search for: qxl_release

qxl expects that list_first_entry(release->bos) returns the first element qxl added to the list. ttm_eu_reserve_buffers() may reorder the list though. Add a release_bo field to struct qxl_release and use that instead. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 1 + drivers/gpu/drm/qxl/qxl_cmd.c | 6 ++---- drivers/gpu/drm/qxl/qxl_release.c | 12 ++++++------ 3 files changed, 9 insertions(+), 10 deletions(-) diff --git a/drivers...

s/PAGE_SIZE/PAGE_MASK/ Luckily release_offset is never larger than PAGE_SIZE, so the bug has no bad side effects and managed to stay unnoticed for years that way ... Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_ioctl.c | 4 ++-- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index e238a1a2ec..6cc9f3367f 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -182,9 +182,9 @@ static int qxl_process_s...

...s/gpu/drm/qxl/qxl_cmd.c | 5 - drivers/gpu/drm/qxl/qxl_debugfs.c | 12 ++- drivers/gpu/drm/qxl/qxl_drv.h | 22 ++--- drivers/gpu/drm/qxl/qxl_fence.c | 87 ------------------- drivers/gpu/drm/qxl/qxl_kms.c | 2 drivers/gpu/drm/qxl/qxl_object.c | 2 drivers/gpu/drm/qxl/qxl_release.c | 166 ++++++++++++++++++++++++++++++++----- drivers/gpu/drm/qxl/qxl_ttm.c | 97 ++++++++++++---------- 9 files changed, 220 insertions(+), 175 deletions(-) delete mode 100644 drivers/gpu/drm/qxl/qxl_fence.c diff --git a/drivers/gpu/drm/qxl/Makefile b/drivers/gpu/drm/qxl/Makefile index e...

On Wed, Apr 29, 2020 at 12:01:24PM +0300, Vasily Averin wrote: > qxl_release should not be accesses after qxl_push_*_ring_release() calls: > userspace driver can process submitted command quickly, move qxl_release > into release_ring, generate interrupt and trigger garbage collector. > > It can lead to crashes in qxl driver or trigger memory corruption > in...

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index 013b938986c7..f30460782f05 100644 --- a/drivers/gpu/drm/qxl/qxl_debugfs.c +++ b/drivers/gpu/drm/qxl/qxl_debugfs.c @@ -61,7 +61,7 @@ qxl_debugfs_bu...

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index 013b938986c7..f30460782f05 100644 --- a/drivers/gpu/drm/qxl/qxl_debugfs.c +++ b/drivers/gpu/drm/qxl/qxl_debugfs.c @@ -61,7 +61,7 @@ qxl_debugfs_bu...

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index bdb5ac0987ab..94439212a5c5 100644 --- a/drivers/gpu/drm/qxl/qxl_debugfs.c +++ b/drivers/gpu/drm/qxl/qxl_debugfs.c @@ -61,7 +61,7 @@ qxl_debugfs_bu...

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index bdb5ac0987ab..94439212a5c5 100644 --- a/drivers/gpu/drm/qxl/qxl_debugfs.c +++ b/drivers/gpu/drm/qxl/qxl_debugfs.c @@ -61,7 +61,7 @@ qxl_debugfs_bu...

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index bdb5ac0987ab..94439212a5c5 100644 --- a/drivers/gpu/drm/qxl/qxl_debugfs.c +++ b/drivers/gpu/drm/qxl/qxl_debugfs.c @@ -61,7 +61,7 @@ qxl_debugfs_bu...

...missing in the qxl driver somewhere, most likely in some error handling code path given that this bug is a relatively rare event. There is only a single ttm_eu_reserve_buffers() call in qxl. So how about this? ----------------------- cut here -------------------- diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 312216caeea2..2f9950fa0b8d 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -262,18 +262,20 @@ int qxl_release_reserve_list(struct qxl_release *release, bool no_intr) ret = ttm_eu_reserve_buffers(&release-&gt...

...at anholt.net> Reviewed-by: Eric Anholt <eric at anholt.net> Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch> Cc: Dave Airlie <airlied at redhat.com> Cc: Gerd Hoffmann <kraxel at redhat.com> Cc: virtualization at lists.linux-foundation.org --- drivers/gpu/drm/qxl/qxl_release.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 7cb214577275..e37f0097f744 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -50,12 +50,6 @@ static const char *qxl_get_tim...

...at anholt.net> Reviewed-by: Eric Anholt <eric at anholt.net> Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch> Cc: Dave Airlie <airlied at redhat.com> Cc: Gerd Hoffmann <kraxel at redhat.com> Cc: virtualization at lists.linux-foundation.org --- drivers/gpu/drm/qxl/qxl_release.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 7cb214577275..e37f0097f744 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -50,12 +50,6 @@ static const char *qxl_get_tim...

...at anholt.net> Reviewed-by: Eric Anholt <eric at anholt.net> Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch> Cc: Dave Airlie <airlied at redhat.com> Cc: Gerd Hoffmann <kraxel at redhat.com> Cc: virtualization at lists.linux-foundation.org --- drivers/gpu/drm/qxl/qxl_release.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c index 7cb214577275..e37f0097f744 100644 --- a/drivers/gpu/drm/qxl/qxl_release.c +++ b/drivers/gpu/drm/qxl/qxl_release.c @@ -50,12 +50,6 @@ static const char *qxl_get_tim...

On Mon, Apr 27, 2020 at 08:32:51AM +0300, Vasily Averin wrote: > Cc: stable at vger.kernel.org > Fixes: 8002db6336dd ("qxl: convert qxl driver to proper use for reservations") > Signed-off-by: Vasily Averin <vvs at virtuozzo.com> Both patches pushed to drm-misc-fixes. thanks, Gerd

...ders the list to keep track of what buffers are reserved, so previous members are always unreserved. This gets rid of some bookkeeping that's no longer needed, while simplifying the code some. Signed-off-by: Maarten Lankhorst <maarten.lankhorst at canonical.com> --- drivers/gpu/drm/qxl/qxl_release.c | 1 drivers/gpu/drm/ttm/ttm_execbuf_util.c | 142 +++++++++++-------------------- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 1 include/drm/ttm/ttm_execbuf_util.h | 3 - 4 files changed, 50 insertions(+), 97 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/dr...

...s/gpu/drm/qxl/qxl_object.h | 4 ++-- drivers/gpu/drm/qxl/qxl_cmd.c | 4 ++-- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_display.c | 8 ++++---- drivers/gpu/drm/qxl/qxl_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_object.c | 20 ++++++++++---------- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/qxl/qxl_ttm.c | 4 ++-- 9 files changed, 26 insertions(+), 26 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h index 2896bb6fdbf4..b80d4a4361cd 100644 --- a/drivers/gpu/drm/qxl/qxl_drv.h +++ b/drivers/gpu/drm/qxl/qxl_drv.h @@ -...

...s/gpu/drm/qxl/qxl_object.h | 4 ++-- drivers/gpu/drm/qxl/qxl_cmd.c | 4 ++-- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_display.c | 8 ++++---- drivers/gpu/drm/qxl/qxl_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_object.c | 20 ++++++++++---------- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/qxl/qxl_ttm.c | 4 ++-- 9 files changed, 26 insertions(+), 26 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h index 2896bb6fdbf4..b80d4a4361cd 100644 --- a/drivers/gpu/drm/qxl/qxl_drv.h +++ b/drivers/gpu/drm/qxl/qxl_drv.h @@ -...

...s/gpu/drm/qxl/qxl_object.h | 4 ++-- drivers/gpu/drm/qxl/qxl_cmd.c | 4 ++-- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_display.c | 8 ++++---- drivers/gpu/drm/qxl/qxl_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_object.c | 20 ++++++++++---------- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/qxl/qxl_ttm.c | 4 ++-- 9 files changed, 26 insertions(+), 26 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h index 2896bb6fdbf4..b80d4a4361cd 100644 --- a/drivers/gpu/drm/qxl/qxl_drv.h +++ b/drivers/gpu/drm/qxl/qxl_drv.h @@ -...

...s/gpu/drm/qxl/qxl_object.h | 4 ++-- drivers/gpu/drm/qxl/qxl_cmd.c | 4 ++-- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_display.c | 8 ++++---- drivers/gpu/drm/qxl/qxl_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_object.c | 20 ++++++++++---------- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/qxl/qxl_ttm.c | 4 ++-- 9 files changed, 26 insertions(+), 26 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h index ae82e5fab09c..9e034c5fa87d 100644 --- a/drivers/gpu/drm/qxl/qxl_drv.h +++ b/drivers/gpu/drm/qxl/qxl_drv.h @@ -...

...s/gpu/drm/qxl/qxl_object.h | 4 ++-- drivers/gpu/drm/qxl/qxl_cmd.c | 4 ++-- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_display.c | 8 ++++---- drivers/gpu/drm/qxl/qxl_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_object.c | 20 ++++++++++---------- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/qxl/qxl_ttm.c | 4 ++-- 9 files changed, 26 insertions(+), 26 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h index ae82e5fab09c..9e034c5fa87d 100644 --- a/drivers/gpu/drm/qxl/qxl_drv.h +++ b/drivers/gpu/drm/qxl/qxl_drv.h @@ -...