Re: [PATCH 06/21] drm/etnaviv: copy pmrs from userspace

[Lucas Stach <l.stach@pengutronix.de>]

Am Freitag, den 09.06.2017, 12:21 +0200 schrieb Christian Gmeiner:
> All performance monitor requests will be validated during this phase.
> 
> Signed-off-by: Christian Gmeiner <christian.gmeiner@gmail.com>
> ---
>  drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 68
> +++++++++++++++++++++++++++-
>  1 file changed, 66 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
> b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
> index fdfe31d..ed05b64 100644
> --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
> +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
> @@ -21,6 +21,7 @@
>  #include "etnaviv_drv.h"
>  #include "etnaviv_gpu.h"
>  #include "etnaviv_gem.h"
> +#include "etnaviv_perfmon.h"
>  
>  /*
>   * Cmdstream submission:
> @@ -283,6 +284,53 @@ static int submit_reloc(struct
> etnaviv_gem_submit *submit, void *stream,
>  	return 0;
>  }
>  
> +static int submit_perfmon_request(struct etnaviv_gem_submit *submit,

Please name this after what is does: submit_perfmon_validate()

> +		struct etnaviv_cmdbuf *cmdbuf,
> +		const struct drm_etnaviv_gem_submit_pmr *pmrs,
> +		u32 nr_pms)
> +{
> +	u32 i;
> +
> +	for (i = 0; i < nr_pms; i++) {
> +		const struct drm_etnaviv_gem_submit_pmr *r = pmrs +
> i;
> +		struct etnaviv_gem_submit_bo *bo;
> +		int ret;
> +
> +		ret = submit_bo(submit, r->read_idx, &bo);
> +		if (ret)
> +			return ret;
> +
> +		if (r->read_offset == 0) {
> +			DRM_ERROR("perfmon request: offset is 0");
> +			return -EINVAL;
> +		}

Why is a 0 offset invalid? Can't the readback be placed at the
beginning of the BO?

> +
> +		if (r->read_offset >= bo->obj->base.size -
> sizeof(u32)) {
> +			DRM_ERROR("perfmon request: offset %u
> outside object", i);
> +			return -EINVAL;
> +		}
> +
> +		if (!r->flags) {
> +			DRM_ERROR("perfmon request: flags are 0");
> +			return -EINVAL;
> +		}
This needs to validate that the flags are valid, not just that there
are flags -> reject any non-allocated flag bits.

> +
> +		if (etnaviv_pm_req_validate(r)) {
> +			DRM_ERROR("perfmon request: domain or signal
> not valid");
> +			return -EINVAL;
> +		}
> +
> +		cmdbuf->pmrs[i].flags = r->flags;
> +		cmdbuf->pmrs[i].domain = r->domain;
> +		cmdbuf->pmrs[i].signal = r->signal;
> +		cmdbuf->pmrs[i].sequence = r->sequence;
> +		cmdbuf->pmrs[i].offset = r->read_offset;
> +		cmdbuf->pmrs[i].bo_vma = etnaviv_gem_vmap(&bo->obj-
> >base);
> +	}
> +
> +	return 0;
> +}
> +
>  static void submit_cleanup(struct etnaviv_gem_submit *submit)
>  {
>  	unsigned i;
> @@ -306,6 +354,7 @@ int etnaviv_ioctl_gem_submit(struct drm_device
> *dev, void *data,
>  	struct etnaviv_drm_private *priv = dev->dev_private;
>  	struct drm_etnaviv_gem_submit *args = data;
>  	struct drm_etnaviv_gem_submit_reloc *relocs;
> +	struct drm_etnaviv_gem_submit_pmr *pmrs;
>  	struct drm_etnaviv_gem_submit_bo *bos;
>  	struct etnaviv_gem_submit *submit;
>  	struct etnaviv_cmdbuf *cmdbuf;
> @@ -347,11 +396,12 @@ int etnaviv_ioctl_gem_submit(struct drm_device
> *dev, void *data,
>  	 */
>  	bos = drm_malloc_ab(args->nr_bos, sizeof(*bos));
>  	relocs = drm_malloc_ab(args->nr_relocs, sizeof(*relocs));
> +	pmrs = drm_malloc_ab(args->nr_pmrs, sizeof(*pmrs));
>  	stream = drm_malloc_ab(1, args->stream_size);
>  	cmdbuf = etnaviv_cmdbuf_new(gpu->cmdbuf_suballoc,
>  				    ALIGN(args->stream_size, 8) + 8,
> -				    args->nr_bos, 0);
> -	if (!bos || !relocs || !stream || !cmdbuf) {
> +				    args->nr_bos, args->nr_pmrs);
> +	if (!bos || !relocs || !pmrs || !stream || !cmdbuf) {
>  		ret = -ENOMEM;
>  		goto err_submit_cmds;
>  	}
> @@ -373,6 +423,13 @@ int etnaviv_ioctl_gem_submit(struct drm_device
> *dev, void *data,
>  		goto err_submit_cmds;
>  	}
>  
> +	ret = copy_from_user(pmrs, u64_to_user_ptr(args->pmrs),
> +			     args->nr_pmrs * sizeof(*pmrs));
> +	if (ret) {
> +		ret = -EFAULT;
> +		goto err_submit_cmds;
> +	}
> +
>  	ret = copy_from_user(stream, u64_to_user_ptr(args->stream),
>  			     args->stream_size);
>  	if (ret) {
> @@ -441,8 +498,13 @@ int etnaviv_ioctl_gem_submit(struct drm_device
> *dev, void *data,
>  	if (ret)
>  		goto out;
>  
> +	ret = submit_perfmon_request(submit, cmdbuf, pmrs, args-
> >nr_pmrs);
> +	if (ret)
> +		goto out;
> +
>  	memcpy(cmdbuf->vaddr, stream, args->stream_size);
>  	cmdbuf->user_size = ALIGN(args->stream_size, 8);
> +	cmdbuf->nr_pmrs = args->nr_pmrs;

Please move this below the copy_from_user of the pmrs.

>  
>  	ret = etnaviv_gpu_submit(gpu, submit, cmdbuf);
>  	if (ret == 0)
> @@ -494,6 +556,8 @@ int etnaviv_ioctl_gem_submit(struct drm_device
> *dev, void *data,
>  		drm_free_large(bos);
>  	if (relocs)
>  		drm_free_large(relocs);
> +	if (pmrs)
> +		drm_free_large(pmrs);
>  
>  	return ret;
>  }
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel