mirror of
https://gitlab.freedesktop.org/mesa/mesa.git
synced 2026-05-21 13:18:09 +02:00
3eb7575679
This is the most serious bug we've had in a long time due to a fundamental misunderstanding of the hardware (due to incomplete reverse-engineering). It caught me off guard. The texture descriptor has "mode" bits which configure two aspects of how the address pointer is interpreted: * whether it is indirected, pointing to a secondary page table for sparse * whether it writes texture access counters (for Metal's idea of sparse). ...Neither of these is a "null texture" mode. So why did I see Apple's blob using a non-normal mode for null textures, and why did I copy those settings? 1. Because the hardware texture access counters provide a cheap way to detect null texture accesses after the fact, which I think their GPU debug tools use. I'm not sure why release builds of the driver do/did that, but whatever. 2. Because I assumed Cupertino knew best and I didn't bother looking too close. We can't use them here (without doing extra memory allocations), since then the GPU will increment access counters. And since our null texture address used to just be a pointer in the command buffer, that mean the GPU will trash whatever memory happened to be 0x400 bytes after the start of the null texture descriptor. The symptom being random faults. This bug was caught when trying to use the zero-page instead, which raised a permission fault when the GPU tried to write counts. Then I remembered the sparse mechanism and had a bit of a eureka moment. Immediately followed by an "oh, f#$&" moment as I realized how many random bugs could potentially be root caused to this. The fix is two-fold: 1. Use normal layout instead. 2. Set the address to the zero-page (which is a fixed VA) and detect null textures by checking the address, instead of the mode. The latter is a good idea anyway, but both parts needs to be done atomically to maintain bisectability. Backport-to: 25.1 Signed-off-by: Alyssa Rosenzweig <alyssa@rosenzweig.io> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/34703> |
||
|---|---|---|
| .. | ||
| tests | ||
| agx_abi.h | ||
| agx_bg_eot.c | ||
| agx_bg_eot.h | ||
| agx_bo.c | ||
| agx_bo.h | ||
| agx_border.c | ||
| agx_device.c | ||
| agx_device.h | ||
| agx_device_virtio.c | ||
| agx_device_virtio.h | ||
| agx_helpers.h | ||
| agx_linker.c | ||
| agx_linker.h | ||
| agx_nir_format_helpers.h | ||
| agx_nir_lower_gs.c | ||
| agx_nir_lower_gs.h | ||
| agx_nir_lower_ia.c | ||
| agx_nir_lower_msaa.c | ||
| agx_nir_lower_sample_intrinsics.c | ||
| agx_nir_lower_tess.c | ||
| agx_nir_lower_tilebuffer.c | ||
| agx_nir_lower_uvs.c | ||
| agx_nir_lower_vbo.c | ||
| agx_nir_lower_vbo.h | ||
| agx_nir_prolog_epilog.c | ||
| agx_ppp.h | ||
| agx_scratch.c | ||
| agx_scratch.h | ||
| agx_tilebuffer.c | ||
| agx_tilebuffer.h | ||
| agx_usc.h | ||
| agx_uvs.h | ||
| agx_va.c | ||
| asahi_proto.h | ||
| decode.c | ||
| decode.h | ||
| dyld_interpose.h | ||
| meson.build | ||
| pool.c | ||
| pool.h | ||
| wrap.c | ||