diff options
| author | Alexei Shlychkov <shlychkov@gmail.com> | 2012-04-05 15:52:59 -0700 |
|---|---|---|
| committer | Ziyann <jaraidaniel@gmail.com> | 2014-10-01 12:57:52 +0200 |
| commit | 2f7e426da342b2aa2692d747dfee31880d6dfecc (patch) | |
| tree | 5aa11a8fdb1850f5725f16eda33392fa4e006028 /drivers/misc | |
| parent | 5bd02b76b616d14b17c5a8c8d84420810157eb99 (diff) | |
| download | kernel_samsung_tuna-2f7e426da342b2aa2692d747dfee31880d6dfecc.zip kernel_samsung_tuna-2f7e426da342b2aa2692d747dfee31880d6dfecc.tar.gz kernel_samsung_tuna-2f7e426da342b2aa2692d747dfee31880d6dfecc.tar.bz2 | |
gcx: fixed command buffer overrun.
Change-Id: Idfbb3b199cd40eb7df81532425c98c1c98b208fb
Signed-off-by: Alexei Shlychkov <shlychkov@gmail.com>
Diffstat (limited to 'drivers/misc')
| -rw-r--r-- | drivers/misc/gcx/gcbv/gcbv.c | 34 | ||||
| -rw-r--r-- | drivers/misc/gcx/gccore/gccmdbuf.c | 2 |
2 files changed, 32 insertions, 4 deletions
diff --git a/drivers/misc/gcx/gcbv/gcbv.c b/drivers/misc/gcx/gcbv/gcbv.c index 64013d7b..733b1e9 100644 --- a/drivers/misc/gcx/gcbv/gcbv.c +++ b/drivers/misc/gcx/gcbv/gcbv.c @@ -124,6 +124,15 @@ #define GPU_CMD_SIZE (sizeof(unsigned int) * 2) +#define GC_BUFFER_RESERVE \ +( \ + sizeof(struct gcmopipesel) + \ + sizeof(struct gcmommumaster) + \ + sizeof(struct gcmommuflush) + \ + sizeof(struct gcmosignal) + \ + sizeof(struct gccmdend) \ +) + /******************************************************************************* ** Internal structures. */ @@ -739,15 +748,24 @@ static enum bverror append_buffer(struct gcbatch *batch) "command buffer allocation failed"); goto exit; } + + GCPRINT(GCDBGFILTER, GCZONE_BUFFER, GC_MOD_PREFIX + "allocated new buffer = 0x%08X\n", + __func__, __LINE__, (unsigned int) temp); } else { temp = gccontext.vac_buffers; gccontext.vac_buffers = temp->next; + + GCPRINT(GCDBGFILTER, GCZONE_BUFFER, GC_MOD_PREFIX + "reusing buffer = 0x%08X\n", + __func__, __LINE__, (unsigned int) temp); } memset(temp, 0, sizeof(struct gcbuffer)); temp->head = temp->tail = (unsigned int *) (temp + 1); - temp->available = GC_BUFFER_SIZE - sizeof(struct gcbuffer); + temp->available = GC_BUFFER_SIZE - max(sizeof(struct gcbuffer), + GC_BUFFER_RESERVE); if (batch->bufhead == NULL) batch->bufhead = temp; @@ -834,7 +852,7 @@ static enum bverror add_fixup(struct gcbatch *batch, unsigned int *fixup, bverror = BVERR_NONE; exit: - GCPRINT(GCDBGFILTER, GCZONE_BUFFER, "--" GC_MOD_PREFIX + GCPRINT(GCDBGFILTER, GCZONE_FIXUP, "--" GC_MOD_PREFIX "bverror = %d\n", __func__, __LINE__, bverror); return bverror; @@ -867,6 +885,16 @@ static enum bverror claim_buffer(struct gcbatch *batch, curbuf = batch->buftail; } + if (curbuf->available < size) { + GCPRINT(GCDBGFILTER, GCZONE_BUFFER, GC_MOD_PREFIX + "requested size is too large.\n", + __func__, __LINE__); + + BVSETERROR(BVERR_OOM, + "command buffer allocation failed"); + goto exit; + } + *buffer = curbuf->tail; curbuf->tail = (unsigned int *) ((unsigned char *) curbuf->tail + size); curbuf->available -= size; @@ -874,7 +902,7 @@ static enum bverror claim_buffer(struct gcbatch *batch, bverror = BVERR_NONE; exit: - GCPRINT(GCDBGFILTER, GCZONE_FIXUP, "--" GC_MOD_PREFIX + GCPRINT(GCDBGFILTER, GCZONE_BUFFER, "--" GC_MOD_PREFIX "bverror = %d\n", __func__, __LINE__, bverror); return bverror; diff --git a/drivers/misc/gcx/gccore/gccmdbuf.c b/drivers/misc/gcx/gccore/gccmdbuf.c index a5d5040..24ea947 100644 --- a/drivers/misc/gcx/gccore/gccmdbuf.c +++ b/drivers/misc/gcx/gccore/gccmdbuf.c @@ -32,7 +32,7 @@ #include <linux/gcx.h> #include "gccmdbuf.h" -#define GC_CMD_BUF_PAGES 20 +#define GC_CMD_BUF_PAGES 32 #define GC_CMD_BUF_SIZE (PAGE_SIZE * GC_CMD_BUF_PAGES) struct cmdbuf { |