drm/vc4: Disallow using dmabuf BOs as shaders.

This is a step in eliminating the rewrite-the-shaders root hole.

Signed-off-by: Eric Anholt <eric@anholt.net>

4 files changed, 53 insertions, 2 deletions

diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
index 93be736c87bf..ae3ade165888 100644
--- a/drivers/gpu/drm/vc4/vc4_bo.c
+++ b/drivers/gpu/drm/vc4/vc4_bo.c
@@ -177,6 +177,12 @@ vc4_free_object(struct drm_gem_object *gem_bo)
 	kfree(bo->validated_shader);
 	bo->validated_shader = NULL;
 
+	/* If the BO was exported, and it's made it to this point,
+	 * then the dmabuf usage has been completely finished (so it's
+	 * safe now to let it turn into a shader again).
+	 */
+	bo->dma_buf_import_export = false;
+
 	bo->free_time = jiffies;
 	list_add(&bo->size_head, cache_list);
 	list_add(&bo->unref_head, &vc4->bo_cache.time_list);
@@ -217,3 +223,33 @@ vc4_bo_cache_init(struct drm_device *dev)
 		    vc4_bo_cache_time_timer,
 		    (unsigned long) dev);
 }
+
+struct drm_gem_object *
+vc4_prime_import(struct drm_device *dev, struct dma_buf *dma_buf)
+{
+	struct drm_gem_object *obj = drm_gem_prime_import(dev, dma_buf);
+
+	if (!IS_ERR_OR_NULL(obj)) {
+		struct vc4_bo *bo = to_vc4_bo(obj);
+		bo->dma_buf_import_export = true;
+	}
+
+	return obj;
+}
+
+struct dma_buf *
+vc4_prime_export(struct drm_device *dev, struct drm_gem_object *obj, int flags)
+{
+	struct vc4_bo *bo = to_vc4_bo(obj);
+
+	mutex_lock(&dev->struct_mutex);
+	if (bo->validated_shader) {
+		mutex_unlock(&dev->struct_mutex);
+		DRM_ERROR("Attempting to export shader BO\n");
+		return ERR_PTR(-EINVAL);
+	}
+	bo->dma_buf_import_export = true;
+	mutex_unlock(&dev->struct_mutex);
+
+	return drm_gem_prime_export(dev, obj, flags);
+}
diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 0bdc0f9069af..7408deecc857 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -143,8 +143,8 @@ static struct drm_driver vc4_drm_driver = {
 
 	.prime_handle_to_fd = drm_gem_prime_handle_to_fd,
 	.prime_fd_to_handle = drm_gem_prime_fd_to_handle,
-	.gem_prime_import = drm_gem_prime_import,
-	.gem_prime_export = drm_gem_prime_export,
+	.gem_prime_import = vc4_prime_import,
+	.gem_prime_export = vc4_prime_export,
 	.gem_prime_get_sg_table	= drm_gem_cma_prime_get_sg_table,
 	.gem_prime_import_sg_table = drm_gem_cma_prime_import_sg_table,
 	.gem_prime_vmap		= drm_gem_cma_prime_vmap,
diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index 0f71effb1cab..57ace7cfb322 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -102,6 +102,11 @@ struct vc4_bo {
 
 	/* Cached state from validation of the shader code. */
 	struct vc4_validated_shader_info *validated_shader;
+
+	/* Set if the buffer has been either imported or exported via
+	 * dmabufs.  Used for shader mapping security checks.
+	 */
+	bool dma_buf_import_export;
 };
 
 static inline struct vc4_bo *
@@ -353,6 +358,10 @@ struct vc4_bo *vc4_bo_create(struct drm_device *dev, size_t size);
 int vc4_dumb_create(struct drm_file *file_priv,
 		    struct drm_device *dev,
 		    struct drm_mode_create_dumb *args);
+struct drm_gem_object *vc4_prime_import(struct drm_device *dev,
+					struct dma_buf *dma_buf);
+struct dma_buf *vc4_prime_export(struct drm_device *dev,
+				 struct drm_gem_object *obj, int flags);
 
 /* vc4_debugfs.c */
 int vc4_debugfs_init(struct drm_minor *minor);
diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
index 1f5e02783c96..839d5521cfe5 100644
--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
@@ -369,6 +369,7 @@ check_instruction_reads(uint64_t inst,
 struct vc4_validated_shader_info *
 vc4_validate_shader(struct drm_gem_cma_object *shader_obj)
 {
+	struct vc4_dev *vc4 = to_vc4_dev(shader_obj->base.dev);
 	struct vc4_bo *shader_bo = to_vc4_bo(&shader_obj->base);
 	bool found_shader_end = false;
 	int shader_end_ip = 0;
@@ -389,6 +390,11 @@ vc4_validate_shader(struct drm_gem_cma_object *shader_obj)
 		return NULL;
 	}
 
+	if (shader_bo->dma_buf_import_export) {
+		DRM_ERROR("shader BO was exported through dmabuf.\n");
+		return NULL;
+	}
+
 	memset(&validation_state, 0, sizeof(validation_state));
 
 	for (i = 0; i < 8; i++)