Mesa (main): intel/decoder: Fix binding table pointer decoding with large offsets

[GitLab Mirror]

Module: Mesa
Branch: main
Commit: b637f6c3db07d6baac6fbd11324a9dd132395203
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=b637f6c3db07d6baac6fbd11324a9dd132395203

Author: Kenneth Graunke <kenneth at whitecape.org>
Date:   Fri May 13 13:04:21 2022 -0700

intel/decoder: Fix binding table pointer decoding with large offsets

XeHP supports a 20:5 pointer format, so the offset can legitimately
be more than UINT16_MAX.  Likewise, with 256B binding table mode on
Icelake/Tigerlake, we might have 18:8 pointers that exceed UINT16_MAX.

Thanks to Felix DeGrood for catching this!

Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin at intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/16538>

---

 src/intel/common/intel_batch_decoder.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/src/intel/common/intel_batch_decoder.c b/src/intel/common/intel_batch_decoder.c
index 7d01f0df092..20f4a8f1c24 100644
--- a/src/intel/common/intel_batch_decoder.c
+++ b/src/intel/common/intel_batch_decoder.c
@@ -281,9 +281,22 @@ dump_binding_table(struct intel_batch_decode_ctx *ctx,
       return;
    }
 
-   /* When 256B binding tables are enabled, we have to shift the offset */
-   if (ctx->use_256B_binding_tables)
+   /* Most platforms use a 16-bit pointer with 32B alignment in bits 15:5. */
+   uint32_t btp_alignment = 32;
+   uint32_t btp_pointer_bits = 16;
+
+   if (ctx->devinfo.verx10 >= 125) {
+      /* The pointer is now 21-bit with 32B alignment in bits 20:5. */
+      btp_pointer_bits = 21;
+   } else if (ctx->use_256B_binding_tables) {
+      /* When 256B binding tables are enabled, we have to shift the offset
+       * which is stored in bits 15:5 but interpreted as bits 18:8 of the
+       * actual offset.  The effective pointer is 19-bit with 256B alignment.
+       */
       offset <<= 3;
+      btp_pointer_bits = 19;
+      btp_alignment = 256;
+   }
 
    const uint64_t bt_pool_base = ctx->bt_pool_base ? ctx->bt_pool_base :
                                                      ctx->surface_base;
@@ -293,7 +306,7 @@ dump_binding_table(struct intel_batch_decode_ctx *ctx,
                            bt_pool_base, 1, 8);
    }
 
-   if (offset % 32 != 0 || offset >= UINT16_MAX) {
+   if (offset % btp_alignment != 0 || offset >= (1u << btp_pointer_bits)) {
       fprintf(ctx->fp, "  invalid binding table pointer\n");
       return;
    }