archive/rpcs3
1
0
Fork 0
mirror of https://github.com/RPCS3/rpcs3.git synced 2025-07-16 03:38:38 +12:00
Code Issues Projects Releases Packages Wiki Activity Actions

sys_rsx: More error checks for ZCULL area binding

Browse source 
And clamp zcull offset to 256MB, it's unknown if only the error check clamps or it is clamped entirely.
This commit is contained in:
Eladash 2020-04-18 22:26:41 +03:00 • committed by Ani
parent b94e4247cc
commit 8c747bf0a2
1 changed files with 17 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

22
rpcs3/Emu/Cell/lv2/sys_rsx.cpp
View file

@ -650,16 +650,28 @@ error_code sys_rsx_context_attribute(u32 context_id, u32 package_id, u64 a3, u64
sys_rsx.warning("sys_rsx_context_attribute(): RSX is not idle while setting zcull"); sys_rsx.warning("sys_rsx_context_attribute(): RSX is not idle while setting zcull");
} }
const u32 offset = (a5 & 0xFFFFFFFF); const u32 width = ((a4 & 0xFFFFFFFF) >> 22) << 6;
const u32 height = ((a4 & 0xFFFFFFFF) >> 6) << 6;
const u32 cullStart = (a5 >> 32) & ~0xFFF;
const u32 offset = (a5 & 0x0FFFFFFF);
const bool bound = (a6 & 0xFFFFFFFF) != 0; const bool bound = (a6 & 0xFFFFFFFF) != 0;
if (bound) if (bound)
{ {
if (offset >= render->local_mem_size) const auto cull_range = utils::address_range::start_length(cullStart, width * height);
// cullStart is an offset inside ZCULL RAM which is 3MB long, check bounds
// width and height are not allowed to be zero (checked by range.valid())
if (!cull_range.valid() || cull_range.end >= 3u << 20 || offset >= render->local_mem_size)
{ {
return CELL_EINVAL; return CELL_EINVAL;
} }
if (a5 & 0xF0000000)
{
sys_rsx.warning("sys_rsx_context_attribute(): ZCULL offset greater than 256MB (offset=0x%x)", offset);
}
// Hardcoded values in gcm // Hardcoded values in gcm
verify(HERE), !!(a4 & (1ull << 32)), (a6 & 0xFFFFFFFF) == 0u + ((0x2000 << 0) | (0x20 << 16)); verify(HERE), !!(a4 & (1ull << 32)), (a6 & 0xFFFFFFFF) == 0u + ((0x2000 << 0) | (0x20 << 16));
} }
@ -670,9 +682,9 @@ error_code sys_rsx_context_attribute(u32 context_id, u32 package_id, u64 a3, u64
zcull.zFormat = ((a4 >> 32) >> 4) & 0xF; zcull.zFormat = ((a4 >> 32) >> 4) & 0xF;
zcull.aaFormat = ((a4 >> 32) >> 8) & 0xF; zcull.aaFormat = ((a4 >> 32) >> 8) & 0xF;
zcull.width = ((a4 & 0xFFFFFFFF) >> 22) << 6; zcull.width = width;
zcull.height = (((a4 & 0xFFFFFFFF) >> 6) & 0xFF) << 6; zcull.height = height;
zcull.cullStart = (a5 >> 32); zcull.cullStart = cullStart;
zcull.offset = offset; zcull.offset = offset;
zcull.zcullDir = ((a6 >> 32) >> 1) & 0x1; zcull.zcullDir = ((a6 >> 32) >> 1) & 0x1;
zcull.zcullFormat = ((a6 >> 32) >> 2) & 0x3FF; zcull.zcullFormat = ((a6 >> 32) >> 2) & 0x3FF;