From: Christian König christian.koenig@amd.com

Improve error handling in case userspace sends us an invalid command buffer.

Signed-off-by: Christian König christian.koenig@amd.com --- drivers/gpu/drm/radeon/radeon_uvd.c | 43 ++++++++++++++++++++++++++++------- 1 file changed, 35 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c index 4fec195..f1c1575 100644 --- a/drivers/gpu/drm/radeon/radeon_uvd.c +++ b/drivers/gpu/drm/radeon/radeon_uvd.c @@ -357,8 +357,10 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo, }

r = radeon_bo_kmap(bo, &ptr); - if (r) + if (r) { + DRM_ERROR("Failed mapping the UVD message (%d)!\n", r); return r; + }

msg = ptr + offset;

@@ -384,8 +386,14 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo, radeon_bo_kunmap(bo); return 0; } else { - /* it's a create msg, no special handling needed */ radeon_bo_kunmap(bo); + + if (msg_type != 0) { + DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type); + return -EINVAL; + } + + /* it's a create msg, no special handling needed */ }

/* create or decode, validate the handle */ @@ -408,7 +416,7 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,

static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p, int data0, int data1, - unsigned buf_sizes[]) + unsigned buf_sizes[], bool *has_msg_cmd) { struct radeon_cs_chunk *relocs_chunk; struct radeon_cs_reloc *reloc; @@ -437,7 +445,7 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,

if (cmd < 0x4) { if ((end - start) < buf_sizes[cmd]) { - DRM_ERROR("buffer to small (%d / %d)!\n", + DRM_ERROR("buffer (%d) to small (%d / %d)!\n", cmd, (unsigned)(end - start), buf_sizes[cmd]); return -EINVAL; } @@ -462,9 +470,17 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p, }

if (cmd == 0) { + if (*has_msg_cmd) { + DRM_ERROR("More than one message in a UVD-IB!\n"); + return -EINVAL; + } + *has_msg_cmd = true; r = radeon_uvd_cs_msg(p, reloc->robj, offset, buf_sizes); if (r) return r; + } else if (!*has_msg_cmd) { + DRM_ERROR("Message needed before other commands are send!\n"); + return -EINVAL; }

return 0; @@ -473,7 +489,8 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p, static int radeon_uvd_cs_reg(struct radeon_cs_parser *p, struct radeon_cs_packet *pkt, int *data0, int *data1, - unsigned buf_sizes[]) + unsigned buf_sizes[], + bool *has_msg_cmd) { int i, r;

@@ -487,7 +504,8 @@ static int radeon_uvd_cs_reg(struct radeon_cs_parser *p, *data1 = p->idx; break; case UVD_GPCOM_VCPU_CMD: - r = radeon_uvd_cs_reloc(p, *data0, *data1, buf_sizes); + r = radeon_uvd_cs_reloc(p, *data0, *data1, + buf_sizes, has_msg_cmd); if (r) return r; break; @@ -508,6 +526,9 @@ int radeon_uvd_cs_parse(struct radeon_cs_parser *p) struct radeon_cs_packet pkt; int r, data0 = 0, data1 = 0;

+ /* does the IB has a msg command */ + bool has_msg_cmd = false; + /* minimum buffer sizes */ unsigned buf_sizes[] = { [0x00000000] = 2048, @@ -534,8 +555,8 @@ int radeon_uvd_cs_parse(struct radeon_cs_parser *p) return r; switch (pkt.type) { case RADEON_PACKET_TYPE0: - r = radeon_uvd_cs_reg(p, &pkt, &data0, - &data1, buf_sizes); + r = radeon_uvd_cs_reg(p, &pkt, &data0, &data1, + buf_sizes, &has_msg_cmd); if (r) return r; break; @@ -547,6 +568,12 @@ int radeon_uvd_cs_parse(struct radeon_cs_parser *p) return -EINVAL; } } while (p->idx < p->chunks[p->chunk_ib_idx].length_dw); + + if (!has_msg_cmd) { + DRM_ERROR("UVD-IBs need a msg command!\n"); + return -EINVAL; + } + return 0; }

On Mon, Aug 5, 2013 at 8:10 AM, Christian König deathsimple@vodafone.de wrote:

From: Christian König christian.koenig@amd.com

Otherwise just reinitialize from scratch on resume, and so make it more likely to succeed.

Signed-off-by: Christian König christian.koenig@amd.com Cc: stable@vger.kernel.org

Pulled the series into my -fixes branch.

Alex

---

drivers/gpu/drm/radeon/cik.c | 2 +- drivers/gpu/drm/radeon/radeon.h | 2 +- drivers/gpu/drm/radeon/radeon_fence.c | 2 +- drivers/gpu/drm/radeon/radeon_uvd.c | 46 +++++++++++++++++++++++---------- drivers/gpu/drm/radeon/rv770.c | 2 +- 5 files changed, 37 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c index 524db70..ecb883d 100644 --- a/drivers/gpu/drm/radeon/cik.c +++ b/drivers/gpu/drm/radeon/cik.c @@ -6979,7 +6979,7 @@ int cik_uvd_resume(struct radeon_device *rdev)

    /* programm the VCPU memory controller bits 0-27 */
    addr = rdev->uvd.gpu_addr >> 3;

•   size = RADEON_GPU_PAGE_ALIGN(rdev->uvd.fw_size + 4) >> 3;
  

•   size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 4) >> 3;
    WREG32(UVD_VCPU_CACHE_OFFSET0, addr);
    WREG32(UVD_VCPU_CACHE_SIZE0, size);
  
  

diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h index 2f08219..76dbe8e 100644 --- a/drivers/gpu/drm/radeon/radeon.h +++ b/drivers/gpu/drm/radeon/radeon.h @@ -1468,7 +1468,6 @@ struct radeon_uvd { void *cpu_addr; uint64_t gpu_addr; void *saved_bo;

•   unsigned                fw_size;
    atomic_t                handles[RADEON_MAX_UVD_HANDLES];
    struct drm_file         *filp[RADEON_MAX_UVD_HANDLES];
    struct delayed_work     idle_work;
  

@@ -2066,6 +2065,7 @@ struct radeon_device { const struct firmware *mec_fw; /* CIK MEC firmware */ const struct firmware *sdma_fw; /* CIK SDMA firmware */ const struct firmware *smc_fw; /* SMC firmware */

•   const struct firmware *uvd_fw;  /* UVD firmware */
    struct r600_blit r600_blit;
    struct r600_vram_scratch vram_scratch;
    int msi_enabled; /* msi enabled */
  

diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c index 7ddb0ef..ddb8f8e 100644 --- a/drivers/gpu/drm/radeon/radeon_fence.c +++ b/drivers/gpu/drm/radeon/radeon_fence.c @@ -782,7 +782,7 @@ int radeon_fence_driver_start_ring(struct radeon_device *rdev, int ring)

            } else {
                    /* put fence directly behind firmware */

•                   index = ALIGN(rdev->uvd.fw_size, 8);
  

•                   index = ALIGN(rdev->uvd_fw->size, 8);
                    rdev->fence_drv[ring].cpu_addr = rdev->uvd.cpu_addr + index;
                    rdev->fence_drv[ring].gpu_addr = rdev->uvd.gpu_addr + index;
            }
  

diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c index 414fd14..ca0d735 100644 --- a/drivers/gpu/drm/radeon/radeon_uvd.c +++ b/drivers/gpu/drm/radeon/radeon_uvd.c @@ -56,7 +56,6 @@ static void radeon_uvd_idle_work_handler(struct work_struct *work);

int radeon_uvd_init(struct radeon_device *rdev) {

•   const struct firmware *fw;
    unsigned long bo_size;
    const char *fw_name;
    int i, r;
  

@@ -105,14 +104,14 @@ int radeon_uvd_init(struct radeon_device *rdev) return -EINVAL; }

•   r = request_firmware(&fw, fw_name, rdev->dev);
  

•   r = request_firmware(&rdev->uvd_fw, fw_name, rdev->dev);
    if (r) {
            dev_err(rdev->dev, "radeon_uvd: Can't load firmware \"%s\"\n",
                    fw_name);
            return r;
    }
  
  

•   bo_size = RADEON_GPU_PAGE_ALIGN(fw->size + 8) +
  

•   bo_size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 8) +
              RADEON_UVD_STACK_SIZE + RADEON_UVD_HEAP_SIZE;
    r = radeon_bo_create(rdev, bo_size, PAGE_SIZE, true,
                         RADEON_GEM_DOMAIN_VRAM, NULL, &rdev->uvd.vcpu_bo);
  

@@ -145,12 +144,6 @@ int radeon_uvd_init(struct radeon_device *rdev)

    radeon_bo_unreserve(rdev->uvd.vcpu_bo);

•   rdev->uvd.fw_size = fw->size;
  

•   memset(rdev->uvd.cpu_addr, 0, bo_size);
  

•   memcpy(rdev->uvd.cpu_addr, fw->data, fw->size);
  

•   release_firmware(fw);
  

•   for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
            atomic_set(&rdev->uvd.handles[i], 0);
            rdev->uvd.filp[i] = NULL;
  

@@ -174,33 +167,60 @@ void radeon_uvd_fini(struct radeon_device *rdev) }

    radeon_bo_unref(&rdev->uvd.vcpu_bo);

•   release_firmware(rdev->uvd_fw);
  

}

int radeon_uvd_suspend(struct radeon_device *rdev) { unsigned size;

•   void *ptr;
  

•   int i;
  
    if (rdev->uvd.vcpu_bo == NULL)
            return 0;
  
  

•   for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i)
  

•           if (atomic_read(&rdev->uvd.handles[i]))
  

•                   break;
  

•   if (i == RADEON_MAX_UVD_HANDLES)
  

•           return 0;
  

•   size = radeon_bo_size(rdev->uvd.vcpu_bo);
  

•   size -= rdev->uvd_fw->size;
  

•   ptr = rdev->uvd.cpu_addr;
  

•   ptr += rdev->uvd_fw->size;
  

•   rdev->uvd.saved_bo = kmalloc(size, GFP_KERNEL);
  

•   memcpy(rdev->uvd.saved_bo, rdev->uvd.cpu_addr, size);
  

•   memcpy(rdev->uvd.saved_bo, ptr, size);
  
    return 0;
  

}

int radeon_uvd_resume(struct radeon_device *rdev) {

•   unsigned size;
  

•   void *ptr;
  

•   if (rdev->uvd.vcpu_bo == NULL)
            return -EINVAL;
  
  

•   memcpy(rdev->uvd.cpu_addr, rdev->uvd_fw->data, rdev->uvd_fw->size);
  

•   size = radeon_bo_size(rdev->uvd.vcpu_bo);
  

•   size -= rdev->uvd_fw->size;
  

•   ptr = rdev->uvd.cpu_addr;
  

•   ptr += rdev->uvd_fw->size;
  

•   if (rdev->uvd.saved_bo != NULL) {
  

•           unsigned size = radeon_bo_size(rdev->uvd.vcpu_bo);
  

•           memcpy(rdev->uvd.cpu_addr, rdev->uvd.saved_bo, size);
  

•           memcpy(ptr, rdev->uvd.saved_bo, size);
            kfree(rdev->uvd.saved_bo);
            rdev->uvd.saved_bo = NULL;
  

•   }
  

•   } else
  

•           memset(ptr, 0, size);
  
    return 0;
  

} diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c index f101013..0804d60 100644 --- a/drivers/gpu/drm/radeon/rv770.c +++ b/drivers/gpu/drm/radeon/rv770.c @@ -813,7 +813,7 @@ int rv770_uvd_resume(struct radeon_device *rdev)

    /* programm the VCPU memory controller bits 0-27 */
    addr = rdev->uvd.gpu_addr >> 3;

•   size = RADEON_GPU_PAGE_ALIGN(rdev->uvd.fw_size + 4) >> 3;
  

•   size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 4) >> 3;
    WREG32(UVD_VCPU_CACHE_OFFSET0, addr);
    WREG32(UVD_VCPU_CACHE_SIZE0, size);
  
  

-- 1.7.9.5