From: Ville Syrjälä <[email protected]>

i915_gem_object_create_internal() does not hand out zeroed
memory. Thus we may confuse whatever stale garbage is in
there as a previous register write and mistakenly handle the
first actual register write as an indexed write. This can
end up corrupting the instruction sufficiently well to lose
the entire register write.

Make sure we've actually emitted a previous instruction before
attemting indexed register write merging.

Signed-off-by: Ville Syrjälä <[email protected]>
---
 drivers/gpu/drm/i915/display/intel_dsb.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_dsb.c 
b/drivers/gpu/drm/i915/display/intel_dsb.c
index 093b2567883d..a20ae5313d23 100644
--- a/drivers/gpu/drm/i915/display/intel_dsb.c
+++ b/drivers/gpu/drm/i915/display/intel_dsb.c
@@ -141,6 +141,14 @@ static bool intel_dsb_prev_ins_is_write(struct intel_dsb 
*dsb,
        const u32 *buf = dsb->cmd_buf;
        u32 prev_opcode, prev_reg;
 
+       /*
+        * Nothing emitted yet? Must check before looking
+        * at the actual data since i915_gem_object_create_internal()
+        * does *not* give you zeroed memory!
+        */
+       if (dsb->free_pos == 0)
+               return false;
+
        prev_opcode = buf[dsb->ins_start_offset + 1] >> DSB_OPCODE_SHIFT;
        prev_reg = buf[dsb->ins_start_offset + 1] & DSB_REG_VALUE_MASK;
 
-- 
2.39.3

Reply via email to