Mesa (staging/21.0): radv: Fix improper max_index_count argument for indexed draws

[GitLab Mirror]

Module: Mesa
Branch: staging/21.0
Commit: ee858c68aacd6a4ebeed93466eebd2fa49435f00
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=ee858c68aacd6a4ebeed93466eebd2fa49435f00

Author: Tony Wasserka <tony.wasserka at gmx.de>
Date:   Thu Mar  4 12:10:55 2021 +0100

radv: Fix improper max_index_count argument for indexed draws

Reviewed-by: Samuel Pitoiset <samuel.pitoiset at gmail.com>
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/3598
Cc: mesa-stable
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/9429>
(cherry picked from commit dad3cda66c88d253c2e8da7e344ff84c88ea15e7)

---

 .pick_status.json                |  2 +-
 src/amd/vulkan/radv_cmd_buffer.c | 17 +++++++++++++++--
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/.pick_status.json b/.pick_status.json
index 955e5679fdd..9c88fcfc650 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -886,7 +886,7 @@
         "description": "radv: Fix improper max_index_count argument for indexed draws",
         "nominated": true,
         "nomination_type": 0,
-        "resolution": 0,
+        "resolution": 1,
         "master_sha": null,
         "because_sha": null
     },
diff --git a/src/amd/vulkan/radv_cmd_buffer.c b/src/amd/vulkan/radv_cmd_buffer.c
index 6424255fd4e..fed82e930de 100644
--- a/src/amd/vulkan/radv_cmd_buffer.c
+++ b/src/amd/vulkan/radv_cmd_buffer.c
@@ -5269,13 +5269,21 @@ radv_cs_emit_draw_packet(struct radv_cmd_buffer *cmd_buffer,
 	                            S_0287F0_USE_OPAQUE(use_opaque));
 }
 
+/**
+ * Emit a PKT3_DRAW_INDEX_2 packet to render "index_count` vertices.
+ *
+ * The starting address "index_va" may point anywhere within the index buffer. The number of
+ * indexes allocated in the index buffer *past that point* is specified by "max_index_count".
+ * Hardware uses this information to return 0 for out-of-bounds reads.
+ */
 static void
 radv_cs_emit_draw_indexed_packet(struct radv_cmd_buffer *cmd_buffer,
                                  uint64_t index_va,
+                                 uint32_t max_index_count,
                                  uint32_t index_count)
 {
 	radeon_emit(cmd_buffer->cs, PKT3(PKT3_DRAW_INDEX_2, 4, cmd_buffer->state.predicating));
-	radeon_emit(cmd_buffer->cs, cmd_buffer->state.max_index_count);
+	radeon_emit(cmd_buffer->cs, max_index_count);
 	radeon_emit(cmd_buffer->cs, index_va);
 	radeon_emit(cmd_buffer->cs, index_va >> 32);
 	radeon_emit(cmd_buffer->cs, index_count);
@@ -5402,10 +5410,13 @@ radv_emit_draw_packets(struct radv_cmd_buffer *cmd_buffer,
 			int index_size = radv_get_vgt_index_size(state->index_type);
 			uint64_t index_va;
 
+ 			uint32_t remaining_indexes = cmd_buffer->state.max_index_count;
+ 			remaining_indexes = MAX2(remaining_indexes, info->first_index) - info->first_index;
+
 			/* Skip draw calls with 0-sized index buffers. They
 			 * cause a hang on some chips, like Navi10-14.
 			 */
-			if (!cmd_buffer->state.max_index_count)
+			if (!remaining_indexes)
 				return;
 
 			index_va = state->index_va;
@@ -5414,6 +5425,7 @@ radv_emit_draw_packets(struct radv_cmd_buffer *cmd_buffer,
 			if (!state->subpass->view_mask) {
 				radv_cs_emit_draw_indexed_packet(cmd_buffer,
 								 index_va,
+ 								 remaining_indexes,
 								 info->count);
 			} else {
 				unsigned i;
@@ -5422,6 +5434,7 @@ radv_emit_draw_packets(struct radv_cmd_buffer *cmd_buffer,
 
 					radv_cs_emit_draw_indexed_packet(cmd_buffer,
 									 index_va,
+ 									 remaining_indexes,
 									 info->count);
 				}
 			}