From patchwork Wed Sep 24 17:20:24 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gustavo Padovan X-Patchwork-Id: 4968741 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 5798FBEEA9 for ; Wed, 24 Sep 2014 17:20:49 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 17E982027D for ; Wed, 24 Sep 2014 17:20:48 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id D78A52028D for ; Wed, 24 Sep 2014 17:20:45 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 2CC006E653; Wed, 24 Sep 2014 10:20:45 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-qg0-f54.google.com (mail-qg0-f54.google.com [209.85.192.54]) by gabe.freedesktop.org (Postfix) with ESMTP id 39A586E64D; Wed, 24 Sep 2014 10:20:43 -0700 (PDT) Received: by mail-qg0-f54.google.com with SMTP id a108so6340454qge.13 for ; Wed, 24 Sep 2014 10:20:42 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=JpvGv0oU6+GfU4EGqPKq3+mO0/d9nmFh0gWmaLG5lmc=; b=ZvSTcUCPxSn4lo8dgaN79WNLBm9AodvVJHgDVOJLWWCa1NHqLbLxl/w6lhd3r00prM OZZVqa/ugMc7O5+w7H065hdUe5aUGF/li5FV6r5iN/QaJNsbCYf/rgCVcJkE3qWtZb59 GlQJbkpH6VBhxSnxLj2TMxPzeOl5nRfmBrw+EvfSVybFTHOxl/0qe9rXZxrgpfMwkZTO uhI3Bd8T+CrwEw2jTd4GFM/yMa9zv5Ii5/0rc3I7vmnzW33KPAB2j3fegRoWK2qDJbKT X/F0AfgbydCN+cghmpo689CNP4t520d+kWIJ7hk3XFscoPHjCWT1XU6eyhvj5VdZHqzu pHGA== X-Received: by 10.229.212.138 with SMTP id gs10mr10732206qcb.7.1411579242853; Wed, 24 Sep 2014 10:20:42 -0700 (PDT) Received: from localhost.localdomain ([191.255.48.205]) by mx.google.com with ESMTPSA id l46sm13274852qgd.27.2014.09.24.10.20.40 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Sep 2014 10:20:42 -0700 (PDT) From: Gustavo Padovan To: intel-gfx@lists.freedesktop.org Subject: [PATCH v3 03/11] drm/i915: Fix not checking cursor and object sizes Date: Wed, 24 Sep 2014 14:20:24 -0300 Message-Id: <1411579232-8668-3-git-send-email-gustavo@padovan.org> X-Mailer: git-send-email 1.9.3 In-Reply-To: <1411579232-8668-1-git-send-email-gustavo@padovan.org> References: <1411579232-8668-1-git-send-email-gustavo@padovan.org> Cc: Gustavo Padovan , dri-devel@lists.freedesktop.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Spam-Status: No, score=-4.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Gustavo Padovan Even if the fb is the same we should still check if the sizes are valid to be set. Signed-off-by: Gustavo Padovan --- drivers/gpu/drm/i915/intel_display.c | 61 ++++++++++++++++++++++++------------ 1 file changed, 41 insertions(+), 20 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c index b1c2dbf..20be2ed 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -8465,7 +8465,7 @@ static int intel_crtc_cursor_set_obj(struct drm_crtc *crtc, struct drm_i915_private *dev_priv = dev->dev_private; struct intel_crtc *intel_crtc = to_intel_crtc(crtc); enum pipe pipe = intel_crtc->pipe; - unsigned old_width, stride; + unsigned old_width; uint32_t addr; int ret; @@ -8477,29 +8477,11 @@ static int intel_crtc_cursor_set_obj(struct drm_crtc *crtc, goto finish; } - /* Check for which cursor types we support */ - if (!cursor_size_ok(dev, width, height)) { - DRM_DEBUG("Cursor dimension not supported\n"); - return -EINVAL; - } - - stride = roundup_pow_of_two(width) * 4; - if (obj->base.size < stride * height) { - DRM_DEBUG_KMS("buffer is too small\n"); - return -ENOMEM; - } - /* we only need to pin inside GTT if cursor is non-phy */ mutex_lock(&dev->struct_mutex); if (!INTEL_INFO(dev)->cursor_needs_physical) { unsigned alignment; - if (obj->tiling_mode) { - DRM_DEBUG_KMS("cursor cannot be tiled\n"); - ret = -EINVAL; - goto fail_locked; - } - /* * Global gtt pte registers are special registers which actually * forward writes to a chunk of system memory. Which means that @@ -11923,16 +11905,55 @@ intel_check_cursor_plane(struct drm_plane *plane, struct intel_plane_state *state) { struct drm_crtc *crtc = state->crtc; + struct drm_device *dev = crtc->dev; struct drm_framebuffer *fb = state->fb; struct drm_rect *dest = &state->dst; struct drm_rect *src = &state->src; const struct drm_rect *clip = &state->clip; + struct drm_i915_gem_object *obj = intel_fb_obj(fb); + int crtc_w, crtc_h; + unsigned stride; + int ret; - return drm_plane_helper_check_update(plane, crtc, fb, + ret = drm_plane_helper_check_update(plane, crtc, fb, src, dest, clip, DRM_PLANE_HELPER_NO_SCALING, DRM_PLANE_HELPER_NO_SCALING, true, true, &state->visible); + if (ret) + return ret; + + + /* if we want to turn off the cursor ignore width and height */ + if (!obj) + return 0; + + if (fb == crtc->cursor->fb) + return 0; + + /* Check for which cursor types we support */ + crtc_w = drm_rect_width(&state->orig_dst); + crtc_h = drm_rect_height(&state->orig_dst); + if (!cursor_size_ok(dev, crtc_w, crtc_h)) { + DRM_DEBUG("Cursor dimension not supported\n"); + return -EINVAL; + } + + stride = roundup_pow_of_two(crtc_w) * 4; + if (obj->base.size < stride * crtc_h) { + DRM_DEBUG_KMS("buffer is too small\n"); + return -ENOMEM; + } + + /* we only need to pin inside GTT if cursor is non-phy */ + mutex_lock(&dev->struct_mutex); + if (!INTEL_INFO(dev)->cursor_needs_physical && obj->tiling_mode) { + DRM_DEBUG_KMS("cursor cannot be tiled\n"); + ret = -EINVAL; + } + mutex_unlock(&dev->struct_mutex); + + return ret; } static int