Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7e3f8e91 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2018-01-24' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes 

Two vc4 fixes that were applied in the last day.
One fixes a NULL dereference, and the other fixes
a flickering bug.

Cc: Eric Anholt <eric@anholt.net>
Cc: Boris Brezillon <boris.brezillon@free-electrons.com>

* tag 'drm-misc-fixes-2018-01-24' of git://anongit.freedesktop.org/drm/drm-misc:
  drm/vc4: Fix NULL pointer dereference in vc4_save_hang_state()
  drm/vc4: Flush the caches before the bin jobs, as well.
parents 0c5b9b5d 17b11b76

drivers/gpu/drm/vc4/vc4_gem.c

+27 −6
Original line number Diff line number Diff line
@@ -146,7 +146,7 @@ vc4_save_hang_state(struct drm_device *dev) 
	struct vc4_exec_info *exec[2];

	struct vc4_bo *bo;

	unsigned long irqflags;

	unsigned int i, j, unref_list_count, prev_idx;

	unsigned int i, j, k, unref_list_count;



	kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL);

	if (!kernel_state)
@@ -182,7 +182,7 @@ vc4_save_hang_state(struct drm_device *dev) 
		return;

	}



	prev_idx = 0;

	k = 0;

	for (i = 0; i < 2; i++) {

		if (!exec[i])

			continue;
@@ -197,7 +197,7 @@ vc4_save_hang_state(struct drm_device *dev) 
			WARN_ON(!refcount_read(&bo->usecnt));

			refcount_inc(&bo->usecnt);

			drm_gem_object_get(&exec[i]->bo[j]->base);

			kernel_state->bo[j + prev_idx] = &exec[i]->bo[j]->base;

			kernel_state->bo[k++] = &exec[i]->bo[j]->base;

		}



		list_for_each_entry(bo, &exec[i]->unref_list, unref_head) {
@@ -205,12 +205,12 @@ vc4_save_hang_state(struct drm_device *dev) 
			 * because they are naturally unpurgeable.

			 */

			drm_gem_object_get(&bo->base.base);

			kernel_state->bo[j + prev_idx] = &bo->base.base;

			j++;

			kernel_state->bo[k++] = &bo->base.base;

		}

		prev_idx = j + 1;

	}



	WARN_ON_ONCE(k != state->bo_count);



	if (exec[0])

		state->start_bin = exec[0]->ct0ca;

	if (exec[1])
@@ -436,6 +436,19 @@ vc4_flush_caches(struct drm_device *dev) 
		  VC4_SET_FIELD(0xf, V3D_SLCACTL_ICC));

}



static void

vc4_flush_texture_caches(struct drm_device *dev)

{

	struct vc4_dev *vc4 = to_vc4_dev(dev);



	V3D_WRITE(V3D_L2CACTL,

		  V3D_L2CACTL_L2CCLR);



	V3D_WRITE(V3D_SLCACTL,

		  VC4_SET_FIELD(0xf, V3D_SLCACTL_T1CC) |

		  VC4_SET_FIELD(0xf, V3D_SLCACTL_T0CC));

}



/* Sets the registers for the next job to be actually be executed in

 * the hardware.

 *
@@ -474,6 +487,14 @@ vc4_submit_next_render_job(struct drm_device *dev) 
	if (!exec)

		return;



	/* A previous RCL may have written to one of our textures, and

	 * our full cache flush at bin time may have occurred before

	 * that RCL completed.  Flush the texture cache now, but not

	 * the instructions or uniforms (since we don't write those

	 * from an RCL).

	 */

	vc4_flush_texture_caches(dev);



	submit_cl(dev, 1, exec->ct1ca, exec->ct1ea);

}