On Thu, 18 Dec 2014, Daniel Vetter <daniel@xxxxxxxx> wrote: > On Thu, Dec 18, 2014 at 09:51:26AM -0800, Bob Paauwe wrote: >> When creating a fence for a tiled object, only fence the area that >> makes up the actual tiles. The object may be larger than the tiled >> area and if we allow those extra addresses to be fenced, they'll >> get converted to addresses beyond where the object is mapped. This >> opens up the possiblity of writes beyond the end of object. >> >> To prevent this, we adjust the size of the fence to only encompass >> the area that makes up the actual tiles. The extra space is considered >> un-tiled and now behaves as if it was a linear object. >> >> Testcase: igt/gem_tiled_fence_overflow >> Reported-by: Dan Hettena <danh@xxxxxxx> >> Signed-off-by: Bob Paauwe <bob.j.paauwe@xxxxxxxxx> > > Presuming this indeed blows up (I didn't try your test) this is one for > Jani. > > Reviewed-by: Daniel Vetter <daniel.vetter@xxxxxxxx> > Cc: stable@xxxxxxxxxxxxxxx Pushed to drm-intel-fixes, thanks for the patch and review. BR, Jani. > > Thanks, Daniel > >> --- >> drivers/gpu/drm/i915/i915_gem.c | 7 +++++++ >> 1 file changed, 7 insertions(+) >> >> diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c >> index 67550ac..c9acbfa 100644 >> --- a/drivers/gpu/drm/i915/i915_gem.c >> +++ b/drivers/gpu/drm/i915/i915_gem.c >> @@ -3173,6 +3173,13 @@ static void i965_write_fence_reg(struct drm_device *dev, int reg, >> u32 size = i915_gem_obj_ggtt_size(obj); >> uint64_t val; >> >> + /* Adjust fence size to match tiled area */ >> + if (obj->tiling_mode != I915_TILING_NONE) { >> + uint32_t row_size = obj->stride * >> + (obj->tiling_mode == I915_TILING_Y ? 32 : 8); >> + size = (size / row_size) * row_size; >> + } >> + >> val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) & >> 0xfffff000) << 32; >> val |= i915_gem_obj_ggtt_offset(obj) & 0xfffff000; >> -- >> 2.1.0 >> >> _______________________________________________ >> Intel-gfx mailing list >> Intel-gfx@xxxxxxxxxxxxxxxxxxxxx >> http://lists.freedesktop.org/mailman/listinfo/intel-gfx > > -- > Daniel Vetter > Software Engineer, Intel Corporation > +41 (0) 79 365 57 48 - http://blog.ffwll.ch -- Jani Nikula, Intel Open Source Technology Center _______________________________________________ Intel-gfx mailing list Intel-gfx@xxxxxxxxxxxxxxxxxxxxx http://lists.freedesktop.org/mailman/listinfo/intel-gfx