From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751334AbdFASIZ (ORCPT ); Thu, 1 Jun 2017 14:08:25 -0400 Received: from mx1.redhat.com ([209.132.183.28]:40300 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751122AbdFASIY (ORCPT ); Thu, 1 Jun 2017 14:08:24 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 57288142A8D Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=alex.williamson@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 57288142A8D Date: Thu, 1 Jun 2017 12:08:20 -0600 From: Alex Williamson To: Xiaoguang Chen Cc: kraxel@redhat.com, chris@chris-wilson.co.uk, intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org, zhenyuw@linux.intel.com, zhiyuan.lv@intel.com, intel-gvt-dev@lists.freedesktop.org, zhi.a.wang@intel.com, kevin.tian@intel.com Subject: Re: [PATCH v6 6/6] drm/i915/gvt: Adding interface so user space can get the dma-buf Message-ID: <20170601120820.3358f7dd@w520.home> In-Reply-To: <1495874332-2851-7-git-send-email-xiaoguang.chen@intel.com> References: <1495874332-2851-1-git-send-email-xiaoguang.chen@intel.com> <1495874332-2851-7-git-send-email-xiaoguang.chen@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Thu, 01 Jun 2017 18:08:23 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, 27 May 2017 16:38:52 +0800 Xiaoguang Chen wrote: > User space should create the management fd for the dma-buf operation first. > Then user can query the plane information and create dma-buf if necessary > using the management fd. > > Signed-off-by: Xiaoguang Chen > --- > drivers/gpu/drm/i915/gvt/dmabuf.c | 12 ++++ > drivers/gpu/drm/i915/gvt/dmabuf.h | 5 ++ > drivers/gpu/drm/i915/gvt/gvt.c | 2 + > drivers/gpu/drm/i915/gvt/gvt.h | 5 ++ > drivers/gpu/drm/i915/gvt/kvmgt.c | 144 ++++++++++++++++++++++++++++++++++++++ > drivers/gpu/drm/i915/gvt/vgpu.c | 1 + > 6 files changed, 169 insertions(+) > > diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c > index c831e91..9759e9a 100644 > --- a/drivers/gpu/drm/i915/gvt/dmabuf.c > +++ b/drivers/gpu/drm/i915/gvt/dmabuf.c > @@ -226,6 +226,7 @@ int intel_vgpu_create_dmabuf(struct intel_vgpu *vgpu, void *args) > struct vfio_vgpu_dmabuf_info *gvt_dmabuf = args; > struct intel_vgpu_fb_info *fb_info; > int ret; > + struct intel_vgpu_dmabuf_obj *dmabuf_obj; > > ret = intel_vgpu_get_plane_info(dev, vgpu, &gvt_dmabuf->plane_info); > if (ret != 0) > @@ -263,6 +264,17 @@ int intel_vgpu_create_dmabuf(struct intel_vgpu *vgpu, void *args) > gvt_vgpu_err("create dma-buf fd failed ret:%d\n", ret); > return ret; > } > + dmabuf_obj = kmalloc(sizeof(*dmabuf_obj), GFP_KERNEL); > + if (dmabuf_obj == NULL) { > + kfree(fb_info); > + i915_gem_object_put(obj); > + gvt_vgpu_err("alloc dmabuf_obj failed\n"); > + return -ENOMEM; > + } > + dmabuf_obj->obj = obj; > + INIT_LIST_HEAD(&dmabuf_obj->list); > + list_add_tail(&dmabuf_obj->list, &vgpu->dmabuf_obj_list_head); > + > gvt_dmabuf->fd = ret; > > return 0; > diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.h b/drivers/gpu/drm/i915/gvt/dmabuf.h > index 8be9979..cafa781 100644 > --- a/drivers/gpu/drm/i915/gvt/dmabuf.h > +++ b/drivers/gpu/drm/i915/gvt/dmabuf.h > @@ -31,6 +31,11 @@ struct intel_vgpu_fb_info { > uint32_t fb_size; > }; > > +struct intel_vgpu_dmabuf_obj { > + struct drm_i915_gem_object *obj; > + struct list_head list; > +}; > + > int intel_vgpu_query_plane(struct intel_vgpu *vgpu, void *args); > int intel_vgpu_create_dmabuf(struct intel_vgpu *vgpu, void *args); > > diff --git a/drivers/gpu/drm/i915/gvt/gvt.c b/drivers/gpu/drm/i915/gvt/gvt.c > index 2032917..dbc3f86 100644 > --- a/drivers/gpu/drm/i915/gvt/gvt.c > +++ b/drivers/gpu/drm/i915/gvt/gvt.c > @@ -54,6 +54,8 @@ static const struct intel_gvt_ops intel_gvt_ops = { > .vgpu_reset = intel_gvt_reset_vgpu, > .vgpu_activate = intel_gvt_activate_vgpu, > .vgpu_deactivate = intel_gvt_deactivate_vgpu, > + .vgpu_query_plane = intel_vgpu_query_plane, > + .vgpu_create_dmabuf = intel_vgpu_create_dmabuf, > }; > > /** > diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h > index 763a8c5..a855797 100644 > --- a/drivers/gpu/drm/i915/gvt/gvt.h > +++ b/drivers/gpu/drm/i915/gvt/gvt.h > @@ -185,8 +185,11 @@ struct intel_vgpu { > struct kvm *kvm; > struct work_struct release_work; > atomic_t released; > + struct vfio_device *vfio_device; > } vdev; > #endif > + int dmabuf_mgr_fd; > + struct list_head dmabuf_obj_list_head; > }; > > struct intel_gvt_gm { > @@ -467,6 +470,8 @@ struct intel_gvt_ops { > void (*vgpu_reset)(struct intel_vgpu *); > void (*vgpu_activate)(struct intel_vgpu *); > void (*vgpu_deactivate)(struct intel_vgpu *); > + int (*vgpu_query_plane)(struct intel_vgpu *vgpu, void *); > + int (*vgpu_create_dmabuf)(struct intel_vgpu *vgpu, void *); > }; > > > diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c > index 389f072..a079080 100644 > --- a/drivers/gpu/drm/i915/gvt/kvmgt.c > +++ b/drivers/gpu/drm/i915/gvt/kvmgt.c > @@ -41,6 +41,7 @@ > #include > #include > #include > +#include > > #include "i915_drv.h" > #include "gvt.h" > @@ -524,6 +525,125 @@ static int intel_vgpu_reg_init_opregion(struct intel_vgpu *vgpu) > return ret; > } > > +static int kvmgt_get_vfio_device(struct intel_vgpu *vgpu) > +{ > + struct vfio_device *device; > + > + device = vfio_device_get_from_dev(mdev_dev(vgpu->vdev.mdev)); > + if (device == NULL) > + return -ENODEV; > + vgpu->vdev.vfio_device = device; > + > + return 0; > +} > + > +static void kvmgt_put_vfio_device(struct intel_vgpu *vgpu) > +{ > + vfio_device_put(vgpu->vdev.vfio_device); > +} > + > +static int intel_vgpu_dmabuf_mgr_fd_mmap(struct file *file, > + struct vm_area_struct *vma) > +{ > + return -EPERM; > +} > + > +static int intel_vgpu_dmabuf_mgr_fd_release(struct inode *inode, > + struct file *filp) > +{ > + struct intel_vgpu *vgpu = filp->private_data; > + struct intel_vgpu_dmabuf_obj *obj; > + struct list_head *pos; > + > + if (WARN_ON(!vgpu->vdev.vfio_device)) > + return -ENODEV; > + > + list_for_each(pos, &vgpu->dmabuf_obj_list_head) { > + obj = container_of(pos, struct intel_vgpu_dmabuf_obj, list); > + if (WARN_ON(!obj)) > + return -ENODEV; > + kfree(obj->obj->gvt_info); > + i915_gem_object_put(obj->obj); > + kfree(obj); > + kvmgt_put_vfio_device(vgpu); Can we do this? If I understand, we're releasing all the references and allocations for the dmabuf fds on release of the manager fd. What happens if the user continues trying to access those dmabuf fds after this? > + } > + kvmgt_put_vfio_device(vgpu); > + > + return 0; > +} > + > +static long intel_vgpu_dmabuf_mgr_fd_ioctl(struct file *filp, > + unsigned int ioctl, unsigned long arg) > +{ > + struct intel_vgpu *vgpu = filp->private_data; > + int minsz; > + int ret; > + struct fd f; > + > + f = fdget(vgpu->dmabuf_mgr_fd); > + if (!f.file) > + return -EBADF; > + > + if (ioctl == VFIO_DEVICE_QUERY_PLANE) { > + struct vfio_vgpu_plane_info info; > + > + minsz = offsetofend(struct vfio_vgpu_plane_info, resv); > + if (copy_from_user(&info, (void __user *)arg, minsz)) { > + fdput(f); > + return -EFAULT; > + } > + if (info.argsz < minsz) { > + fdput(f); > + return -EINVAL; > + } > + ret = intel_gvt_ops->vgpu_query_plane(vgpu, &info); > + if (ret != 0) { > + fdput(f); > + gvt_vgpu_err("query plane failed:%d\n", ret); > + return -EINVAL; > + } > + fdput(f); > + return copy_to_user((void __user *)arg, &info, minsz) ? > + -EFAULT : 0; > + } else if (ioctl == VFIO_DEVICE_CREATE_DMABUF) { > + struct vfio_vgpu_dmabuf_info dmabuf; > + > + minsz = offsetofend(struct vfio_vgpu_dmabuf_info, resv); > + if (copy_from_user(&dmabuf, (void __user *)arg, minsz)) { > + fdput(f); > + return -EFAULT; > + } > + if (dmabuf.argsz < minsz) { > + fdput(f); > + return -EINVAL; > + } > + ret = kvmgt_get_vfio_device(vgpu); > + if (ret != 0) > + return ret; Missed an fdput, though I'm not sure I understand the value of the original fdget or the dmabuf_mgr_fd field at all. dmabuf_mgr_fd is only used here, presumably to add a reference to the fd while we're in the ioctl, but we're in the ioctl function of that fd, so I think there are already references elsewhere. > + > + ret = intel_gvt_ops->vgpu_create_dmabuf(vgpu, &dmabuf); > + if (ret != 0) { > + kvmgt_put_vfio_device(vgpu); > + fdput(f); > + return -EINVAL; Why not return the errno that vgpu_create_dmabuf provided? > + } > + fdput(f); > + return copy_to_user((void __user *)arg, &dmabuf, minsz) ? > + -EFAULT : 0; > + } > + > + fdput(f); > + gvt_vgpu_err("unsupported dmabuf operation\n"); > + > + return -EINVAL; > +} > + > +static const struct file_operations intel_vgpu_dmabuf_mgr_fd_ops = { > + .release = intel_vgpu_dmabuf_mgr_fd_release, > + .unlocked_ioctl = intel_vgpu_dmabuf_mgr_fd_ioctl, > + .mmap = intel_vgpu_dmabuf_mgr_fd_mmap, > + .llseek = noop_llseek, > +}; > static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev) > { > struct intel_vgpu *vgpu = NULL; > @@ -1259,6 +1379,30 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd, > } else if (cmd == VFIO_DEVICE_RESET) { > intel_gvt_ops->vgpu_reset(vgpu); > return 0; > + } else if (cmd == VFIO_DEVICE_GET_FD) { > + int fd; > + u32 type; > + int ret; > + > + if (copy_from_user(&type, (void __user *)arg, sizeof(type))) > + return -EINVAL; > + if (type != VFIO_DEVICE_DMABUF_MGR_FD) > + return -EINVAL; > + > + ret = kvmgt_get_vfio_device(vgpu); > + if (ret != 0) > + return ret; > + > + fd = anon_inode_getfd("intel-vgpu-dmabuf-mgr-fd", > + &intel_vgpu_dmabuf_mgr_fd_ops, > + vgpu, O_RDWR | O_CLOEXEC); > + if (fd < 0) { > + gvt_vgpu_err("create dmabuf mgr fd failed\n"); > + return -EINVAL; Error path leaks vfio_device reference. > + } > + vgpu->dmabuf_mgr_fd = fd; As above, unclear value of this field, additionally, what if the user calls VFIO_DEVICE_GET_FD more than once? > + > + return fd; > } > > return 0; > diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c > index 6e3cbd8..af6fc74 100644 > --- a/drivers/gpu/drm/i915/gvt/vgpu.c > +++ b/drivers/gpu/drm/i915/gvt/vgpu.c > @@ -346,6 +346,7 @@ static struct intel_vgpu *__intel_gvt_create_vgpu(struct intel_gvt *gvt, > vgpu->gvt = gvt; > vgpu->sched_ctl.weight = param->weight; > bitmap_zero(vgpu->tlb_handle_pending, I915_NUM_ENGINES); > + INIT_LIST_HEAD(&vgpu->dmabuf_obj_list_head); > > intel_vgpu_init_cfg_space(vgpu, param->primary); >