Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-27 14:41:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'vmwgfx-next-2014-01-13' of git://people.freedesktop.org/~thomash/linux into drm-next

Browse Source 
Anyway, nothing big here, Three more code cleanup patches from Rashika
Kheria, and one TTM/vmwgfx patch from me that tightens security around TTM
objects enough for them to opened using prime objects from render nodes:

Previously any client could access a shared buffer using the "name", also
without actually opening it. Now a reference is required, and for render nodes
such a reference is intended to only be obtainable using a prime fd.

vmwgfx-next 2014-01-13 pull request

* tag 'vmwgfx-next-2014-01-13' of git://people.freedesktop.org/~thomash/linux:
  drivers: gpu: Mark functions as static in vmwgfx_fence.c
  drivers: gpu: Mark functions as static in vmwgfx_buffer.c
  drivers: gpu: Mark functions as static in vmwgfx_kms.c
  drm/ttm: ttm object security fixes for render nodes
This commit is contained in:
Dave Airlie 2014-01-14 10:55:36 +10:00
commit faf096ffba
6 changed files with 89 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

94
drivers/gpu/drm/ttm/ttm_object.c
View File

@ -68,7 +68,7 @@
struct ttm_object_file { struct ttm_object_file {
struct ttm_object_device *tdev; struct ttm_object_device *tdev;
rwlock_t lock; spinlock_t lock;
struct list_head ref_list; struct list_head ref_list;
struct drm_open_hash ref_hash[TTM_REF_NUM]; struct drm_open_hash ref_hash[TTM_REF_NUM];
struct kref refcount; struct kref refcount;
@ -118,6 +118,7 @@ struct ttm_object_device {
*/ */
struct ttm_ref_object { struct ttm_ref_object {
struct rcu_head rcu_head;
struct drm_hash_item hash; struct drm_hash_item hash;
struct list_head head; struct list_head head;
struct kref kref; struct kref kref;
@ -210,10 +211,9 @@ static void ttm_release_base(struct kref *kref)
* call_rcu() or ttm_base_object_kfree(). * call_rcu() or ttm_base_object_kfree().
*/ */
if (base->refcount_release) { ttm_object_file_unref(&base->tfile);
ttm_object_file_unref(&base->tfile); if (base->refcount_release)
base->refcount_release(&base); base->refcount_release(&base);
}
} }
void ttm_base_object_unref(struct ttm_base_object **p_base) void ttm_base_object_unref(struct ttm_base_object **p_base)
@ -229,33 +229,47 @@ EXPORT_SYMBOL(ttm_base_object_unref);
struct ttm_base_object *ttm_base_object_lookup(struct ttm_object_file *tfile, struct ttm_base_object *ttm_base_object_lookup(struct ttm_object_file *tfile,
uint32_t key) uint32_t key)
{ {
struct ttm_object_device *tdev = tfile->tdev; struct ttm_base_object *base = NULL;
struct ttm_base_object *uninitialized_var(base);
struct drm_hash_item *hash; struct drm_hash_item *hash;
struct drm_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE];
int ret; int ret;
rcu_read_lock(); rcu_read_lock();
ret = drm_ht_find_item_rcu(&tdev->object_hash, key, &hash); ret = drm_ht_find_item_rcu(ht, key, &hash);
if (likely(ret == 0)) { if (likely(ret == 0)) {
base = drm_hash_entry(hash, struct ttm_base_object, hash); base = drm_hash_entry(hash, struct ttm_ref_object, hash)->obj;
ret = kref_get_unless_zero(&base->refcount) ? 0 : -EINVAL; if (!kref_get_unless_zero(&base->refcount))
base = NULL;
} }
rcu_read_unlock(); rcu_read_unlock();
if (unlikely(ret != 0))
return NULL;
if (tfile != base->tfile && !base->shareable) {
pr_err("Attempted access of non-shareable object\n");
ttm_base_object_unref(&base);
return NULL;
}
return base; return base;
} }
EXPORT_SYMBOL(ttm_base_object_lookup); EXPORT_SYMBOL(ttm_base_object_lookup);
struct ttm_base_object *
ttm_base_object_lookup_for_ref(struct ttm_object_device *tdev, uint32_t key)
{
struct ttm_base_object *base = NULL;
struct drm_hash_item *hash;
struct drm_open_hash *ht = &tdev->object_hash;
int ret;
rcu_read_lock();
ret = drm_ht_find_item_rcu(ht, key, &hash);
if (likely(ret == 0)) {
base = drm_hash_entry(hash, struct ttm_base_object, hash);
if (!kref_get_unless_zero(&base->refcount))
base = NULL;
}
rcu_read_unlock();
return base;
}
EXPORT_SYMBOL(ttm_base_object_lookup_for_ref);
int ttm_ref_object_add(struct ttm_object_file *tfile, int ttm_ref_object_add(struct ttm_object_file *tfile,
struct ttm_base_object *base, struct ttm_base_object *base,
enum ttm_ref_type ref_type, bool *existed) enum ttm_ref_type ref_type, bool *existed)
@ -266,21 +280,25 @@ int ttm_ref_object_add(struct ttm_object_file *tfile,
struct ttm_mem_global *mem_glob = tfile->tdev->mem_glob; struct ttm_mem_global *mem_glob = tfile->tdev->mem_glob;
int ret = -EINVAL; int ret = -EINVAL;
if (base->tfile != tfile && !base->shareable)
return -EPERM;
if (existed != NULL) if (existed != NULL)
*existed = true; *existed = true;
while (ret == -EINVAL) { while (ret == -EINVAL) {
read_lock(&tfile->lock); rcu_read_lock();
ret = drm_ht_find_item(ht, base->hash.key, &hash); ret = drm_ht_find_item_rcu(ht, base->hash.key, &hash);
if (ret == 0) { if (ret == 0) {
ref = drm_hash_entry(hash, struct ttm_ref_object, hash); ref = drm_hash_entry(hash, struct ttm_ref_object, hash);
kref_get(&ref->kref); if (!kref_get_unless_zero(&ref->kref)) {
read_unlock(&tfile->lock); rcu_read_unlock();
break; break;
}
} }
read_unlock(&tfile->lock); rcu_read_unlock();
ret = ttm_mem_global_alloc(mem_glob, sizeof(*ref), ret = ttm_mem_global_alloc(mem_glob, sizeof(*ref),
false, false); false, false);
if (unlikely(ret != 0)) if (unlikely(ret != 0))
@ -297,19 +315,19 @@ int ttm_ref_object_add(struct ttm_object_file *tfile,
ref->ref_type = ref_type; ref->ref_type = ref_type;
kref_init(&ref->kref); kref_init(&ref->kref);
write_lock(&tfile->lock); spin_lock(&tfile->lock);
ret = drm_ht_insert_item(ht, &ref->hash); ret = drm_ht_insert_item_rcu(ht, &ref->hash);
if (likely(ret == 0)) { if (likely(ret == 0)) {
list_add_tail(&ref->head, &tfile->ref_list); list_add_tail(&ref->head, &tfile->ref_list);
kref_get(&base->refcount); kref_get(&base->refcount);
write_unlock(&tfile->lock); spin_unlock(&tfile->lock);
if (existed != NULL) if (existed != NULL)
*existed = false; *existed = false;
break; break;
} }
write_unlock(&tfile->lock); spin_unlock(&tfile->lock);
BUG_ON(ret != -EINVAL); BUG_ON(ret != -EINVAL);
ttm_mem_global_free(mem_glob, sizeof(*ref)); ttm_mem_global_free(mem_glob, sizeof(*ref));
@ -330,17 +348,17 @@ static void ttm_ref_object_release(struct kref *kref)
struct ttm_mem_global *mem_glob = tfile->tdev->mem_glob; struct ttm_mem_global *mem_glob = tfile->tdev->mem_glob;
ht = &tfile->ref_hash[ref->ref_type]; ht = &tfile->ref_hash[ref->ref_type];
(void)drm_ht_remove_item(ht, &ref->hash); (void)drm_ht_remove_item_rcu(ht, &ref->hash);
list_del(&ref->head); list_del(&ref->head);
write_unlock(&tfile->lock); spin_unlock(&tfile->lock);
if (ref->ref_type != TTM_REF_USAGE && base->ref_obj_release) if (ref->ref_type != TTM_REF_USAGE && base->ref_obj_release)
base->ref_obj_release(base, ref->ref_type); base->ref_obj_release(base, ref->ref_type);
ttm_base_object_unref(&ref->obj); ttm_base_object_unref(&ref->obj);
ttm_mem_global_free(mem_glob, sizeof(*ref)); ttm_mem_global_free(mem_glob, sizeof(*ref));
kfree(ref); kfree_rcu(ref, rcu_head);
write_lock(&tfile->lock); spin_lock(&tfile->lock);
} }
int ttm_ref_object_base_unref(struct ttm_object_file *tfile, int ttm_ref_object_base_unref(struct ttm_object_file *tfile,
@ -351,15 +369,15 @@ int ttm_ref_object_base_unref(struct ttm_object_file *tfile,
struct drm_hash_item *hash; struct drm_hash_item *hash;
int ret; int ret;
write_lock(&tfile->lock); spin_lock(&tfile->lock);
ret = drm_ht_find_item(ht, key, &hash); ret = drm_ht_find_item(ht, key, &hash);
if (unlikely(ret != 0)) { if (unlikely(ret != 0)) {
write_unlock(&tfile->lock); spin_unlock(&tfile->lock);
return -EINVAL; return -EINVAL;
} }
ref = drm_hash_entry(hash, struct ttm_ref_object, hash); ref = drm_hash_entry(hash, struct ttm_ref_object, hash);
kref_put(&ref->kref, ttm_ref_object_release); kref_put(&ref->kref, ttm_ref_object_release);
write_unlock(&tfile->lock); spin_unlock(&tfile->lock);
return 0; return 0;
} }
EXPORT_SYMBOL(ttm_ref_object_base_unref); EXPORT_SYMBOL(ttm_ref_object_base_unref);
@ -372,7 +390,7 @@ void ttm_object_file_release(struct ttm_object_file **p_tfile)
struct ttm_object_file *tfile = *p_tfile; struct ttm_object_file *tfile = *p_tfile;
*p_tfile = NULL; *p_tfile = NULL;
write_lock(&tfile->lock); spin_lock(&tfile->lock);
/* /*
* Since we release the lock within the loop, we have to * Since we release the lock within the loop, we have to
@ -388,7 +406,7 @@ void ttm_object_file_release(struct ttm_object_file **p_tfile)
for (i = 0; i < TTM_REF_NUM; ++i) for (i = 0; i < TTM_REF_NUM; ++i)
drm_ht_remove(&tfile->ref_hash[i]); drm_ht_remove(&tfile->ref_hash[i]);
write_unlock(&tfile->lock); spin_unlock(&tfile->lock);
ttm_object_file_unref(&tfile); ttm_object_file_unref(&tfile);
} }
EXPORT_SYMBOL(ttm_object_file_release); EXPORT_SYMBOL(ttm_object_file_release);
@ -404,7 +422,7 @@ struct ttm_object_file *ttm_object_file_init(struct ttm_object_device *tdev,
if (unlikely(tfile == NULL)) if (unlikely(tfile == NULL))
return NULL; return NULL;
rwlock_init(&tfile->lock); spin_lock_init(&tfile->lock);
tfile->tdev = tdev; tfile->tdev = tdev;
kref_init(&tfile->refcount); kref_init(&tfile->refcount);
INIT_LIST_HEAD(&tfile->ref_list); INIT_LIST_HEAD(&tfile->ref_list);

8
drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
View File

@ -517,7 +517,7 @@ static struct ttm_backend_func vmw_ttm_func = {
.destroy = vmw_ttm_destroy, .destroy = vmw_ttm_destroy,
}; };
struct ttm_tt *vmw_ttm_tt_create(struct ttm_bo_device *bdev, static struct ttm_tt *vmw_ttm_tt_create(struct ttm_bo_device *bdev,
unsigned long size, uint32_t page_flags, unsigned long size, uint32_t page_flags,
struct page *dummy_read_page) struct page *dummy_read_page)
{ {
@ -546,12 +546,12 @@ out_no_init:
return NULL; return NULL;
} }
int vmw_invalidate_caches(struct ttm_bo_device *bdev, uint32_t flags) static int vmw_invalidate_caches(struct ttm_bo_device *bdev, uint32_t flags)
{ {
return 0; return 0;
} }
int vmw_init_mem_type(struct ttm_bo_device *bdev, uint32_t type, static int vmw_init_mem_type(struct ttm_bo_device *bdev, uint32_t type,
struct ttm_mem_type_manager *man) struct ttm_mem_type_manager *man)
{ {
switch (type) { switch (type) {
@ -589,7 +589,7 @@ int vmw_init_mem_type(struct ttm_bo_device *bdev, uint32_t type,
return 0; return 0;
} }
void vmw_evict_flags(struct ttm_buffer_object *bo, static void vmw_evict_flags(struct ttm_buffer_object *bo,
struct ttm_placement *placement) struct ttm_placement *placement)
{ {
*placement = vmw_sys_placement; *placement = vmw_sys_placement;

9
drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
View File

@ -271,7 +271,7 @@ void vmw_fence_obj_unreference(struct vmw_fence_obj **fence_p)
spin_unlock_irq(&fman->lock); spin_unlock_irq(&fman->lock);
} }
void vmw_fences_perform_actions(struct vmw_fence_manager *fman, static void vmw_fences_perform_actions(struct vmw_fence_manager *fman,
struct list_head *list) struct list_head *list)
{ {
struct vmw_fence_action *action, *next_action; struct vmw_fence_action *action, *next_action;
@ -897,7 +897,7 @@ static void vmw_event_fence_action_cleanup(struct vmw_fence_action *action)
* Note that the action callbacks may be executed before this function * Note that the action callbacks may be executed before this function
* returns. * returns.
*/ */
void vmw_fence_obj_add_action(struct vmw_fence_obj *fence, static void vmw_fence_obj_add_action(struct vmw_fence_obj *fence,
struct vmw_fence_action *action) struct vmw_fence_action *action)
{ {
struct vmw_fence_manager *fman = fence->fman; struct vmw_fence_manager *fman = fence->fman;
@ -993,7 +993,7 @@ struct vmw_event_fence_pending {
struct drm_vmw_event_fence event; struct drm_vmw_event_fence event;
}; };
int vmw_event_fence_action_create(struct drm_file *file_priv, static int vmw_event_fence_action_create(struct drm_file *file_priv,
struct vmw_fence_obj *fence, struct vmw_fence_obj *fence,
uint32_t flags, uint32_t flags,
uint64_t user_data, uint64_t user_data,
@ -1080,7 +1080,8 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
*/ */
if (arg->handle) { if (arg->handle) {
struct ttm_base_object *base = struct ttm_base_object *base =
ttm_base_object_lookup(vmw_fp->tfile, arg->handle); ttm_base_object_lookup_for_ref(dev_priv->tdev,
arg->handle);
if (unlikely(base == NULL)) { if (unlikely(base == NULL)) {
DRM_ERROR("Fence event invalid fence object handle " DRM_ERROR("Fence event invalid fence object handle "

12
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
View File

@ -40,7 +40,7 @@ struct vmw_clip_rect {
* Clip @num_rects number of @rects against @clip storing the * Clip @num_rects number of @rects against @clip storing the
* results in @out_rects and the number of passed rects in @out_num. * results in @out_rects and the number of passed rects in @out_num.
*/ */
void vmw_clip_cliprects(struct drm_clip_rect *rects, static void vmw_clip_cliprects(struct drm_clip_rect *rects,
int num_rects, int num_rects,
struct vmw_clip_rect clip, struct vmw_clip_rect clip,
SVGASignedRect *out_rects, SVGASignedRect *out_rects,
@ -423,7 +423,7 @@ struct vmw_framebuffer_surface {
struct drm_master *master; struct drm_master *master;
}; };
void vmw_framebuffer_surface_destroy(struct drm_framebuffer *framebuffer) static void vmw_framebuffer_surface_destroy(struct drm_framebuffer *framebuffer)
{ {
struct vmw_framebuffer_surface *vfbs = struct vmw_framebuffer_surface *vfbs =
vmw_framebuffer_to_vfbs(framebuffer); vmw_framebuffer_to_vfbs(framebuffer);
@ -589,7 +589,7 @@ out_free_tmp:
return ret; return ret;
} }
int vmw_framebuffer_surface_dirty(struct drm_framebuffer *framebuffer, static int vmw_framebuffer_surface_dirty(struct drm_framebuffer *framebuffer,
struct drm_file *file_priv, struct drm_file *file_priv,
unsigned flags, unsigned color, unsigned flags, unsigned color,
struct drm_clip_rect *clips, struct drm_clip_rect *clips,
@ -761,7 +761,7 @@ struct vmw_framebuffer_dmabuf {
struct vmw_dma_buffer *buffer; struct vmw_dma_buffer *buffer;
}; };
void vmw_framebuffer_dmabuf_destroy(struct drm_framebuffer *framebuffer) static void vmw_framebuffer_dmabuf_destroy(struct drm_framebuffer *framebuffer)
{ {
struct vmw_framebuffer_dmabuf *vfbd = struct vmw_framebuffer_dmabuf *vfbd =
vmw_framebuffer_to_vfbd(framebuffer); vmw_framebuffer_to_vfbd(framebuffer);
@ -947,7 +947,7 @@ static int do_dmabuf_dirty_sou(struct drm_file *file_priv,
return ret; return ret;
} }
int vmw_framebuffer_dmabuf_dirty(struct drm_framebuffer *framebuffer, static int vmw_framebuffer_dmabuf_dirty(struct drm_framebuffer *framebuffer,
struct drm_file *file_priv, struct drm_file *file_priv,
unsigned flags, unsigned color, unsigned flags, unsigned color,
struct drm_clip_rect *clips, struct drm_clip_rect *clips,
@ -1677,7 +1677,7 @@ void vmw_disable_vblank(struct drm_device *dev, int crtc)
* Small shared kms functions. * Small shared kms functions.
*/ */
int vmw_du_update_layout(struct vmw_private *dev_priv, unsigned num, static int vmw_du_update_layout(struct vmw_private *dev_priv, unsigned num,
struct drm_vmw_rect *rects) struct drm_vmw_rect *rects)
{ {
struct drm_device *dev = dev_priv->dev; struct drm_device *dev = dev_priv->dev;

3
drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
View File

@ -843,6 +843,7 @@ out_unlock:
int vmw_surface_reference_ioctl(struct drm_device *dev, void *data, int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
struct drm_file *file_priv) struct drm_file *file_priv)
{ {
struct vmw_private *dev_priv = vmw_priv(dev);
union drm_vmw_surface_reference_arg *arg = union drm_vmw_surface_reference_arg *arg =
(union drm_vmw_surface_reference_arg *)data; (union drm_vmw_surface_reference_arg *)data;
struct drm_vmw_surface_arg *req = &arg->req; struct drm_vmw_surface_arg *req = &arg->req;
@ -854,7 +855,7 @@ int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
struct ttm_base_object *base; struct ttm_base_object *base;
int ret = -EINVAL; int ret = -EINVAL;
base = ttm_base_object_lookup(tfile, req->sid); base = ttm_base_object_lookup_for_ref(dev_priv->tdev, req->sid);
if (unlikely(base == NULL)) { if (unlikely(base == NULL)) {
DRM_ERROR("Could not find surface to reference.\n"); DRM_ERROR("Could not find surface to reference.\n");
return -EINVAL; return -EINVAL;

18
include/drm/ttm/ttm_object.h
View File

@ -190,13 +190,25 @@ extern int ttm_base_object_init(struct ttm_object_file *tfile,
* @key: Hash key * @key: Hash key
* *
* Looks up a struct ttm_base_object with the key @key. * Looks up a struct ttm_base_object with the key @key.
* Also verifies that the object is visible to the application, by
* comparing the @tfile argument and checking the object shareable flag.
*/ */
extern struct ttm_base_object *ttm_base_object_lookup(struct ttm_object_file extern struct ttm_base_object *ttm_base_object_lookup(struct ttm_object_file
*tfile, uint32_t key); *tfile, uint32_t key);
/**
* ttm_base_object_lookup_for_ref
*
* @tdev: Pointer to a struct ttm_object_device.
* @key: Hash key
*
* Looks up a struct ttm_base_object with the key @key.
* This function should only be used when the struct tfile associated with the
* caller doesn't yet have a reference to the base object.
*/
extern struct ttm_base_object *
ttm_base_object_lookup_for_ref(struct ttm_object_device *tdev, uint32_t key);
/** /**
* ttm_base_object_unref * ttm_base_object_unref
* *
@ -218,6 +230,8 @@ extern void ttm_base_object_unref(struct ttm_base_object **p_base);
* @existed: Upon completion, indicates that an identical reference object * @existed: Upon completion, indicates that an identical reference object
* already existed, and the refcount was upped on that object instead. * already existed, and the refcount was upped on that object instead.
* *
* Checks that the base object is shareable and adds a ref object to it.
*
* Adding a ref object to a base object is basically like referencing the * Adding a ref object to a base object is basically like referencing the
* base object, but a user-space application holds the reference. When the * base object, but a user-space application holds the reference. When the
* file corresponding to @tfile is closed, all its reference objects are * file corresponding to @tfile is closed, all its reference objects are