@@ -394,13 +394,40 @@ static const struct drm_driver gud_drm_driver = {
.minor = 0,
};
+static int gud_alloc_bulk_buffer(struct gud_device *gdrm)
+{
+ unsigned int i, num_pages;
+ struct page **pages;
+ void *ptr;
+ int ret;
+
+ gdrm->bulk_buf = vmalloc_32(gdrm->bulk_len);
+ if (!gdrm->bulk_buf)
+ return -ENOMEM;
+
+ num_pages = DIV_ROUND_UP(gdrm->bulk_len, PAGE_SIZE);
+ pages = kmalloc_array(num_pages, sizeof(struct page *), GFP_KERNEL);
+ if (!pages)
+ return -ENOMEM;
+
+ for (i = 0, ptr = gdrm->bulk_buf; i < num_pages; i++, ptr += PAGE_SIZE)
+ pages[i] = vmalloc_to_page(ptr);
+
+ ret = sg_alloc_table_from_pages(&gdrm->bulk_sgt, pages, num_pages,
+ 0, gdrm->bulk_len, GFP_KERNEL);
+ kfree(pages);
+
+ return ret;
+}
+
static void gud_free_buffers_and_mutex(void *data)
{
struct gud_device *gdrm = data;
vfree(gdrm->compress_buf);
gdrm->compress_buf = NULL;
- kfree(gdrm->bulk_buf);
+ sg_free_table(&gdrm->bulk_sgt);
+ vfree(gdrm->bulk_buf);
gdrm->bulk_buf = NULL;
mutex_destroy(&gdrm->ctrl_lock);
}
@@ -537,24 +564,17 @@ static int gud_probe(struct usb_interface *intf, const struct usb_device_id *id)
if (desc.max_buffer_size)
max_buffer_size = le32_to_cpu(desc.max_buffer_size);
-retry:
- /*
- * Use plain kmalloc here since devm_kmalloc() places struct devres at the beginning
- * of the buffer it allocates. This wastes a lot of memory when allocating big buffers.
- * Asking for 2M would actually allocate 4M. This would also prevent getting the biggest
- * possible buffer potentially leading to split transfers.
- */
- gdrm->bulk_buf = kmalloc(max_buffer_size, GFP_KERNEL | __GFP_NOWARN);
- if (!gdrm->bulk_buf) {
- max_buffer_size = roundup_pow_of_two(max_buffer_size) / 2;
- if (max_buffer_size < SZ_512K)
- return -ENOMEM;
- goto retry;
- }
+ /* Prevent a misbehaving device from allocating loads of RAM. 4096x4096@XRGB8888 = 64 MB */
+ if (max_buffer_size > SZ_64M)
+ max_buffer_size = SZ_64M;
gdrm->bulk_pipe = usb_sndbulkpipe(interface_to_usbdev(intf), usb_endpoint_num(bulk_out));
gdrm->bulk_len = max_buffer_size;
+ ret = gud_alloc_bulk_buffer(gdrm);
+ if (ret)
+ return ret;
+
if (gdrm->compression & GUD_COMPRESSION_LZ4) {
gdrm->lz4_comp_mem = devm_kmalloc(dev, LZ4_MEM_COMPRESS, GFP_KERNEL);
if (!gdrm->lz4_comp_mem)
@@ -5,6 +5,7 @@
#include <linux/list.h>
#include <linux/mutex.h>
+#include <linux/scatterlist.h>
#include <linux/usb.h>
#include <linux/workqueue.h>
#include <uapi/drm/drm_fourcc.h>
@@ -26,6 +27,7 @@ struct gud_device {
unsigned int bulk_pipe;
void *bulk_buf;
size_t bulk_len;
+ struct sg_table bulk_sgt;
u8 compression;
void *lz4_comp_mem;
@@ -220,13 +220,51 @@ static int gud_prep_flush(struct gud_device *gdrm, struct drm_framebuffer *fb,
return ret;
}
+struct gud_usb_bulk_context {
+ struct timer_list timer;
+ struct usb_sg_request sgr;
+};
+
+static void gud_usb_bulk_timeout(struct timer_list *t)
+{
+ struct gud_usb_bulk_context *ctx = from_timer(ctx, t, timer);
+
+ usb_sg_cancel(&ctx->sgr);
+}
+
+static int gud_usb_bulk(struct gud_device *gdrm, size_t len)
+{
+ struct gud_usb_bulk_context ctx;
+ int ret;
+
+ ret = usb_sg_init(&ctx.sgr, gud_to_usb_device(gdrm), gdrm->bulk_pipe, 0,
+ gdrm->bulk_sgt.sgl, gdrm->bulk_sgt.nents, len, GFP_KERNEL);
+ if (ret)
+ return ret;
+
+ timer_setup_on_stack(&ctx.timer, gud_usb_bulk_timeout, 0);
+ mod_timer(&ctx.timer, jiffies + msecs_to_jiffies(3000));
+
+ usb_sg_wait(&ctx.sgr);
+
+ if (!del_timer_sync(&ctx.timer))
+ ret = -ETIMEDOUT;
+ else if (ctx.sgr.status < 0)
+ ret = ctx.sgr.status;
+ else if (ctx.sgr.bytes != len)
+ ret = -EIO;
+
+ destroy_timer_on_stack(&ctx.timer);
+
+ return ret;
+}
+
static int gud_flush_rect(struct gud_device *gdrm, struct drm_framebuffer *fb,
const struct drm_format_info *format, struct drm_rect *rect)
{
- struct usb_device *usb = gud_to_usb_device(gdrm);
struct gud_set_buffer_req req;
- int ret, actual_length;
size_t len, trlen;
+ int ret;
drm_dbg(&gdrm->drm, "Flushing [FB:%d] " DRM_RECT_FMT "\n", fb->base.id, DRM_RECT_ARG(rect));
@@ -255,10 +293,7 @@ static int gud_flush_rect(struct gud_device *gdrm, struct drm_framebuffer *fb,
return ret;
}
- ret = usb_bulk_msg(usb, gdrm->bulk_pipe, gdrm->bulk_buf, trlen,
- &actual_length, msecs_to_jiffies(3000));
- if (!ret && trlen != actual_length)
- ret = -EIO;
+ ret = gud_usb_bulk(gdrm, trlen);
if (ret)
gdrm->stats_num_errors++;