1 | /* |
2 | * Created: Tue Feb 2 08:37:54 1999 by faith@valinux.com |
3 | * |
4 | * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas. |
5 | * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California. |
6 | * All Rights Reserved. |
7 | * |
8 | * Author Rickard E. (Rik) Faith <faith@valinux.com> |
9 | * Author Gareth Hughes <gareth@valinux.com> |
10 | * |
11 | * Permission is hereby granted, free of charge, to any person obtaining a |
12 | * copy of this software and associated documentation files (the "Software"), |
13 | * to deal in the Software without restriction, including without limitation |
14 | * the rights to use, copy, modify, merge, publish, distribute, sublicense, |
15 | * and/or sell copies of the Software, and to permit persons to whom the |
16 | * Software is furnished to do so, subject to the following conditions: |
17 | * |
18 | * The above copyright notice and this permission notice (including the next |
19 | * paragraph) shall be included in all copies or substantial portions of the |
20 | * Software. |
21 | * |
22 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
23 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
24 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL |
25 | * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR |
26 | * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, |
27 | * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR |
28 | * OTHER DEALINGS IN THE SOFTWARE. |
29 | */ |
30 | |
31 | #include <linux/slab.h> |
32 | |
33 | #include <drm/drm_auth.h> |
34 | #include <drm/drm_drv.h> |
35 | #include <drm/drm_file.h> |
36 | #include <drm/drm_lease.h> |
37 | #include <drm/drm_print.h> |
38 | |
39 | #include "drm_internal.h" |
40 | #include "drm_legacy.h" |
41 | |
42 | /** |
43 | * DOC: master and authentication |
44 | * |
45 | * &struct drm_master is used to track groups of clients with open |
46 | * primary/legacy device nodes. For every &struct drm_file which has had at |
47 | * least once successfully became the device master (either through the |
48 | * SET_MASTER IOCTL, or implicitly through opening the primary device node when |
49 | * no one else is the current master that time) there exists one &drm_master. |
50 | * This is noted in &drm_file.is_master. All other clients have just a pointer |
51 | * to the &drm_master they are associated with. |
52 | * |
53 | * In addition only one &drm_master can be the current master for a &drm_device. |
54 | * It can be switched through the DROP_MASTER and SET_MASTER IOCTL, or |
55 | * implicitly through closing/opening the primary device node. See also |
56 | * drm_is_current_master(). |
57 | * |
58 | * Clients can authenticate against the current master (if it matches their own) |
59 | * using the GETMAGIC and AUTHMAGIC IOCTLs. Together with exchanging masters, |
60 | * this allows controlled access to the device for an entire group of mutually |
61 | * trusted clients. |
62 | */ |
63 | |
64 | static bool drm_is_current_master_locked(struct drm_file *fpriv) |
65 | { |
66 | lockdep_assert_once(lockdep_is_held(&fpriv->master_lookup_lock) || |
67 | lockdep_is_held(&fpriv->minor->dev->master_mutex)); |
68 | |
69 | return fpriv->is_master && drm_lease_owner(master: fpriv->master) == fpriv->minor->dev->master; |
70 | } |
71 | |
72 | /** |
73 | * drm_is_current_master - checks whether @priv is the current master |
74 | * @fpriv: DRM file private |
75 | * |
76 | * Checks whether @fpriv is current master on its device. This decides whether a |
77 | * client is allowed to run DRM_MASTER IOCTLs. |
78 | * |
79 | * Most of the modern IOCTL which require DRM_MASTER are for kernel modesetting |
80 | * - the current master is assumed to own the non-shareable display hardware. |
81 | */ |
82 | bool drm_is_current_master(struct drm_file *fpriv) |
83 | { |
84 | bool ret; |
85 | |
86 | spin_lock(lock: &fpriv->master_lookup_lock); |
87 | ret = drm_is_current_master_locked(fpriv); |
88 | spin_unlock(lock: &fpriv->master_lookup_lock); |
89 | |
90 | return ret; |
91 | } |
92 | EXPORT_SYMBOL(drm_is_current_master); |
93 | |
94 | int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv) |
95 | { |
96 | struct drm_auth *auth = data; |
97 | int ret = 0; |
98 | |
99 | mutex_lock(&dev->master_mutex); |
100 | if (!file_priv->magic) { |
101 | ret = idr_alloc(&file_priv->master->magic_map, ptr: file_priv, |
102 | start: 1, end: 0, GFP_KERNEL); |
103 | if (ret >= 0) |
104 | file_priv->magic = ret; |
105 | } |
106 | auth->magic = file_priv->magic; |
107 | mutex_unlock(lock: &dev->master_mutex); |
108 | |
109 | drm_dbg_core(dev, "%u\n" , auth->magic); |
110 | |
111 | return ret < 0 ? ret : 0; |
112 | } |
113 | |
114 | int drm_authmagic(struct drm_device *dev, void *data, |
115 | struct drm_file *file_priv) |
116 | { |
117 | struct drm_auth *auth = data; |
118 | struct drm_file *file; |
119 | |
120 | drm_dbg_core(dev, "%u\n" , auth->magic); |
121 | |
122 | mutex_lock(&dev->master_mutex); |
123 | file = idr_find(&file_priv->master->magic_map, id: auth->magic); |
124 | if (file) { |
125 | file->authenticated = 1; |
126 | idr_replace(&file_priv->master->magic_map, NULL, id: auth->magic); |
127 | } |
128 | mutex_unlock(lock: &dev->master_mutex); |
129 | |
130 | return file ? 0 : -EINVAL; |
131 | } |
132 | |
133 | struct drm_master *drm_master_create(struct drm_device *dev) |
134 | { |
135 | struct drm_master *master; |
136 | |
137 | master = kzalloc(size: sizeof(*master), GFP_KERNEL); |
138 | if (!master) |
139 | return NULL; |
140 | |
141 | kref_init(kref: &master->refcount); |
142 | drm_master_legacy_init(master); |
143 | idr_init_base(idr: &master->magic_map, base: 1); |
144 | master->dev = dev; |
145 | |
146 | /* initialize the tree of output resource lessees */ |
147 | INIT_LIST_HEAD(list: &master->lessees); |
148 | INIT_LIST_HEAD(list: &master->lessee_list); |
149 | idr_init(idr: &master->leases); |
150 | idr_init_base(idr: &master->lessee_idr, base: 1); |
151 | |
152 | return master; |
153 | } |
154 | |
155 | static void drm_set_master(struct drm_device *dev, struct drm_file *fpriv, |
156 | bool new_master) |
157 | { |
158 | dev->master = drm_master_get(master: fpriv->master); |
159 | if (dev->driver->master_set) |
160 | dev->driver->master_set(dev, fpriv, new_master); |
161 | |
162 | fpriv->was_master = true; |
163 | } |
164 | |
165 | static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv) |
166 | { |
167 | struct drm_master *old_master; |
168 | struct drm_master *new_master; |
169 | |
170 | lockdep_assert_held_once(&dev->master_mutex); |
171 | |
172 | WARN_ON(fpriv->is_master); |
173 | old_master = fpriv->master; |
174 | new_master = drm_master_create(dev); |
175 | if (!new_master) |
176 | return -ENOMEM; |
177 | spin_lock(lock: &fpriv->master_lookup_lock); |
178 | fpriv->master = new_master; |
179 | spin_unlock(lock: &fpriv->master_lookup_lock); |
180 | |
181 | fpriv->is_master = 1; |
182 | fpriv->authenticated = 1; |
183 | |
184 | drm_set_master(dev, fpriv, new_master: true); |
185 | |
186 | if (old_master) |
187 | drm_master_put(master: &old_master); |
188 | |
189 | return 0; |
190 | } |
191 | |
192 | /* |
193 | * In the olden days the SET/DROP_MASTER ioctls used to return EACCES when |
194 | * CAP_SYS_ADMIN was not set. This was used to prevent rogue applications |
195 | * from becoming master and/or failing to release it. |
196 | * |
197 | * At the same time, the first client (for a given VT) is _always_ master. |
198 | * Thus in order for the ioctls to succeed, one had to _explicitly_ run the |
199 | * application as root or flip the setuid bit. |
200 | * |
201 | * If the CAP_SYS_ADMIN was missing, no other client could become master... |
202 | * EVER :-( Leading to a) the graphics session dying badly or b) a completely |
203 | * locked session. |
204 | * |
205 | * |
206 | * As some point systemd-logind was introduced to orchestrate and delegate |
207 | * master as applicable. It does so by opening the fd and passing it to users |
208 | * while in itself logind a) does the set/drop master per users' request and |
209 | * b) * implicitly drops master on VT switch. |
210 | * |
211 | * Even though logind looks like the future, there are a few issues: |
212 | * - some platforms don't have equivalent (Android, CrOS, some BSDs) so |
213 | * root is required _solely_ for SET/DROP MASTER. |
214 | * - applications may not be updated to use it, |
215 | * - any client which fails to drop master* can DoS the application using |
216 | * logind, to a varying degree. |
217 | * |
218 | * * Either due missing CAP_SYS_ADMIN or simply not calling DROP_MASTER. |
219 | * |
220 | * |
221 | * Here we implement the next best thing: |
222 | * - ensure the logind style of fd passing works unchanged, and |
223 | * - allow a client to drop/set master, iff it is/was master at a given point |
224 | * in time. |
225 | * |
226 | * Note: DROP_MASTER cannot be free for all, as an arbitrator user could: |
227 | * - DoS/crash the arbitrator - details would be implementation specific |
228 | * - open the node, become master implicitly and cause issues |
229 | * |
230 | * As a result this fixes the following when using root-less build w/o logind |
231 | * - startx |
232 | * - weston |
233 | * - various compositors based on wlroots |
234 | */ |
235 | static int |
236 | drm_master_check_perm(struct drm_device *dev, struct drm_file *file_priv) |
237 | { |
238 | if (file_priv->was_master && |
239 | rcu_access_pointer(file_priv->pid) == task_pid(current)) |
240 | return 0; |
241 | |
242 | if (!capable(CAP_SYS_ADMIN)) |
243 | return -EACCES; |
244 | |
245 | return 0; |
246 | } |
247 | |
248 | int drm_setmaster_ioctl(struct drm_device *dev, void *data, |
249 | struct drm_file *file_priv) |
250 | { |
251 | int ret; |
252 | |
253 | mutex_lock(&dev->master_mutex); |
254 | |
255 | ret = drm_master_check_perm(dev, file_priv); |
256 | if (ret) |
257 | goto out_unlock; |
258 | |
259 | if (drm_is_current_master_locked(fpriv: file_priv)) |
260 | goto out_unlock; |
261 | |
262 | if (dev->master) { |
263 | ret = -EBUSY; |
264 | goto out_unlock; |
265 | } |
266 | |
267 | if (!file_priv->master) { |
268 | ret = -EINVAL; |
269 | goto out_unlock; |
270 | } |
271 | |
272 | if (!file_priv->is_master) { |
273 | ret = drm_new_set_master(dev, fpriv: file_priv); |
274 | goto out_unlock; |
275 | } |
276 | |
277 | if (file_priv->master->lessor != NULL) { |
278 | drm_dbg_lease(dev, |
279 | "Attempt to set lessee %d as master\n" , |
280 | file_priv->master->lessee_id); |
281 | ret = -EINVAL; |
282 | goto out_unlock; |
283 | } |
284 | |
285 | drm_set_master(dev, fpriv: file_priv, new_master: false); |
286 | out_unlock: |
287 | mutex_unlock(lock: &dev->master_mutex); |
288 | return ret; |
289 | } |
290 | |
291 | static void drm_drop_master(struct drm_device *dev, |
292 | struct drm_file *fpriv) |
293 | { |
294 | if (dev->driver->master_drop) |
295 | dev->driver->master_drop(dev, fpriv); |
296 | drm_master_put(master: &dev->master); |
297 | } |
298 | |
299 | int drm_dropmaster_ioctl(struct drm_device *dev, void *data, |
300 | struct drm_file *file_priv) |
301 | { |
302 | int ret; |
303 | |
304 | mutex_lock(&dev->master_mutex); |
305 | |
306 | ret = drm_master_check_perm(dev, file_priv); |
307 | if (ret) |
308 | goto out_unlock; |
309 | |
310 | if (!drm_is_current_master_locked(fpriv: file_priv)) { |
311 | ret = -EINVAL; |
312 | goto out_unlock; |
313 | } |
314 | |
315 | if (!dev->master) { |
316 | ret = -EINVAL; |
317 | goto out_unlock; |
318 | } |
319 | |
320 | if (file_priv->master->lessor != NULL) { |
321 | drm_dbg_lease(dev, |
322 | "Attempt to drop lessee %d as master\n" , |
323 | file_priv->master->lessee_id); |
324 | ret = -EINVAL; |
325 | goto out_unlock; |
326 | } |
327 | |
328 | drm_drop_master(dev, fpriv: file_priv); |
329 | out_unlock: |
330 | mutex_unlock(lock: &dev->master_mutex); |
331 | return ret; |
332 | } |
333 | |
334 | int drm_master_open(struct drm_file *file_priv) |
335 | { |
336 | struct drm_device *dev = file_priv->minor->dev; |
337 | int ret = 0; |
338 | |
339 | /* if there is no current master make this fd it, but do not create |
340 | * any master object for render clients |
341 | */ |
342 | mutex_lock(&dev->master_mutex); |
343 | if (!dev->master) { |
344 | ret = drm_new_set_master(dev, fpriv: file_priv); |
345 | } else { |
346 | spin_lock(lock: &file_priv->master_lookup_lock); |
347 | file_priv->master = drm_master_get(master: dev->master); |
348 | spin_unlock(lock: &file_priv->master_lookup_lock); |
349 | } |
350 | mutex_unlock(lock: &dev->master_mutex); |
351 | |
352 | return ret; |
353 | } |
354 | |
355 | void drm_master_release(struct drm_file *file_priv) |
356 | { |
357 | struct drm_device *dev = file_priv->minor->dev; |
358 | struct drm_master *master; |
359 | |
360 | mutex_lock(&dev->master_mutex); |
361 | master = file_priv->master; |
362 | if (file_priv->magic) |
363 | idr_remove(&file_priv->master->magic_map, id: file_priv->magic); |
364 | |
365 | if (!drm_is_current_master_locked(fpriv: file_priv)) |
366 | goto out; |
367 | |
368 | drm_legacy_lock_master_cleanup(dev, master); |
369 | |
370 | if (dev->master == file_priv->master) |
371 | drm_drop_master(dev, fpriv: file_priv); |
372 | out: |
373 | if (drm_core_check_feature(dev, feature: DRIVER_MODESET) && file_priv->is_master) { |
374 | /* Revoke any leases held by this or lessees, but only if |
375 | * this is the "real" master |
376 | */ |
377 | drm_lease_revoke(master); |
378 | } |
379 | |
380 | /* drop the master reference held by the file priv */ |
381 | if (file_priv->master) |
382 | drm_master_put(master: &file_priv->master); |
383 | mutex_unlock(lock: &dev->master_mutex); |
384 | } |
385 | |
386 | /** |
387 | * drm_master_get - reference a master pointer |
388 | * @master: &struct drm_master |
389 | * |
390 | * Increments the reference count of @master and returns a pointer to @master. |
391 | */ |
392 | struct drm_master *drm_master_get(struct drm_master *master) |
393 | { |
394 | kref_get(kref: &master->refcount); |
395 | return master; |
396 | } |
397 | EXPORT_SYMBOL(drm_master_get); |
398 | |
399 | /** |
400 | * drm_file_get_master - reference &drm_file.master of @file_priv |
401 | * @file_priv: DRM file private |
402 | * |
403 | * Increments the reference count of @file_priv's &drm_file.master and returns |
404 | * the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL. |
405 | * |
406 | * Master pointers returned from this function should be unreferenced using |
407 | * drm_master_put(). |
408 | */ |
409 | struct drm_master *drm_file_get_master(struct drm_file *file_priv) |
410 | { |
411 | struct drm_master *master = NULL; |
412 | |
413 | spin_lock(lock: &file_priv->master_lookup_lock); |
414 | if (!file_priv->master) |
415 | goto unlock; |
416 | master = drm_master_get(file_priv->master); |
417 | |
418 | unlock: |
419 | spin_unlock(lock: &file_priv->master_lookup_lock); |
420 | return master; |
421 | } |
422 | EXPORT_SYMBOL(drm_file_get_master); |
423 | |
424 | static void drm_master_destroy(struct kref *kref) |
425 | { |
426 | struct drm_master *master = container_of(kref, struct drm_master, refcount); |
427 | struct drm_device *dev = master->dev; |
428 | |
429 | if (drm_core_check_feature(dev, feature: DRIVER_MODESET)) |
430 | drm_lease_destroy(lessee: master); |
431 | |
432 | drm_legacy_master_rmmaps(dev, master); |
433 | |
434 | idr_destroy(&master->magic_map); |
435 | idr_destroy(&master->leases); |
436 | idr_destroy(&master->lessee_idr); |
437 | |
438 | kfree(objp: master->unique); |
439 | kfree(objp: master); |
440 | } |
441 | |
442 | /** |
443 | * drm_master_put - unreference and clear a master pointer |
444 | * @master: pointer to a pointer of &struct drm_master |
445 | * |
446 | * This decrements the &drm_master behind @master and sets it to NULL. |
447 | */ |
448 | void drm_master_put(struct drm_master **master) |
449 | { |
450 | kref_put(kref: &(*master)->refcount, release: drm_master_destroy); |
451 | *master = NULL; |
452 | } |
453 | EXPORT_SYMBOL(drm_master_put); |
454 | |
455 | /* Used by drm_client and drm_fb_helper */ |
456 | bool drm_master_internal_acquire(struct drm_device *dev) |
457 | { |
458 | mutex_lock(&dev->master_mutex); |
459 | if (dev->master) { |
460 | mutex_unlock(lock: &dev->master_mutex); |
461 | return false; |
462 | } |
463 | |
464 | return true; |
465 | } |
466 | EXPORT_SYMBOL(drm_master_internal_acquire); |
467 | |
468 | /* Used by drm_client and drm_fb_helper */ |
469 | void drm_master_internal_release(struct drm_device *dev) |
470 | { |
471 | mutex_unlock(lock: &dev->master_mutex); |
472 | } |
473 | EXPORT_SYMBOL(drm_master_internal_release); |
474 | |