[PATCH] drm/radeon: Fix negative cursor position

[Michel Dänzer]

On 23/09/16 10:06 PM, Takashi Iwai wrote:
> radeon_cursor_move_unlock() contains a workaround for AVIVO chips that
> are older than DCE6 when the cursor ends on 128 pixel boundary.  It
> decreases the position when the calculated end position is on 128
> pixel boundary.  However, it hits also the condition where x=-1 and
> width=1 are passed, since cursor_end is 0 (which is aligned with 128,
> too).  Then the value gets decreased and it hits WARN_ON_ONCE()
> below, eventually screws up the GPU.
> 
> The fix is simply to skip the workaround when x is already zero.
> Also, remove the superfluous WARN_ON_ON() for the negative value check
> that wouldn't happen any longer after this change.
> 
> Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1000433
> Cc: <stable at vger.kernel.org>
> Signed-off-by: Takashi Iwai <tiwai at suse.de>
> ---
>  drivers/gpu/drm/radeon/radeon_cursor.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
> index 2a10e24b34b1..4e436eb49a56 100644
> --- a/drivers/gpu/drm/radeon/radeon_cursor.c
> +++ b/drivers/gpu/drm/radeon/radeon_cursor.c
> @@ -193,10 +193,8 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
>  			if (w <= 0) {
>  				w = 1;
>  				cursor_end = x - xorigin + w;
> -				if (!(cursor_end & 0x7f)) {
> +				if (x > 0 && !(cursor_end & 0x7f))
>  					x--;
> -					WARN_ON_ONCE(x < 0);
> -				}
>  			}

The problem with this change is that the horizontal cursor end position
can again and up as a multiple of 128, which this code is trying to
avoid, because it can break the cursor with some versions of AVIVO / DCE
display engines.

Attached is a proof-of-concept (only compile tested) alternative fix
which hides the cursor while it's out of bounds. I'll test it, clean it
up and split it up into multiple patches when I get a chance, but maybe
you or the reporter of the referenced bug can test it in the meantime.


-- 
Earthling Michel Dänzer               |               http://www.amd.com
Libre software enthusiast             |             Mesa and X developer
-------------- next part --------------
A non-text attachment was scrubbed...
Name: radeon-cursor-out-of-bounds.diff
Type: text/x-patch
Size: 4154 bytes
Desc: not available
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20160926/20463735/attachment-0001.bin>