xf86-video-intel: 2 commits - src/sna/fb src/sna/kgem.c src/sna/kgem.h

[Chris Wilson]

 src/sna/fb/fbpointbits.h |   23 +++++++++++++----------
 src/sna/kgem.c           |    4 +++-
 src/sna/kgem.h           |    2 ++
 3 files changed, 18 insertions(+), 11 deletions(-)

New commits:
commit 08d73f1a4499cfe7c3121ff2ecdd36729c5f3544
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Wed Mar 12 12:17:55 2014 +0000

    sna: Only couple up a proxy->rq when inserting into the request->buffers list
    
    Otherwise, we may never decouple it again afterwards leading to a
    dangling pointer dereference.
    
    Bugzilla: https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/1289923
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/kgem.c b/src/sna/kgem.c
index 8aef623..729573a 100644
--- a/src/sna/kgem.c
+++ b/src/sna/kgem.c
@@ -5841,11 +5841,13 @@ struct kgem_bo *kgem_create_proxy(struct kgem *kgem,
 	bo->proxy = kgem_bo_reference(target);
 	bo->delta = offset;
 
+	/* Proxies are only tracked for busyness on the current rq */
 	if (target->exec && !bo->io) {
+		assert(RQ(target->rq) == kgem->next_request);
 		list_move_tail(&bo->request, &kgem->next_request->buffers);
 		bo->exec = &_kgem_dummy_exec;
+		bo->rq = target->rq;
 	}
-	bo->rq = target->rq;
 
 	return bo;
 }
diff --git a/src/sna/kgem.h b/src/sna/kgem.h
index fdabd50..cb0055e 100644
--- a/src/sna/kgem.h
+++ b/src/sna/kgem.h
@@ -630,6 +630,8 @@ static inline void __kgem_bo_mark_dirty(struct kgem_bo *bo)
 	     bo->handle, bo->proxy != NULL));
 
 	assert(bo->refcnt);
+	assert(bo->exec);
+	assert(bo->rq);
 
 	bo->exec->flags |= LOCAL_EXEC_OBJECT_WRITE;
 	bo->needs_flush = bo->gpu_dirty = true;
commit 2f50261539618c30c8470a5795fe5c2440e2318f
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Wed Mar 12 10:51:56 2014 +0000

    sna: Simplify code when no 64-bit registers are available in the ISA
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/fb/fbpointbits.h b/src/sna/fb/fbpointbits.h
index 60bf488..134f78e 100644
--- a/src/sna/fb/fbpointbits.h
+++ b/src/sna/fb/fbpointbits.h
@@ -116,32 +116,35 @@ DOTS__SIMPLE(FbBits * dst,
 	     FbBits and, FbBits xor)
 {
 	uint32_t *pts = (uint32_t *) ptsOrig;
-	BITS *bits = (BITS *) dst, *p;
+	BITS *bits = (BITS *) dst;
 	BITS bxor = (BITS) xor;
-	FbStride bitsStride = dstStride * (sizeof(FbBits) / sizeof(BITS));
+	unsigned bitsStride = dstStride * (sizeof(FbBits) / sizeof(BITS));
 
 	bits += bitsStride * (yorg + yoff) + (xorg + xoff);
+#if __x86_64__
 	while (npt >= 2) {
 		union {
 			uint32_t pt32[2];
 			uint64_t pt64;
 		} pt;
-		pt.pt64 = *(uint64_t *)pts;
 
-		p = bits + intToY(pt.pt32[0]) * bitsStride + intToX(pt.pt32[0]);
-		WRITE(p, bxor);
-
-		p = bits + intToY(pt.pt32[1]) * bitsStride + intToX(pt.pt32[1]);
-		WRITE(p, bxor);
+		pt.pt64 = *(uint64_t *)pts;
+		bits[intToY(pt.pt32[0]) * bitsStride + intToX(pt.pt32[0])] = bxor;
+		bits[intToY(pt.pt32[1]) * bitsStride + intToX(pt.pt32[1])] = bxor;
 
 		pts += 2;
 		npt -= 2;
 	}
 	if (npt) {
 		uint32_t pt = *pts;
-		p = bits + intToY(pt) * bitsStride + intToX(pt);
-		WRITE(p, bxor);
+		bits[intToY(pt) * bitsStride + intToX(pt)] = bxor;
+	}
+#else
+	while (npt--) {
+		uint32_t pt = *pts++;
+		bits[intToY(pt) * bitsStride + intToX(pt)] = bxor;
 	}
+#endif
 }
 
 #undef RROP