mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
	akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
	Daniel Vetter <daniel.vetter@ffwll.ch>,
	Eric Anholt <eric@anholt.net>
Subject: [62/98] drm/i915: fix tiling limits for i915 class hw v2
Date: Mon, 10 May 2010 15:35:14 -0700	[thread overview]
Message-ID: <20100510223539.977813255@kvm.kroah.org> (raw)
In-Reply-To: <20100510223714.GA18416@kroah.com>

2.6.32-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Daniel Vetter <daniel.vetter@ffwll.ch>

commit c36a2a6de59e4a141a68b7575de837d3b0bd96b3 upstream.

Current code is definitely crap: Largest pitch allowed spills into
the TILING_Y bit of the fence registers ... :(

I've rewritten the limits check under the assumption that 3rd gen hw
has a 3d pitch limit of 8kb (like 2nd gen). This is supported by an
otherwise totally misleading XXX comment.

This bug mostly resulted in tiling-corrupted pixmaps because the kernel
allowed too wide buffers to be tiled. Bug brought to the light by the
xf86-video-intel 2.11 release because that unconditionally enabled
tiling for pixmaps, relying on the kernel to check things. Tiling for
the framebuffer was not affected because the ddx does some additional
checks there ensure the buffer is within hw-limits.

v2: Instead of computing the value that would be written into the
hw fence registers and then checking the limits simply check whether
the stride is above the 8kb limit. To better document the hw, add
some WARN_ONs in i915_write_fence_reg like I've done for the i830
case (using the right limits).

Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=27449
Tested-by: Alexander Lam <lambchop468@gmail.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/gpu/drm/i915/i915_gem.c        |    6 ++++++
 drivers/gpu/drm/i915/i915_gem_tiling.c |   22 +++++++++-------------
 drivers/gpu/drm/i915/i915_reg.h        |    2 +-
 3 files changed, 16 insertions(+), 14 deletions(-)

--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2334,6 +2334,12 @@ static void i915_write_fence_reg(struct
 	pitch_val = obj_priv->stride / tile_width;
 	pitch_val = ffs(pitch_val) - 1;
 
+	if (obj_priv->tiling_mode == I915_TILING_Y &&
+	    HAS_128_BYTE_Y_TILING(dev))
+		WARN_ON(pitch_val > I830_FENCE_MAX_PITCH_VAL);
+	else
+		WARN_ON(pitch_val > I915_FENCE_MAX_PITCH_VAL);
+
 	val = obj_priv->gtt_offset;
 	if (obj_priv->tiling_mode == I915_TILING_Y)
 		val |= 1 << I830_FENCE_TILING_Y_SHIFT;
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -353,21 +353,17 @@ i915_tiling_ok(struct drm_device *dev, i
 		 * reg, so dont bother to check the size */
 		if (stride / 128 > I965_FENCE_MAX_PITCH_VAL)
 			return false;
-	} else if (IS_I9XX(dev)) {
-		uint32_t pitch_val = ffs(stride / tile_width) - 1;
-
-		/* XXX: For Y tiling, FENCE_MAX_PITCH_VAL is actually 6 (8KB)
-		 * instead of 4 (2KB) on 945s.
-		 */
-		if (pitch_val > I915_FENCE_MAX_PITCH_VAL ||
-		    size > (I830_FENCE_MAX_SIZE_VAL << 20))
+	} else if (IS_I9XX(dev) || IS_I8XX(dev)) {
+		if (stride > 8192)
 			return false;
-	} else {
-		uint32_t pitch_val = ffs(stride / tile_width) - 1;
 
-		if (pitch_val > I830_FENCE_MAX_PITCH_VAL ||
-		    size > (I830_FENCE_MAX_SIZE_VAL << 19))
-			return false;
+		if (IS_I9XX(dev)) {
+			if (size > I830_FENCE_MAX_SIZE_VAL << 20)
+				return false;
+		} else {
+			if (size > I830_FENCE_MAX_SIZE_VAL << 19)
+				return false;
+		}
 	}
 
 	/* 965+ just needs multiples of tile width */
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -214,7 +214,7 @@
 #define   I830_FENCE_SIZE_BITS(size)	((ffs((size) >> 19) - 1) << 8)
 #define   I830_FENCE_PITCH_SHIFT	4
 #define   I830_FENCE_REG_VALID		(1<<0)
-#define   I915_FENCE_MAX_PITCH_VAL	0x10
+#define   I915_FENCE_MAX_PITCH_VAL	4
 #define   I830_FENCE_MAX_PITCH_VAL	6
 #define   I830_FENCE_MAX_SIZE_VAL	(1<<8)
 



  parent reply	other threads:[~2010-05-10 23:13 UTC|newest]

Thread overview: 106+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-05-10 22:37 [00/98] 2.6.32.13-stable review Greg KH
2010-05-10 22:34 ` [01/98] USB: EHCI: defer reclamation of siTDs Greg KH
2010-05-10 22:34 ` [02/98] p54usb: Add usbid for Corega CG-WLUSB2GT Greg KH
2010-05-10 22:34 ` [03/98] md/raid5: allow for more than 2^31 chunks Greg KH
2010-05-10 22:34 ` [04/98] md/raid5: fix previous patch Greg KH
2010-05-10 22:34 ` [05/98] libata: fix locking around blk_abort_request() Greg KH
2010-05-10 22:34 ` [06/98] libata: ensure NCQ error result taskfile is fully initialized Greg KH
2010-05-10 22:34 ` [07/98] w1: w1 temp: fix negative termperature calculation Greg KH
2010-05-10 22:34 ` [08/98] memcg: fix prepare migration Greg KH
2010-05-10 22:34 ` [09/98] mac80211: remove bogus TX agg state assignment Greg KH
2010-05-10 22:34 ` [10/98] flex_array: fix the panic when calling flex_array_alloc() without __GFP_ZERO Greg KH
2010-05-10 22:34 ` [11/98] core, x86: make LIST_POISON less deadly Greg KH
2010-05-10 22:34 ` [12/98] hugetlb: fix infinite loop in get_futex_key() when backed by huge pages Greg KH
2010-05-10 22:34 ` [13/98] reiserfs: fix permissions on .reiserfs_priv Greg KH
2010-05-10 22:34 ` [14/98] reiserfs: fix corruption during shrinking of xattrs Greg KH
2010-05-10 22:34 ` [15/98] nfsd4: bug in read_buf Greg KH
2010-05-10 22:34 ` [16/98] keys: the request_key() syscall should link an existing key to the dest keyring Greg KH
2010-05-10 22:34 ` [17/98] staging: usbip: Fix deadlock Greg KH
2010-05-10 22:34 ` [18/98] USB: fix remote wakeup settings during system sleep Greg KH
2010-05-10 22:34 ` [19/98] USB: Add id for HP ev2210 a.k.a Sierra MC5725 miniPCI-e Cell Modem Greg KH
2010-05-10 22:34 ` [20/98] USB: fix testing the wrong variable in fs_create_by_name() Greg KH
2010-05-10 22:34 ` [21/98] USB: dont choose configs with no interfaces Greg KH
2010-05-10 22:34 ` [22/98] USB: OHCI: dont look at the root hub to get the number of ports Greg KH
2010-05-10 22:34 ` [23/98] USB: xhci: properly set the "Mult" field of the endpoint context Greg KH
2010-05-10 22:34 ` [24/98] USB: xhci: properly set endpoint context fields for periodic eps Greg KH
2010-05-10 22:34 ` [25/98] procfs: fix tid fdinfo Greg KH
2010-05-10 22:34 ` [26/98] ocfs2: Update VFS inodes id info after reflink Greg KH
2010-05-10 22:34 ` [27/98] ocfs2: potential ERR_PTR dereference on error paths Greg KH
2010-05-10 22:34 ` [28/98] ocfs2: Compute metaecc for superblocks during online resize Greg KH
2010-05-10 22:34 ` [29/98] ocfs2_dlmfs: Fix math error when reading LVB Greg KH
2010-05-10 22:34 ` [30/98] powernow-k8: Fix frequency reporting Greg KH
2010-05-10 22:34 ` [31/98] nfs d_revalidate() is too trigger-happy with d_drop() Greg KH
2010-05-10 22:34 ` [32/98] NFS: rsize and wsize settings ignored on v4 mounts Greg KH
2010-05-10 22:34 ` [33/98] Staging: hv: Fix a bug affecting IPv6 Greg KH
2010-05-10 22:34 ` [34/98] Staging: hv: Fix up memory leak on HvCleanup Greg KH
2010-05-10 22:34 ` [35/98] Staging: hv: name network device ethX rather than sethX Greg KH
2010-05-10 22:34 ` [36/98] i2c: Fix probing of FSC hardware monitoring chips Greg KH
2010-05-10 22:34 ` [37/98] perf: Fix resource leak in failure path of perf_event_open() Greg KH
2010-05-10 22:34 ` [38/98] raid6: fix recovery performance regression Greg KH
2010-05-10 22:34 ` [39/98] serial: 8250_pnp - add Fujitsu Wacom device Greg KH
2010-05-10 22:34 ` [40/98] block: ensure jiffies wrap is handled correctly in blk_rq_timed_out_timer Greg KH
2010-05-10 22:34 ` [41/98] dm9601: fix phy/eeprom write routine Greg KH
2010-05-10 22:34 ` [42/98] p54pci: fix bugs in p54p_check_tx_ring Greg KH
2010-05-10 22:34 ` [43/98] edac, mce: Fix wrong mask and macro usage Greg KH
2010-05-10 22:34 ` [44/98] x86-64: Clear a 64-bit FS/GS base on fork if selector is nonzero Greg KH
2010-05-10 22:34 ` [45/98] x86: Disable large pages on CPUs with Atom erratum AAE44 Greg KH
2010-05-10 22:34 ` [46/98] x86, k8 nb: Fix boot crash: enable k8_northbridges unconditionally on AMD systems Greg KH
2010-05-10 22:34 ` [47/98] x86, AMD: Fix stale cpuid4_info shared_map data in shared_cpu_map cpumasks Greg KH
2010-05-10 22:35 ` [48/98] ALSA: hda: Use LPIB quirk for DG965OT board version AAD63733-203 Greg KH
2010-05-10 22:35 ` [49/98] ALSA: hda - Add PCI quirk for HP dv6-1110ax Greg KH
2010-05-10 22:35 ` [50/98] ALSA: hda: Use STAC_DELL_M6_BOTH quirk for Dell Studio XPS 1645 Greg KH
2010-05-10 22:35 ` [51/98] ALSA: hda: Use STAC_DELL_M6_BOTH quirk for Dell Studio 1558 Greg KH
2010-05-10 23:31   ` Nigel Cunningham
2010-05-10 22:35 ` [52/98] ALSA: hda: Use ALC880_F1734 quirk for Fujitsu Siemens AMILO Xi 1526 Greg KH
2010-05-10 22:35 ` [53/98] ALSA: snd-meastro3: Add amp_gpio quirk for Compaq EVO N600C Greg KH
2010-05-10 22:35 ` [54/98] ALSA: snd-meastro3: Ignore spurious HV interrupts during suspend / resume Greg KH
2010-05-10 22:35 ` [55/98] ALSA: hda: Fix max PCM level to 0 dB for Fujitsu-Siemens laptops using CX20549 (Venice) Greg KH
2010-05-10 22:35 ` [56/98] ALSA: hda: Fix 0 dB for Packard Bell models using Conexant " Greg KH
2010-05-10 22:35 ` [57/98] ALSA: hda: Use olpc-xo-1_5 quirk for Toshiba Satellite Pro T130-15F Greg KH
2010-05-10 22:35 ` [58/98] ALSA: hda: Use olpc-xo-1_5 quirk for Toshiba Satellite P500-PSPGSC-01800T Greg KH
2010-05-10 22:35 ` [59/98] libata: Fix accesses at LBA28 boundary (old bug, but nasty) (v2) Greg KH
2010-05-10 22:35 ` [60/98] ext4: correctly calculate number of blocks for fiemap Greg KH
2010-05-10 22:35 ` [61/98] initramfs: handle unrecognised decompressor when unpacking Greg KH
2010-05-10 22:35 ` Greg KH [this message]
2010-05-10 22:35 ` [63/98] CRED: Fix a race in creds_are_invalid() in credentials debugging Greg KH
2010-05-10 22:35 ` [64/98] jfs: fix diAllocExt error in resizing filesystem Greg KH
2010-05-10 22:35 ` [65/98] ACPI: introduce kernel parameter acpi_sleep=sci_force_enable Greg KH
2010-05-10 22:35 ` [66/98] p54pci: rx frame length check Greg KH
2010-05-10 22:35 ` [67/98] drivers/net/wireless/p54/txrx.c Fix off by one error Greg KH
2010-05-10 22:35 ` [68/98] dccp_probe: Fix module load dependencies between dccp and dccp_probe Greg KH
2010-05-10 22:35 ` [69/98] KVM: remove unused load_segment_descriptor_to_kvm_desct Greg KH
2010-05-10 22:35 ` [70/98] kgdb: dont needlessly skip PAGE_USER test for Fsl booke Greg KH
2010-05-10 22:35 ` [71/98] r8169: use correct barrier between cacheable and non-cacheable memory Greg KH
2010-05-10 22:35 ` [72/98] r8169: fix broken register writes Greg KH
2010-05-10 22:35 ` [73/98] r8169: more broken register writes workaround Greg KH
2010-05-10 22:35 ` [74/98] PCI: Ensure we re-enable devices on resume Greg KH
2010-05-10 22:35 ` [75/98] [SCSI] skip sense logging for some ATA PASS-THROUGH cdbs Greg KH
2010-05-10 22:35 ` [76/98] tg3: Fix INTx fallback when MSI fails Greg KH
2010-05-10 22:35 ` [77/98] xfs: add a shrinker to background inode reclaim Greg KH
2010-05-11 14:47   ` Alex Elder
2010-05-11 15:12     ` Greg KH
2010-05-10 22:35 ` [78/98] parisc: Set PCI CLS early in boot Greg KH
2010-05-10 22:35 ` [79/98] [SCSI] qla2xxx: Properly handle UNDERRUN completion statuses Greg KH
2010-05-10 22:35 ` [80/98] bnx2: Fix lost MSI-X problem on 5709 NICs Greg KH
2010-05-10 22:35 ` [81/98] tracing: Fix ftrace_event_call alignment for use with gcc 4.5 Greg KH
2010-05-10 22:35 ` [82/98] security: testing the wrong variable in create_by_name() Greg KH
2010-05-10 22:35 ` [83/98] md: restore ability of spare drives to spin down Greg KH
2010-05-10 22:35 ` [84/98] virtio: initialize earlier Greg KH
2010-05-10 22:35 ` [85/98] md/raid6: Fix raid-6 read-error correction in degraded state Greg KH
2010-05-10 22:35 ` [86/98] V4L/DVB: budget: Oops: "BUG: unable to handle kernel NULL pointer dereference" Greg KH
2010-05-10 22:35 ` [87/98] ACPI: DMI init_set_sci_en_on_resume for multiple Lenovo ThinkPads Greg KH
2010-05-11  3:39   ` Alex Chiang
2010-05-10 22:35 ` [88/98] power_meter: acpi_device_class "power_meter_resource" too long Greg KH
2010-05-10 22:35 ` [89/98] ACPI: sleep: init_set_sci_en_on_resume for Dell Studio 155x Greg KH
2010-05-10 22:35 ` [90/98] cpuidle: Fix incorrect optimization Greg KH
2010-05-10 22:35 ` [91/98] [ARM] pxa/colibri: fix missing #include <mach/mfp.h> in colibri.h Greg KH
2010-05-10 22:35 ` [92/98] SCSI: fix locking around blk_abort_request() Greg KH
2010-05-10 22:35 ` [93/98] SCSI: libiscsi: regression: fix header digest errors Greg KH
2010-05-10 22:35 ` [94/98] [SCSI] scsi_debug: virtual_gb ignores sector_size Greg KH
2010-05-10 22:35 ` [95/98] [SCSI] Enable retries for SYNCRONIZE_CACHE commands to fix I/O error Greg KH
2010-05-10 22:35 ` [96/98] SCSI: Retry commands with UNIT_ATTENTION sense codes to fix ext3/ext4 " Greg KH
2010-05-10 22:35 ` [97/98] MIPS: Sibyte: Apply M3 workaround only on affected chip types and versions Greg KH
2010-05-10 22:35 ` [98/98] MIPS: uasm: Add OR instruction Greg KH
2010-05-11 11:53   ` [Stable-review] " Stefan Bader
2010-05-11 12:00     ` Stefan Bader
2010-05-11 15:02     ` Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20100510223539.977813255@kvm.kroah.org \
    --to=gregkh@suse.de \
    --cc=akpm@linux-foundation.org \
    --cc=alan@lxorguk.ukuu.org.uk \
    --cc=daniel.vetter@ffwll.ch \
    --cc=eric@anholt.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable-review@kernel.org \
    --cc=stable@kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®