Bug 15733

Summary: Crash when accessing nonexistent GTT entries in i915
Product: Drivers Reporter: Rafael J. Wysocki (rjw)
Component: Video(DRI - Intel)Assignee: drivers_video-dri-intel (drivers_video-dri-intel)
Status: CLOSED CODE_FIX    
Severity: normal CC: chris, daniel, jbarnes, maciej.rutecki
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: 2.6.32.4 Subsystem:
Regression: Yes Bisected commit-id:
Bug Depends on:    
Bug Blocks: 14885    
Attachments: Restrict GTT map size in i915/i945

Description Rafael J. Wysocki 2010-04-08 22:17:14 UTC 
Subject    : [PATCH] intel-agp.c: Fix crash when accessing nonexistent GTT entries in i915
Submitter  : Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Date       : 2010-03-10 22:09
Message-ID : 1268258994.2183.14.camel@carter
References : http://marc.info/?l=linux-kernel&m=126825901326111&w=4
Handled-By : Zhenyu Wang <zhenyuw@linux.intel.com>
Handled-By : Andrew Morton <akpm@linux-foundation.org>

This entry is being used for tracking a regression from 2.6.32.  Please don't
close it until the problem is fixed in the mainline.
Comment 1 Rafael J. Wysocki 2010-04-09 19:51:08 UTC 
On Friday 09 April 2010, Miguel Ojeda wrote:
> On Fri, Apr 9, 2010 at 1:04 AM, Rafael J. Wysocki <rjw@sisk.pl> wrote:
> > This message has been generated automatically as a part of a report
> > of regressions introduced between 2.6.32 and 2.6.33.
> >
> > The following bug entry is on the current list of known regressions
> > introduced between 2.6.32 and 2.6.33.  Please verify if it still should
> > be listed and let the tracking team know (either way).
> 
> It still should be listed.
> 
> >
> >
> > Bug-Entry       : http://bugzilla.kernel.org/show_bug.cgi?id=15733
> > Subject         : Crash when accessing nonexistent GTT entries in i915
> > Submitter       : Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
> > Date            : 2010-03-10 22:09 (30 days old)
> > Message-ID      : <1268258994.2183.14.camel@carter>
> > References      : http://marc.info/?l=linux-kernel&m=126825901326111&w=4
> > Handled-By      : Zhenyu Wang <zhenyuw@linux.intel.com>
> >                  Andrew Morton <akpm@linux-foundation.org>
Comment 2 Chris Wilson 2010-05-18 11:16:56 UTC 
The patch is slightly flawed in that even the earliest i915 were not limited to 128MB. However, the GTT on i915 and i945 is sized by the aperture.
Comment 3 Chris Wilson 2010-05-18 11:25:44 UTC 
Created attachment 26422 [details]
Restrict GTT map size in i915/i945
Comment 4 Chris Wilson 2010-06-06 12:59:01 UTC 
In 2.6.35-rc2:

commit f1befe71fa7a79ab733011b045639d8d809924ad
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Tue May 18 12:24:51 2010 +0100

    agp/intel: Restrict GTT mapping to valid range on i915 and i945
    
    References:
    
      Bug 15733 - Crash when accessing nonexistent GTT entries in i915
      https://bugzilla.kernel.org/show_bug.cgi?id=15733
    
    On G33 and above, the size of the GTT space is determined by the GMCH
    control register. Prior to this revision, the size is determined by the
    size of the aperture. So we must careful to map and fill the appropriate
    range depending on chipset.
    
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Eric Anholt <eric@anholt.net>
Comment 5 Daniel Vetter 2010-09-08 20:46:39 UTC 
The patch that supposedly fixes this bug is unfortunately itself rather broken (as was the first regression fix). There's a new patch available in the drm-intel-next branch available at:

http://cgit.freedesktop.org/~ickle/drm-intel/

Please retest to ensure that this does not break your systems - I'd like to avoid a regression fix for a regression fix for a regression fix ;)

-Daniel