Mesa (master): i965: Implement bounds checking for transform feedback output.

[Paul Berry]

Module: Mesa
Branch: master
Commit: 21504b462acda4977c5fdfffc192e73273b8fb26
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=21504b462acda4977c5fdfffc192e73273b8fb26

Author: Kenneth Graunke <kenneth at whitecape.org>
Date:   Tue Dec 13 22:53:53 2011 -0800

i965: Implement bounds checking for transform feedback output.

Signed-off-by: Kenneth Graunke <kenneth at whitecape.org>
Reviewed-by: Paul Berry <stereotype441 at gmail.com>

---

 src/mesa/drivers/dri/i965/brw_context.c |    1 +
 src/mesa/drivers/dri/i965/brw_context.h |    3 ++
 src/mesa/drivers/dri/i965/brw_gs_emit.c |   10 ++++++++
 src/mesa/drivers/dri/i965/gen6_sol.c    |   38 +++++++++++++++++++++++++++++++
 4 files changed, 52 insertions(+), 0 deletions(-)

diff --git a/src/mesa/drivers/dri/i965/brw_context.c b/src/mesa/drivers/dri/i965/brw_context.c
index 2096be9..f5c9d7a 100644
--- a/src/mesa/drivers/dri/i965/brw_context.c
+++ b/src/mesa/drivers/dri/i965/brw_context.c
@@ -117,6 +117,7 @@ static void brwInitDriverFunctions( struct dd_function_table *functions )
    brw_init_queryobj_functions(functions);
 
    functions->PrepareExecBegin = brwPrepareExecBegin;
+   functions->BeginTransformFeedback = brw_begin_transform_feedback;
    functions->EndTransformFeedback = brw_end_transform_feedback;
 }
 
diff --git a/src/mesa/drivers/dri/i965/brw_context.h b/src/mesa/drivers/dri/i965/brw_context.h
index 6fa71a3..e8ebea8 100644
--- a/src/mesa/drivers/dri/i965/brw_context.h
+++ b/src/mesa/drivers/dri/i965/brw_context.h
@@ -1078,6 +1078,9 @@ brw_fprog_uses_noperspective(const struct gl_fragment_program *fprog);
 
 /* gen6_sol.c */
 void
+brw_begin_transform_feedback(struct gl_context *ctx, GLenum mode,
+			     struct gl_transform_feedback_object *obj);
+void
 brw_end_transform_feedback(struct gl_context *ctx,
                            struct gl_transform_feedback_object *obj);
 
diff --git a/src/mesa/drivers/dri/i965/brw_gs_emit.c b/src/mesa/drivers/dri/i965/brw_gs_emit.c
index 3062c33..269a495 100644
--- a/src/mesa/drivers/dri/i965/brw_gs_emit.c
+++ b/src/mesa/drivers/dri/i965/brw_gs_emit.c
@@ -337,6 +337,15 @@ gen6_sol_program(struct brw_gs_compile *c, struct brw_gs_prog_key *key,
        */
       brw_MOV(p, get_element_ud(c->reg.header, 5),
               get_element_ud(c->reg.SVBI, 0));
+
+      /* Make sure that the buffers have enough room for all the vertices. */
+      brw_ADD(p, get_element_ud(c->reg.temp, 0),
+	         get_element_ud(c->reg.SVBI, 0), brw_imm_ud(num_verts));
+      brw_CMP(p, vec1(brw_null_reg()), BRW_CONDITIONAL_LE,
+	         get_element_ud(c->reg.temp, 0),
+	         get_element_ud(c->reg.SVBI, 4));
+      brw_IF(p, BRW_EXECUTE_1);
+
       /* For each vertex, generate code to output each varying using the
        * appropriate binding table entry.
        */
@@ -377,6 +386,7 @@ gen6_sol_program(struct brw_gs_compile *c, struct brw_gs_prog_key *key,
                     get_element_ud(c->reg.header, 5), brw_imm_ud(1));
          }
       }
+      brw_ENDIF(p);
 
       /* Now, reinitialize the header register from R0 to restore the parts of
        * the register that we overwrote while streaming out transform feedback
diff --git a/src/mesa/drivers/dri/i965/gen6_sol.c b/src/mesa/drivers/dri/i965/gen6_sol.c
index 38aedcc..2f2051b 100644
--- a/src/mesa/drivers/dri/i965/gen6_sol.c
+++ b/src/mesa/drivers/dri/i965/gen6_sol.c
@@ -26,6 +26,7 @@
  * Code to initialize the binding table entries used by transform feedback.
  */
 
+#include "main/macros.h"
 #include "brw_context.h"
 #include "intel_batchbuffer.h"
 #include "brw_defines.h"
@@ -72,6 +73,43 @@ const struct brw_tracked_state gen6_sol_surface = {
 };
 
 void
+brw_begin_transform_feedback(struct gl_context *ctx, GLenum mode,
+			     struct gl_transform_feedback_object *obj)
+{
+   struct intel_context *intel = intel_context(ctx);
+   const struct gl_shader_program *vs_prog =
+      ctx->Shader.CurrentVertexProgram;
+   const struct gl_transform_feedback_info *linked_xfb_info =
+      &vs_prog->LinkedTransformFeedback;
+   struct gl_transform_feedback_object *xfb_obj =
+      ctx->TransformFeedback.CurrentObject;
+
+   unsigned max_index = 0xffffffff;
+
+   /* Compute the maximum number of vertices that we can write without
+    * overflowing any of the buffers currently being used for feedback.
+    */
+   for (int i = 0; i < BRW_MAX_SOL_BUFFERS; ++i) {
+      unsigned stride = linked_xfb_info->BufferStride[i];
+
+      /* Skip any inactive buffers, which have a stride of 0. */
+      if (stride == 0)
+	 continue;
+
+      unsigned max_for_this_buffer = xfb_obj->Size[i] / (4 * stride);
+      max_index = MIN2(max_index, max_for_this_buffer);
+   }
+
+   /* Initialize the SVBI 0 register to zero and set the maximum index. */
+   BEGIN_BATCH(4);
+   OUT_BATCH(_3DSTATE_GS_SVB_INDEX << 16 | (4 - 2));
+   OUT_BATCH(0); /* SVBI 0 */
+   OUT_BATCH(0);
+   OUT_BATCH(max_index);
+   ADVANCE_BATCH();
+}
+
+void
 brw_end_transform_feedback(struct gl_context *ctx,
                            struct gl_transform_feedback_object *obj)
 {