drm/i915: Don't allow binding objects into the last page of the aperture.

This should avoid a class of bugs where the hardware prefetches past the
end of the object, and walks into unallocated memory when the object is
bound to the last page of the aperture.

fd.o bug #21488

Signed-off-by: Eric Anholt <eric@anholt.net>

diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 051134c56aef5d52b4aa8813ffd850b1d3b33a1f..3133f991968d1c66384502aa30c163b1e822ef37 100644 (file)
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1011,8 +1011,16 @@ static int i915_load_modeset_init(struct drm_device *dev)
        /* Basic memrange allocator for stolen space (aka vram) */
        drm_mm_init(&dev_priv->vram, 0, prealloc_size);
 
-       /* Let GEM Manage from end of prealloc space to end of aperture */
-       i915_gem_do_init(dev, prealloc_size, agp_size);
+       /* Let GEM Manage from end of prealloc space to end of aperture.
+        *
+        * However, leave one page at the end still bound to the scratch page.
+        * There are a number of places where the hardware apparently
+        * prefetches past the end of the object, and we've seen multiple
+        * hangs with the GPU head pointer stuck in a batchbuffer bound
+        * at the last page of the aperture.  One page should be enough to
+        * keep any prefetching inside of the aperture.
+        */
+       i915_gem_do_init(dev, prealloc_size, agp_size - 4096);
 
        ret = i915_gem_init_ringbuffer(dev);
        if (ret)