From patchwork Sun May 14 20:47:31 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Osipenko X-Patchwork-Id: 9725953 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 00C2D60381 for ; Mon, 15 May 2017 00:50:20 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E7A3428926 for ; Mon, 15 May 2017 00:50:19 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DC2DC28936; Mon, 15 May 2017 00:50:19 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 646A828926 for ; Mon, 15 May 2017 00:50:19 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id E94566E192; Mon, 15 May 2017 00:48:54 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-wr0-x242.google.com (mail-wr0-x242.google.com [IPv6:2a00:1450:400c:c0c::242]) by gabe.freedesktop.org (Postfix) with ESMTPS id A1E256E032 for ; Sun, 14 May 2017 20:48:52 +0000 (UTC) Received: by mail-wr0-x242.google.com with SMTP id g12so12703198wrg.2 for ; Sun, 14 May 2017 13:48:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=Wul4lAMD1nG/O2IQVME3t4/1zHVQ7wvwjBwxdS318YQ=; b=CBT7Q7IxbGl5dMhXtTTYXOSEG1p/D4iC4fCXEa06Mqt4zb/9OTRKI2yMZgeTDU0IS0 zIzOUnuvTpcfRtsPtx+Y8jXlE0evQMOi8qUmOYsYimVOQ/qnuYXD9Ov8FxBBrSKJzbf1 9onSD11Q/C4rcqgD6KeyhnvzhkhNCF9TkvBwQu1IjcsWmDT2kg0z2J1Gm8TQlyhjcnjv dC1tKJvntD0YOz7abFKsQsnvUpWsGOzEW9OsqN99nuJOQ4KcOWQ/KZvFms+GA5QNtkll 4OW0qXKYxSbYPkgVD+BxfEu7udn/MGNxVNLFvIXd+DkSZtiBm1zs+H++J5tXgh+1FCsI YMLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=Wul4lAMD1nG/O2IQVME3t4/1zHVQ7wvwjBwxdS318YQ=; b=AwU7CQho/AUeWZ1vO6jMseP/zcBgXw2D1clDpKOg00415MY2w7eOVb79JOluonaC4C /KtWZZX2gYjWvEN2R9nI5u8Dohhe50Dv2U2nb61YAoR5OXtjksPcwYuhtGtF/1gg/f5j /nKuHmpBoQEKyhFexvW33Taet03JfqYVMHgG4VPbpNBx2MUInxAd4/0AkMO1XOSeulZP M1GYMrldX57vCV324ZS+xFld13eL/go2kGAjQhGEFGc1JO7hYYuT55J+LafJPUxtxQ/i YxeqnuGyiLOJjdpk36a+AcGi61f2XquOebfzixLDaqVJEZK0r9MGkC51EK0X0ysC0iKG h9aA== X-Gm-Message-State: AODbwcAtOjwbTakCE3o+be6jzKEkv8q7jER/G6+S9phTFM9asCoVb7Bt H8k0QgJ8QZ25Ow== X-Received: by 10.46.82.154 with SMTP id n26mr1212398lje.61.1494794931263; Sun, 14 May 2017 13:48:51 -0700 (PDT) Received: from localhost.localdomain (ppp109-252-91-175.pppoe.spdop.ru. [109.252.91.175]) by smtp.gmail.com with ESMTPSA id 75sm1839959lja.53.2017.05.14.13.48.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 14 May 2017 13:48:50 -0700 (PDT) From: Dmitry Osipenko To: Thierry Reding , Mikko Perttunen Subject: [PATCH] gpu: host1x: Do not leak BO's phys address to userspace Date: Sun, 14 May 2017 23:47:31 +0300 Message-Id: <20170514204734.22130-1-digetx@gmail.com> X-Mailer: git-send-email 2.13.0 X-Mailman-Approved-At: Mon, 15 May 2017 00:48:34 +0000 Cc: linux-tegra@vger.kernel.org, DRI Development X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP Do gathers coping before patching them, so the original gathers are left untouched. That's not as bad as leaking a kernel addresses, but still doesn't feel right. Signed-off-by: Dmitry Osipenko --- drivers/gpu/host1x/job.c | 46 ++++++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 16 deletions(-) diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c index d9933828fe87..8f0d43b8f9a6 100644 --- a/drivers/gpu/host1x/job.c +++ b/drivers/gpu/host1x/job.c @@ -137,8 +137,9 @@ static void host1x_syncpt_patch_offset(struct host1x_syncpt *sp, * avoid a wrap condition in the HW). */ static int do_waitchks(struct host1x_job *job, struct host1x *host, - struct host1x_bo *patch) + struct host1x_job_gather *g) { + struct host1x_bo *patch = g->bo; int i; /* compare syncpt vs wait threshold */ @@ -165,7 +166,8 @@ static int do_waitchks(struct host1x_job *job, struct host1x *host, wait->syncpt_id, sp->name, wait->thresh, host1x_syncpt_read_min(sp)); - host1x_syncpt_patch_offset(sp, patch, wait->offset); + host1x_syncpt_patch_offset(sp, patch, + g->offset + wait->offset); } wait->bo = NULL; @@ -269,11 +271,12 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job) return err; } -static int do_relocs(struct host1x_job *job, struct host1x_bo *cmdbuf) +static int do_relocs(struct host1x_job *job, struct host1x_job_gather *g) { int i = 0; u32 last_page = ~0; void *cmdbuf_page_addr = NULL; + struct host1x_bo *cmdbuf = g->bo; /* pin & patch the relocs for one gather */ for (i = 0; i < job->num_relocs; i++) { @@ -286,7 +289,8 @@ static int do_relocs(struct host1x_job *job, struct host1x_bo *cmdbuf) if (cmdbuf != reloc->cmdbuf.bo) continue; - if (last_page != reloc->cmdbuf.offset >> PAGE_SHIFT) { + if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && + last_page != reloc->cmdbuf.offset >> PAGE_SHIFT) { if (cmdbuf_page_addr) host1x_bo_kunmap(cmdbuf, last_page, cmdbuf_page_addr); @@ -301,11 +305,20 @@ static int do_relocs(struct host1x_job *job, struct host1x_bo *cmdbuf) } } + if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) { + cmdbuf_page_addr = job->gather_copy_mapped; + cmdbuf_page_addr += g->offset; + } + target = cmdbuf_page_addr + (reloc->cmdbuf.offset & ~PAGE_MASK); + + if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) + target += (reloc->cmdbuf.offset & PAGE_MASK) >> 2; + *target = reloc_addr; } - if (cmdbuf_page_addr) + if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && cmdbuf_page_addr) host1x_bo_kunmap(cmdbuf, last_page, cmdbuf_page_addr); return 0; @@ -573,6 +586,14 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev) if (err) goto out; + if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && !err) { + err = copy_gathers(job, dev); + if (err) { + host1x_job_unpin(job); + return err; + } + } + /* patch gathers */ for (i = 0; i < job->num_gathers; i++) { struct host1x_job_gather *g = &job->gathers[i]; @@ -581,7 +602,8 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev) if (g->handled) continue; - g->base = job->gather_addr_phys[i]; + if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) + g->base = job->gather_addr_phys[i]; for (j = i + 1; j < job->num_gathers; j++) { if (job->gathers[j].bo == g->bo) { @@ -590,23 +612,15 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev) } } - err = do_relocs(job, g->bo); + err = do_relocs(job, g); if (err) break; - err = do_waitchks(job, host, g->bo); + err = do_waitchks(job, host, g); if (err) break; } - if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && !err) { - err = copy_gathers(job, dev); - if (err) { - host1x_job_unpin(job); - return err; - } - } - out: wmb();