[PATCH 51/54] fast-pread-ioctl

[Chris Wilson]

---
 drivers/gpu/drm/i915/i915_drv.c |  2 +-
 drivers/gpu/drm/i915/i915_drv.h |  5 +++--
 drivers/gpu/drm/i915/i915_gem.c | 41 +++++++++++++++++++++++++++--------------
 3 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index cefc18785423..7aec6a77fd2c 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -2556,7 +2556,7 @@ static const struct drm_ioctl_desc i915_ioctls[] = {
 	DRM_IOCTL_DEF_DRV(I915_GEM_ENTERVT, drm_noop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
 	DRM_IOCTL_DEF_DRV(I915_GEM_LEAVEVT, drm_noop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
 	DRM_DRIVER_IOCTL_DEF(I915_GEM_CREATE, i915_gem_create_ioctl, DRM_RENDER_ALLOW),
-	DRM_IOCTL_DEF_DRV(I915_GEM_PREAD, i915_gem_pread_ioctl, DRM_RENDER_ALLOW),
+	DRM_DRIVER_IOCTL_DEF(I915_GEM_PREAD, i915_gem_pread_ioctl, DRM_RENDER_ALLOW),
 	DRM_DRIVER_IOCTL_DEF(I915_GEM_PWRITE, i915_gem_pwrite_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_GEM_MMAP, i915_gem_mmap_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_GEM_MMAP_GTT, i915_gem_mmap_gtt_ioctl, DRM_RENDER_ALLOW),
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index f970bbe608f6..ab2b29138df9 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -3191,8 +3191,9 @@ ibx_disable_display_interrupt(struct drm_i915_private *dev_priv, uint32_t bits)
 long i915_gem_create_ioctl(struct file *filp,
 			   unsigned int cmd,
 			   unsigned long data);
-int i915_gem_pread_ioctl(struct drm_device *dev, void *data,
-			 struct drm_file *file_priv);
+long i915_gem_pread_ioctl(struct file *filp,
+			  unsigned int cmd,
+			  unsigned long data);
 long i915_gem_pwrite_ioctl(struct file *filp,
 			   unsigned int cmd,
 			   unsigned long data);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index bd3b541fde06..9a7d10a99b64 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1209,33 +1209,42 @@ i915_gem_gtt_pread(struct drm_i915_gem_object *obj,
  *
  * On error, the contents of *data are undefined.
  */
-int
-i915_gem_pread_ioctl(struct drm_device *dev, void *data,
-		     struct drm_file *file)
+long
+i915_gem_pread_ioctl(struct file *filp, unsigned int cmd, unsigned long data)
 {
-	struct drm_i915_gem_pread *args = data;
+	struct drm_i915_gem_pread __user *user = (typeof(user))data;
+	struct drm_file *file = filp->private_data;
 	struct drm_i915_gem_object *obj;
+	struct drm_i915_gem_pread arg;
 	int ret;
 
-	if (args->size == 0)
+	if (unlikely(!access_ok(VERIFY_READ, user, sizeof(*user))))
+		return -EFAULT;
+
+	user_access_begin();
+	unsafe_get_user(arg.handle, &user->handle, err_user);
+	unsafe_get_user(arg.size, &user->size, err_user);
+	unsafe_get_user(arg.offset, &user->offset, err_user);
+	unsafe_get_user(arg.data_ptr, &user->data_ptr, err_user);
+	user_access_end();
+
+	if (arg.size == 0)
 		return 0;
 
-	if (!access_ok(VERIFY_WRITE,
-		       u64_to_user_ptr(args->data_ptr),
-		       args->size))
+	if (!access_ok(VERIFY_WRITE, u64_to_user_ptr(arg.data_ptr), arg.size))
 		return -EFAULT;
 
-	obj = i915_gem_object_lookup(file, args->handle);
-	if (!obj)
+	obj = i915_gem_object_lookup(file, arg.handle);
+	if (unlikely(!obj))
 		return -ENOENT;
 
 	/* Bounds check source.  */
-	if (range_overflows_t(u64, args->offset, args->size, obj->base.size)) {
+	if (range_overflows_t(u64, arg.offset, arg.size, obj->base.size)) {
 		ret = -EINVAL;
 		goto out;
 	}
 
-	trace_i915_gem_object_pread(obj, args->offset, args->size);
+	trace_i915_gem_object_pread(obj, arg.offset, arg.size);
 
 	ret = i915_gem_object_wait(obj,
 				   I915_WAIT_INTERRUPTIBLE,
@@ -1248,14 +1257,18 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
 	if (ret)
 		goto out;
 
-	ret = i915_gem_shmem_pread(obj, args);
+	ret = i915_gem_shmem_pread(obj, &arg);
 	if (ret == -EFAULT || ret == -ENODEV)
-		ret = i915_gem_gtt_pread(obj, args);
+		ret = i915_gem_gtt_pread(obj, &arg);
 
 	i915_gem_object_unpin_pages(obj);
 out:
 	i915_gem_object_put(obj);
 	return ret;
+
+err_user:
+	user_access_end();
+	return -EFAULT;
 }
 
 /* This is the fast write path which cannot handle
-- 
2.11.0