similar to: [PATCH] drm/virtio: Fix warning in virtio_gpu_queue_fenced_ctrl_buffer.

Userspace requested command buffer allocations could be too large to make as a contiguous allocation. Use vmalloc if necessary to satisfy those allocations. Signed-off-by: David Riley <davidriley at chromium.org> --- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 4 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 114 ++++++++++++++++++++----- 2 files changed, 96 insertions(+), 22 deletions(-)

Userspace requested command buffer allocations could be too large to make as a contiguous allocation. Use vmalloc if necessary to satisfy those allocations. Signed-off-by: David Riley <davidriley at chromium.org> --- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 4 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 114 ++++++++++++++++++++----- 2 files changed, 96 insertions(+), 22 deletions(-)

Userspace requested command buffer allocations could be too large to make as a contiguous allocation. Use vmalloc if necessary to satisfy those allocations. Signed-off-by: David Riley <davidriley at chromium.org> --- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 4 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 78 +++++++++++++++++++++++--- 2 files changed, 72 insertions(+), 10 deletions(-)

Userspace requested command buffer allocations could be too large to make as a contiguous allocation. Use vmalloc if necessary to satisfy those allocations. Signed-off-by: David Riley <davidriley at chromium.org> --- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 4 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 79 +++++++++++++++++++++++--- 2 files changed, 73 insertions(+), 10 deletions(-)

From: David Riley <davidriley at chromium.org> virtio_gpu_get_caps_ioctl could return success with invalid data if a second caller to the function occurred after the entry was created in virtio_gpu_cmd_get_capset but prior to the virtio_gpu_cmd_capset_cb callback being called. This could leak contents of memory as well since the caps_cache allocation is done without zeroing.

On Fri, Aug 30, 2019 at 10:49:25AM -0700, David Riley wrote: > Hi Gerd, > > On Fri, Aug 30, 2019 at 4:16 AM Gerd Hoffmann <kraxel at redhat.com> wrote: > > > > Hi, > > > > > > > - kfree(vbuf->data_buf); > > > > > + kvfree(vbuf->data_buf); > > > > > > > > if (is_vmalloc_addr(vbuf->data_buf))

> +/* How many bytes left in this page. */ > +static unsigned int rest_of_page(void *data) > +{ > + return PAGE_SIZE - offset_in_page(data); > +} Not needed. > +/* Create sg_table from a vmalloc'd buffer. */ > +static struct sg_table *vmalloc_to_sgt(char *data, uint32_t size, int *sg_ents) > +{ > + int nents, ret, s, i; > + struct sg_table *sgt; > + struct

Be consistent with the rest of the code base. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/virtio/virtgpu_drv.h | 4 ++-- drivers/gpu/drm/virtio/virtgpu_plane.c | 12 ++++++------ drivers/gpu/drm/virtio/virtgpu_vq.c | 12 ++++++------ 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h

Add helper function to handle the submission of fenced control requests. Make sure we initialize the fence while holding the virtqueue lock, so requests can't be reordered. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/virtio/virtgpu_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 40 +++++++++++++++++++++++++++++----- 2 files changed, 35

Add helper function to handle the submission of fenced control requests. Make sure we initialize the fence while holding the virtqueue lock, so requests can't be reordered. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/virtio/virtgpu_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 40 +++++++++++++++++++++++++++++----- 2 files changed, 35

Add helper function to handle the submission of fenced control requests. Make sure we initialize the fence while holding the virtqueue lock, so requests can't be reordered. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/virtio/virtgpu_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 40 +++++++++++++++++++++++++++++----- 2 files changed, 35

Add helper function to handle the submission of fenced control requests. Make sure we initialize the fence while holding the virtqueue lock, so requests can't be reordered. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/virtio/virtgpu_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 40 +++++++++++++++++++++++++++++----- 2 files changed, 35

Add helper function to handle the submission of fenced control requests. Make sure we initialize the fence while holding the virtqueue lock, so requests can't be reordered. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/virtio/virtgpu_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 40 +++++++++++++++++++++++++++++----- 2 files changed, 35

Add helper function to handle the submission of fenced control requests. Make sure we initialize the fence while holding the virtqueue lock, so requests can't be reordered. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/virtio/virtgpu_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 40 +++++++++++++++++++++++++++++----- 2 files changed, 35

Factor function in preparation to generating scatterlist prior to locking. Signed-off-by: David Riley <davidriley at chromium.org> --- drivers/gpu/drm/virtio/virtgpu_vq.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index 7fd2851f7b97..5a64c776138d 100644 ---

Factor function in preparation to generating scatterlist prior to locking. Signed-off-by: David Riley <davidriley at chromium.org> --- drivers/gpu/drm/virtio/virtgpu_vq.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index 981ee16e3ee9..bf5a4a50b002 100644 ---

Factor function in preparation to generating scatterlist prior to locking. Signed-off-by: David Riley <davidriley at chromium.org> --- drivers/gpu/drm/virtio/virtgpu_vq.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index 981ee16e3ee9..bf5a4a50b002 100644 ---

Rework fencing workflow, starting with virtio_gpu_execbuffer_ioctl. Stop using ttm helpers, use the virtio_gpu_array_* helpers (which work on the reservation objects directly) instead. New workflow: (1) All gem objects needed by a command are added to a virtio_gpu_object_array. (2) All reservation objects will be locked (virtio_gpu_array_lock_resv). (3) virtio_gpu_fence_emit() completes

Rework fencing workflow, starting with virtio_gpu_execbuffer_ioctl. Stop using ttm helpers, use the virtio_gpu_array_* helpers (which work on the reservation objects directly) instead. New workflow: (1) All gem objects needed by a command are added to a virtio_gpu_object_array. (2) All reservation objects will be locked (virtio_gpu_array_lock_resv). (3) virtio_gpu_fence_emit() completes

Just use kmem_cache instead of rolling our own, limited implementation. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/virtio/virtgpu_drv.h | 4 +-- drivers/gpu/drm/virtio/virtgpu_vq.c | 57 +++++++----------------------------- 2 files changed, 11 insertions(+), 50 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h