On Thu, Dec 18, 2014 at 09:51:26AM -0800, Bob Paauwe wrote:
> When creating a fence for a tiled object, only fence the area that
> makes up the actual tiles. The object may be larger than the tiled
> area and if we allow those extra addresses to be fenced, they'll
> get converted to addresses beyond where the object is mapped. This
> opens up the possiblity of writes beyond the end of object.
>
> To prevent this, we adjust the size of the fence to only encompass
> the area that makes up the actual tiles. The extra space is considered
> un-tiled and now behaves as if it was a linear object.
>
> Testcase: igt/gem_tiled_fence_overflow
> Reported-by: Dan Hettena <danh@xxxxxxx>
> Signed-off-by: Bob Paauwe <bob.j.paauwe@xxxxxxxxx>
Presuming this indeed blows up (I didn't try your test) this is one for
Jani.
Reviewed-by: Daniel Vetter <daniel.vetter@xxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Thanks, Daniel
> ---
> drivers/gpu/drm/i915/i915_gem.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
> index 67550ac..c9acbfa 100644
> --- a/drivers/gpu/drm/i915/i915_gem.c
> +++ b/drivers/gpu/drm/i915/i915_gem.c
> @@ -3173,6 +3173,13 @@ static void i965_write_fence_reg(struct drm_device *dev, int reg,
> u32 size = i915_gem_obj_ggtt_size(obj);
> uint64_t val;
>
> + /* Adjust fence size to match tiled area */
> + if (obj->tiling_mode != I915_TILING_NONE) {
> + uint32_t row_size = obj->stride *
> + (obj->tiling_mode == I915_TILING_Y ? 32 : 8);
> + size = (size / row_size) * row_size;
> + }
> +
> val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) &
> 0xfffff000) << 32;
> val |= i915_gem_obj_ggtt_offset(obj) & 0xfffff000;
> --
> 2.1.0
>
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx
--
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/intel-gfx
