Skip to content

Honeykrisp integration: AGX correctness fixes, VK_KHR_cooperative_matrix, G13G CDM trim - #1

Closed
joshuaswarren wants to merge 10000 commits into
omacom:mainfrom
joshuaswarren:honeykrisp-omarchy
Closed

joshuaswarren wants to merge 10000 commits into
omacom:mainfrom
joshuaswarren:honeykrisp-omarchy

Conversation

@joshuaswarren

@joshuaswarren joshuaswarren commented Sep 19, 2026 •

Copy link
Copy Markdown

Honeykrisp integration branch: Apple Silicon (AGX) correctness + coopmat + G13G CDM trim

Brings omacom/mesa to the line the Omarchy M+ team actually runs and measures on M1-class hardware. 43 commits on top of the Sep 12 stock sync. Three parts:

1. Correctness fixes (upstreamable — see the series branch)

  • agx: keep the mod-32 shift count when fusing ushr+iand into ubfe — wrong-results fix for the shift-then-mask fusion
  • agx: represent the fused shift-then-mask as ubfe, not ubitfield_extract
  • nir: pass FP_MATH_CTRL to the builder generator — the NIR generator bug that affects every Mesa driver, not just AGX
  • agx: correctly rounded fdiv/frcp, faithful log/log2, exact sin/cos reduction + FTZ handling + the late fdiv lowering

A clean 6-patch series with these commits only (no receipts, no perf-only changes) is staged at joshuaswarren/mesa:upstream/correctness for forwarding to gitlab.freedesktop.org.

2. VK_KHR_cooperative_matrix for AGX

Enabled by default (opt-out via AGX_SIMDMAT=0): 16x16x16 and fp16 shapes, hardware 8x8x8 fp32 via simd_matrix_fmadd32, ISA disassembly support, software lowering outside full subgroups, shader-cache key handling, and the regression tests. This is what mlx-omarchy's cooperative-matrix path needs on M1.

3. Per-launch CDM barrier trim — G13G only

Trims the kitchen-sink CDM barrier after each compute launch on t8103 (M1) to the designed bit set: +6.3% ctx1024 decode, pins held 24/24, runtime suite 22 cases / 6,189 assertions green (six interleaved A/B rounds, mlx-omarchy v0.6.0 wheel untouched). Deliberately not enabled on G13X (M1 Max): the port measured +13% short / −3.2% long-context and was reverted — this branch carries that history (5deac1c8068 restores the G13X sink).

Validation

  • mlx-omarchy v0.6.0 release gate on this line: pinned ctx1024 decode 102.29 tok/s, Parakeet 3× warm byte-identical (104/104)
  • 25-suite mlx-omarchy battery, stock vs merged
  • oMLX runtime suite: 22 cases / 6,189 assertions, 0 failures
  • Five miscompiles reproduced and fixed; standalone repros included (the repro/ commits)

Not in this branch

  • The hk/* experiment branches (G13X barrier ports, default-off diagnostic knobs, trig-invariance, agx-wait-batching, etc.) stay unmerged until measured — they are not part of this PR
  • Internal receipts/ evidence commits ride along for team review; they will be stripped before any freedesktop submission

llandwerlin-intel and others added 30 commits September 1, 2026 10:08
The semantic of the gl_FragColor is to write to all attachments. Blorp
only uses a single render target.

Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43984>
Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43984>
Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43984>
This is the logic that BRW currently has and just happens to work on
JAY because the register allocation seems to always reuse RT0's alpha
as undef alpha component for RT1 in a bunch of tests like :

   dEQP-VK.pipeline.*.multisample.alpha_to_coverage_unused_attachment.samples_*.alpha_opaque*

Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43984>
Makes fs_prog_data populate consistent with NIR.

Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43984>
Fixes piglit's :

INTEL_JAY=fs ./bin/ext_framebuffer_multisample-draw-buffers-alpha-to-coverage 8 -auto -fbo

With zink

Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43984>
Fixes a crash with Iris & Jay on KHR-GL46.program_interface_query.output-layout-index

Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43984>
Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43984>
This change brings a 11%~12% improvement on MountAndBlade2 due to a
few fragment shaders being heavily optimized because there is no color
attachment and much of the fragment shader code can just be eliminated
to just leave the alpha output which in some of the shader is a
hardcoded 0.0f.

Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43984>
…ction

Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43984>
Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43984>
…ign_curb_setup()

Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43984>
This will drop an instruction if the spill offset > 0xffff. Otherwise
turns a MAD into a SHL on Gfx20+.

Will become more useful on Gfx35+ with efficient 64bit.

Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/44076>
…ring

No changes at the moment, but this helps DXC's vector arrays.

Reviewed-by: Marek Olšák <maraeo@gmail.com>
Reviewed-by: Rhys Perry <pendingchaos02@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43409>
Foz-DB Navi48:
Totals from 160 (0.08% of 209079) affected shaders:
MaxWaves: 3936 -> 3952 (+0.41%); split: +0.51%, -0.10%
Instrs: 470357 -> 467348 (-0.64%); split: -0.77%, +0.13%
CodeSize: 2488428 -> 2481964 (-0.26%); split: -0.48%, +0.22%
VGPRs: 11164 -> 11260 (+0.86%); split: -0.54%, +1.40%
SpillSGPRs: 1295 -> 1349 (+4.17%)
LDS: 507904 -> 395264 (-22.18%)
Latency: 2024248 -> 2018675 (-0.28%); split: -0.41%, +0.13%
InvThroughput: 1311982 -> 1313220 (+0.09%); split: -0.06%, +0.16%
VClause: 7787 -> 7789 (+0.03%); split: -0.01%, +0.04%
SClause: 8359 -> 8343 (-0.19%); split: -0.20%, +0.01%
Copies: 29646 -> 29558 (-0.30%); split: -1.61%, +1.32%
Branches: 8147 -> 8075 (-0.88%); split: -0.92%, +0.04%
PreSGPRs: 8294 -> 8349 (+0.66%); split: -0.24%, +0.90%
PreVGPRs: 8262 -> 8384 (+1.48%); split: -1.03%, +2.51%
VALU: 277157 -> 277490 (+0.12%); split: -0.20%, +0.32%
SALU: 61154 -> 61167 (+0.02%); split: -0.18%, +0.20%
SMEM: 22043 -> 22042 (-0.00%)
VOPD: 88 -> 80 (-9.09%)

Reviewed-by: Rhys Perry <pendingchaos02@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43409>
Better access pattern for nir_opt_large_constants.

Foz-DB Navi48:
Totals from 914 (0.44% of 209101) affected shaders:
MaxWaves: 24004 -> 24010 (+0.02%)
Instrs: 1016080 -> 1013177 (-0.29%); split: -0.49%, +0.21%
CodeSize: 5237984 -> 5214772 (-0.44%); split: -0.56%, +0.12%
VGPRs: 55632 -> 55548 (-0.15%)
Latency: 8157272 -> 8028791 (-1.58%); split: -1.60%, +0.03%
InvThroughput: 1216615 -> 1217141 (+0.04%); split: -0.30%, +0.35%
VClause: 19438 -> 18712 (-3.73%); split: -3.80%, +0.06%
SClause: 19881 -> 19369 (-2.58%); split: -2.58%, +0.01%
Copies: 99203 -> 100299 (+1.10%); split: -0.22%, +1.33%
Branches: 21269 -> 21135 (-0.63%); split: -0.66%, +0.03%
PreSGPRs: 38695 -> 38897 (+0.52%); split: -0.05%, +0.57%
PreVGPRs: 46861 -> 46786 (-0.16%); split: -0.17%, +0.01%
VALU: 625524 -> 628291 (+0.44%); split: -0.23%, +0.68%
SALU: 111810 -> 110171 (-1.47%); split: -1.68%, +0.21%
VMEM: 45832 -> 44093 (-3.79%); split: -3.82%, +0.03%
SMEM: 32065 -> 31329 (-2.30%)
VOPD: 391 -> 399 (+2.05%)

Reviewed-by: Rhys Perry <pendingchaos02@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43409>
This avoids reallocation on export. Also avoids suballocation
and BO reuse to ensure new surface is zeroed on recent kernel.

Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Marek Olšák <maraeo@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43837>
If a caller uses existing pipe_resource as a template, the next pointer
may be valid and we must not copy it here.

Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Marek Olšák <maraeo@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43837>
Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Marek Olšák <maraeo@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43837>
Reallocate inplace now works with multi plane textures.

Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Marek Olšák <maraeo@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43837>
Signed-off-by: Hans-Kristian Arntzen <post@arntzen-software.no>
Reviewed-by: Connor Abbott <cwabbott0@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/44119>
The Bifrost models had no rate data. Populate the pixel, texel, and FMA
(arith) rates, per clock per core, from Arm's GPU datasheet, completing
the rate set the Valhall models already carry.

The FMA rate is the datasheet's FP32 ops/cycle halved (the datasheet
counts each FMA as two ops), i.e. EE-count x warp-width. Pixel and texel
are the datasheet's pixels/cycle and texels/cycle. The varying rate is
not published in the datasheet and is left unset (0) for now.

The low-end parts are EE-configurable (G31 1-2 EE, G51/G52 2-3 EE); the
datasheet's nominal top-of-range config is used, matching Arm Mobile
Studio (malioc):

  GPU       pixel texel fma
  G71/G72     1     1    12
  G51         2     2    12
  G31         2     2     8
  G52/G76     2     2    24

Signed-off-by: Chris Healy <healych@amazon.com>
Assisted-by: Claude Code (Claude Opus 4.8)
Reviewed-by: Christoph Pillmayer <christoph.pillmayer@arm.com>
Reviewed-by: Lorenzo Rossi <lorenzo.rossi@collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/44106>
bi_gather_stats() divided the arithmetic tuple count by a fixed 24 and
the texture message count by a fixed 2. Those constants match only one
Bifrost configuration -- G52/G76's 3 EE x 8-wide warp at 2 texels/clock
-- so shader-db stats were wrong on every other Bifrost GPU and, worse,
reported identical cycles when comparing one shader across GPUs (G31 vs
G52 arith really differ by 3x; G71 vs G52 texture by 2x).

Take the arith and texel rates from the model instead (added in the
previous commit), mirroring the Valhall va_count_stats() path. GPUs not
in the model table fall back to G52, whose rates (24 arith, 2 texels)
equal the historical constants, so their output is unchanged; G52's own
output is likewise unchanged.

The varying rate is left on its fixed 16; making it model-aware is left
as a follow-up for if/when the per-GPU varying details are determined.

Reporting-only: the stats feed pan_stats_util_debug() (shaderdb /
statsfull output) and nothing else, so there is no codegen impact.

Signed-off-by: Chris Healy <healych@amazon.com>
Assisted-by: Claude Code (Claude Opus 4.8)
Reviewed-by: Christoph Pillmayer <christoph.pillmayer@arm.com>
Reviewed-by: Lorenzo Rossi <lorenzo.rossi@collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/44106>
RADV has a graphics and a compute path, it requires a BOTTOM_OF_PIPE
event, not a CS_DONE.

Signed-off-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/44074>
This pipeline stage is for vkCmdBlitImage() and RADV only has a graphics
path.

Signed-off-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/44074>
The only difference is that ALL_GRAPHICS will also trigger a
CS_PARTIAL_FLUSH now because COPY_INDIRECT is part of ALL_GRAPHICS.

COPY_INDIRECT can execute both graphics and compute shaders in RADV
but from Vulkan it's considered a graphics stage, and not a
transfer/copy operation, as weird as it is.

Signed-off-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/44074>
nir_builder_opcodes_h.py renders the intrinsic builders from a mako
template that references FP_MATH_CTRL, but the index was never imported
or passed to render(), so mako resolved the name to UNDEFINED and
silently skipped the builder-defaulting block for every FP_MATH_CTRL
intrinsic. NoContraction on cooperative-matrix operations was therefore
dropped in every driver, not just this one, and the generated header is
missing the twelve fp_math_ctrl defaulting blocks.

Import the index and hand it to the template. The generated header grows
exactly 24 lines, twelve two-line defaulting blocks.
Three cases where the lowerings assumed IEEE denormal behaviour that the
hardware does not provide. All three were reported by Dj from stress
runs on an M2 Pro, and reproduce on an M1 (G13G B1).

Division refined a * rcp(b) in place, so when the exact quotient sits
just below the normal boundary the GPU zeroes the correction step's
intermediate value and the step is silently skipped, giving a 1 ulp
error: 18,382 wrong results over 1M random pairs. Divide the normalized
mantissas instead and restore the exponent afterwards, so the refinement
always runs on operands near one and the flush happens on the exact
quotient, before rounding. The rounding decision is now integer: the
half-ulp point is exact by construction, and the residual of the second
Markstein step is exact by the fma contract, so the comparison against
it decides the tie without a third refinement.

log() lowered to hardware log2 times ln2 and the multiply was subject to
contraction, so a shader computing precise log2(x) * ln2 got different
bits depending on whether ln2 was a literal or read from a buffer, on
26.8% of inputs. log2 is now computed directly as a double-float series
and log() is the one rounded multiply the source asks for.

sin() returned its argument unchanged for a zero input. The comparison
flushes, so a subnormal argument matched and the unflushed subnormal
leaked out through the select. Return a signed zero.

Verified on an M1 against an exact model over 262,144 pairs covering
edge bit patterns and the binade boundaries: division, reciprocal and
the literal-versus-buffer pair are exact, log and log2 are within 1 ulp.
An independent exact-rational checker agrees over 489M cases. CTS
float_controls goes from one failure to 1,146 pass, 0 fail; arithmetic
is 311/311.
The G13 matrix tile spans all 32 lanes of a SIMD group, so the hardware
lowering is only correct when every subgroup of the dispatch is fully
populated. Any workgroup whose size is not a multiple of 32 took it
anyway and returned garbage: local size 16, 8 or 1 got 62 to 64 of 64
elements wrong, and those are valid shaders.

Route them to a software lowering instead. Every active invocation keeps
a private element array, but only the slots it owns are authoritative:
logical element e is owned by invocation e % A, where A is the active
invocation count of this subgroup, so partial tail subgroups and
runtime-variable workgroup sizes are handled. Tangled operations (load,
store, muladd, conversions, arithmetic) run on every lane with uniform
bounds and gather non-owned source elements from their owner; untangled
ones (insert, extract, copy, bitcast, length) touch local slots only and
stay valid on a subset of lanes, per the tangled-instruction list in
SPV_KHR_cooperative_matrix rev 10. A valid shader is never rejected.

Reported by Dj.
Loading or storing a matrix through a uint16_t or uint8_t pointer got 56
of 64 elements wrong. The lowering stepped the strided axis on the
buffer's own vector type and the contiguous axis on the matrix component
type, which only coincides when the two widths match.

Count the row in pointer elements, convert to component steps, and index
one component-typed deref. The division is by a constant and is exact
whenever the row stride is component-aligned, which the cooperative
matrix memory alignment rules require; for width-matched buffers it
folds back to the previous arithmetic.

This also removes AGX_HWMAT_NO_FLATADDR. It selected the two-level
address form, which is the form that gets narrow pointers wrong, so it
now only names a broken path.

Reported by Dj.
The switch is gone, so stop hashing it and stop asserting that it
changes the pipeline cache UUID. AGX_SIMDMAT, AGX_DECODE_Q4 and
AGX_HWMAT_VEC2 keep their entries.
simd_matrix_fmadd16/32 fixed bits 0 through 7, but bit 7 is the first
bit of the destination operand, where it carries the register cache
hint. Any matrix instruction with a cached destination therefore failed
to decode, which trips the compiler's own disassembly selftest on a
debug build. Match the seven opcode bits and let the operand own bit 7.

Add three cases: both opcodes with a plain destination, and fmadd16 with
a cached one.
cmshape2 walks the advertised matrix shapes, layouts, workgroup sizes
and pointer widths against a host oracle, and checks that NoContraction
survives and that a divergent component write is not lost. run_matrix2
drives the 30 cases that cover the fixes in this series.

precise_math compares division, reciprocal, log and log2 against an
exact model over 262,144 inputs, including the binade boundaries and the
literal-versus-buffer pair for ln2. compute_runner is the small Vulkan
dispatch harness it uses.
The kitchen-sink CDM_BARRIER emitted after every compute launch (marked
'to be safe' until the bits are understood) costs ~10 us per dispatch in
dependent compute chains: on Apple M1 (G13X), Qwen2.5-0.5B Q4 decode
spends ~2.1 ms of a ~9.8 ms token in it (receipts/2026-09-16-termA,
mlx-omarchy). Removing it entirely gains +25.6% but is
nondeterministically wrong; emitting only bits 4..8 on G13X holds the
mlx-omarchy pinned generated-ID digests 48/48 interleaved runs (both
legs) and the omarchy runtime suite (22 cases / 6189 assertions), and
measures +3.05% ctx1053 / +3.03% short decode on m1-test-host.

Other chips keep the full kitchen sink until measured there.
m1-test-host is a t8103 (Apple M1, G13G core id) and maps to AGX_CHIP_G13G;
the previous commit gated on G13X, so on the one machine the trim was
measured on it did nothing and the packaged -2 build was a no-op.
The measured set on G13G is bits 4-8; every other chip keeps the
kitchen sink unchanged.
G13X is generation 13 with multiple clusters (agx_device.c): t6000/t6001
-- M1 Pro/Max, G13C cores. The driver itself documents the designed
pre-sink emission for these dies: unk_4 is set under
chip == AGX_CHIP_G13X on top of unk_5/6/8, i.e. bits {4,5,6,8}. Gate the
kitchen sink off for G13X as well as G13G so both G13 dies run their
sourced minimal sets; G14* keep the full sink.

Measured on G13G (m1-test-host, t8103): pins 48/48 + suite 6189 assertions,
+3.05% ctx1053. G13X verification is measured separately on t6001-test-host.
t6001-test-host (t6001, G13C, M1 Max), 12-round interleaved packaged A/B of the
G13X designed set {4,5,6,8} vs the sink: short decode +13.0% but
ctx1053 -3.17% (KV-stream leg), pins 48/48, omarchy runtime suite
22694 assertions green. Correct but regressive on the Max's weakest
leg, so G13X stays on the sink; only G13G carries the trim.
0d38e0a (asahi: keep cooperative matrices opt-in and key compiler
switches) flipped AGX_SIMDMAT from default-on to opt-in as a safety gate
while the HW lowering mishandled partial subgroups. 109e7cc (agx:
lower cooperative matrices in software outside full subgroups) landed the
software fallback, so the hazard is gone: agx_preprocess_nir routes every
non-full-subgroup dispatch through agx_nir_lower_cmat.c and a valid
shader is never rejected.

Restore the default to true. Trunk-tip builds regressed 26% decode and
50% prefill with the extension off. AGX_SIMDMAT=0 still disables it, the
shader cache key still tracks the option, and cache_options.py now pins
the default-on contract (AGX_SIMDMAT=1 must equal the unset identity).
The sin zero-return selects the argument when it compares equal to zero.
The comparison flushes, so a subnormal argument matches and leaks out
unflushed through the select. From flushed sources (in-shader arithmetic)
the argument is already zero and nothing changes; from unflushed sources
(buffer loads) a shader declaring DenormFlushToZero must see a flushed,
sign-preserving zero, which the hardware fmul path it sits behind does
not give it.

Gate the fix on the DenormFlushToZero fp32 execution mode alone. The
CTS float_controls sin cases are all DenormFlushToZero (optionally with
SignedZeroInfNanPreserve on other operands); SignedZeroInfNanPreserve
alone never exercises sin and preserving the subnormal argument is
correct under DenormPreserve and under no mode at all, so those modes
keep the existing emission byte-identical.

Division is deliberately left unkeyed: the CTS fp32 group exercises
OpFDiv only under DenormFlushToZero with in-shader-flushed denorm
inputs (expectations V_ZERO/V_UNUSED) and has no DenormPreserve or
rounding-mode division cases, and the previously-landed exact sequence
flushes the subnormal-result band itself (it is FTZ-by-construction),
so no existing sequence satisfies DenormPreserve there and none is
required by any current CTS case.

Pinned by test-lower-math.cpp: the default-mode fdiv/frcp op histograms
are exact pins of the sequences the MLX decode digests were measured
against, and the sin case distinguishes the keyed FTZ emission.
joshuaswarren pushed a commit to joshuaswarren/mesa-1 that referenced this pull request Sep 21, 2026
…any instruction

This happens with crucible test func.sync.semaphore-fd.no-sync.q0.

Thread 4 "crucible" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff2fff6c0 (LWP 687540)]
0x00007ffff34749aa in anv_reloc_list_grow_deps (list=0x0, min_num_words=0) at ../src/intel/vulkan/anv_batch_chain.c:96
96	   if (min_num_words <= list->dep_words)
(gdb) bt
\#0  0x00007ffff34749aa in anv_reloc_list_grow_deps (list=0x0, min_num_words=0) at ../src/intel/vulkan/anv_batch_chain.c:96
\omacom#1  0x00007ffff3474b84 in anv_reloc_list_append (list=0x0, other=0x7fffec0589c0) at ../src/intel/vulkan/anv_batch_chain.c:147
\omacom#2  0x00007ffff348f6a5 in anv_cmd_buffer_bind_shaders (vk_cmd_buffer=0x7fffec177150, stage_count=1, stages=0x7ffff2ffc5f4, vk_shaders=0x7ffff2ffc5f8)
    at ../src/intel/vulkan/anv_cmd_buffer.c:1839
\omacom#3  0x00007ffff590490b in vk_compute_pipeline_cmd_bind (cmd_buffer=0x7fffec177150, pipeline=0x7fffec039210) at ../src/vulkan/runtime/vk_pipeline.c:2333
\omacom#4  0x00007ffff58fe859 in vk_common_CmdBindPipeline (commandBuffer=0x7fffec177150, pipelineBindPoint=VK_PIPELINE_BIND_POINT_COMPUTE, _pipeline=0x7fffec039210)
    at ../src/vulkan/runtime/vk_pipeline.c:490
\omacom#5  0x00005555555a239f in create_command_buffer (ctx=ctx@entry=0x7ffff2ffccb0, parity=parity@entry=0) at ../src/tests/func/sync/semaphore-fd.c:381
\omacom#6  0x00005555555a37e4 in test_opaque_fd () at ../src/tests/func/sync/semaphore-fd.c:781
\omacom#7  0x000055555557f7e9 in t_enter_main_phase () at ../src/framework/test/t_phases.c:57
\omacom#8  t_enter_next_phase () at ../src/framework/test/t_phases.c:170
\omacom#9  0x000055555557f8a2 in t_enter_setup_phase () at ../src/framework/test/t_phases.c:39
\omacom#10 t_enter_next_phase () at ../src/framework/test/t_phases.c:167
\omacom#11 0x00005555555826b5 in t_thread_release () at ../src/framework/test/t_thread.c:142
\omacom#12 0x0000555555582879 in t_thread_release_wrapper (ignore=<optimized out>) at ../src/framework/test/test.c:236
\omacom#13 0x00005555555827d3 in test_thread_start (arg=<optimized out>) at ../src/framework/test/t_thread.c:60
\omacom#14 0x00007ffff7b14289 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:448
\omacom#15 0x00007ffff7b92d08 in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Cc: stable
Reviewed-by: Ivan Briano <ivan.briano@intel.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/43375>
joshuaswarren pushed a commit to joshuaswarren/mesa-1 that referenced this pull request Sep 21, 2026
Wifi can occasionally cause crashes on the host, and we don't need it for
graphics testing.

[  401.084158] Unable to handle kernel paging request at virtual address ff800099ff80ffb2
[  401.092309] Mem abort info:
[  401.095190]   ESR = 0x0000000096000004
[  401.099045]   EC = 0x25: DABT (current EL), IL = 32 bits
[  401.104501]   SET = 0, FnV = 0
[  401.107640]   EA = 0, S1PTW = 0
[  401.110875]   FSC = 0x04: level 0 translation fault
[  401.115885] Data abort info:
[  401.118850]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[  401.124489]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[  401.129684]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[  401.135140] [ff800099ff80ffb2] address between user and kernel address ranges
[  401.142468] Internal error: Oops: 0000000096000004 [omacom#1]  SMP
[  401.148283] Modules linked in: vhost_vsock vhost vhost_iotlb ipv6
[  401.154556] CPU: 2 UID: 0 PID: 718 Comm: Wi-Fi HwsimMsg  Tainted: G        W           6.17.3-gddf65230edb2 omacom#1 PREEMPT

Signed-off-by: Valentine Burley <valentine.burley@collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/39993>
joshuaswarren pushed a commit to joshuaswarren/mesa-1 that referenced this pull request Sep 21, 2026
Fix a crash in image descriptor emission caused by stale image_mask bits.

Root cause:
- set_shader_images used a shift expression with count==64 when clearing
  image_mask, which is undefined behavior in C.
- This could leave image_mask inconsistent with actual image bindings,
  so panfrost_emit_images() might dereferences NULL image resources.

Fixes:
- Use 64-bit-safe bit helpers for mask updates to avoid invalid shifts.

Crash observed when running: OpenCL-CTS api/test_api
Backtrace:
  #0 util_image_to_sampler_view (v->resource is NULL)
  omacom#1 panfrost_emit_images
  omacom#2 panfrost_update_shader_state
  omacom#3 panfrost_launch_grid_on_batch
  omacom#4 panfrost_launch_grid

Backport-to: *
Signed-off-by: Eric Guo <eric.guo@nxp.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Erik Faye-Lund <erik.faye-lund@collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/40621>
joshuaswarren pushed a commit to joshuaswarren/mesa-1 that referenced this pull request Sep 21, 2026
This change adds the DRAW_ATTR_NONEXIST functionality
which fixes the memory access issue.

For instance, this issue is triggered with "piglit/bin/glsl-routing -auto -fbo":
==8384==ERROR: AddressSanitizer: heap-use-after-free on address 0xa11dfd84 at pc 0xae573fbd bp 0xbf87f688 sp 0xbf87f67c
READ of size 4 at 0xa11dfd84 thread T0
    #0 0xae573fbc in emit_hw_vertex ../src/gallium/drivers/i915/i915_prim_emit.c:92
    omacom#1 0xae574ab0 in emit_prim ../src/gallium/drivers/i915/i915_prim_emit.c:154
    omacom#2 0xae574ab0 in setup_tri ../src/gallium/drivers/i915/i915_prim_emit.c:160
    omacom#3 0xad65d322 in do_triangle ../src/gallium/auxiliary/draw/draw_pipe.c:173
    omacom#4 0xad65d322 in pipe_run_linear ../src/gallium/auxiliary/draw/draw_decompose_tmp.h:181
    omacom#5 0xad663375 in draw_pipeline_run_linear ../src/gallium/auxiliary/draw/draw_pipe.c:337
    omacom#6 0xad86d9ac in pipeline ../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:476
    omacom#7 0xad86d9ac in llvm_pipeline_generic ../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:701
    omacom#8 0xad86ed75 in llvm_middle_end_linear_run ../src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline_llvm.c:784
    omacom#9 0xad6aaaee in vsplit_segment_simple_linear ../src/gallium/auxiliary/draw/draw_pt_vsplit_tmp.h:223
    omacom#10 0xad6aaaee in vsplit_run_linear ../src/gallium/auxiliary/draw/draw_split_tmp.h:64
    omacom#11 0xad68a74b in draw_pt_arrays ../src/gallium/auxiliary/draw/draw_pt.c:161
    omacom#12 0xad68b7ca in draw_pt_arrays_restart ../src/gallium/auxiliary/draw/draw_pt.c:430
    omacom#13 0xad68b7ca in draw_instances ../src/gallium/auxiliary/draw/draw_pt.c:491
    omacom#14 0xad68ce0a in draw_vbo ../src/gallium/auxiliary/draw/draw_pt.c:628
    omacom#15 0xae5651d4 in i915_draw_vbo ../src/gallium/drivers/i915/i915_context.c:115
    omacom#16 0xae5651d4 in i915_draw_vbo ../src/gallium/drivers/i915/i915_context.c:51
    omacom#17 0xac7f50d3 in _mesa_draw_arrays ../src/mesa/main/draw.c:1204

Fixes: 65920a8 ("i915g: replace "uint" with normal uint32_t.")
Signed-off-by: Patrick Lerda <patrick9876@free.fr>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27571>
@joshuaswarren

joshuaswarren commented Sep 30, 2026 •

Copy link
Copy Markdown
Author

Superseded by the stack #3 → #4 → #5. Review it in that order.

Left out on purpose: 52563a9a4fb and b161c27760b, which this branch reverts. The hardware tests under tests/, the driver's vulkan/tests/cache_options.py and the repro/ files are not carried; they stay on honeykrisp-omarchy in joshuaswarren/mesa-1.

Closing.

maralcbr pushed a commit that referenced this pull request Oct 25, 2026
Import Eryk’s current fixed-point border-depth correction
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.