drm/i915: Only fence tiled region of object.

commit af1a7301c7cf8912dca03065d448c4437c5c239f upstream. When creating a fence for a tiled object, only fence the area that makes up the actual tiles. The object may be larger than the tiled area and if we allow those extra addresses to be fenced, they'll get converted to addresses beyond where the object is mapped. This opens up the possiblity of writes beyond the end of object. To prevent this, we adjust the size of the fence to only encompass the area that makes up the actual tiles. The extra space is considered un-tiled and now behaves as if it was a linear object. Testcase: igt/gem_tiled_fence_overflow Reported-by: Dan Hettena <danh@ghs.com> Signed-off-by: Bob Paauwe <bob.j.paauwe@intel.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/i915: Only fence tiled region of object.
commit af1a7301c7cf8912dca03065d448c4437c5c239f upstream. When creating a fence for a tiled object, only fence the area that makes up the actual tiles. The object may be larger than the tiled area and if we allow those extra addresses to be fenced, they'll get converted to addresses beyond where the object is mapped. This opens up the possiblity of writes beyond the end of object. To prevent this, we adjust the size of the fence to only encompass the area that makes up the actual tiles. The extra space is considered un-tiled and now behaves as if it was a linear object. Testcase: igt/gem_tiled_fence_overflow Reported-by: Dan Hettena <danh@ghs.com> Signed-off-by: Bob Paauwe <bob.j.paauwe@intel.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bob Paauwe · Greg Kroah-Hartman
1 parent e63fea1633
Showing 1 changed file with 7 additions and 0 deletions Side-by-side Diff
drivers/gpu/drm/i915/i915_gem.c
@@ -3050,6 +3050,13 @@
 		u32 size = i915_gem_obj_ggtt_size(obj);
 		uint64_t val;
  
+		/* Adjust fence size to match tiled area */
+		if (obj->tiling_mode != I915_TILING_NONE) {
+			uint32_t row_size = obj->stride *
+				(obj->tiling_mode == I915_TILING_Y ? 32 : 8);
+			size = (size / row_size) * row_size;
+		}
+
 		val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) &
 				 0xfffff000) << 32;
 		val |= i915_gem_obj_ggtt_offset(obj) & 0xfffff000;
...	...	@@ -3050,6 +3050,13 @@
3050	3050	u32 size = i915_gem_obj_ggtt_size(obj);
3051	3051	uint64_t val;
3052	3052
	3053	+ /* Adjust fence size to match tiled area */
	3054	+ if (obj->tiling_mode != I915_TILING_NONE) {
	3055	+ uint32_t row_size = obj->stride *
	3056	+ (obj->tiling_mode == I915_TILING_Y ? 32 : 8);
	3057	+ size = (size / row_size) * row_size;
	3058	+ }
	3059	+
3053	3060	val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) &
3054	3061	0xfffff000) << 32;
3055	3062	val \|= i915_gem_obj_ggtt_offset(obj) & 0xfffff000;