[Mesa-dev] [PATCH 4/8] i965: Store mcs buffer size

[Pohjolainen, Topi]

On Thu, Nov 03, 2016 at 10:39:39AM +0000, Lionel Landwerlin wrote:
> From: Ben Widawsky <benjamin.widawsky at intel.com>
> 
> libdrm may round up the allocation requested by mesa. As a result, accesses
> through the gtt may end up accessing memory which does not belong to mesa. The
> problem is described in the following commit:
> commit 7ae870211ddc40ef6ed209a322c3a721214bb737
> Author: Eric Anholt <eric at anholt.net>
> Date:   Mon Apr 14 16:52:43 2014 -0700
> 
>     i965: Fix buffer overruns in MSAA MCS buf This size field is an alternate
> 
> In that patch this was solved by making sure we only 1'd the logical size of the
> buffer. This patch becomes necessary because the miptree data structure is going
> to go away in the upcoming patch and we won't have access to the total_height
> field anymore.
> 
> v2: drop setting the size in intel_hiz_miptree_buf_create() (Lionel)
> 
> Signed-off-by: Ben Widawsky <benjamin.widawsky at intel.com> (v1)
> Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin at intel.com> (v2)
> ---
>  src/mesa/drivers/dri/i965/intel_mipmap_tree.c | 4 ++--
>  src/mesa/drivers/dri/i965/intel_mipmap_tree.h | 9 +++++++++
>  2 files changed, 11 insertions(+), 2 deletions(-)
> 
> diff --git a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
> index c2bff17..3d1bdb1 100644
> --- a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
> +++ b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
> @@ -1503,8 +1503,7 @@ intel_miptree_init_mcs(struct brw_context *brw,
>        return;
>     }
>     void *data = mt->mcs_buf->bo->virtual;
> -   memset(data, init_value,
> -          mt->mcs_buf->mt->total_height * mt->mcs_buf->mt->pitch);

If I read the previous patch right, this is already needed there as
mcs_buf->mt is left NULL?

> +   memset(data, init_value, mt->mcs_buf->size);
>     drm_intel_bo_unmap(mt->mcs_buf->bo);
>     mt->fast_clear_state = INTEL_FAST_CLEAR_STATE_CLEAR;
>  }
> @@ -1545,6 +1544,7 @@ intel_mcs_miptree_buf_create(struct brw_context *brw,
>  
>     buf->bo = temp_mt->bo;
>     buf->offset = temp_mt->offset;
> +   buf->size = temp_mt->total_height * temp_mt->pitch;
>     buf->pitch = temp_mt->pitch;
>     buf->qpitch = temp_mt->qpitch;
>  
> diff --git a/src/mesa/drivers/dri/i965/intel_mipmap_tree.h b/src/mesa/drivers/dri/i965/intel_mipmap_tree.h
> index 0b49dc2..0b4b353 100644
> --- a/src/mesa/drivers/dri/i965/intel_mipmap_tree.h
> +++ b/src/mesa/drivers/dri/i965/intel_mipmap_tree.h
> @@ -350,6 +350,15 @@ struct intel_miptree_aux_buffer
>      */
>     uint32_t offset;
>  
> +   /*
> +    * Size of the MCS surface.
> +    *
> +    * This is needed when doing any gtt mapped operations on the buffer (which
> +    * will be Y-tiled). It is possible that it will not be the same as bo->size
> +    * when the drm allocator rounds up the requested size.
> +    */
> +   size_t size;
> +
>     /**
>      * Pitch in bytes.
>      *
> -- 
> 2.10.2
> 
> _______________________________________________
> mesa-dev mailing list
> mesa-dev at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/mesa-dev