* [PATCH v6 3/4] drm/virtio: implement userptr support for zero-copy memory access
2026-09-17 10:25 [PATCH v6 0/4] virtio-gpu: Add userptr support for compute workloads Honglei Huang
2026-09-17 10:25 ` [PATCH v6 1/4] drm/virtio-gpu: Add VIRTIO_GPU_CAPSET_ROCM capability Honglei Huang
2026-09-17 10:25 ` [PATCH v6 2/4] drm/virtgpu api: add blob userptr resource Honglei Huang
@ 2026-09-17 10:25 ` Honglei Huang
2026-09-17 10:25 ` [PATCH v6 4/4] drm/virtio: wire blob ioctl creation to userptr objects Honglei Huang
3 siblings, 0 replies; 5+ messages in thread
From: Honglei Huang @ 2026-09-17 10:25 UTC (permalink / raw)
To: Dmitry Osipenko, Akihiko Odaki, David Airlie, Gerd Hoffmann
Cc: Gurchetan Singh, Chia-I Wu, Ray Huang, dri-devel, virtualization,
linux-kernel
From: Honglei Huang <Honglei1.Huang@amd.com>
Add userptr blob objects so the guest kernel can pin an existing
userspace mapping and advertise it as CREATE_BLOB backing entries.
- New virtio_gpu_object_userptr type for userptr resources
- Pin pages with pin_user_pages_fast() and FOLL_LONGTERM
- Charge FOLL_LONGTERM pins against RLIMIT_MEMLOCK
- DMA-map the scatterlist and pass DMA addresses when the virtio
DMA API is required
- Keep pages pinned until RESOURCE_UNREF is queued; drop them from
cleanup_object() on the unref response or on create failure
- Reject unaligned or overflowing userptr ranges at create time
- Return a fresh SG table from PRIME export
Signed-off-by: Honglei Huang <Honglei1.Huang@amd.com>
---
drivers/gpu/drm/virtio/Makefile | 3 +-
drivers/gpu/drm/virtio/virtgpu_drv.h | 36 +++
drivers/gpu/drm/virtio/virtgpu_object.c | 10 +
drivers/gpu/drm/virtio/virtgpu_userptr.c | 323 +++++++++++++++++++++++
4 files changed, 371 insertions(+), 1 deletion(-)
create mode 100644 drivers/gpu/drm/virtio/virtgpu_userptr.c
diff --git a/drivers/gpu/drm/virtio/Makefile b/drivers/gpu/drm/virtio/Makefile
index d2e1788a82..fe7332a621 100644
--- a/drivers/gpu/drm/virtio/Makefile
+++ b/drivers/gpu/drm/virtio/Makefile
@@ -6,6 +6,7 @@
virtio-gpu-y := virtgpu_drv.o virtgpu_kms.o virtgpu_gem.o virtgpu_vram.o \
virtgpu_display.o virtgpu_vq.o \
virtgpu_fence.o virtgpu_object.o virtgpu_debugfs.o virtgpu_plane.o \
- virtgpu_ioctl.o virtgpu_prime.o virtgpu_trace_points.o virtgpu_submit.o
+ virtgpu_ioctl.o virtgpu_prime.o virtgpu_trace_points.o virtgpu_submit.o \
+ virtgpu_userptr.o
obj-$(CONFIG_DRM_VIRTIO_GPU) += virtio-gpu.o
diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
index 9df4c71173..42869b7d57 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
@@ -105,6 +105,7 @@ struct virtio_gpu_object_params {
uint32_t blob_flags;
uint64_t blob_id;
uint32_t blob_hints;
+ uint64_t userptr;
};
struct virtio_gpu_object {
@@ -138,12 +139,41 @@ struct virtio_gpu_object_vram {
struct drm_mm_node vram_node;
};
+struct virtio_gpu_object_userptr;
+
+struct virtio_gpu_object_userptr_ops {
+ int (*get_pages)(struct virtio_gpu_object_userptr *userptr);
+ void (*put_pages)(struct virtio_gpu_object_userptr *userptr);
+};
+
+struct virtio_gpu_object_userptr {
+ struct virtio_gpu_object base;
+ const struct virtio_gpu_object_userptr_ops *ops;
+ /* Protects pages and sgt. */
+ struct mutex lock;
+
+ uint64_t start;
+ uint32_t npages;
+ uint32_t bo_handle;
+ uint32_t flags;
+
+ struct virtio_gpu_device *vgdev;
+ struct drm_file *file;
+ struct page **pages;
+ struct sg_table *sgt;
+ bool dma_mapped;
+ struct mm_struct *mm;
+};
+
#define to_virtio_gpu_shmem(virtio_gpu_object) \
container_of((virtio_gpu_object), struct virtio_gpu_object_shmem, base)
#define to_virtio_gpu_vram(virtio_gpu_object) \
container_of((virtio_gpu_object), struct virtio_gpu_object_vram, base)
+#define to_virtio_gpu_userptr(virtio_gpu_object) \
+ container_of((virtio_gpu_object), struct virtio_gpu_object_userptr, base)
+
struct virtio_gpu_object_array {
struct ww_acquire_ctx ticket;
struct list_head next;
@@ -562,4 +592,10 @@ void virtio_gpu_vram_map_deferred(struct virtio_gpu_object_vram *vram);
int virtio_gpu_execbuffer_ioctl(struct drm_device *dev, void *data,
struct drm_file *file);
+/* virtgpu_userptr.c */
+int virtio_gpu_userptr_create(struct virtio_gpu_device *vgdev,
+ struct drm_file *file,
+ struct virtio_gpu_object_params *params,
+ struct virtio_gpu_object **bo_ptr);
+bool virtio_gpu_is_userptr(struct virtio_gpu_object *bo);
#endif
diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c
index 49899485be..5c40f5a034 100644
--- a/drivers/gpu/drm/virtio/virtgpu_object.c
+++ b/drivers/gpu/drm/virtio/virtgpu_object.c
@@ -91,6 +91,16 @@ void virtio_gpu_cleanup_object(struct virtio_gpu_object *bo)
drm_gem_free_mmap_offset(&vram->base.base.base);
drm_gem_object_release(&vram->base.base.base);
kfree(vram);
+ } else if (virtio_gpu_is_userptr(bo)) {
+ struct virtio_gpu_object_userptr *userptr =
+ to_virtio_gpu_userptr(bo);
+
+ mutex_lock(&userptr->lock);
+ userptr->ops->put_pages(userptr);
+ mutex_unlock(&userptr->lock);
+ mutex_destroy(&userptr->lock);
+ drm_gem_object_release(&userptr->base.base.base);
+ kfree(userptr);
} else {
drm_gem_object_release(&bo->base.base);
kfree(bo);
diff --git a/drivers/gpu/drm/virtio/virtgpu_userptr.c b/drivers/gpu/drm/virtio/virtgpu_userptr.c
new file mode 100644
index 0000000000..7879735e63
--- /dev/null
+++ b/drivers/gpu/drm/virtio/virtgpu_userptr.c
@@ -0,0 +1,323 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/dma-mapping.h>
+#include <linux/limits.h>
+#include <linux/mm.h>
+#include <linux/overflow.h>
+#include <linux/pid.h>
+#include <linux/sched/mm.h>
+#include <linux/sched/signal.h>
+#include <linux/vmalloc.h>
+
+#include "virtgpu_drv.h"
+#include <drm/drm_gem.h>
+#include <drm/drm_prime.h>
+
+static struct sg_table *
+virtio_gpu_userptr_get_sg_table(struct drm_gem_object *obj);
+
+static void virtio_gpu_userptr_free(struct drm_gem_object *obj)
+{
+ struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(obj);
+ struct virtio_gpu_device *vgdev = obj->dev->dev_private;
+
+ /*
+ * Keep pages pinned until RESOURCE_UNREF completes. The response
+ * callback calls virtio_gpu_cleanup_object(), which drops them.
+ */
+ if (bo->created) {
+ virtio_gpu_remove_from_restore_list(bo);
+ virtio_gpu_cmd_unref_resource(vgdev, bo, false);
+ virtio_gpu_notify(vgdev);
+ return;
+ }
+
+ virtio_gpu_cleanup_object(bo);
+}
+
+static const struct drm_gem_object_funcs virtio_gpu_userptr_funcs = {
+ .open = virtio_gpu_gem_object_open,
+ .close = virtio_gpu_gem_object_close,
+ .free = virtio_gpu_userptr_free,
+ .export = virtgpu_gem_prime_export,
+ .get_sg_table = virtio_gpu_userptr_get_sg_table,
+};
+
+bool virtio_gpu_is_userptr(struct virtio_gpu_object *bo)
+{
+ return bo->base.base.funcs == &virtio_gpu_userptr_funcs;
+}
+
+static int
+virtio_gpu_userptr_get_pages(struct virtio_gpu_object_userptr *userptr)
+{
+ unsigned int flag = FOLL_LONGTERM;
+ unsigned int num_pages, pinned = 0;
+ int ret = 0;
+
+ if (userptr->pages)
+ return 0;
+
+ userptr->pages = kvmalloc_array(userptr->npages, sizeof(struct page *),
+ GFP_KERNEL);
+ if (!userptr->pages)
+ return -ENOMEM;
+
+ if (!(userptr->flags & VIRTGPU_BLOB_FLAG_USERPTR_RDONLY))
+ flag |= FOLL_WRITE;
+
+ do {
+ num_pages = userptr->npages - pinned;
+
+ ret = pin_user_pages_fast(userptr->start + pinned * PAGE_SIZE,
+ num_pages, flag,
+ userptr->pages + pinned);
+
+ if (ret < 0) {
+ if (pinned)
+ unpin_user_pages(userptr->pages, pinned);
+ kvfree(userptr->pages);
+ return ret;
+ }
+
+ pinned += ret;
+
+ } while (pinned < userptr->npages);
+
+ return 0;
+}
+
+static void
+virtio_gpu_userptr_unaccount(struct virtio_gpu_object_userptr *userptr)
+{
+ if (!userptr->mm)
+ return;
+
+ atomic64_sub(userptr->npages, &userptr->mm->pinned_vm);
+ mmdrop(userptr->mm);
+ userptr->mm = NULL;
+}
+
+static void
+virtio_gpu_userptr_put_pages(struct virtio_gpu_object_userptr *userptr)
+{
+ struct drm_device *dev = userptr->base.base.base.dev;
+
+ if (userptr->sgt) {
+ if (userptr->dma_mapped)
+ dma_unmap_sgtable(drm_dev_dma_dev(dev), userptr->sgt,
+ DMA_BIDIRECTIONAL, 0);
+ userptr->dma_mapped = false;
+ sg_free_table(userptr->sgt);
+ kfree(userptr->sgt);
+ userptr->sgt = NULL;
+ }
+
+ if (userptr->pages) {
+ unpin_user_pages(userptr->pages, userptr->npages);
+ kvfree(userptr->pages);
+ userptr->pages = NULL;
+ }
+
+ virtio_gpu_userptr_unaccount(userptr);
+}
+
+static int
+virtio_gpu_userptr_get_entries(struct virtio_gpu_device *vgdev,
+ struct virtio_gpu_object_userptr *userptr,
+ struct virtio_gpu_mem_entry **ents,
+ unsigned int *nents)
+{
+ bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
+ struct scatterlist *sg;
+ unsigned int count;
+ int si;
+
+ count = use_dma_api ? userptr->sgt->nents : userptr->sgt->orig_nents;
+ if (!count)
+ return -EINVAL;
+
+ *ents = kvmalloc_array(count, sizeof(**ents), GFP_KERNEL);
+ if (!*ents)
+ return -ENOMEM;
+
+ if (use_dma_api) {
+ for_each_sgtable_dma_sg(userptr->sgt, sg, si) {
+ (*ents)[si].addr = cpu_to_le64(sg_dma_address(sg));
+ (*ents)[si].length = cpu_to_le32(sg_dma_len(sg));
+ (*ents)[si].padding = 0;
+ }
+ } else {
+ for_each_sgtable_sg(userptr->sgt, sg, si) {
+ (*ents)[si].addr = cpu_to_le64(sg_phys(sg));
+ (*ents)[si].length = cpu_to_le32(sg->length);
+ (*ents)[si].padding = 0;
+ }
+ }
+
+ *nents = count;
+ return 0;
+}
+
+static struct sg_table *
+virtio_gpu_userptr_get_sg_table(struct drm_gem_object *obj)
+{
+ struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(obj);
+ struct virtio_gpu_object_userptr *userptr = to_virtio_gpu_userptr(bo);
+ int ret;
+
+ mutex_lock(&userptr->lock);
+ if (!userptr->pages) {
+ ret = userptr->ops->get_pages(userptr);
+ if (ret) {
+ mutex_unlock(&userptr->lock);
+ return ERR_PTR(ret);
+ }
+ }
+ mutex_unlock(&userptr->lock);
+
+ /* PRIME takes ownership of the returned table. */
+ return drm_prime_pages_to_sg(obj->dev, userptr->pages, userptr->npages);
+}
+
+static int
+virtio_gpu_userptr_init(struct drm_device *dev, struct drm_file *file,
+ struct virtio_gpu_object_userptr *userptr,
+ struct virtio_gpu_object_params *params,
+ const struct virtio_gpu_object_userptr_ops *ops)
+{
+ struct drm_gem_object *obj;
+ int ret;
+
+ userptr->start = params->userptr;
+ userptr->npages = params->size >> PAGE_SHIFT;
+ userptr->flags = params->blob_flags;
+
+ mutex_init(&userptr->lock);
+ userptr->vgdev = dev->dev_private;
+ userptr->file = file;
+ userptr->ops = ops;
+
+ /*
+ * Allocate the resource id before GEM init so a failure here can
+ * unwind with a plain kfree and does not need a special id=0 guard
+ * in the shared resource_id_put helper.
+ */
+ ret = virtio_gpu_resource_id_get(userptr->vgdev,
+ &userptr->base.hw_res_handle);
+ if (ret) {
+ mutex_destroy(&userptr->lock);
+ return ret;
+ }
+
+ obj = &userptr->base.base.base;
+ obj->funcs = &virtio_gpu_userptr_funcs;
+
+ drm_gem_private_object_init(dev, obj, params->size);
+ INIT_LIST_HEAD(&userptr->base.restore_node);
+
+ return 0;
+}
+
+static const struct virtio_gpu_object_userptr_ops virtio_gpu_userptr_ops = {
+ .get_pages = virtio_gpu_userptr_get_pages,
+ .put_pages = virtio_gpu_userptr_put_pages,
+};
+
+int virtio_gpu_userptr_create(struct virtio_gpu_device *vgdev,
+ struct drm_file *file,
+ struct virtio_gpu_object_params *params,
+ struct virtio_gpu_object **bo_ptr)
+{
+ struct virtio_gpu_object_userptr *userptr;
+ struct virtio_gpu_mem_entry *ents = NULL;
+ struct sg_table *sgt;
+ struct mm_struct *mm;
+ unsigned long lock_limit;
+ unsigned long start;
+ unsigned long end;
+ s64 new_pinned;
+ unsigned int nents;
+ int ret;
+
+ *bo_ptr = NULL;
+
+ if (!params->size || !IS_ALIGNED(params->size, PAGE_SIZE) ||
+ params->userptr != (unsigned long)params->userptr)
+ return -EINVAL;
+
+ start = params->userptr;
+ if (!IS_ALIGNED(start, PAGE_SIZE) ||
+ check_add_overflow(start, (unsigned long)params->size, &end))
+ return -EINVAL;
+
+ if (!can_do_mlock())
+ return -EPERM;
+
+ if (params->size >> PAGE_SHIFT > INT_MAX)
+ return -E2BIG;
+
+ if (!access_ok((void __user *)start, params->size))
+ return -EFAULT;
+
+ userptr = kzalloc_obj(*userptr);
+ if (!userptr)
+ return -ENOMEM;
+
+ ret = virtio_gpu_userptr_init(vgdev->ddev, file, userptr, params,
+ &virtio_gpu_userptr_ops);
+ if (ret) {
+ kfree(userptr);
+ return ret;
+ }
+
+ mm = current->mm;
+ mmgrab(mm);
+ lock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
+ new_pinned = atomic64_add_return(userptr->npages, &mm->pinned_vm);
+ if (new_pinned < 0 ||
+ (new_pinned > lock_limit && !capable(CAP_IPC_LOCK))) {
+ atomic64_sub(userptr->npages, &mm->pinned_vm);
+ mmdrop(mm);
+ ret = new_pinned < 0 ? -EOVERFLOW : -ENOMEM;
+ goto err_cleanup;
+ }
+ userptr->mm = mm;
+
+ mutex_lock(&userptr->lock);
+ ret = userptr->ops->get_pages(userptr);
+ mutex_unlock(&userptr->lock);
+ if (ret)
+ goto err_cleanup;
+
+ sgt = drm_prime_pages_to_sg(vgdev->ddev, userptr->pages,
+ userptr->npages);
+ if (IS_ERR(sgt)) {
+ ret = PTR_ERR(sgt);
+ goto err_cleanup;
+ }
+
+ ret = dma_map_sgtable(drm_dev_dma_dev(vgdev->ddev), sgt,
+ DMA_BIDIRECTIONAL, 0);
+ if (ret) {
+ sg_free_table(sgt);
+ kfree(sgt);
+ goto err_cleanup;
+ }
+
+ userptr->sgt = sgt;
+ userptr->dma_mapped = true;
+
+ ret = virtio_gpu_userptr_get_entries(vgdev, userptr, &ents, &nents);
+ if (ret)
+ goto err_cleanup;
+
+ virtio_gpu_cmd_resource_create_blob(vgdev, &userptr->base, params, ents,
+ nents);
+
+ *bo_ptr = &userptr->base;
+ return 0;
+
+err_cleanup:
+ virtio_gpu_cleanup_object(&userptr->base);
+ return ret;
+}
--
2.34.1
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH v6 4/4] drm/virtio: wire blob ioctl creation to userptr objects
2026-09-17 10:25 [PATCH v6 0/4] virtio-gpu: Add userptr support for compute workloads Honglei Huang
` (2 preceding siblings ...)
2026-09-17 10:25 ` [PATCH v6 3/4] drm/virtio: implement userptr support for zero-copy memory access Honglei Huang
@ 2026-09-17 10:25 ` Honglei Huang
3 siblings, 0 replies; 5+ messages in thread
From: Honglei Huang @ 2026-09-17 10:25 UTC (permalink / raw)
To: Dmitry Osipenko, Akihiko Odaki, David Airlie, Gerd Hoffmann
Cc: Gurchetan Singh, Chia-I Wu, Ray Huang, dri-devel, virtualization,
linux-kernel
From: Honglei Huang <Honglei1.Huang@amd.com>
Integrate userptr into the blob resource creation ioctl.
- Include VIRTGPU_BLOB_FLAG_USE_USERPTR and
VIRTGPU_BLOB_FLAG_USERPTR_RDONLY in VIRTGPU_BLOB_FLAG_USE_MASK
- Require userptr if and only if USE_USERPTR is set
- Pass the userspace address into the internal create params
- Call virtio_gpu_userptr_create() for userptr blob requests
Signed-off-by: Honglei Huang <Honglei1.Huang@amd.com>
---
drivers/gpu/drm/virtio/virtgpu_ioctl.c | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
index 3d8e4ccdb7..616d248b3d 100644
--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
@@ -36,7 +36,9 @@
#define VIRTGPU_BLOB_FLAG_USE_MASK (VIRTGPU_BLOB_FLAG_USE_MAPPABLE | \
VIRTGPU_BLOB_FLAG_USE_SHAREABLE | \
- VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE)
+ VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE | \
+ VIRTGPU_BLOB_FLAG_USE_USERPTR | \
+ VIRTGPU_BLOB_FLAG_USERPTR_RDONLY)
/* Must be called with &virtio_gpu_fpriv.struct_mutex held. */
static void virtio_gpu_create_context_locked(struct virtio_gpu_device *vgdev,
@@ -458,6 +460,17 @@ static int verify_blob(struct virtio_gpu_device *vgdev,
return -EINVAL;
}
+ if (rc_blob->blob_flags & VIRTGPU_BLOB_FLAG_USE_USERPTR) {
+ if (!rc_blob->userptr)
+ return -EINVAL;
+ } else {
+ if (rc_blob->userptr)
+ return -EINVAL;
+
+ if (rc_blob->blob_flags & VIRTGPU_BLOB_FLAG_USERPTR_RDONLY)
+ return -EINVAL;
+ }
+
switch (rc_blob->blob_mem) {
case VIRTGPU_BLOB_MEM_GUEST:
*guest_blob = true;
@@ -495,6 +508,7 @@ static int verify_blob(struct virtio_gpu_device *vgdev,
params->blob = true;
params->blob_flags = rc_blob->blob_flags;
params->blob_hints = rc_blob->blob_hints;
+ params->userptr = rc_blob->userptr;
if (vgdev->has_blob_alignment &&
!IS_ALIGNED(params->size, vgdev->blob_alignment))
@@ -538,8 +552,10 @@ static int virtio_gpu_resource_create_blob_ioctl(struct drm_device *dev,
vfpriv->ctx_id, NULL, NULL);
}
- if (guest_blob)
+ if (guest_blob && !params.userptr)
ret = virtio_gpu_object_create(vgdev, ¶ms, &bo, NULL);
+ else if (guest_blob && params.userptr)
+ ret = virtio_gpu_userptr_create(vgdev, file, ¶ms, &bo);
else if (!guest_blob && host3d_blob)
ret = virtio_gpu_vram_create(vgdev, ¶ms, &bo);
else
--
2.34.1
^ permalink raw reply [flat|nested] 5+ messages in thread