From patchwork Fri Mar 12 11:56:02 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Owain Ainsworth X-Patchwork-Id: 85251 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o2CBuPb2003454 for ; Fri, 12 Mar 2010 11:57:01 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 84F649F73D; Fri, 12 Mar 2010 03:56:24 -0800 (PST) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from mail-bw0-f215.google.com (mail-bw0-f215.google.com [209.85.218.215]) by gabe.freedesktop.org (Postfix) with ESMTP id 4E8E99E7EA for ; Fri, 12 Mar 2010 03:56:22 -0800 (PST) Received: by bwz7 with SMTP id 7so867185bwz.24 for ; Fri, 12 Mar 2010 03:56:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:received:from:to:cc:subject :date:message-id:x-mailer:in-reply-to:references; bh=fliiHYUd83pdc4eKho+Eb4zCJ/i2eMdCt2gnhOMBNO8=; b=uOdAXwece3gYJyHWrqhsh/5qiy/Izj5xaHHVicmuJtdEgZNknAPpvvTqL01Xx7ofnJ Qxz8gNTuDKjJ7/PPtdV4dEOs79DjuKH4ri8lKV7TWPw4dOOk3uKsBpRDG0IMF/hI4+gA OnNSwJ/V7X5ZlAN55+CyTE5CgC7T+TnwElTpc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; b=xyb4sPPMjWU+wfRxRLwNU4ZXbC9ch4Uffv3zVrs4m0wosH9LkZ87j9EitRdZOX62ko 6luEeb+zROjl17mIj91m6iw2rn8aDnaTvMft+sH1Hn1mQQydRkChxY2yt+AEMSDsHkne FLkop4HMMFluhnrPxdTbm/I1HD3tLCqWewfKg= Received: by 10.204.49.88 with SMTP id u24mr1028961bkf.44.1268394975294; Fri, 12 Mar 2010 03:56:15 -0800 (PST) Received: from stephanie.nicotinebsd.org (ns1.nicotinebsd.org [93.97.176.184]) by mx.google.com with ESMTPS id l1sm4864646bkl.14.2010.03.12.03.56.14 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 12 Mar 2010 03:56:15 -0800 (PST) Received: from localhost (1000@localhost [IPv6:::1]) by stephanie.nicotinebsd.org (OpenSMTPD) with ESMTP id 1268394967.2u3o0HswnNg462hB; Fri, 12 Mar 2010 11:56:07 +0000 (GMT) From: "Owain G. Ainsworth" To: intel-gfx@lists.freedesktop.org Date: Fri, 12 Mar 2010 11:56:02 +0000 Message-Id: <1268394962-9545-1-git-send-email-oga@openbsd.org> X-Mailer: git-send-email 1.6.5.7 In-Reply-To: <1268345996-21989-1-git-send-email-oga@openbsd.org> References: <1268345996-21989-1-git-send-email-oga@openbsd.org> Cc: "Owain G. Ainsworth" Subject: [Intel-gfx] [PATCH] drm/i915: check execbuffer for validity earlier to save on work. X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: intel-gfx-bounces@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Fri, 12 Mar 2010 11:57:03 +0000 (UTC) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index e52a277..d66b402 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -3653,23 +3653,6 @@ err: return ret; } -static int -i915_gem_check_execbuffer (struct drm_i915_gem_execbuffer2 *exec, - uint64_t exec_offset) -{ - uint32_t exec_start, exec_len; - - exec_start = (uint32_t) exec_offset + exec->batch_start_offset; - exec_len = (uint32_t) exec->batch_len; - - if ((exec_start | exec_len) & 0x7) - return -EINVAL; - - if (!exec_start) - return -EINVAL; - - return 0; -} static int i915_gem_wait_for_pending_flip(struct drm_device *dev, @@ -3719,7 +3702,6 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, struct drm_clip_rect *cliprects = NULL; struct drm_i915_gem_relocation_entry *relocs = NULL; int ret = 0, ret2, i, pinned = 0; - uint64_t exec_offset; uint32_t seqno, flush_domains, reloc_index; int pin_tries, flips; @@ -3727,6 +3709,16 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n", (int) args->buffers_ptr, args->buffer_count, args->batch_len); #endif + /* + * check for valid execbuffer offset. We can do this early because + * bound objects are always page aligned, so only the start offset + * matters. Also check for overflow. + */ + if ((args->batch_start_offset | args->batch_len) & 0x7 || + args->batch_start_offset + args->batch_len < args->batch_len || + args->batch_start_offset + args->batch_len < + args->batch_start_offset) + return -EINVAL; if (args->buffer_count < 1) { DRM_ERROR("execbuf with %d buffers\n", args->buffer_count); @@ -3875,16 +3867,13 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, ret = -EINVAL; goto err; } - batch_obj->pending_read_domains |= I915_GEM_DOMAIN_COMMAND; - - /* Sanity check the batch buffer, prior to moving objects */ - exec_offset = exec_list[args->buffer_count - 1].offset; - ret = i915_gem_check_execbuffer (args, exec_offset); - if (ret != 0) { - DRM_ERROR("execbuf with invalid offset/length\n"); + if (args->batch_start_offset + args->batch_len > batch_obj->size) { + DRM_ERROR("batchbuffer shorter than program length\n"); + ret = EINVAL; goto err; } + batch_obj->pending_read_domains |= I915_GEM_DOMAIN_COMMAND; i915_verify_inactive(dev, __FILE__, __LINE__); /* Zero the global flush/invalidate flags. These @@ -3952,7 +3942,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, #endif /* Exec the batchbuffer */ - ret = i915_dispatch_gem_execbuffer(dev, args, cliprects, exec_offset); + ret = i915_dispatch_gem_execbuffer(dev, args, cliprects, + exec_list[args->buffer_count - 1].offset); if (ret) { DRM_ERROR("dispatch failed %d\n", ret); goto err;