 = static_cast<char*>(dst); auto dst2 = static_cast<char*>(dst);
@ -184,6 +185,11 @@ namespace rsx
} }
} }
static auto tile_texel_data16 = tile_texel_data<u16, false>;
static auto tile_texel_data32 = tile_texel_data<u32, false>;
static auto detile_texel_data16 = tile_texel_data<u16, true>;
static auto detile_texel_data32 = tile_texel_data<u32, true>;
#undef RSX_TILE_WIDTH #undef RSX_TILE_WIDTH
#undef RSX_TILE_HEIGHT #undef RSX_TILE_HEIGHT
#undef RSX_DMA_OP_ENCODE_TILE #undef RSX_DMA_OP_ENCODE_TILE

7
rpcs3/Emu/RSX/Program/GLSLSnippets/RSXMemoryTiling.glsl
View file

@ -308,10 +308,11 @@ void do_memory_op(const in uint row, const in uint col)
tile_address ^= ((tile_address >> 11) & 1) << 10; tile_address ^= ((tile_address >> 11) & 1) << 10;
// Calculate relative addresses and sample // Calculate relative addresses and sample
uint linear_image_offset = (row * image_pitch) + (col * image_bpp); const uint linear_image_offset = (row * image_pitch) + (col * image_bpp);
uint tile_data_offset = tile_address - (tile_base_address + tile_offset); const uint tile_base_offset = tile_address - conf.tile_base_address; // Distance from tile base address
const uint tile_data_offset = tile_base_offset - conf.tile_offset; // Distance from data base address
if (tile_data_offset >= tile_size) if (tile_base_offset >= tile_size)
{ {
// Do not touch anything out of bounds // Do not touch anything out of bounds
return; return;