[Mesa-stable] [Mesa-dev] [PATCH 2/2] i965/vec4: Clamp indirect tes input array reads with 0x0fffffff

[Jason Ekstrand]

Have you seen this cause an actual problem?  There's no way we can actually
end up with an input array that big...  I guess this is for the crazy OOB
case?

On Wed, Aug 29, 2018 at 3:12 PM Ian Romanick <idr at freedesktop.org> wrote:

> From: Ian Romanick <ian.d.romanick at intel.com>
>
> Page 190 of "Volume 7: 3D Media GPGPU Engine (Haswell)" says the valid
> range of the offset is [0, 0FFFFFFFh].
>
> Signed-off-by: Ian Romanick <ian.d.romanick at intel.com>
> Cc: mesa-stable at lists.freedesktop.org
> Cc: Kenneth Graunke <kenneth at whitecape.org>
> ---
>  src/intel/compiler/brw_vec4_tes.cpp | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/src/intel/compiler/brw_vec4_tes.cpp
> b/src/intel/compiler/brw_vec4_tes.cpp
> index 35aff0f4b78..cf1bff42aa9 100644
> --- a/src/intel/compiler/brw_vec4_tes.cpp
> +++ b/src/intel/compiler/brw_vec4_tes.cpp
> @@ -185,9 +185,19 @@
> vec4_tes_visitor::nir_emit_intrinsic(nir_intrinsic_instr *instr)
>           first_component /= 2;
>
>        if (indirect_offset.file != BAD_FILE) {
> +         src_reg clamped_indirect_offset = src_reg(this,
> glsl_type::uvec4_type);
> +
> +         /* Page 190 of "Volume 7: 3D Media GPGPU Engine (Haswell)" says
> the
> +          * valid range of the offset is [0, 0FFFFFFFh].
> +          */
> +         emit_minmax(BRW_CONDITIONAL_L,
> +                     dst_reg(clamped_indirect_offset),
> +                     retype(indirect_offset, BRW_REGISTER_TYPE_UD),
> +                     brw_imm_ud(0x0fffffffu));
> +
>           header = src_reg(this, glsl_type::uvec4_type);
>           emit(TES_OPCODE_ADD_INDIRECT_URB_OFFSET, dst_reg(header),
> -              input_read_header, indirect_offset);
> +              input_read_header, clamped_indirect_offset);
>        } else {
>           /* Arbitrarily only push up to 24 vec4 slots worth of data,
>            * which is 12 registers (since each holds 2 vec4 slots).
> --
> 2.14.4
>
> _______________________________________________
> mesa-dev mailing list
> mesa-dev at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/mesa-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/mesa-stable/attachments/20180829/b6bace3d/attachment-0001.html>