Plumb buffer map permissions through gbm.

Map read/write permissions were being ignored by minigbm.  This can
cause segfaults or failed mappings if the device FD permissions are not
rw.

Also adds bounds checking in tegra.c for tile/untile transfers.

BUG=chromium:737328
TEST=cyan, nyan graphicsSanity with read only on device

Change-Id: I8fccaed4e908cda3ff7d7cf451d0ad75d65039e6
Reviewed-on: https://chromium-review.googlesource.com/556980
Commit-Ready: Joe Kniss <djmk@google.com>
Tested-by: Joe Kniss <djmk@google.com>
Reviewed-by: Gurchetan Singh <gurchetansingh@chromium.org>

diff --git a/amdgpu.c b/amdgpu.c
index b94b44f..ff1336d 100644 (file)
--- a/amdgpu.c
+++ b/amdgpu.c
@@ -400,7 +400,7 @@ static int amdgpu_bo_create(struct bo *bo, uint32_t width, uint32_t height, uint
        return ret;
 }
 
-static void *amdgpu_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+static void *amdgpu_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
 {
        int ret;
        union drm_amdgpu_gem_mmap gem_map;
@@ -415,8 +415,7 @@ static void *amdgpu_bo_map(struct bo *bo, struct map_info *data, size_t plane)
        }
        data->length = bo->total_size;
 
-       return mmap(0, bo->total_size, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
-                   gem_map.out.addr_ptr);
+       return mmap(0, bo->total_size, prot, MAP_SHARED, bo->drv->fd, gem_map.out.addr_ptr);
 }
 
 static uint32_t amdgpu_resolve_format(uint32_t format, uint64_t usage)

diff --git a/cros_gralloc/cros_gralloc_buffer.cc b/cros_gralloc/cros_gralloc_buffer.cc
index 1ef7278..3609f58 100644 (file)
--- a/cros_gralloc/cros_gralloc_buffer.cc
+++ b/cros_gralloc/cros_gralloc_buffer.cc
@@ -61,7 +61,7 @@ int32_t cros_gralloc_buffer::lock(uint64_t flags, uint8_t *addr[DRV_MAX_PLANES])
                        vaddr = lock_data_[0]->addr;
                } else {
                        vaddr = drv_bo_map(bo_, 0, 0, drv_bo_get_width(bo_), drv_bo_get_height(bo_),
-                                          0, &lock_data_[0], 0);
+                                          BO_TRANSFER_READ_WRITE, &lock_data_[0], 0);
                }
 
                if (vaddr == MAP_FAILED) {

diff --git a/drv.c b/drv.c
index ce6e63f..87b633a 100644 (file)
--- a/drv.c
+++ b/drv.c
@@ -348,11 +348,13 @@ void *drv_bo_map(struct bo *bo, uint32_t x, uint32_t y, uint32_t width, uint32_t
        uint8_t *addr;
        size_t offset;
        struct map_info *data;
+       int prot;
 
        assert(width > 0);
        assert(height > 0);
        assert(x + width <= drv_bo_get_width(bo));
        assert(y + height <= drv_bo_get_height(bo));
+       assert(BO_TRANSFER_READ_WRITE & flags);
 
        pthread_mutex_lock(&bo->drv->driver_lock);
 
@@ -363,7 +365,8 @@ void *drv_bo_map(struct bo *bo, uint32_t x, uint32_t y, uint32_t width, uint32_t
        }
 
        data = calloc(1, sizeof(*data));
-       addr = bo->drv->backend->bo_map(bo, data, plane);
+       prot = BO_TRANSFER_WRITE & flags ? PROT_WRITE | PROT_READ : PROT_READ;
+       addr = bo->drv->backend->bo_map(bo, data, plane, prot);
        if (addr == MAP_FAILED) {
                *map_data = NULL;
                free(data);

diff --git a/drv.h b/drv.h
index d96b30d..a42b23e 100644 (file)
--- a/drv.h
+++ b/drv.h
@@ -39,6 +39,12 @@ extern "C" {
 #define BO_USE_RENDERSCRIPT            (1ull << 16)
 #define BO_USE_TEXTURE                 (1ull << 17)
 
+/* Read-Write permissions for drv_bo_map() flags */
+#define BO_TRANSFER_NONE 0
+#define BO_TRANSFER_READ (1 << 0)
+#define BO_TRANSFER_WRITE (1 << 1)
+#define BO_TRANSFER_READ_WRITE (BO_TRANSFER_READ | BO_TRANSFER_WRITE)
+
 /* This is our extension to <drm_fourcc.h>.  We need to make sure we don't step
  * on the namespace of already defined formats, which can be done by using invalid
  * fourcc codes.

diff --git a/drv_priv.h b/drv_priv.h
index 06c5979..3ecdc58 100644 (file)
--- a/drv_priv.h
+++ b/drv_priv.h
@@ -73,7 +73,7 @@ struct backend {
                                        uint32_t format, const uint64_t *modifiers, uint32_t count);
        int (*bo_destroy)(struct bo *bo);
        int (*bo_import)(struct bo *bo, struct drv_import_fd_data *data);
-       void *(*bo_map)(struct bo *bo, struct map_info *data, size_t plane);
+       void *(*bo_map)(struct bo *bo, struct map_info *data, size_t plane, int prot);
        int (*bo_unmap)(struct bo *bo, struct map_info *data);
        uint32_t (*resolve_format)(uint32_t format, uint64_t usage);
        struct combinations combos;

diff --git a/gbm.c b/gbm.c
index ab576cf..37fb1d9 100644 (file)
--- a/gbm.c
+++ b/gbm.c
@@ -233,7 +233,10 @@ PUBLIC void *gbm_bo_map(struct gbm_bo *bo, uint32_t x, uint32_t y, uint32_t widt
                return NULL;
 
        *stride = gbm_bo_get_plane_stride(bo, plane);
-       return drv_bo_map(bo->bo, x, y, width, height, 0, (struct map_info **)map_data, plane);
+       uint32_t drv_flags = flags & GBM_BO_TRANSFER_READ ? BO_TRANSFER_READ : BO_TRANSFER_NONE;
+       drv_flags |= flags & GBM_BO_TRANSFER_WRITE ? BO_TRANSFER_WRITE : BO_TRANSFER_NONE;
+       return drv_bo_map(bo->bo, x, y, width, height, drv_flags, (struct map_info **)map_data,
+                         plane);
 }
 
 PUBLIC void gbm_bo_unmap(struct gbm_bo *bo, void *map_data)

diff --git a/helpers.c b/helpers.c
index 806c152..c6e3527 100644 (file)
--- a/helpers.c
+++ b/helpers.c
@@ -291,7 +291,7 @@ int drv_prime_bo_import(struct bo *bo, struct drv_import_fd_data *data)
        return 0;
 }
 
-void *drv_dumb_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+void *drv_dumb_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
 {
        int ret;
        size_t i;
@@ -310,8 +310,7 @@ void *drv_dumb_bo_map(struct bo *bo, struct map_info *data, size_t plane)
                if (bo->handles[i].u32 == bo->handles[plane].u32)
                        data->length += bo->sizes[i];
 
-       return mmap(0, data->length, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
-                   map_dumb.offset);
+       return mmap(0, data->length, prot, MAP_SHARED, bo->drv->fd, map_dumb.offset);
 }
 
 uintptr_t drv_get_reference_count(struct driver *drv, struct bo *bo, size_t plane)

diff --git a/helpers.h b/helpers.h
index b42a3c2..dc1a7c0 100644 (file)
--- a/helpers.h
+++ b/helpers.h
@@ -16,7 +16,7 @@ int drv_dumb_bo_create(struct bo *bo, uint32_t width, uint32_t height, uint32_t
 int drv_dumb_bo_destroy(struct bo *bo);
 int drv_gem_bo_destroy(struct bo *bo);
 int drv_prime_bo_import(struct bo *bo, struct drv_import_fd_data *data);
-void *drv_dumb_bo_map(struct bo *bo, struct map_info *data, size_t plane);
+void *drv_dumb_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot);
 uintptr_t drv_get_reference_count(struct driver *drv, struct bo *bo, size_t plane);
 void drv_increment_reference_count(struct driver *drv, struct bo *bo, size_t plane);
 void drv_decrement_reference_count(struct driver *drv, struct bo *bo, size_t plane);

diff --git a/i915.c b/i915.c
index b2520a8..1e9f72b 100644 (file)
--- a/i915.c
+++ b/i915.c
@@ -372,7 +372,7 @@ static int i915_bo_import(struct bo *bo, struct drv_import_fd_data *data)
        return 0;
 }
 
-static void *i915_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+static void *i915_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
 {
        int ret;
        void *addr;
@@ -410,9 +410,7 @@ static void *i915_bo_map(struct bo *bo, struct map_info *data, size_t plane)
                        return MAP_FAILED;
                }
 
-               addr = mmap(0, bo->total_size, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
-                           gem_map.offset);
-
+               addr = mmap(0, bo->total_size, prot, MAP_SHARED, bo->drv->fd, gem_map.offset);
                set_domain.read_domains = I915_GEM_DOMAIN_GTT;
                set_domain.write_domain = I915_GEM_DOMAIN_GTT;
        }

diff --git a/mediatek.c b/mediatek.c
index af2e441..3d2702f 100644 (file)
--- a/mediatek.c
+++ b/mediatek.c
@@ -73,7 +73,7 @@ static int mediatek_bo_create(struct bo *bo, uint32_t width, uint32_t height, ui
        return 0;
 }
 
-static void *mediatek_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+static void *mediatek_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
 {
        int ret;
        struct drm_mtk_gem_map_off gem_map;
@@ -89,8 +89,7 @@ static void *mediatek_bo_map(struct bo *bo, struct map_info *data, size_t plane)
 
        data->length = bo->total_size;
 
-       return mmap(0, bo->total_size, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
-                   gem_map.offset);
+       return mmap(0, bo->total_size, prot, MAP_SHARED, bo->drv->fd, gem_map.offset);
 }
 
 static uint32_t mediatek_resolve_format(uint32_t format, uint64_t usage)

diff --git a/rockchip.c b/rockchip.c
index 5a907f0..66f1ea0 100644 (file)
--- a/rockchip.c
+++ b/rockchip.c
@@ -225,7 +225,7 @@ static int rockchip_bo_create(struct bo *bo, uint32_t width, uint32_t height, ui
                                                 ARRAY_SIZE(modifiers));
 }
 
-static void *rockchip_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+static void *rockchip_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
 {
        int ret;
        struct drm_rockchip_gem_map_off gem_map;
@@ -246,8 +246,7 @@ static void *rockchip_bo_map(struct bo *bo, struct map_info *data, size_t plane)
 
        data->length = bo->total_size;
 
-       return mmap(0, bo->total_size, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
-                   gem_map.offset);
+       return mmap(0, bo->total_size, prot, MAP_SHARED, bo->drv->fd, gem_map.offset);
 }
 
 static uint32_t rockchip_resolve_format(uint32_t format, uint64_t usage)

diff --git a/tegra.c b/tegra.c
index 09ca8b2..7ddeb96 100644 (file)
--- a/tegra.c
+++ b/tegra.c
@@ -44,6 +44,7 @@ enum tegra_map_type {
 struct tegra_private_map_data {
        void *tiled;
        void *untiled;
+       int prot;
 };
 
 static const uint32_t render_target_formats[] = { DRM_FORMAT_ARGB8888, DRM_FORMAT_XRGB8888 };
@@ -102,7 +103,7 @@ static void compute_layout_linear(int width, int height, int format, uint32_t *s
 
 static void transfer_tile(struct bo *bo, uint8_t *tiled, uint8_t *untiled, enum tegra_map_type type,
                          uint32_t bytes_per_pixel, uint32_t gob_top, uint32_t gob_left,
-                         uint32_t gob_size_pixels)
+                         uint32_t gob_size_pixels, uint8_t *tiled_last)
 {
        uint8_t *tmp;
        uint32_t x, y, k;
@@ -115,7 +116,15 @@ static void transfer_tile(struct bo *bo, uint8_t *tiled, uint8_t *untiled, enum
                x = gob_left + (((k >> 3) & 8) | ((k >> 1) & 4) | (k & 3));
                y = gob_top + ((k >> 7 << 3) | ((k >> 3) & 6) | ((k >> 2) & 1));
 
-               tmp = untiled + (y * bo->strides[0]) + (x * bytes_per_pixel);
+               if (tiled >= tiled_last)
+                       return;
+
+               if (x >= bo->width || y >= bo->height) {
+                       tiled += bytes_per_pixel;
+                       continue;
+               }
+
+               tmp = untiled + y * bo->strides[0] + x * bytes_per_pixel;
 
                if (type == TEGRA_READ_TILED_BUFFER)
                        memcpy(tmp, tiled, bytes_per_pixel);
@@ -133,7 +142,7 @@ static void transfer_tiled_memory(struct bo *bo, uint8_t *tiled, uint8_t *untile
        uint32_t gob_width, gob_height, gob_size_bytes, gob_size_pixels, gob_count_x, gob_count_y,
            gob_top, gob_left;
        uint32_t i, j, offset;
-       uint8_t *tmp;
+       uint8_t *tmp, *tiled_last;
        uint32_t bytes_per_pixel = drv_stride_from_format(bo->format, 1, 0);
 
        /*
@@ -152,6 +161,8 @@ static void transfer_tiled_memory(struct bo *bo, uint8_t *tiled, uint8_t *untile
        gob_count_x = DIV_ROUND_UP(bo->strides[0], NV_BLOCKLINEAR_GOB_WIDTH);
        gob_count_y = DIV_ROUND_UP(bo->height, gob_height);
 
+       tiled_last = tiled + bo->total_size;
+
        offset = 0;
        for (j = 0; j < gob_count_y; j++) {
                gob_top = j * gob_height;
@@ -160,7 +171,7 @@ static void transfer_tiled_memory(struct bo *bo, uint8_t *tiled, uint8_t *untile
                        gob_left = i * gob_width;
 
                        transfer_tile(bo, tmp, untiled, type, bytes_per_pixel, gob_top, gob_left,
-                                     gob_size_pixels);
+                                     gob_size_pixels, tiled_last);
 
                        offset += gob_size_bytes;
                }
@@ -254,7 +265,7 @@ static int tegra_bo_create(struct bo *bo, uint32_t width, uint32_t height, uint3
        return 0;
 }
 
-static void *tegra_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+static void *tegra_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
 {
        int ret;
        struct drm_tegra_gem_mmap gem_map;
@@ -269,14 +280,13 @@ static void *tegra_bo_map(struct bo *bo, struct map_info *data, size_t plane)
                return MAP_FAILED;
        }
 
-       void *addr = mmap(0, bo->total_size, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
-                         gem_map.offset);
-
+       void *addr = mmap(0, bo->total_size, prot, MAP_SHARED, bo->drv->fd, gem_map.offset);
        data->length = bo->total_size;
        if ((bo->tiling & 0xFF) == NV_MEM_KIND_C32_2CRA && addr != MAP_FAILED) {
                priv = calloc(1, sizeof(*priv));
                priv->untiled = calloc(1, bo->total_size);
                priv->tiled = addr;
+               priv->prot = prot;
                data->priv = priv;
                transfer_tiled_memory(bo, priv->tiled, priv->untiled, TEGRA_READ_TILED_BUFFER);
                addr = priv->untiled;
@@ -289,7 +299,9 @@ static int tegra_bo_unmap(struct bo *bo, struct map_info *data)
 {
        if (data->priv) {
                struct tegra_private_map_data *priv = data->priv;
-               transfer_tiled_memory(bo, priv->tiled, priv->untiled, TEGRA_WRITE_TILED_BUFFER);
+               if (priv->prot & PROT_WRITE)
+                       transfer_tiled_memory(bo, priv->tiled, priv->untiled,
+                                             TEGRA_WRITE_TILED_BUFFER);
                data->addr = priv->tiled;
                free(priv->untiled);
                free(priv);

diff --git a/vc4.c b/vc4.c
index 99896b9..c797bd9 100644 (file)
--- a/vc4.c
+++ b/vc4.c
@@ -62,7 +62,7 @@ static int vc4_bo_create(struct bo *bo, uint32_t width, uint32_t height, uint32_
        return 0;
 }
 
-static void *vc4_bo_map(struct bo *bo, struct map_info *data, size_t plane)
+static void *vc4_bo_map(struct bo *bo, struct map_info *data, size_t plane, int prot)
 {
        int ret;
        struct drm_vc4_mmap_bo bo_map;
@@ -77,9 +77,7 @@ static void *vc4_bo_map(struct bo *bo, struct map_info *data, size_t plane)
        }
 
        data->length = bo->total_size;
-
-       return mmap(0, bo->total_size, PROT_READ | PROT_WRITE, MAP_SHARED, bo->drv->fd,
-                   bo_map.offset);
+       return mmap(0, bo->total_size, prot, MAP_SHARED, bo->drv->fd, bo_map.offset);
 }
 
 struct backend backend_vc4 = {