From patchwork Thu Apr 22 21:38:41 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Owain Ainsworth X-Patchwork-Id: 94543 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o3MLcvnK029483 for ; Thu, 22 Apr 2010 21:40:45 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id A53199E8FD; Thu, 22 Apr 2010 14:38:56 -0700 (PDT) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from mail-ww0-f49.google.com (mail-ww0-f49.google.com [74.125.82.49]) by gabe.freedesktop.org (Postfix) with ESMTP id B5F199E817 for ; Thu, 22 Apr 2010 14:38:53 -0700 (PDT) Received: by wwi17 with SMTP id 17so176209wwi.36 for ; Thu, 22 Apr 2010 14:38:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:received:from:to:cc:subject :date:message-id:x-mailer; bh=O74xioUP5WeLQLPLDvxSxgobEfw0AKOCPtNHvVtYa44=; b=VH0gcbR0LfwvdHsNw/waEJuC/faXLRyOo4lyfHRhGrdmmK/kATfhf6nFVt+WGJ0S1j xqCFFLF0lKaGgRP7kRUCYn9rsDYt1WxG2DrYMpO0lfoTUBks+jna5mGVXgKvDJifOA+x L53iJ3vibZ8VowXQbUYM0rYMJhQQgkhu4VbtY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer; b=GJAVfJMdtmTg15b7o9lz33SCYkX6L09EeuXLpEkdOBZK8+0S1ehg4NjjeXmOzAAKug W12k7oIQCTRIxAaXWeM9v++kFNFInDImN4pcRTZecspof33MIOSzQyEfHe9X7iu4YI3S 0Jj71g1HywlMATSS3EPGRmNV7itF0PpePUzeY= Received: by 10.216.181.13 with SMTP id k13mr712249wem.118.1271972331660; Thu, 22 Apr 2010 14:38:51 -0700 (PDT) Received: from stephanie.nicotinebsd.org (ns1.nicotinebsd.org [93.97.176.184]) by mx.google.com with ESMTPS id r29sm2792146wbv.9.2010.04.22.14.38.50 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 22 Apr 2010 14:38:50 -0700 (PDT) Received: from localhost (1000@localhost [IPv6:::1]) by stephanie.nicotinebsd.org (OpenSMTPD) with ESMTP id 1271972328.nNyKI6UOrsA4ezbb; Thu, 22 Apr 2010 22:38:49 +0100 (BST) From: "Owain G. Ainsworth" To: intel-gfx@lists.freedesktop.org Date: Thu, 22 Apr 2010 22:38:41 +0100 Message-Id: <1271972322-18780-1-git-send-email-oga@openbsd.org> X-Mailer: git-send-email 1.6.5.7 Cc: "Owain G. Ainsworth" Subject: [Intel-gfx] [PATCH 1/2] drm/i915: check execbuffer for validity earlier to save on work. X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: intel-gfx-bounces@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Thu, 22 Apr 2010 21:40:45 +0000 (UTC) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index b85727c..a9da182 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -3656,23 +3656,6 @@ err: return ret; } -static int -i915_gem_check_execbuffer (struct drm_i915_gem_execbuffer2 *exec, - uint64_t exec_offset) -{ - uint32_t exec_start, exec_len; - - exec_start = (uint32_t) exec_offset + exec->batch_start_offset; - exec_len = (uint32_t) exec->batch_len; - - if ((exec_start | exec_len) & 0x7) - return -EINVAL; - - if (!exec_start) - return -EINVAL; - - return 0; -} static int i915_gem_wait_for_pending_flip(struct drm_device *dev, @@ -3722,7 +3705,6 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, struct drm_clip_rect *cliprects = NULL; struct drm_i915_gem_relocation_entry *relocs = NULL; int ret = 0, ret2, i, pinned = 0; - uint64_t exec_offset; uint32_t seqno, flush_domains, reloc_index; int pin_tries, flips; @@ -3730,6 +3712,16 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n", (int) args->buffers_ptr, args->buffer_count, args->batch_len); #endif + /* + * check for valid execbuffer offset. We can do this early because + * bound objects are always page aligned, so only the start offset + * matters. Also check for overflow. + */ + if ((args->batch_start_offset | args->batch_len) & 0x7 || + args->batch_start_offset + args->batch_len < args->batch_len || + args->batch_start_offset + args->batch_len < + args->batch_start_offset) + return -EINVAL; if (args->buffer_count < 1) { DRM_ERROR("execbuf with %d buffers\n", args->buffer_count); @@ -3878,15 +3870,12 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, ret = -EINVAL; goto err; } - batch_obj->pending_read_domains |= I915_GEM_DOMAIN_COMMAND; - - /* Sanity check the batch buffer, prior to moving objects */ - exec_offset = exec_list[args->buffer_count - 1].offset; - ret = i915_gem_check_execbuffer (args, exec_offset); - if (ret != 0) { - DRM_ERROR("execbuf with invalid offset/length\n"); + if (args->batch_start_offset + args->batch_len > batch_obj->size) { + DRM_ERROR("batchbuffer shorter than program length\n"); + ret = EINVAL; goto err; } + batch_obj->pending_read_domains |= I915_GEM_DOMAIN_COMMAND; i915_verify_inactive(dev, __FILE__, __LINE__); @@ -3955,7 +3944,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, #endif /* Exec the batchbuffer */ - ret = i915_dispatch_gem_execbuffer(dev, args, cliprects, exec_offset); + ret = i915_dispatch_gem_execbuffer(dev, args, cliprects, + exec_list[args->buffer_count - 1].offset); if (ret) { DRM_ERROR("dispatch failed %d\n", ret); goto err;