Hi,
This patch set allocates the restricted DMA-bufs via the TEE subsystem.
This a complete rewrite compared to the previous patch set [1], and other
earlier proposals [2] and [3] with a separate restricted heap.
The TEE subsystem handles the DMA-buf allocations since it is the TEE
(OP-TEE, AMD-TEE, TS-TEE, or a future QTEE) which sets up the restrictions
for the memory used for the DMA-bufs.
I've added a new IOCTL, TEE_IOC_RSTMEM_ALLOC, to allocate the restricted
DMA-bufs. This new IOCTL reaches the backend TEE driver, allowing it to
choose how to allocate the restricted physical memory.
TEE_IOC_RSTMEM_ALLOC is quite similar to TEE_IOC_SHM_ALLOC so it's tempting
to extend TEE_IOC_SHM_ALLOC with two new flags
TEE_IOC_SHM_FLAG_SECURE_VIDEO and TEE_IOC_SHM_FLAG_SECURE_TRUSTED_UI for
the same feature. However, it might be a bit confusing since
TEE_IOC_SHM_ALLOC only returns an anonymous file descriptor, but
TEE_IOC_SHM_FLAG_SECURE_VIDEO and TEE_IOC_SHM_FLAG_SECURE_TRUSTED_UI would
return a DMA-buf file descriptor instead. What do others think?
This can be tested on QEMU with the following steps:
repo init -u https://github.com/jenswi-linaro/manifest.git -m qemu_v8.xml \
-b prototype/sdp-v2
repo sync -j8
cd build
make toolchains -j4
make all -j$(nproc)
make run-only
# login and at the prompt:
xtest --sdp-basic
https://optee.readthedocs.io/en/latest/building/prerequisites.html
list dependencies needed to build the above.
The tests are pretty basic, mostly checking that a Trusted Application in
the secure world can access and manipulate the memory. There are also some
negative tests for out of bounds buffers etc.
Thanks,
Jens
[1] https://lore.kernel.org/lkml/20240830070351.2855919-1-jens.wiklander@linaro…
[2] https://lore.kernel.org/dri-devel/20240515112308.10171-1-yong.wu@mediatek.c…
[3] https://lore.kernel.org/lkml/20220805135330.970-1-olivier.masse@nxp.com/
Changes since the V1 RFC:
* Based on v6.11
* Complete rewrite, replacing the restricted heap with TEE_IOC_RSTMEM_ALLOC
Changes since Olivier's post [2]:
* Based on Yong Wu's post [1] where much of dma-buf handling is done in
the generic restricted heap
* Simplifications and cleanup
* New commit message for "dma-buf: heaps: add Linaro restricted dmabuf heap
support"
* Replaced the word "secure" with "restricted" where applicable
Jens Wiklander (2):
tee: add restricted memory allocation
optee: support restricted memory allocation
drivers/tee/Makefile | 1 +
drivers/tee/optee/core.c | 21 ++++
drivers/tee/optee/optee_private.h | 6 +
drivers/tee/optee/optee_smc.h | 35 ++++++
drivers/tee/optee/smc_abi.c | 45 ++++++-
drivers/tee/tee_core.c | 33 ++++-
drivers/tee/tee_private.h | 2 +
drivers/tee/tee_rstmem.c | 200 ++++++++++++++++++++++++++++++
drivers/tee/tee_shm.c | 2 +
drivers/tee/tee_shm_pool.c | 69 ++++++++++-
include/linux/tee_core.h | 6 +
include/linux/tee_drv.h | 9 ++
include/uapi/linux/tee.h | 33 ++++-
13 files changed, 455 insertions(+), 7 deletions(-)
create mode 100644 drivers/tee/tee_rstmem.c
--
2.43.0
Reports indicates that some userspace applications try to merge more than
80k of fences into a single dma_fence_array leading to a warning from
kzalloc() that the requested size becomes to big.
While that is clearly an userspace bug we should probably handle that case
gracefully in the kernel.
So we can either reject requests to merge more than a reasonable amount of
fences (64k maybe?) or we can start to use kvzalloc() instead of kzalloc().
This patch here does the later.
Signed-off-by: Christian König <christian.koenig(a)amd.com>
CC: stable(a)vger.kernel.org
---
drivers/dma-buf/dma-fence-array.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/dma-buf/dma-fence-array.c b/drivers/dma-buf/dma-fence-array.c
index 8a08ffde31e7..46ac42bcfac0 100644
--- a/drivers/dma-buf/dma-fence-array.c
+++ b/drivers/dma-buf/dma-fence-array.c
@@ -119,8 +119,8 @@ static void dma_fence_array_release(struct dma_fence *fence)
for (i = 0; i < array->num_fences; ++i)
dma_fence_put(array->fences[i]);
- kfree(array->fences);
- dma_fence_free(fence);
+ kvfree(array->fences);
+ kvfree_rcu(fence, rcu);
}
static void dma_fence_array_set_deadline(struct dma_fence *fence,
@@ -153,7 +153,7 @@ struct dma_fence_array *dma_fence_array_alloc(int num_fences)
{
struct dma_fence_array *array;
- return kzalloc(struct_size(array, callbacks, num_fences), GFP_KERNEL);
+ return kvzalloc(struct_size(array, callbacks, num_fences), GFP_KERNEL);
}
EXPORT_SYMBOL(dma_fence_array_alloc);
--
2.34.1
Am 16.10.24 um 18:43 schrieb Adrián Larumbe:
> On 16.10.2024 15:12, Christian König wrote:
>> Am 15.10.24 um 01:31 schrieb Adrián Larumbe:
>>> Doesn't make any functional difference because generic dma_fence is the
>>> first panfrost_fence structure member, but I guess it doesn't hurt either.
>> As discussed with Sima we want to push into the exactly opposite direction
>> because that requires that the panfrost module stays loaded as long as fences
>> are around.
> Does that mean in future commits the struct dma_fence_ops' .release pointer will be
> done with altogether?
Yes, exactly that's the idea.
As a first step I'm preparing patches right now to enforce using kmalloc
instead of driver brewed approaches for dma_fence handling.
Regards,
Christian.
>
>> So clearly a NAK to this one here. Rather document on the structure that the
>> dma_fence structure must be the first member.
>>
>> Regards,
>> Christian.
>>
>>> Signed-off-by: Adrián Larumbe <adrian.larumbe(a)collabora.com>
>>> ---
>>> drivers/gpu/drm/panfrost/panfrost_job.c | 6 ++++++
>>> 1 file changed, 6 insertions(+)
>>>
>>> diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
>>> index 5d83c6a148ec..fa219f719bdc 100644
>>> --- a/drivers/gpu/drm/panfrost/panfrost_job.c
>>> +++ b/drivers/gpu/drm/panfrost/panfrost_job.c
>>> @@ -85,9 +85,15 @@ static const char *panfrost_fence_get_timeline_name(struct dma_fence *fence)
>>> }
>>> }
>>> +static void panfrost_fence_release(struct dma_fence *fence)
>>> +{
>>> + kfree(to_panfrost_fence(fence));
>>> +}
>>> +
>>> static const struct dma_fence_ops panfrost_fence_ops = {
>>> .get_driver_name = panfrost_fence_get_driver_name,
>>> .get_timeline_name = panfrost_fence_get_timeline_name,
>>> + .release = panfrost_fence_release,
>>> };
>>> static struct dma_fence *panfrost_fence_create(struct panfrost_device *pfdev, int js_num)
On 15/10/2024 14:07, Jyothi Kumar Seerapu wrote:
> When high performance with multiple i2c messages in a single transfer
> is required, employ Block Event Interrupt (BEI) to trigger interrupts
> after specific messages transfer and the last message transfer,
> thereby reducing interrupts.
> For each i2c message transfer, a series of Transfer Request Elements(TREs)
> must be programmed, including config tre for frequency configuration,
> go tre for holding i2c address and dma tre for holding dma buffer address,
> length as per the hardware programming guide. For transfer using BEI,
> multiple I2C messages may necessitate the preparation of config, go,
> and tx DMA TREs. However, a channel TRE size of 64 is often insufficient,
> potentially leading to failures due to inadequate memory space.
>
> Adjust the channel TRE size through the device tree.
> The default size is 64, but clients can modify this value based on
> their heigher channel TRE size requirements.
>
> Signed-off-by: Jyothi Kumar Seerapu <quic_jseerapu(a)quicinc.com>
> ---
> arch/arm64/boot/dts/qcom/sc7280.dtsi | 132 +++++++++++++--------------
> 1 file changed, 66 insertions(+), 66 deletions(-)
>
> diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
> index 3d8410683402..c7c0e15ff9d3 100644
> --- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
> +++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
> @@ -1064,7 +1064,7 @@
> };
>
> gpi_dma0: dma-controller@900000 {
> - #dma-cells = <3>;
> + #dma-cells = <4>;
> compatible = "qcom,sc7280-gpi-dma", "qcom,sm6350-gpi-dma";
> reg = <0 0x00900000 0 0x60000>;
> interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
> @@ -1114,8 +1114,8 @@
> "qup-memory";
> power-domains = <&rpmhpd SC7280_CX>;
> required-opps = <&rpmhpd_opp_low_svs>;
> - dmas = <&gpi_dma0 0 0 QCOM_GPI_I2C>,
> - <&gpi_dma0 1 0 QCOM_GPI_I2C>;
> + dmas = <&gpi_dma0 0 0 QCOM_GPI_I2C 64>,
> + <&gpi_dma0 1 0 QCOM_GPI_I2C 64>;
So everywhere is 64, thus this is fixed. Deduce it from the compatible
Best regards,
Krzysztof
Am 15.10.24 um 01:31 schrieb Adrián Larumbe:
> Doesn't make any functional difference because generic dma_fence is the
> first panfrost_fence structure member, but I guess it doesn't hurt either.
As discussed with Sima we want to push into the exactly opposite
direction because that requires that the panfrost module stays loaded as
long as fences are around.
So clearly a NAK to this one here. Rather document on the structure that
the dma_fence structure must be the first member.
Regards,
Christian.
> Signed-off-by: Adrián Larumbe <adrian.larumbe(a)collabora.com>
> ---
> drivers/gpu/drm/panfrost/panfrost_job.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
> index 5d83c6a148ec..fa219f719bdc 100644
> --- a/drivers/gpu/drm/panfrost/panfrost_job.c
> +++ b/drivers/gpu/drm/panfrost/panfrost_job.c
> @@ -85,9 +85,15 @@ static const char *panfrost_fence_get_timeline_name(struct dma_fence *fence)
> }
> }
>
> +static void panfrost_fence_release(struct dma_fence *fence)
> +{
> + kfree(to_panfrost_fence(fence));
> +}
> +
> static const struct dma_fence_ops panfrost_fence_ops = {
> .get_driver_name = panfrost_fence_get_driver_name,
> .get_timeline_name = panfrost_fence_get_timeline_name,
> + .release = panfrost_fence_release,
> };
>
> static struct dma_fence *panfrost_fence_create(struct panfrost_device *pfdev, int js_num)
On 15-10-24, 17:37, Jyothi Kumar Seerapu wrote:
> When high performance with multiple i2c messages in a single transfer
> is required, employ Block Event Interrupt (BEI) to trigger interrupts
> after specific messages transfer and the last message transfer,
> thereby reducing interrupts.
>
> For each i2c message transfer, a series of Transfer Request Elements(TREs)
> must be programmed, including config tre for frequency configuration,
> go tre for holding i2c address and dma tre for holding dma buffer address,
> length as per the hardware programming guide. For transfer using BEI,
> multiple I2C messages may necessitate the preparation of config, go,
> and tx DMA TREs. However, a channel TRE size of 64 is often insufficient,
> potentially leading to failures due to inadequate memory space.
>
> Add additional argument to dma-cell property for channel TRE size.
> With this, adjust the channel TRE size via the device tree.
> The default size is 64, but clients can modify this value based on
> their specific requirements.
>
> Signed-off-by: Jyothi Kumar Seerapu <quic_jseerapu(a)quicinc.com>
> ---
> Documentation/devicetree/bindings/dma/qcom,gpi.yaml | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/Documentation/devicetree/bindings/dma/qcom,gpi.yaml b/Documentation/devicetree/bindings/dma/qcom,gpi.yaml
> index 4df4e61895d2..002495921643 100644
> --- a/Documentation/devicetree/bindings/dma/qcom,gpi.yaml
> +++ b/Documentation/devicetree/bindings/dma/qcom,gpi.yaml
> @@ -54,14 +54,16 @@ properties:
> maxItems: 13
>
> "#dma-cells":
> - const: 3
> + minItems: 3
> + maxItems: 4
> description: >
> DMA clients must use the format described in dma.txt, giving a phandle
> - to the DMA controller plus the following 3 integer cells:
> + to the DMA controller plus the following 4 integer cells:
> - channel: if set to 0xffffffff, any available channel will be allocated
> for the client. Otherwise, the exact channel specified will be used.
> - seid: serial id of the client as defined in the SoC documentation.
> - client: type of the client as defined in dt-bindings/dma/qcom-gpi.h
> + - channel-tre-size: size of the channel TRE (transfer ring element)
This is a firmware /software property, why should this be in hardware
description?
--
~Vinod
On Tue, Oct 15, 2024 at 05:37:46PM +0530, Jyothi Kumar Seerapu wrote:
> When high performance with multiple i2c messages in a single transfer
> is required, employ Block Event Interrupt (BEI) to trigger interrupts
> after specific messages transfer and the last message transfer,
> thereby reducing interrupts.
>
> For each i2c message transfer, a series of Transfer Request Elements(TREs)
> must be programmed, including config tre for frequency configuration,
> go tre for holding i2c address and dma tre for holding dma buffer address,
> length as per the hardware programming guide. For transfer using BEI,
> multiple I2C messages may necessitate the preparation of config, go,
> and tx DMA TREs. However, a channel TRE size of 64 is often insufficient,
> potentially leading to failures due to inadequate memory space.
>
> Add additional argument to dma-cell property for channel TRE size.
No such property 'dma-cell'
> With this, adjust the channel TRE size via the device tree.
> The default size is 64, but clients can modify this value based on
> their specific requirements.
>
> Signed-off-by: Jyothi Kumar Seerapu <quic_jseerapu(a)quicinc.com>
> ---
> Documentation/devicetree/bindings/dma/qcom,gpi.yaml | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/Documentation/devicetree/bindings/dma/qcom,gpi.yaml b/Documentation/devicetree/bindings/dma/qcom,gpi.yaml
> index 4df4e61895d2..002495921643 100644
> --- a/Documentation/devicetree/bindings/dma/qcom,gpi.yaml
> +++ b/Documentation/devicetree/bindings/dma/qcom,gpi.yaml
> @@ -54,14 +54,16 @@ properties:
> maxItems: 13
>
> "#dma-cells":
> - const: 3
> + minItems: 3
> + maxItems: 4
> description: >
> DMA clients must use the format described in dma.txt, giving a phandle
> - to the DMA controller plus the following 3 integer cells:
> + to the DMA controller plus the following 4 integer cells:
> - channel: if set to 0xffffffff, any available channel will be allocated
> for the client. Otherwise, the exact channel specified will be used.
> - seid: serial id of the client as defined in the SoC documentation.
> - client: type of the client as defined in dt-bindings/dma/qcom-gpi.h
> + - channel-tre-size: size of the channel TRE (transfer ring element)
>
> iommus:
> maxItems: 1
> --
> 2.17.1
>
On 15/10/2024 14:07, Jyothi Kumar Seerapu wrote:
> When high performance with multiple i2c messages in a single transfer
> is required, employ Block Event Interrupt (BEI) to trigger interrupts
> after specific messages transfer and the last message transfer,
> thereby reducing interrupts.
>
> For each i2c message transfer, a series of Transfer Request Elements(TREs)
> must be programmed, including config tre for frequency configuration,
> go tre for holding i2c address and dma tre for holding dma buffer address,
> length as per the hardware programming guide. For transfer using BEI,
> multiple I2C messages may necessitate the preparation of config, go,
> and tx DMA TREs. However, a channel TRE size of 64 is often insufficient,
> potentially leading to failures due to inadequate memory space.
Please kindly test the patches before you sent them. Upstream is not a
testing service.
Best regards,
Krzysztof
On Tue, 15 Oct 2024 17:37:46 +0530, Jyothi Kumar Seerapu wrote:
> When high performance with multiple i2c messages in a single transfer
> is required, employ Block Event Interrupt (BEI) to trigger interrupts
> after specific messages transfer and the last message transfer,
> thereby reducing interrupts.
>
> For each i2c message transfer, a series of Transfer Request Elements(TREs)
> must be programmed, including config tre for frequency configuration,
> go tre for holding i2c address and dma tre for holding dma buffer address,
> length as per the hardware programming guide. For transfer using BEI,
> multiple I2C messages may necessitate the preparation of config, go,
> and tx DMA TREs. However, a channel TRE size of 64 is often insufficient,
> potentially leading to failures due to inadequate memory space.
>
> Add additional argument to dma-cell property for channel TRE size.
> With this, adjust the channel TRE size via the device tree.
> The default size is 64, but clients can modify this value based on
> their specific requirements.
>
> Signed-off-by: Jyothi Kumar Seerapu <quic_jseerapu(a)quicinc.com>
> ---
> Documentation/devicetree/bindings/dma/qcom,gpi.yaml | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
My bot found errors running 'make dt_binding_check' on your patch:
yamllint warnings/errors:
dtschema/dtc warnings/errors:
/builds/robherring/dt-review-ci/linux/Documentation/devicetree/bindings/dma/qcom,gpi.yaml: properties:#dma-cells: 'minItems' is not one of ['description', 'deprecated', 'const', 'enum', 'minimum', 'maximum', 'multipleOf', 'default', '$ref', 'oneOf']
from schema $id: http://devicetree.org/meta-schemas/core.yaml#
/builds/robherring/dt-review-ci/linux/Documentation/devicetree/bindings/dma/qcom,gpi.yaml: properties:#dma-cells: 'maxItems' is not one of ['description', 'deprecated', 'const', 'enum', 'minimum', 'maximum', 'multipleOf', 'default', '$ref', 'oneOf']
from schema $id: http://devicetree.org/meta-schemas/core.yaml#
doc reference errors (make refcheckdocs):
See https://patchwork.ozlabs.org/project/devicetree-bindings/patch/202410151207…
The base for the series is generally the latest rc1. A different dependency
should be noted in *this* patch.
If you already ran 'make dt_binding_check' and didn't see the above
error(s), then make sure 'yamllint' is installed and dt-schema is up to
date:
pip3 install dtschema --upgrade
Please check and re-submit after running the above command yourself. Note
that DT_SCHEMA_FILES can be set to your schema file to speed up checking
your schema. However, it must be unset to test all examples with your schema.
On Sat, Oct 5, 2024 at 11:10 AM Pintu Kumar <quic_pintu(a)quicinc.com> wrote:
>
> These warnings/errors are reported by checkpatch.
> Fix them with minor changes to make it clean.
> No other functional changes.
>
> WARNING: Block comments use * on subsequent lines
> + /* only support discovering the end of the buffer,
> + but also allow SEEK_SET to maintain the idiomatic
>
> WARNING: Block comments use a trailing */ on a separate line
> + SEEK_END(0), SEEK_CUR(0) pattern */
>
> WARNING: Block comments use a trailing */ on a separate line
> + * before passing the sgt back to the exporter. */
>
> ERROR: "foo * bar" should be "foo *bar"
> +static struct sg_table * __map_dma_buf(struct dma_buf_attachment *attach,
>
> WARNING: Symbolic permissions 'S_IRUGO' are not preferred. Consider using octal permissions '0444'.
> + d = debugfs_create_file("bufinfo", S_IRUGO, dma_buf_debugfs_dir,
>
> total: 1 errors, 4 warnings, 1746 lines checked
>
> Signed-off-by: Pintu Kumar <quic_pintu(a)quicinc.com>
Looks ok to me. Thanks for sending these cleanups!
Acked-by: John Stultz <jstultz(a)google.com>
Hello,
We held a workshop at XDC 2024 titled "Towards a universal buffer
allocator for Linux", whose abstract was as follows:
Buffer allocation for media contents, despite being required for any
framework or application dealing with image capture, processing,
decoding, encoding, rendering and display, remains an area plagued by
many unsolved problems. Over time improvements have been made to APIs
for buffer allocation, both on the kernel side (standardization of the
DRM dumb buffer API, or DMA heaps, to name a few) and in userspace
(most notably with GBM, and the buffer management API in Vulkan), or
for specific use cases (e.g. gralloc in Android). Unfortunately, no
universal solution exists to allocate buffers shared by multiple
devices. This is hindering interoperability and forces userspace to
pile hacks and workarounds.
(https://indico.freedesktop.org/event/6/contributions/395/).
Here are the raw notes from the workshop.
XDC 2024 - Buffer allocation workshop
=====================================
Attendees:
- Erico Nunes <ernunes(a)redhat.com>
- James Jones <jajones(a)nvidia.com>
- Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
- Nicolas Dufresne <nicolas(a)collabora.com>
- Yunxiang (Teddy) Li <yunxiang.li(a)amd.com>
Relevant content:
- XDC 2016: https://www.x.org/wiki/Events/XDC2016/Program/Unix_Device_Memory_Allocation…
- XDC 2020: https://lpc.events/event/9/contributions/615/attachments/704/1301/XDC_2020_…
Discussions
-----------
NICs are relevant to the discussion, but likely only on large servers.
The proposal needs to accomodate that.
Nicolas asked about support for the CPU as a device. A lot of pipelines
are hybrid, with CPU processing and dedicated hardware processing. James
said previous proposals were able to support the CPU as a device. The
last proposal was focussed on usages, so could support CPUs.
Demi things this could be viewed as in a similar way as type checking in
compilers, which have to resolve constraints.
Nicolas is annoyed that we force applications to make a decision,
requiring them to go the hard route of reallocation if they get it
wrong. Some of the parameters are the MMU configuration, which can't be
changed afterwards in Linux.
Demi said that there could be cases where the fastest thing to do is to
use shadow memory and copy. Nicolas said the first question that would
come back is if this is something userspace should decide. Yunxiang
asked if we're looking at designing a kernel interface to convey
constraints. Nicolas said some kernel APIs expose some constraints. For
instance, V4L2 allows discovering some stride constraints. Yunxiang
thinks constraints won't be able to scale. Capabilities would be
better. The difference is that the hardware device can have lots of
constraints, but could more easily say some of the things it can do.
Adding a new capability later wouldn't break anything, but adding a new
constraint would require all components to understand it. James said the
latest proposal handled constraints in a forward-compatible way with
versioned constraints. Demi prefers the capabilities approach. Yunxiang
said devices could expose which memory they can access.
Nicolas said that in GStreamer, the current approach is trial and error.
Capabilities would reduce trial and error. Everybody has hacks on top.
James is instead bringing a formula that solves this. As soon as each of
the nodes involved can be identified (which GStreamer can do now), we
can calculate and combine but can't sustain adding capabilities. Liviu
said GStreamer could tell which capabilities it supports, and push
hardware vendors to comply with that. If the hardware is not compatible,
GStreamer would provide converters. Nicolas said buffer sharing is a
trade-off. We will find things that won't break it but will make it
slower. Demi said that cache-incoherent DMA will usually have higher
bandwidth than cache-coherent DMA, unless all the components share the
same cache.
Discussion followed on capabilities vs. constraints. It's partly a
vocabulary matter. The first proposal from James was using the word
capability. Constraints in the last proposal describe what a device can
do.
Nicolas has only stride and number of planes as constraints in
GStreamer. James' mechanism has support for much more. Yunxiang asked if
we can include the pixel format as constraints. James said we first have
to resolve formats and modifiers, and then handle allocation
constraints. Yunxiang thinks the allocator should also take care of the
format. Nicolas said that when using a tiling modifier, we already
reduce the scope of incompatibilities. When using e.g. an Intel tiling
modifier, there's a bigger guarantee that the devices that support it
will be able to inter-operate as they're designed for that purpose.
Demi said it should be possible to validate parameters for buffers
without being Mesa. The format modifiers are way too opaque. James said
that for each format we need to query possible modifiers, and for each
format+modifier we need to query constraints. Modifiers are mostly
considered opaque to applications, constraints are semi-opaque, and
formats are not opaque.
The problem that remains hard to James is when it comes to locality, how
do we say "local to a device" ? There's no serializable representation
of a device. Nicolas says that as soon as it stays in the graphics
stack, the stack will hide the problem from applications. A sysfs path
could be used on Linux to identify a device.
James asked how an application would be allowed to allocate buffers from
e.g. a DRI device, if the allocator library told it that the allocation
needs to be done there. This starts becoming a permission issue or a
logind issue. Passing fds could help, but when sitting on top of GL, we
have no way to get an fd. Nicolas said Vulkan should be OK, but GL is
dead. Nicolas asked why it would be useful to get access to fds. James
said that at the bottom of the problem we have the question of which fd
we send an ioctl to to allocate memory.
We could start small to have something and break the chicken and egg
problem. James thought about using GBM to start with, but this isn't
good for GStreamer. James and Nicolas thought that kernel drivers would
register dmabuf heaps. One issue with dmabuf heaps today is that
allocation isn't tracked, so we bypass cgroups. DRM and V4L2 have the
same issue, offering an infinite amount of memory. logind has a
responsibility of not making it worse, so didn't allow access to dmabuf
heaps. The problem needs to be fixed in the kernel first, adding
accounting. This would then be an incentive to abandon device-specific
allocation APIs, as memory accounting would come for free when using
dmabuf heaps. Nicolas wonders why the obvious path forward of
implementing heaps for devices that have specific constraints didn't
happen. James thinks people may just have been too busy.
Demi brought up the VFIO case. The hardware device may not be managed by
the kernel, it may be managed by userspace, or passed to a guest.
Capabilities for those devices can't come from a kernel device. James
said the key is communicating the constraints in a serializable way.
Allocation would involve passing dmabufs between guests and hosts.
Allocation from DMA heaps and from subsystem-specific APIs will coexist
for a long time. This needs to be abstracted in a userspace library, so
that the underlying allocators can evolve.
Demi asked if GBM is needed when using Vulkan. Internally in mesa,
everything uses GBM for allocation. James said it's a good argument to
ask why not using Vulkan only. If we decide to use GBM to bootstrap this
evolution, and GBM allocates for a specific device, then it doesn't seem
to be a good fit. We don't want to add support for system memory
allocation to GBM. Erico said that there's a use case for GBM even when
using Vulkan when there's a separate display device that has no Vulkan
implementation.
We need an iterative approach. For instance a simple useful improvement
would be to expose stride constraints on DRM devices.
Conclusions
-----------
- We need some library (existing or new one)
- We need some API
- We need someone to bootstrap this
- We need a more iterative approach
Action points
-------------
- Add memory accounting to DMA heaps
- Push drivers to implement their own heaps to replace subsystem allocation APIs
--
Regards,
Laurent Pinchart
Hi,
On Sat, 5 Oct 2024 at 23:40, Pintu Kumar <quic_pintu(a)quicinc.com> wrote:
>
> These warnings/errors are reported by checkpatch.
> Fix them with minor changes to make it clean.
> No other functional changes.
>
> WARNING: Block comments use * on subsequent lines
> + /* only support discovering the end of the buffer,
> + but also allow SEEK_SET to maintain the idiomatic
>
> WARNING: Block comments use a trailing */ on a separate line
> + SEEK_END(0), SEEK_CUR(0) pattern */
>
> WARNING: Block comments use a trailing */ on a separate line
> + * before passing the sgt back to the exporter. */
>
> ERROR: "foo * bar" should be "foo *bar"
> +static struct sg_table * __map_dma_buf(struct dma_buf_attachment *attach,
>
> WARNING: Symbolic permissions 'S_IRUGO' are not preferred. Consider using octal permissions '0444'.
> + d = debugfs_create_file("bufinfo", S_IRUGO, dma_buf_debugfs_dir,
>
> total: 1 errors, 4 warnings, 1746 lines checked
>
> Signed-off-by: Pintu Kumar <quic_pintu(a)quicinc.com>
>
> ---
> Changes in V1 suggested by Sumit Semwal:
> Change commit title, and mention exact reason of fix in commit log.
> V1: https://lore.kernel.org/all/CAOuPNLg1=YCUFXW-76A_gZm_PE1MFSugNvg3dEdkfujXV_…
> ---
> drivers/dma-buf/dma-buf.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
> index 8892bc701a66..2e63d50e46d3 100644
> --- a/drivers/dma-buf/dma-buf.c
> +++ b/drivers/dma-buf/dma-buf.c
> @@ -176,8 +176,9 @@ static loff_t dma_buf_llseek(struct file *file, loff_t offset, int whence)
> dmabuf = file->private_data;
>
> /* only support discovering the end of the buffer,
> - but also allow SEEK_SET to maintain the idiomatic
> - SEEK_END(0), SEEK_CUR(0) pattern */
> + * but also allow SEEK_SET to maintain the idiomatic
> + * SEEK_END(0), SEEK_CUR(0) pattern.
> + */
> if (whence == SEEK_END)
> base = dmabuf->size;
> else if (whence == SEEK_SET)
> @@ -782,13 +783,14 @@ static void mangle_sg_table(struct sg_table *sg_table)
> /* To catch abuse of the underlying struct page by importers mix
> * up the bits, but take care to preserve the low SG_ bits to
> * not corrupt the sgt. The mixing is undone in __unmap_dma_buf
> - * before passing the sgt back to the exporter. */
> + * before passing the sgt back to the exporter.
> + */
> for_each_sgtable_sg(sg_table, sg, i)
> sg->page_link ^= ~0xffUL;
> #endif
>
> }
> -static struct sg_table * __map_dma_buf(struct dma_buf_attachment *attach,
> +static struct sg_table *__map_dma_buf(struct dma_buf_attachment *attach,
> enum dma_data_direction direction)
> {
> struct sg_table *sg_table;
> @@ -1694,7 +1696,7 @@ static int dma_buf_init_debugfs(void)
>
> dma_buf_debugfs_dir = d;
>
> - d = debugfs_create_file("bufinfo", S_IRUGO, dma_buf_debugfs_dir,
> + d = debugfs_create_file("bufinfo", 0444, dma_buf_debugfs_dir,
> NULL, &dma_buf_debug_fops);
> if (IS_ERR(d)) {
> pr_debug("dma_buf: debugfs: failed to create node bufinfo\n");
> --
Pushed V2 here. Any further comment on this ?
Thanks,
Pintu
On Tue, Oct 1, 2024 at 7:51 PM Pintu Kumar <quic_pintu(a)quicinc.com> wrote:
>
> Use of kmap_atomic/kunmap_atomic is deprecated, use
> kmap_local_page/kunmap_local instead.
>
> This is reported by checkpatch.
> Also fix repeated word issue.
>
> WARNING: Deprecated use of 'kmap_atomic', prefer 'kmap_local_page' instead
> + void *vaddr = kmap_atomic(page);
>
> WARNING: Deprecated use of 'kunmap_atomic', prefer 'kunmap_local' instead
> + kunmap_atomic(vaddr);
>
> WARNING: Possible repeated word: 'by'
> + * has been killed by by SIGKILL
>
> total: 0 errors, 3 warnings, 405 lines checked
>
> Signed-off-by: Pintu Kumar <quic_pintu(a)quicinc.com>
Reviewed-by: T.J. Mercier <tjmercier(a)google.com>
The Android kernels have been doing this for over a year, so should be
pretty well tested at this point:
https://r.android.com/c/kernel/common/+/2500840
> ---
> drivers/dma-buf/heaps/cma_heap.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/dma-buf/heaps/cma_heap.c b/drivers/dma-buf/heaps/cma_heap.c
> index 93be88b805fe..8c55431cc16c 100644
> --- a/drivers/dma-buf/heaps/cma_heap.c
> +++ b/drivers/dma-buf/heaps/cma_heap.c
> @@ -309,13 +309,13 @@ static struct dma_buf *cma_heap_allocate(struct dma_heap *heap,
> struct page *page = cma_pages;
>
> while (nr_clear_pages > 0) {
> - void *vaddr = kmap_atomic(page);
> + void *vaddr = kmap_local_page(page);
>
> memset(vaddr, 0, PAGE_SIZE);
> - kunmap_atomic(vaddr);
> + kunmap_local(vaddr);
> /*
> * Avoid wasting time zeroing memory if the process
> - * has been killed by by SIGKILL
> + * has been killed by SIGKILL.
> */
> if (fatal_signal_pending(current))
> goto free_cma;
> --
> 2.17.1
>
Hello Pintu,
On Tue, 1 Oct 2024 at 23:16, Pintu Kumar <quic_pintu(a)quicinc.com> wrote:
>
> Symbolic permissions are not preferred, instead use the octal.
> Also, fix other warnings/errors as well for cleanup.
>
> WARNING: Block comments use * on subsequent lines
> + /* only support discovering the end of the buffer,
> + but also allow SEEK_SET to maintain the idiomatic
>
> WARNING: Block comments use a trailing */ on a separate line
> + SEEK_END(0), SEEK_CUR(0) pattern */
>
> WARNING: Block comments use a trailing */ on a separate line
> + * before passing the sgt back to the exporter. */
>
> ERROR: "foo * bar" should be "foo *bar"
> +static struct sg_table * __map_dma_buf(struct dma_buf_attachment *attach,
>
> WARNING: Symbolic permissions 'S_IRUGO' are not preferred. Consider using octal permissions '0444'.
> + d = debugfs_create_file("bufinfo", S_IRUGO, dma_buf_debugfs_dir,
>
> total: 1 errors, 4 warnings, 1746 lines checked
>
> Signed-off-by: Pintu Kumar <quic_pintu(a)quicinc.com>
Thanks for this patch - could you please also mention in the commit
log how did you find this? It looks like you ran checkpatch, but it's
not clear from the commit log.
Since this patch does multiple things related to checkpatch warnings
(change S_IRUGO to 0444, comments correction, function declaration
correction), can I please ask you to change the commit title to also
reflect that?
> ---
> drivers/dma-buf/dma-buf.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
> index 8892bc701a66..2e63d50e46d3 100644
> --- a/drivers/dma-buf/dma-buf.c
> +++ b/drivers/dma-buf/dma-buf.c
> @@ -176,8 +176,9 @@ static loff_t dma_buf_llseek(struct file *file, loff_t offset, int whence)
> dmabuf = file->private_data;
>
> /* only support discovering the end of the buffer,
> - but also allow SEEK_SET to maintain the idiomatic
> - SEEK_END(0), SEEK_CUR(0) pattern */
> + * but also allow SEEK_SET to maintain the idiomatic
> + * SEEK_END(0), SEEK_CUR(0) pattern.
> + */
> if (whence == SEEK_END)
> base = dmabuf->size;
> else if (whence == SEEK_SET)
> @@ -782,13 +783,14 @@ static void mangle_sg_table(struct sg_table *sg_table)
> /* To catch abuse of the underlying struct page by importers mix
> * up the bits, but take care to preserve the low SG_ bits to
> * not corrupt the sgt. The mixing is undone in __unmap_dma_buf
> - * before passing the sgt back to the exporter. */
> + * before passing the sgt back to the exporter.
> + */
> for_each_sgtable_sg(sg_table, sg, i)
> sg->page_link ^= ~0xffUL;
> #endif
>
> }
> -static struct sg_table * __map_dma_buf(struct dma_buf_attachment *attach,
> +static struct sg_table *__map_dma_buf(struct dma_buf_attachment *attach,
> enum dma_data_direction direction)
> {
> struct sg_table *sg_table;
> @@ -1694,7 +1696,7 @@ static int dma_buf_init_debugfs(void)
>
> dma_buf_debugfs_dir = d;
>
> - d = debugfs_create_file("bufinfo", S_IRUGO, dma_buf_debugfs_dir,
> + d = debugfs_create_file("bufinfo", 0444, dma_buf_debugfs_dir,
> NULL, &dma_buf_debug_fops);
> if (IS_ERR(d)) {
> pr_debug("dma_buf: debugfs: failed to create node bufinfo\n");
> --
> 2.17.1
>
Best,
Sumit.