ac/debug: use an explicit getter for fetching words from the IB

Guard against out-of-bounds accesses, and prepare for upcoming changes.

Reviewed-by: Marek Olšák <marek.olsak@amd.com>

1 files changed, 215 insertions, 153 deletions

diff --git a/src/amd/common/ac_debug.c b/src/amd/common/ac_debug.c
index 42a72c086b..518893ff48 100644
--- a/src/amd/common/ac_debug.c
+++ b/src/amd/common/ac_debug.c
@@ -43,6 +43,19 @@
 
 #define INDENT_PKT 8
 
+struct ac_ib_parser {
+	uint32_t *ib;
+	unsigned num_dw;
+	int trace_id;
+	enum chip_class chip_class;
+	ac_debug_addr_callback addr_callback;
+	void *addr_callback_data;
+
+	unsigned cur_dw;
+};
+
+static void ac_do_parse_ib(FILE *f, struct ac_ib_parser *ib);
+
 static void print_spaces(FILE *f, unsigned num)
 {
 	fprintf(f, "%*s", num, "");
@@ -129,11 +142,23 @@ void ac_dump_reg(FILE *file, unsigned offset, uint32_t value,
 	fprintf(file, COLOR_YELLOW "0x%05x" COLOR_RESET " <- 0x%08x\n", offset, value);
 }
 
-static void ac_parse_set_reg_packet(FILE *f, uint32_t *ib, unsigned count,
-				    unsigned reg_offset)
+static uint32_t ac_ib_get(struct ac_ib_parser *ib)
+{
+	uint32_t v = 0xdeadbeef;
+
+	if (ib->cur_dw < ib->num_dw)
+		v = ib->ib[ib->cur_dw];
+
+	ib->cur_dw++;
+	return v;
+}
+
+static void ac_parse_set_reg_packet(FILE *f, unsigned count, unsigned reg_offset,
+				    struct ac_ib_parser *ib)
 {
-	unsigned reg = ((ib[1] & 0xFFFF) << 2) + reg_offset;
-	unsigned index = ib[1] >> 28;
+	unsigned reg_dw = ac_ib_get(ib);
+	unsigned reg = ((reg_dw & 0xFFFF) << 2) + reg_offset;
+	unsigned index = reg_dw >> 28;
 	int i;
 
 	if (index != 0) {
@@ -142,17 +167,15 @@ static void ac_parse_set_reg_packet(FILE *f, uint32_t *ib, unsigned count,
 	}
 
 	for (i = 0; i < count; i++)
-		ac_dump_reg(f, reg + i*4, ib[2+i], ~0);
+		ac_dump_reg(f, reg + i*4, ac_ib_get(ib), ~0);
 }
 
-static uint32_t *ac_parse_packet3(FILE *f, uint32_t *ib, int *num_dw,
-				  int trace_id, enum chip_class chip_class,
-				  ac_debug_addr_callback addr_callback,
-				  void *addr_callback_data)
+static void ac_parse_packet3(FILE *f, uint32_t header, struct ac_ib_parser *ib)
 {
-	unsigned count = PKT_COUNT_G(ib[0]);
-	unsigned op = PKT3_IT_OPCODE_G(ib[0]);
-	const char *predicate = PKT3_PREDICATE(ib[0]) ? "(predicate)" : "";
+	unsigned first_dw = ib->cur_dw;
+	int count = PKT_COUNT_G(header);
+	unsigned op = PKT3_IT_OPCODE_G(header);
+	const char *predicate = PKT3_PREDICATE(header) ? "(predicate)" : "";
 	int i;
 
 	/* Print the name first. */
@@ -179,180 +202,206 @@ static uint32_t *ac_parse_packet3(FILE *f, uint32_t *ib, int *num_dw,
 	/* Print the contents. */
 	switch (op) {
 	case PKT3_SET_CONTEXT_REG:
-		ac_parse_set_reg_packet(f, ib, count, SI_CONTEXT_REG_OFFSET);
+		ac_parse_set_reg_packet(f, count, SI_CONTEXT_REG_OFFSET, ib);
 		break;
 	case PKT3_SET_CONFIG_REG:
-		ac_parse_set_reg_packet(f, ib, count, SI_CONFIG_REG_OFFSET);
+		ac_parse_set_reg_packet(f, count, SI_CONFIG_REG_OFFSET, ib);
 		break;
 	case PKT3_SET_UCONFIG_REG:
-		ac_parse_set_reg_packet(f, ib, count, CIK_UCONFIG_REG_OFFSET);
+		ac_parse_set_reg_packet(f, count, CIK_UCONFIG_REG_OFFSET, ib);
 		break;
 	case PKT3_SET_SH_REG:
-		ac_parse_set_reg_packet(f, ib, count, SI_SH_REG_OFFSET);
+		ac_parse_set_reg_packet(f, count, SI_SH_REG_OFFSET, ib);
 		break;
 	case PKT3_ACQUIRE_MEM:
-		ac_dump_reg(f, R_0301F0_CP_COHER_CNTL, ib[1], ~0);
-		ac_dump_reg(f, R_0301F4_CP_COHER_SIZE, ib[2], ~0);
-		ac_dump_reg(f, R_030230_CP_COHER_SIZE_HI, ib[3], ~0);
-		ac_dump_reg(f, R_0301F8_CP_COHER_BASE, ib[4], ~0);
-		ac_dump_reg(f, R_0301E4_CP_COHER_BASE_HI, ib[5], ~0);
-		print_named_value(f, "POLL_INTERVAL", ib[6], 16);
+		ac_dump_reg(f, R_0301F0_CP_COHER_CNTL, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_0301F4_CP_COHER_SIZE, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_030230_CP_COHER_SIZE_HI, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_0301F8_CP_COHER_BASE, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_0301E4_CP_COHER_BASE_HI, ac_ib_get(ib), ~0);
+		print_named_value(f, "POLL_INTERVAL", ac_ib_get(ib), 16);
 		break;
 	case PKT3_SURFACE_SYNC:
-		if (chip_class >= CIK) {
-			ac_dump_reg(f, R_0301F0_CP_COHER_CNTL, ib[1], ~0);
-			ac_dump_reg(f, R_0301F4_CP_COHER_SIZE, ib[2], ~0);
-			ac_dump_reg(f, R_0301F8_CP_COHER_BASE, ib[3], ~0);
+		if (ib->chip_class >= CIK) {
+			ac_dump_reg(f, R_0301F0_CP_COHER_CNTL, ac_ib_get(ib), ~0);
+			ac_dump_reg(f, R_0301F4_CP_COHER_SIZE, ac_ib_get(ib), ~0);
+			ac_dump_reg(f, R_0301F8_CP_COHER_BASE, ac_ib_get(ib), ~0);
 		} else {
-			ac_dump_reg(f, R_0085F0_CP_COHER_CNTL, ib[1], ~0);
-			ac_dump_reg(f, R_0085F4_CP_COHER_SIZE, ib[2], ~0);
-			ac_dump_reg(f, R_0085F8_CP_COHER_BASE, ib[3], ~0);
+			ac_dump_reg(f, R_0085F0_CP_COHER_CNTL, ac_ib_get(ib), ~0);
+			ac_dump_reg(f, R_0085F4_CP_COHER_SIZE, ac_ib_get(ib), ~0);
+			ac_dump_reg(f, R_0085F8_CP_COHER_BASE, ac_ib_get(ib), ~0);
 		}
-		print_named_value(f, "POLL_INTERVAL", ib[4], 16);
+		print_named_value(f, "POLL_INTERVAL", ac_ib_get(ib), 16);
 		break;
-	case PKT3_EVENT_WRITE:
-		ac_dump_reg(f, R_028A90_VGT_EVENT_INITIATOR, ib[1],
+	case PKT3_EVENT_WRITE: {
+		uint32_t event_dw = ac_ib_get(ib);
+		ac_dump_reg(f, R_028A90_VGT_EVENT_INITIATOR, event_dw,
 			    S_028A90_EVENT_TYPE(~0));
-		print_named_value(f, "EVENT_INDEX", (ib[1] >> 8) & 0xf, 4);
-		print_named_value(f, "INV_L2", (ib[1] >> 20) & 0x1, 1);
+		print_named_value(f, "EVENT_INDEX", (event_dw >> 8) & 0xf, 4);
+		print_named_value(f, "INV_L2", (event_dw >> 20) & 0x1, 1);
 		if (count > 0) {
-			print_named_value(f, "ADDRESS_LO", ib[2], 32);
-			print_named_value(f, "ADDRESS_HI", ib[3], 16);
+			print_named_value(f, "ADDRESS_LO", ac_ib_get(ib), 32);
+			print_named_value(f, "ADDRESS_HI", ac_ib_get(ib), 16);
 		}
 		break;
-	case PKT3_EVENT_WRITE_EOP:
-		ac_dump_reg(f, R_028A90_VGT_EVENT_INITIATOR, ib[1],
+	}
+	case PKT3_EVENT_WRITE_EOP: {
+		uint32_t event_dw = ac_ib_get(ib);
+		ac_dump_reg(f, R_028A90_VGT_EVENT_INITIATOR, event_dw,
 			    S_028A90_EVENT_TYPE(~0));
-		print_named_value(f, "EVENT_INDEX", (ib[1] >> 8) & 0xf, 4);
-		print_named_value(f, "TCL1_VOL_ACTION_ENA", (ib[1] >> 12) & 0x1, 1);
-		print_named_value(f, "TC_VOL_ACTION_ENA", (ib[1] >> 13) & 0x1, 1);
-		print_named_value(f, "TC_WB_ACTION_ENA", (ib[1] >> 15) & 0x1, 1);
-		print_named_value(f, "TCL1_ACTION_ENA", (ib[1] >> 16) & 0x1, 1);
-		print_named_value(f, "TC_ACTION_ENA", (ib[1] >> 17) & 0x1, 1);
-		print_named_value(f, "ADDRESS_LO", ib[2], 32);
-		print_named_value(f, "ADDRESS_HI", ib[3], 16);
-		print_named_value(f, "DST_SEL", (ib[3] >> 16) & 0x3, 2);
-		print_named_value(f, "INT_SEL", (ib[3] >> 24) & 0x7, 3);
-		print_named_value(f, "DATA_SEL", ib[3] >> 29, 3);
-		print_named_value(f, "DATA_LO", ib[4], 32);
-		print_named_value(f, "DATA_HI", ib[5], 32);
+		print_named_value(f, "EVENT_INDEX", (event_dw >> 8) & 0xf, 4);
+		print_named_value(f, "TCL1_VOL_ACTION_ENA", (event_dw >> 12) & 0x1, 1);
+		print_named_value(f, "TC_VOL_ACTION_ENA", (event_dw >> 13) & 0x1, 1);
+		print_named_value(f, "TC_WB_ACTION_ENA", (event_dw >> 15) & 0x1, 1);
+		print_named_value(f, "TCL1_ACTION_ENA", (event_dw >> 16) & 0x1, 1);
+		print_named_value(f, "TC_ACTION_ENA", (event_dw >> 17) & 0x1, 1);
+		print_named_value(f, "ADDRESS_LO", ac_ib_get(ib), 32);
+		uint32_t addr_hi_dw = ac_ib_get(ib);
+		print_named_value(f, "ADDRESS_HI", addr_hi_dw, 16);
+		print_named_value(f, "DST_SEL", (addr_hi_dw >> 16) & 0x3, 2);
+		print_named_value(f, "INT_SEL", (addr_hi_dw >> 24) & 0x7, 3);
+		print_named_value(f, "DATA_SEL", addr_hi_dw >> 29, 3);
+		print_named_value(f, "DATA_LO", ac_ib_get(ib), 32);
+		print_named_value(f, "DATA_HI", ac_ib_get(ib), 32);
 		break;
-	case PKT3_RELEASE_MEM:
-		ac_dump_reg(f, R_028A90_VGT_EVENT_INITIATOR, ib[1],
+	}
+	case PKT3_RELEASE_MEM: {
+		uint32_t event_dw = ac_ib_get(ib);
+		ac_dump_reg(f, R_028A90_VGT_EVENT_INITIATOR, event_dw,
 			    S_028A90_EVENT_TYPE(~0));
-		print_named_value(f, "EVENT_INDEX", (ib[1] >> 8) & 0xf, 4);
-		print_named_value(f, "TCL1_VOL_ACTION_ENA", (ib[1] >> 12) & 0x1, 1);
-		print_named_value(f, "TC_VOL_ACTION_ENA", (ib[1] >> 13) & 0x1, 1);
-		print_named_value(f, "TC_WB_ACTION_ENA", (ib[1] >> 15) & 0x1, 1);
-		print_named_value(f, "TCL1_ACTION_ENA", (ib[1] >> 16) & 0x1, 1);
-		print_named_value(f, "TC_ACTION_ENA", (ib[1] >> 17) & 0x1, 1);
-		print_named_value(f, "TC_NC_ACTION_ENA", (ib[1] >> 19) & 0x1, 1);
-		print_named_value(f, "TC_WC_ACTION_ENA", (ib[1] >> 20) & 0x1, 1);
-		print_named_value(f, "TC_MD_ACTION_ENA", (ib[1] >> 21) & 0x1, 1);
-		print_named_value(f, "DST_SEL", (ib[2] >> 16) & 0x3, 2);
-		print_named_value(f, "INT_SEL", (ib[2] >> 24) & 0x7, 3);
-		print_named_value(f, "DATA_SEL", ib[2] >> 29, 3);
-		print_named_value(f, "ADDRESS_LO", ib[3], 32);
-		print_named_value(f, "ADDRESS_HI", ib[4], 32);
-		print_named_value(f, "DATA_LO", ib[5], 32);
-		print_named_value(f, "DATA_HI", ib[6], 32);
-		print_named_value(f, "CTXID", ib[7], 32);
+		print_named_value(f, "EVENT_INDEX", (event_dw >> 8) & 0xf, 4);
+		print_named_value(f, "TCL1_VOL_ACTION_ENA", (event_dw >> 12) & 0x1, 1);
+		print_named_value(f, "TC_VOL_ACTION_ENA", (event_dw >> 13) & 0x1, 1);
+		print_named_value(f, "TC_WB_ACTION_ENA", (event_dw >> 15) & 0x1, 1);
+		print_named_value(f, "TCL1_ACTION_ENA", (event_dw >> 16) & 0x1, 1);
+		print_named_value(f, "TC_ACTION_ENA", (event_dw >> 17) & 0x1, 1);
+		print_named_value(f, "TC_NC_ACTION_ENA", (event_dw >> 19) & 0x1, 1);
+		print_named_value(f, "TC_WC_ACTION_ENA", (event_dw >> 20) & 0x1, 1);
+		print_named_value(f, "TC_MD_ACTION_ENA", (event_dw >> 21) & 0x1, 1);
+		uint32_t sel_dw = ac_ib_get(ib);
+		print_named_value(f, "DST_SEL", (sel_dw >> 16) & 0x3, 2);
+		print_named_value(f, "INT_SEL", (sel_dw >> 24) & 0x7, 3);
+		print_named_value(f, "DATA_SEL", sel_dw >> 29, 3);
+		print_named_value(f, "ADDRESS_LO", ac_ib_get(ib), 32);
+		print_named_value(f, "ADDRESS_HI", ac_ib_get(ib), 32);
+		print_named_value(f, "DATA_LO", ac_ib_get(ib), 32);
+		print_named_value(f, "DATA_HI", ac_ib_get(ib), 32);
+		print_named_value(f, "CTXID", ac_ib_get(ib), 32);
 		break;
+	}
 	case PKT3_WAIT_REG_MEM:
-		print_named_value(f, "OP", ib[1], 32);
-		print_named_value(f, "ADDRESS_LO", ib[2], 32);
-		print_named_value(f, "ADDRESS_HI", ib[3], 32);
-		print_named_value(f, "REF", ib[4], 32);
-		print_named_value(f, "MASK", ib[5], 32);
-		print_named_value(f, "POLL_INTERVAL", ib[6], 16);
+		print_named_value(f, "OP", ac_ib_get(ib), 32);
+		print_named_value(f, "ADDRESS_LO", ac_ib_get(ib), 32);
+		print_named_value(f, "ADDRESS_HI", ac_ib_get(ib), 32);
+		print_named_value(f, "REF", ac_ib_get(ib), 32);
+		print_named_value(f, "MASK", ac_ib_get(ib), 32);
+		print_named_value(f, "POLL_INTERVAL", ac_ib_get(ib), 16);
 		break;
 	case PKT3_DRAW_INDEX_AUTO:
-		ac_dump_reg(f, R_030930_VGT_NUM_INDICES, ib[1], ~0);
-		ac_dump_reg(f, R_0287F0_VGT_DRAW_INITIATOR, ib[2], ~0);
+		ac_dump_reg(f, R_030930_VGT_NUM_INDICES, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_0287F0_VGT_DRAW_INITIATOR, ac_ib_get(ib), ~0);
 		break;
 	case PKT3_DRAW_INDEX_2:
-		ac_dump_reg(f, R_028A78_VGT_DMA_MAX_SIZE, ib[1], ~0);
-		ac_dump_reg(f, R_0287E8_VGT_DMA_BASE, ib[2], ~0);
-		ac_dump_reg(f, R_0287E4_VGT_DMA_BASE_HI, ib[3], ~0);
-		ac_dump_reg(f, R_030930_VGT_NUM_INDICES, ib[4], ~0);
-		ac_dump_reg(f, R_0287F0_VGT_DRAW_INITIATOR, ib[5], ~0);
+		ac_dump_reg(f, R_028A78_VGT_DMA_MAX_SIZE, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_0287E8_VGT_DMA_BASE, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_0287E4_VGT_DMA_BASE_HI, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_030930_VGT_NUM_INDICES, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_0287F0_VGT_DRAW_INITIATOR, ac_ib_get(ib), ~0);
 		break;
 	case PKT3_INDEX_TYPE:
-		ac_dump_reg(f, R_028A7C_VGT_DMA_INDEX_TYPE, ib[1], ~0);
+		ac_dump_reg(f, R_028A7C_VGT_DMA_INDEX_TYPE, ac_ib_get(ib), ~0);
 		break;
 	case PKT3_NUM_INSTANCES:
-		ac_dump_reg(f, R_030934_VGT_NUM_INSTANCES, ib[1], ~0);
+		ac_dump_reg(f, R_030934_VGT_NUM_INSTANCES, ac_ib_get(ib), ~0);
 		break;
 	case PKT3_WRITE_DATA:
-		ac_dump_reg(f, R_370_CONTROL, ib[1], ~0);
-		ac_dump_reg(f, R_371_DST_ADDR_LO, ib[2], ~0);
-		ac_dump_reg(f, R_372_DST_ADDR_HI, ib[3], ~0);
+		ac_dump_reg(f, R_370_CONTROL, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_371_DST_ADDR_LO, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_372_DST_ADDR_HI, ac_ib_get(ib), ~0);
 		for (i = 2; i < count; i++) {
 			print_spaces(f, INDENT_PKT);
-			fprintf(f, "0x%08x\n", ib[2+i]);
+			fprintf(f, "0x%08x\n", ac_ib_get(ib));
 		}
 		break;
 	case PKT3_CP_DMA:
-		ac_dump_reg(f, R_410_CP_DMA_WORD0, ib[1], ~0);
-		ac_dump_reg(f, R_411_CP_DMA_WORD1, ib[2], ~0);
-		ac_dump_reg(f, R_412_CP_DMA_WORD2, ib[3], ~0);
-		ac_dump_reg(f, R_413_CP_DMA_WORD3, ib[4], ~0);
-		ac_dump_reg(f, R_414_COMMAND, ib[5], ~0);
+		ac_dump_reg(f, R_410_CP_DMA_WORD0, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_411_CP_DMA_WORD1, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_412_CP_DMA_WORD2, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_413_CP_DMA_WORD3, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_414_COMMAND, ac_ib_get(ib), ~0);
 		break;
 	case PKT3_DMA_DATA:
-		ac_dump_reg(f, R_500_DMA_DATA_WORD0, ib[1], ~0);
-		ac_dump_reg(f, R_501_SRC_ADDR_LO, ib[2], ~0);
-		ac_dump_reg(f, R_502_SRC_ADDR_HI, ib[3], ~0);
-		ac_dump_reg(f, R_503_DST_ADDR_LO, ib[4], ~0);
-		ac_dump_reg(f, R_504_DST_ADDR_HI, ib[5], ~0);
-		ac_dump_reg(f, R_414_COMMAND, ib[6], ~0);
+		ac_dump_reg(f, R_500_DMA_DATA_WORD0, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_501_SRC_ADDR_LO, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_502_SRC_ADDR_HI, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_503_DST_ADDR_LO, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_504_DST_ADDR_HI, ac_ib_get(ib), ~0);
+		ac_dump_reg(f, R_414_COMMAND, ac_ib_get(ib), ~0);
 		break;
 	case PKT3_INDIRECT_BUFFER_SI:
 	case PKT3_INDIRECT_BUFFER_CONST:
-	case PKT3_INDIRECT_BUFFER_CIK:
-		ac_dump_reg(f, R_3F0_IB_BASE_LO, ib[1], ~0);
-		ac_dump_reg(f, R_3F1_IB_BASE_HI, ib[2], ~0);
-		ac_dump_reg(f, R_3F2_CONTROL, ib[3], ~0);
-
-		if (addr_callback) {
-			uint64_t addr = ((uint64_t)ib[2] << 32) | ib[1];
-			void *data = addr_callback(addr_callback_data, addr);
-			const char *name = G_3F2_CHAIN(ib[3]) ? "chained" : "nested";
-
-			if (data)
-				ac_parse_ib(f, data,  G_3F2_IB_SIZE(ib[3]),
-					    trace_id, name, chip_class,
-					    addr_callback, addr_callback_data);
+	case PKT3_INDIRECT_BUFFER_CIK: {
+		uint32_t base_lo_dw = ac_ib_get(ib);
+		ac_dump_reg(f, R_3F0_IB_BASE_LO, base_lo_dw, ~0);
+		uint32_t base_hi_dw = ac_ib_get(ib);
+		ac_dump_reg(f, R_3F1_IB_BASE_HI, base_hi_dw, ~0);
+		uint32_t control_dw = ac_ib_get(ib);
+		ac_dump_reg(f, R_3F2_CONTROL, control_dw, ~0);
+
+		if (!ib->addr_callback)
+			break;
+
+		uint64_t addr = ((uint64_t)base_hi_dw << 32) | base_lo_dw;
+		void *data = ib->addr_callback(ib->addr_callback_data, addr);
+		if (!data)
+			break;
+
+		if (G_3F2_CHAIN(control_dw)) {
+			ib->ib = data;
+			ib->num_dw = G_3F2_IB_SIZE(control_dw);
+			ib->cur_dw = 0;
+			return;
 		}
+
+		struct ac_ib_parser ib_recurse;
+		memcpy(&ib_recurse, ib, sizeof(ib_recurse));
+		ib_recurse.ib = data;
+		ib_recurse.num_dw = G_3F2_IB_SIZE(control_dw);
+		ib_recurse.cur_dw = 0;
+
+		fprintf(f, "------------------ nested begin ------------------\n");
+		ac_do_parse_ib(f, &ib_recurse);
+		fprintf(f, "------------------- nested end -------------------\n");
 		break;
+	}
 	case PKT3_CLEAR_STATE:
 	case PKT3_INCREMENT_DE_COUNTER:
 	case PKT3_PFP_SYNC_ME:
 		break;
 	case PKT3_NOP:
-		if (ib[0] == 0xffff1000) {
+		if (header == 0xffff1000) {
 			count = -1; /* One dword NOP. */
-			break;
-		} else if (count == 0 && AC_IS_TRACE_POINT(ib[1])) {
-			unsigned packet_id = AC_GET_TRACE_POINT_ID(ib[1]);
+		} else if (count == 0 && ib->cur_dw < ib->num_dw &&
+			   AC_IS_TRACE_POINT(ib->ib[ib->cur_dw])) {
+			unsigned packet_id = AC_GET_TRACE_POINT_ID(ib->ib[ib->cur_dw]);
 
 			print_spaces(f, INDENT_PKT);
 			fprintf(f, COLOR_RED "Trace point ID: %u\n", packet_id);
 
-			if (trace_id == -1)
+			if (ib->trace_id == -1)
 				break; /* tracing was disabled */
 
 			print_spaces(f, INDENT_PKT);
-			if (packet_id < trace_id)
+			if (packet_id < ib->trace_id)
 				fprintf(f, COLOR_RED
 					"This trace point was reached by the CP."
 					COLOR_RESET "\n");
-			else if (packet_id == trace_id)
+			else if (packet_id == ib->trace_id)
 				fprintf(f, COLOR_RED
 					"!!!!! This is the last trace point that "
 					"was reached by the CP !!!!!"
 					COLOR_RESET "\n");
-			else if (packet_id+1 == trace_id)
+			else if (packet_id+1 == ib->trace_id)
 				fprintf(f, COLOR_RED
 					"!!!!! This is the first trace point that "
 					"was NOT been reached by the CP !!!!!"
@@ -364,51 +413,37 @@ static uint32_t *ac_parse_packet3(FILE *f, uint32_t *ib, int *num_dw,
 					COLOR_RESET "\n");
 			break;
 		}
-		/* fall through, print all dwords */
-	default:
-		for (i = 0; i < count+1; i++) {
-			print_spaces(f, INDENT_PKT);
-			fprintf(f, "0x%08x\n", ib[1+i]);
-		}
+		break;
 	}
 
-	ib += count + 2;
-	*num_dw -= count + 2;
-	return ib;
+	/* print additional dwords */
+	while (ib->cur_dw <= first_dw + count) {
+		print_spaces(f, INDENT_PKT);
+		fprintf(f, "0x%08x\n", ac_ib_get(ib));
+	}
+
+	if (ib->cur_dw > first_dw + count + 1)
+		fprintf(f, COLOR_RED "!!!!! count in header too low !!!!!"
+			COLOR_RESET "\n");
 }
 
 /**
  * Parse and print an IB into a file.
- *
- * \param f		file
- * \param ib		IB
- * \param num_dw	size of the IB
- * \param chip_class	chip class
- * \param trace_id	the last trace ID that is known to have been reached
- *			and executed by the CP, typically read from a buffer
- * \param addr_callback Get a mapped pointer of the IB at a given address. Can
- *                      be NULL.
- * \param addr_callback_data user data for addr_callback
  */
-void ac_parse_ib_chunk(FILE *f, uint32_t *ib, int num_dw, int trace_id,
-		       enum chip_class chip_class,
-		       ac_debug_addr_callback addr_callback, void *addr_callback_data)
+static void ac_do_parse_ib(FILE *f, struct ac_ib_parser *ib)
 {
-	while (num_dw > 0) {
-		unsigned type = PKT_TYPE_G(ib[0]);
+	while (ib->cur_dw < ib->num_dw) {
+		uint32_t header = ac_ib_get(ib);
+		unsigned type = PKT_TYPE_G(header);
 
 		switch (type) {
 		case 3:
-			ib = ac_parse_packet3(f, ib, &num_dw, trace_id,
-					      chip_class, addr_callback,
-					      addr_callback_data);
+			ac_parse_packet3(f, header, ib);
 			break;
 		case 2:
 			/* type-2 nop */
-			if (ib[0] == 0x80000000) {
+			if (header == 0x80000000) {
 				fprintf(f, COLOR_GREEN "NOP (type 2)" COLOR_RESET "\n");
-				ib++;
-				num_dw--;
 				break;
 			}
 			/* fall through */
@@ -418,7 +453,7 @@ void ac_parse_ib_chunk(FILE *f, uint32_t *ib, int num_dw, int trace_id,
 		}
 	}
 
-	if (num_dw < 0) {
+	if (ib->cur_dw > ib->num_dw) {
 		printf("\nPacket ends after the end of IB.\n");
 		exit(0);
 	}
@@ -427,6 +462,33 @@ void ac_parse_ib_chunk(FILE *f, uint32_t *ib, int num_dw, int trace_id,
 /**
  * Parse and print an IB into a file.
  *
+ * \param f            file
+ * \param ib_ptr       IB
+ * \param num_dw       size of the IB
+ * \param chip_class   chip class
+ * \param trace_id     the last trace ID that is known to have been reached
+ *                     and executed by the CP, typically read from a buffer
+ * \param addr_callback Get a mapped pointer of the IB at a given address. Can
+ *                      be NULL.
+ * \param addr_callback_data user data for addr_callback
+ */
+void ac_parse_ib_chunk(FILE *f, uint32_t *ib_ptr, int num_dw, int trace_id,
+                       enum chip_class chip_class,
+                       ac_debug_addr_callback addr_callback, void *addr_callback_data)
+{
+	struct ac_ib_parser ib = {};
+	ib.ib = ib_ptr;
+	ib.num_dw = num_dw;
+	ib.trace_id = trace_id;
+	ib.chip_class = chip_class;
+	ib.addr_callback = addr_callback;
+	ib.addr_callback_data = addr_callback_data;
+	ac_do_parse_ib(f, &ib);
+}
+
+/**
+ * Parse and print an IB into a file.
+ *
  * \param f		file
  * \param ib		IB
  * \param num_dw	size of the IB