linux-kernel - RE: [PATCH v6 6/6] drm/i915/gvt: Adding interface so user space can get the dma-buf

Open Source and information security mailing list archives

Message-ID: <DD379D741F77464281CE7ED1CD7C12DE7066B9F5@SHSMSX101.ccr.corp.intel.com>
Date:   Mon, 5 Jun 2017 02:39:32 +0000
From:   "Chen, Xiaoguang" <xiaoguang.chen@...el.com>
To:     Gerd Hoffmann <kraxel@...hat.com>,
        Alex Williamson <alex.williamson@...hat.com>
CC:     "Tian, Kevin" <kevin.tian@...el.com>,
        "intel-gfx@...ts.freedesktop.org" <intel-gfx@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "zhenyuw@...ux.intel.com" <zhenyuw@...ux.intel.com>,
        "chris@...is-wilson.co.uk" <chris@...is-wilson.co.uk>,
        "Lv, Zhiyuan" <zhiyuan.lv@...el.com>,
        "intel-gvt-dev@...ts.freedesktop.org" 
        <intel-gvt-dev@...ts.freedesktop.org>,
        "Wang, Zhi A" <zhi.a.wang@...el.com>
Subject: RE: [PATCH v6 6/6] drm/i915/gvt: Adding interface so user space can
 get the dma-buf

Hi, 

>-----Original Message-----
>From: intel-gvt-dev [mailto:intel-gvt-dev-bounces@...ts.freedesktop.org] On
>Behalf Of Gerd Hoffmann
>Sent: Friday, June 02, 2017 11:24 PM
>To: Alex Williamson <alex.williamson@...hat.com>; Chen, Xiaoguang
><xiaoguang.chen@...el.com>
>Cc: Tian, Kevin <kevin.tian@...el.com>; intel-gfx@...ts.freedesktop.org; linux-
>kernel@...r.kernel.org; zhenyuw@...ux.intel.com; chris@...is-wilson.co.uk; Lv,
>Zhiyuan <zhiyuan.lv@...el.com>; intel-gvt-dev@...ts.freedesktop.org; Wang, Zhi
>A <zhi.a.wang@...el.com>
>Subject: Re: [PATCH v6 6/6] drm/i915/gvt: Adding interface so user space can get
>the dma-buf
>
>  Hi,
>
>> > When i915's dma-buf's release() callback is called it will try to
>> > free the gem object associated with the dma-buf if its ref count is
>> > 0. But in our case the ref count is 1 so no free callback is called
>> > so we can not release allocations there.
>
>Why the ref count is one?  
The gem object is created by us while creating the dma-buf(the ref count of the gem object is initialized to 1).
Later when user import the dma-buf the ref count of the gem object associate with the dma-buf will increased.
When user finished using the dma-buf it will decrease the ref count.
But the ref count of the gem object will become 1 when all the user finished using the dma-buf because we create the gem object(the test also showing this result).

Typically user only export a dma-buf(no gem object yet) then when user import the dma-buf then a gem object will be created.
But in our case we do not implement the dma-buf from scratch but calling the i915_gem_prime_export() where a gem object is an input parameter.

Chenxg

>Who holds a reference and why?
>Maybe it should be the other way around, i.e. the dmabuf holds a reference on
>the vgpu instance backing it, i.e. you can't delete the vgpu while dma-bufs exist?
>
>> We cannot simply say that the user isn't allowed to release them in
>> that order.
>
>Yep, not going to fly.  Can happen even unintentionally because we can pass
>around dmabufs to other processes.  Example: qemu passes dmabuf to spice-
>client, then qemu crashes.  mgmt fd is closed before dmabuf fd then.  The kernel
>must be able to handle that.
>
>cheers,
>  Gerd
>_______________________________________________
>intel-gvt-dev mailing list
>intel-gvt-dev@...ts.freedesktop.org
>https://lists.freedesktop.org/mailman/listinfo/intel-gvt-dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives