nvc0: set rsvd_kick correctly

This prevents trampling beyond the end of the command stream during flushes.

NOTE: This is a candidate for the stable branches.

Reported-by: Christoph Bumiller <christoph.bumiller@speed.at>
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
(cherry picked from commit e72cc26518d8a60093ac497bf680c1f4ba614fa9)
intel: Fix MRT handling of glBitmap().

We'd only hit color buffer 0 even if multiple draw buffers were bound.

NOTE: This is a candidate for the stable branches.

Reviewed-and-tested-by: Ian Romanick <ian.d.romanick@intel.com>
Acked-by: Paul Berry <stereotype441@gmail.com>
(cherry picked from commit 1cb8de6fff24743e479e17f023bd3a7b455b756f)
intel: Fix format handling of blit glBitmap()

Any 32-bit format got ARGB8888 handling (including, say, GL_RG1616), and
anything else got 16-bit (including, say, GL_R8), which could potentially
hang the GPU by writing out of bounds.

NOTE: This is a candidate for the stable branches.

Reviewed-and-tested-by: Ian Romanick <ian.d.romanick@intel.com>
Acked-by: Paul Berry <stereotype441@gmail.com>
(cherry picked from commit 0a39cb88deee338de3c82db2e70594f11ee1cc8d)
gallivm: fix out-of-bounds access with mirror_clamp_to_edge address mode

Surprising this bug survived so long, we were missing a clamp (in the
linear filtering version).
(Valgrind complained a lot about invalid reads with piglit texwrap,
I've also seen spurios failures in this test which might have
happened due to this. Valgrind probably didn't complain before the
alignment reduction in llvmpipe to 4x4 since the test is using tiny
textures so the reads were still always well within allocated area.)
While here, also do an effective clamp (after half subtraction)
of [0,length-0.5] instead of [0, length-1] which saves an instruction
(the filtering weight could be different due to this, but only if
both texels point to the same max texel so it doesn't matter).
(Both changes are borrowed from PIPE_TEX_CLAMP_TO_EDGE case.)

Note: This is a candidate for the stable branches.

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
(cherry picked from commit 458a9a0f85b93e3520c33dd3b502e26a31f08e4b)
meta: move vertex array enables for mipmap generation

Before, on the second call to GenerateMipmap we were enabling two
vertex arrays for the current vertex array object, rather than
the private generate-mipmap vertex array object.  This caused
things to blow up elsewhere.

This patch moves the array enables into the block where the
generate-mipmap vertex array object is created, as we do in
the setup_ff_generate_mipmap() function.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=60518
NOTE: This is a candidate for the stable branches.

Tested-by: core13@gmx.net
Reviewed-by: José Fonseca <jfonseca@vmware.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
(cherry picked from commit dcc5b6bfb79261779d85325239d75a2e1f3bec37)
mesa: handle missing read buffer in _mesa_get_color_read_format/type()

We were crashing when GL_READ_BUFFER == GL_NONE.  Check for NULL
pointers and reorganize the code.  The spec doesn't say which error
to generate in this situation, but NVIDIA raises GL_INVALID_OPERATION.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=65173
NOTE: This is a candidate for the stable branches.

Tested-by: Vedran Rodic <vrodic@gmail.com>
Reviewed-by: José Fonseca <jfonseca@vmware.com>
(cherry picked from commit e20a2df4017ab10dd7199936948c6ac809bfacb6)
i965: Fix glColorPointer(GL_FIXED)

When a gl_client_array is created with glColorPointer,
gl_client_array::Normalized is true. This caused the translation from the
gl_client_array's type to a BRW_SURFACEFORMAT to assertion fail.

Fixes the spinning cube's color in Android 4.2's ApiDemos.apk,
"Graphics > OpenGL ES".

Fixes assertion failure in mesa-demos/src/egl/opengles1/tri_x11 on Haswell
and Ivybridge:
  brw_draw_upload.c:287: get_surface_type: Assertion `0' failed.

No Piglit regressions on Haswell.

Note: This is a candidate for the 9.1 branch.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=42182
Issue: AXIA-2954
Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
Signed-off-by: Chad Versace <chad.versace@linux.intel.com>
(cherry picked from commit 7a9f4d3e7114ca709658a620644ad897bdda41e7)
i965: fix problem with constant out of bounds access (v3)

Okay I now understand why Frank would want to run away, this is
my attempt at fixing the CVE out of bounds access to constants
outside the range. This attempt converts any illegal constants
to constant 0 as per the GL spec, and is undefined behaviour.

A future patch should add some debug for users to find this out,
but this needs to be backported to stable branches.

CVE-2013-1872

v2: drop the last hunk which was a separate fix (now in master).
hopefully fix the indentations.

v3: don't fail piglit, the whole 8/16 dispatch stuff was over
my head, and I spent a while figuring it out, but this one is
definitely safe, one piglit pass extra on my Ironlake.

NOTE: This is a candidate for stable branches.

Signed-off-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit 0677ea063cd96adefe87c1fb01ef7c66d905535b)
st/xlib: Fix upside down coordinates for CopySubBuffer

The coordinates need to be inverted between glX and gallium.

NOTE: This is a candidate for stable release branches.

Reviewed-by: Brian Paul <brianp@vmware.com>
(cherry picked from commit 4e5416b0e2e0aedbed48acabe31a68fe1b37b61a)
st/xlib: Flush the front buffer before doing CopySubBuffer

We flush pending rendering before running CopySubBuffer, which
ensures that the right bits get to the screen.

NOTE: This is a candidate for stable release branches.

Reviewed-by: Brian Paul <brianp@vmware.com>
(cherry picked from commit 4f905d4900ea962876eb5933dd00d4b251767f71)
scons: Fix implicit python dependency discovery on Windows.

Probably due to CRLF endings, the discovery of python import statements
was not working on Windows builds, causing incremental builds to often
fail unless one wiped out the build directory.

NOTE: This is a candidate for stable branches.
(cherry picked from commit 0aca2c6b608b80661cb8fd35eb08195ab95743f5)
glsl: Bail on parsing if the #version directive is bogus.

If we didn't successfully parse the #version line, there's no point in
continuing with parsing and compiling: it's already failed.

Furthermore, it can actually be harmful: right after handling #version,
we call _mesa_glsl_initialize_types(), which checks state->es_shader and
language_version.  If it isn't valid, it hits an assertion failure.

Fixes Piglit's "invalid-version-es."  When processing "#version 110 es",
our code set state->es_shader and state->language_version = 110.  It
then properly determined that this was invalid and flagged an error.
Since we continued anyway, we hit the assertion mentioned above.

NOTE: This is a candidate for the 9.1 branch.

Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
(cherry picked from commit f730b1f72a13aa1e749beeb50f8e8c5929bf2c45)
winsys/radeon: add env var to disable VM on Cayman/Trinity

Set env var RADEON_VA=0 to disable VM on Cayman/Trinity.
Useful for debugging.

Note: this is a candidate for the 9.1 branch.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Tom Stellard <thomas.stellard@amd.com>
Reviewed-by: Marek Olšák <maraeo@gmail.com>
(cherry picked from commit 761320b197ecc87221d070f5e961032ab0b665a4)
i965: Shut up the last release build warning.

I don't see a sensible value to use in this path, but we shouldn't ever
hit this outside of developer new-texture-target enabling.

Reviewed-by: Matt Turner <mattst88@gmail.com>
(cherry picked from commit 1658efc42cc6a8a32fde222b74f052f4f7b1434a)
intel: Add a null pointer check before dereferencing the pointer

Reviewed-by: Jordan Justen <jordan.l.justen@intel.com>
Reviewed-by: Matt Turner <mattst88@gmail.com>
(cherry picked from commit 484b89ace99cb34719ff79c6aab1658bb8f3dc79)
mesa: Fix ieee fp on Alpha

Commit 1f82bf12ed inadvertently broke it, checking for __IEEE_FLOAT on all
Alpha machines instead of only on VMS as before.

NOTE: This is a candidate for the 9.1 branch.

Reviewed-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Andreas Boll <andreas.boll.dev@gmail.com>
Signed-off-by: Sven Joachim <svenjoac@gmx.de>
(cherry picked from commit 0829b893a9e9c874c0ef80d343af49334305e32e)