Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751162AbdFBDYk convert rfc822-to-8bit (ORCPT ); Thu, 1 Jun 2017 23:24:40 -0400 Received: from mga04.intel.com ([192.55.52.120]:29693 "EHLO mga04.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751120AbdFBDYj (ORCPT ); Thu, 1 Jun 2017 23:24:39 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.39,283,1493708400"; d="scan'208";a="1177303191" From: "Chen, Xiaoguang" To: Alex Williamson CC: "kraxel@redhat.com" , "chris@chris-wilson.co.uk" , "intel-gfx@lists.freedesktop.org" , "linux-kernel@vger.kernel.org" , "zhenyuw@linux.intel.com" , "Lv, Zhiyuan" , "intel-gvt-dev@lists.freedesktop.org" , "Wang, Zhi A" , "Tian, Kevin" Subject: RE: [PATCH v6 6/6] drm/i915/gvt: Adding interface so user space can get the dma-buf Thread-Topic: [PATCH v6 6/6] drm/i915/gvt: Adding interface so user space can get the dma-buf Thread-Index: AQHS1sTjDVt2qF3L0keVbZ8anq02C6IP0HMAgAEcHXA= Date: Fri, 2 Jun 2017 03:24:35 +0000 Message-ID: References: <1495874332-2851-1-git-send-email-xiaoguang.chen@intel.com> <1495874332-2851-7-git-send-email-xiaoguang.chen@intel.com> <20170601120820.3358f7dd@w520.home> In-Reply-To: <20170601120820.3358f7dd@w520.home> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 10.0.102.7 dlp-reaction: no-action x-originating-ip: [10.239.127.40] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 10885 Lines: 336 Hi Alex, >-----Original Message----- >From: Alex Williamson [mailto:alex.williamson@redhat.com] >Sent: Friday, June 02, 2017 2:08 AM >To: Chen, Xiaoguang >Cc: kraxel@redhat.com; chris@chris-wilson.co.uk; intel- >gfx@lists.freedesktop.org; linux-kernel@vger.kernel.org; >zhenyuw@linux.intel.com; Lv, Zhiyuan ; intel-gvt- >dev@lists.freedesktop.org; Wang, Zhi A ; Tian, Kevin > >Subject: Re: [PATCH v6 6/6] drm/i915/gvt: Adding interface so user space can get >the dma-buf > >On Sat, 27 May 2017 16:38:52 +0800 >Xiaoguang Chen wrote: > >> User space should create the management fd for the dma-buf operation first. >> Then user can query the plane information and create dma-buf if >> necessary using the management fd. >> >> Signed-off-by: Xiaoguang Chen >> --- >> drivers/gpu/drm/i915/gvt/dmabuf.c | 12 ++++ >> drivers/gpu/drm/i915/gvt/dmabuf.h | 5 ++ >> drivers/gpu/drm/i915/gvt/gvt.c | 2 + >> drivers/gpu/drm/i915/gvt/gvt.h | 5 ++ >> drivers/gpu/drm/i915/gvt/kvmgt.c | 144 >++++++++++++++++++++++++++++++++++++++ >> drivers/gpu/drm/i915/gvt/vgpu.c | 1 + >> 6 files changed, 169 insertions(+) >> >> diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c >> b/drivers/gpu/drm/i915/gvt/dmabuf.c >> index c831e91..9759e9a 100644 >> --- a/drivers/gpu/drm/i915/gvt/dmabuf.c >> +++ b/drivers/gpu/drm/i915/gvt/dmabuf.c >> @@ -226,6 +226,7 @@ int intel_vgpu_create_dmabuf(struct intel_vgpu *vgpu, >void *args) >> struct vfio_vgpu_dmabuf_info *gvt_dmabuf = args; >> struct intel_vgpu_fb_info *fb_info; >> int ret; >> + struct intel_vgpu_dmabuf_obj *dmabuf_obj; >> >> ret = intel_vgpu_get_plane_info(dev, vgpu, &gvt_dmabuf->plane_info); >> if (ret != 0) >> @@ -263,6 +264,17 @@ int intel_vgpu_create_dmabuf(struct intel_vgpu *vgpu, >void *args) >> gvt_vgpu_err("create dma-buf fd failed ret:%d\n", ret); >> return ret; >> } >> + dmabuf_obj = kmalloc(sizeof(*dmabuf_obj), GFP_KERNEL); >> + if (dmabuf_obj == NULL) { >> + kfree(fb_info); >> + i915_gem_object_put(obj); >> + gvt_vgpu_err("alloc dmabuf_obj failed\n"); >> + return -ENOMEM; >> + } >> + dmabuf_obj->obj = obj; >> + INIT_LIST_HEAD(&dmabuf_obj->list); >> + list_add_tail(&dmabuf_obj->list, &vgpu->dmabuf_obj_list_head); >> + >> gvt_dmabuf->fd = ret; >> >> return 0; >> diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.h >> b/drivers/gpu/drm/i915/gvt/dmabuf.h >> index 8be9979..cafa781 100644 >> --- a/drivers/gpu/drm/i915/gvt/dmabuf.h >> +++ b/drivers/gpu/drm/i915/gvt/dmabuf.h >> @@ -31,6 +31,11 @@ struct intel_vgpu_fb_info { >> uint32_t fb_size; >> }; >> >> +struct intel_vgpu_dmabuf_obj { >> + struct drm_i915_gem_object *obj; >> + struct list_head list; >> +}; >> + >> int intel_vgpu_query_plane(struct intel_vgpu *vgpu, void *args); int >> intel_vgpu_create_dmabuf(struct intel_vgpu *vgpu, void *args); >> >> diff --git a/drivers/gpu/drm/i915/gvt/gvt.c >> b/drivers/gpu/drm/i915/gvt/gvt.c index 2032917..dbc3f86 100644 >> --- a/drivers/gpu/drm/i915/gvt/gvt.c >> +++ b/drivers/gpu/drm/i915/gvt/gvt.c >> @@ -54,6 +54,8 @@ static const struct intel_gvt_ops intel_gvt_ops = { >> .vgpu_reset = intel_gvt_reset_vgpu, >> .vgpu_activate = intel_gvt_activate_vgpu, >> .vgpu_deactivate = intel_gvt_deactivate_vgpu, >> + .vgpu_query_plane = intel_vgpu_query_plane, >> + .vgpu_create_dmabuf = intel_vgpu_create_dmabuf, >> }; >> >> /** >> diff --git a/drivers/gpu/drm/i915/gvt/gvt.h >> b/drivers/gpu/drm/i915/gvt/gvt.h index 763a8c5..a855797 100644 >> --- a/drivers/gpu/drm/i915/gvt/gvt.h >> +++ b/drivers/gpu/drm/i915/gvt/gvt.h >> @@ -185,8 +185,11 @@ struct intel_vgpu { >> struct kvm *kvm; >> struct work_struct release_work; >> atomic_t released; >> + struct vfio_device *vfio_device; >> } vdev; >> #endif >> + int dmabuf_mgr_fd; >> + struct list_head dmabuf_obj_list_head; >> }; >> >> struct intel_gvt_gm { >> @@ -467,6 +470,8 @@ struct intel_gvt_ops { >> void (*vgpu_reset)(struct intel_vgpu *); >> void (*vgpu_activate)(struct intel_vgpu *); >> void (*vgpu_deactivate)(struct intel_vgpu *); >> + int (*vgpu_query_plane)(struct intel_vgpu *vgpu, void *); >> + int (*vgpu_create_dmabuf)(struct intel_vgpu *vgpu, void *); >> }; >> >> >> diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c >> b/drivers/gpu/drm/i915/gvt/kvmgt.c >> index 389f072..a079080 100644 >> --- a/drivers/gpu/drm/i915/gvt/kvmgt.c >> +++ b/drivers/gpu/drm/i915/gvt/kvmgt.c >> @@ -41,6 +41,7 @@ >> #include >> #include >> #include >> +#include >> >> #include "i915_drv.h" >> #include "gvt.h" >> @@ -524,6 +525,125 @@ static int intel_vgpu_reg_init_opregion(struct >intel_vgpu *vgpu) >> return ret; >> } >> >> +static int kvmgt_get_vfio_device(struct intel_vgpu *vgpu) { >> + struct vfio_device *device; >> + >> + device = vfio_device_get_from_dev(mdev_dev(vgpu->vdev.mdev)); >> + if (device == NULL) >> + return -ENODEV; >> + vgpu->vdev.vfio_device = device; >> + >> + return 0; >> +} >> + >> +static void kvmgt_put_vfio_device(struct intel_vgpu *vgpu) { >> + vfio_device_put(vgpu->vdev.vfio_device); >> +} >> + >> +static int intel_vgpu_dmabuf_mgr_fd_mmap(struct file *file, >> + struct vm_area_struct *vma) >> +{ >> + return -EPERM; >> +} >> + >> +static int intel_vgpu_dmabuf_mgr_fd_release(struct inode *inode, >> + struct file *filp) >> +{ >> + struct intel_vgpu *vgpu = filp->private_data; >> + struct intel_vgpu_dmabuf_obj *obj; >> + struct list_head *pos; >> + >> + if (WARN_ON(!vgpu->vdev.vfio_device)) >> + return -ENODEV; >> + >> + list_for_each(pos, &vgpu->dmabuf_obj_list_head) { >> + obj = container_of(pos, struct intel_vgpu_dmabuf_obj, list); >> + if (WARN_ON(!obj)) >> + return -ENODEV; >> + kfree(obj->obj->gvt_info); >> + i915_gem_object_put(obj->obj); >> + kfree(obj); >> + kvmgt_put_vfio_device(vgpu); > >Can we do this? If I understand, we're releasing all the references and allocations >for the dmabuf fds on release of the manager fd. What happens if the user >continues trying to access those dmabuf fds after this? I think we can do this here. The dma-buf's release function dma_buf_release() will be called by kernel which means all the created dmabufs will be invalid even we do not release all the references and allocations here. > >> + } >> + kvmgt_put_vfio_device(vgpu); >> + >> + return 0; >> +} >> + >> +static long intel_vgpu_dmabuf_mgr_fd_ioctl(struct file *filp, >> + unsigned int ioctl, unsigned long arg) { >> + struct intel_vgpu *vgpu = filp->private_data; >> + int minsz; >> + int ret; >> + struct fd f; >> + >> + f = fdget(vgpu->dmabuf_mgr_fd); >> + if (!f.file) >> + return -EBADF; >> + >> + if (ioctl == VFIO_DEVICE_QUERY_PLANE) { >> + struct vfio_vgpu_plane_info info; >> + >> + minsz = offsetofend(struct vfio_vgpu_plane_info, resv); >> + if (copy_from_user(&info, (void __user *)arg, minsz)) { >> + fdput(f); >> + return -EFAULT; >> + } >> + if (info.argsz < minsz) { >> + fdput(f); >> + return -EINVAL; >> + } >> + ret = intel_gvt_ops->vgpu_query_plane(vgpu, &info); >> + if (ret != 0) { >> + fdput(f); >> + gvt_vgpu_err("query plane failed:%d\n", ret); >> + return -EINVAL; >> + } >> + fdput(f); >> + return copy_to_user((void __user *)arg, &info, minsz) ? >> + -EFAULT : 0; >> + } else if (ioctl == VFIO_DEVICE_CREATE_DMABUF) { >> + struct vfio_vgpu_dmabuf_info dmabuf; >> + >> + minsz = offsetofend(struct vfio_vgpu_dmabuf_info, resv); >> + if (copy_from_user(&dmabuf, (void __user *)arg, minsz)) { >> + fdput(f); >> + return -EFAULT; >> + } >> + if (dmabuf.argsz < minsz) { >> + fdput(f); >> + return -EINVAL; >> + } >> + ret = kvmgt_get_vfio_device(vgpu); >> + if (ret != 0) >> + return ret; > >Missed an fdput, though I'm not sure I understand the value of the original fdget >or the dmabuf_mgr_fd field at all. dmabuf_mgr_fd is only used here, presumably >to add a reference to the fd while we're in the ioctl, but we're in the ioctl function >of that fd, so I think there are already references elsewhere. Make sense. Fdget/fdput can be removed. > >> + >> + ret = intel_gvt_ops->vgpu_create_dmabuf(vgpu, &dmabuf); >> + if (ret != 0) { >> + kvmgt_put_vfio_device(vgpu); >> + fdput(f); >> + return -EINVAL; > >Why not return the errno that vgpu_create_dmabuf provided? Will change to use the returned errno. > >> + } >> + fdput(f); >> + return copy_to_user((void __user *)arg, &dmabuf, minsz) ? >> + -EFAULT : 0; >> + } >> + >> + fdput(f); >> + gvt_vgpu_err("unsupported dmabuf operation\n"); >> + >> + return -EINVAL; >> +} >> + >> +static const struct file_operations intel_vgpu_dmabuf_mgr_fd_ops = { >> + .release = intel_vgpu_dmabuf_mgr_fd_release, >> + .unlocked_ioctl = intel_vgpu_dmabuf_mgr_fd_ioctl, >> + .mmap = intel_vgpu_dmabuf_mgr_fd_mmap, >> + .llseek = noop_llseek, >> +}; >> static int intel_vgpu_create(struct kobject *kobj, struct mdev_device >> *mdev) { >> struct intel_vgpu *vgpu = NULL; >> @@ -1259,6 +1379,30 @@ static long intel_vgpu_ioctl(struct mdev_device >*mdev, unsigned int cmd, >> } else if (cmd == VFIO_DEVICE_RESET) { >> intel_gvt_ops->vgpu_reset(vgpu); >> return 0; >> + } else if (cmd == VFIO_DEVICE_GET_FD) { >> + int fd; >> + u32 type; >> + int ret; >> + >> + if (copy_from_user(&type, (void __user *)arg, sizeof(type))) >> + return -EINVAL; >> + if (type != VFIO_DEVICE_DMABUF_MGR_FD) >> + return -EINVAL; >> + >> + ret = kvmgt_get_vfio_device(vgpu); >> + if (ret != 0) >> + return ret; >> + >> + fd = anon_inode_getfd("intel-vgpu-dmabuf-mgr-fd", >> + &intel_vgpu_dmabuf_mgr_fd_ops, >> + vgpu, O_RDWR | O_CLOEXEC); >> + if (fd < 0) { >> + gvt_vgpu_err("create dmabuf mgr fd failed\n"); >> + return -EINVAL; > >Error path leaks vfio_device reference. Will correct in the next version. > >> + } >> + vgpu->dmabuf_mgr_fd = fd; > >As above, unclear value of this field, additionally, what if the user calls >VFIO_DEVICE_GET_FD more than once? Ah, good question. VFIO_DEVICE_GET_FD should only be called once. And we should add a check if the vgpu->dmabuf_mgr_fd is not 0 which means VFIO_DEVICE_GET_FD had been called before we should return an error. > >> + >> + return fd; >> } >> >> return 0; >> diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c >> b/drivers/gpu/drm/i915/gvt/vgpu.c index 6e3cbd8..af6fc74 100644 >> --- a/drivers/gpu/drm/i915/gvt/vgpu.c >> +++ b/drivers/gpu/drm/i915/gvt/vgpu.c >> @@ -346,6 +346,7 @@ static struct intel_vgpu >*__intel_gvt_create_vgpu(struct intel_gvt *gvt, >> vgpu->gvt = gvt; >> vgpu->sched_ctl.weight = param->weight; >> bitmap_zero(vgpu->tlb_handle_pending, I915_NUM_ENGINES); >> + INIT_LIST_HEAD(&vgpu->dmabuf_obj_list_head); >> >> intel_vgpu_init_cfg_space(vgpu, param->primary); >>