Plumb buffer map permissions through gbm.
Map read/write permissions were being ignored by minigbm. This can
cause segfaults or failed mappings if the device FD permissions are not
rw.
Also adds bounds checking in tegra.c for tile/untile transfers.
BUG=chromium:737328
TEST=cyan, nyan graphicsSanity with read only on device
Change-Id: I8fccaed4e908cda3ff7d7cf451d0ad75d65039e6
Reviewed-on: https://chromium-review.googlesource.com/556980
Commit-Ready: Joe Kniss <djmk@google.com>
Tested-by: Joe Kniss <djmk@google.com>
Reviewed-by: Gurchetan Singh <gurchetansingh@chromium.org>
diff --git a/amdgpu.c b/amdgpu.c
index b94b44f..ff1336d 100644
--- a/amdgpu.c
+++ b/amdgpu.c
@@ -400,7 +400,7 @@
return ret;
}
-static void *amdgpu_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+static void *amdgpu_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
{
int ret;
union drm_amdgpu_gem_mmap gem_map;
@@ -415,8 +415,7 @@
}
data->length = bo->total_size;
- return mmap(0, bo->total_size, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
- gem_map.out.addr_ptr);
+ return mmap(0, bo->total_size, prot, MAP_SHARED, bo->drv->fd, gem_map.out.addr_ptr);
}
static uint32_t amdgpu_resolve_format(uint32_t format, uint64_t usage)
diff --git a/cros_gralloc/cros_gralloc_buffer.cc b/cros_gralloc/cros_gralloc_buffer.cc
index 1ef7278..3609f58 100644
--- a/cros_gralloc/cros_gralloc_buffer.cc
+++ b/cros_gralloc/cros_gralloc_buffer.cc
@@ -61,7 +61,7 @@
vaddr = lock_data_[0]->addr;
} else {
vaddr = drv_bo_map(bo_, 0, 0, drv_bo_get_width(bo_), drv_bo_get_height(bo_),
- 0, &lock_data_[0], 0);
+ BO_TRANSFER_READ_WRITE, &lock_data_[0], 0);
}
if (vaddr == MAP_FAILED) {
diff --git a/drv.c b/drv.c
index ce6e63f..87b633a 100644
--- a/drv.c
+++ b/drv.c
@@ -348,11 +348,13 @@
uint8_t *addr;
size_t offset;
struct map_info *data;
+ int prot;
assert(width > 0);
assert(height > 0);
assert(x + width <= drv_bo_get_width(bo));
assert(y + height <= drv_bo_get_height(bo));
+ assert(BO_TRANSFER_READ_WRITE & flags);
pthread_mutex_lock(&bo->drv->driver_lock);
@@ -363,7 +365,8 @@
}
data = calloc(1, sizeof(*data));
- addr = bo->drv->backend->bo_map(bo, data, plane);
+ prot = BO_TRANSFER_WRITE & flags ? PROT_WRITE | PROT_READ : PROT_READ;
+ addr = bo->drv->backend->bo_map(bo, data, plane, prot);
if (addr == MAP_FAILED) {
*map_data = NULL;
free(data);
diff --git a/drv.h b/drv.h
index d96b30d..a42b23e 100644
--- a/drv.h
+++ b/drv.h
@@ -39,6 +39,12 @@
#define BO_USE_RENDERSCRIPT (1ull << 16)
#define BO_USE_TEXTURE (1ull << 17)
+/* Read-Write permissions for drv_bo_map() flags */
+#define BO_TRANSFER_NONE 0
+#define BO_TRANSFER_READ (1 << 0)
+#define BO_TRANSFER_WRITE (1 << 1)
+#define BO_TRANSFER_READ_WRITE (BO_TRANSFER_READ | BO_TRANSFER_WRITE)
+
/* This is our extension to <drm_fourcc.h>. We need to make sure we don't step
* on the namespace of already defined formats, which can be done by using invalid
* fourcc codes.
diff --git a/drv_priv.h b/drv_priv.h
index 06c5979..3ecdc58 100644
--- a/drv_priv.h
+++ b/drv_priv.h
@@ -73,7 +73,7 @@
uint32_t format, const uint64_t *modifiers, uint32_t count);
int (*bo_destroy)(struct bo *bo);
int (*bo_import)(struct bo *bo, struct drv_import_fd_data *data);
- void *(*bo_map)(struct bo *bo, struct map_info *data, size_t plane);
+ void *(*bo_map)(struct bo *bo, struct map_info *data, size_t plane, int prot);
int (*bo_unmap)(struct bo *bo, struct map_info *data);
uint32_t (*resolve_format)(uint32_t format, uint64_t usage);
struct combinations combos;
diff --git a/gbm.c b/gbm.c
index ab576cf..37fb1d9 100644
--- a/gbm.c
+++ b/gbm.c
@@ -233,7 +233,10 @@
return NULL;
*stride = gbm_bo_get_plane_stride(bo, plane);
- return drv_bo_map(bo->bo, x, y, width, height, 0, (struct map_info **)map_data, plane);
+ uint32_t drv_flags = flags & GBM_BO_TRANSFER_READ ? BO_TRANSFER_READ : BO_TRANSFER_NONE;
+ drv_flags |= flags & GBM_BO_TRANSFER_WRITE ? BO_TRANSFER_WRITE : BO_TRANSFER_NONE;
+ return drv_bo_map(bo->bo, x, y, width, height, drv_flags, (struct map_info **)map_data,
+ plane);
}
PUBLIC void gbm_bo_unmap(struct gbm_bo *bo, void *map_data)
diff --git a/helpers.c b/helpers.c
index 806c152..c6e3527 100644
--- a/helpers.c
+++ b/helpers.c
@@ -291,7 +291,7 @@
return 0;
}
-void *drv_dumb_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+void *drv_dumb_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
{
int ret;
size_t i;
@@ -310,8 +310,7 @@
if (bo->handles[i].u32 == bo->handles[plane].u32)
data->length += bo->sizes[i];
- return mmap(0, data->length, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
- map_dumb.offset);
+ return mmap(0, data->length, prot, MAP_SHARED, bo->drv->fd, map_dumb.offset);
}
uintptr_t drv_get_reference_count(struct driver *drv, struct bo *bo, size_t plane)
diff --git a/helpers.h b/helpers.h
index b42a3c2..dc1a7c0 100644
--- a/helpers.h
+++ b/helpers.h
@@ -16,7 +16,7 @@
int drv_dumb_bo_destroy(struct bo *bo);
int drv_gem_bo_destroy(struct bo *bo);
int drv_prime_bo_import(struct bo *bo, struct drv_import_fd_data *data);
-void *drv_dumb_bo_map(struct bo *bo, struct map_info *data, size_t plane);
+void *drv_dumb_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot);
uintptr_t drv_get_reference_count(struct driver *drv, struct bo *bo, size_t plane);
void drv_increment_reference_count(struct driver *drv, struct bo *bo, size_t plane);
void drv_decrement_reference_count(struct driver *drv, struct bo *bo, size_t plane);
diff --git a/i915.c b/i915.c
index b2520a8..1e9f72b 100644
--- a/i915.c
+++ b/i915.c
@@ -372,7 +372,7 @@
return 0;
}
-static void *i915_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+static void *i915_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
{
int ret;
void *addr;
@@ -410,9 +410,7 @@
return MAP_FAILED;
}
- addr = mmap(0, bo->total_size, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
- gem_map.offset);
-
+ addr = mmap(0, bo->total_size, prot, MAP_SHARED, bo->drv->fd, gem_map.offset);
set_domain.read_domains = I915_GEM_DOMAIN_GTT;
set_domain.write_domain = I915_GEM_DOMAIN_GTT;
}
diff --git a/mediatek.c b/mediatek.c
index af2e441..3d2702f 100644
--- a/mediatek.c
+++ b/mediatek.c
@@ -73,7 +73,7 @@
return 0;
}
-static void *mediatek_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+static void *mediatek_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
{
int ret;
struct drm_mtk_gem_map_off gem_map;
@@ -89,8 +89,7 @@
data->length = bo->total_size;
- return mmap(0, bo->total_size, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
- gem_map.offset);
+ return mmap(0, bo->total_size, prot, MAP_SHARED, bo->drv->fd, gem_map.offset);
}
static uint32_t mediatek_resolve_format(uint32_t format, uint64_t usage)
diff --git a/rockchip.c b/rockchip.c
index 5a907f0..66f1ea0 100644
--- a/rockchip.c
+++ b/rockchip.c
@@ -225,7 +225,7 @@
ARRAY_SIZE(modifiers));
}
-static void *rockchip_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+static void *rockchip_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
{
int ret;
struct drm_rockchip_gem_map_off gem_map;
@@ -246,8 +246,7 @@
data->length = bo->total_size;
- return mmap(0, bo->total_size, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
- gem_map.offset);
+ return mmap(0, bo->total_size, prot, MAP_SHARED, bo->drv->fd, gem_map.offset);
}
static uint32_t rockchip_resolve_format(uint32_t format, uint64_t usage)
diff --git a/tegra.c b/tegra.c
index 09ca8b2..7ddeb96 100644
--- a/tegra.c
+++ b/tegra.c
@@ -44,6 +44,7 @@
struct tegra_private_map_data {
void *tiled;
void *untiled;
+ int prot;
};
static const uint32_t render_target_formats[] = { DRM_FORMAT_ARGB8888, DRM_FORMAT_XRGB8888 };
@@ -102,7 +103,7 @@
static void transfer_tile(struct bo *bo, uint8_t *tiled, uint8_t *untiled, enum tegra_map_type type,
uint32_t bytes_per_pixel, uint32_t gob_top, uint32_t gob_left,
- uint32_t gob_size_pixels)
+ uint32_t gob_size_pixels, uint8_t *tiled_last)
{
uint8_t *tmp;
uint32_t x, y, k;
@@ -115,7 +116,15 @@
x = gob_left + (((k >> 3) & 8) | ((k >> 1) & 4) | (k & 3));
y = gob_top + ((k >> 7 << 3) | ((k >> 3) & 6) | ((k >> 2) & 1));
- tmp = untiled + (y * bo->strides[0]) + (x * bytes_per_pixel);
+ if (tiled >= tiled_last)
+ return;
+
+ if (x >= bo->width || y >= bo->height) {
+ tiled += bytes_per_pixel;
+ continue;
+ }
+
+ tmp = untiled + y * bo->strides[0] + x * bytes_per_pixel;
if (type == TEGRA_READ_TILED_BUFFER)
memcpy(tmp, tiled, bytes_per_pixel);
@@ -133,7 +142,7 @@
uint32_t gob_width, gob_height, gob_size_bytes, gob_size_pixels, gob_count_x, gob_count_y,
gob_top, gob_left;
uint32_t i, j, offset;
- uint8_t *tmp;
+ uint8_t *tmp, *tiled_last;
uint32_t bytes_per_pixel = drv_stride_from_format(bo->format, 1, 0);
/*
@@ -152,6 +161,8 @@
gob_count_x = DIV_ROUND_UP(bo->strides[0], NV_BLOCKLINEAR_GOB_WIDTH);
gob_count_y = DIV_ROUND_UP(bo->height, gob_height);
+ tiled_last = tiled + bo->total_size;
+
offset = 0;
for (j = 0; j < gob_count_y; j++) {
gob_top = j * gob_height;
@@ -160,7 +171,7 @@
gob_left = i * gob_width;
transfer_tile(bo, tmp, untiled, type, bytes_per_pixel, gob_top, gob_left,
- gob_size_pixels);
+ gob_size_pixels, tiled_last);
offset += gob_size_bytes;
}
@@ -254,7 +265,7 @@
return 0;
}
-static void *tegra_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+static void *tegra_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
{
int ret;
struct drm_tegra_gem_mmap gem_map;
@@ -269,14 +280,13 @@
return MAP_FAILED;
}
- void *addr = mmap(0, bo->total_size, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
- gem_map.offset);
-
+ void *addr = mmap(0, bo->total_size, prot, MAP_SHARED, bo->drv->fd, gem_map.offset);
data->length = bo->total_size;
if ((bo->tiling & 0xFF) == NV_MEM_KIND_C32_2CRA && addr != MAP_FAILED) {
priv = calloc(1, sizeof(*priv));
priv->untiled = calloc(1, bo->total_size);
priv->tiled = addr;
+ priv->prot = prot;
data->priv = priv;
transfer_tiled_memory(bo, priv->tiled, priv->untiled, TEGRA_READ_TILED_BUFFER);
addr = priv->untiled;
@@ -289,7 +299,9 @@
{
if (data->priv) {
struct tegra_private_map_data *priv = data->priv;
- transfer_tiled_memory(bo, priv->tiled, priv->untiled, TEGRA_WRITE_TILED_BUFFER);
+ if (priv->prot & PROT_WRITE)
+ transfer_tiled_memory(bo, priv->tiled, priv->untiled,
+ TEGRA_WRITE_TILED_BUFFER);
data->addr = priv->tiled;
free(priv->untiled);
free(priv);
diff --git a/vc4.c b/vc4.c
index 99896b9..c797bd9 100644
--- a/vc4.c
+++ b/vc4.c
@@ -62,7 +62,7 @@
return 0;
}
-static void *vc4_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+static void *vc4_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
{
int ret;
struct drm_vc4_mmap_bo bo_map;
@@ -77,9 +77,7 @@
}
data->length = bo->total_size;
-
- return mmap(0, bo->total_size, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
- bo_map.offset);
+ return mmap(0, bo->total_size, prot, MAP_SHARED, bo->drv->fd, bo_map.offset);
}
struct backend backend_vc4 = {