[Mesa-dev] [PATCH 4/8] i965: Store mcs buffer size

[Lionel Landwerlin]

From: Ben Widawsky <benjamin.widawsky at intel.com>

libdrm may round up the allocation requested by mesa. As a result, accesses
through the gtt may end up accessing memory which does not belong to mesa. The
problem is described in the following commit:
commit 7ae870211ddc40ef6ed209a322c3a721214bb737
Author: Eric Anholt <eric at anholt.net>
Date:   Mon Apr 14 16:52:43 2014 -0700

    i965: Fix buffer overruns in MSAA MCS buf This size field is an alternate

In that patch this was solved by making sure we only 1'd the logical size of the
buffer. This patch becomes necessary because the miptree data structure is going
to go away in the upcoming patch and we won't have access to the total_height
field anymore.

v2: drop setting the size in intel_hiz_miptree_buf_create() (Lionel)

Signed-off-by: Ben Widawsky <benjamin.widawsky at intel.com> (v1)
Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin at intel.com> (v2)
---
 src/mesa/drivers/dri/i965/intel_mipmap_tree.c | 4 ++--
 src/mesa/drivers/dri/i965/intel_mipmap_tree.h | 9 +++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
index c2bff17..3d1bdb1 100644
--- a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
+++ b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
@@ -1503,8 +1503,7 @@ intel_miptree_init_mcs(struct brw_context *brw,
       return;
    }
    void *data = mt->mcs_buf->bo->virtual;
-   memset(data, init_value,
-          mt->mcs_buf->mt->total_height * mt->mcs_buf->mt->pitch);
+   memset(data, init_value, mt->mcs_buf->size);
    drm_intel_bo_unmap(mt->mcs_buf->bo);
    mt->fast_clear_state = INTEL_FAST_CLEAR_STATE_CLEAR;
 }
@@ -1545,6 +1544,7 @@ intel_mcs_miptree_buf_create(struct brw_context *brw,
 
    buf->bo = temp_mt->bo;
    buf->offset = temp_mt->offset;
+   buf->size = temp_mt->total_height * temp_mt->pitch;
    buf->pitch = temp_mt->pitch;
    buf->qpitch = temp_mt->qpitch;
 
diff --git a/src/mesa/drivers/dri/i965/intel_mipmap_tree.h b/src/mesa/drivers/dri/i965/intel_mipmap_tree.h
index 0b49dc2..0b4b353 100644
--- a/src/mesa/drivers/dri/i965/intel_mipmap_tree.h
+++ b/src/mesa/drivers/dri/i965/intel_mipmap_tree.h
@@ -350,6 +350,15 @@ struct intel_miptree_aux_buffer
     */
    uint32_t offset;
 
+   /*
+    * Size of the MCS surface.
+    *
+    * This is needed when doing any gtt mapped operations on the buffer (which
+    * will be Y-tiled). It is possible that it will not be the same as bo->size
+    * when the drm allocator rounds up the requested size.
+    */
+   size_t size;
+
    /**
     * Pitch in bytes.
     *
-- 
2.10.2