Re: [PATCH 06/21] drm/etnaviv: copy pmrs from userspace

2017-06-26 15:18 GMT+02:00 Lucas Stach l.stach@pengutronix.de:

Am Freitag, den 09.06.2017, 12:21 +0200 schrieb Christian Gmeiner:

...

All performance monitor requests will be validated during this phase.

Signed-off-by: Christian Gmeiner christian.gmeiner@gmail.com

drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 68 +++++++++++++++++++++++++++- 1 file changed, 66 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c index fdfe31d..ed05b64 100644 --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c @@ -21,6 +21,7 @@ #include "etnaviv_drv.h" #include "etnaviv_gpu.h" #include "etnaviv_gem.h" +#include "etnaviv_perfmon.h"

/*

• Cmdstream submission:

@@ -283,6 +284,53 @@ static int submit_reloc(struct etnaviv_gem_submit *submit, void *stream, return 0; }

+static int submit_perfmon_request(struct etnaviv_gem_submit *submit,

Please name this after what is does: submit_perfmon_validate()

OK

...

•         struct etnaviv_cmdbuf *cmdbuf,
  

•         const struct drm_etnaviv_gem_submit_pmr *pmrs,
  

•         u32 nr_pms)
  

+{

• u32 i;
  

• for (i = 0; i < nr_pms; i++) {
  

•         const struct drm_etnaviv_gem_submit_pmr *r = pmrs +
  

i;

•         struct etnaviv_gem_submit_bo *bo;
  

•         int ret;
  

•         ret = submit_bo(submit, r->read_idx, &bo);
  

•         if (ret)
  

•                 return ret;
  

•         if (r->read_offset == 0) {
  

•                 DRM_ERROR("perfmon request: offset is 0");
  

•                 return -EINVAL;
  

•         }
  

Why is a 0 offset invalid? Can't the readback be placed at the beginning of the BO?

At offset 0 the sequence number gets stored. This sequence number is used to sync kernel space and user space. See sync_point_perfmon_sample_post() in [PATCH 10/21] drm/etnaviv: use 'sync points' for performance monitor requests Will add a comment about this fact.

...

•         if (r->read_offset >= bo->obj->base.size -
  

sizeof(u32)) {

•                 DRM_ERROR("perfmon request: offset %u
  

outside object", i);

•                 return -EINVAL;
  

•         }
  

•         if (!r->flags) {
  

•                 DRM_ERROR("perfmon request: flags are 0");
  

•                 return -EINVAL;
  

•         }
  

This needs to validate that the flags are valid, not just that there are flags -> reject any non-allocated flag bits.

Good point - will add flags validation.

...

•         if (etnaviv_pm_req_validate(r)) {
  

•                 DRM_ERROR("perfmon request: domain or signal
  

not valid");

•                 return -EINVAL;
  

•         }
  

•         cmdbuf->pmrs[i].flags = r->flags;
  

•         cmdbuf->pmrs[i].domain = r->domain;
  

•         cmdbuf->pmrs[i].signal = r->signal;
  

•         cmdbuf->pmrs[i].sequence = r->sequence;
  

•         cmdbuf->pmrs[i].offset = r->read_offset;
  

•         cmdbuf->pmrs[i].bo_vma = etnaviv_gem_vmap(&bo->obj-
  

...

base);

• }
  

• return 0;
  

+}

static void submit_cleanup(struct etnaviv_gem_submit *submit) { unsigned i; @@ -306,6 +354,7 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data, struct etnaviv_drm_private *priv = dev->dev_private; struct drm_etnaviv_gem_submit *args = data; struct drm_etnaviv_gem_submit_reloc *relocs;

• struct drm_etnaviv_gem_submit_pmr *pmrs;
  struct drm_etnaviv_gem_submit_bo *bos;
  struct etnaviv_gem_submit *submit;
  struct etnaviv_cmdbuf *cmdbuf;
  

@@ -347,11 +396,12 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data, */ bos = drm_malloc_ab(args->nr_bos, sizeof(*bos)); relocs = drm_malloc_ab(args->nr_relocs, sizeof(*relocs));

• pmrs = drm_malloc_ab(args->nr_pmrs, sizeof(*pmrs));
  stream = drm_malloc_ab(1, args->stream_size);
  cmdbuf = etnaviv_cmdbuf_new(gpu->cmdbuf_suballoc,
                              ALIGN(args->stream_size, 8) + 8,
  

•                             args->nr_bos, 0);
  

• if (!bos || !relocs || !stream || !cmdbuf) {
  

•                             args->nr_bos, args->nr_pmrs);
  

• if (!bos || !relocs || !pmrs || !stream || !cmdbuf) {
          ret = -ENOMEM;
          goto err_submit_cmds;
  }
  

@@ -373,6 +423,13 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data, goto err_submit_cmds; }

• ret = copy_from_user(pmrs, u64_to_user_ptr(args->pmrs),
  

•                      args->nr_pmrs * sizeof(*pmrs));
  

• if (ret) {
  

•         ret = -EFAULT;
  

•         goto err_submit_cmds;
  

• }
  

• ret = copy_from_user(stream, u64_to_user_ptr(args->stream),
                       args->stream_size);
  if (ret) {
  

@@ -441,8 +498,13 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data, if (ret) goto out;

• ret = submit_perfmon_request(submit, cmdbuf, pmrs, args-
  

...

nr_pmrs);

• if (ret)
  

•         goto out;
  

• memcpy(cmdbuf->vaddr, stream, args->stream_size);
  cmdbuf->user_size = ALIGN(args->stream_size, 8);
  

• cmdbuf->nr_pmrs = args->nr_pmrs;
  

Please move this below the copy_from_user of the pmrs.

OK

...

  ret = etnaviv_gpu_submit(gpu, submit, cmdbuf);
  if (ret == 0)

@@ -494,6 +556,8 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data, drm_free_large(bos); if (relocs) drm_free_large(relocs);

• if (pmrs)
  

•         drm_free_large(pmrs);
  
  return ret;
  

}

greets -- Christian Gmeiner, MSc

https://www.youtube.com/user/AloryOFFICIAL https://soundcloud.com/christian-gmeiner