dri-devel March 2020

dri-devel@lists.freedesktop.org

328 participants
771 discussions

[PATCH] vgacon: Fix a UAF in vgacon_invert_region
by Zhang Xiaoxu 04 Mar '20

04 Mar '20

When syzkaller tests, there is a UAF: BUG: KASan: use after free in vgacon_invert_region+0x9d/0x110 at addr ffff880000100000 Read of size 2 by task syz-executor.1/16489 page:ffffea0000004000 count:0 mapcount:-127 mapping: (null) index:0x0 page flags: 0xfffff00000000() page dumped because: kasan: bad access detected CPU: 1 PID: 16489 Comm: syz-executor.1 Not tainted Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-… [View More]project.org 04/01/2014 Call Trace: [<ffffffffb119f309>] dump_stack+0x1e/0x20 [<ffffffffb04af957>] kasan_report+0x577/0x950 [<ffffffffb04ae652>] __asan_load2+0x62/0x80 [<ffffffffb090f26d>] vgacon_invert_region+0x9d/0x110 [<ffffffffb0a39d95>] invert_screen+0xe5/0x470 [<ffffffffb0a21dcb>] set_selection+0x44b/0x12f0 [<ffffffffb0a3bfae>] tioclinux+0xee/0x490 [<ffffffffb0a1d114>] vt_ioctl+0xff4/0x2670 [<ffffffffb0a0089a>] tty_ioctl+0x46a/0x1a10 [<ffffffffb052db3d>] do_vfs_ioctl+0x5bd/0xc40 [<ffffffffb052e2f2>] SyS_ioctl+0x132/0x170 [<ffffffffb11c9b1b>] system_call_fastpath+0x22/0x27 Memory state around the buggy address: ffff8800000fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800000fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff880000100000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff It can be reproduce in the linux mainline by the program: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/ioctl.h> #include <linux/vt.h> struct tiocl_selection { unsigned short xs; /* X start */ unsigned short ys; /* Y start */ unsigned short xe; /* X end */ unsigned short ye; /* Y end */ unsigned short sel_mode; /* selection mode */ }; #define TIOCL_SETSEL 2 struct tiocl { unsigned char type; unsigned char pad; struct tiocl_selection sel; }; int main() { int fd = 0; const char *dev = "/dev/char/4:1"; struct vt_consize v = {0}; struct tiocl tioc = {0}; fd = open(dev, O_RDWR, 0); v.v_rows = 3346; ioctl(fd, VT_RESIZEX, &v); tioc.type = TIOCL_SETSEL; ioctl(fd, TIOCLINUX, &tioc); return 0; } When resize the screen, update the 'vc->vc_size_row' to the new_row_size, but when 'set_origin' in 'vgacon_set_origin', vgacon use 'vga_vram_base' for 'vc_origin' and 'vc_visible_origin', not 'vc_screenbuf'. It maybe smaller than 'vc_screenbuf'. When TIOCLINUX, use the new_row_size to calc the offset, it maybe larger than the vga_vram_base in vgacon driver, then bad access. So, If the screen size larger than vga_vram, resize screen should be failed. This alse fix CVE-2020-8649 Fixes: 0aec4867dca14 ("[PATCH] SVGATextMode fix") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/video/console/vgacon.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c index de7b8382aba9..9c216f707629 100644 --- a/drivers/video/console/vgacon.c +++ b/drivers/video/console/vgacon.c @@ -1316,7 +1316,10 @@ static int vgacon_font_get(struct vc_data *c, struct console_font *font) static int vgacon_resize(struct vc_data *c, unsigned int width, unsigned int height, unsigned int user) { - if (width % 2 || width > screen_info.orig_video_cols || + if (width % 2 || width * height > vga_vram_size) + return -EINVAL; + + if (width > screen_info.orig_video_cols || height > (screen_info.orig_video_lines * vga_default_font_height)/ c->vc_font.height) /* let svgatextmode tinker with video timings and -- 2.17.2 [View Less]

3 4

[PATCH] drm/bochs: Remove vga write
by Alistair Francis 04 Mar '20

04 Mar '20

The QEMU model for the Bochs display has no VGA memory section at offset 0x400 [1]. By writing to this register Linux can create a write to unassigned memory which depending on machine and architecture can result in a store fault. I don't see any reference to this address at OSDev [2] or in the Bochs source code. Removing this write still allows graphics to work inside QEMU with the bochs-display. 1: https://gitlab.com/qemu-project/qemu/-/blob/master/hw/display/bochs-display… 2. https://… [View More]

3 4

[PATCH 1/2] trace: Export anonymous tracing
by Chris Wilson 03 Mar '20

03 Mar '20

To facilitate construction of per-client event ringbuffers, in particular for a per-client debug and error report log, it would be extremely useful to create an anonymous file that can be handed to userspace so that it can see its and only its events. trace already provides a means of encapsulating the trace ringbuffer into a struct file that can be opened via the tracefs, and so with a couple of minor tweaks can provide the same access via an anonymous inode. Signed-off-by: Chris Wilson <… [View More]chris(a)chris-wilson.co.uk> Cc: Steven Rostedt (VMware) <rostedt(a)goodmis.org> --- include/linux/trace.h | 4 ++ kernel/trace/trace.c | 142 ++++++++++++++++++++++++++++++------------ 2 files changed, 105 insertions(+), 41 deletions(-) diff --git a/include/linux/trace.h b/include/linux/trace.h index 7fd86d3c691f..337454e859f4 100644 --- a/include/linux/trace.h +++ b/include/linux/trace.h @@ -30,8 +30,12 @@ void trace_printk_init_buffers(void); int trace_array_printk(struct trace_array *tr, unsigned long ip, const char *fmt, ...); void trace_array_put(struct trace_array *tr); +struct trace_array *trace_array_create(void); struct trace_array *trace_array_get_by_name(const char *name); int trace_array_destroy(struct trace_array *tr); + +int anon_trace_getfd(const char *name, struct trace_array *tr); + #endif /* CONFIG_TRACING */ #endif /* _LINUX_TRACE_H */ diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index cf2e87b8cab1..792d7f2b86c1 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -48,6 +48,7 @@ #include <linux/fsnotify.h> #include <linux/irq_work.h> #include <linux/workqueue.h> +#include <linux/anon_inodes.h> #include "trace.h" #include "trace_output.h" @@ -4162,7 +4163,7 @@ static int s_show(struct seq_file *m, void *v) */ static inline int tracing_get_cpu(struct inode *inode) { - if (inode->i_cdev) /* See trace_create_cpu_file() */ + if (inode && inode->i_cdev) /* See trace_create_cpu_file() */ return (long)inode->i_cdev - 1; return RING_BUFFER_ALL_CPUS; } @@ -5974,32 +5975,22 @@ tracing_max_lat_write(struct file *filp, const char __user *ubuf, #endif -static int tracing_open_pipe(struct inode *inode, struct file *filp) +static struct trace_iterator * +tracing_create_pipe_iter(struct trace_array *tr, struct inode *inode) { - struct trace_array *tr = inode->i_private; struct trace_iterator *iter; - int ret; - - ret = tracing_check_open_get_tr(tr); - if (ret) - return ret; - - mutex_lock(&trace_types_lock); /* create a buffer to store the information to pass to userspace */ iter = kzalloc(sizeof(*iter), GFP_KERNEL); - if (!iter) { - ret = -ENOMEM; - __trace_array_put(tr); - goto out; - } + if (!iter) + return ERR_PTR(-ENOMEM); trace_seq_init(&iter->seq); iter->trace = tr->current_trace; if (!alloc_cpumask_var(&iter->started, GFP_KERNEL)) { - ret = -ENOMEM; - goto fail; + kfree(iter); + return ERR_PTR(-ENOMEM); } /* trace pipe does not show start of buffer */ @@ -6016,6 +6007,29 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp) iter->array_buffer = &tr->array_buffer; iter->cpu_file = tracing_get_cpu(inode); mutex_init(&iter->mutex); + + return iter; +} + +static int tracing_open_pipe(struct inode *inode, struct file *filp) +{ + struct trace_array *tr = inode->i_private; + struct trace_iterator *iter; + int ret; + + ret = tracing_check_open_get_tr(tr); + if (ret) + return ret; + + mutex_lock(&trace_types_lock); + + iter = tracing_create_pipe_iter(tr, inode); + if (IS_ERR(iter)) { + ret = PTR_ERR(iter); + __trace_array_put(tr); + goto out; + } + filp->private_data = iter; if (iter->trace->pipe_open) @@ -6027,18 +6041,12 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp) out: mutex_unlock(&trace_types_lock); return ret; - -fail: - kfree(iter); - __trace_array_put(tr); - mutex_unlock(&trace_types_lock); - return ret; } static int tracing_release_pipe(struct inode *inode, struct file *file) { struct trace_iterator *iter = file->private_data; - struct trace_array *tr = inode->i_private; + struct trace_array *tr = iter->tr; mutex_lock(&trace_types_lock); @@ -7904,7 +7912,7 @@ static inline __init int register_snapshot_cmd(void) { return 0; } static struct dentry *tracing_get_dentry(struct trace_array *tr) { - if (WARN_ON(!tr->dir)) + if (!tr->dir) return ERR_PTR(-ENODEV); /* Top directory uses NULL as the parent */ @@ -8525,7 +8533,7 @@ struct trace_array *trace_array_find_get(const char *instance) return tr; } -static struct trace_array *trace_array_create(const char *name) +static struct trace_array *__trace_array_create(const char *name) { struct trace_array *tr; int ret; @@ -8535,9 +8543,11 @@ static struct trace_array *trace_array_create(const char *name) if (!tr) return ERR_PTR(ret); - tr->name = kstrdup(name, GFP_KERNEL); - if (!tr->name) - goto out_free_tr; + if (name) { + tr->name = kstrdup(name, GFP_KERNEL); + if (!tr->name) + goto out_free_tr; + } if (!alloc_cpumask_var(&tr->tracing_cpumask, GFP_KERNEL)) goto out_free_tr; @@ -8560,19 +8570,22 @@ static struct trace_array *trace_array_create(const char *name) if (allocate_trace_buffers(tr, trace_buf_size) < 0) goto out_free_tr; - tr->dir = tracefs_create_dir(name, trace_instance_dir); - if (!tr->dir) - goto out_free_tr; + if (name) { + tr->dir = tracefs_create_dir(name, trace_instance_dir); + if (!tr->dir) + goto out_free_tr; - ret = event_trace_add_tracer(tr->dir, tr); - if (ret) { - tracefs_remove(tr->dir); - goto out_free_tr; + ret = event_trace_add_tracer(tr->dir, tr); + if (ret) { + tracefs_remove(tr->dir); + goto out_free_tr; + } + + init_tracer_tracefs(tr, tr->dir); } ftrace_init_trace_array(tr); - init_tracer_tracefs(tr, tr->dir); init_trace_flags_index(tr); __update_tracer_options(tr); @@ -8580,7 +8593,6 @@ static struct trace_array *trace_array_create(const char *name) tr->ref++; - return tr; out_free_tr: @@ -8592,6 +8604,12 @@ static struct trace_array *trace_array_create(const char *name) return ERR_PTR(ret); } +struct trace_array *trace_array_create(void) +{ + return __trace_array_create(NULL); +} +EXPORT_SYMBOL_GPL(trace_array_create); + static int instance_mkdir(const char *name) { struct trace_array *tr; @@ -8604,7 +8622,7 @@ static int instance_mkdir(const char *name) if (trace_array_find(name)) goto out_unlock; - tr = trace_array_create(name); + tr = __trace_array_create(name); ret = PTR_ERR_OR_ZERO(tr); @@ -8642,7 +8660,7 @@ struct trace_array *trace_array_get_by_name(const char *name) goto out_unlock; } - tr = trace_array_create(name); + tr = __trace_array_create(name); if (IS_ERR(tr)) tr = NULL; @@ -8677,7 +8695,8 @@ static int __remove_instance(struct trace_array *tr) event_trace_del_tracer(tr); ftrace_clear_pids(tr); ftrace_destroy_function_files(tr); - tracefs_remove(tr->dir); + if (tr->dir) + tracefs_remove(tr->dir); free_trace_buffers(tr); for (i = 0; i < tr->nr_topts; i++) { @@ -9220,6 +9239,47 @@ void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) } EXPORT_SYMBOL_GPL(ftrace_dump); +int anon_trace_getfd(const char *name, struct trace_array *tr) +{ + struct trace_iterator *iter; + int ret; + + if (!tr || trace_array_get(tr) < 0) + return -ENODEV; + + mutex_lock(&trace_types_lock); + + iter = tracing_create_pipe_iter(tr, NULL); + if (IS_ERR(iter)) { + ret = PTR_ERR(iter); + __trace_array_put(tr); + goto out; + } + + ret = anon_inode_getfd(name, &tracing_pipe_fops, iter, O_CLOEXEC); + if (ret < 0) + goto fail; + + if (iter->trace->pipe_open) + iter->trace->pipe_open(iter); + + tr->current_trace->ref++; +out: + mutex_unlock(&trace_types_lock); + return ret; + +fail: + mutex_unlock(&trace_types_lock); + + free_cpumask_var(iter->started); + mutex_destroy(&iter->mutex); + kfree(iter); + + trace_array_put(tr); + return ret; +} +EXPORT_SYMBOL_GPL(anon_trace_getfd); + int trace_run_command(const char *buf, int (*createfn)(int, char **)) { char **argv; -- 2.25.1 [View Less]

4 8

[PATCH v2 0/3] drm/dp, i915: eDP DPCD backlight control detection fixes
by Lyude Paul 03 Mar '20

03 Mar '20

Unfortunately, it turned out that the DPCD is also not a reliable way of probing for DPCD backlight support as some panels will lie and say they have DPCD backlight controls when they don't actually. So, revert back to the old behavior and add a bunch of EDID-based DP quirks for the panels that we know need this. As you might have already guessed, OUI quirks didn't seem to be a very safe bet for these panels due to them not having their device IDs filled out. Lyude Paul (3): drm/dp: … [View More]

2 6

[PATCH v2] nouveau/hmm: map pages after migration
by Ralph Campbell 03 Mar '20

03 Mar '20

When memory is migrated to the GPU, it is likely to be accessed by GPU code soon afterwards. Instead of waiting for a GPU fault, map the migrated memory into the GPU page tables with the same access permissions as the source CPU page table entries. This preserves copy on write semantics. Signed-off-by: Ralph Campbell <rcampbell(a)nvidia.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: Jason Gunthorpe <jgg(a)mellanox.com> Cc: "Jérôme Glisse" <jglisse(a)redhat.com> Cc: Ben … [View More]Skeggs <bskeggs(a)redhat.com> --- Originally this patch was targeted for Jason's rdma tree since other HMM related changes were queued there. Now that those have been merged, this patch just contains changes to nouveau so it could go through any tree. I guess Ben Skeggs' tree would be appropriate. Changes since v1: Rebase to linux-5.6.0-rc4 Address Christoph Hellwig's comments drivers/gpu/drm/nouveau/nouveau_dmem.c | 44 ++++++++----- drivers/gpu/drm/nouveau/nouveau_svm.c | 85 ++++++++++++++++++++++++++ drivers/gpu/drm/nouveau/nouveau_svm.h | 5 ++ 3 files changed, 118 insertions(+), 16 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_dmem.c b/drivers/gpu/drm/nouveau/nouveau_dmem.c index 0ad5d87b5a8e..172e0c98cec5 100644 --- a/drivers/gpu/drm/nouveau/nouveau_dmem.c +++ b/drivers/gpu/drm/nouveau/nouveau_dmem.c @@ -25,11 +25,13 @@ #include "nouveau_dma.h" #include "nouveau_mem.h" #include "nouveau_bo.h" +#include "nouveau_svm.h" #include <nvif/class.h> #include <nvif/object.h> #include <nvif/if500b.h> #include <nvif/if900b.h> +#include <nvif/if000c.h> #include <linux/sched/mm.h> #include <linux/hmm.h> @@ -558,10 +560,11 @@ nouveau_dmem_init(struct nouveau_drm *drm) } static unsigned long nouveau_dmem_migrate_copy_one(struct nouveau_drm *drm, - unsigned long src, dma_addr_t *dma_addr) + unsigned long src, dma_addr_t *dma_addr, u64 *pfn) { struct device *dev = drm->dev->dev; struct page *dpage, *spage; + unsigned long paddr; spage = migrate_pfn_to_page(src); if (!spage || !(src & MIGRATE_PFN_MIGRATE)) @@ -569,17 +572,21 @@ static unsigned long nouveau_dmem_migrate_copy_one(struct nouveau_drm *drm, dpage = nouveau_dmem_page_alloc_locked(drm); if (!dpage) - return 0; + goto out; *dma_addr = dma_map_page(dev, spage, 0, PAGE_SIZE, DMA_BIDIRECTIONAL); if (dma_mapping_error(dev, *dma_addr)) goto out_free_page; + paddr = nouveau_dmem_page_addr(dpage); if (drm->dmem->migrate.copy_func(drm, 1, NOUVEAU_APER_VRAM, - nouveau_dmem_page_addr(dpage), NOUVEAU_APER_HOST, - *dma_addr)) + paddr, NOUVEAU_APER_HOST, *dma_addr)) goto out_dma_unmap; + *pfn = NVIF_VMM_PFNMAP_V0_V | NVIF_VMM_PFNMAP_V0_VRAM | + ((paddr >> PAGE_SHIFT) << NVIF_VMM_PFNMAP_V0_ADDR_SHIFT); + if (src & MIGRATE_PFN_WRITE) + *pfn |= NVIF_VMM_PFNMAP_V0_W; return migrate_pfn(page_to_pfn(dpage)) | MIGRATE_PFN_LOCKED; out_dma_unmap: @@ -587,18 +594,19 @@ static unsigned long nouveau_dmem_migrate_copy_one(struct nouveau_drm *drm, out_free_page: nouveau_dmem_page_free_locked(drm, dpage); out: + *pfn = NVIF_VMM_PFNMAP_V0_NONE; return 0; } static void nouveau_dmem_migrate_chunk(struct nouveau_drm *drm, - struct migrate_vma *args, dma_addr_t *dma_addrs) + struct migrate_vma *args, dma_addr_t *dma_addrs, u64 *pfns) { struct nouveau_fence *fence; unsigned long addr = args->start, nr_dma = 0, i; for (i = 0; addr < args->end; i++) { args->dst[i] = nouveau_dmem_migrate_copy_one(drm, args->src[i], - dma_addrs + nr_dma); + dma_addrs + nr_dma, pfns + i); if (args->dst[i]) nr_dma++; addr += PAGE_SIZE; @@ -607,15 +615,12 @@ static void nouveau_dmem_migrate_chunk(struct nouveau_drm *drm, nouveau_fence_new(drm->dmem->migrate.chan, false, &fence); migrate_vma_pages(args); nouveau_dmem_fence_done(&fence); + nouveau_pfns_map(drm, args->vma->vm_mm, args->start, pfns, i); while (nr_dma--) { dma_unmap_page(drm->dev->dev, dma_addrs[nr_dma], PAGE_SIZE, DMA_BIDIRECTIONAL); } - /* - * FIXME optimization: update GPU page table to point to newly migrated - * memory. - */ migrate_vma_finalize(args); } @@ -632,7 +637,8 @@ nouveau_dmem_migrate_vma(struct nouveau_drm *drm, .vma = vma, .start = start, }; - unsigned long c, i; + unsigned long i; + u64 *pfns; int ret = -ENOMEM; args.src = kcalloc(max, sizeof(*args.src), GFP_KERNEL); @@ -646,19 +652,25 @@ nouveau_dmem_migrate_vma(struct nouveau_drm *drm, if (!dma_addrs) goto out_free_dst; - for (i = 0; i < npages; i += c) { - c = min(SG_MAX_SINGLE_ALLOC, npages); - args.end = start + (c << PAGE_SHIFT); + pfns = nouveau_pfns_alloc(max); + if (!pfns) + goto out_free_dma; + + for (i = 0; i < npages; i += max) { + args.end = start + (max << PAGE_SHIFT); ret = migrate_vma_setup(&args); if (ret) - goto out_free_dma; + goto out_free_pfns; if (args.cpages) - nouveau_dmem_migrate_chunk(drm, &args, dma_addrs); + nouveau_dmem_migrate_chunk(drm, &args, dma_addrs, + pfns); args.start = args.end; } ret = 0; +out_free_pfns: + nouveau_pfns_free(pfns); out_free_dma: kfree(dma_addrs); out_free_dst: diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c index df9bf1fd1bc0..8c629918a3c6 100644 --- a/drivers/gpu/drm/nouveau/nouveau_svm.c +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c @@ -70,6 +70,12 @@ struct nouveau_svm { #define SVM_DBG(s,f,a...) NV_DEBUG((s)->drm, "svm: "f"\n", ##a) #define SVM_ERR(s,f,a...) NV_WARN((s)->drm, "svm: "f"\n", ##a) +struct nouveau_pfnmap_args { + struct nvif_ioctl_v0 i; + struct nvif_ioctl_mthd_v0 m; + struct nvif_vmm_pfnmap_v0 p; +}; + struct nouveau_ivmm { struct nouveau_svmm *svmm; u64 inst; @@ -782,6 +788,85 @@ nouveau_svm_fault(struct nvif_notify *notify) return NVIF_NOTIFY_KEEP; } +static inline struct nouveau_pfnmap_args * +nouveau_pfns_to_args(void *pfns) +{ + struct nvif_vmm_pfnmap_v0 *p = + container_of(pfns, struct nvif_vmm_pfnmap_v0, phys); + + return container_of(p, struct nouveau_pfnmap_args, p); +} + +u64 * +nouveau_pfns_alloc(unsigned long npages) +{ + struct nouveau_pfnmap_args *args; + + args = kzalloc(struct_size(args, p.phys, npages), GFP_KERNEL); + if (!args) + return NULL; + + args->i.type = NVIF_IOCTL_V0_MTHD; + args->m.method = NVIF_VMM_V0_PFNMAP; + args->p.page = PAGE_SHIFT; + + return args->p.phys; +} + +void +nouveau_pfns_free(u64 *pfns) +{ + struct nouveau_pfnmap_args *args = nouveau_pfns_to_args(pfns); + + kfree(args); +} + +static struct nouveau_svmm * +nouveau_find_svmm(struct nouveau_svm *svm, struct mm_struct *mm) +{ + struct nouveau_ivmm *ivmm; + + list_for_each_entry(ivmm, &svm->inst, head) { + if (ivmm->svmm->notifier.mm == mm) + return ivmm->svmm; + } + return NULL; +} + +void +nouveau_pfns_map(struct nouveau_drm *drm, struct mm_struct *mm, + unsigned long addr, u64 *pfns, unsigned long npages) +{ + struct nouveau_svm *svm = drm->svm; + struct nouveau_svmm *svmm; + struct nouveau_pfnmap_args *args; + int ret; + + if (!svm) + return; + + mutex_lock(&svm->mutex); + svmm = nouveau_find_svmm(svm, mm); + if (!svmm) { + mutex_unlock(&svm->mutex); + return; + } + mutex_unlock(&svm->mutex); + + args = nouveau_pfns_to_args(pfns); + args->p.addr = addr; + args->p.size = npages << PAGE_SHIFT; + + mutex_lock(&svmm->mutex); + + svmm->vmm->vmm.object.client->super = true; + ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) + + npages * sizeof(args->p.phys[0]), NULL); + svmm->vmm->vmm.object.client->super = false; + + mutex_unlock(&svmm->mutex); +} + static void nouveau_svm_fault_buffer_fini(struct nouveau_svm *svm, int id) { diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.h b/drivers/gpu/drm/nouveau/nouveau_svm.h index e839d8189461..0649f8d587a8 100644 --- a/drivers/gpu/drm/nouveau/nouveau_svm.h +++ b/drivers/gpu/drm/nouveau/nouveau_svm.h @@ -18,6 +18,11 @@ void nouveau_svmm_fini(struct nouveau_svmm **); int nouveau_svmm_join(struct nouveau_svmm *, u64 inst); void nouveau_svmm_part(struct nouveau_svmm *, u64 inst); int nouveau_svmm_bind(struct drm_device *, void *, struct drm_file *); + +u64 *nouveau_pfns_alloc(unsigned long npages); +void nouveau_pfns_free(u64 *pfns); +void nouveau_pfns_map(struct nouveau_drm *drm, struct mm_struct *mm, + unsigned long addr, u64 *pfns, unsigned long npages); #else /* IS_ENABLED(CONFIG_DRM_NOUVEAU_SVM) */ static inline void nouveau_svm_init(struct nouveau_drm *drm) {} static inline void nouveau_svm_fini(struct nouveau_drm *drm) {} -- 2.20.1 [View Less]

2 2

[PATCH v5 0/9] Huge page-table entries for TTM
by Thomas Hellström (VMware) 03 Mar '20

03 Mar '20

In order to reduce CPU usage [1] and in theory TLB misses this patchset enables huge- and giant page-table entries for TTM and TTM-enabled graphics drivers. Patch 1 and 2 introduce a vma_is_special_huge() function to make the mm code take the same path as DAX when splitting huge- and giant page table entries, (which currently means zapping the page-table entry and rely on re-faulting). Patch 3 makes the mm code split existing huge page-table entries on huge_fault fallbacks. Typically on COW … [View More]or on buffer-objects that want write-notify. COW and write-notification is always done on the lowest page-table level. See the patch log message for additional considerations. Patch 4 introduces functions to allow the graphics drivers to manipulate the caching- and encryption flags of huge page-table entries without ugly hacks. Patch 5 implements the huge_fault handler in TTM. This enables huge page-table entries, provided that the kernel is configured to support transhuge pages, either by default or using madvise(). However, they are unlikely to be inserted unless the kernel buffer object pfns and user-space addresses align perfectly. There are various options here, but since buffer objects that reside in system pages typically start at huge page boundaries if they are backed by huge pages, we try to enforce buffer object starting pfns and user-space addresses to be huge page-size aligned if their size exceeds a huge page-size. If pud-size transhuge ("giant") pages are enabled by the arch, the same holds for those. Patch 6 implements a specialized huge_fault handler for vmwgfx. The vmwgfx driver may perform dirty-tracking and needs some special code to handle that correctly. Patch 7 implements a drm helper to align user-space addresses according to the above scheme, if possible. Patch 8 implements a TTM range manager for vmwgfx that does the same for graphics IO memory. This may later be reused by other graphics drivers if necessary. Patch 9 finally hooks up the helpers of patch 7 and 8 to the vmwgfx driver. A similar change is needed for graphics drivers that want a reasonable likelyhood of actually using huge page-table entries. If a buffer object size is not huge-page or giant-page aligned, its size will NOT be inflated by this patchset. This means that the buffer object tail will use smaller size page-table entries and thus no memory overhead occurs. Drivers that want to pay the memory overhead price need to implement their own scheme to inflate buffer-object sizes. PMD size huge page-table-entries have been tested with vmwgfx and found to work well both with system memory backed and IO memory backed buffer objects. PUD size giant page-table-entries have seen limited (fault and COW) testing using a modified kernel (to support 1GB page allocations) and a fake vmwgfx TTM memory type. The vmwgfx driver does otherwise not support 1GB-size IO memory resources. Comments and suggestions welcome. Thomas Changes since RFC: * Check for buffer objects present in contigous IO Memory (Christian König) * Rebased on the vmwgfx emulated coherent memory functionality. That rebase adds patch 5. Changes since v1: * Make the new TTM range manager vmwgfx-specific. (Christian König) * Minor fixes for configs that don't support or only partially support transhuge pages. Changes since v2: * Minor coding style and doc fixes in patch 5/9 (Christian König) * Patch 5/9 doesn't touch mm. Remove from the patch title. Changes since v3: * Added reviews and acks * Implemented ugly but generic ttm_pgprot_is_wrprotecting() instead of arch specific code. Changes since v4: * Added timings (Andrew Morton) * Updated function documentation (Andrew Morton) [1] The below test program generates the following gnu time output when run on a vmwgfx-enabled kernel without the patch series: 4.78user 6.02system 0:10.91elapsed 99%CPU (0avgtext+0avgdata 1624maxresident)k 0inputs+0outputs (0major+640077minor)pagefaults 0swaps and with the patch series: 1.71user 3.60system 0:05.40elapsed 98%CPU (0avgtext+0avgdata 1656maxresident)k 0inputs+0outputs (0major+20079minor)pagefaults 0swaps A consistent number of reduced graphics page-faults can be seen with normal graphics applications, but due to the aggressive buffer object caching in vmwgfx user-space drivers the CPU time reduction is within the error marginal. #include <unistd.h> #include <string.h> #include <sys/mman.h> #include <xf86drm.h> static void checkerr(int ret, const char *name) { if (ret < 0) { perror(name); exit(-1); } } int main(int agc, const char *argv[]) { struct drm_mode_create_dumb c_arg = {0}; struct drm_mode_map_dumb m_arg = {0}; struct drm_mode_destroy_dumb d_arg = {0}; int ret, i, fd; void *map; fd = open("/dev/dri/card0", O_RDWR); checkerr(fd, argv[0]); for (i = 0; i < 10000; ++i) { c_arg.bpp = 32; c_arg.width = 1024; c_arg.height = 1024; ret = drmIoctl(fd, DRM_IOCTL_MODE_CREATE_DUMB, &c_arg); checkerr(fd, argv[0]); m_arg.handle = c_arg.handle; ret = drmIoctl(fd, DRM_IOCTL_MODE_MAP_DUMB, &m_arg); checkerr(fd, argv[0]); map = mmap(NULL, c_arg.size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, m_arg.offset); checkerr(map == MAP_FAILED ? -1 : 0, argv[0]); (void) madvise((void *) map, c_arg.size, MADV_HUGEPAGE); memset(map, 0x67, c_arg.size); munmap(map, c_arg.size); d_arg.handle = c_arg.handle; ret = drmIoctl(fd, DRM_IOCTL_MODE_DESTROY_DUMB, &d_arg); checkerr(ret, argv[0]); } close(fd); } Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Michal Hocko <mhocko(a)suse.com> Cc: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> Cc: Ralph Campbell <rcampbell(a)nvidia.com> Cc: "Jérôme Glisse" <jglisse(a)redhat.com> Cc: "Christian König" <christian.koenig(a)amd.com> Cc: Dan Williams <dan.j.williams(a)intel.com> [View Less]

2 10

[PATCH v3 0/5] dt-bindings: convert timing + panel-dpi to DT schema
by Sam Ravnborg 03 Mar '20

03 Mar '20

This set of patches convert display-timing.txt to DT schema. To do that add a panel-timing.yaml file that include all the panel-timing properties and use this in panel-common and in display-timings. panel-dpi was also converted so we have no .txt users left of panel-timing in panel/ Everything passed dt_binding_check - and the trivial errors I tried in the examples was all catched during validation. This work was triggered by a patch-set from Oleksandr Suvorov aiming at updating panel-lvds … [View More]

5 17

[PATCH] drm/amd/display: dcn20: remove an unused function
by Melissa Wen 03 Mar '20

03 Mar '20

The dpp2_get_optimal_number_of_taps function is never used. Removing just for code cleaning up. Signed-off-by: Melissa Wen <melissa.srw(a)gmail.com> --- .../gpu/drm/amd/display/dc/dcn20/dcn20_dpp.c | 78 ------------------- 1 file changed, 78 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dpp.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dpp.c index 13e057d7ee93..42bba7c9548b 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dpp.c +++ b/drivers/gpu/drm/amd/… [View More]display/dc/dcn20/dcn20_dpp.c @@ -369,84 +369,6 @@ void dpp2_set_cursor_attributes( } } -#define IDENTITY_RATIO(ratio) (dc_fixpt_u3d19(ratio) == (1 << 19)) - -bool dpp2_get_optimal_number_of_taps( - struct dpp *dpp, - struct scaler_data *scl_data, - const struct scaling_taps *in_taps) -{ - /* Some ASICs does not support FP16 scaling, so we reject modes require this*/ - if (scl_data->viewport.width != scl_data->h_active && - scl_data->viewport.height != scl_data->v_active && - dpp->caps->dscl_data_proc_format == DSCL_DATA_PRCESSING_FIXED_FORMAT && - scl_data->format == PIXEL_FORMAT_FP16) - return false; - - if (scl_data->viewport.width > scl_data->h_active && - dpp->ctx->dc->debug.max_downscale_src_width != 0 && - scl_data->viewport.width > dpp->ctx->dc->debug.max_downscale_src_width) - return false; - - /* TODO: add lb check */ - - /* No support for programming ratio of 8, drop to 7.99999.. */ - if (scl_data->ratios.horz.value == (8ll << 32)) - scl_data->ratios.horz.value--; - if (scl_data->ratios.vert.value == (8ll << 32)) - scl_data->ratios.vert.value--; - if (scl_data->ratios.horz_c.value == (8ll << 32)) - scl_data->ratios.horz_c.value--; - if (scl_data->ratios.vert_c.value == (8ll << 32)) - scl_data->ratios.vert_c.value--; - - /* Set default taps if none are provided */ - if (in_taps->h_taps == 0) { - if (dc_fixpt_ceil(scl_data->ratios.horz) > 4) - scl_data->taps.h_taps = 8; - else - scl_data->taps.h_taps = 4; - } else - scl_data->taps.h_taps = in_taps->h_taps; - if (in_taps->v_taps == 0) { - if (dc_fixpt_ceil(scl_data->ratios.vert) > 4) - scl_data->taps.v_taps = 8; - else - scl_data->taps.v_taps = 4; - } else - scl_data->taps.v_taps = in_taps->v_taps; - if (in_taps->v_taps_c == 0) { - if (dc_fixpt_ceil(scl_data->ratios.vert_c) > 4) - scl_data->taps.v_taps_c = 4; - else - scl_data->taps.v_taps_c = 2; - } else - scl_data->taps.v_taps_c = in_taps->v_taps_c; - if (in_taps->h_taps_c == 0) { - if (dc_fixpt_ceil(scl_data->ratios.horz_c) > 4) - scl_data->taps.h_taps_c = 4; - else - scl_data->taps.h_taps_c = 2; - } else if ((in_taps->h_taps_c % 2) != 0 && in_taps->h_taps_c != 1) - /* Only 1 and even h_taps_c are supported by hw */ - scl_data->taps.h_taps_c = in_taps->h_taps_c - 1; - else - scl_data->taps.h_taps_c = in_taps->h_taps_c; - - if (!dpp->ctx->dc->debug.always_scale) { - if (IDENTITY_RATIO(scl_data->ratios.horz)) - scl_data->taps.h_taps = 1; - if (IDENTITY_RATIO(scl_data->ratios.vert)) - scl_data->taps.v_taps = 1; - if (IDENTITY_RATIO(scl_data->ratios.horz_c)) - scl_data->taps.h_taps_c = 1; - if (IDENTITY_RATIO(scl_data->ratios.vert_c)) - scl_data->taps.v_taps_c = 1; - } - - return true; -} - void oppn20_dummy_program_regamma_pwl( struct dpp *dpp, const struct pwl_params *params, -- 2.25.1 [View Less]

2 1

[PATCH 0/9] drm: drm_fb_helper cleanup.
by Pankaj Bharadiya 03 Mar '20

03 Mar '20

This series addresses below drm_fb_helper tasks from Documentation/gpu/todo.rst. - The max connector argument for drm_fb_helper_init() isn't used anymore and can be removed. - The helper doesn't keep an array of connectors anymore so these can be removed: drm_fb_helper_single_add_all_connectors(), drm_fb_helper_add_one_connector() and drm_fb_helper_remove_one_connector(). Pankaj Bharadiya (9): drm: Remove unused arg from drm_fb_helper_init drm/radeon: remove radeon_fb_{add,remove}… [View More]

7 24

[PATCH 1/2] dt-bindings: gpu: mali-bifrost: Add Rockchip PX30 compatible
by Miquel Raynal 03 Mar '20

03 Mar '20

Rockchip PX30 SoCs feature a Bifrost Mali GPU. Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> --- Documentation/devicetree/bindings/gpu/arm,mali-bifrost.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/Documentation/devicetree/bindings/gpu/arm,mali-bifrost.yaml b/Documentation/devicetree/bindings/gpu/arm,mali-bifrost.yaml index 5f1fd6d7ee0f..283ee0c274d1 100644 --- a/Documentation/devicetree/bindings/gpu/arm,mali-bifrost.yaml +++ b/Documentation/devicetree/bindings/… [View More]

2 4

← Newer
1
...
67
68
69
70
71
72
73
...
78
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

dri-devel March 2020