From 5454221cfb77bf2e4c1729e9867a1e14166becbc Mon Sep 17 00:00:00 2001 From: Jose Maria Casanova Crespo Date: Sun, 1 Mar 2026 23:58:49 +0100 Subject: [PATCH] v3d: reject fast TLB blit when RT formats don't match v3d_tlb_blit_fast includes the blit onto a pending job that writes to the source resource. The TLB data is already unpacked according to the job's RT format, so storing it with a different RT format performs a channel reinterpretation rather than a raw byte copy, corrupting the data. So when copying from RGB10_A2UI to RG16UI with glCopyImageSubData, the copy_image path remaps both formats to R16G16_UNORM for a raw 32-bit copy. The fast TLB blit found the pending clear job (RGB10_A2UI, 4 channels: 10-10-10-2) and stored its TLB data as RG16UI (2 channels: 16-16), writing the unpacked 10-bit R and G channel values into 16-bit fields instead of preserving the raw packed bits. Previous internal_type/bpp check was insufficient: both RGB10_A2UI and RG16UI share internal_type=16UI and the source bpp (64) exceeds the destination bpp (32), but their channel layouts are different. Add a check that the job's source surface RT format matches the blit destination RT format before allowing the fast path. Fixes: 66de8b4b5cbb ("v3d: add a faster TLB blit path") Reviewed-by: Iago Toral Quiroga Part-of: --- src/broadcom/ci/broadcom-rpi4-fails.txt | 10 ---------- src/broadcom/ci/broadcom-rpi5-fails.txt | 9 --------- src/gallium/drivers/v3d/v3d_blit.c | 10 ++++++++++ 3 files changed, 10 insertions(+), 19 deletions(-) diff --git a/src/broadcom/ci/broadcom-rpi4-fails.txt b/src/broadcom/ci/broadcom-rpi4-fails.txt index 5f4dd70016f..8b063dbf9ea 100644 --- a/src/broadcom/ci/broadcom-rpi4-fails.txt +++ b/src/broadcom/ci/broadcom-rpi4-fails.txt @@ -756,16 +756,6 @@ ubsan-dEQP-VK.image.mutable.2d_array.r16g16_sfloat_r32_uint_draw_copy_resolve_mu ubsan-dEQP-VK.image.mutable.2d_array.r16g16b16a16_sfloat_r16g16b16a16_uint_draw_copy_resolve_mutable_resolve_att,Fail ubsan-dEQP-VK.image.mutable.2d_array.r32_uint_r8g8b8a8_sint_draw_copy_resolve_mutable_color_att,Fail -# New failures with ES CTS 3.2.13.0 -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16f.renderbuffer_to_texture2d,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16i.renderbuffer_to_renderbuffer,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16i.renderbuffer_to_texture2d,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16ui.renderbuffer_to_renderbuffer,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16ui.renderbuffer_to_texture2d,Fail -arm32-dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16f.renderbuffer_to_texture2d,Fail -arm32-dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16i.renderbuffer_to_texture2d,Fail -arm32-dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16ui.renderbuffer_to_texture2d,Fail - # SKQP failing tests ES2BlendWithNoTexture,Fail SRGBReadWritePixels,Fail diff --git a/src/broadcom/ci/broadcom-rpi5-fails.txt b/src/broadcom/ci/broadcom-rpi5-fails.txt index 0208c81e156..d8cb90b940b 100644 --- a/src/broadcom/ci/broadcom-rpi5-fails.txt +++ b/src/broadcom/ci/broadcom-rpi5-fails.txt @@ -607,15 +607,6 @@ dEQP-VK.binding_model.unused_invalid_descriptor.write.unused.storage_buffer,Cras dEQP-VK.binding_model.unused_invalid_descriptor.write.unused.uniform_buffer,Crash asan-dEQP-VK.binding_model.unused_invalid_descriptor.write.invalid.combined_image_sampler,Crash -# New failures with ES CTS 3.2.13.0 -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16f.renderbuffer_to_texture2d,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16i.renderbuffer_to_renderbuffer,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16i.renderbuffer_to_texture2d,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16ui.renderbuffer_to_renderbuffer,Fail -dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16ui.renderbuffer_to_texture2d,Fail -asan-dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16f.renderbuffer_to_texture2d,Fail -asan-dEQP-GLES31.functional.copy_image.non_compressed.viewclass_32_bits.rgb10_a2ui_rg16i.renderbuffer_to_texture2d,Fail - # SKQP failing tests ES2BlendWithNoTexture,Fail SRGBReadWritePixels,Fail diff --git a/src/gallium/drivers/v3d/v3d_blit.c b/src/gallium/drivers/v3d/v3d_blit.c index 95d34dbd34b..1f36c508f26 100644 --- a/src/gallium/drivers/v3d/v3d_blit.c +++ b/src/gallium/drivers/v3d/v3d_blit.c @@ -471,6 +471,16 @@ v3d_tlb_blit_fast(struct pipe_context *pctx, struct pipe_blit_info *info) return; } + /* If the blit destination uses a different RT format the channel + * layout won't match and we would corrupt the data (e.g. storing + * 10-10-10-2 channels as 16-16). + */ + if (v3d_get_rt_format(devinfo, spsurf->format) != + v3d_get_rt_format(devinfo, dbuf.format)) { + pipe_resource_reference(&dbuf.texture, NULL); + return; + } + MESA_TRACE_FUNC(); /* If we had any other jobs writing to the blit dst we should submit