Kernel Bug Tracker – Bug 15733
Crash when accessing nonexistent GTT entries in i915
Last modified: 2010-09-08 20:46:39 UTC
Subject : [PATCH] intel-agp.c: Fix crash when accessing nonexistent GTT entries in i915
Submitter : Miguel Ojeda <email@example.com>
Date : 2010-03-10 22:09
Message-ID : 1268258994.2183.14.camel@carter
References : http://marc.info/?l=linux-kernel&m=126825901326111&w=4
Handled-By : Zhenyu Wang <firstname.lastname@example.org>
Handled-By : Andrew Morton <email@example.com>
This entry is being used for tracking a regression from 2.6.32. Please don't
close it until the problem is fixed in the mainline.
On Friday 09 April 2010, Miguel Ojeda wrote:
> On Fri, Apr 9, 2010 at 1:04 AM, Rafael J. Wysocki <firstname.lastname@example.org> wrote:
> > This message has been generated automatically as a part of a report
> > of regressions introduced between 2.6.32 and 2.6.33.
> > The following bug entry is on the current list of known regressions
> > introduced between 2.6.32 and 2.6.33. Please verify if it still should
> > be listed and let the tracking team know (either way).
> It still should be listed.
> > Bug-Entry : http://bugzilla.kernel.org/show_bug.cgi?id=15733
> > Subject : Crash when accessing nonexistent GTT entries in i915
> > Submitter : Miguel Ojeda <email@example.com>
> > Date : 2010-03-10 22:09 (30 days old)
> > Message-ID : <1268258994.2183.14.camel@carter>
> > References : http://marc.info/?l=linux-kernel&m=126825901326111&w=4
> > Handled-By : Zhenyu Wang <firstname.lastname@example.org>
> > Andrew Morton <email@example.com>
The patch is slightly flawed in that even the earliest i915 were not limited to 128MB. However, the GTT on i915 and i945 is sized by the aperture.
Created attachment 26422 [details]
Restrict GTT map size in i915/i945
Author: Chris Wilson <firstname.lastname@example.org>
Date: Tue May 18 12:24:51 2010 +0100
agp/intel: Restrict GTT mapping to valid range on i915 and i945
Bug 15733 - Crash when accessing nonexistent GTT entries in i915
On G33 and above, the size of the GTT space is determined by the GMCH
control register. Prior to this revision, the size is determined by the
size of the aperture. So we must careful to map and fill the appropriate
range depending on chipset.
Signed-off-by: Chris Wilson <email@example.com>
Signed-off-by: Eric Anholt <firstname.lastname@example.org>
The patch that supposedly fixes this bug is unfortunately itself rather broken (as was the first regression fix). There's a new patch available in the drm-intel-next branch available at:
Please retest to ensure that this does not break your systems - I'd like to avoid a regression fix for a regression fix for a regression fix ;)