From patchwork Wed Apr 13 20:26:50 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Wilson X-Patchwork-Id: 705721 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p3DKRMa7007305 for ; Wed, 13 Apr 2011 20:27:43 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 8ECF49F365 for ; Wed, 13 Apr 2011 13:27:22 -0700 (PDT) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from fireflyinternet.com (server109-228-6-236.live-servers.net [109.228.6.236]) by gabe.freedesktop.org (Postfix) with ESMTP id 283DD9E989 for ; Wed, 13 Apr 2011 13:27:02 -0700 (PDT) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=78.156.66.37; Received: from arrandale.alporthouse.com (unverified [78.156.66.37]) by fireflyinternet.com (Firefly Internet SMTP) with ESMTP id 31985563-1500050 for multiple; Wed, 13 Apr 2011 21:26:55 +0100 From: Chris Wilson To: intel-gfx@lists.freedesktop.org Date: Wed, 13 Apr 2011 21:26:50 +0100 Message-Id: <1302726410-14906-1-git-send-email-chris@chris-wilson.co.uk> X-Mailer: git-send-email 1.7.4.1 In-Reply-To: <20110413191323.GE3660@viiv.ffwll.ch> References: <20110413191323.GE3660@viiv.ffwll.ch> X-Originating-IP: 78.156.66.37 Subject: [Intel-gfx] [PATCH] drm/i915: Prevent mmap access through the GTT of snooped pages X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: intel-gfx-bounces+patchwork-intel-gfx=patchwork.kernel.org@lists.freedesktop.org Errors-To: intel-gfx-bounces+patchwork-intel-gfx=patchwork.kernel.org@lists.freedesktop.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Wed, 13 Apr 2011 20:27:43 +0000 (UTC) The docs have a dire warning not to attempt to access snooped pages through the GTT. Prevent userspace from doing so by sending them a SIGBUS if they try. [Now it is possible with a bit of extra complexity to map the snooped CPU page into the vma and return that through i915_gem_fault() instead. The question is: is it simpler to do that workaround in the kernel than it is to do it in userspace?] Signed-off-by: Chris Wilson Reviewed-by: Daniel Vetter --- drivers/gpu/drm/i915/i915_gem.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index 8b3007c..daa64cb 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -1211,6 +1211,16 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf) trace_i915_gem_object_fault(obj, page_offset, true, write); + /* The docs warn of dire consequences if we try to write to a snooped + * page through the GTT. So kill the driver/app early with a SIGBUS. + */ + if (INTEL_INFO(dev)->gen < 6 && obj->cache_level != I915_CACHE_NONE) { + DRM_DEBUG("Attempting to read a snooped page through the GTT, " + "this is illegal on pre-SandyBridge chipsets.\n"); + ret = -EINVAL; + goto unlock; + } + /* Now bind it into the GTT if needed */ if (!obj->map_and_fenceable) { ret = i915_gem_object_unbind(obj);