[PATCH 49/54] fast-madv-ioctl

[Chris Wilson]

---
 drivers/gpu/drm/i915/i915_drv.c |  2 +-
 drivers/gpu/drm/i915/i915_drv.h |  5 +++--
 drivers/gpu/drm/i915/i915_gem.c | 41 +++++++++++++++++++++++++++++------------
 3 files changed, 33 insertions(+), 15 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index fc663f902683..4bd88294238d 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -2566,7 +2566,7 @@ static const struct drm_ioctl_desc i915_ioctls[] = {
 	DRM_DRIVER_IOCTL_DEF(I915_GEM_GET_TILING, i915_gem_get_tiling_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_GEM_GET_APERTURE, i915_gem_get_aperture_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_GET_PIPE_FROM_CRTC_ID, intel_get_pipe_from_crtc_id, 0),
-	DRM_IOCTL_DEF_DRV(I915_GEM_MADVISE, i915_gem_madvise_ioctl, DRM_RENDER_ALLOW),
+	DRM_DRIVER_IOCTL_DEF(I915_GEM_MADVISE, i915_gem_madvise_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_OVERLAY_PUT_IMAGE, intel_overlay_put_image_ioctl, DRM_MASTER|DRM_CONTROL_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_OVERLAY_ATTRS, intel_overlay_attrs_ioctl, DRM_MASTER|DRM_CONTROL_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_SET_SPRITE_COLORKEY, intel_sprite_set_colorkey, DRM_MASTER|DRM_CONTROL_ALLOW),
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 7d266802fa1d..2cea49a69d1b 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -3220,8 +3220,9 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data,
 long i915_gem_throttle_ioctl(struct file *filp,
 			     unsigned int cmd,
 			     unsigned long data);
-int i915_gem_madvise_ioctl(struct drm_device *dev, void *data,
-			   struct drm_file *file_priv);
+long i915_gem_madvise_ioctl(struct file *filp,
+			    unsigned int cmd,
+			    unsigned long data);
 int i915_gem_set_tiling_ioctl(struct drm_device *dev, void *data,
 			      struct drm_file *file_priv);
 long i915_gem_get_tiling_ioctl(struct file *filp,
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 1be8a08e3e64..cbf2f324a4c2 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -4309,16 +4309,25 @@ long i915_gem_busy_ioctl(struct file *filp,
 }
 
 
-int
-i915_gem_madvise_ioctl(struct drm_device *dev, void *data,
-		       struct drm_file *file_priv)
+long
+i915_gem_madvise_ioctl(struct file *filp,
+		       unsigned int cmd,
+		       unsigned long data)
 {
-	struct drm_i915_private *dev_priv = to_i915(dev);
-	struct drm_i915_gem_madvise *args = data;
+	struct drm_i915_gem_madvise __user *user = (typeof(user))data;
+	struct drm_i915_gem_madvise arg;
 	struct drm_i915_gem_object *obj;
 	int err;
 
-	switch (args->madv) {
+	if (unlikely(!access_ok(VERIFY_WRITE, user, sizeof(*user))))
+		return -EFAULT;
+
+	user_access_begin();
+	unsafe_get_user(arg.handle, &user->handle, err_user);
+	unsafe_get_user(arg.madv, &user->madv, err_user);
+	user_access_end();
+
+	switch (arg.madv) {
 	case I915_MADV_DONTNEED:
 	case I915_MADV_WILLNEED:
 	    break;
@@ -4326,8 +4335,8 @@ i915_gem_madvise_ioctl(struct drm_device *dev, void *data,
 	    return -EINVAL;
 	}
 
-	obj = i915_gem_object_lookup(file_priv, args->handle);
-	if (!obj)
+	obj = i915_gem_object_lookup(filp->private_data, arg.handle);
+	if (unlikely(!obj))
 		return -ENOENT;
 
 	err = mutex_lock_interruptible(&obj->mm.lock);
@@ -4336,13 +4345,13 @@ i915_gem_madvise_ioctl(struct drm_device *dev, void *data,
 
 	if (obj->mm.pages &&
 	    i915_gem_object_is_tiled(obj) &&
-	    dev_priv->quirks & QUIRK_PIN_SWIZZLED_PAGES) {
+	    to_i915(obj->base.dev)->quirks & QUIRK_PIN_SWIZZLED_PAGES) {
 		if (obj->mm.madv == I915_MADV_WILLNEED) {
 			GEM_BUG_ON(!obj->mm.quirked);
 			__i915_gem_object_unpin_pages(obj);
 			obj->mm.quirked = false;
 		}
-		if (args->madv == I915_MADV_WILLNEED) {
+		if (arg.madv == I915_MADV_WILLNEED) {
 			GEM_BUG_ON(obj->mm.quirked);
 			__i915_gem_object_pin_pages(obj);
 			obj->mm.quirked = true;
@@ -4350,18 +4359,26 @@ i915_gem_madvise_ioctl(struct drm_device *dev, void *data,
 	}
 
 	if (obj->mm.madv != __I915_MADV_PURGED)
-		obj->mm.madv = args->madv;
+		obj->mm.madv = arg.madv;
 
 	/* if the object is no longer attached, discard its backing storage */
 	if (obj->mm.madv == I915_MADV_DONTNEED && !obj->mm.pages)
 		i915_gem_object_truncate(obj);
 
-	args->retained = obj->mm.madv != __I915_MADV_PURGED;
+	arg.retained = obj->mm.madv != __I915_MADV_PURGED;
 	mutex_unlock(&obj->mm.lock);
 
+	user_access_begin();
+	unsafe_put_user(arg.retained, &user->retained, err_user);
+	user_access_end();
+
 out:
 	i915_gem_object_put(obj);
 	return err;
+
+err_user:
+	user_access_end();
+	return -EFAULT;
 }
 
 static void
-- 
2.11.0