public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Brandon Philips <bphilips@suse.de>
To: Dave Airlie <airlied@redhat.com>,
	Zhenyu Wang <zhenyu.z.wang@intel.com>,
	Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: linux-kernel@vger.kernel.org
Subject: [PATCH] intel-agp: Avoid oops for G33 on 1MB stolen case
Date: Tue, 14 Oct 2008 15:58:17 -0700	[thread overview]
Message-ID: <20081014225817.GA29267@plankton.lan> (raw)

This is similar to f443675affe3f16dd428e46f0f7fd3f4d703eeab which was
reverted because it broke older X.org driver. This patch only fixes
the 1MB stolen case since it causes an oops.

Xorg will not work without the accompanying patch[1] but avoiding an
oops and making it possible to work with patched xorg driver is
reasonable.

[1] http://ifup.org/~philips/review/xf86-video-intel-G33-1mb.patch

Explanation of the oops:

> static void intel_i830_init_gtt_entries(void)
...
>         } else if (IS_G33) {
>         /* G33's GTT size defined in gmch_ctrl */
>                 switch (gmch_ctrl & G33_PGETBL_SIZE_MASK) {
>                 case G33_PGETBL_SIZE_1M:
>                         size = 1024;
>                         break;
...
>                 size += 4;

size = 1028

Then since we have the BIOS setting 1MB for the device in the GMCH
control we get to here:

>         } else {
>                 switch (gmch_ctrl & I855_GMCH_GMS_MASK) {
>                 case I855_GMCH_GMS_STOLEN_1M:
>                         gtt_entries = MB(1) - KB(size);
>                         break;

MB(1) = 1 * 1024 * 1024
KB(1028) = 1028 * 1024

MB(1) - KB(1028) = -4096

>         gtt_entries /= KB(4);
>         intel_private.gtt_entries = gtt_entries;

We end up with -1 in gtt_entries.

This leads to intel_i915_configure reading/writing to areas outside of
mapped memory and the oops.

Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=391261

Signed-off-by: Brandon Philips <bphilips@suse.de>

---
 drivers/char/agp/intel-agp.c |    8 ++++++++
 1 file changed, 8 insertions(+)

Index: linux-2.6/drivers/char/agp/intel-agp.c
===================================================================
--- linux-2.6.orig/drivers/char/agp/intel-agp.c
+++ linux-2.6/drivers/char/agp/intel-agp.c
@@ -559,6 +559,14 @@ static void intel_i830_init_gtt_entries(
 	} else {
 		switch (gmch_ctrl & I855_GMCH_GMS_MASK) {
 		case I855_GMCH_GMS_STOLEN_1M:
+			if (IS_G33) {
+				size = 0;
+				printk(KERN_WARNING PFX
+				       "Warning: G33 chipset with 1MB"
+					" allocated. Older X.org Intel drivers"
+					" will not work.\n");
+				WARN_ON(1);
+			}
 			gtt_entries = MB(1) - KB(size);
 			break;
 		case I855_GMCH_GMS_STOLEN_4M:

             reply	other threads:[~2008-10-14 23:01 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-10-14 22:58 Brandon Philips [this message]
2008-10-20 21:21 ` [PATCH] intel-agp: Avoid oops for G33 on 1MB stolen case Andrew Morton
2008-10-20 21:44   ` Dave Airlie
2008-10-20 21:52     ` Arjan van de Ven
2008-10-29  4:41       ` Brandon Philips
2008-10-29  5:22       ` [PATCH v2] " Brandon Philips
2008-10-29  5:23   ` [PATCH] " Brandon Philips

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20081014225817.GA29267@plankton.lan \
    --to=bphilips@suse.de \
    --cc=airlied@redhat.com \
    --cc=jbarnes@virtuousgeek.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=zhenyu.z.wang@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox