From 31ea1923de1242f46512ecadbd9a100871377ede Mon Sep 17 00:00:00 2001 From: Jose Maria Casanova Crespo Date: Sun, 1 Mar 2026 23:58:49 +0100 Subject: [PATCH] v3d: reject fast TLB blit when RT formats don't match v3d_tlb_blit_fast includes the blit onto a pending job that writes to the source resource. The TLB data is already unpacked according to the job's RT format, so storing it with a different RT format performs a channel reinterpretation rather than a raw byte copy, corrupting the data. So when copying from RGB10_A2UI to RG16UI with glCopyImageSubData, the copy_image path remaps both formats to R16G16_UNORM for a raw 32-bit copy. The fast TLB blit found the pending clear job (RGB10_A2UI, 4 channels: 10-10-10-2) and stored its TLB data as RG16UI (2 channels: 16-16), writing the unpacked 10-bit R and G channel values into 16-bit fields instead of preserving the raw packed bits. Previous internal_type/bpp check was insufficient: both RGB10_A2UI and RG16UI share internal_type=16UI and the source bpp (64) exceeds the destination bpp (32), but their channel layouts are different. Add a check that the job's source surface RT format matches the blit destination RT format before allowing the fast path. Fixes: 66de8b4b5cbb ("v3d: add a faster TLB blit path") Reviewed-by: Iago Toral Quiroga (cherry picked from commit 5454221cfb77bf2e4c1729e9867a1e14166becbc) Part-of: --- .pick_status.json | 2 +- src/broadcom/ci/broadcom-rpi4-fails.txt | 10 ---------- src/broadcom/ci/broadcom-rpi5-fails.txt | 7 ------- src/gallium/drivers/v3d/v3d_blit.c | 10 ++++++++++ 4 files changed, 11 insertions(+), 18 deletions(-) diff --git a/.pick_status.json b/.pick_status.json index 6ad478e2e58..a0c52bbb6fe 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -2814,7 +2814,7 @@ "description": "v3d: reject fast TLB blit when RT formats don't match", "nominated": true, "nomination_type": 2, - "resolution": 0, + "resolution": 1, "main_sha": null, "because_sha": "66de8b4b5cbbb317130dde765201b5720394ed00", "notes": null diff --git a/src/broadcom/ci/broadcom-rpi4-fails.txt b/src/broadcom/ci/broadcom-rpi4-fails.txt index 28181240a1e..5ab0a5327c1 100644 --- a/src/broadcom/ci/broadcom-rpi4-fails.txt +++ b/src/broadcom/ci/broadcom-rpi4-fails.txt @@ -861,16 +861,6 @@ ubsan-dEQP-VK.image.mutable.2d_array.r16g16b16a16_sfloat_r16g16b16a16_uint_draw_ ubsan-dEQP-VK.image.mutable.2d_array.r32_uint_r8g8b8a8_sint_draw_copy_resolve_mutable_color_att,Fail ubsan-dEQP-VK.pipeline.monolithic.logic_op_na_formats.r16g16_sfloat.nand_blend,Fail -# New failures with ES CTS 3.2.13.0 -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16f.renderbuffer_to_texture2d,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16i.renderbuffer_to_renderbuffer,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16i.renderbuffer_to_texture2d,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16ui.renderbuffer_to_renderbuffer,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16ui.renderbuffer_to_texture2d,Fail -arm32-dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16f.renderbuffer_to_texture2d,Fail -arm32-dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16i.renderbuffer_to_texture2d,Fail -arm32-dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16ui.renderbuffer_to_texture2d,Fail - # SKQP failing tests ES2BlendWithNoTexture,Fail SRGBReadWritePixels,Fail diff --git a/src/broadcom/ci/broadcom-rpi5-fails.txt b/src/broadcom/ci/broadcom-rpi5-fails.txt index 25cffce3fdc..698a7450a78 100644 --- a/src/broadcom/ci/broadcom-rpi5-fails.txt +++ b/src/broadcom/ci/broadcom-rpi5-fails.txt @@ -701,13 +701,6 @@ dEQP-VK.binding_model.unused_invalid_descriptor.write.unused.storage_buffer,Cras dEQP-VK.binding_model.unused_invalid_descriptor.write.unused.uniform_buffer,Crash asan-dEQP-VK.binding_model.unused_invalid_descriptor.write.invalid.combined_image_sampler,Crash -# New failures with ES CTS 3.2.13.0 -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16f.renderbuffer_to_texture2d,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16i.renderbuffer_to_renderbuffer,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16i.renderbuffer_to_texture2d,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16ui.renderbuffer_to_renderbuffer,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16ui.renderbuffer_to_texture2d,Fail - # SKQP failing tests ES2BlendWithNoTexture,Fail SRGBReadWritePixels,Fail diff --git a/src/gallium/drivers/v3d/v3d_blit.c b/src/gallium/drivers/v3d/v3d_blit.c index e2a6e8a540c..ca9fc66cd3d 100644 --- a/src/gallium/drivers/v3d/v3d_blit.c +++ b/src/gallium/drivers/v3d/v3d_blit.c @@ -470,6 +470,16 @@ v3d_tlb_blit_fast(struct pipe_context *pctx, struct pipe_blit_info *info) if (sinternal_type != rinternal_type) return; + /* If the blit destination uses a different RT format the channel + * layout won't match and we would corrupt the data (e.g. storing + * 10-10-10-2 channels as 16-16). + */ + if (v3d_get_rt_format(devinfo, spsurf->format) != + v3d_get_rt_format(devinfo, dbuf.format)) { + pipe_resource_reference(&dbuf.texture, NULL); + return; + } + MESA_TRACE_FUNC(); /* If we had any other jobs writing to the blit dst we should submit