[PATCH] sna/kgem: Gen8 blt broken when dest base offset has bit 4 set

[PATCH] sna/kgem: Gen8 blt broken when dest base offset has bit 4 set

[Mika Kuoppala]

With bit 4 set in destination base address, the Gen8 blitter
fails and blits errorneously into area before destination
(dest - 16 bytes), corrupting memory.

Broken hw is suspect.

v2: Update the destination base offset pattern as revealed
    by igt/tests/gem_userptr_blits/destination-bo-align

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=79053
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Tested-by: xunx.fang@intel.com
Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com>
---
 src/sna/kgem.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/sna/kgem.h b/src/sna/kgem.h
index 6adae3b..344dcea 100644
--- a/src/sna/kgem.h
+++ b/src/sna/kgem.h
@@ -551,6 +551,11 @@ static inline bool kgem_bo_blt_pitch_is_ok(struct kgem *kgem,
 					   struct kgem_bo *bo)
 {
 	int pitch = bo->pitch;
+
+	/* bdw is broken with blit dst align */
+	if (kgem->gen >= 0100 && pitch & (1 << 4))
+		return false;
+
 	if (kgem->gen >= 040 && bo->tiling)
 		pitch /= 4;
 	if (pitch > MAXSHORT) {
-- 
1.9.1

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH] sna/kgem: Gen8 blt broken when dest base offset has bit 4 set

[Chris Wilson]

On Wed, Nov 19, 2014 at 03:10:05PM +0200, Mika Kuoppala wrote:
> With bit 4 set in destination base address, the Gen8 blitter
> fails and blits errorneously into area before destination
> (dest - 16 bytes), corrupting memory.
> 
> Broken hw is suspect.
> 
> v2: Update the destination base offset pattern as revealed
>     by igt/tests/gem_userptr_blits/destination-bo-align
> 
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=79053
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Tested-by: xunx.fang@intel.com
> Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com>
> ---
>  src/sna/kgem.h | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/src/sna/kgem.h b/src/sna/kgem.h
> index 6adae3b..344dcea 100644
> --- a/src/sna/kgem.h
> +++ b/src/sna/kgem.h
> @@ -551,6 +551,11 @@ static inline bool kgem_bo_blt_pitch_is_ok(struct kgem *kgem,
>  					   struct kgem_bo *bo)
>  {
>  	int pitch = bo->pitch;
> +
> +	/* bdw is broken with blit dst align */
> +	if (kgem->gen >= 0100 && pitch & (1 << 4))
> +		return false;
> +
>  	if (kgem->gen >= 040 && bo->tiling)
>  		pitch /= 4;
>  	if (pitch > MAXSHORT) {

I added a chunk:

@@ -573,6 +580,12 @@ static inline bool kgem_bo_can_blt(struct kgem *kgem,
                return false;
        }
 
+       if (kgem->gen >= 0100 && bo->proxy && bo->delta & (1 << 4)) {
+               DBG(("%s: can not blt to handle=%d, delta=%d\n",
+                    __FUNCTION__, bo->handle, bo->delta));
+               return false;
+       }
+
        return kgem_bo_blt_pitch_is_ok(kgem, bo);
 }

In case we had a 32-byte pitch but starting at a 16-byte offset, which
should also trigger the corruption, right?
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH] sna/kgem: Gen8 blt broken when dest base offset has bit 4 set

[Mika Kuoppala]

Chris Wilson <chris@chris-wilson.co.uk> writes:

> On Wed, Nov 19, 2014 at 03:10:05PM +0200, Mika Kuoppala wrote:
>> With bit 4 set in destination base address, the Gen8 blitter
>> fails and blits errorneously into area before destination
>> (dest - 16 bytes), corrupting memory.
>> 
>> Broken hw is suspect.
>> 
>> v2: Update the destination base offset pattern as revealed
>>     by igt/tests/gem_userptr_blits/destination-bo-align
>> 
>> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=79053
>> Cc: Chris Wilson <chris@chris-wilson.co.uk>
>> Tested-by: xunx.fang@intel.com
>> Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com>
>> ---
>>  src/sna/kgem.h | 5 +++++
>>  1 file changed, 5 insertions(+)
>> 
>> diff --git a/src/sna/kgem.h b/src/sna/kgem.h
>> index 6adae3b..344dcea 100644
>> --- a/src/sna/kgem.h
>> +++ b/src/sna/kgem.h
>> @@ -551,6 +551,11 @@ static inline bool kgem_bo_blt_pitch_is_ok(struct kgem *kgem,
>>  					   struct kgem_bo *bo)
>>  {
>>  	int pitch = bo->pitch;
>> +
>> +	/* bdw is broken with blit dst align */
>> +	if (kgem->gen >= 0100 && pitch & (1 << 4))
>> +		return false;
>> +
>>  	if (kgem->gen >= 040 && bo->tiling)
>>  		pitch /= 4;
>>  	if (pitch > MAXSHORT) {
>
> I added a chunk:
>
> @@ -573,6 +580,12 @@ static inline bool kgem_bo_can_blt(struct kgem *kgem,
>                 return false;
>         }
>  
> +       if (kgem->gen >= 0100 && bo->proxy && bo->delta & (1 << 4)) {
> +               DBG(("%s: can not blt to handle=%d, delta=%d\n",
> +                    __FUNCTION__, bo->handle, bo->delta));
> +               return false;
> +       }
> +
>         return kgem_bo_blt_pitch_is_ok(kgem, bo);
>  }
>
> In case we had a 32-byte pitch but starting at a 16-byte offset, which
> should also trigger the corruption, right?
> -Chris

So far the story is:

in XY_SRC_COPY_BLT, if Destination base address
bit 4 is set, it will blit into wrong destination

If bit 4 is set in Source base address, you
get blit into correct spot but with bad data.

I have used 4 * 4 dwords as a pattern. I will
do more experiments with the pitch tomorrow.

-Mika

>
> -- 
> Chris Wilson, Intel Open Source Technology Centre
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx