From e00da334748d2a61c0063c94fa6166533d878057 Mon Sep 17 00:00:00 2001
From: Iago Toral Quiroga <itoral@igalia.com>
Date: Mon, 27 May 2024 13:43:51 +0200
Subject: [PATCH] v3dv: use pSizes paramater in vkCmdBindVertexBuffers2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We can use this to specify the maximum vertex index that can
be accessed, which the hardware will use to detect and prevent
out-of-bounds accesses to vertex buffers.

Reviewed-by: Alejandro Piñeiro <apinheiro@igalia.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/29425>
---
 src/broadcom/vulkan/v3dv_cmd_buffer.c  | 19 +++++++++++++++++--
 src/broadcom/vulkan/v3dv_private.h     |  1 +
 src/broadcom/vulkan/v3dvx_cmd_buffer.c |  4 +++-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/src/broadcom/vulkan/v3dv_cmd_buffer.c b/src/broadcom/vulkan/v3dv_cmd_buffer.c
index d7e974b38b5..ed5e118a0b4 100644
--- a/src/broadcom/vulkan/v3dv_cmd_buffer.c
+++ b/src/broadcom/vulkan/v3dv_cmd_buffer.c
@@ -3465,16 +3465,31 @@ v3dv_CmdBindVertexBuffers2(VkCommandBuffer commandBuffer,
       if (BITSET_TEST(dyn->dirty, MESA_VK_DYNAMIC_VI_BINDING_STRIDES))
          vb_state_changed = true;
    }
-   /* FIXME: at this moment we don't do any thing with pSizes. */
+
    for (uint32_t i = 0; i < bindingCount; i++) {
-      if (vb[firstBinding + i].buffer != v3dv_buffer_from_handle(pBuffers[i])) {
+      struct v3dv_buffer *buffer = v3dv_buffer_from_handle(pBuffers[i]);
+      if (vb[firstBinding + i].buffer != buffer) {
          vb[firstBinding + i].buffer = v3dv_buffer_from_handle(pBuffers[i]);
          vb_state_changed = true;
       }
+
       if (vb[firstBinding + i].offset != pOffsets[i]) {
          vb[firstBinding + i].offset = pOffsets[i];
          vb_state_changed = true;
       }
+      assert(pOffsets[i] <= buffer->size);
+
+      VkDeviceSize size;
+      if (!pSizes || pSizes[i] == VK_WHOLE_SIZE)
+         size = buffer->size - pOffsets[i];
+      else
+         size = pSizes[i];
+      assert(pOffsets[i] + size <= buffer->size);
+
+      if (vb[firstBinding + i].size != size) {
+         vb[firstBinding + i].size = size;
+         vb_state_changed = true;
+      }
    }
 
    if (vb_state_changed)
diff --git a/src/broadcom/vulkan/v3dv_private.h b/src/broadcom/vulkan/v3dv_private.h
index 15f57fee62b..464f3bce233 100644
--- a/src/broadcom/vulkan/v3dv_private.h
+++ b/src/broadcom/vulkan/v3dv_private.h
@@ -1389,6 +1389,7 @@ struct v3dv_draw_info {
 struct v3dv_vertex_binding {
    struct v3dv_buffer *buffer;
    VkDeviceSize offset;
+   VkDeviceSize size;
 };
 
 struct v3dv_descriptor_state {
diff --git a/src/broadcom/vulkan/v3dvx_cmd_buffer.c b/src/broadcom/vulkan/v3dvx_cmd_buffer.c
index 51189f4042c..0b2df2c9def 100644
--- a/src/broadcom/vulkan/v3dvx_cmd_buffer.c
+++ b/src/broadcom/vulkan/v3dvx_cmd_buffer.c
@@ -2620,7 +2620,9 @@ v3dX(cmd_buffer_emit_gl_shader_state)(struct v3dv_cmd_buffer *cmd_buffer)
 
          attr.stride =
             cmd_buffer->vk.dynamic_graphics_state.vi_binding_strides[binding];
-         attr.maximum_index = 0xffffff;
+
+         attr.maximum_index = attr.stride == 0 ?
+                              1u : MIN2(0xffffffu, c_vb->size / attr.stride);
       }
 
       emitted_va_count++;