This series fixes two long-standing bugs in the VC4 binner's out-of-memory (overflow) path. The binner writes each tile's binned command list into a per-job binner BO that is carved into fixed slots, and spills into overflow memory whenever a tile's list outgrows its initial tile-alloc block. Bugs in that path have been reported for years as GPU hangs, userspace heap corruption and occasional full system crashes [1][2].
The two patches address distinct problems and can be reviewed independently, though they were all found while chasing the same reports. Patch 1 addresses an issue in vc4_overflow_mem_work(). The function points BPOA at a 512KB slot inside the 16MB binner BO but writes the size of the *whole* BO to BPOS, so on every binner OOM event the hardware is authorized to DMA tile lists across other in-flight jobs' slots and, for any slot but the first, past the end of the BO into unrelated CMA memory. Patch 2 zeroes the Tile State Data Array (TSDA) when a job's binning slot is configured. Binner slots are recycled between jobs without ever being cleared and, although the kernel sets the "Auto-initialise Tile State Data Array" flag, the PTB demonstrably still acts on stale tile state left by the slot's previous user, generating invalid command streams with invalid primitive streams and branches that hang the GPU. [1] https://github.com/raspberrypi/linux/issues/3221 [2] https://github.com/raspberrypi/linux/issues/5780 Best regards, - Maíra --- v1 -> v2: https://lore.kernel.org/r/[email protected] - Drop the GPU-reset overflow-allocator fix and the dynamic initial tile-alloc block sizing in favor of new patch. - [1/2] Add Iago's R-b (Iago Toral) - [2/2] NEW PATCH: "drm/vc4: Zero the tile state data array before each BIN job" --- Jose Maria Casanova Crespo (1): drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Maíra Canal (1): drm/vc4: Zero the tile state data array before each BIN job drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +++++++++++++++++++++++------ 2 files changed, 24 insertions(+), 7 deletions(-) --- base-commit: a3caaa06809248b996254be5b47e10804a3494e2 change-id: 20260718-vc4-bin-oom-fixes-29cf2cce2562 -- Maíra Canal <[email protected]>
