Module: Mesa
Branch: staging/21.0
Commit: ee858c68aacd6a4ebeed93466eebd2fa49435f00
URL:    
http://cgit.freedesktop.org/mesa/mesa/commit/?id=ee858c68aacd6a4ebeed93466eebd2fa49435f00

Author: Tony Wasserka <[email protected]>
Date:   Thu Mar  4 12:10:55 2021 +0100

radv: Fix improper max_index_count argument for indexed draws

Reviewed-by: Samuel Pitoiset <[email protected]>
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/3598
Cc: mesa-stable
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/9429>
(cherry picked from commit dad3cda66c88d253c2e8da7e344ff84c88ea15e7)

---

 .pick_status.json                |  2 +-
 src/amd/vulkan/radv_cmd_buffer.c | 17 +++++++++++++++--
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/.pick_status.json b/.pick_status.json
index 955e5679fdd..9c88fcfc650 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -886,7 +886,7 @@
         "description": "radv: Fix improper max_index_count argument for 
indexed draws",
         "nominated": true,
         "nomination_type": 0,
-        "resolution": 0,
+        "resolution": 1,
         "master_sha": null,
         "because_sha": null
     },
diff --git a/src/amd/vulkan/radv_cmd_buffer.c b/src/amd/vulkan/radv_cmd_buffer.c
index 6424255fd4e..fed82e930de 100644
--- a/src/amd/vulkan/radv_cmd_buffer.c
+++ b/src/amd/vulkan/radv_cmd_buffer.c
@@ -5269,13 +5269,21 @@ radv_cs_emit_draw_packet(struct radv_cmd_buffer 
*cmd_buffer,
                                    S_0287F0_USE_OPAQUE(use_opaque));
 }
 
+/**
+ * Emit a PKT3_DRAW_INDEX_2 packet to render "index_count` vertices.
+ *
+ * The starting address "index_va" may point anywhere within the index buffer. 
The number of
+ * indexes allocated in the index buffer *past that point* is specified by 
"max_index_count".
+ * Hardware uses this information to return 0 for out-of-bounds reads.
+ */
 static void
 radv_cs_emit_draw_indexed_packet(struct radv_cmd_buffer *cmd_buffer,
                                  uint64_t index_va,
+                                 uint32_t max_index_count,
                                  uint32_t index_count)
 {
        radeon_emit(cmd_buffer->cs, PKT3(PKT3_DRAW_INDEX_2, 4, 
cmd_buffer->state.predicating));
-       radeon_emit(cmd_buffer->cs, cmd_buffer->state.max_index_count);
+       radeon_emit(cmd_buffer->cs, max_index_count);
        radeon_emit(cmd_buffer->cs, index_va);
        radeon_emit(cmd_buffer->cs, index_va >> 32);
        radeon_emit(cmd_buffer->cs, index_count);
@@ -5402,10 +5410,13 @@ radv_emit_draw_packets(struct radv_cmd_buffer 
*cmd_buffer,
                        int index_size = 
radv_get_vgt_index_size(state->index_type);
                        uint64_t index_va;
 
+                       uint32_t remaining_indexes = 
cmd_buffer->state.max_index_count;
+                       remaining_indexes = MAX2(remaining_indexes, 
info->first_index) - info->first_index;
+
                        /* Skip draw calls with 0-sized index buffers. They
                         * cause a hang on some chips, like Navi10-14.
                         */
-                       if (!cmd_buffer->state.max_index_count)
+                       if (!remaining_indexes)
                                return;
 
                        index_va = state->index_va;
@@ -5414,6 +5425,7 @@ radv_emit_draw_packets(struct radv_cmd_buffer *cmd_buffer,
                        if (!state->subpass->view_mask) {
                                radv_cs_emit_draw_indexed_packet(cmd_buffer,
                                                                 index_va,
+                                                                
remaining_indexes,
                                                                 info->count);
                        } else {
                                unsigned i;
@@ -5422,6 +5434,7 @@ radv_emit_draw_packets(struct radv_cmd_buffer *cmd_buffer,
 
                                        
radv_cs_emit_draw_indexed_packet(cmd_buffer,
                                                                         
index_va,
+                                                                        
remaining_indexes,
                                                                         
info->count);
                                }
                        }

_______________________________________________
mesa-commit mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/mesa-commit

Reply via email to