1 /*
2 * Created: Fri Jan 8 09:01:26 1999 by faith@valinux.com
3 *
4 * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
5 * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
6 * All Rights Reserved.
7 *
8 * Author Rickard E. (Rik) Faith <faith@valinux.com>
9 * Author Gareth Hughes <gareth@valinux.com>
10 *
11 * Permission is hereby granted, free of charge, to any person obtaining a
12 * copy of this software and associated documentation files (the "Software"),
13 * to deal in the Software without restriction, including without limitation
14 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
15 * and/or sell copies of the Software, and to permit persons to whom the
16 * Software is furnished to do so, subject to the following conditions:
17 *
18 * The above copyright notice and this permission notice (including the next
19 * paragraph) shall be included in all copies or substantial portions of the
20 * Software.
21 *
22 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
23 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
24 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
25 * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
26 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
27 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
28 * OTHER DEALINGS IN THE SOFTWARE.
29 */
30
31 #include <sys/filio.h>
32
33 #include <linux/export.h>
34 #include <linux/nospec.h>
35 #include <linux/pci.h>
36 #include <linux/uaccess.h>
37
38 #include <drm/drm_auth.h>
39 #include <drm/drm_crtc.h>
40 #include <drm/drm_drv.h>
41 #include <drm/drm_file.h>
42 #include <drm/drm_ioctl.h>
43 #include <drm/drm_print.h>
44
45 #include "drm_crtc_internal.h"
46 #include "drm_internal.h"
47
48 /**
49 * DOC: getunique and setversion story
50 *
51 * BEWARE THE DRAGONS! MIND THE TRAPDOORS!
52 *
53 * In an attempt to warn anyone else who's trying to figure out what's going
54 * on here, I'll try to summarize the story. First things first, let's clear up
55 * the names, because the kernel internals, libdrm and the ioctls are all named
56 * differently:
57 *
58 * - GET_UNIQUE ioctl, implemented by drm_getunique is wrapped up in libdrm
59 * through the drmGetBusid function.
60 * - The libdrm drmSetBusid function is backed by the SET_UNIQUE ioctl. All
61 * that code is nerved in the kernel with drm_invalid_op().
62 * - The internal set_busid kernel functions and driver callbacks are
63 * exclusively use by the SET_VERSION ioctl, because only drm 1.0 (which is
64 * nerved) allowed userspace to set the busid through the above ioctl.
65 * - Other ioctls and functions involved are named consistently.
66 *
67 * For anyone wondering what's the difference between drm 1.1 and 1.4: Correctly
68 * handling pci domains in the busid on ppc. Doing this correctly was only
69 * implemented in libdrm in 2010, hence can't be nerved yet. No one knows what's
70 * special with drm 1.2 and 1.3.
71 *
72 * Now the actual horror story of how device lookup in drm works. At large,
73 * there's 2 different ways, either by busid, or by device driver name.
74 *
75 * Opening by busid is fairly simple:
76 *
77 * 1. First call SET_VERSION to make sure pci domains are handled properly. As a
78 * side-effect this fills out the unique name in the master structure.
79 * 2. Call GET_UNIQUE to read out the unique name from the master structure,
80 * which matches the busid thanks to step 1. If it doesn't, proceed to try
81 * the next device node.
82 *
83 * Opening by name is slightly different:
84 *
85 * 1. Directly call VERSION to get the version and to match against the driver
86 * name returned by that ioctl. Note that SET_VERSION is not called, which
87 * means the unique name for the master node just opening is _not_ filled
88 * out. This despite that with current drm device nodes are always bound to
89 * one device, and can't be runtime assigned like with drm 1.0.
90 * 2. Match driver name. If it mismatches, proceed to the next device node.
91 * 3. Call GET_UNIQUE, and check whether the unique name has length zero (by
92 * checking that the first byte in the string is 0). If that's not the case
93 * libdrm skips and proceeds to the next device node. Probably this is just
94 * copypasta from drm 1.0 times where a set unique name meant that the driver
95 * was in use already, but that's just conjecture.
96 *
97 * Long story short: To keep the open by name logic working, GET_UNIQUE must
98 * _not_ return a unique string when SET_VERSION hasn't been called yet,
99 * otherwise libdrm breaks. Even when that unique string can't ever change, and
100 * is totally irrelevant for actually opening the device because runtime
101 * assignable device instances were only support in drm 1.0, which is long dead.
102 * But the libdrm code in drmOpenByName somehow survived, hence this can't be
103 * broken.
104 */
105
106 /*
107 * Get the bus id.
108 *
109 * \param inode device inode.
110 * \param file_priv DRM file private.
111 * \param cmd command.
112 * \param arg user argument, pointing to a drm_unique structure.
113 * \return zero on success or a negative number on failure.
114 *
115 * Copies the bus id from drm_device::unique into user space.
116 */
drm_getunique(struct drm_device * dev,void * data,struct drm_file * file_priv)117 int drm_getunique(struct drm_device *dev, void *data,
118 struct drm_file *file_priv)
119 {
120 struct drm_unique *u = data;
121 struct drm_master *master;
122
123 mutex_lock(&dev->master_mutex);
124 master = file_priv->master;
125 if (u->unique_len >= master->unique_len) {
126 if (copy_to_user(u->unique, master->unique, master->unique_len)) {
127 mutex_unlock(&dev->master_mutex);
128 return -EFAULT;
129 }
130 }
131 u->unique_len = master->unique_len;
132 mutex_unlock(&dev->master_mutex);
133
134 return 0;
135 }
136
137 static void
drm_unset_busid(struct drm_device * dev,struct drm_master * master)138 drm_unset_busid(struct drm_device *dev,
139 struct drm_master *master)
140 {
141 kfree(master->unique);
142 master->unique = NULL;
143 master->unique_len = 0;
144 }
145
drm_set_busid(struct drm_device * dev,struct drm_file * file_priv)146 static int drm_set_busid(struct drm_device *dev, struct drm_file *file_priv)
147 {
148 struct drm_master *master = file_priv->master;
149 int ret;
150
151 if (master->unique != NULL)
152 drm_unset_busid(dev, master);
153
154 #ifdef __linux__
155 if (dev->dev && dev_is_pci(dev->dev)) {
156 #else
157 if (1) {
158 #endif
159 ret = drm_pci_set_busid(dev, master);
160 if (ret) {
161 drm_unset_busid(dev, master);
162 return ret;
163 }
164 } else {
165 WARN_ON(!dev->unique);
166 master->unique = kstrdup(dev->unique, GFP_KERNEL);
167 if (master->unique)
168 master->unique_len = strlen(dev->unique);
169 }
170
171 return 0;
172 }
173
174 /*
175 * Get client information.
176 *
177 * \param inode device inode.
178 * \param file_priv DRM file private.
179 * \param cmd command.
180 * \param arg user argument, pointing to a drm_client structure.
181 *
182 * \return zero on success or a negative number on failure.
183 *
184 * Searches for the client with the specified index and copies its information
185 * into userspace
186 */
187 int drm_getclient(struct drm_device *dev, void *data,
188 struct drm_file *file_priv)
189 {
190 struct drm_client *client = data;
191
192 /*
193 * Hollowed-out getclient ioctl to keep some dead old drm tests/tools
194 * not breaking completely. Userspace tools stop enumerating one they
195 * get -EINVAL, hence this is the return value we need to hand back for
196 * no clients tracked.
197 *
198 * Unfortunately some clients (*cough* libva *cough*) use this in a fun
199 * attempt to figure out whether they're authenticated or not. Since
200 * that's the only thing they care about, give it to the directly
201 * instead of walking one giant list.
202 */
203 if (client->idx == 0) {
204 client->auth = file_priv->authenticated;
205 #ifdef __linux__
206 client->pid = task_pid_vnr(current);
207 client->uid = overflowuid;
208 #else
209 client->pid = curproc->p_p->ps_pid;
210 client->uid = 0xfffe;
211 #endif
212 client->magic = 0;
213 client->iocs = 0;
214
215 return 0;
216 } else {
217 return -EINVAL;
218 }
219 }
220
221 /*
222 * Get statistics information.
223 *
224 * \param inode device inode.
225 * \param file_priv DRM file private.
226 * \param cmd command.
227 * \param arg user argument, pointing to a drm_stats structure.
228 *
229 * \return zero on success or a negative number on failure.
230 */
231 static int drm_getstats(struct drm_device *dev, void *data,
232 struct drm_file *file_priv)
233 {
234 struct drm_stats *stats = data;
235
236 /* Clear stats to prevent userspace from eating its stack garbage. */
237 memset(stats, 0, sizeof(*stats));
238
239 return 0;
240 }
241
242 /*
243 * Get device/driver capabilities
244 */
245 static int drm_getcap(struct drm_device *dev, void *data, struct drm_file *file_priv)
246 {
247 struct drm_get_cap *req = data;
248 struct drm_crtc *crtc;
249
250 req->value = 0;
251
252 /* Only some caps make sense with UMS/render-only drivers. */
253 switch (req->capability) {
254 case DRM_CAP_TIMESTAMP_MONOTONIC:
255 req->value = 1;
256 return 0;
257 case DRM_CAP_PRIME:
258 req->value = DRM_PRIME_CAP_IMPORT | DRM_PRIME_CAP_EXPORT;
259 return 0;
260 case DRM_CAP_SYNCOBJ:
261 req->value = drm_core_check_feature(dev, DRIVER_SYNCOBJ);
262 return 0;
263 case DRM_CAP_SYNCOBJ_TIMELINE:
264 req->value = drm_core_check_feature(dev, DRIVER_SYNCOBJ_TIMELINE);
265 return 0;
266 }
267
268 /* Other caps only work with KMS drivers */
269 if (!drm_core_check_feature(dev, DRIVER_MODESET))
270 return -EOPNOTSUPP;
271
272 switch (req->capability) {
273 case DRM_CAP_DUMB_BUFFER:
274 if (dev->driver->dumb_create)
275 req->value = 1;
276 break;
277 case DRM_CAP_VBLANK_HIGH_CRTC:
278 req->value = 1;
279 break;
280 case DRM_CAP_DUMB_PREFERRED_DEPTH:
281 req->value = dev->mode_config.preferred_depth;
282 break;
283 case DRM_CAP_DUMB_PREFER_SHADOW:
284 req->value = dev->mode_config.prefer_shadow;
285 break;
286 case DRM_CAP_ASYNC_PAGE_FLIP:
287 req->value = dev->mode_config.async_page_flip;
288 break;
289 case DRM_CAP_PAGE_FLIP_TARGET:
290 req->value = 1;
291 drm_for_each_crtc(crtc, dev) {
292 if (!crtc->funcs->page_flip_target)
293 req->value = 0;
294 }
295 break;
296 case DRM_CAP_CURSOR_WIDTH:
297 if (dev->mode_config.cursor_width)
298 req->value = dev->mode_config.cursor_width;
299 else
300 req->value = 64;
301 break;
302 case DRM_CAP_CURSOR_HEIGHT:
303 if (dev->mode_config.cursor_height)
304 req->value = dev->mode_config.cursor_height;
305 else
306 req->value = 64;
307 break;
308 case DRM_CAP_ADDFB2_MODIFIERS:
309 req->value = !dev->mode_config.fb_modifiers_not_supported;
310 break;
311 case DRM_CAP_CRTC_IN_VBLANK_EVENT:
312 req->value = 1;
313 break;
314 case DRM_CAP_ATOMIC_ASYNC_PAGE_FLIP:
315 req->value = drm_core_check_feature(dev, DRIVER_ATOMIC) &&
316 dev->mode_config.async_page_flip;
317 break;
318 default:
319 return -EINVAL;
320 }
321 return 0;
322 }
323
324 /*
325 * Set device/driver capabilities
326 */
327 static int
328 drm_setclientcap(struct drm_device *dev, void *data, struct drm_file *file_priv)
329 {
330 struct drm_set_client_cap *req = data;
331
332 /* No render-only settable capabilities for now */
333
334 /* Below caps that only works with KMS drivers */
335 if (!drm_core_check_feature(dev, DRIVER_MODESET))
336 return -EOPNOTSUPP;
337
338 switch (req->capability) {
339 case DRM_CLIENT_CAP_STEREO_3D:
340 if (req->value > 1)
341 return -EINVAL;
342 file_priv->stereo_allowed = req->value;
343 break;
344 case DRM_CLIENT_CAP_UNIVERSAL_PLANES:
345 if (req->value > 1)
346 return -EINVAL;
347 file_priv->universal_planes = req->value;
348 break;
349 case DRM_CLIENT_CAP_ATOMIC:
350 if (!drm_core_check_feature(dev, DRIVER_ATOMIC))
351 return -EOPNOTSUPP;
352 /* The modesetting DDX has a totally broken idea of atomic. */
353 #ifdef __linux__
354 if (current->comm[0] == 'X' && req->value == 1) {
355 #else
356 if (curproc->p_p->ps_comm[0] == 'X' && req->value == 1) {
357 #endif
358 pr_info("broken atomic modeset userspace detected, disabling atomic\n");
359 return -EOPNOTSUPP;
360 }
361 if (req->value > 2)
362 return -EINVAL;
363 file_priv->atomic = req->value;
364 file_priv->universal_planes = req->value;
365 /*
366 * No atomic user-space blows up on aspect ratio mode bits.
367 */
368 file_priv->aspect_ratio_allowed = req->value;
369 break;
370 case DRM_CLIENT_CAP_ASPECT_RATIO:
371 if (req->value > 1)
372 return -EINVAL;
373 file_priv->aspect_ratio_allowed = req->value;
374 break;
375 case DRM_CLIENT_CAP_WRITEBACK_CONNECTORS:
376 if (!file_priv->atomic)
377 return -EINVAL;
378 if (req->value > 1)
379 return -EINVAL;
380 file_priv->writeback_connectors = req->value;
381 break;
382 case DRM_CLIENT_CAP_CURSOR_PLANE_HOTSPOT:
383 if (!drm_core_check_feature(dev, DRIVER_CURSOR_HOTSPOT))
384 return -EOPNOTSUPP;
385 if (!file_priv->atomic)
386 return -EINVAL;
387 if (req->value > 1)
388 return -EINVAL;
389 file_priv->supports_virtualized_cursor_plane = req->value;
390 break;
391 default:
392 return -EINVAL;
393 }
394
395 return 0;
396 }
397
398 /*
399 * Setversion ioctl.
400 *
401 * \param inode device inode.
402 * \param file_priv DRM file private.
403 * \param cmd command.
404 * \param arg user argument, pointing to a drm_lock structure.
405 * \return zero on success or negative number on failure.
406 *
407 * Sets the requested interface version
408 */
409 static int drm_setversion(struct drm_device *dev, void *data, struct drm_file *file_priv)
410 {
411 struct drm_set_version *sv = data;
412 int if_version, retcode = 0;
413
414 mutex_lock(&dev->master_mutex);
415 if (sv->drm_di_major != -1) {
416 if (sv->drm_di_major != DRM_IF_MAJOR ||
417 sv->drm_di_minor < 0 || sv->drm_di_minor > DRM_IF_MINOR) {
418 retcode = -EINVAL;
419 goto done;
420 }
421 if_version = DRM_IF_VERSION(sv->drm_di_major,
422 sv->drm_di_minor);
423 dev->if_version = max(if_version, dev->if_version);
424 if (sv->drm_di_minor >= 1) {
425 /*
426 * Version 1.1 includes tying of DRM to specific device
427 * Version 1.4 has proper PCI domain support
428 */
429 retcode = drm_set_busid(dev, file_priv);
430 if (retcode)
431 goto done;
432 }
433 }
434
435 if (sv->drm_dd_major != -1) {
436 if (sv->drm_dd_major != dev->driver->major ||
437 sv->drm_dd_minor < 0 || sv->drm_dd_minor >
438 dev->driver->minor) {
439 retcode = -EINVAL;
440 goto done;
441 }
442 }
443
444 done:
445 sv->drm_di_major = DRM_IF_MAJOR;
446 sv->drm_di_minor = DRM_IF_MINOR;
447 sv->drm_dd_major = dev->driver->major;
448 sv->drm_dd_minor = dev->driver->minor;
449 mutex_unlock(&dev->master_mutex);
450
451 return retcode;
452 }
453
454 /**
455 * drm_noop - DRM no-op ioctl implementation
456 * @dev: DRM device for the ioctl
457 * @data: data pointer for the ioctl
458 * @file_priv: DRM file for the ioctl call
459 *
460 * This no-op implementation for drm ioctls is useful for deprecated
461 * functionality where we can't return a failure code because existing userspace
462 * checks the result of the ioctl, but doesn't care about the action.
463 *
464 * Always returns successfully with 0.
465 */
466 int drm_noop(struct drm_device *dev, void *data,
467 struct drm_file *file_priv)
468 {
469 drm_dbg_core(dev, "\n");
470 return 0;
471 }
472 EXPORT_SYMBOL(drm_noop);
473
474 /**
475 * drm_invalid_op - DRM invalid ioctl implementation
476 * @dev: DRM device for the ioctl
477 * @data: data pointer for the ioctl
478 * @file_priv: DRM file for the ioctl call
479 *
480 * This no-op implementation for drm ioctls is useful for deprecated
481 * functionality where we really don't want to allow userspace to call the ioctl
482 * any more. This is the case for old ums interfaces for drivers that
483 * transitioned to kms gradually and so kept the old legacy tables around. This
484 * only applies to radeon and i915 kms drivers, other drivers shouldn't need to
485 * use this function.
486 *
487 * Always fails with a return value of -EINVAL.
488 */
489 int drm_invalid_op(struct drm_device *dev, void *data,
490 struct drm_file *file_priv)
491 {
492 return -EINVAL;
493 }
494 EXPORT_SYMBOL(drm_invalid_op);
495
496 /*
497 * Copy and IOCTL return string to user space
498 */
499 static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value)
500 {
501 size_t len;
502
503 /* don't attempt to copy a NULL pointer */
504 if (WARN_ONCE(!value, "BUG: the value to copy was not set!")) {
505 *buf_len = 0;
506 return 0;
507 }
508
509 /* don't overflow userbuf */
510 len = strlen(value);
511 if (len > *buf_len)
512 len = *buf_len;
513
514 /* let userspace know exact length of driver value (which could be
515 * larger than the userspace-supplied buffer) */
516 *buf_len = strlen(value);
517
518 /* finally, try filling in the userbuf */
519 if (len && buf)
520 if (copy_to_user(buf, value, len))
521 return -EFAULT;
522 return 0;
523 }
524
525 /*
526 * Get version information
527 *
528 * \param inode device inode.
529 * \param filp file pointer.
530 * \param cmd command.
531 * \param arg user argument, pointing to a drm_version structure.
532 * \return zero on success or negative number on failure.
533 *
534 * Fills in the version information in \p arg.
535 */
536 int drm_version(struct drm_device *dev, void *data,
537 struct drm_file *file_priv)
538 {
539 struct drm_version *version = data;
540 int err;
541
542 version->version_major = dev->driver->major;
543 version->version_minor = dev->driver->minor;
544 version->version_patchlevel = dev->driver->patchlevel;
545 err = drm_copy_field(version->name, &version->name_len,
546 dev->driver->name);
547
548 /* Driver date is deprecated. Userspace expects a non-empty string. */
549 if (!err)
550 err = drm_copy_field(version->date, &version->date_len, "0");
551 if (!err)
552 err = drm_copy_field(version->desc, &version->desc_len,
553 dev->driver->desc);
554
555 return err;
556 }
557
558 static int drm_ioctl_permit(u32 flags, struct drm_file *file_priv)
559 {
560 /* ROOT_ONLY is only for CAP_SYS_ADMIN */
561 if (unlikely((flags & DRM_ROOT_ONLY) && !capable(CAP_SYS_ADMIN)))
562 return -EACCES;
563
564 /* AUTH is only for authenticated or render client */
565 if (unlikely((flags & DRM_AUTH) && !drm_is_render_client(file_priv) &&
566 !file_priv->authenticated))
567 return -EACCES;
568
569 /* MASTER is only for master or control clients */
570 if (unlikely((flags & DRM_MASTER) &&
571 !drm_is_current_master(file_priv)))
572 return -EACCES;
573
574 /* Render clients must be explicitly allowed */
575 if (unlikely(!(flags & DRM_RENDER_ALLOW) &&
576 drm_is_render_client(file_priv)))
577 return -EACCES;
578
579 return 0;
580 }
581
582 #define DRM_IOCTL_DEF(ioctl, _func, _flags) \
583 [DRM_IOCTL_NR(ioctl)] = { \
584 .cmd = ioctl, \
585 .func = _func, \
586 .flags = _flags, \
587 .name = #ioctl \
588 }
589
590 /* Ioctl table */
591 static const struct drm_ioctl_desc drm_ioctls[] = {
592 DRM_IOCTL_DEF(DRM_IOCTL_VERSION, drm_version, DRM_RENDER_ALLOW),
593 DRM_IOCTL_DEF(DRM_IOCTL_GET_UNIQUE, drm_getunique, 0),
594 DRM_IOCTL_DEF(DRM_IOCTL_GET_MAGIC, drm_getmagic, 0),
595
596 DRM_IOCTL_DEF(DRM_IOCTL_GET_CLIENT, drm_getclient, 0),
597 DRM_IOCTL_DEF(DRM_IOCTL_GET_STATS, drm_getstats, 0),
598 DRM_IOCTL_DEF(DRM_IOCTL_GET_CAP, drm_getcap, DRM_RENDER_ALLOW),
599 DRM_IOCTL_DEF(DRM_IOCTL_SET_CLIENT_CAP, drm_setclientcap, 0),
600 DRM_IOCTL_DEF(DRM_IOCTL_SET_VERSION, drm_setversion, DRM_MASTER),
601
602 DRM_IOCTL_DEF(DRM_IOCTL_SET_UNIQUE, drm_invalid_op, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
603 DRM_IOCTL_DEF(DRM_IOCTL_BLOCK, drm_noop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
604 DRM_IOCTL_DEF(DRM_IOCTL_UNBLOCK, drm_noop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
605 DRM_IOCTL_DEF(DRM_IOCTL_AUTH_MAGIC, drm_authmagic, DRM_MASTER),
606
607 #ifdef __OpenBSD__
608 DRM_IOCTL_DEF(DRM_IOCTL_GET_PCIINFO, drm_getpciinfo, DRM_RENDER_ALLOW),
609 #endif
610
611 #ifdef __linux__
612 DRM_IOCTL_DEF(DRM_IOCTL_SET_MASTER, drm_setmaster_ioctl, 0),
613 DRM_IOCTL_DEF(DRM_IOCTL_DROP_MASTER, drm_dropmaster_ioctl, 0),
614 #else
615 /* On OpenBSD xorg privdrop has already occurred before this point */
616 DRM_IOCTL_DEF(DRM_IOCTL_SET_MASTER, drm_noop, 0),
617 DRM_IOCTL_DEF(DRM_IOCTL_DROP_MASTER, drm_noop, 0),
618 #endif
619
620 DRM_IOCTL_DEF(DRM_IOCTL_ADD_DRAW, drm_noop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
621 DRM_IOCTL_DEF(DRM_IOCTL_RM_DRAW, drm_noop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
622
623 DRM_IOCTL_DEF(DRM_IOCTL_FINISH, drm_noop, DRM_AUTH),
624
625 DRM_IOCTL_DEF(DRM_IOCTL_WAIT_VBLANK, drm_wait_vblank_ioctl, 0),
626
627 DRM_IOCTL_DEF(DRM_IOCTL_UPDATE_DRAW, drm_noop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
628
629 DRM_IOCTL_DEF(DRM_IOCTL_GEM_CLOSE, drm_gem_close_ioctl, DRM_RENDER_ALLOW),
630 DRM_IOCTL_DEF(DRM_IOCTL_GEM_FLINK, drm_gem_flink_ioctl, DRM_AUTH),
631 DRM_IOCTL_DEF(DRM_IOCTL_GEM_OPEN, drm_gem_open_ioctl, DRM_AUTH),
632
633 DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETRESOURCES, drm_mode_getresources, 0),
634
635 DRM_IOCTL_DEF(DRM_IOCTL_PRIME_HANDLE_TO_FD, drm_prime_handle_to_fd_ioctl, DRM_RENDER_ALLOW),
636 DRM_IOCTL_DEF(DRM_IOCTL_PRIME_FD_TO_HANDLE, drm_prime_fd_to_handle_ioctl, DRM_RENDER_ALLOW),
637
638 DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETPLANERESOURCES, drm_mode_getplane_res, 0),
639 DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETCRTC, drm_mode_getcrtc, 0),
640 DRM_IOCTL_DEF(DRM_IOCTL_MODE_SETCRTC, drm_mode_setcrtc, DRM_MASTER),
641 DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETPLANE, drm_mode_getplane, 0),
642 DRM_IOCTL_DEF(DRM_IOCTL_MODE_SETPLANE, drm_mode_setplane, DRM_MASTER),
643 DRM_IOCTL_DEF(DRM_IOCTL_MODE_CURSOR, drm_mode_cursor_ioctl, DRM_MASTER),
644 DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETGAMMA, drm_mode_gamma_get_ioctl, 0),
645 DRM_IOCTL_DEF(DRM_IOCTL_MODE_SETGAMMA, drm_mode_gamma_set_ioctl, DRM_MASTER),
646 DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETENCODER, drm_mode_getencoder, 0),
647 DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETCONNECTOR, drm_mode_getconnector, 0),
648 DRM_IOCTL_DEF(DRM_IOCTL_MODE_ATTACHMODE, drm_noop, DRM_MASTER),
649 DRM_IOCTL_DEF(DRM_IOCTL_MODE_DETACHMODE, drm_noop, DRM_MASTER),
650 DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETPROPERTY, drm_mode_getproperty_ioctl, 0),
651 DRM_IOCTL_DEF(DRM_IOCTL_MODE_SETPROPERTY, drm_connector_property_set_ioctl, DRM_MASTER),
652 DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETPROPBLOB, drm_mode_getblob_ioctl, 0),
653 DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETFB, drm_mode_getfb, 0),
654 DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETFB2, drm_mode_getfb2_ioctl, 0),
655 DRM_IOCTL_DEF(DRM_IOCTL_MODE_ADDFB, drm_mode_addfb_ioctl, 0),
656 DRM_IOCTL_DEF(DRM_IOCTL_MODE_ADDFB2, drm_mode_addfb2_ioctl, 0),
657 DRM_IOCTL_DEF(DRM_IOCTL_MODE_RMFB, drm_mode_rmfb_ioctl, 0),
658 DRM_IOCTL_DEF(DRM_IOCTL_MODE_CLOSEFB, drm_mode_closefb_ioctl, 0),
659 DRM_IOCTL_DEF(DRM_IOCTL_MODE_PAGE_FLIP, drm_mode_page_flip_ioctl, DRM_MASTER),
660 DRM_IOCTL_DEF(DRM_IOCTL_MODE_DIRTYFB, drm_mode_dirtyfb_ioctl, DRM_MASTER),
661 DRM_IOCTL_DEF(DRM_IOCTL_MODE_CREATE_DUMB, drm_mode_create_dumb_ioctl, 0),
662 DRM_IOCTL_DEF(DRM_IOCTL_MODE_MAP_DUMB, drm_mode_mmap_dumb_ioctl, 0),
663 DRM_IOCTL_DEF(DRM_IOCTL_MODE_DESTROY_DUMB, drm_mode_destroy_dumb_ioctl, 0),
664 DRM_IOCTL_DEF(DRM_IOCTL_MODE_OBJ_GETPROPERTIES, drm_mode_obj_get_properties_ioctl, 0),
665 DRM_IOCTL_DEF(DRM_IOCTL_MODE_OBJ_SETPROPERTY, drm_mode_obj_set_property_ioctl, DRM_MASTER),
666 DRM_IOCTL_DEF(DRM_IOCTL_MODE_CURSOR2, drm_mode_cursor2_ioctl, DRM_MASTER),
667 DRM_IOCTL_DEF(DRM_IOCTL_MODE_ATOMIC, drm_mode_atomic_ioctl, DRM_MASTER),
668 DRM_IOCTL_DEF(DRM_IOCTL_MODE_CREATEPROPBLOB, drm_mode_createblob_ioctl, 0),
669 DRM_IOCTL_DEF(DRM_IOCTL_MODE_DESTROYPROPBLOB, drm_mode_destroyblob_ioctl, 0),
670
671 DRM_IOCTL_DEF(DRM_IOCTL_SYNCOBJ_CREATE, drm_syncobj_create_ioctl,
672 DRM_RENDER_ALLOW),
673 DRM_IOCTL_DEF(DRM_IOCTL_SYNCOBJ_DESTROY, drm_syncobj_destroy_ioctl,
674 DRM_RENDER_ALLOW),
675 DRM_IOCTL_DEF(DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD, drm_syncobj_handle_to_fd_ioctl,
676 DRM_RENDER_ALLOW),
677 DRM_IOCTL_DEF(DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE, drm_syncobj_fd_to_handle_ioctl,
678 DRM_RENDER_ALLOW),
679 DRM_IOCTL_DEF(DRM_IOCTL_SYNCOBJ_TRANSFER, drm_syncobj_transfer_ioctl,
680 DRM_RENDER_ALLOW),
681 DRM_IOCTL_DEF(DRM_IOCTL_SYNCOBJ_WAIT, drm_syncobj_wait_ioctl,
682 DRM_RENDER_ALLOW),
683 DRM_IOCTL_DEF(DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT, drm_syncobj_timeline_wait_ioctl,
684 DRM_RENDER_ALLOW),
685 DRM_IOCTL_DEF(DRM_IOCTL_SYNCOBJ_EVENTFD, drm_syncobj_eventfd_ioctl,
686 DRM_RENDER_ALLOW),
687 DRM_IOCTL_DEF(DRM_IOCTL_SYNCOBJ_RESET, drm_syncobj_reset_ioctl,
688 DRM_RENDER_ALLOW),
689 DRM_IOCTL_DEF(DRM_IOCTL_SYNCOBJ_SIGNAL, drm_syncobj_signal_ioctl,
690 DRM_RENDER_ALLOW),
691 DRM_IOCTL_DEF(DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL, drm_syncobj_timeline_signal_ioctl,
692 DRM_RENDER_ALLOW),
693 DRM_IOCTL_DEF(DRM_IOCTL_SYNCOBJ_QUERY, drm_syncobj_query_ioctl,
694 DRM_RENDER_ALLOW),
695 DRM_IOCTL_DEF(DRM_IOCTL_CRTC_GET_SEQUENCE, drm_crtc_get_sequence_ioctl, 0),
696 DRM_IOCTL_DEF(DRM_IOCTL_CRTC_QUEUE_SEQUENCE, drm_crtc_queue_sequence_ioctl, 0),
697 #ifdef __linux__
698 DRM_IOCTL_DEF(DRM_IOCTL_MODE_CREATE_LEASE, drm_mode_create_lease_ioctl, DRM_MASTER),
699 DRM_IOCTL_DEF(DRM_IOCTL_MODE_LIST_LESSEES, drm_mode_list_lessees_ioctl, DRM_MASTER),
700 DRM_IOCTL_DEF(DRM_IOCTL_MODE_GET_LEASE, drm_mode_get_lease_ioctl, DRM_MASTER),
701 DRM_IOCTL_DEF(DRM_IOCTL_MODE_REVOKE_LEASE, drm_mode_revoke_lease_ioctl, DRM_MASTER),
702 #endif
703 };
704
705 #define DRM_CORE_IOCTL_COUNT ARRAY_SIZE(drm_ioctls)
706
707 int
708 pledge_ioctl_drm(struct proc *p, long com, dev_t device)
709 {
710 struct drm_device *dev = drm_get_device_from_kdev(device);
711 unsigned int nr = DRM_IOCTL_NR(com);
712 const struct drm_ioctl_desc *ioctl;
713
714 if (dev == NULL)
715 return EPERM;
716
717 if (nr < DRM_CORE_IOCTL_COUNT &&
718 ((nr < DRM_COMMAND_BASE || nr >= DRM_COMMAND_END)))
719 ioctl = &drm_ioctls[nr];
720 else if (nr >= DRM_COMMAND_BASE && nr < DRM_COMMAND_END &&
721 nr < DRM_COMMAND_BASE + dev->driver->num_ioctls)
722 ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
723 else
724 return EPERM;
725
726 if (ioctl->flags & DRM_RENDER_ALLOW)
727 return 0;
728
729 /*
730 * These are dangerous, but we have to allow them until we
731 * have prime/dma-buf support.
732 */
733 switch (com) {
734 case DRM_IOCTL_GET_MAGIC:
735 case DRM_IOCTL_GEM_OPEN:
736 return 0;
737 }
738
739 /* for amdgpu libdrm */
740 if (com == DRM_IOCTL_GET_CLIENT)
741 return 0;
742
743 return EPERM;
744 }
745
746 /**
747 * DOC: driver specific ioctls
748 *
749 * First things first, driver private IOCTLs should only be needed for drivers
750 * supporting rendering. Kernel modesetting is all standardized, and extended
751 * through properties. There are a few exceptions in some existing drivers,
752 * which define IOCTL for use by the display DRM master, but they all predate
753 * properties.
754 *
755 * Now if you do have a render driver you always have to support it through
756 * driver private properties. There's a few steps needed to wire all the things
757 * up.
758 *
759 * First you need to define the structure for your IOCTL in your driver private
760 * UAPI header in ``include/uapi/drm/my_driver_drm.h``::
761 *
762 * struct my_driver_operation {
763 * u32 some_thing;
764 * u32 another_thing;
765 * };
766 *
767 * Please make sure that you follow all the best practices from
768 * ``Documentation/process/botching-up-ioctls.rst``. Note that drm_ioctl()
769 * automatically zero-extends structures, hence make sure you can add more stuff
770 * at the end, i.e. don't put a variable sized array there.
771 *
772 * Then you need to define your IOCTL number, using one of DRM_IO(), DRM_IOR(),
773 * DRM_IOW() or DRM_IOWR(). It must start with the DRM_IOCTL\_ prefix::
774 *
775 * ##define DRM_IOCTL_MY_DRIVER_OPERATION \
776 * DRM_IOW(DRM_COMMAND_BASE, struct my_driver_operation)
777 *
778 * DRM driver private IOCTL must be in the range from DRM_COMMAND_BASE to
779 * DRM_COMMAND_END. Finally you need an array of &struct drm_ioctl_desc to wire
780 * up the handlers and set the access rights::
781 *
782 * static const struct drm_ioctl_desc my_driver_ioctls[] = {
783 * DRM_IOCTL_DEF_DRV(MY_DRIVER_OPERATION, my_driver_operation,
784 * DRM_AUTH|DRM_RENDER_ALLOW),
785 * };
786 *
787 * And then assign this to the &drm_driver.ioctls field in your driver
788 * structure.
789 *
790 * See the separate chapter on :ref:`file operations<drm_driver_fops>` for how
791 * the driver-specific IOCTLs are wired up.
792 */
793
794 long drm_ioctl_kernel(struct file *file, drm_ioctl_t *func, void *kdata,
795 u32 flags)
796 {
797 STUB();
798 return -ENOSYS;
799 #ifdef notyet
800 struct drm_file *file_priv = file->private_data;
801 struct drm_device *dev = file_priv->minor->dev;
802 int ret;
803
804 /* Update drm_file owner if fd was passed along. */
805 drm_file_update_pid(file_priv);
806
807 if (drm_dev_is_unplugged(dev))
808 return -ENODEV;
809
810 ret = drm_ioctl_permit(flags, file_priv);
811 if (unlikely(ret))
812 return ret;
813
814 return func(dev, kdata, file_priv);
815 }
816 EXPORT_SYMBOL(drm_ioctl_kernel);
817
818 /**
819 * drm_ioctl - ioctl callback implementation for DRM drivers
820 * @filp: file this ioctl is called on
821 * @cmd: ioctl cmd number
822 * @arg: user argument
823 *
824 * Looks up the ioctl function in the DRM core and the driver dispatch table,
825 * stored in &drm_driver.ioctls. It checks for necessary permission by calling
826 * drm_ioctl_permit(), and dispatches to the respective function.
827 *
828 * Returns:
829 * Zero on success, negative error code on failure.
830 */
831 long drm_ioctl(struct file *filp,
832 unsigned int cmd, unsigned long arg)
833 {
834 STUB();
835 return -ENOSYS;
836 #ifdef notyet
837 struct drm_file *file_priv = filp->private_data;
838 struct drm_device *dev;
839 const struct drm_ioctl_desc *ioctl = NULL;
840 drm_ioctl_t *func;
841 unsigned int nr = DRM_IOCTL_NR(cmd);
842 int retcode = -EINVAL;
843 char stack_kdata[128];
844 char *kdata = NULL;
845 unsigned int in_size, out_size, drv_size, ksize;
846 bool is_driver_ioctl;
847
848 dev = file_priv->minor->dev;
849
850 if (drm_dev_is_unplugged(dev))
851 return -ENODEV;
852
853 if (DRM_IOCTL_TYPE(cmd) != DRM_IOCTL_BASE)
854 return -ENOTTY;
855
856 is_driver_ioctl = nr >= DRM_COMMAND_BASE && nr < DRM_COMMAND_END;
857
858 if (is_driver_ioctl) {
859 /* driver ioctl */
860 unsigned int index = nr - DRM_COMMAND_BASE;
861
862 if (index >= dev->driver->num_ioctls)
863 goto err_i1;
864 index = array_index_nospec(index, dev->driver->num_ioctls);
865 ioctl = &dev->driver->ioctls[index];
866 } else {
867 /* core ioctl */
868 if (nr >= DRM_CORE_IOCTL_COUNT)
869 goto err_i1;
870 nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
871 ioctl = &drm_ioctls[nr];
872 }
873
874 drv_size = _IOC_SIZE(ioctl->cmd);
875 out_size = in_size = _IOC_SIZE(cmd);
876 if ((cmd & ioctl->cmd & IOC_IN) == 0)
877 in_size = 0;
878 if ((cmd & ioctl->cmd & IOC_OUT) == 0)
879 out_size = 0;
880 ksize = max(max(in_size, out_size), drv_size);
881
882 drm_dbg_core(dev, "comm=\"%s\" pid=%d, dev=0x%lx, auth=%d, %s\n",
883 current->comm, task_pid_nr(current),
884 (long)old_encode_dev(file_priv->minor->kdev->devt),
885 file_priv->authenticated, ioctl->name);
886
887 /* Do not trust userspace, use our own definition */
888 func = ioctl->func;
889
890 if (unlikely(!func)) {
891 drm_dbg_core(dev, "no function\n");
892 retcode = -EINVAL;
893 goto err_i1;
894 }
895
896 if (ksize <= sizeof(stack_kdata)) {
897 kdata = stack_kdata;
898 } else {
899 kdata = kmalloc(ksize, GFP_KERNEL);
900 if (!kdata) {
901 retcode = -ENOMEM;
902 goto err_i1;
903 }
904 }
905
906 if (copy_from_user(kdata, (void __user *)arg, in_size) != 0) {
907 retcode = -EFAULT;
908 goto err_i1;
909 }
910
911 if (ksize > in_size)
912 memset(kdata + in_size, 0, ksize - in_size);
913
914 retcode = drm_ioctl_kernel(filp, func, kdata, ioctl->flags);
915 if (copy_to_user((void __user *)arg, kdata, out_size) != 0)
916 retcode = -EFAULT;
917
918 err_i1:
919 if (!ioctl)
920 drm_dbg_core(dev,
921 "invalid ioctl: comm=\"%s\", pid=%d, dev=0x%lx, auth=%d, cmd=0x%02x, nr=0x%02x\n",
922 current->comm, task_pid_nr(current),
923 (long)old_encode_dev(file_priv->minor->kdev->devt),
924 file_priv->authenticated, cmd, nr);
925
926 if (kdata != stack_kdata)
927 kfree(kdata);
928 if (retcode)
929 drm_dbg_core(dev, "comm=\"%s\", pid=%d, ret=%d\n",
930 current->comm, task_pid_nr(current), retcode);
931 return retcode;
932 #endif
933 #endif
934 }
935 EXPORT_SYMBOL(drm_ioctl);
936
937 /**
938 * drm_ioctl_flags - Check for core ioctl and return ioctl permission flags
939 * @nr: ioctl number
940 * @flags: where to return the ioctl permission flags
941 *
942 * This ioctl is only used by the vmwgfx driver to augment the access checks
943 * done by the drm core and insofar a pretty decent layering violation. This
944 * shouldn't be used by any drivers.
945 *
946 * Returns:
947 * True if the @nr corresponds to a DRM core ioctl number, false otherwise.
948 */
949 bool drm_ioctl_flags(unsigned int nr, unsigned int *flags)
950 {
951 if (nr >= DRM_COMMAND_BASE && nr < DRM_COMMAND_END)
952 return false;
953
954 if (nr >= DRM_CORE_IOCTL_COUNT)
955 return false;
956 nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
957
958 *flags = drm_ioctls[nr].flags;
959 return true;
960 }
961 EXPORT_SYMBOL(drm_ioctl_flags);
962
963 int
964 drm_do_ioctl(struct drm_device *dev, int minor, u_long cmd, caddr_t data)
965 {
966 struct drm_file *file_priv;
967 const struct drm_ioctl_desc *ioctl;
968 drm_ioctl_t *func;
969 unsigned int nr = DRM_IOCTL_NR(cmd);
970 int retcode = -EINVAL;
971 unsigned int usize, asize;
972 caddr_t adata = data;
973
974 mutex_lock(&dev->filelist_mutex);
975 file_priv = drm_find_file_by_minor(dev, minor);
976 mutex_unlock(&dev->filelist_mutex);
977 if (file_priv == NULL) {
978 DRM_ERROR("can't find authenticator\n");
979 return -EINVAL;
980 }
981
982 DRM_DEBUG("pid=%d, cmd=0x%02lx, nr=0x%02x, dev 0x%lx, auth=%d\n",
983 curproc->p_p->ps_pid, cmd, (u_int)DRM_IOCTL_NR(cmd), (long)&dev->dev,
984 file_priv->authenticated);
985
986 switch (cmd) {
987 case FIOASYNC:
988 return 0;
989 }
990
991 if ((nr >= DRM_CORE_IOCTL_COUNT) &&
992 ((nr < DRM_COMMAND_BASE) || (nr >= DRM_COMMAND_END)))
993 return (-EINVAL);
994 if ((nr >= DRM_COMMAND_BASE) && (nr < DRM_COMMAND_END) &&
995 (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls)) {
996 uint32_t drv_size;
997 ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
998 drv_size = IOCPARM_LEN(ioctl->cmd);
999 usize = asize = IOCPARM_LEN(cmd);
1000 if (drv_size > asize)
1001 asize = drv_size;
1002 } else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
1003 uint32_t drv_size;
1004 ioctl = &drm_ioctls[nr];
1005
1006 drv_size = IOCPARM_LEN(ioctl->cmd);
1007 usize = asize = IOCPARM_LEN(cmd);
1008 if (drv_size > asize)
1009 asize = drv_size;
1010 cmd = ioctl->cmd;
1011 } else
1012 return (-EINVAL);
1013
1014 func = ioctl->func;
1015 if (!func) {
1016 DRM_DEBUG("no function\n");
1017 return (-EINVAL);
1018 }
1019
1020 retcode = drm_ioctl_permit(ioctl->flags, file_priv);
1021 if (unlikely(retcode))
1022 return retcode;
1023
1024 if (asize > usize) {
1025 adata = malloc(asize, M_DRM, M_WAITOK | M_ZERO);
1026 memcpy(adata, data, usize);
1027 }
1028
1029 retcode = func(dev, adata, file_priv);
1030
1031 if (asize > usize) {
1032 memcpy(data, adata, usize);
1033 free(adata, M_DRM, asize);
1034 }
1035
1036 return (retcode);
1037 }
1038
1039 /* drmioctl is called whenever a process performs an ioctl on /dev/drm.
1040 */
1041 int
1042 drmioctl(dev_t kdev, u_long cmd, caddr_t data, int flags, struct proc *p)
1043 {
1044 struct drm_device *dev = drm_get_device_from_kdev(kdev);
1045 int error;
1046
1047 if (dev == NULL)
1048 return ENODEV;
1049
1050 mtx_enter(&dev->quiesce_mtx);
1051 while (dev->quiesce)
1052 msleep_nsec(&dev->quiesce, &dev->quiesce_mtx, PZERO, "drmioc",
1053 INFSLP);
1054 dev->quiesce_count++;
1055 mtx_leave(&dev->quiesce_mtx);
1056
1057 error = -drm_do_ioctl(dev, minor(kdev), cmd, data);
1058 if (error < 0 && error != ERESTART && error != EJUSTRETURN)
1059 printf("%s: cmd 0x%lx errno %d\n", __func__, cmd, error);
1060
1061 mtx_enter(&dev->quiesce_mtx);
1062 dev->quiesce_count--;
1063 if (dev->quiesce)
1064 wakeup(&dev->quiesce_count);
1065 mtx_leave(&dev->quiesce_mtx);
1066
1067 return (error);
1068 }
1069