drm/i915: Trim the command parser allocations
authorChris Wilson <chris@chris-wilson.co.uk>
Wed, 14 Jan 2015 11:20:57 +0000 (11:20 +0000)
committerDaniel Vetter <daniel.vetter@ffwll.ch>
Mon, 23 Feb 2015 16:07:40 +0000 (17:07 +0100)
commit17cabf571e50677d980e9ab2a43c5f11213003ae
tree3b4f7ae8f3a79cbe81dc2b93562fc629b7029ef4
parentc32e3788ecc27a66bb859b67a58893cd2a32bf1b
drm/i915: Trim the command parser allocations

Currently, the command parser tries to create a secondary batch exactly
as large as the original, and vmap both. This is open to abuse by
userspace using extremely large batch objects, but only executing very
short batches. For example, this would be if userspace were to implement
a command submission ringbuffer. However, we only need to allocate pages
for just the contents of the command sequence in the batch - all
relocations copied to the secondary batch will reference the original
batch and so there can be no access to the secondary batch outside of
the explicit execution region.

Testcase: igt/gem_exec_big #ivb,byt,hsw
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=88308
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: John Harrison <John.C.Harrison@Intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
drivers/gpu/drm/i915/i915_cmd_parser.c
drivers/gpu/drm/i915/i915_gem_execbuffer.c