search for: nvif_object_ioctl

...ouveau_svmm *svmm, struct mm_struct *mm, unsigned long addr, u64 *pfns, unsigned long npages) { struct nouveau_pfnmap_args *args = nouveau_pfns_to_args(pfns); - int ret; args->p.addr = addr; args->p.size = npages << PAGE_SHIFT; mutex_lock(&svmm->mutex); - ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, - struct_size(args, p.phys, npages), NULL); + nvif_object_ioctl(&svmm->vmm->vmm.object, args, + struct_size(args, p.phys, npages), NULL); mutex_unlock(&svmm->mutex); } -- 2.27.0

...;>> + if (size > INT_MAX || >>> + !(args = kmalloc(sizeof(*args) + size, GFP_KERNEL))) >> >> Hi, >> >> Would it be cleaner or better to use size_add(sizeof(*args), size)? > > I think the INT_MAX test is actually better in this case because > nvif_object_ioctl()'s size argument is u32: > > ret = nvif_object_ioctl(object, args, sizeof(*args) + size, NULL); > ^^^^^^^^^^^^^^^^^^^^ > > So that could wrap around, even though the allocation may not. > > Better yet, since "sizeof(*args) + s...

On Sat, 2024-05-18 at 11:23 -0700, Guenter Roeck wrote: > On 5/18/24 10:32, Kees Cook wrote: > [] > > I think the INT_MAX test is actually better in this case because > > nvif_object_ioctl()'s size argument is u32: > > > > ret = nvif_object_ioctl(object, args, sizeof(*args) + size, NULL); > > ^^^^^^^^^^^^^^^^^^^^ > > > > So that could wrap around, even though the allocation may not. > > > > Better...

...izeof(stack) - sizeof(*args)) { > > + if (size > INT_MAX || > > + !(args = kmalloc(sizeof(*args) + size, GFP_KERNEL))) > > Hi, > > Would it be cleaner or better to use size_add(sizeof(*args), size)? I think the INT_MAX test is actually better in this case because nvif_object_ioctl()'s size argument is u32: ret = nvif_object_ioctl(object, args, sizeof(*args) + size, NULL); ^^^^^^^^^^^^^^^^^^^^ So that could wrap around, even though the allocation may not. Better yet, since "sizeof(*args) + size" is repeated 3 times in the...

...ack)) { + args = kmalloc(args_size, GFP_KERNEL); + if (!args) return -ENOMEM; } else { args = (void *)stack; @@ -157,7 +162,7 @@ nvif_object_mthd(struct nvif_object *object, u32 mthd, void *data, u32 size) args->mthd.method = mthd; memcpy(args->mthd.data, data, size); - ret = nvif_object_ioctl(object, args, sizeof(*args) + size, NULL); + ret = nvif_object_ioctl(object, args, args_size, NULL); memcpy(data, args->mthd.data, size); if (args != (void *)stack) kfree(args); @@ -276,7 +281,15 @@ nvif_object_ctor(struct nvif_object *parent, const char *name, u32 handle, object->ma...

...zeof(stack)) { + if (!(args = kmalloc(args_size, GFP_KERNEL))) return -ENOMEM; } else { args = (void *)stack; @@ -157,7 +161,7 @@ nvif_object_mthd(struct nvif_object *object, u32 mthd, void *data, u32 size) args->mthd.method = mthd; memcpy(args->mthd.data, data, size); - ret = nvif_object_ioctl(object, args, sizeof(*args) + size, NULL); + ret = nvif_object_ioctl(object, args, args_size, NULL); memcpy(data, args->mthd.data, size); if (args != (void *)stack) kfree(args); @@ -276,7 +280,14 @@ nvif_object_ctor(struct nvif_object *parent, const char *name, u32 handle, object->ma...

On Tue, Apr 21, 2020 at 09:21:46PM -0300, Jason Gunthorpe wrote: > +void nouveau_hmm_convert_pfn(struct nouveau_drm *drm, struct hmm_range *range, > + u64 *ioctl_addr) > { > unsigned long i, npages; > > + /* > + * The ioctl_addr prepared here is passed through nvif_object_ioctl() > + * to an eventual DMA map on some call chain like: > + * nouveau_svm_fault(): > + * args.i.m.method = NVIF_VMM_V0_PFNMAP > + * nouveau_range_fault() > + * nvif_object_ioctl() > + * client->driver->ioctl() > + * struct nvif_d...

(adding linux-hardening at vger.kernel.org) Le 18/05/2024 ? 16:37, Guenter Roeck a ?crit?: > Trying to build parisc:allmodconfig with gcc 12.x or later results > in the following build error. > > drivers/gpu/drm/nouveau/nvif/object.c: In function 'nvif_object_mthd': > drivers/gpu/drm/nouveau/nvif/object.c:161:9: error: > 'memcpy' accessing 4294967264 or more

...r its pfns array a couple of times anyhow. It > also has a nasty call chain before it reaches the dma map and hardware > suggesting performance isn't important: > > nouveau_svm_fault(): > args.i.m.method = NVIF_VMM_V0_PFNMAP > nouveau_range_fault() > nvif_object_ioctl() > client->driver->ioctl() > struct nvif_driver nvif_driver_nvkm: > .ioctl = nvkm_client_ioctl > nvkm_ioctl() > nvkm_ioctl_path() > nvkm_ioctl_v0[type].func(..) > nvkm_ioctl_mthd() > nvkm_object_mthd() > struct nvk...

...veau_svm_mni_ops = { }; static void nouveau_hmm_convert_pfn(struct nouveau_drm *drm, - struct hmm_range *range, u64 *ioctl_addr) + struct hmm_range *range, + struct nouveau_pfnmap_args *args) { struct page *page; /* - * The ioctl_addr prepared here is passed through nvif_object_ioctl() + * The address prepared here is passed through nvif_object_ioctl() * to an eventual DMA map in something like gp100_vmm_pgt_pfn() * * This is all just encoding the internal hmm representation into a * different nouveau internal representation. */ if (!(range->hmm_pfns[0] &am...

...ouveau_pfns_to_args(pfns); - int ret; args->p.addr = addr; args->p.size = npages << PAGE_SHIFT; @@ -823,8 +822,8 @@ nouveau_pfns_map(struct nouveau_svmm *svmm, struct mm_struct *mm, mutex_lock(&svmm->mutex); svmm->vmm->vmm.object.client->super = true; - ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) + - npages * sizeof(args->p.phys[0]), NULL); + nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) + + npages * sizeof(args->p.phys[0]), NULL); svmm->vmm->vmm.object.client->super = false; mutex_un...

...ouveau_svmm *svmm, struct mm_struct *mm, unsigned long addr, u64 *pfns, unsigned long npages) { struct nouveau_pfnmap_args *args = nouveau_pfns_to_args(pfns); - int ret; args->p.addr = addr; args->p.size = npages << PAGE_SHIFT; mutex_lock(&svmm->mutex); - ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, - struct_size(args, p.phys, npages), NULL); + nvif_object_ioctl(&svmm->vmm->vmm.object, args, + struct_size(args, p.phys, npages), NULL); mutex_unlock(&svmm->mutex); } -- 2.39.2

...46PM -0300, Jason Gunthorpe wrote: > > +void nouveau_hmm_convert_pfn(struct nouveau_drm *drm, struct hmm_range *range, > > + u64 *ioctl_addr) > > { > > unsigned long i, npages; > > > > + /* > > + * The ioctl_addr prepared here is passed through nvif_object_ioctl() > > + * to an eventual DMA map on some call chain like: > > + * nouveau_svm_fault(): > > + * args.i.m.method = NVIF_VMM_V0_PFNMAP > > + * nouveau_range_fault() > > + * nvif_object_ioctl() > > + * client->driver->ioctl() &gt...

...ouveau_pfns_to_args(pfns); - int ret; args->p.addr = addr; args->p.size = npages << PAGE_SHIFT; @@ -823,7 +822,7 @@ nouveau_pfns_map(struct nouveau_svmm *svmm, struct mm_struct *mm, mutex_lock(&svmm->mutex); svmm->vmm->vmm.object.client->super = true; - ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) + + nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) + npages * sizeof(args->p.phys[0]), NULL); svmm->vmm->vmm.object.client->super = false; -- 2.17.1

The goal for this series is to introduce the hmm_range_fault() output array flags HMM_PFN_PMD and HMM_PFN_PUD. This allows a device driver to know that a given 4K PFN is actually mapped by the CPU using either a PMD sized or PUD sized CPU page table entry and therefore the device driver can safely map system memory using larger device MMU PTEs. The series is based on 5.8.0-rc3 and is intended for

The goal for this series is to introduce the hmm_pfn_to_map_order() function. This allows a device driver to know that a given 4K PFN is actually mapped by the CPU using a larger sized CPU page table entry and therefore the device driver can safely map system memory using larger device MMU PTEs. The series is based on 5.8.0-rc3 and is intended for Jason Gunthorpe's hmm tree. These were

....invalidate = nouveau_svm_range_invalidate, > }; > > +static void nouveau_hmm_convert_pfn(struct nouveau_drm *drm, > + struct hmm_range *range, u64 *ioctl_addr) > +{ > + unsigned long i, npages; > + > + /* > + * The ioctl_addr prepared here is passed through nvif_object_ioctl() > + * to an eventual DMA map in something like gp100_vmm_pgt_pfn() > + * > + * This is all just encoding the internal hmm reprensetation into a "representation" ... > @@ -542,12 +564,15 @@ static int nouveau_range_fault(struct nouveau_svmm *svmm, > return -EBUS...

.../0x2ce [nouveau] [ 7.402345] ? nvkm_udevice_rd08+0x5b/0x5b [nouveau] [ 7.402587] nvkm_ioctl+0x1c6/0x48d [nouveau] [ 7.402829] ? nvif_client_init+0xc3/0x114 [nouveau] [ 7.403094] ? nvkm_client_map+0xf/0xf [nouveau] [ 7.403382] nvkm_client_ioctl+0x1c/0x22 [nouveau] [ 7.403643] nvif_object_ioctl+0x6f/0xff [nouveau] [ 7.403903] nvif_object_init+0xd4/0x1de [nouveau] [ 7.404164] nvif_device_init+0x21/0x5c [nouveau] [ 7.404453] nouveau_cli_init+0x21f/0xe1f [nouveau] [ 7.404733] ? nouveau_drm_load+0x1d/0xe11 [nouveau] [ 7.405011] nouveau_drm_load+0x54/0xe11 [nouveau] [ 7....

...e_fault(range, 0); - if (ret <= 0) { - if (ret == 0) - ret = -EBUSY; - up_read(&svmm->notifier.mm->mmap_sem); - hmm_range_unregister(range); - return ret; - } - return 0; + nouveau_dmem_convert_pfn(drm, &range); + + svmm->vmm->vmm.object.client->super = true; + ret = nvif_object_ioctl(&svmm->vmm->vmm.object, data, size, NULL); + svmm->vmm->vmm.object.client->super = false; + mutex_unlock(&svmm->mutex); + + return ret; } static int @@ -559,7 +584,6 @@ nouveau_svm_fault(struct nvif_notify *notify) } i; u64 phys[16]; } args; - struct hmm_range...

hmm_range_fault() returns an array of page frame numbers and flags for how the pages are mapped in the requested process' page tables. The PFN can be used to get the struct page with hmm_pfn_to_page() and the page size order can be determined with compound_order(page) but if the page is larger than order 0 (PAGE_SIZE), there is no indication that the page is mapped using a larger page size. To