@@ -169,6 +169,7 @@ TESTS_progs = \
 	kms_atomic_interruptible \
 	kms_atomic_transition \
 	kms_available_modes_crc \
+	kms_big_fb \
 	kms_busy \
 	kms_ccs \
 	kms_chv_cursor_fail \

@@ -0,0 +1,414 @@
+/*
+ * Copyright © 2018 Intel Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ */
+
+#include "igt.h"
+#include <errno.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+
+typedef struct {
+	int drm_fd;
+	igt_display_t display;
+	enum pipe pipe;
+	igt_output_t *output;
+	igt_plane_t *plane;
+	igt_pipe_crc_t *pipe_crc;
+	struct igt_fb small_fb, big_fb;
+	uint64_t modifier;
+	struct {
+		int max_width, max_height;
+	} ram, kernel;
+} data_t;
+
+static void paint_pattern(data_t *data,
+			  struct igt_fb *fb,
+			  int w, int h)
+{
+	cairo_pattern_t *pat;
+	cairo_t *cr;
+
+	cr = igt_get_cairo_ctx(data->drm_fd, fb);
+
+	igt_paint_color(cr, 0, 0, w, h, 0.0, 0.0, 0.0);
+
+	pat = cairo_pattern_create_mesh();
+	cairo_mesh_pattern_begin_patch(pat);
+	cairo_mesh_pattern_move_to(pat, 0,  0);
+	cairo_mesh_pattern_line_to(pat, w, 0);
+	cairo_mesh_pattern_line_to(pat, w, h);
+	cairo_mesh_pattern_line_to(pat, 0, h);
+	cairo_mesh_pattern_set_corner_color_rgb(pat, 0, 0.0, 1.0, 1.0);
+	cairo_mesh_pattern_set_corner_color_rgb(pat, 1, 1.0, 0.0, 1.0);
+	cairo_mesh_pattern_set_corner_color_rgb(pat, 2, 1.0, 1.0, 0.0);
+	cairo_mesh_pattern_set_corner_color_rgb(pat, 3, 0.0, 0.0, 0.0);
+	cairo_mesh_pattern_end_patch(pat);
+
+	cairo_rectangle(cr, 0, 0, w, h);
+	cairo_set_source(cr, pat);
+	cairo_fill(cr);
+
+	cairo_pattern_destroy(pat);
+
+	igt_paint_test_pattern(cr, w, h);
+
+	igt_put_cairo_ctx(data->drm_fd, fb, cr);
+}
+
+static void copy_pattern(data_t *data,
+			  struct igt_fb *dst,
+			  struct igt_fb *src,
+			  int sx, int sy, int dx, int dy,
+			  int w, int h)
+{
+	cairo_surface_t *surface;
+	cairo_t *cr;
+
+	surface = igt_get_cairo_surface(data->drm_fd, src);
+
+	cr = igt_get_cairo_ctx(data->drm_fd, dst);
+
+	cairo_set_source_surface(cr, surface, dx-sx, dy-sy);
+	cairo_rectangle(cr, dx, dy, w, h);
+	cairo_fill (cr);
+
+	igt_put_cairo_ctx(data->drm_fd, dst, cr);
+
+	cairo_surface_destroy(surface);
+}
+
+static void test_plane(data_t *data)
+{
+	igt_plane_t *plane = data->plane;
+	struct igt_fb *small_fb = &data->small_fb;
+	struct igt_fb *big_fb = &data->big_fb;
+	igt_crc_t small_crc, big_crc;
+
+	if (plane->type == DRM_PLANE_TYPE_CURSOR)
+		return;
+
+	igt_info("small fb top left\n");
+	copy_pattern(data, small_fb, big_fb, 0, 0, 0, 0,
+		     small_fb->width, small_fb->height);
+	igt_plane_set_fb(plane, small_fb);
+	igt_display_commit2(&data->display, data->display.is_atomic ?
+			    COMMIT_ATOMIC : COMMIT_UNIVERSAL);
+	igt_pipe_crc_collect_crc(data->pipe_crc, &small_crc);
+
+	igt_info("big fb top left\n");
+	igt_plane_set_fb(plane, big_fb);
+	igt_fb_set_position(big_fb, plane, 0, 0);
+	igt_fb_set_size(big_fb, plane, small_fb->width, small_fb->height);
+	igt_plane_set_size(plane, small_fb->width, small_fb->height);
+	igt_display_commit2(&data->display, data->display.is_atomic ?
+			    COMMIT_ATOMIC : COMMIT_UNIVERSAL);
+	igt_pipe_crc_collect_crc(data->pipe_crc, &big_crc);
+
+	igt_assert_crc_equal(&big_crc, &small_crc);
+
+	igt_info("small fb bottom right\n");
+	copy_pattern(data, small_fb, big_fb,
+		     big_fb->width - small_fb->width,
+		     big_fb->height - small_fb->height,
+		     0, 0, small_fb->width, small_fb->height);
+	igt_plane_set_fb(plane, small_fb);
+	igt_display_commit2(&data->display, data->display.is_atomic ?
+			    COMMIT_ATOMIC : COMMIT_UNIVERSAL);
+	igt_pipe_crc_collect_crc(data->pipe_crc, &small_crc);
+
+	igt_info("big fb bottom right\n");
+	igt_plane_set_fb(plane, big_fb);
+	igt_fb_set_position(big_fb, plane,
+			    big_fb->width - small_fb->width,
+			    big_fb->height - small_fb->height);
+	igt_fb_set_size(big_fb, plane, small_fb->width, small_fb->height);
+	igt_plane_set_size(plane, small_fb->width, small_fb->height);
+	igt_display_commit2(&data->display, data->display.is_atomic ?
+			    COMMIT_ATOMIC : COMMIT_UNIVERSAL);
+	igt_pipe_crc_collect_crc(data->pipe_crc, &big_crc);
+
+	igt_assert_crc_equal(&big_crc, &small_crc);
+
+	igt_plane_set_fb(plane, NULL);
+	igt_display_commit2(&data->display, data->display.is_atomic ?
+			    COMMIT_ATOMIC : COMMIT_UNIVERSAL);
+}
+
+static void
+test_pipe(data_t *data)
+{
+	drmModeModeInfo *mode;
+
+	mode = igt_output_get_mode(data->output);
+
+	igt_create_fb(data->drm_fd, mode->hdisplay, mode->vdisplay,
+		      DRM_FORMAT_XRGB8888, DRM_FORMAT_MOD_LINEAR,
+		      &data->small_fb);
+
+	igt_output_set_pipe(data->output, data->pipe);
+
+	if (!data->display.is_atomic) {
+		igt_plane_t *primary = igt_output_get_plane_type(data->output,
+								 DRM_PLANE_TYPE_PRIMARY);
+
+		/* legacy setcrtc needs an fb */
+		igt_plane_set_fb(primary, &data->small_fb);
+		igt_display_commit2(&data->display, COMMIT_LEGACY);
+		igt_plane_set_fb(primary, NULL);
+	}
+
+	igt_display_commit2(&data->display, data->display.is_atomic ?
+			    COMMIT_ATOMIC : COMMIT_UNIVERSAL);
+
+	data->pipe_crc = igt_pipe_crc_new(data->drm_fd, data->pipe,
+					  INTEL_PIPE_CRC_SOURCE_AUTO);
+
+	for_each_plane_on_pipe(&data->display, data->pipe, data->plane)
+		test_plane(data);
+
+	igt_pipe_crc_free(data->pipe_crc);
+
+	igt_remove_fb(data->drm_fd, &data->small_fb);
+}
+
+static void
+test_scanout(data_t *data)
+{
+	igt_create_fb(data->drm_fd,
+		      data->ram.max_width,
+		      data->ram.max_height,
+		      DRM_FORMAT_XRGB8888, data->modifier,
+		      &data->big_fb);
+
+	paint_pattern(data, &data->big_fb,
+		      data->big_fb.width, data->big_fb.height);
+
+	for_each_pipe_with_valid_output(&data->display, data->pipe, data->output)
+		test_pipe(data);
+
+	igt_remove_fb(data->drm_fd, &data->big_fb);
+}
+
+static void
+test_size_overflow(data_t *data)
+{
+	uint32_t fb_id;
+	uint32_t bo;
+	uint32_t offsets[4] = {};
+	int ret;
+
+	/*
+	 * Try to a specific integer overflow in i915 fb size
+	 * calculations. 32k * 32k * 4 == 1<<32 which is checked
+	 * against the bo size. The check should fail on account
+	 * of the bo being smaller, but due to the overflow the
+	 * computed fb size is 0 and thus the check never trips.
+	 */
+	igt_require(data->kernel.max_width >= 32767 &&
+		    data->kernel.max_height >= 32767);
+
+	bo = gem_create(data->drm_fd, (1ULL << 32) - 4096);
+	igt_require(bo);
+
+	ret = __kms_addfb(data->drm_fd, bo,
+			  32767, 32767,
+			  32768 * 4, DRM_FORMAT_XRGB8888,
+			  data->modifier,
+			  offsets, DRM_MODE_FB_MODIFIERS, &fb_id);
+	igt_assert_neq(ret, 0);
+
+	gem_close(data->drm_fd, bo);
+}
+
+static void
+test_size_offset_overflow(data_t *data)
+{
+	uint32_t fb_id;
+	uint32_t bo;
+	uint32_t offsets[4] = {};
+	int ret;
+
+	/*
+	 * Try to a specific integer overflow in i915 fb size
+	 * calculations. This time it's offsets[1] + the tile
+	 * aligned chroma plane size that overflows and
+	 * incorrectly passes the bo size check.
+	 */
+	igt_require(igt_display_has_format_mod(&data->display,
+					       DRM_FORMAT_NV12,
+					       data->modifier));
+
+	bo = gem_create(data->drm_fd, (1ULL << 32) - 4096);
+	igt_require(bo);
+
+	offsets[0] = 0;
+	offsets[1] = (1ULL << 32) - 8192 * 4096;
+
+	ret = __kms_addfb(data->drm_fd, bo,
+			  8192, 8188,
+			  8192, DRM_FORMAT_NV12,
+			  data->modifier,
+			  offsets, DRM_MODE_FB_MODIFIERS, &fb_id);
+	igt_assert_neq(ret, 0);
+
+	gem_close(data->drm_fd, bo);
+}
+
+static int rmfb(int fd, uint32_t id)
+{
+	int err;
+
+	err = 0;
+	if (igt_ioctl(fd, DRM_IOCTL_MODE_RMFB, &id))
+		err = -errno;
+
+	errno = 0;
+	return err;
+}
+
+static void
+test_addfb(data_t *data)
+{
+	uint64_t size;
+	unsigned int stride;
+	uint32_t fb_id;
+	uint32_t bo;
+	uint32_t offsets[4] = {};
+	int ret;
+
+	igt_calc_fb_size(data->drm_fd,
+			 data->kernel.max_width,
+			 data->kernel.max_height,
+			 DRM_FORMAT_XRGB8888,
+			 data->modifier,
+			 &size, &stride);
+
+	bo = gem_create(data->drm_fd, size);
+	igt_require(bo);
+
+	ret = __kms_addfb(data->drm_fd, bo,
+			  data->kernel.max_width,
+			  data->kernel.max_height,
+			  stride, DRM_FORMAT_XRGB8888,
+			  data->modifier,
+			  offsets, DRM_MODE_FB_MODIFIERS, &fb_id);
+	igt_assert_eq(ret, 0);
+
+	rmfb(data->drm_fd, fb_id);
+	gem_close(data->drm_fd, bo);
+}
+
+static data_t data;
+
+static const struct {
+	uint64_t modifier;
+	const char *name;
+} modifiers[] = {
+	{ DRM_FORMAT_MOD_LINEAR, "linear", },
+	{ I915_FORMAT_MOD_X_TILED, "x-tiled", },
+	{ I915_FORMAT_MOD_Y_TILED, "y-tiled", },
+	/* FIXME need a cpu mmap path in igt_fb */
+#if 0
+	{ I915_FORMAT_MOD_Yf_TILED, "yf-tiled", },
+#endif
+};
+
+igt_main
+{
+	igt_fixture {
+		drmModeResPtr res;
+		uint64_t ram;
+		int i = 0;
+
+		igt_skip_on_simulation();
+
+		data.drm_fd = drm_open_driver_master(DRIVER_INTEL);
+
+		kmstest_set_vt_graphics_mode();
+
+		igt_require_pipe_crc(data.drm_fd);
+		igt_display_init(&data.display, data.drm_fd);
+
+		res = drmModeGetResources(data.drm_fd);
+		igt_assert(res);
+
+		data.kernel.max_width = res->max_width;
+		data.kernel.max_height = res->max_height;
+
+		drmModeFreeResources(res);
+
+		/* Let's not try to use more than half of the total RAM */
+		ram = intel_get_total_ram_mb();
+		igt_info("%"PRIu64" MiB RAM\n", ram);
+
+		data.ram.max_width = data.kernel.max_width;
+		data.ram.max_height = data.kernel.max_height;
+		while (data.ram.max_height * data.ram.max_height * 4 / (1024*1024) > ram) {
+			if (i++ & 1)
+				data.ram.max_width >>= 1;
+			else
+				data.ram.max_height >>= 1;
+		}
+	}
+
+	/*
+	 * Skip linear as it doesn't hit the overflow we want
+	 * on account of the tile height being effectively one,
+	 * and thus the kenrnel rounding up to the next tile
+	 * height won't do anything.
+	 */
+	for (int i = 1; i < ARRAY_SIZE(modifiers); i++) {
+		igt_subtest_f("%s-addfb-size-overflow",
+			      modifiers[i].name) {
+			data.modifier = modifiers[i].modifier;
+			test_size_overflow(&data);
+		}
+	}
+
+	for (int i = 1; i < ARRAY_SIZE(modifiers); i++) {
+		igt_subtest_f("%s-addfb-size-offset-overflow",
+			      modifiers[i].name) {
+			data.modifier = modifiers[i].modifier;
+			test_size_offset_overflow(&data);
+		}
+	}
+
+	for (int i = 0; i < ARRAY_SIZE(modifiers); i++) {
+		igt_subtest_f("%s-addfb", modifiers[i].name) {
+			data.modifier = modifiers[i].modifier;
+
+			test_addfb(&data);
+		}
+	}
+
+	for (int i = 0; i < ARRAY_SIZE(modifiers); i++) {
+		igt_subtest_f("%s-scanout", modifiers[i].name) {
+			data.modifier = modifiers[i].modifier;
+
+			test_scanout(&data);
+		}
+	}
+
+	igt_fixture
+		igt_display_fini(&data.display);
+}

@@ -144,6 +144,7 @@ test_progs = [
 	'kms_atomic_interruptible',
 	'kms_atomic_transition',
 	'kms_available_modes_crc',
+	'kms_big_fb',
 	'kms_busy',
 	'kms_ccs',
 	'kms_chv_cursor_fail',