* Re: [PATCH v3 03/23] drm/qxl: simplify slot management
From: Noralf Trønnes @ 2019-01-25 15:52 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-4-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> Drop pointless indirection, remove the mem_slots array and index
> variables, drop dynamic allocation. Store memslots in qxl_device
> instead.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Looks sane:
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 04/23] drm/qxl: change the way slot is detected
From: Noralf Trønnes @ 2019-01-25 15:52 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Frediano Ziglio
In-Reply-To: <20190118122020.27596-5-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> From: Frediano Ziglio <fziglio@redhat.com>
>
> Instead of relaying on surface type use the actual placement.
> This allow to have different placement for a single type of
> surface.
>
> Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
>
> [ kraxel: rebased, adapted to upstream changes ]
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 05/23] drm/qxl: drop unused fields from struct qxl_device
From: Noralf Trønnes @ 2019-01-25 15:53 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-6-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> slot_id_bits and slot_gen_bits can be read directly from qxlrom instead.
> va_slot_mask is never used anywhere.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 06/23] drm/qxl: use separate offset spaces for the two slots / ttm memory types.
From: Noralf Trønnes @ 2019-01-25 15:57 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-7-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> Without that ttm offsets are not unique, they can refer to objects
> in both VRAM and PRIV memory (aka main and surfaces slot).
>
> One of those "why things didn't blow up without this" moments.
> Probably offset conflicts are rare enough by pure luck.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 07/23] drm/qxl: allow both PRIV and VRAM placement for QXL_GEM_DOMAIN_SURFACE
From: Noralf Trønnes @ 2019-01-25 15:58 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-8-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> qxl surfaces (used for framebuffers and gem objects) can live in both
> VRAM and PRIV ttm domains. Update placement setup to include both.
> Put PRIV first in the list so it is preferred, so VRAM will have more
> room for objects which must be allocated there.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 08/23] drm/qxl: use QXL_GEM_DOMAIN_SURFACE for shadow bo.
From: Noralf Trønnes @ 2019-01-25 15:58 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-9-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> The shadow bo is used as qxl surface, so allocate it as
> QXL_GEM_DOMAIN_SURFACE. Should usually be allocated in
> PRIV ttm domain then, so this reduces VRAM memory pressure.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 09/23] drm/qxl: use QXL_GEM_DOMAIN_SURFACE for dumb gem objects
From: Noralf Trønnes @ 2019-01-25 15:59 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-10-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> dumb buffers are used as qxl surfaces, so allocate them as
> QXL_GEM_DOMAIN_SURFACE. Should usually be allocated in
> PRIV ttm domain then, so this reduces VRAM memory pressure.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 10/23] drm/qxl: move qxl_primary_apply_cursor to correct place
From: Noralf Trønnes @ 2019-01-25 16:09 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-11-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> The cursor must be set again after creating the primary surface.
> Also drop the error message.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
> drivers/gpu/drm/qxl/qxl_display.c | 10 +++-------
> 1 file changed, 3 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
> index 86bfc19bea..1b700ef503 100644
> --- a/drivers/gpu/drm/qxl/qxl_display.c
> +++ b/drivers/gpu/drm/qxl/qxl_display.c
> @@ -533,7 +533,6 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
> .x2 = plane->state->fb->width,
> .y2 = plane->state->fb->height
> };
> - int ret;
> bool same_shadow = false;
>
> if (old_state->fb) {
> @@ -554,16 +553,13 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
> if (!same_shadow)
> qxl_io_destroy_primary(qdev);
> bo_old->is_primary = false;
> -
> - ret = qxl_primary_apply_cursor(plane);
> - if (ret)
> - DRM_ERROR(
> - "could not set cursor after creating primary");
> }
>
> if (!bo->is_primary) {
> - if (!same_shadow)
> + if (!same_shadow) {
> qxl_io_create_primary(qdev, 0, bo);
> + qxl_primary_apply_cursor(plane);
> + }
> bo->is_primary = true;
> }
>
>
I don't see how the commit message matches what you're doing. It gives
the impression that it must be applied under yet another condition, but
the condition for applying the cursor is changed from bo_old->is_primary
to !bo->is_primary.
It probably makes sense to someone that knows the driver.
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 11/23] drm/qxl: drop unused offset parameter from qxl_io_create_primary()
From: Noralf Trønnes @ 2019-01-25 16:10 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-12-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 12/23] drm/qxl: track primary bo
From: Noralf Trønnes @ 2019-01-25 16:11 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-13-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> Track which bo is used as primary surface. With that in place we don't
> need the primary_created flag any more, we can just check the primary bo
> pointer instead.
>
> Also verify we don't already have a primary surface in
> qxl_io_create_primary().
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 13/23] drm/qxl: use shadow bo directly
From: Noralf Trønnes @ 2019-01-25 16:59 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-14-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> Pass the shadow bo to qxl_io_create_primary() instead of expecting
> qxl_io_create_primary to check bo->shadow. Set is_primary flag on the
> shadow bo. Move the is_primary tracking into qxl_io_create_primary()
> and qxl_io_destroy_primary() functions.
>
> That simplifies primary surface tracking and the workflow in
> qxl_primary_atomic_update().
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
>
> qxl_io_create/destroy_primary: primary_bo tracking [fixup]
> ---
I'm unable to follow the logic, but I didn't spot anything suspicious
looking.
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 14/23] drm/qxl: cover all crtcs in shadow bo.
From: Noralf Trønnes @ 2019-01-25 17:08 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-15-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> The qxl device supports only a single active framebuffer ("primary
> surface" in spice terminology). In multihead configurations are handled
> by defining rectangles within the primary surface for each head/crtc.
>
> Userspace which uses the qxl ioctl interface (xorg qxl driver) is aware
> of this limitation and will setup framebuffers and crtcs accordingly.
>
> Userspace which uses dumb framebuffers (xorg modesetting driver,
> wayland) is not aware of this limitation and tries to use two
> framebuffers (one for each crtc) instead.
>
> The qxl kms driver already has the dumb bo separated from the primary
> surface, by using a (shared) shadow bo as primary surface. This is
> needed to support pageflips without having to re-create the primary
> surface. The qxl driver will blit from the dumb bo to the shadow bo
> instead.
>
> So we can extend the shadow logic: Maintain a global shadow bo (aka
> primary surface), make it big enough that dumb bo's for all crtcs fit in
> side-by-side. Adjust the pageflip blits to place the heads next to each
> other in the shadow.
>
> With this patch in place multihead qxl works with wayland.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
> drivers/gpu/drm/qxl/qxl_drv.h | 5 +-
> drivers/gpu/drm/qxl/qxl_display.c | 119 +++++++++++++++++++++++++++++---------
> drivers/gpu/drm/qxl/qxl_draw.c | 9 ++-
> 3 files changed, 104 insertions(+), 29 deletions(-)
>
> diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
> index 150b1a4f66..43c6df9cf9 100644
> --- a/drivers/gpu/drm/qxl/qxl_drv.h
> +++ b/drivers/gpu/drm/qxl/qxl_drv.h
> @@ -230,6 +230,8 @@ struct qxl_device {
> struct qxl_ram_header *ram_header;
>
> struct qxl_bo *primary_bo;
> + struct qxl_bo *dumb_shadow_bo;
> + struct qxl_head *dumb_heads;
>
> struct qxl_memslot main_slot;
> struct qxl_memslot surfaces_slot;
> @@ -437,7 +439,8 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev,
> struct qxl_bo *bo,
> unsigned int flags, unsigned int color,
> struct drm_clip_rect *clips,
> - unsigned int num_clips, int inc);
> + unsigned int num_clips, int inc,
> + uint32_t dumb_shadow_offset);
>
> void qxl_draw_fill(struct qxl_draw_fill *qxl_draw_fill_rec);
>
> diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
> index ff13bc6a4a..d9de43e5fd 100644
> --- a/drivers/gpu/drm/qxl/qxl_display.c
> +++ b/drivers/gpu/drm/qxl/qxl_display.c
> @@ -323,6 +323,8 @@ static void qxl_crtc_update_monitors_config(struct drm_crtc *crtc,
> head.y = crtc->y;
> if (qdev->monitors_config->count < i + 1)
> qdev->monitors_config->count = i + 1;
> + if (qdev->primary_bo == qdev->dumb_shadow_bo)
> + head.x += qdev->dumb_heads[i].x;
> } else if (i > 0) {
> head.width = 0;
> head.height = 0;
> @@ -426,7 +428,7 @@ static int qxl_framebuffer_surface_dirty(struct drm_framebuffer *fb,
> }
>
> qxl_draw_dirty_fb(qdev, fb, qobj, flags, color,
> - clips, num_clips, inc);
> + clips, num_clips, inc, 0);
>
> drm_modeset_unlock_all(fb->dev);
>
> @@ -535,6 +537,7 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
> .x2 = plane->state->fb->width,
> .y2 = plane->state->fb->height
> };
> + uint32_t dumb_shadow_offset = 0;
>
> if (old_state->fb) {
> bo_old = gem_to_qxl_bo(old_state->fb->obj[0]);
> @@ -551,7 +554,12 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
> qxl_primary_apply_cursor(plane);
> }
>
> - qxl_draw_dirty_fb(qdev, plane->state->fb, bo, 0, 0, &norect, 1, 1);
> + if (bo->is_dumb)
> + dumb_shadow_offset =
> + qdev->dumb_heads[plane->state->crtc->index].x;
> +
> + qxl_draw_dirty_fb(qdev, plane->state->fb, bo, 0, 0, &norect, 1, 1,
> + dumb_shadow_offset);
> }
>
> static void qxl_primary_atomic_disable(struct drm_plane *plane,
> @@ -707,12 +715,68 @@ static void qxl_cursor_atomic_disable(struct drm_plane *plane,
> qxl_release_fence_buffer_objects(release);
> }
>
> +static void qxl_update_dumb_head(struct qxl_device *qdev,
> + int index, struct qxl_bo *bo)
> +{
> + uint32_t width, height;
> +
> + if (index >= qdev->monitors_config->max_allowed)
> + return;
> +
> + if (bo && bo->is_dumb) {
> + width = bo->surf.width;
> + height = bo->surf.height;
> + } else {
> + width = 0;
> + height = 0;
> + }
> +
> + if (qdev->dumb_heads[index].width == width &&
> + qdev->dumb_heads[index].height == height)
> + return;
> +
> + DRM_DEBUG("#%d: %dx%d -> %dx%d\n", index,
> + qdev->dumb_heads[index].width,
> + qdev->dumb_heads[index].height,
> + width, height);
> + qdev->dumb_heads[index].width = width;
> + qdev->dumb_heads[index].height = height;
> +}
> +
> +static void qxl_calc_dumb_shadow(struct qxl_device *qdev,
> + struct qxl_surface *surf)
> +{
> + struct qxl_head *head;
> + int i;
> +
> + memset(surf, 0, sizeof(*surf));
> + for (i = 0; i < qdev->monitors_config->max_allowed; i++) {
> + head = qdev->dumb_heads + i;
> + head->x = surf->width;
> + surf->width += head->width;
> + if (surf->height < head->height)
> + surf->height = head->height;
> + }
> + if (surf->width < 64)
> + surf->width = 64;
> + if (surf->height < 64)
> + surf->height = 64;
> + surf->format = SPICE_SURFACE_FMT_32_xRGB;
> + surf->stride = surf->width * 4;
> +
> + if (!qdev->dumb_shadow_bo ||
> + qdev->dumb_shadow_bo->surf.width != surf->width ||
> + qdev->dumb_shadow_bo->surf.height != surf->height)
> + DRM_DEBUG("%dx%d\n", surf->width, surf->height);
> +}
> +
> static int qxl_plane_prepare_fb(struct drm_plane *plane,
> struct drm_plane_state *new_state)
> {
> struct qxl_device *qdev = plane->dev->dev_private;
> struct drm_gem_object *obj;
> - struct qxl_bo *user_bo, *old_bo = NULL;
> + struct qxl_bo *user_bo;
> + struct qxl_surface surf;
> int ret;
>
> if (!new_state->fb)
> @@ -722,29 +786,30 @@ static int qxl_plane_prepare_fb(struct drm_plane *plane,
> user_bo = gem_to_qxl_bo(obj);
>
> if (plane->type == DRM_PLANE_TYPE_PRIMARY &&
> - user_bo->is_dumb && !user_bo->shadow) {
> - if (plane->state->fb) {
> - obj = plane->state->fb->obj[0];
> - old_bo = gem_to_qxl_bo(obj);
> + user_bo->is_dumb) {
> + qxl_update_dumb_head(qdev, new_state->crtc->index,
> + user_bo);
> + qxl_calc_dumb_shadow(qdev, &surf);
> + if (!qdev->dumb_shadow_bo ||
> + qdev->dumb_shadow_bo->surf.width != surf.width ||
> + qdev->dumb_shadow_bo->surf.height != surf.height) {
> + if (qdev->dumb_shadow_bo) {
> + drm_gem_object_put_unlocked
> + (&qdev->dumb_shadow_bo->gem_base);
> + qdev->dumb_shadow_bo = NULL;
> + }
> + qxl_bo_create(qdev, surf.height * surf.stride,
> + true, true, QXL_GEM_DOMAIN_SURFACE, &surf,
> + &qdev->dumb_shadow_bo);
> }
> - if (old_bo && old_bo->shadow &&
> - user_bo->gem_base.size == old_bo->gem_base.size &&
> - plane->state->crtc == new_state->crtc &&
> - plane->state->crtc_w == new_state->crtc_w &&
> - plane->state->crtc_h == new_state->crtc_h &&
> - plane->state->src_x == new_state->src_x &&
> - plane->state->src_y == new_state->src_y &&
> - plane->state->src_w == new_state->src_w &&
> - plane->state->src_h == new_state->src_h &&
> - plane->state->rotation == new_state->rotation &&
> - plane->state->zpos == new_state->zpos) {
> - drm_gem_object_get(&old_bo->shadow->gem_base);
> - user_bo->shadow = old_bo->shadow;
> - } else {
> - qxl_bo_create(qdev, user_bo->gem_base.size,
> - true, true, QXL_GEM_DOMAIN_SURFACE, NULL,
> - &user_bo->shadow);
> - user_bo->shadow->surf = user_bo->surf;
> + if (user_bo->shadow != qdev->dumb_shadow_bo) {
> + if (user_bo->shadow) {
> + drm_gem_object_put_unlocked
> + (&user_bo->shadow->gem_base);
> + user_bo->shadow = NULL;
> + }
> + drm_gem_object_get(&qdev->dumb_shadow_bo->gem_base);
> + user_bo->shadow = qdev->dumb_shadow_bo;
> }
> }
>
> @@ -773,7 +838,7 @@ static void qxl_plane_cleanup_fb(struct drm_plane *plane,
> user_bo = gem_to_qxl_bo(obj);
> qxl_bo_unpin(user_bo);
>
> - if (user_bo->shadow && !user_bo->shadow->is_primary) {
> + if (old_state->fb != plane->state->fb && user_bo->shadow) {
> drm_gem_object_put_unlocked(&user_bo->shadow->gem_base);
> user_bo->shadow = NULL;
> }
> @@ -1106,6 +1171,8 @@ int qxl_create_monitors_object(struct qxl_device *qdev)
>
> memset(qdev->monitors_config, 0, monitors_config_size);
> qdev->monitors_config->max_allowed = max_allowed;
> +
> + qdev->dumb_heads = kcalloc(max_allowed, sizeof(qdev->dumb_heads[0]), GFP_KERNEL);
Needs an allocation failure check. With that:
Acked-by: Noralf Trønnes <noralf@tronnes.org>
> return 0;
> }
>
> diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c
> index c408bb83c7..5313ad21c1 100644
> --- a/drivers/gpu/drm/qxl/qxl_draw.c
> +++ b/drivers/gpu/drm/qxl/qxl_draw.c
> @@ -267,7 +267,8 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev,
> struct qxl_bo *bo,
> unsigned int flags, unsigned int color,
> struct drm_clip_rect *clips,
> - unsigned int num_clips, int inc)
> + unsigned int num_clips, int inc,
> + uint32_t dumb_shadow_offset)
> {
> /*
> * TODO: if flags & DRM_MODE_FB_DIRTY_ANNOTATE_FILL then we should
> @@ -295,6 +296,9 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev,
> if (ret)
> return;
>
> + clips->x1 += dumb_shadow_offset;
> + clips->x2 += dumb_shadow_offset;
> +
> left = clips->x1;
> right = clips->x2;
> top = clips->y1;
> @@ -342,7 +346,8 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev,
> goto out_release_backoff;
>
> ret = qxl_image_init(qdev, release, dimage, surface_base,
> - left, top, width, height, depth, stride);
> + left - dumb_shadow_offset,
> + top, width, height, depth, stride);
> qxl_bo_kunmap(bo);
> if (ret)
> goto out_release_backoff;
>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 15/23] drm/qxl: use qxl_num_crtc directly
From: Noralf Trønnes @ 2019-01-25 17:12 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-16-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> qdev->monitors_config->max_allowed is effectively set by the
> qxl.num_heads module parameter, stored in the qxl_num_crtc variable.
> Lets get rid of the indirection and use the variable qxl_num_crtc
> directly. The kernel doesn't need to dereference pointers each time it
> needs the value, and when reading the code you don't have to trace where
> and why qdev->monitors_config->max_allowed is set.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 16/23] drm/qxl: implement prime kmap/kunmap
From: Noralf Trønnes @ 2019-01-25 17:19 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-17-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> Generic fbdev emulation needs this. Also: We must keep track of the
> number of mappings now, so we don't unmap early in case two users want a
> kmap of the same bo. Add a sanity check to destroy callback to make
> sure kmap/kunmap is balanced.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Just a note: You catch the one-to-many kmap type of unbalance, but not
the one-too-many kunmap situation.
Acked-by: Noralf Trønnes <noralf@tronnes.org>
> drivers/gpu/drm/qxl/qxl_drv.h | 1 +
> drivers/gpu/drm/qxl/qxl_object.c | 6 ++++++
> drivers/gpu/drm/qxl/qxl_prime.c | 17 +++++++++++++----
> 3 files changed, 20 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
> index 43c6df9cf9..8c3af1cdbe 100644
> --- a/drivers/gpu/drm/qxl/qxl_drv.h
> +++ b/drivers/gpu/drm/qxl/qxl_drv.h
> @@ -84,6 +84,7 @@ struct qxl_bo {
> struct ttm_bo_kmap_obj kmap;
> unsigned int pin_count;
> void *kptr;
> + unsigned int map_count;
> int type;
>
> /* Constant after initialization */
> diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c
> index 024c8dd317..4928fa6029 100644
> --- a/drivers/gpu/drm/qxl/qxl_object.c
> +++ b/drivers/gpu/drm/qxl/qxl_object.c
> @@ -36,6 +36,7 @@ static void qxl_ttm_bo_destroy(struct ttm_buffer_object *tbo)
> qdev = (struct qxl_device *)bo->gem_base.dev->dev_private;
>
> qxl_surface_evict(qdev, bo, false);
> + WARN_ON_ONCE(bo->map_count > 0);
> mutex_lock(&qdev->gem.mutex);
> list_del_init(&bo->list);
> mutex_unlock(&qdev->gem.mutex);
> @@ -131,6 +132,7 @@ int qxl_bo_kmap(struct qxl_bo *bo, void **ptr)
> if (bo->kptr) {
> if (ptr)
> *ptr = bo->kptr;
> + bo->map_count++;
> return 0;
> }
> r = ttm_bo_kmap(&bo->tbo, 0, bo->tbo.num_pages, &bo->kmap);
> @@ -139,6 +141,7 @@ int qxl_bo_kmap(struct qxl_bo *bo, void **ptr)
> bo->kptr = ttm_kmap_obj_virtual(&bo->kmap, &is_iomem);
> if (ptr)
> *ptr = bo->kptr;
> + bo->map_count = 1;
> return 0;
> }
>
> @@ -180,6 +183,9 @@ void qxl_bo_kunmap(struct qxl_bo *bo)
> {
> if (bo->kptr == NULL)
> return;
> + bo->map_count--;
> + if (bo->map_count > 0)
> + return;
> bo->kptr = NULL;
> ttm_bo_kunmap(&bo->kmap);
> }
> diff --git a/drivers/gpu/drm/qxl/qxl_prime.c b/drivers/gpu/drm/qxl/qxl_prime.c
> index a55dece118..708378844c 100644
> --- a/drivers/gpu/drm/qxl/qxl_prime.c
> +++ b/drivers/gpu/drm/qxl/qxl_prime.c
> @@ -22,7 +22,7 @@
> * Authors: Andreas Pokorny
> */
>
> -#include "qxl_drv.h"
> +#include "qxl_object.h"
>
> /* Empty Implementations as there should not be any other driver for a virtual
> * device that might share buffers with qxl */
> @@ -54,13 +54,22 @@ struct drm_gem_object *qxl_gem_prime_import_sg_table(
>
> void *qxl_gem_prime_vmap(struct drm_gem_object *obj)
> {
> - WARN_ONCE(1, "not implemented");
> - return ERR_PTR(-ENOSYS);
> + struct qxl_bo *bo = gem_to_qxl_bo(obj);
> + void *ptr;
> + int ret;
> +
> + ret = qxl_bo_kmap(bo, &ptr);
> + if (ret < 0)
> + return ERR_PTR(ret);
> +
> + return ptr;
> }
>
> void qxl_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr)
> {
> - WARN_ONCE(1, "not implemented");
> + struct qxl_bo *bo = gem_to_qxl_bo(obj);
> +
> + qxl_bo_kunmap(bo);
> }
>
> int qxl_gem_prime_mmap(struct drm_gem_object *obj,
>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 17/23] drm/qxl: use generic fbdev emulation
From: Noralf Trønnes @ 2019-01-25 17:25 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-18-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> Switch qxl over to the new generic fbdev emulation.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
> drivers/gpu/drm/qxl/qxl_display.c | 7 -------
> drivers/gpu/drm/qxl/qxl_drv.c | 2 ++
> 2 files changed, 2 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
> index ef832f98ab..9c751f01e3 100644
> --- a/drivers/gpu/drm/qxl/qxl_display.c
> +++ b/drivers/gpu/drm/qxl/qxl_display.c
> @@ -1221,18 +1221,11 @@ int qxl_modeset_init(struct qxl_device *qdev)
> qxl_display_read_client_monitors_config(qdev);
>
> drm_mode_config_reset(&qdev->ddev);
> -
> - /* primary surface must be created by this point, to allow
> - * issuing command queue commands and having them read by
> - * spice server. */
> - qxl_fbdev_init(qdev);
> return 0;
> }
>
> void qxl_modeset_fini(struct qxl_device *qdev)
> {
> - qxl_fbdev_fini(qdev);
> -
> qxl_destroy_monitors_object(qdev);
> drm_mode_config_cleanup(&qdev->ddev);
> }
> diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c
> index 13c8a662f9..3fce7d16df 100644
> --- a/drivers/gpu/drm/qxl/qxl_drv.c
> +++ b/drivers/gpu/drm/qxl/qxl_drv.c
> @@ -93,6 +93,8 @@ qxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
> if (ret)
> goto modeset_cleanup;
>
> + drm_fb_helper_remove_conflicting_pci_framebuffers(pdev, 0, "qxl");
I couldn't find that this was part of old fbdev code, so it would be
nice to mention it in the commit message.
Acked-by: Noralf Trønnes <noralf@tronnes.org>
> + drm_fbdev_generic_setup(&qdev->ddev, 32);
> return 0;
>
> modeset_cleanup:
>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 18/23] drm/qxl: remove dead qxl fbdev emulation code
From: Noralf Trønnes @ 2019-01-25 17:25 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-19-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> Lovely diffstat, thanks to the new generic fbdev emulation.
>
> drm/qxl/Makefile | 2
> drm/qxl/qxl_draw.c | 232 ----------------------------------------
> drm/qxl/qxl_drv.h | 21 ---
> drm/qxl/qxl_fb.c | 300 -----------------------------------------------------
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
> drivers/gpu/drm/qxl/qxl_drv.h | 21 ---
> drivers/gpu/drm/qxl/qxl_draw.c | 232 -------------------------------
> drivers/gpu/drm/qxl/qxl_fb.c | 300 -----------------------------------------
> drivers/gpu/drm/qxl/Makefile | 2 +-
> 4 files changed, 1 insertion(+), 554 deletions(-)
> delete mode 100644 drivers/gpu/drm/qxl/qxl_fb.c
>
Nice!
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 19/23] drm/qxl: implement qxl_gem_prime_(un)pin
From: Noralf Trønnes @ 2019-01-25 17:26 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-20-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 20/23] drm/qxl: add mode/framebuffer check functions
From: Noralf Trønnes @ 2019-01-25 17:30 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-21-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> Add a helper functions to check video modes. Also add a helper to check
> framebuffer buffer objects, using the former for consistency. That way
> we should not fail in qxl_primary_atomic_check() because video modes
> which are too big will not be added to the mode list in the first place.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 21/23] drm/qxl: add qxl_add_mode helper function
From: Noralf Trønnes @ 2019-01-25 17:34 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-22-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> Add a helper function to add custom video modes to a connector.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 22/23] drm/qxl: use kernel mode db
From: Noralf Trønnes @ 2019-01-25 17:35 UTC (permalink / raw)
To: Gerd Hoffmann, dri-devel
Cc: David Airlie, open list:DRM DRIVER FOR QXL VIRTUAL GPU,
Dave Airlie, open list, open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190118122020.27596-23-kraxel@redhat.com>
Den 18.01.2019 13.20, skrev Gerd Hoffmann:
> Add all standard modes from the kernel's video mode data base.
> Keep a few non-standard modes in the qxl mode list.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
Acked-by: Noralf Trønnes <noralf@tronnes.org>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH v3 18/23] drm/qxl: remove dead qxl fbdev emulation code
From: Sam Ravnborg @ 2019-01-25 18:10 UTC (permalink / raw)
To: Noralf Trønnes
Cc: David Airlie, open list, dri-devel,
open list:DRM DRIVER FOR QXL VIRTUAL GPU, Dave Airlie,
open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <e5a15f7e-b3f1-b609-4a0f-bd66ea711951@tronnes.org>
Hi Noralf.
> > Lovely diffstat, thanks to the new generic fbdev emulation.
> >
> > drm/qxl/Makefile | 2
> > drm/qxl/qxl_draw.c | 232 ----------------------------------------
> > drm/qxl/qxl_drv.h | 21 ---
> > drm/qxl/qxl_fb.c | 300 -----------------------------------------------------
> >
> > Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> > ---
> > drivers/gpu/drm/qxl/qxl_drv.h | 21 ---
> > drivers/gpu/drm/qxl/qxl_draw.c | 232 -------------------------------
> > drivers/gpu/drm/qxl/qxl_fb.c | 300 -----------------------------------------
> > drivers/gpu/drm/qxl/Makefile | 2 +-
> > 4 files changed, 1 insertion(+), 554 deletions(-)
> > delete mode 100644 drivers/gpu/drm/qxl/qxl_fb.c
> >
>
> Nice!
>
> Acked-by: Noralf Trønnes <noralf@tronnes.org>
It must be a very satisfying experience to see such benefits
of the many hours of works you have put into the genric
fbdev emulation code.
Well done, and indeed a nice patch from Gerd.
Sam
^ permalink raw reply
* Re: [PATCH v3 18/23] drm/qxl: remove dead qxl fbdev emulation code
From: Noralf Trønnes @ 2019-01-25 18:44 UTC (permalink / raw)
To: Sam Ravnborg
Cc: David Airlie, open list, dri-devel,
open list:DRM DRIVER FOR QXL VIRTUAL GPU, Dave Airlie,
open list:DRM DRIVER FOR QXL VIRTUAL GPU
In-Reply-To: <20190125181009.GA8230@ravnborg.org>
Den 25.01.2019 19.10, skrev Sam Ravnborg:
> Hi Noralf.
>
>>> Lovely diffstat, thanks to the new generic fbdev emulation.
>>>
>>> drm/qxl/Makefile | 2
>>> drm/qxl/qxl_draw.c | 232 ----------------------------------------
>>> drm/qxl/qxl_drv.h | 21 ---
>>> drm/qxl/qxl_fb.c | 300 -----------------------------------------------------
>>>
>>> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
>>> ---
>>> drivers/gpu/drm/qxl/qxl_drv.h | 21 ---
>>> drivers/gpu/drm/qxl/qxl_draw.c | 232 -------------------------------
>>> drivers/gpu/drm/qxl/qxl_fb.c | 300 -----------------------------------------
>>> drivers/gpu/drm/qxl/Makefile | 2 +-
>>> 4 files changed, 1 insertion(+), 554 deletions(-)
>>> delete mode 100644 drivers/gpu/drm/qxl/qxl_fb.c
>>>
>>
>> Nice!
>>
>> Acked-by: Noralf Trønnes <noralf@tronnes.org>
> It must be a very satisfying experience to see such benefits
> of the many hours of works you have put into the genric
> fbdev emulation code.
Indeed and having more users of the code increases the chance of
detecting any bugs lurking underneath the surface.
> Well done, and indeed a nice patch from Gerd.
>
> Sam
>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply
* Re: [PATCH net-next V4 0/5] vhost: accelerate metadata access through vmap()
From: David Miller @ 2019-01-26 22:37 UTC (permalink / raw)
To: jasowang; +Cc: netdev, mst, linux-kernel, kvm, virtualization
In-Reply-To: <20190123095557.30168-1-jasowang@redhat.com>
From: Jason Wang <jasowang@redhat.com>
Date: Wed, 23 Jan 2019 17:55:52 +0800
> This series tries to access virtqueue metadata through kernel virtual
> address instead of copy_user() friends since they had too much
> overheads like checks, spec barriers or even hardware feature
> toggling.
>
> Test shows about 24% improvement on TX PPS. It should benefit other
> cases as well.
I've read over the discussion of patch #5 a few times.
And it seems to me that, at a minimum, a few things still need to
be resolved:
1) More perf data added to commit message.
2) Whether invalidate_range_start() and invalidate_range_end() must
be paired.
Etc. So I am marking this series "Changes Requested".
^ permalink raw reply
* Re: [PATCH net-next V4 0/5] vhost: accelerate metadata access through vmap()
From: Michael S. Tsirkin @ 2019-01-27 0:31 UTC (permalink / raw)
To: David Miller; +Cc: netdev, linux-kernel, kvm, virtualization
In-Reply-To: <20190126.143708.1203048880266877709.davem@davemloft.net>
On Sat, Jan 26, 2019 at 02:37:08PM -0800, David Miller wrote:
> From: Jason Wang <jasowang@redhat.com>
> Date: Wed, 23 Jan 2019 17:55:52 +0800
>
> > This series tries to access virtqueue metadata through kernel virtual
> > address instead of copy_user() friends since they had too much
> > overheads like checks, spec barriers or even hardware feature
> > toggling.
> >
> > Test shows about 24% improvement on TX PPS. It should benefit other
> > cases as well.
>
> I've read over the discussion of patch #5 a few times.
>
> And it seems to me that, at a minimum, a few things still need to
> be resolved:
>
> 1) More perf data added to commit message.
>
> 2) Whether invalidate_range_start() and invalidate_range_end() must
> be paired.
Add dirty tracking.
> Etc. So I am marking this series "Changes Requested".
^ permalink raw reply
* [PATCH net] vhost: fix OOB in get_rx_bufs()
From: Jason Wang @ 2019-01-28 7:05 UTC (permalink / raw)
To: mst, jasowang, stefanha; +Cc: netdev, linux-kernel, kvm, virtualization
After batched used ring updating was introduced in commit e2b3b35eb989
("vhost_net: batch used ring update in rx"). We tend to batch heads in
vq->heads for more than one packet. But the quota passed to
get_rx_bufs() was not correctly limited, which can result a OOB write
in vq->heads.
headcount = get_rx_bufs(vq, vq->heads + nvq->done_idx,
vhost_len, &in, vq_log, &log,
likely(mergeable) ? UIO_MAXIOV : 1);
UIO_MAXIOV was still used which is wrong since we could have batched
used in vq->heads, this will cause OOB if the next buffer needs more
than 960 (1024 (UIO_MAXIOV) - 64 (VHOST_NET_BATCH)) heads after we've
batched 64 (VHOST_NET_BATCH) heads:
=============================================================================
BUG kmalloc-8k (Tainted: G B ): Redzone overwritten
-----------------------------------------------------------------------------
INFO: 0x00000000fd93b7a2-0x00000000f0713384. First byte 0xa9 instead of 0xcc
INFO: Allocated in alloc_pd+0x22/0x60 age=3933677 cpu=2 pid=2674
kmem_cache_alloc_trace+0xbb/0x140
alloc_pd+0x22/0x60
gen8_ppgtt_create+0x11d/0x5f0
i915_ppgtt_create+0x16/0x80
i915_gem_create_context+0x248/0x390
i915_gem_context_create_ioctl+0x4b/0xe0
drm_ioctl_kernel+0xa5/0xf0
drm_ioctl+0x2ed/0x3a0
do_vfs_ioctl+0x9f/0x620
ksys_ioctl+0x6b/0x80
__x64_sys_ioctl+0x11/0x20
do_syscall_64+0x43/0xf0
entry_SYSCALL_64_after_hwframe+0x44/0xa9
INFO: Slab 0x00000000d13e87af objects=3 used=3 fp=0x (null) flags=0x200000000010201
INFO: Object 0x0000000003278802 @offset=17064 fp=0x00000000e2e6652b
Fixing this by allocating UIO_MAXIOV + VHOST_NET_BATCH iovs for
vhost-net. This is done through set the limitation through
vhost_dev_init(), then set_owner can allocate the number of iov in a
per device manner.
This fixes CVE-2018-16880.
Fixes: e2b3b35eb989 ("vhost_net: batch used ring update in rx")
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
drivers/vhost/net.c | 3 ++-
drivers/vhost/scsi.c | 2 +-
drivers/vhost/vhost.c | 7 ++++---
drivers/vhost/vhost.h | 4 +++-
drivers/vhost/vsock.c | 2 +-
5 files changed, 11 insertions(+), 7 deletions(-)
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index bca86bf7189f..df51a35cf537 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -1337,7 +1337,8 @@ static int vhost_net_open(struct inode *inode, struct file *f)
n->vqs[i].rx_ring = NULL;
vhost_net_buf_init(&n->vqs[i].rxq);
}
- vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
+ vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX,
+ UIO_MAXIOV + VHOST_NET_BATCH);
vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, EPOLLOUT, dev);
vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, EPOLLIN, dev);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 344684f3e2e4..23593cb23dd0 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1627,7 +1627,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
vqs[i] = &vs->vqs[i].vq;
vs->vqs[i].vq.handle_kick = vhost_scsi_handle_kick;
}
- vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ);
+ vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, UIO_MAXIOV);
vhost_scsi_init_inflight(vs, NULL);
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 15a216cdd507..24a129fcdd61 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -390,9 +390,9 @@ static long vhost_dev_alloc_iovecs(struct vhost_dev *dev)
vq->indirect = kmalloc_array(UIO_MAXIOV,
sizeof(*vq->indirect),
GFP_KERNEL);
- vq->log = kmalloc_array(UIO_MAXIOV, sizeof(*vq->log),
+ vq->log = kmalloc_array(dev->iov_limit, sizeof(*vq->log),
GFP_KERNEL);
- vq->heads = kmalloc_array(UIO_MAXIOV, sizeof(*vq->heads),
+ vq->heads = kmalloc_array(dev->iov_limit, sizeof(*vq->heads),
GFP_KERNEL);
if (!vq->indirect || !vq->log || !vq->heads)
goto err_nomem;
@@ -414,7 +414,7 @@ static void vhost_dev_free_iovecs(struct vhost_dev *dev)
}
void vhost_dev_init(struct vhost_dev *dev,
- struct vhost_virtqueue **vqs, int nvqs)
+ struct vhost_virtqueue **vqs, int nvqs, int iov_limit)
{
struct vhost_virtqueue *vq;
int i;
@@ -427,6 +427,7 @@ void vhost_dev_init(struct vhost_dev *dev,
dev->iotlb = NULL;
dev->mm = NULL;
dev->worker = NULL;
+ dev->iov_limit = iov_limit;
init_llist_head(&dev->work_list);
init_waitqueue_head(&dev->wait);
INIT_LIST_HEAD(&dev->read_list);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 1b675dad5e05..9490e7ddb340 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -170,9 +170,11 @@ struct vhost_dev {
struct list_head read_list;
struct list_head pending_list;
wait_queue_head_t wait;
+ int iov_limit;
};
-void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, int nvqs);
+void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs,
+ int nvqs, int iov_limit);
long vhost_dev_set_owner(struct vhost_dev *dev);
bool vhost_dev_has_owner(struct vhost_dev *dev);
long vhost_dev_check_owner(struct vhost_dev *);
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 3fbc068eaa9b..bb5fc0e9fbc2 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -531,7 +531,7 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file)
vsock->vqs[VSOCK_VQ_TX].handle_kick = vhost_vsock_handle_tx_kick;
vsock->vqs[VSOCK_VQ_RX].handle_kick = vhost_vsock_handle_rx_kick;
- vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs));
+ vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs), UIO_MAXIOV);
file->private_data = vsock;
spin_lock_init(&vsock->send_pkt_list_lock);
--
2.17.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox