bpf: Prevent memory disambiguation attack
[linux/fpc-iii.git] / drivers / gpu / drm / i915 / i915_gem_dmabuf.c
blob864439a214c83c32d663e49bf05c50cd96f3ffb3
1 /*
2 * Copyright 2012 Red Hat Inc
4 * Permission is hereby granted, free of charge, to any person obtaining a
5 * copy of this software and associated documentation files (the "Software"),
6 * to deal in the Software without restriction, including without limitation
7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8 * and/or sell copies of the Software, and to permit persons to whom the
9 * Software is furnished to do so, subject to the following conditions:
11 * The above copyright notice and this permission notice (including the next
12 * paragraph) shall be included in all copies or substantial portions of the
13 * Software.
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
21 * DEALINGS IN THE SOFTWARE.
23 * Authors:
24 * Dave Airlie <airlied@redhat.com>
27 #include <linux/dma-buf.h>
28 #include <linux/reservation.h>
30 #include <drm/drmP.h>
32 #include "i915_drv.h"
34 static struct drm_i915_gem_object *dma_buf_to_obj(struct dma_buf *buf)
36 return to_intel_bo(buf->priv);
39 static struct sg_table *i915_gem_map_dma_buf(struct dma_buf_attachment *attachment,
40 enum dma_data_direction dir)
42 struct drm_i915_gem_object *obj = dma_buf_to_obj(attachment->dmabuf);
43 struct sg_table *st;
44 struct scatterlist *src, *dst;
45 int ret, i;
47 ret = i915_gem_object_pin_pages(obj);
48 if (ret)
49 goto err;
51 /* Copy sg so that we make an independent mapping */
52 st = kmalloc(sizeof(struct sg_table), GFP_KERNEL);
53 if (st == NULL) {
54 ret = -ENOMEM;
55 goto err_unpin_pages;
58 ret = sg_alloc_table(st, obj->mm.pages->nents, GFP_KERNEL);
59 if (ret)
60 goto err_free;
62 src = obj->mm.pages->sgl;
63 dst = st->sgl;
64 for (i = 0; i < obj->mm.pages->nents; i++) {
65 sg_set_page(dst, sg_page(src), src->length, 0);
66 dst = sg_next(dst);
67 src = sg_next(src);
70 if (!dma_map_sg(attachment->dev, st->sgl, st->nents, dir)) {
71 ret = -ENOMEM;
72 goto err_free_sg;
75 return st;
77 err_free_sg:
78 sg_free_table(st);
79 err_free:
80 kfree(st);
81 err_unpin_pages:
82 i915_gem_object_unpin_pages(obj);
83 err:
84 return ERR_PTR(ret);
87 static void i915_gem_unmap_dma_buf(struct dma_buf_attachment *attachment,
88 struct sg_table *sg,
89 enum dma_data_direction dir)
91 struct drm_i915_gem_object *obj = dma_buf_to_obj(attachment->dmabuf);
93 dma_unmap_sg(attachment->dev, sg->sgl, sg->nents, dir);
94 sg_free_table(sg);
95 kfree(sg);
97 i915_gem_object_unpin_pages(obj);
100 static void *i915_gem_dmabuf_vmap(struct dma_buf *dma_buf)
102 struct drm_i915_gem_object *obj = dma_buf_to_obj(dma_buf);
104 return i915_gem_object_pin_map(obj, I915_MAP_WB);
107 static void i915_gem_dmabuf_vunmap(struct dma_buf *dma_buf, void *vaddr)
109 struct drm_i915_gem_object *obj = dma_buf_to_obj(dma_buf);
111 i915_gem_object_unpin_map(obj);
114 static void *i915_gem_dmabuf_kmap_atomic(struct dma_buf *dma_buf, unsigned long page_num)
116 return NULL;
119 static void i915_gem_dmabuf_kunmap_atomic(struct dma_buf *dma_buf, unsigned long page_num, void *addr)
123 static void *i915_gem_dmabuf_kmap(struct dma_buf *dma_buf, unsigned long page_num)
125 struct drm_i915_gem_object *obj = dma_buf_to_obj(dma_buf);
126 struct page *page;
128 if (page_num >= obj->base.size >> PAGE_SHIFT)
129 return NULL;
131 if (!i915_gem_object_has_struct_page(obj))
132 return NULL;
134 if (i915_gem_object_pin_pages(obj))
135 return NULL;
137 /* Synchronisation is left to the caller (via .begin_cpu_access()) */
138 page = i915_gem_object_get_page(obj, page_num);
139 if (IS_ERR(page))
140 goto err_unpin;
142 return kmap(page);
144 err_unpin:
145 i915_gem_object_unpin_pages(obj);
146 return NULL;
149 static void i915_gem_dmabuf_kunmap(struct dma_buf *dma_buf, unsigned long page_num, void *addr)
151 struct drm_i915_gem_object *obj = dma_buf_to_obj(dma_buf);
153 kunmap(virt_to_page(addr));
154 i915_gem_object_unpin_pages(obj);
157 static int i915_gem_dmabuf_mmap(struct dma_buf *dma_buf, struct vm_area_struct *vma)
159 struct drm_i915_gem_object *obj = dma_buf_to_obj(dma_buf);
160 int ret;
162 if (obj->base.size < vma->vm_end - vma->vm_start)
163 return -EINVAL;
165 if (!obj->base.filp)
166 return -ENODEV;
168 ret = call_mmap(obj->base.filp, vma);
169 if (ret)
170 return ret;
172 fput(vma->vm_file);
173 vma->vm_file = get_file(obj->base.filp);
175 return 0;
178 static int i915_gem_begin_cpu_access(struct dma_buf *dma_buf, enum dma_data_direction direction)
180 struct drm_i915_gem_object *obj = dma_buf_to_obj(dma_buf);
181 struct drm_device *dev = obj->base.dev;
182 bool write = (direction == DMA_BIDIRECTIONAL || direction == DMA_TO_DEVICE);
183 int err;
185 err = i915_gem_object_pin_pages(obj);
186 if (err)
187 return err;
189 err = i915_mutex_lock_interruptible(dev);
190 if (err)
191 goto out;
193 err = i915_gem_object_set_to_cpu_domain(obj, write);
194 mutex_unlock(&dev->struct_mutex);
196 out:
197 i915_gem_object_unpin_pages(obj);
198 return err;
201 static int i915_gem_end_cpu_access(struct dma_buf *dma_buf, enum dma_data_direction direction)
203 struct drm_i915_gem_object *obj = dma_buf_to_obj(dma_buf);
204 struct drm_device *dev = obj->base.dev;
205 int err;
207 err = i915_gem_object_pin_pages(obj);
208 if (err)
209 return err;
211 err = i915_mutex_lock_interruptible(dev);
212 if (err)
213 goto out;
215 err = i915_gem_object_set_to_gtt_domain(obj, false);
216 mutex_unlock(&dev->struct_mutex);
218 out:
219 i915_gem_object_unpin_pages(obj);
220 return err;
223 static const struct dma_buf_ops i915_dmabuf_ops = {
224 .map_dma_buf = i915_gem_map_dma_buf,
225 .unmap_dma_buf = i915_gem_unmap_dma_buf,
226 .release = drm_gem_dmabuf_release,
227 .map = i915_gem_dmabuf_kmap,
228 .map_atomic = i915_gem_dmabuf_kmap_atomic,
229 .unmap = i915_gem_dmabuf_kunmap,
230 .unmap_atomic = i915_gem_dmabuf_kunmap_atomic,
231 .mmap = i915_gem_dmabuf_mmap,
232 .vmap = i915_gem_dmabuf_vmap,
233 .vunmap = i915_gem_dmabuf_vunmap,
234 .begin_cpu_access = i915_gem_begin_cpu_access,
235 .end_cpu_access = i915_gem_end_cpu_access,
238 struct dma_buf *i915_gem_prime_export(struct drm_device *dev,
239 struct drm_gem_object *gem_obj, int flags)
241 struct drm_i915_gem_object *obj = to_intel_bo(gem_obj);
242 DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
244 exp_info.ops = &i915_dmabuf_ops;
245 exp_info.size = gem_obj->size;
246 exp_info.flags = flags;
247 exp_info.priv = gem_obj;
248 exp_info.resv = obj->resv;
250 if (obj->ops->dmabuf_export) {
251 int ret = obj->ops->dmabuf_export(obj);
252 if (ret)
253 return ERR_PTR(ret);
256 return drm_gem_dmabuf_export(dev, &exp_info);
259 static int i915_gem_object_get_pages_dmabuf(struct drm_i915_gem_object *obj)
261 struct sg_table *pages;
262 unsigned int sg_page_sizes;
264 pages = dma_buf_map_attachment(obj->base.import_attach,
265 DMA_BIDIRECTIONAL);
266 if (IS_ERR(pages))
267 return PTR_ERR(pages);
269 sg_page_sizes = i915_sg_page_sizes(pages->sgl);
271 __i915_gem_object_set_pages(obj, pages, sg_page_sizes);
273 return 0;
276 static void i915_gem_object_put_pages_dmabuf(struct drm_i915_gem_object *obj,
277 struct sg_table *pages)
279 dma_buf_unmap_attachment(obj->base.import_attach, pages,
280 DMA_BIDIRECTIONAL);
283 static const struct drm_i915_gem_object_ops i915_gem_object_dmabuf_ops = {
284 .get_pages = i915_gem_object_get_pages_dmabuf,
285 .put_pages = i915_gem_object_put_pages_dmabuf,
288 struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev,
289 struct dma_buf *dma_buf)
291 struct dma_buf_attachment *attach;
292 struct drm_i915_gem_object *obj;
293 int ret;
295 /* is this one of own objects? */
296 if (dma_buf->ops == &i915_dmabuf_ops) {
297 obj = dma_buf_to_obj(dma_buf);
298 /* is it from our device? */
299 if (obj->base.dev == dev) {
301 * Importing dmabuf exported from out own gem increases
302 * refcount on gem itself instead of f_count of dmabuf.
304 return &i915_gem_object_get(obj)->base;
308 /* need to attach */
309 attach = dma_buf_attach(dma_buf, dev->dev);
310 if (IS_ERR(attach))
311 return ERR_CAST(attach);
313 get_dma_buf(dma_buf);
315 obj = i915_gem_object_alloc(to_i915(dev));
316 if (obj == NULL) {
317 ret = -ENOMEM;
318 goto fail_detach;
321 drm_gem_private_object_init(dev, &obj->base, dma_buf->size);
322 i915_gem_object_init(obj, &i915_gem_object_dmabuf_ops);
323 obj->base.import_attach = attach;
324 obj->resv = dma_buf->resv;
326 /* We use GTT as shorthand for a coherent domain, one that is
327 * neither in the GPU cache nor in the CPU cache, where all
328 * writes are immediately visible in memory. (That's not strictly
329 * true, but it's close! There are internal buffers such as the
330 * write-combined buffer or a delay through the chipset for GTT
331 * writes that do require us to treat GTT as a separate cache domain.)
333 obj->base.read_domains = I915_GEM_DOMAIN_GTT;
334 obj->base.write_domain = 0;
336 return &obj->base;
338 fail_detach:
339 dma_buf_detach(dma_buf, attach);
340 dma_buf_put(dma_buf);
342 return ERR_PTR(ret);
345 #if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)
346 #include "selftests/mock_dmabuf.c"
347 #include "selftests/i915_gem_dmabuf.c"
348 #endif