• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * Copyright © 2017 Keith Packard <keithp@keithp.com>
4  */
5 #include <linux/file.h>
6 #include <linux/uaccess.h>
7 
8 #include <drm/drm_auth.h>
9 #include <drm/drm_crtc_helper.h>
10 #include <drm/drm_drv.h>
11 #include <drm/drm_file.h>
12 #include <drm/drm_lease.h>
13 #include <drm/drm_print.h>
14 
15 #include "drm_crtc_internal.h"
16 #include "drm_internal.h"
17 
18 /* ANDROID:
19  * this is needed to get access to dentry_open, which the drm layer does
20  * need to do.
21  */
22 MODULE_IMPORT_NS(VFS_internal_I_am_really_a_filesystem_and_am_NOT_a_driver);
23 
24 /**
25  * DOC: drm leasing
26  *
27  * DRM leases provide information about whether a DRM master may control a DRM
28  * mode setting object. This enables the creation of multiple DRM masters that
29  * manage subsets of display resources.
30  *
31  * The original DRM master of a device 'owns' the available drm resources. It
32  * may create additional DRM masters and 'lease' resources which it controls
33  * to the new DRM master. This gives the new DRM master control over the
34  * leased resources until the owner revokes the lease, or the new DRM master
35  * is closed. Some helpful terminology:
36  *
37  * - An 'owner' is a &struct drm_master that is not leasing objects from
38  *   another &struct drm_master, and hence 'owns' the objects. The owner can be
39  *   identified as the &struct drm_master for which &drm_master.lessor is NULL.
40  *
41  * - A 'lessor' is a &struct drm_master which is leasing objects to one or more
42  *   other &struct drm_master. Currently, lessees are not allowed to
43  *   create sub-leases, hence the lessor is the same as the owner.
44  *
45  * - A 'lessee' is a &struct drm_master which is leasing objects from some
46  *   other &struct drm_master. Each lessee only leases resources from a single
47  *   lessor recorded in &drm_master.lessor, and holds the set of objects that
48  *   it is leasing in &drm_master.leases.
49  *
50  * - A 'lease' is a contract between the lessor and lessee that identifies
51  *   which resources may be controlled by the lessee. All of the resources
52  *   that are leased must be owned by or leased to the lessor, and lessors are
53  *   not permitted to lease the same object to multiple lessees.
54  *
55  * The set of objects any &struct drm_master 'controls' is limited to the set
56  * of objects it leases (for lessees) or all objects (for owners).
57  *
58  * Objects not controlled by a &struct drm_master cannot be modified through
59  * the various state manipulating ioctls, and any state reported back to user
60  * space will be edited to make them appear idle and/or unusable. For
61  * instance, connectors always report 'disconnected', while encoders
62  * report no possible crtcs or clones.
63  *
64  * Since each lessee may lease objects from a single lessor, display resource
65  * leases form a tree of &struct drm_master. As lessees are currently not
66  * allowed to create sub-leases, the tree depth is limited to 1. All of
67  * these get activated simultaneously when the top level device owner changes
68  * through the SETMASTER or DROPMASTER IOCTL, so &drm_device.master points to
69  * the owner at the top of the lease tree (i.e. the &struct drm_master for which
70  * &drm_master.lessor is NULL). The full list of lessees that are leasing
71  * objects from the owner can be searched via the owner's
72  * &drm_master.lessee_idr.
73  */
74 
75 #define drm_for_each_lessee(lessee, lessor) \
76 	list_for_each_entry((lessee), &(lessor)->lessees, lessee_list)
77 
78 static uint64_t drm_lease_idr_object;
79 
drm_lease_owner(struct drm_master * master)80 struct drm_master *drm_lease_owner(struct drm_master *master)
81 {
82 	while (master->lessor != NULL)
83 		master = master->lessor;
84 	return master;
85 }
86 
87 static struct drm_master*
_drm_find_lessee(struct drm_master * master,int lessee_id)88 _drm_find_lessee(struct drm_master *master, int lessee_id)
89 {
90 	lockdep_assert_held(&master->dev->mode_config.idr_mutex);
91 	return idr_find(&drm_lease_owner(master)->lessee_idr, lessee_id);
92 }
93 
_drm_lease_held_master(struct drm_master * master,int id)94 static int _drm_lease_held_master(struct drm_master *master, int id)
95 {
96 	lockdep_assert_held(&master->dev->mode_config.idr_mutex);
97 	if (master->lessor)
98 		return idr_find(&master->leases, id) != NULL;
99 	return true;
100 }
101 
102 /* Checks if the given object has been leased to some lessee of drm_master */
_drm_has_leased(struct drm_master * master,int id)103 static bool _drm_has_leased(struct drm_master *master, int id)
104 {
105 	struct drm_master *lessee;
106 
107 	lockdep_assert_held(&master->dev->mode_config.idr_mutex);
108 	drm_for_each_lessee(lessee, master)
109 		if (_drm_lease_held_master(lessee, id))
110 			return true;
111 	return false;
112 }
113 
114 /* Called with idr_mutex held */
_drm_lease_held(struct drm_file * file_priv,int id)115 bool _drm_lease_held(struct drm_file *file_priv, int id)
116 {
117 	bool ret;
118 	struct drm_master *master;
119 
120 	if (!file_priv)
121 		return true;
122 
123 	master = drm_file_get_master(file_priv);
124 	if (!master)
125 		return true;
126 	ret = _drm_lease_held_master(master, id);
127 	drm_master_put(&master);
128 
129 	return ret;
130 }
131 
drm_lease_held(struct drm_file * file_priv,int id)132 bool drm_lease_held(struct drm_file *file_priv, int id)
133 {
134 	struct drm_master *master;
135 	bool ret;
136 
137 	if (!file_priv)
138 		return true;
139 
140 	master = drm_file_get_master(file_priv);
141 	if (!master)
142 		return true;
143 	if (!master->lessor) {
144 		ret = true;
145 		goto out;
146 	}
147 	mutex_lock(&master->dev->mode_config.idr_mutex);
148 	ret = _drm_lease_held_master(master, id);
149 	mutex_unlock(&master->dev->mode_config.idr_mutex);
150 
151 out:
152 	drm_master_put(&master);
153 	return ret;
154 }
155 
156 /*
157  * Given a bitmask of crtcs to check, reconstructs a crtc mask based on the
158  * crtcs which are visible through the specified file.
159  */
drm_lease_filter_crtcs(struct drm_file * file_priv,uint32_t crtcs_in)160 uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
161 {
162 	struct drm_master *master;
163 	struct drm_device *dev;
164 	struct drm_crtc *crtc;
165 	int count_in, count_out;
166 	uint32_t crtcs_out = 0;
167 
168 	if (!file_priv)
169 		return crtcs_in;
170 
171 	master = drm_file_get_master(file_priv);
172 	if (!master)
173 		return crtcs_in;
174 	if (!master->lessor) {
175 		crtcs_out = crtcs_in;
176 		goto out;
177 	}
178 	dev = master->dev;
179 
180 	count_in = count_out = 0;
181 	mutex_lock(&master->dev->mode_config.idr_mutex);
182 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
183 		if (_drm_lease_held_master(master, crtc->base.id)) {
184 			uint32_t mask_in = 1ul << count_in;
185 
186 			if ((crtcs_in & mask_in) != 0) {
187 				uint32_t mask_out = 1ul << count_out;
188 
189 				crtcs_out |= mask_out;
190 			}
191 			count_out++;
192 		}
193 		count_in++;
194 	}
195 	mutex_unlock(&master->dev->mode_config.idr_mutex);
196 
197 out:
198 	drm_master_put(&master);
199 	return crtcs_out;
200 }
201 
202 /*
203  * Uses drm_master_create to allocate a new drm_master, then checks to
204  * make sure all of the desired objects can be leased, atomically
205  * leasing them to the new drmmaster.
206  *
207  * 	ERR_PTR(-EACCES)	some other master holds the title to any object
208  * 	ERR_PTR(-ENOENT)	some object is not a valid DRM object for this device
209  * 	ERR_PTR(-EBUSY)		some other lessee holds title to this object
210  *	ERR_PTR(-EEXIST)	same object specified more than once in the provided list
211  *	ERR_PTR(-ENOMEM)	allocation failed
212  */
drm_lease_create(struct drm_master * lessor,struct idr * leases)213 static struct drm_master *drm_lease_create(struct drm_master *lessor, struct idr *leases)
214 {
215 	struct drm_device *dev = lessor->dev;
216 	int error;
217 	struct drm_master *lessee;
218 	int object;
219 	int id;
220 	void *entry;
221 
222 	DRM_DEBUG_LEASE("lessor %d\n", lessor->lessee_id);
223 
224 	lessee = drm_master_create(lessor->dev);
225 	if (!lessee) {
226 		DRM_DEBUG_LEASE("drm_master_create failed\n");
227 		return ERR_PTR(-ENOMEM);
228 	}
229 
230 	mutex_lock(&dev->mode_config.idr_mutex);
231 
232 	idr_for_each_entry(leases, entry, object) {
233 		error = 0;
234 		if (!idr_find(&dev->mode_config.object_idr, object))
235 			error = -ENOENT;
236 		else if (_drm_has_leased(lessor, object))
237 			error = -EBUSY;
238 
239 		if (error != 0) {
240 			DRM_DEBUG_LEASE("object %d failed %d\n", object, error);
241 			goto out_lessee;
242 		}
243 	}
244 
245 	/* Insert the new lessee into the tree */
246 	id = idr_alloc(&(drm_lease_owner(lessor)->lessee_idr), lessee, 1, 0, GFP_KERNEL);
247 	if (id < 0) {
248 		error = id;
249 		goto out_lessee;
250 	}
251 
252 	lessee->lessee_id = id;
253 	lessee->lessor = drm_master_get(lessor);
254 	list_add_tail(&lessee->lessee_list, &lessor->lessees);
255 
256 	/* Move the leases over */
257 	lessee->leases = *leases;
258 	DRM_DEBUG_LEASE("new lessee %d %p, lessor %d %p\n", lessee->lessee_id, lessee, lessor->lessee_id, lessor);
259 
260 	mutex_unlock(&dev->mode_config.idr_mutex);
261 	return lessee;
262 
263 out_lessee:
264 	mutex_unlock(&dev->mode_config.idr_mutex);
265 
266 	drm_master_put(&lessee);
267 
268 	return ERR_PTR(error);
269 }
270 
drm_lease_destroy(struct drm_master * master)271 void drm_lease_destroy(struct drm_master *master)
272 {
273 	struct drm_device *dev = master->dev;
274 
275 	mutex_lock(&dev->mode_config.idr_mutex);
276 
277 	DRM_DEBUG_LEASE("drm_lease_destroy %d\n", master->lessee_id);
278 
279 	/* This master is referenced by all lessees, hence it cannot be destroyed
280 	 * until all of them have been
281 	 */
282 	WARN_ON(!list_empty(&master->lessees));
283 
284 	/* Remove this master from the lessee idr in the owner */
285 	if (master->lessee_id != 0) {
286 		DRM_DEBUG_LEASE("remove master %d from device list of lessees\n", master->lessee_id);
287 		idr_remove(&(drm_lease_owner(master)->lessee_idr), master->lessee_id);
288 	}
289 
290 	/* Remove this master from any lessee list it may be on */
291 	list_del(&master->lessee_list);
292 
293 	mutex_unlock(&dev->mode_config.idr_mutex);
294 
295 	if (master->lessor) {
296 		/* Tell the master to check the lessee list */
297 		drm_sysfs_lease_event(dev);
298 		drm_master_put(&master->lessor);
299 	}
300 
301 	DRM_DEBUG_LEASE("drm_lease_destroy done %d\n", master->lessee_id);
302 }
303 
_drm_lease_revoke(struct drm_master * top)304 static void _drm_lease_revoke(struct drm_master *top)
305 {
306 	int object;
307 	void *entry;
308 	struct drm_master *master = top;
309 
310 	lockdep_assert_held(&top->dev->mode_config.idr_mutex);
311 
312 	/*
313 	 * Walk the tree starting at 'top' emptying all leases. Because
314 	 * the tree is fully connected, we can do this without recursing
315 	 */
316 	for (;;) {
317 		DRM_DEBUG_LEASE("revoke leases for %p %d\n", master, master->lessee_id);
318 
319 		/* Evacuate the lease */
320 		idr_for_each_entry(&master->leases, entry, object)
321 			idr_remove(&master->leases, object);
322 
323 		/* Depth-first list walk */
324 
325 		/* Down */
326 		if (!list_empty(&master->lessees)) {
327 			master = list_first_entry(&master->lessees, struct drm_master, lessee_list);
328 		} else {
329 			/* Up */
330 			while (master != top && master == list_last_entry(&master->lessor->lessees, struct drm_master, lessee_list))
331 				master = master->lessor;
332 
333 			if (master == top)
334 				break;
335 
336 			/* Over */
337 			master = list_next_entry(master, lessee_list);
338 		}
339 	}
340 }
341 
drm_lease_revoke(struct drm_master * top)342 void drm_lease_revoke(struct drm_master *top)
343 {
344 	mutex_lock(&top->dev->mode_config.idr_mutex);
345 	_drm_lease_revoke(top);
346 	mutex_unlock(&top->dev->mode_config.idr_mutex);
347 }
348 
validate_lease(struct drm_device * dev,int object_count,struct drm_mode_object ** objects,bool universal_planes)349 static int validate_lease(struct drm_device *dev,
350 			  int object_count,
351 			  struct drm_mode_object **objects,
352 			  bool universal_planes)
353 {
354 	int o;
355 	int has_crtc = -1;
356 	int has_connector = -1;
357 	int has_plane = -1;
358 
359 	/* we want to confirm that there is at least one crtc, plane
360 	   connector object. */
361 
362 	for (o = 0; o < object_count; o++) {
363 		if (objects[o]->type == DRM_MODE_OBJECT_CRTC && has_crtc == -1) {
364 			has_crtc = o;
365 		}
366 		if (objects[o]->type == DRM_MODE_OBJECT_CONNECTOR && has_connector == -1)
367 			has_connector = o;
368 
369 		if (universal_planes) {
370 			if (objects[o]->type == DRM_MODE_OBJECT_PLANE && has_plane == -1)
371 				has_plane = o;
372 		}
373 	}
374 	if (has_crtc == -1 || has_connector == -1)
375 		return -EINVAL;
376 	if (universal_planes && has_plane == -1)
377 		return -EINVAL;
378 	return 0;
379 }
380 
fill_object_idr(struct drm_device * dev,struct drm_file * lessor_priv,struct idr * leases,int object_count,u32 * object_ids)381 static int fill_object_idr(struct drm_device *dev,
382 			   struct drm_file *lessor_priv,
383 			   struct idr *leases,
384 			   int object_count,
385 			   u32 *object_ids)
386 {
387 	struct drm_mode_object **objects;
388 	u32 o;
389 	int ret;
390 	bool universal_planes = READ_ONCE(lessor_priv->universal_planes);
391 
392 	objects = kcalloc(object_count, sizeof(struct drm_mode_object *),
393 			  GFP_KERNEL);
394 	if (!objects)
395 		return -ENOMEM;
396 
397 	/* step one - get references to all the mode objects
398 	   and check for validity. */
399 	for (o = 0; o < object_count; o++) {
400 		objects[o] = drm_mode_object_find(dev, lessor_priv,
401 						  object_ids[o],
402 						  DRM_MODE_OBJECT_ANY);
403 		if (!objects[o]) {
404 			ret = -ENOENT;
405 			goto out_free_objects;
406 		}
407 
408 		if (!drm_mode_object_lease_required(objects[o]->type)) {
409 			DRM_DEBUG_KMS("invalid object for lease\n");
410 			ret = -EINVAL;
411 			goto out_free_objects;
412 		}
413 	}
414 
415 	ret = validate_lease(dev, object_count, objects, universal_planes);
416 	if (ret) {
417 		DRM_DEBUG_LEASE("lease validation failed\n");
418 		goto out_free_objects;
419 	}
420 
421 	/* add their IDs to the lease request - taking into account
422 	   universal planes */
423 	for (o = 0; o < object_count; o++) {
424 		struct drm_mode_object *obj = objects[o];
425 		u32 object_id = objects[o]->id;
426 
427 		DRM_DEBUG_LEASE("Adding object %d to lease\n", object_id);
428 
429 		/*
430 		 * We're using an IDR to hold the set of leased
431 		 * objects, but we don't need to point at the object's
432 		 * data structure from the lease as the main object_idr
433 		 * will be used to actually find that. Instead, all we
434 		 * really want is a 'leased/not-leased' result, for
435 		 * which any non-NULL pointer will work fine.
436 		 */
437 		ret = idr_alloc(leases, &drm_lease_idr_object , object_id, object_id + 1, GFP_KERNEL);
438 		if (ret < 0) {
439 			DRM_DEBUG_LEASE("Object %d cannot be inserted into leases (%d)\n",
440 					object_id, ret);
441 			goto out_free_objects;
442 		}
443 		if (obj->type == DRM_MODE_OBJECT_CRTC && !universal_planes) {
444 			struct drm_crtc *crtc = obj_to_crtc(obj);
445 
446 			ret = idr_alloc(leases, &drm_lease_idr_object, crtc->primary->base.id, crtc->primary->base.id + 1, GFP_KERNEL);
447 			if (ret < 0) {
448 				DRM_DEBUG_LEASE("Object primary plane %d cannot be inserted into leases (%d)\n",
449 						object_id, ret);
450 				goto out_free_objects;
451 			}
452 			if (crtc->cursor) {
453 				ret = idr_alloc(leases, &drm_lease_idr_object, crtc->cursor->base.id, crtc->cursor->base.id + 1, GFP_KERNEL);
454 				if (ret < 0) {
455 					DRM_DEBUG_LEASE("Object cursor plane %d cannot be inserted into leases (%d)\n",
456 							object_id, ret);
457 					goto out_free_objects;
458 				}
459 			}
460 		}
461 	}
462 
463 	ret = 0;
464 out_free_objects:
465 	for (o = 0; o < object_count; o++) {
466 		if (objects[o])
467 			drm_mode_object_put(objects[o]);
468 	}
469 	kfree(objects);
470 	return ret;
471 }
472 
473 /*
474  * The master associated with the specified file will have a lease
475  * created containing the objects specified in the ioctl structure.
476  * A file descriptor will be allocated for that and returned to the
477  * application.
478  */
drm_mode_create_lease_ioctl(struct drm_device * dev,void * data,struct drm_file * lessor_priv)479 int drm_mode_create_lease_ioctl(struct drm_device *dev,
480 				void *data, struct drm_file *lessor_priv)
481 {
482 	struct drm_mode_create_lease *cl = data;
483 	size_t object_count;
484 	int ret = 0;
485 	struct idr leases;
486 	struct drm_master *lessor;
487 	struct drm_master *lessee = NULL;
488 	struct file *lessee_file = NULL;
489 	struct file *lessor_file = lessor_priv->filp;
490 	struct drm_file *lessee_priv;
491 	int fd = -1;
492 	uint32_t *object_ids;
493 
494 	/* Can't lease without MODESET */
495 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
496 		return -EOPNOTSUPP;
497 
498 	/* need some objects */
499 	if (cl->object_count == 0) {
500 		DRM_DEBUG_LEASE("no objects in lease\n");
501 		return -EINVAL;
502 	}
503 
504 	if (cl->flags && (cl->flags & ~(O_CLOEXEC | O_NONBLOCK))) {
505 		DRM_DEBUG_LEASE("invalid flags\n");
506 		return -EINVAL;
507 	}
508 
509 	lessor = drm_file_get_master(lessor_priv);
510 	/* Do not allow sub-leases */
511 	if (lessor->lessor) {
512 		DRM_DEBUG_LEASE("recursive leasing not allowed\n");
513 		ret = -EINVAL;
514 		goto out_lessor;
515 	}
516 
517 	object_count = cl->object_count;
518 
519 	object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
520 			array_size(object_count, sizeof(__u32)));
521 	if (IS_ERR(object_ids)) {
522 		ret = PTR_ERR(object_ids);
523 		goto out_lessor;
524 	}
525 
526 	idr_init(&leases);
527 
528 	/* fill and validate the object idr */
529 	ret = fill_object_idr(dev, lessor_priv, &leases,
530 			      object_count, object_ids);
531 	kfree(object_ids);
532 	if (ret) {
533 		DRM_DEBUG_LEASE("lease object lookup failed: %i\n", ret);
534 		idr_destroy(&leases);
535 		goto out_lessor;
536 	}
537 
538 	/* Allocate a file descriptor for the lease */
539 	fd = get_unused_fd_flags(cl->flags & (O_CLOEXEC | O_NONBLOCK));
540 	if (fd < 0) {
541 		idr_destroy(&leases);
542 		ret = fd;
543 		goto out_lessor;
544 	}
545 
546 	DRM_DEBUG_LEASE("Creating lease\n");
547 	/* lessee will take the ownership of leases */
548 	lessee = drm_lease_create(lessor, &leases);
549 
550 	if (IS_ERR(lessee)) {
551 		ret = PTR_ERR(lessee);
552 		idr_destroy(&leases);
553 		goto out_leases;
554 	}
555 
556 	/* Clone the lessor file to create a new file for us */
557 	DRM_DEBUG_LEASE("Allocating lease file\n");
558 	lessee_file = file_clone_open(lessor_file);
559 	if (IS_ERR(lessee_file)) {
560 		ret = PTR_ERR(lessee_file);
561 		goto out_lessee;
562 	}
563 
564 	lessee_priv = lessee_file->private_data;
565 	/* Change the file to a master one */
566 	drm_master_put(&lessee_priv->master);
567 	lessee_priv->master = lessee;
568 	lessee_priv->is_master = 1;
569 	lessee_priv->authenticated = 1;
570 
571 	/* Pass fd back to userspace */
572 	DRM_DEBUG_LEASE("Returning fd %d id %d\n", fd, lessee->lessee_id);
573 	cl->fd = fd;
574 	cl->lessee_id = lessee->lessee_id;
575 
576 	/* Hook up the fd */
577 	fd_install(fd, lessee_file);
578 
579 	drm_master_put(&lessor);
580 	DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
581 	return 0;
582 
583 out_lessee:
584 	drm_master_put(&lessee);
585 
586 out_leases:
587 	put_unused_fd(fd);
588 
589 out_lessor:
590 	drm_master_put(&lessor);
591 	DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
592 	return ret;
593 }
594 
drm_mode_list_lessees_ioctl(struct drm_device * dev,void * data,struct drm_file * lessor_priv)595 int drm_mode_list_lessees_ioctl(struct drm_device *dev,
596 			       void *data, struct drm_file *lessor_priv)
597 {
598 	struct drm_mode_list_lessees *arg = data;
599 	__u32 __user *lessee_ids = (__u32 __user *) (uintptr_t) (arg->lessees_ptr);
600 	__u32 count_lessees = arg->count_lessees;
601 	struct drm_master *lessor, *lessee;
602 	int count;
603 	int ret = 0;
604 
605 	if (arg->pad)
606 		return -EINVAL;
607 
608 	/* Can't lease without MODESET */
609 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
610 		return -EOPNOTSUPP;
611 
612 	lessor = drm_file_get_master(lessor_priv);
613 	DRM_DEBUG_LEASE("List lessees for %d\n", lessor->lessee_id);
614 
615 	mutex_lock(&dev->mode_config.idr_mutex);
616 
617 	count = 0;
618 	drm_for_each_lessee(lessee, lessor) {
619 		/* Only list un-revoked leases */
620 		if (!idr_is_empty(&lessee->leases)) {
621 			if (count_lessees > count) {
622 				DRM_DEBUG_LEASE("Add lessee %d\n", lessee->lessee_id);
623 				ret = put_user(lessee->lessee_id, lessee_ids + count);
624 				if (ret)
625 					break;
626 			}
627 			count++;
628 		}
629 	}
630 
631 	DRM_DEBUG_LEASE("Lessor leases to %d\n", count);
632 	if (ret == 0)
633 		arg->count_lessees = count;
634 
635 	mutex_unlock(&dev->mode_config.idr_mutex);
636 	drm_master_put(&lessor);
637 
638 	return ret;
639 }
640 
641 /* Return the list of leased objects for the specified lessee */
drm_mode_get_lease_ioctl(struct drm_device * dev,void * data,struct drm_file * lessee_priv)642 int drm_mode_get_lease_ioctl(struct drm_device *dev,
643 			     void *data, struct drm_file *lessee_priv)
644 {
645 	struct drm_mode_get_lease *arg = data;
646 	__u32 __user *object_ids = (__u32 __user *) (uintptr_t) (arg->objects_ptr);
647 	__u32 count_objects = arg->count_objects;
648 	struct drm_master *lessee;
649 	struct idr *object_idr;
650 	int count;
651 	void *entry;
652 	int object;
653 	int ret = 0;
654 
655 	if (arg->pad)
656 		return -EINVAL;
657 
658 	/* Can't lease without MODESET */
659 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
660 		return -EOPNOTSUPP;
661 
662 	lessee = drm_file_get_master(lessee_priv);
663 	DRM_DEBUG_LEASE("get lease for %d\n", lessee->lessee_id);
664 
665 	mutex_lock(&dev->mode_config.idr_mutex);
666 
667 	if (lessee->lessor == NULL)
668 		/* owner can use all objects */
669 		object_idr = &lessee->dev->mode_config.object_idr;
670 	else
671 		/* lessee can only use allowed object */
672 		object_idr = &lessee->leases;
673 
674 	count = 0;
675 	idr_for_each_entry(object_idr, entry, object) {
676 		if (count_objects > count) {
677 			DRM_DEBUG_LEASE("adding object %d\n", object);
678 			ret = put_user(object, object_ids + count);
679 			if (ret)
680 				break;
681 		}
682 		count++;
683 	}
684 
685 	DRM_DEBUG("lease holds %d objects\n", count);
686 	if (ret == 0)
687 		arg->count_objects = count;
688 
689 	mutex_unlock(&dev->mode_config.idr_mutex);
690 	drm_master_put(&lessee);
691 
692 	return ret;
693 }
694 
695 /*
696  * This removes all of the objects from the lease without
697  * actually getting rid of the lease itself; that way all
698  * references to it still work correctly
699  */
drm_mode_revoke_lease_ioctl(struct drm_device * dev,void * data,struct drm_file * lessor_priv)700 int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
701 				void *data, struct drm_file *lessor_priv)
702 {
703 	struct drm_mode_revoke_lease *arg = data;
704 	struct drm_master *lessor;
705 	struct drm_master *lessee;
706 	int ret = 0;
707 
708 	DRM_DEBUG_LEASE("revoke lease for %d\n", arg->lessee_id);
709 
710 	/* Can't lease without MODESET */
711 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
712 		return -EOPNOTSUPP;
713 
714 	lessor = drm_file_get_master(lessor_priv);
715 	mutex_lock(&dev->mode_config.idr_mutex);
716 
717 	lessee = _drm_find_lessee(lessor, arg->lessee_id);
718 
719 	/* No such lessee */
720 	if (!lessee) {
721 		ret = -ENOENT;
722 		goto fail;
723 	}
724 
725 	/* Lease is not held by lessor */
726 	if (lessee->lessor != lessor) {
727 		ret = -EACCES;
728 		goto fail;
729 	}
730 
731 	_drm_lease_revoke(lessee);
732 
733 fail:
734 	mutex_unlock(&dev->mode_config.idr_mutex);
735 	drm_master_put(&lessor);
736 
737 	return ret;
738 }
739