[Mesa-dev] [PATCH 4/8] i965: Store mcs buffer size

[Ben Widawsky]

On 16-11-07 10:22:46, Lionel Landwerlin wrote:
>On 07/11/16 10:07, Pohjolainen, Topi wrote:
>>On Thu, Nov 03, 2016 at 10:39:39AM +0000, Lionel Landwerlin wrote:
>>>From: Ben Widawsky <benjamin.widawsky at intel.com>
>>>
>>>libdrm may round up the allocation requested by mesa. As a result, accesses
>>>through the gtt may end up accessing memory which does not belong to mesa. The
>>>problem is described in the following commit:
>>>commit 7ae870211ddc40ef6ed209a322c3a721214bb737
>>>Author: Eric Anholt <eric at anholt.net>
>>>Date:   Mon Apr 14 16:52:43 2014 -0700
>>>
>>>     i965: Fix buffer overruns in MSAA MCS buf This size field is an alternate
>>>
>>>In that patch this was solved by making sure we only 1'd the logical size of the
>>>buffer. This patch becomes necessary because the miptree data structure is going
>>>to go away in the upcoming patch and we won't have access to the total_height
>>>field anymore.
>>>
>>>v2: drop setting the size in intel_hiz_miptree_buf_create() (Lionel)
>>>
>>>Signed-off-by: Ben Widawsky <benjamin.widawsky at intel.com> (v1)
>>>Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin at intel.com> (v2)
>>>---
>>>  src/mesa/drivers/dri/i965/intel_mipmap_tree.c | 4 ++--
>>>  src/mesa/drivers/dri/i965/intel_mipmap_tree.h | 9 +++++++++
>>>  2 files changed, 11 insertions(+), 2 deletions(-)
>>>
>>>diff --git a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
>>>index c2bff17..3d1bdb1 100644
>>>--- a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
>>>+++ b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
>>>@@ -1503,8 +1503,7 @@ intel_miptree_init_mcs(struct brw_context *brw,
>>>        return;
>>>     }
>>>     void *data = mt->mcs_buf->bo->virtual;
>>>-   memset(data, init_value,
>>>-          mt->mcs_buf->mt->total_height * mt->mcs_buf->mt->pitch);
>>If I read the previous patch right, this is already needed there as
>>mcs_buf->mt is left NULL?
>
>Thanks, that's wrong indeed.
>I think it makes sense to squash patch 3 & 4.
>

Sounds good to me.

>>
>>>+   memset(data, init_value, mt->mcs_buf->size);
>>>     drm_intel_bo_unmap(mt->mcs_buf->bo);
>>>     mt->fast_clear_state = INTEL_FAST_CLEAR_STATE_CLEAR;
>>>  }
>>>@@ -1545,6 +1544,7 @@ intel_mcs_miptree_buf_create(struct brw_context *brw,
>>>     buf->bo = temp_mt->bo;
>>>     buf->offset = temp_mt->offset;
>>>+   buf->size = temp_mt->total_height * temp_mt->pitch;
>>>     buf->pitch = temp_mt->pitch;
>>>     buf->qpitch = temp_mt->qpitch;
>>>diff --git a/src/mesa/drivers/dri/i965/intel_mipmap_tree.h b/src/mesa/drivers/dri/i965/intel_mipmap_tree.h
>>>index 0b49dc2..0b4b353 100644
>>>--- a/src/mesa/drivers/dri/i965/intel_mipmap_tree.h
>>>+++ b/src/mesa/drivers/dri/i965/intel_mipmap_tree.h
>>>@@ -350,6 +350,15 @@ struct intel_miptree_aux_buffer
>>>      */
>>>     uint32_t offset;
>>>+   /*
>>>+    * Size of the MCS surface.
>>>+    *
>>>+    * This is needed when doing any gtt mapped operations on the buffer (which
>>>+    * will be Y-tiled). It is possible that it will not be the same as bo->size
>>>+    * when the drm allocator rounds up the requested size.
>>>+    */
>>>+   size_t size;
>>>+
>>>     /**
>>>      * Pitch in bytes.
>>>      *
>>>-- 
>>>2.10.2
>>>
>>>_______________________________________________
>>>mesa-dev mailing list
>>>mesa-dev at lists.freedesktop.org
>>>https://lists.freedesktop.org/mailman/listinfo/mesa-dev
>>_______________________________________________
>>mesa-dev mailing list
>>mesa-dev at lists.freedesktop.org
>>https://lists.freedesktop.org/mailman/listinfo/mesa-dev
>
>
>_______________________________________________
>mesa-dev mailing list
>mesa-dev at lists.freedesktop.org
>https://lists.freedesktop.org/mailman/listinfo/mesa-dev