xf86-video-intel: 2 commits - src/sna/fb src/sna/kgem.c src/sna/kgem.h
Chris Wilson
ickle at kemper.freedesktop.org
Wed Mar 12 05:26:20 PDT 2014
src/sna/fb/fbpointbits.h | 23 +++++++++++++----------
src/sna/kgem.c | 4 +++-
src/sna/kgem.h | 2 ++
3 files changed, 18 insertions(+), 11 deletions(-)
New commits:
commit 08d73f1a4499cfe7c3121ff2ecdd36729c5f3544
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date: Wed Mar 12 12:17:55 2014 +0000
sna: Only couple up a proxy->rq when inserting into the request->buffers list
Otherwise, we may never decouple it again afterwards leading to a
dangling pointer dereference.
Bugzilla: https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/1289923
Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
diff --git a/src/sna/kgem.c b/src/sna/kgem.c
index 8aef623..729573a 100644
--- a/src/sna/kgem.c
+++ b/src/sna/kgem.c
@@ -5841,11 +5841,13 @@ struct kgem_bo *kgem_create_proxy(struct kgem *kgem,
bo->proxy = kgem_bo_reference(target);
bo->delta = offset;
+ /* Proxies are only tracked for busyness on the current rq */
if (target->exec && !bo->io) {
+ assert(RQ(target->rq) == kgem->next_request);
list_move_tail(&bo->request, &kgem->next_request->buffers);
bo->exec = &_kgem_dummy_exec;
+ bo->rq = target->rq;
}
- bo->rq = target->rq;
return bo;
}
diff --git a/src/sna/kgem.h b/src/sna/kgem.h
index fdabd50..cb0055e 100644
--- a/src/sna/kgem.h
+++ b/src/sna/kgem.h
@@ -630,6 +630,8 @@ static inline void __kgem_bo_mark_dirty(struct kgem_bo *bo)
bo->handle, bo->proxy != NULL));
assert(bo->refcnt);
+ assert(bo->exec);
+ assert(bo->rq);
bo->exec->flags |= LOCAL_EXEC_OBJECT_WRITE;
bo->needs_flush = bo->gpu_dirty = true;
commit 2f50261539618c30c8470a5795fe5c2440e2318f
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date: Wed Mar 12 10:51:56 2014 +0000
sna: Simplify code when no 64-bit registers are available in the ISA
Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
diff --git a/src/sna/fb/fbpointbits.h b/src/sna/fb/fbpointbits.h
index 60bf488..134f78e 100644
--- a/src/sna/fb/fbpointbits.h
+++ b/src/sna/fb/fbpointbits.h
@@ -116,32 +116,35 @@ DOTS__SIMPLE(FbBits * dst,
FbBits and, FbBits xor)
{
uint32_t *pts = (uint32_t *) ptsOrig;
- BITS *bits = (BITS *) dst, *p;
+ BITS *bits = (BITS *) dst;
BITS bxor = (BITS) xor;
- FbStride bitsStride = dstStride * (sizeof(FbBits) / sizeof(BITS));
+ unsigned bitsStride = dstStride * (sizeof(FbBits) / sizeof(BITS));
bits += bitsStride * (yorg + yoff) + (xorg + xoff);
+#if __x86_64__
while (npt >= 2) {
union {
uint32_t pt32[2];
uint64_t pt64;
} pt;
- pt.pt64 = *(uint64_t *)pts;
- p = bits + intToY(pt.pt32[0]) * bitsStride + intToX(pt.pt32[0]);
- WRITE(p, bxor);
-
- p = bits + intToY(pt.pt32[1]) * bitsStride + intToX(pt.pt32[1]);
- WRITE(p, bxor);
+ pt.pt64 = *(uint64_t *)pts;
+ bits[intToY(pt.pt32[0]) * bitsStride + intToX(pt.pt32[0])] = bxor;
+ bits[intToY(pt.pt32[1]) * bitsStride + intToX(pt.pt32[1])] = bxor;
pts += 2;
npt -= 2;
}
if (npt) {
uint32_t pt = *pts;
- p = bits + intToY(pt) * bitsStride + intToX(pt);
- WRITE(p, bxor);
+ bits[intToY(pt) * bitsStride + intToX(pt)] = bxor;
+ }
+#else
+ while (npt--) {
+ uint32_t pt = *pts++;
+ bits[intToY(pt) * bitsStride + intToX(pt)] = bxor;
}
+#endif
}
#undef RROP
More information about the xorg-commit
mailing list