intel: Avoid the need for most overflow checks by using a scratch page.

The overflow checks were all thoroughly untested, and a bunch of the
ones I'm deleting were pretty broken.  Now, in the case of overflow,
you just decode data of 0xd0d0d0d0, and instr_out prints the warning
message instead.  Note that this still has the same issue of being
under-tested, but at least it's one place instead of per-packet.

A couple of BUFFER_FAIL uses are left where the length to be decoded
could be (significantly) larger than a page, and the decode didn't
just call instr_out (which doesn't dereference data itself unless it's
safe).

1 files changed, 24 insertions, 141 deletions

diff --git a/intel/intel_decode.c b/intel/intel_decode.c
index 36caba7c..97820b35 100644
--- a/intel/intel_decode.c
+++ b/intel/intel_decode.c
@@ -66,6 +66,8 @@ struct drm_intel_decode {
 	 * and is used by the intel-gpu-tools.
 	 */
 	bool dump_past_end;
+
+	bool overflowed;
 };
 
 static FILE *out;
@@ -107,6 +109,14 @@ instr_out(struct drm_intel_decode *ctx, unsigned int index,
 	const char *parseinfo;
 	uint32_t offset = ctx->hw_offset + index * 4;
 
+	if (index > ctx->count) {
+		if (!ctx->overflowed) {
+			fprintf(out, "ERROR: Decode attempted to continue beyond end of batchbuffer\n");
+			ctx->overflowed = true;
+		}
+		return;
+	}
+
 	if (offset == head_offset)
 		parseinfo = "HEAD";
 	else if (offset == tail_offset)
@@ -127,7 +137,6 @@ decode_mi(struct drm_intel_decode *ctx)
 	unsigned int opcode, len = -1;
 	const char *post_sync_op = "";
 	uint32_t *data = ctx->data;
-	uint32_t count = ctx->count;
 
 	struct {
 		uint32_t opcode;
@@ -254,9 +263,6 @@ decode_mi(struct drm_intel_decode *ctx)
 			instr_out(ctx, 0, "%s\n",
 				  opcodes_mi[opcode].name);
 			for (i = 1; i < len; i++) {
-				if (i >= count)
-					BUFFER_FAIL(count, len,
-						    opcodes_mi[opcode].name);
 				instr_out(ctx, i, "dword %d\n", i);
 			}
 
@@ -317,7 +323,6 @@ decode_2d(struct drm_intel_decode *ctx)
 {
 	unsigned int opcode, len;
 	uint32_t *data = ctx->data;
-	uint32_t count = ctx->count;
 
 	struct {
 		uint32_t opcode;
@@ -362,8 +367,6 @@ decode_2d(struct drm_intel_decode *ctx)
 		len = (data[0] & 0x000000ff) + 2;
 		if (len != 3)
 			fprintf(out, "Bad count in XY_SCANLINES_BLT\n");
-		if (count < 3)
-			BUFFER_FAIL(count, len, "XY_SCANLINES_BLT");
 
 		instr_out(ctx, 1, "dest (%d,%d)\n",
 			  data[1] & 0xffff, data[1] >> 16);
@@ -376,8 +379,6 @@ decode_2d(struct drm_intel_decode *ctx)
 		len = (data[0] & 0x000000ff) + 2;
 		if (len != 8)
 			fprintf(out, "Bad count in XY_SETUP_BLT\n");
-		if (count < 8)
-			BUFFER_FAIL(count, len, "XY_SETUP_BLT");
 
 		decode_2d_br01(ctx);
 		instr_out(ctx, 2, "cliprect (%d,%d)\n",
@@ -396,8 +397,6 @@ decode_2d(struct drm_intel_decode *ctx)
 		len = (data[0] & 0x000000ff) + 2;
 		if (len != 3)
 			fprintf(out, "Bad count in XY_SETUP_CLIP_BLT\n");
-		if (count < 3)
-			BUFFER_FAIL(count, len, "XY_SETUP_CLIP_BLT");
 
 		instr_out(ctx, 1, "cliprect (%d,%d)\n",
 			  data[1] & 0xffff, data[2] >> 16);
@@ -411,8 +410,6 @@ decode_2d(struct drm_intel_decode *ctx)
 		if (len != 9)
 			fprintf(out,
 				"Bad count in XY_SETUP_MONO_PATTERN_SL_BLT\n");
-		if (count < 9)
-			BUFFER_FAIL(count, len, "XY_SETUP_MONO_PATTERN_SL_BLT");
 
 		decode_2d_br01(ctx);
 		instr_out(ctx, 2, "cliprect (%d,%d)\n",
@@ -432,8 +429,6 @@ decode_2d(struct drm_intel_decode *ctx)
 		len = (data[0] & 0x000000ff) + 2;
 		if (len != 6)
 			fprintf(out, "Bad count in XY_COLOR_BLT\n");
-		if (count < 6)
-			BUFFER_FAIL(count, len, "XY_COLOR_BLT");
 
 		decode_2d_br01(ctx);
 		instr_out(ctx, 2, "(%d,%d)\n",
@@ -449,8 +444,6 @@ decode_2d(struct drm_intel_decode *ctx)
 		len = (data[0] & 0x000000ff) + 2;
 		if (len != 8)
 			fprintf(out, "Bad count in XY_SRC_COPY_BLT\n");
-		if (count < 8)
-			BUFFER_FAIL(count, len, "XY_SRC_COPY_BLT");
 
 		decode_2d_br01(ctx);
 		instr_out(ctx, 2, "dst (%d,%d)\n",
@@ -484,9 +477,6 @@ decode_2d(struct drm_intel_decode *ctx)
 			}
 
 			for (i = 1; i < len; i++) {
-				if (i >= count)
-					BUFFER_FAIL(count, len,
-						    opcodes_2d[opcode].name);
 				instr_out(ctx, i, "dword %d\n", i);
 			}
 
@@ -1183,7 +1173,6 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 	const char *format, *zformat, *type;
 	uint32_t opcode;
 	uint32_t *data = ctx->data;
-	uint32_t count = ctx->count;
 	uint32_t devid = ctx->devid;
 
 	struct {
@@ -1225,43 +1214,25 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 		len = (data[0] & 0x000000ff) + 1;
 		i = 1;
 		if (data[0] & (0x01 << 8)) {
-			if (i + 2 >= count)
-				BUFFER_FAIL(count, len,
-					    "3DSTATE_LOAD_INDIRECT");
 			instr_out(ctx, i++, "SIS.0\n");
 			instr_out(ctx, i++, "SIS.1\n");
 		}
 		if (data[0] & (0x02 << 8)) {
-			if (i + 1 >= count)
-				BUFFER_FAIL(count, len,
-					    "3DSTATE_LOAD_INDIRECT");
 			instr_out(ctx, i++, "DIS.0\n");
 		}
 		if (data[0] & (0x04 << 8)) {
-			if (i + 2 >= count)
-				BUFFER_FAIL(count, len,
-					    "3DSTATE_LOAD_INDIRECT");
 			instr_out(ctx, i++, "SSB.0\n");
 			instr_out(ctx, i++, "SSB.1\n");
 		}
 		if (data[0] & (0x08 << 8)) {
-			if (i + 2 >= count)
-				BUFFER_FAIL(count, len,
-					    "3DSTATE_LOAD_INDIRECT");
 			instr_out(ctx, i++, "MSB.0\n");
 			instr_out(ctx, i++, "MSB.1\n");
 		}
 		if (data[0] & (0x10 << 8)) {
-			if (i + 2 >= count)
-				BUFFER_FAIL(count, len,
-					    "3DSTATE_LOAD_INDIRECT");
 			instr_out(ctx, i++, "PSP.0\n");
 			instr_out(ctx, i++, "PSP.1\n");
 		}
 		if (data[0] & (0x20 << 8)) {
-			if (i + 2 >= count)
-				BUFFER_FAIL(count, len,
-					    "3DSTATE_LOAD_INDIRECT");
 			instr_out(ctx, i++, "PSC.0\n");
 			instr_out(ctx, i++, "PSC.1\n");
 		}
@@ -1277,10 +1248,6 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 		i = 1;
 		for (word = 0; word <= 8; word++) {
 			if (data[0] & (1 << (4 + word))) {
-				if (i >= count)
-					BUFFER_FAIL(count, len,
-						    "3DSTATE_LOAD_STATE_IMMEDIATE_1");
-
 				/* save vertex state for decode */
 				if (!IS_GEN2(devid)) {
 					int tex_num;
@@ -1668,10 +1635,6 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 		i = 1;
 		for (word = 6; word <= 14; word++) {
 			if (data[0] & (1 << word)) {
-				if (i >= count)
-					BUFFER_FAIL(count, len,
-						    "3DSTATE_LOAD_STATE_IMMEDIATE_2");
-
 				if (word == 6)
 					instr_out(ctx, i++,
 						  "TBCF\n");
@@ -1726,10 +1689,6 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 				int width, height, pitch, dword;
 				const char *tiling;
 
-				if (i + 3 >= count)
-					BUFFER_FAIL(count, len,
-						    "3DSTATE_MAP_STATE");
-
 				dword = data[i];
 				instr_out(ctx, i++,
 					  "map %d MS2 %s%s%s\n", map,
@@ -1929,9 +1888,6 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 		i = 2;
 		for (c = 0; c <= 31; c++) {
 			if (data[1] & (1 << c)) {
-				if (i + 4 >= count)
-					BUFFER_FAIL(count, len,
-						    "3DSTATE_PIXEL_SHADER_CONSTANTS");
 				instr_out(ctx, i, "C%d.X = %f\n", c,
 					  int_as_float(data[i]));
 				i++;
@@ -1962,9 +1918,6 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 		for (instr = 0; instr < (len - 1) / 3; instr++) {
 			char instr_prefix[10];
 
-			if (i + 3 >= count)
-				BUFFER_FAIL(count, len,
-					    "3DSTATE_PIXEL_SHADER_PROGRAM");
 			sprintf(instr_prefix, "PS%03d", instr);
 			i915_decode_instruction(ctx, i,
 						instr_prefix);
@@ -1982,9 +1935,7 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 			if (data[1] & (1 << sampler)) {
 				uint32_t dword;
 				const char *mip_filter = "";
-				if (i + 3 >= count)
-					BUFFER_FAIL(count, len,
-						    "3DSTATE_SAMPLER_STATE");
+
 				dword = data[i];
 				switch ((dword >> 20) & 0x3) {
 				case 0:
@@ -2047,9 +1998,6 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 		if (len != 2)
 			fprintf(out,
 				"Bad count in 3DSTATE_DEST_BUFFER_VARIABLES\n");
-		if (count < 2)
-			BUFFER_FAIL(count, len,
-				    "3DSTATE_DEST_BUFFER_VARIABLES");
 
 		instr_out(ctx, 0,
 			  "3DSTATE_DEST_BUFFER_VARIABLES\n");
@@ -2120,8 +2068,6 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 			if (len != 3)
 				fprintf(out,
 					"Bad count in 3DSTATE_BUFFER_INFO\n");
-			if (count < 3)
-				BUFFER_FAIL(count, len, "3DSTATE_BUFFER_INFO");
 
 			switch ((data[1] >> 24) & 0x7) {
 			case 0x3:
@@ -2155,8 +2101,6 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 		if (len != 3)
 			fprintf(out,
 				"Bad count in 3DSTATE_SCISSOR_RECTANGLE\n");
-		if (count < 3)
-			BUFFER_FAIL(count, len, "3DSTATE_SCISSOR_RECTANGLE");
 
 		instr_out(ctx, 0, "3DSTATE_SCISSOR_RECTANGLE\n");
 		instr_out(ctx, 1, "(%d,%d)\n",
@@ -2171,8 +2115,6 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 		if (len != 5)
 			fprintf(out,
 				"Bad count in 3DSTATE_DRAWING_RECTANGLE\n");
-		if (count < 5)
-			BUFFER_FAIL(count, len, "3DSTATE_DRAWING_RECTANGLE");
 
 		instr_out(ctx, 0, "3DSTATE_DRAWING_RECTANGLE\n");
 		instr_out(ctx, 1, "%s\n",
@@ -2190,8 +2132,6 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 
 		if (len != 7)
 			fprintf(out, "Bad count in 3DSTATE_CLEAR_PARAMETERS\n");
-		if (count < 7)
-			BUFFER_FAIL(count, len, "3DSTATE_CLEAR_PARAMETERS");
 
 		instr_out(ctx, 0, "3DSTATE_CLEAR_PARAMETERS\n");
 		instr_out(ctx, 1, "prim_type=%s, clear=%s%s%s\n",
@@ -2228,9 +2168,6 @@ decode_3d_1d(struct drm_intel_decode *ctx)
 			}
 
 			for (i = 1; i < len; i++) {
-				if (i >= count)
-					BUFFER_FAIL(count, len,
-						    opcode_3d_1d->name);
 				instr_out(ctx, i, "dword %d\n", i);
 			}
 
@@ -2488,9 +2425,6 @@ decode_3d_primitive(struct drm_intel_decode *ctx)
 			goto out;
 		} else {
 			/* sequential vertex access */
-			if (count < 2)
-				BUFFER_FAIL(count, 2,
-					    "3DPRIMITIVE seq indirect");
 			instr_out(ctx, 0,
 				  "3DPRIMITIVE sequential indirect %s, %d starting from "
 				  "%d\n", primtype, len, data[1] & 0xffff);
@@ -2512,7 +2446,6 @@ decode_3d(struct drm_intel_decode *ctx)
 	uint32_t opcode;
 	unsigned int idx;
 	uint32_t *data = ctx->data;
-	uint32_t count = ctx->count;
 
 	struct {
 		uint32_t opcode;
@@ -2558,9 +2491,6 @@ decode_3d(struct drm_intel_decode *ctx)
 			}
 
 			for (i = 1; i < len; i++) {
-				if (i >= count)
-					BUFFER_FAIL(count, len,
-						    opcode_3d->name);
 				instr_out(ctx, i, "dword %d\n", i);
 			}
 			return len;
@@ -2700,8 +2630,6 @@ i965_decode_urb_fence(struct drm_intel_decode *ctx, int len)
 
 	if (len != 3)
 		fprintf(out, "Bad count in URB_FENCE\n");
-	if (ctx->count < 3)
-		BUFFER_FAIL(ctx->count, len, "URB_FENCE");
 
 	vs_fence = data[1] & 0x3ff;
 	gs_fence = (data[1] >> 10) & 0x3ff;
@@ -2776,7 +2704,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 	unsigned int i, j, sba_len;
 	const char *desc1 = NULL;
 	uint32_t *data = ctx->data;
-	uint32_t count = ctx->count;
 	uint32_t devid = ctx->devid;
 
 	struct {
@@ -2863,8 +2790,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 			sba_len = 6;
 		if (len != sba_len)
 			fprintf(out, "Bad count in STATE_BASE_ADDRESS\n");
-		if (len != sba_len)
-			BUFFER_FAIL(count, len, "STATE_BASE_ADDRESS");
 
 		state_base_out(ctx, i++, "general");
 		state_base_out(ctx, i++, "surface");
@@ -2886,8 +2811,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		if (len != 7)
 			fprintf(out,
 				"Bad count in 3DSTATE_PIPELINED_POINTERS\n");
-		if (count < 7)
-			BUFFER_FAIL(count, len, "3DSTATE_PIPELINED_POINTERS");
 
 		instr_out(ctx, 0, "3DSTATE_PIPELINED_POINTERS\n");
 		instr_out(ctx, 1, "VS state\n");
@@ -2903,9 +2826,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 			fprintf(out,
 				"Bad count in 3DSTATE_BINDING_TABLE_POINTERS\n");
 		if (len == 6) {
-			if (count < 6)
-				BUFFER_FAIL(count, len,
-					    "3DSTATE_BINDING_TABLE_POINTERS");
 			instr_out(ctx, 0,
 				  "3DSTATE_BINDING_TABLE_POINTERS\n");
 			instr_out(ctx, 1, "VS binding table\n");
@@ -2914,10 +2834,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 			instr_out(ctx, 4, "SF binding table\n");
 			instr_out(ctx, 5, "WM binding table\n");
 		} else {
-			if (count < 4)
-				BUFFER_FAIL(count, len,
-					    "3DSTATE_BINDING_TABLE_POINTERS");
-
 			instr_out(ctx, 0,
 				  "3DSTATE_BINDING_TABLE_POINTERS: VS mod %d, "
 				  "GS mod %d, PS mod %d\n",
@@ -2935,9 +2851,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		if (len != 4)
 			fprintf(out,
 				"Bad count in 3DSTATE_SAMPLER_STATE_POINTERS\n");
-		if (count < 4)
-			BUFFER_FAIL(count, len,
-				    "3DSTATE_SAMPLER_STATE_POINTERS");
 		instr_out(ctx, 0,
 			  "3DSTATE_SAMPLER_STATE_POINTERS: VS mod %d, "
 			  "GS mod %d, PS mod %d\n", (data[0] & (1 << 8)) != 0,
@@ -2951,8 +2864,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		len = (data[0] & 0xff) + 2;
 		if (len != 3)
 			fprintf(out, "Bad count in 3DSTATE_URB\n");
-		if (count < 3)
-			BUFFER_FAIL(count, len, "3DSTATE_URB");
 		instr_out(ctx, 0, "3DSTATE_URB\n");
 		instr_out(ctx, 1,
 			  "VS entries %d, alloc size %d (1024bit row)\n",
@@ -2966,8 +2877,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		len = (data[0] & 0xff) + 2;
 		if ((len - 1) % 4 != 0)
 			fprintf(out, "Bad count in 3DSTATE_VERTEX_BUFFERS\n");
-		if (count < len)
-			BUFFER_FAIL(count, len, "3DSTATE_VERTEX_BUFFERS");
 		instr_out(ctx, 0, "3DSTATE_VERTEX_BUFFERS\n");
 
 		for (i = 1; i < len;) {
@@ -2994,8 +2903,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		len = (data[0] & 0xff) + 2;
 		if ((len + 1) % 2 != 0)
 			fprintf(out, "Bad count in 3DSTATE_VERTEX_ELEMENTS\n");
-		if (count < len)
-			BUFFER_FAIL(count, len, "3DSTATE_VERTEX_ELEMENTS");
 		instr_out(ctx, 0, "3DSTATE_VERTEX_ELEMENTS\n");
 
 		for (i = 1; i < len;) {
@@ -3023,9 +2930,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		if (len != 4)
 			fprintf(out,
 				"Bad count in 3DSTATE_VIEWPORT_STATE_POINTERS\n");
-		if (count < len)
-			BUFFER_FAIL(count, len,
-				    "3DSTATE_VIEWPORT_STATE_POINTERS");
 		instr_out(ctx, 0,
 			  "3DSTATE_VIEWPORT_STATE_POINTERS\n");
 		instr_out(ctx, 1, "clip\n");
@@ -3037,8 +2941,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		len = (data[0] & 0xff) + 2;
 		if (len != 3)
 			fprintf(out, "Bad count in 3DSTATE_INDEX_BUFFER\n");
-		if (count < len)
-			BUFFER_FAIL(count, len, "3DSTATE_INDEX_BUFFER");
 		instr_out(ctx, 0, "3DSTATE_INDEX_BUFFER\n");
 		instr_out(ctx, 1, "beginning buffer address\n");
 		instr_out(ctx, 2, "ending buffer address\n");
@@ -3049,8 +2951,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		if (len != 4)
 			fprintf(out,
 				"Bad count in 3DSTATE_CC_STATE_POINTERS\n");
-		if (count < 4)
-			BUFFER_FAIL(count, len, "3DSTATE_CC_STATE_POINTERS");
 		instr_out(ctx, 0, "3DSTATE_CC_STATE_POINTERS\n");
 		instr_out(ctx, 1, "blend change %d\n", data[1] & 1);
 		instr_out(ctx, 2, "depth stencil change %d\n",
@@ -3062,8 +2962,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		len = (data[0] & 0xff) + 2;
 		if (len != 2)
 			fprintf(out, "Bad count in 3DSTATE_SCISSOR_POINTERS\n");
-		if (count < 2)
-			BUFFER_FAIL(count, len, "3DSTATE_SCISSOR_POINTERS");
 		instr_out(ctx, 0, "3DSTATE_SCISSOR_POINTERS\n");
 		instr_out(ctx, 1, "scissor rect offset\n");
 		return len;
@@ -3072,8 +2970,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		len = (data[0] & 0xff) + 2;
 		if (len != 6)
 			fprintf(out, "Bad count in 3DSTATE_VS\n");
-		if (count < 6)
-			BUFFER_FAIL(count, len, "3DSTATE_VS");
 		instr_out(ctx, 0, "3DSTATE_VS\n");
 		instr_out(ctx, 1, "kernel pointer\n");
 		instr_out(ctx, 2,
@@ -3097,8 +2993,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		len = (data[0] & 0xff) + 2;
 		if (len != 7)
 			fprintf(out, "Bad count in 3DSTATE_GS\n");
-		if (count < 7)
-			BUFFER_FAIL(count, len, "3DSTATE_GS");
 		instr_out(ctx, 0, "3DSTATE_GS\n");
 		instr_out(ctx, 1, "kernel pointer\n");
 		instr_out(ctx, 2,
@@ -3127,8 +3021,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		len = (data[0] & 0xff) + 2;
 		if (len != 4)
 			fprintf(out, "Bad count in 3DSTATE_CLIP\n");
-		if (count < 4)
-			BUFFER_FAIL(count, len, "3DSTATE_CLIP");
 		instr_out(ctx, 0, "3DSTATE_CLIP\n");
 		instr_out(ctx, 1,
 			  "UserClip distance cull test mask 0x%x\n",
@@ -3160,8 +3052,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		len = (data[0] & 0xff) + 2;
 		if (len != 20)
 			fprintf(out, "Bad count in 3DSTATE_SF\n");
-		if (count < 20)
-			BUFFER_FAIL(count, len, "3DSTATE_SF");
 		instr_out(ctx, 0, "3DSTATE_SF\n");
 		instr_out(ctx, 1,
 			  "Attrib Out %d, Attrib Swizzle %sable, VUE read length %d, "
@@ -3226,8 +3116,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		len = (data[0] & 0xff) + 2;
 		if (len != 9)
 			fprintf(out, "Bad count in 3DSTATE_WM\n");
-		if (count < 9)
-			BUFFER_FAIL(count, len, "3DSTATE_WM");
 		instr_out(ctx, 0, "3DSTATE_WM\n");
 		instr_out(ctx, 1, "kernel start pointer 0\n");
 		instr_out(ctx, 2,
@@ -3271,8 +3159,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		if (len != 4)
 			fprintf(out,
 				"Bad count in 3DSTATE_DRAWING_RECTANGLE\n");
-		if (count < 4)
-			BUFFER_FAIL(count, len, "3DSTATE_DRAWING_RECTANGLE");
 
 		instr_out(ctx, 0, "3DSTATE_DRAWING_RECTANGLE\n");
 		instr_out(ctx, 1, "top left: %d,%d\n",
@@ -3287,8 +3173,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 	case 0x7905:
 		if (len < 5 || len > 7)
 			fprintf(out, "Bad count in 3DSTATE_DEPTH_BUFFER\n");
-		if (count < len)
-			BUFFER_FAIL(count, len, "3DSTATE_DEPTH_BUFFER");
 
 		instr_out(ctx, 0, "3DSTATE_DEPTH_BUFFER\n");
 		if (IS_GEN5(devid) || IS_GEN6(devid))
@@ -3330,8 +3214,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 			len = (data[0] & 0xff) + 2;
 			if (len != 4 && len != 5)
 				fprintf(out, "Bad count in PIPE_CONTROL\n");
-			if (count < len)
-				BUFFER_FAIL(count, len, "PIPE_CONTROL");
 
 			switch ((data[1] >> 14) & 0x3) {
 			case 0:
@@ -3399,8 +3281,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 			len = (data[0] & 0xff) + 2;
 			if (len != 4)
 				fprintf(out, "Bad count in PIPE_CONTROL\n");
-			if (count < len)
-				BUFFER_FAIL(count, len, "PIPE_CONTROL");
 
 			switch ((data[0] >> 14) & 0x3) {
 			case 0:
@@ -3432,8 +3312,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 		len = (data[0] & 0xff) + 2;
 		if (len != 6)
 			fprintf(out, "Bad count in 3DPRIMITIVE\n");
-		if (count < len)
-			BUFFER_FAIL(count, len, "3DPRIMITIVE");
 
 		instr_out(ctx, 0,
 			  "3DPRIMITIVE: %s %s\n",
@@ -3464,9 +3342,6 @@ decode_3d_965(struct drm_intel_decode *ctx)
 			}
 
 			for (i = 1; i < len; i++) {
-				if (i >= count)
-					BUFFER_FAIL(count, len,
-						    opcode_3d->name);
 				instr_out(ctx, i, "dword %d\n", i);
 			}
 			return len;
@@ -3484,7 +3359,6 @@ decode_3d_i830(struct drm_intel_decode *ctx)
 	unsigned int idx;
 	uint32_t opcode;
 	uint32_t *data = ctx->data;
-	uint32_t count = ctx->count;
 
 	struct {
 		uint32_t opcode;
@@ -3537,9 +3411,6 @@ decode_3d_i830(struct drm_intel_decode *ctx)
 			}
 
 			for (i = 1; i < len; i++) {
-				if (i >= count)
-					BUFFER_FAIL(count, len,
-						    opcode_3d->name);
 				instr_out(ctx, i, "dword %d\n", i);
 			}
 			return len;
@@ -3616,11 +3487,21 @@ drm_intel_decode(struct drm_intel_decode *ctx)
 	int ret;
 	unsigned int index = 0;
 	uint32_t devid;
+	int size = ctx->base_count * 4;
+	void *temp;
 
 	if (!ctx)
 		return;
 
-	ctx->data = ctx->base_data;
+	/* Put a scratch page full of obviously undefined data after
+	 * the batchbuffer.  This lets us avoid a bunch of length
+	 * checking in statically sized packets.
+	 */
+	temp = malloc(size + 4096);
+	memcpy(temp, ctx->base_data, size);
+	memset((char *)temp + size, 0xd0, 4096);
+	ctx->data = temp;
+
 	ctx->hw_offset = ctx->base_hw_offset;
 	ctx->count = ctx->base_count;
 
@@ -3685,4 +3566,6 @@ drm_intel_decode(struct drm_intel_decode *ctx)
 		ctx->data += index;
 		ctx->hw_offset += 4 * index;
 	}
+
+	free(temp);
 }