| From af1a7301c7cf8912dca03065d448c4437c5c239f Mon Sep 17 00:00:00 2001 |
| From: Bob Paauwe <bob.j.paauwe@intel.com> |
| Date: Thu, 18 Dec 2014 09:51:26 -0800 |
| Subject: drm/i915: Only fence tiled region of object. |
| |
| From: Bob Paauwe <bob.j.paauwe@intel.com> |
| |
| commit af1a7301c7cf8912dca03065d448c4437c5c239f upstream. |
| |
| When creating a fence for a tiled object, only fence the area that |
| makes up the actual tiles. The object may be larger than the tiled |
| area and if we allow those extra addresses to be fenced, they'll |
| get converted to addresses beyond where the object is mapped. This |
| opens up the possiblity of writes beyond the end of object. |
| |
| To prevent this, we adjust the size of the fence to only encompass |
| the area that makes up the actual tiles. The extra space is considered |
| un-tiled and now behaves as if it was a linear object. |
| |
| Testcase: igt/gem_tiled_fence_overflow |
| Reported-by: Dan Hettena <danh@ghs.com> |
| Signed-off-by: Bob Paauwe <bob.j.paauwe@intel.com> |
| Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> |
| Signed-off-by: Jani Nikula <jani.nikula@intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/gpu/drm/i915/i915_gem.c | 7 +++++++ |
| 1 file changed, 7 insertions(+) |
| |
| --- a/drivers/gpu/drm/i915/i915_gem.c |
| +++ b/drivers/gpu/drm/i915/i915_gem.c |
| @@ -3050,6 +3050,13 @@ static void i965_write_fence_reg(struct |
| u32 size = i915_gem_obj_ggtt_size(obj); |
| uint64_t val; |
| |
| + /* Adjust fence size to match tiled area */ |
| + if (obj->tiling_mode != I915_TILING_NONE) { |
| + uint32_t row_size = obj->stride * |
| + (obj->tiling_mode == I915_TILING_Y ? 32 : 8); |
| + size = (size / row_size) * row_size; |
| + } |
| + |
| val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) & |
| 0xfffff000) << 32; |
| val |= i915_gem_obj_ggtt_offset(obj) & 0xfffff000; |