Linaro-mm-sig

linaro-mm-sig@lists.linaro.org

17 participants
4318 discussions

Re: [PATCH v5 07/16] block: introduce dma map backed bio type

by Christoph Hellwig

On Sat, Aug 01, 2026 at 04:46:19PM +0100, Pavel Begunkov wrote: > Premapped buffers don't require a generic bio_vec since these have > already been dma mapped. Repurpose the bi_io_vec space to strore dmabuf > maps as they are mutually exclusive. > > Suggested-by: Keith Busch <kbusch(a)kernel.org> > Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> > --- > block/bio.c | 15 +++++++++++++-- > block/blk-merge.c | 37 +++++++++++++++++++++++++++++++++++++ > block/fops.c | 2 +- > include/linux/bio.h | 9 +++++---- > include/linux/blk-mq.h | 7 +++++++ > include/linux/blk_types.h | 14 +++++++++++++- > include/linux/bvec.h | 3 ++- > 7 files changed, 78 insertions(+), 9 deletions(-) > > diff --git a/block/bio.c b/block/bio.c > index 898b2f5ef8c8..1602eab05761 100644 > --- a/block/bio.c > +++ b/block/bio.c > @@ -860,7 +860,11 @@ static int __bio_clone(struct bio *bio, struct bio *bio_src, gfp_t gfp) > bio->bi_write_hint = bio_src->bi_write_hint; > bio->bi_write_stream = bio_src->bi_write_stream; > bio->bi_iter = bio_src->bi_iter; > - bio->bi_io_vec = bio_src->bi_io_vec; > + > + if (op_is_dmabuf(bio->bi_opf)) > + bio->bi_dmabuf_map = bio_src->bi_dmabuf_map; > + else > + bio->bi_io_vec = bio_src->bi_io_vec; > > if (bio->bi_bdev) { > if (bio->bi_bdev == bio_src->bi_bdev && > @@ -1183,16 +1187,23 @@ EXPORT_SYMBOL_GPL(__bio_release_pages); > > bool bio_iov_iter_set(struct bio *bio, const struct iov_iter *iter) > { > - if (!iov_iter_is_bvec(iter)) > + if (!iov_iter_is_bvec(iter) && !iov_iter_is_dmabuf_map(iter)) > return false; > > WARN_ON_ONCE(bio->bi_max_vecs); > > + static_assert(offsetof(struct bio, bi_io_vec) == > + offsetof(struct bio, bi_dmabuf_map)); > + static_assert(offsetof(struct iov_iter, bvec) == > + offsetof(struct iov_iter, dmabuf_map)); > + > bio->bi_io_vec = (struct bio_vec *)iter->bvec; > bio->bi_iter.bi_idx = 0; > bio->bi_iter.bi_offset = iter->iov_offset; > bio->bi_iter.bi_size = iov_iter_count(iter); > bio_set_flag(bio, BIO_CLONED); > + if (iov_iter_is_dmabuf_map(iter)) > + bio->bi_opf |= REQ_NOMERGE | REQ_DMABUF; > return true; > } > > diff --git a/block/blk-merge.c b/block/blk-merge.c > index 258a726071d1..1beedc42a85d 100644 > --- a/block/blk-merge.c > +++ b/block/blk-merge.c > @@ -9,6 +9,7 @@ > #include <linux/blk-integrity.h> > #include <linux/part_stat.h> > #include <linux/blk-cgroup.h> > +#include <linux/dma-buf-io.h> > > #include <trace/events/block.h> > > @@ -319,6 +320,28 @@ static inline unsigned int bvec_seg_gap(struct bio_vec *bvprv, > return bv->bv_offset | (bvprv->bv_offset + bvprv->bv_len); > } > > +static inline int bio_split_io_at_dmabuf(struct bio *bio, > + const struct queue_limits *lim, unsigned *segs, > + unsigned max_bytes, unsigned len_align_mask, > + unsigned start_align_mask) > +{ > + unsigned bytes = min(bio->bi_iter.bi_size, max_bytes); > + unsigned seg_shift = bio->bi_dmabuf_map->seg_shift; > + unsigned offset = bio->bi_iter.bi_offset & ((1U << seg_shift) - 1); > + > + if ((bio->bi_iter.bi_offset & start_align_mask) || > + (bio->bi_iter.bi_size & len_align_mask)) > + return -EINVAL; > + > + /* single contiguous range into the dma-buf */ > + *segs = 1; > + > + bytes = min(bytes, ((unsigned)lim->max_segments << seg_shift) - offset); I guess ->seg_shift is some sort of encoding of a max segment size? Comments please.

1 month, 2 weeks

Re: [PATCH v5 01/16] dma-buf: introduce initial file I/O infrastructure

by Christoph Hellwig

On Sat, Aug 01, 2026 at 04:46:13PM +0100, Pavel Begunkov wrote: > The goal is to be able to natively use dma-buf in the read-write / IO > path. This patch adds basic building blocks serving as a glue and API > between drivers and upper layer subsystems providing the uAPI. Later > patches implement it for NVMe raw block devices and expose it to the > user space via io_uring. > > There are two main objects. struct dma_buf_io_ctx and struct > dma_buf_io_map. The ctx is used during initial registration and serves > as an interface between the upper layer user like io_uring and to the > importer subsystem / driver. The map represents the actual dma map > established for the target device[s] with dma_buf_map_attachment() and > stored in a device specific format. The context is created via a new > file operation ->init_dma_buf_io_ctx. > > The ctx-map separation exists to support map invalidation (see > dma_buf_io_invalidate_mappings()). A ctx can create > multiple maps during its lifetime, but there can only be no more than > one (active) map attached to it. Invalidation drops the active map > if present, and the next map will only be attempted to be created > once there is a new request that wants to use the dma-buf IO ctx. > > The primary task of the dma_buf_io_map object is to count requests > using it and to wait for their completion when we want to destroy the > DMA map. Invalidation is delayed by inserting a dma fence, which is > signaled when all flight requests are completed. > > [un]mapping and any work with dma addresses is delegated to the > importer driver via an ops table stored in the ctx, see struct > dma_buf_io_ops. Only the target driver / subsystem knows about devices > it wants to use the dma-buf with, especially in case of multi-device > filesystems or stacking in the future. > > Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> > --- > drivers/dma-buf/Makefile | 2 +- > drivers/dma-buf/dma-buf-io.c | 278 +++++++++++++++++++++++++++++++++++ > include/linux/dma-buf-io.h | 92 ++++++++++++ > include/linux/fs.h | 2 + > 4 files changed, 373 insertions(+), 1 deletion(-) > create mode 100644 drivers/dma-buf/dma-buf-io.c > create mode 100644 include/linux/dma-buf-io.h > > diff --git a/drivers/dma-buf/Makefile b/drivers/dma-buf/Makefile > index b25d7550bacf..523731b0f83e 100644 > --- a/drivers/dma-buf/Makefile > +++ b/drivers/dma-buf/Makefile > @@ -1,6 +1,6 @@ > # SPDX-License-Identifier: GPL-2.0-only > obj-y := dma-buf.o dma-fence.o dma-fence-array.o dma-fence-chain.o \ > - dma-fence-unwrap.o dma-resv.o dma-buf-mapping.o > + dma-fence-unwrap.o dma-resv.o dma-buf-mapping.o dma-buf-io.o > obj-$(CONFIG_DMABUF_HEAPS) += dma-heap.o > obj-$(CONFIG_DMABUF_HEAPS) += heaps/ > obj-$(CONFIG_SYNC_FILE) += sync_file.o > diff --git a/drivers/dma-buf/dma-buf-io.c b/drivers/dma-buf/dma-buf-io.c > new file mode 100644 > index 000000000000..24f58f80c45c > --- /dev/null > +++ b/drivers/dma-buf/dma-buf-io.c > @@ -0,0 +1,278 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > +/* > + * Common infrastructure for supporing dma-buf in the I/O path. > + * > + * Copyright (C) 2026 Pavel Begunkov <asml.silence(a)gmail.com> > + */ > +#include <linux/dma-buf-io.h> > +#include <linux/dma-resv.h> > + > +struct dma_buf_io_fence { > + struct dma_fence base; > + spinlock_t lock; > +}; > + > +static const char *dma_buf_io_fence_drv_name(struct dma_fence *fence) > +{ > + /* default fence release kfree's the base pointer */ > + BUILD_BUG_ON(offsetof(struct dma_buf_io_fence, base)); > + > + return "dma-buf-io-ctx"; > +} > + > +static const char *dma_buf_io_fence_timeline_name(struct dma_fence *fence) > +{ > + return "dma-buf-io-ctx"; > +} > + > +const struct dma_fence_ops dma_buf_io_fence_ops = { > + .get_driver_name = dma_buf_io_fence_drv_name, > + .get_timeline_name = dma_buf_io_fence_timeline_name, > +}; > + > +static void dma_buf_io_ctx_destroy_work(struct work_struct *work) > +{ > + struct dma_buf_io_ctx *ctx = container_of(work, struct dma_buf_io_ctx, > + release_work); > + > + if (WARN_ON_ONCE(refcount_read(&ctx->refs))) > + return; > + > + ctx->dev_ops->release(ctx); > + dma_buf_put(ctx->dmabuf); > + kfree(ctx); > +} > + > +static void dma_buf_io_map_release_work(struct work_struct *work) > +{ > + struct dma_buf_io_map *map = container_of(work, struct dma_buf_io_map, > + release_work); > + struct dma_buf_io_fence *fence = map->fence; > + struct dma_buf_io_ctx *ctx = map->ctx; > + struct dma_buf *dmabuf = ctx->dmabuf; > + > + /* the release path must wait for fences */ > + if (WARN_ON_ONCE(refcount_read(&ctx->refs) == 0)) > + return; > + > + /* Prevent from destoying the ctx while unmapping */ > + refcount_inc(&ctx->refs); > + > + /* > + * There are no more requests using the map, we can signal the fence. > + * It should be done before taking the resv lock as someone could be > + * waiting for the fence while holding the lock. > + */ > + dma_fence_signal(&fence->base); > + > + dma_resv_lock(dmabuf->resv, NULL); > + ctx->dev_ops->unmap(ctx, map); > + dma_resv_unlock(dmabuf->resv); > + > + dma_fence_put(&fence->base); > + percpu_ref_exit(&map->refs); > + kfree(map); > + > + if (refcount_dec_and_test(&ctx->refs)) { > + /* > + * Destruction needs to wait for I/O and dma fences. Defer it to > + * simplify locking. > + */ > + INIT_WORK(&ctx->release_work, dma_buf_io_ctx_destroy_work); > + queue_work(system_wq, &ctx->release_work); > + } > +} > + > +static void dma_buf_io_map_refs_release(struct percpu_ref *ref) > +{ > + struct dma_buf_io_map *map = container_of(ref, struct dma_buf_io_map, refs); > + > + /* might sleep, use a worker */ > + INIT_WORK(&map->release_work, dma_buf_io_map_release_work); > + queue_work(system_wq, &map->release_work); > +} > + > +int dma_buf_io_init_map(struct dma_buf_io_ctx *ctx, struct dma_buf_io_map *map) > +{ > + struct dma_buf_io_fence *fence = NULL; > + int ret; > + > + fence = kzalloc(sizeof(*fence), GFP_KERNEL); > + if (!fence) > + return -ENOMEM; > + > + ret = percpu_ref_init(&map->refs, dma_buf_io_map_refs_release, 0, GFP_KERNEL); > + if (ret) { > + kfree(fence); > + return ret; > + } > + > + spin_lock_init(&fence->lock); > + dma_fence_init(&fence->base, &dma_buf_io_fence_ops, &fence->lock, > + ctx->fence_ctx, atomic_inc_return(&ctx->fence_seq)); > + map->fence = fence; > + map->ctx = ctx; > + return 0; > +} > +EXPORT_SYMBOL_NS_GPL(dma_buf_io_init_map, "DMA_BUF"); > + > +struct dma_buf_io_map *dma_buf_io_create_map(struct dma_buf_io_ctx *ctx) > +{ > + struct dma_buf *dmabuf = ctx->dmabuf; > + struct dma_buf_io_map *map; > + long ret; > + > +retry: > + /* > + * ->dmabuf_map() will be calling dma_buf_map_attachment(), for which > + * we'll need to wait for fences. Do a bit nicer and try to wait > + * without the resv lock first. > + */ > + ret = dma_resv_wait_timeout(dmabuf->resv, DMA_RESV_USAGE_KERNEL, > + true, MAX_SCHEDULE_TIMEOUT); > + if (!ret) > + ret = -EAGAIN; > + if (ret < 0) > + return ERR_PTR(ret); > + > + ret = dma_resv_lock_interruptible(dmabuf->resv, NULL); > + if (ret) > + return ERR_PTR(ret); > + > + map = dma_buf_io_get_map(ctx); > + if (map) { > + ret = 0; > + goto out; > + } > + > + if (dma_resv_wait_timeout(dmabuf->resv, DMA_RESV_USAGE_KERNEL, > + true, 0) < 0) { > + dma_resv_unlock(dmabuf->resv); > + goto retry; > + } > + > + map = ctx->dev_ops->map(ctx); > + if (IS_ERR(map)) { > + ret = PTR_ERR(map); > + goto out; > + } > + > + if (WARN_ON_ONCE(!map->seg_shift)) > + return ERR_PTR(-EFAULT); > + > + percpu_ref_get(&map->refs); > + rcu_assign_pointer(ctx->map, map); > +out: > + dma_resv_unlock(dmabuf->resv); > + if (ret < 0) > + return ERR_PTR(ret); > + return map; > +} > + > +static void dma_buf_io_drop_map(struct dma_buf_io_ctx *ctx) > +{ > + struct dma_buf *dmabuf = ctx->dmabuf; > + struct dma_buf_io_map *map; > + int ret; > + > + dma_resv_assert_held(dmabuf->resv); > + > + map = rcu_dereference_protected(ctx->map, > + dma_resv_held(dmabuf->resv)); > + if (!map) > + return; > + rcu_assign_pointer(ctx->map, NULL); > + > + ret = dma_resv_reserve_fences(dmabuf->resv, 1); > + if (WARN_ON_ONCE(ret)) { > + struct dma_fence *fence = &map->fence->base; > + > + dma_fence_get(fence); > + percpu_ref_kill(&map->refs); > + dma_fence_wait(fence, false); > + dma_fence_put(fence); > + return; > + } > + > + dma_resv_add_fence(dmabuf->resv, &map->fence->base, > + DMA_RESV_USAGE_KERNEL); > + /* > + * Delay destruction until all inflight requests using the map are > + * gone. It'll also signal the fence then. > + */ > + percpu_ref_kill(&map->refs); > +} > + > +void dma_buf_io_invalidate_mappings(struct dma_buf_io_ctx *ctx) > +{ > + dma_buf_io_drop_map(ctx); > +} > +EXPORT_SYMBOL_NS_GPL(dma_buf_io_invalidate_mappings, "DMA_BUF"); > + > +static void dma_buf_io_ctx_release_work(struct work_struct *work) > +{ > + struct dma_buf_io_ctx *ctx = container_of(work, struct dma_buf_io_ctx, > + release_work); > + struct dma_buf *dmabuf = ctx->dmabuf; > + long ret; > + > + dma_resv_lock(dmabuf->resv, NULL); > + /* Remove the last map, there should be no new ones going forward. */ > + dma_buf_io_drop_map(ctx); > + dma_resv_unlock(dmabuf->resv); > + > + /* Wait until all maps are destroyed. */ > + ret = dma_resv_wait_timeout(dmabuf->resv, DMA_RESV_USAGE_KERNEL, > + false, MAX_SCHEDULE_TIMEOUT); > + > + if (WARN_ON_ONCE(ret <= 0)) > + return; > + if (WARN_ON_ONCE(rcu_dereference_protected(ctx->map, true))) > + return; > + > + if (refcount_dec_and_test(&ctx->refs)) > + dma_buf_io_ctx_destroy_work(&ctx->release_work); > +} > + > +void dma_buf_io_ctx_release(struct dma_buf_io_ctx *ctx) > +{ > + /* > + * Destruction needs to wait for I/O and dma fences. Defer it to > + * simplify locking. > + */ > + INIT_WORK(&ctx->release_work, dma_buf_io_ctx_release_work); > + queue_work(system_wq, &ctx->release_work); > +} > + > +int dma_buf_io_ctx_create(struct file *file, > + struct dma_buf_io_ctx *ctx, > + struct dma_buf *dmabuf, > + enum dma_data_direction dir) > +{ > + int ret; > + > + if (!file->f_op->init_dma_buf_io_ctx) > + return -EOPNOTSUPP; > + > + memset(ctx, 0, sizeof(*ctx)); > + ctx->fence_ctx = dma_fence_context_alloc(1); > + ctx->dir = dir; > + ctx->dmabuf = dmabuf; > + refcount_set(&ctx->refs, 1); > + get_dma_buf(dmabuf); > + > + ret = file->f_op->init_dma_buf_io_ctx(file, ctx); > + if (ret) { > + memset(ctx, 0, sizeof(*ctx)); > + dma_buf_put(dmabuf); > + return ret; > + } > + > + if (WARN_ON_ONCE(!ctx->dev_ops || > + !ctx->dev_ops->map || > + !ctx->dev_ops->unmap || > + !ctx->dev_ops->release)) > + return -EINVAL; > + > + return ret; > +} > diff --git a/include/linux/dma-buf-io.h b/include/linux/dma-buf-io.h > new file mode 100644 > index 000000000000..f31c7375ae91 > --- /dev/null > +++ b/include/linux/dma-buf-io.h > @@ -0,0 +1,92 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > +#ifndef __DMA_BUF_IO_H__ > +#define __DMA_BUF_IO_H__ > + > +#include <linux/dma-buf.h> > + > +struct dma_buf_io_fence; > +struct dma_buf_io_ctx; > +struct dma_buf_io_map; > + > +struct dma_buf_io_ops { > + /* > + * Create a new map for the given ctx. Called with the reservation > + * lock held. > + */ > + struct dma_buf_io_map *(*map)(struct dma_buf_io_ctx *ctx); > + > + /* > + * Clean up device specific parts of the @map. Called with the > + * reservation lock held. > + */ > + void (*unmap)(struct dma_buf_io_ctx *ctx, struct dma_buf_io_map *map); > + > + /* > + * The user tries to destroy the ctx. Release all device specific > + * parts of the token. > + */ > + void (*release)(struct dma_buf_io_ctx *); > +}; > + > +struct dma_buf_io_map { > + /* > + * Counts attached requests and other users. Device specific unmapping > + * is deferred until all refs are dropped. > + */ > + struct percpu_ref refs; > + unsigned seg_shift; Can you add a big fat comment explaining how seg_shift works here? I'm looking at the later patch using it for splitting and am very confused about it.

1 month, 2 weeks

Re: [PATCH v5 06/16] block: introduce bio_iov_iter_set()

by Christoph Hellwig

Looks good: Reviewed-by: Christoph Hellwig <hch(a)lst.de>

1 month, 2 weeks

Re: [PATCH] drm/gem: Move pages_to_sg helper into drm_gem.c

by Christian König

On 7/24/26 14:08, Adrián Larumbe wrote: > None of the semantics of the function tell of it being a PRIME-exclusive > entry point. In fact, most drivers seem to be using it to translate a list > of pages into an sg table that can be used for GPU mapping later on, rather > than just for sharing an object's pages with another driver. > > Move it across files and rename accordingly. > > Signed-off-by: Adrián Larumbe <adrian.larumbe(a)collabora.com> > --- > drm_prime_pages_to_sg() has no real dependency on PRIME/dma-buf interfaces. > It is a generic helper that converts a page array into a scatter/gather > table via dma_map_sg_attrs. Nothing in its implementation touches struct > dma_buf or import/export logic. It is correct that this helper is not DMA-buf dependent, but DMA-buf should be the only case when a DRM driver needs to convert an array of pages into an SG table. The background is that we want to discourage people from using SG tables because it was a rather bad design choice to have pages mangled with the DMA addresses in one structure in the first place. So question is why do you want to do this? Regards, Christian. > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 6 ++--- > drivers/gpu/drm/drm_gem.c | 35 ++++++++++++++++++++++++++ > drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- > drivers/gpu/drm/drm_prime.c | 38 ----------------------------- > drivers/gpu/drm/etnaviv/etnaviv_gem.c | 3 +-- > drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 3 ++- > drivers/gpu/drm/loongson/lsdc_gem.c | 3 +-- > drivers/gpu/drm/msm/msm_gem.c | 2 +- > drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- > drivers/gpu/drm/nouveau/nouveau_prime.c | 4 +-- > drivers/gpu/drm/panthor/panthor_gem.c | 6 ++--- > drivers/gpu/drm/radeon/radeon_prime.c | 5 ++-- > drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 6 ++--- > drivers/gpu/drm/tegra/gem.c | 4 +-- > drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 4 +-- > drivers/gpu/drm/xe/xe_dma_buf.c | 6 ++--- > drivers/gpu/drm/xen/xen_drm_front_gem.c | 2 +- > include/drm/drm_gem.h | 5 +++- > include/drm/drm_prime.h | 2 -- > 19 files changed, 68 insertions(+), 70 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c > index b33c300e26e2..c9a98aec7eb6 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c > @@ -203,9 +203,9 @@ static struct sg_table *amdgpu_dma_buf_map(struct dma_buf_attachment *attach, > > switch (bo->tbo.resource->mem_type) { > case TTM_PL_TT: > - sgt = drm_prime_pages_to_sg(obj->dev, > - bo->tbo.ttm->pages, > - bo->tbo.ttm->num_pages); > + sgt = drm_pages_to_sg(obj->dev, > + bo->tbo.ttm->pages, > + bo->tbo.ttm->num_pages); > if (IS_ERR(sgt)) > return sgt; > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > index 018df97d590d..22c8a3b5f667 100644 > --- a/drivers/gpu/drm/drm_gem.c > +++ b/drivers/gpu/drm/drm_gem.c > @@ -780,6 +780,41 @@ void drm_gem_put_pages(struct drm_gem_object *obj, struct page **pages, > } > EXPORT_SYMBOL(drm_gem_put_pages); > > +/** > + * drm_pages_to_sg - converts a page array into an sg list > + * @dev: DRM device > + * @pages: pointer to the array of page pointers to convert > + * @nr_pages: length of the page vector > + * > + * This helper creates an sg table object from a set of pages. > + * This is useful for implementing &drm_gem_object_funcs.get_sg_table. > + */ > +struct sg_table *drm_pages_to_sg(struct drm_device *dev, > + struct page **pages, unsigned int nr_pages) > +{ > + struct sg_table *sg; > + size_t max_segment = 0; > + int err; > + > + sg = kmalloc_obj(struct sg_table); > + if (!sg) > + return ERR_PTR(-ENOMEM); > + > + if (dev) > + max_segment = dma_max_mapping_size(drm_dev_dma_dev(dev)); > + if (max_segment == 0) > + max_segment = UINT_MAX; > + err = sg_alloc_table_from_pages_segment(sg, pages, nr_pages, 0, > + (unsigned long)nr_pages << PAGE_SHIFT, > + max_segment, GFP_KERNEL); > + if (err) { > + kfree(sg); > + sg = ERR_PTR(err); > + } > + return sg; > +} > +EXPORT_SYMBOL(drm_pages_to_sg); > + > static int objects_lookup(struct drm_file *filp, u32 *handle, int count, > struct drm_gem_object **objs) > { > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c > index 22ec52e2ffb8..144d088a477f 100644 > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > @@ -825,7 +825,7 @@ struct sg_table *drm_gem_shmem_get_sg_table(struct drm_gem_shmem_object *shmem) > > drm_WARN_ON(obj->dev, drm_gem_is_imported(obj)); > > - return drm_prime_pages_to_sg(obj->dev, shmem->pages, obj->size >> PAGE_SHIFT); > + return drm_pages_to_sg(obj->dev, shmem->pages, obj->size >> PAGE_SHIFT); > } > EXPORT_SYMBOL_GPL(drm_gem_shmem_get_sg_table); > > diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c > index 9b44c78cd77f..54539a8929c1 100644 > --- a/drivers/gpu/drm/drm_prime.c > +++ b/drivers/gpu/drm/drm_prime.c > @@ -835,44 +835,6 @@ static const struct dma_buf_ops drm_gem_prime_dmabuf_ops = { > .vunmap = drm_gem_dmabuf_vunmap, > }; > > -/** > - * drm_prime_pages_to_sg - converts a page array into an sg list > - * @dev: DRM device > - * @pages: pointer to the array of page pointers to convert > - * @nr_pages: length of the page vector > - * > - * This helper creates an sg table object from a set of pages > - * the driver is responsible for mapping the pages into the > - * importers address space for use with dma_buf itself. > - * > - * This is useful for implementing &drm_gem_object_funcs.get_sg_table. > - */ > -struct sg_table *drm_prime_pages_to_sg(struct drm_device *dev, > - struct page **pages, unsigned int nr_pages) > -{ > - struct sg_table *sg; > - size_t max_segment = 0; > - int err; > - > - sg = kmalloc_obj(struct sg_table); > - if (!sg) > - return ERR_PTR(-ENOMEM); > - > - if (dev) > - max_segment = dma_max_mapping_size(drm_dev_dma_dev(dev)); > - if (max_segment == 0) > - max_segment = UINT_MAX; > - err = sg_alloc_table_from_pages_segment(sg, pages, nr_pages, 0, > - (unsigned long)nr_pages << PAGE_SHIFT, > - max_segment, GFP_KERNEL); > - if (err) { > - kfree(sg); > - sg = ERR_PTR(err); > - } > - return sg; > -} > -EXPORT_SYMBOL(drm_prime_pages_to_sg); > - > /** > * drm_prime_get_contiguous_size - returns the contiguous size of the buffer > * @sgt: sg_table describing the buffer to check > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c > index b0436a1e103f..a8e8614f8210 100644 > --- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c > +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c > @@ -3,7 +3,6 @@ > * Copyright (C) 2015-2018 Etnaviv Project > */ > > -#include <drm/drm_prime.h> > #include <drm/drm_print.h> > #include <linux/dma-mapping.h> > #include <linux/shmem_fs.h> > @@ -104,7 +103,7 @@ struct page **etnaviv_gem_get_pages(struct etnaviv_gem_object *etnaviv_obj) > unsigned int npages = etnaviv_obj->base.size >> PAGE_SHIFT; > struct sg_table *sgt; > > - sgt = drm_prime_pages_to_sg(dev, etnaviv_obj->pages, npages); > + sgt = drm_pages_to_sg(dev, etnaviv_obj->pages, npages); > if (IS_ERR(sgt)) { > dev_err(dev->dev, "failed to allocate sgt: %ld\n", > PTR_ERR(sgt)); > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > index 6757ae6ec304..f44484325ddb 100644 > --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > @@ -3,6 +3,7 @@ > * Copyright (C) 2014-2018 Etnaviv Project > */ > > +#include <drm/drm_gem.h> > #include <drm/drm_prime.h> > #include <linux/dma-buf.h> > #include <linux/module.h> > @@ -22,7 +23,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj) > if (WARN_ON(!etnaviv_obj->pages)) /* should have already pinned! */ > return ERR_PTR(-EINVAL); > > - return drm_prime_pages_to_sg(obj->dev, etnaviv_obj->pages, npages); > + return drm_pages_to_sg(obj->dev, etnaviv_obj->pages, npages); > } > > int etnaviv_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map) > diff --git a/drivers/gpu/drm/loongson/lsdc_gem.c b/drivers/gpu/drm/loongson/lsdc_gem.c > index 2fb03487c983..37160228244c 100644 > --- a/drivers/gpu/drm/loongson/lsdc_gem.c > +++ b/drivers/gpu/drm/loongson/lsdc_gem.c > @@ -9,7 +9,6 @@ > #include <drm/drm_dumb_buffers.h> > #include <drm/drm_file.h> > #include <drm/drm_gem.h> > -#include <drm/drm_prime.h> > #include <drm/drm_print.h> > > #include "lsdc_drv.h" > @@ -51,7 +50,7 @@ static struct sg_table *lsdc_gem_prime_get_sg_table(struct drm_gem_object *obj) > return ERR_PTR(-ENOMEM); > } > > - return drm_prime_pages_to_sg(obj->dev, tt->pages, tt->num_pages); > + return drm_pages_to_sg(obj->dev, tt->pages, tt->num_pages); > } > > static void lsdc_gem_object_free(struct drm_gem_object *obj) > diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c > index efd3d3c9a449..7e3418290c22 100644 > --- a/drivers/gpu/drm/msm/msm_gem.c > +++ b/drivers/gpu/drm/msm/msm_gem.c > @@ -207,7 +207,7 @@ static struct page **get_pages(struct drm_gem_object *obj) > > msm_obj->pages = p; > > - msm_obj->sgt = drm_prime_pages_to_sg(obj->dev, p, npages); > + msm_obj->sgt = drm_pages_to_sg(obj->dev, p, npages); > if (IS_ERR(msm_obj->sgt)) { > void *ptr = ERR_CAST(msm_obj->sgt); > > diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c > index 036d34c674d9..d25393a9e549 100644 > --- a/drivers/gpu/drm/msm/msm_gem_prime.c > +++ b/drivers/gpu/drm/msm/msm_gem_prime.c > @@ -23,7 +23,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj) > if (WARN_ON(!msm_obj->pages)) /* should have already pinned! */ > return ERR_PTR(-ENOMEM); > > - return drm_prime_pages_to_sg(obj->dev, msm_obj->pages, npages); > + return drm_pages_to_sg(obj->dev, msm_obj->pages, npages); > } > > int msm_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map) > diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c > index caab60fc62f6..b95f2f07df74 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_prime.c > +++ b/drivers/gpu/drm/nouveau/nouveau_prime.c > @@ -32,8 +32,8 @@ struct sg_table *nouveau_gem_prime_get_sg_table(struct drm_gem_object *obj) > { > struct nouveau_bo *nvbo = nouveau_gem_object(obj); > > - return drm_prime_pages_to_sg(obj->dev, nvbo->bo.ttm->pages, > - nvbo->bo.ttm->num_pages); > + return drm_pages_to_sg(obj->dev, nvbo->bo.ttm->pages, > + nvbo->bo.ttm->num_pages); > } > > struct drm_gem_object *nouveau_gem_prime_import_sg_table(struct drm_device *dev, > diff --git a/drivers/gpu/drm/panthor/panthor_gem.c b/drivers/gpu/drm/panthor/panthor_gem.c > index 9855df738194..ec530d254fa4 100644 > --- a/drivers/gpu/drm/panthor/panthor_gem.c > +++ b/drivers/gpu/drm/panthor/panthor_gem.c > @@ -321,8 +321,8 @@ panthor_gem_dev_map_get_sgt_locked(struct panthor_gem_object *bo) > if (ret) > return ERR_PTR(ret); > > - sgt = drm_prime_pages_to_sg(bo->base.dev, bo->backing.pages, > - bo->base.size >> PAGE_SHIFT); > + sgt = drm_pages_to_sg(bo->base.dev, bo->backing.pages, > + bo->base.size >> PAGE_SHIFT); > if (IS_ERR(sgt)) > return sgt; > > @@ -702,7 +702,7 @@ static struct sg_table *panthor_gem_get_sg_table(struct drm_gem_object *obj) > drm_WARN_ON_ONCE(obj->dev, !bo->backing.pages); > drm_WARN_ON_ONCE(obj->dev, !refcount_read(&bo->backing.pin_count)); > > - return drm_prime_pages_to_sg(obj->dev, bo->backing.pages, obj->size >> PAGE_SHIFT); > + return drm_pages_to_sg(obj->dev, bo->backing.pages, obj->size >> PAGE_SHIFT); > } > > static int panthor_gem_vmap_locked(struct drm_gem_object *obj, > diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c > index a77881f035e7..4cfc4282a59c 100644 > --- a/drivers/gpu/drm/radeon/radeon_prime.c > +++ b/drivers/gpu/drm/radeon/radeon_prime.c > @@ -26,6 +26,7 @@ > > #include <linux/dma-buf.h> > > +#include <drm/drm_gem.h> > #include <drm/drm_prime.h> > #include <drm/radeon_drm.h> > > @@ -38,8 +39,8 @@ struct sg_table *radeon_gem_prime_get_sg_table(struct drm_gem_object *obj) > { > struct radeon_bo *bo = gem_to_radeon_bo(obj); > > - return drm_prime_pages_to_sg(obj->dev, bo->tbo.ttm->pages, > - bo->tbo.ttm->num_pages); > + return drm_pages_to_sg(obj->dev, bo->tbo.ttm->pages, > + bo->tbo.ttm->num_pages); > } > > struct drm_gem_object *radeon_gem_prime_import_sg_table(struct drm_device *dev, > diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > index b188539dca0b..7897da0becf4 100644 > --- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > +++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > @@ -89,8 +89,8 @@ static int rockchip_gem_get_pages(struct rockchip_gem_object *rk_obj) > > rk_obj->num_pages = rk_obj->base.size >> PAGE_SHIFT; > > - rk_obj->sgt = drm_prime_pages_to_sg(rk_obj->base.dev, > - rk_obj->pages, rk_obj->num_pages); > + rk_obj->sgt = drm_pages_to_sg(rk_obj->base.dev, > + rk_obj->pages, rk_obj->num_pages); > if (IS_ERR(rk_obj->sgt)) { > ret = PTR_ERR(rk_obj->sgt); > goto err_put_pages; > @@ -432,7 +432,7 @@ struct sg_table *rockchip_gem_prime_get_sg_table(struct drm_gem_object *obj) > int ret; > > if (rk_obj->pages) > - return drm_prime_pages_to_sg(obj->dev, rk_obj->pages, rk_obj->num_pages); > + return drm_pages_to_sg(obj->dev, rk_obj->pages, rk_obj->num_pages); > > sgt = kzalloc_obj(*sgt); > if (!sgt) > diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c > index 436394e04812..701af672b4e5 100644 > --- a/drivers/gpu/drm/tegra/gem.c > +++ b/drivers/gpu/drm/tegra/gem.c > @@ -17,7 +17,7 @@ > > #include <drm/drm_drv.h> > #include <drm/drm_dumb_buffers.h> > -#include <drm/drm_prime.h> > +#include <drm/drm_gem.h> > > #include "drm.h" > #include "gem.h" > @@ -352,7 +352,7 @@ static int tegra_bo_get_pages(struct drm_device *drm, struct tegra_bo *bo) > > bo->num_pages = bo->gem.size >> PAGE_SHIFT; > > - bo->sgt = drm_prime_pages_to_sg(bo->gem.dev, bo->pages, bo->num_pages); > + bo->sgt = drm_pages_to_sg(bo->gem.dev, bo->pages, bo->num_pages); > if (IS_ERR(bo->sgt)) { > err = PTR_ERR(bo->sgt); > goto put_pages; > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c > index 39f8c46550c2..c9e7f2e3668c 100644 > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c > @@ -28,7 +28,7 @@ > #include "vmwgfx_bo.h" > #include "vmwgfx_drv.h" > > -#include "drm/drm_prime.h" > +#include "drm/drm_gem.h" > #include "drm/drm_gem_ttm_helper.h" > > #include <linux/debugfs.h> > @@ -76,7 +76,7 @@ static struct sg_table *vmw_gem_object_get_sg_table(struct drm_gem_object *obj) > if (vmw_tt->vsgt.sgt) > return vmw_tt->vsgt.sgt; > > - return drm_prime_pages_to_sg(obj->dev, vmw_tt->dma_ttm.pages, vmw_tt->dma_ttm.num_pages); > + return drm_pages_to_sg(obj->dev, vmw_tt->dma_ttm.pages, vmw_tt->dma_ttm.num_pages); > } > > static int vmw_gem_vmap(struct drm_gem_object *obj, struct iosys_map *map) > diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c > index 8a920e58245c..f0fe80706b79 100644 > --- a/drivers/gpu/drm/xe/xe_dma_buf.c > +++ b/drivers/gpu/drm/xe/xe_dma_buf.c > @@ -118,9 +118,9 @@ static struct sg_table *xe_dma_buf_map(struct dma_buf_attachment *attach, > > switch (bo->ttm.resource->mem_type) { > case XE_PL_TT: > - sgt = drm_prime_pages_to_sg(obj->dev, > - bo->ttm.ttm->pages, > - obj->size >> PAGE_SHIFT); > + sgt = drm_pages_to_sg(obj->dev, > + bo->ttm.ttm->pages, > + obj->size >> PAGE_SHIFT); > if (IS_ERR(sgt)) > return sgt; > > diff --git a/drivers/gpu/drm/xen/xen_drm_front_gem.c b/drivers/gpu/drm/xen/xen_drm_front_gem.c > index eec4c1da3f9e..a4a7c7f2c91c 100644 > --- a/drivers/gpu/drm/xen/xen_drm_front_gem.c > +++ b/drivers/gpu/drm/xen/xen_drm_front_gem.c > @@ -236,7 +236,7 @@ struct sg_table *xen_drm_front_gem_get_sg_table(struct drm_gem_object *gem_obj) > if (!xen_obj->pages) > return ERR_PTR(-ENOMEM); > > - return drm_prime_pages_to_sg(gem_obj->dev, > + return drm_pages_to_sg(gem_obj->dev, > xen_obj->pages, xen_obj->num_pages); > } > > diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h > index 885244e375d3..7b9cc6335689 100644 > --- a/include/drm/drm_gem.h > +++ b/include/drm/drm_gem.h > @@ -155,7 +155,7 @@ struct drm_gem_object_funcs { > * here cannot be used for sg tables pointing at driver private memory > * ranges. > * > - * See also drm_prime_pages_to_sg(). > + * See also drm_pages_to_sg(). > */ > struct sg_table *(*get_sg_table)(struct drm_gem_object *obj); > > @@ -589,6 +589,9 @@ struct page **drm_gem_get_pages(struct drm_gem_object *obj); > void drm_gem_put_pages(struct drm_gem_object *obj, struct page **pages, > bool dirty, bool accessed); > > +struct sg_table *drm_pages_to_sg(struct drm_device *dev, > + struct page **pages, unsigned int nr_pages); > + > void drm_gem_lock(struct drm_gem_object *obj); > void drm_gem_unlock(struct drm_gem_object *obj); > > diff --git a/include/drm/drm_prime.h b/include/drm/drm_prime.h > index f50f862f0d8b..603e16a40ae7 100644 > --- a/include/drm/drm_prime.h > +++ b/include/drm/drm_prime.h > @@ -92,8 +92,6 @@ void drm_gem_dmabuf_vunmap(struct dma_buf *dma_buf, struct iosys_map *map); > int drm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma); > int drm_gem_dmabuf_mmap(struct dma_buf *dma_buf, struct vm_area_struct *vma); > > -struct sg_table *drm_prime_pages_to_sg(struct drm_device *dev, > - struct page **pages, unsigned int nr_pages); > struct dma_buf *drm_gem_prime_export(struct drm_gem_object *obj, > int flags); > > > --- > base-commit: 48dd37d1fef33fbf42f1d6887c61e242fd21d00d > change-id: 20260724-get_pages-e2e91c53eaa3 > > Best regards, > -- > Adrián Larumbe <adrian.larumbe(a)collabora.com> >

1 month, 2 weeks

Re: [PATCH v2] dma-buf/udmabuf: Disable the size limit by default

by Kasireddy, Vivek

> Subject: Re: [PATCH v2] dma-buf/udmabuf: Disable the size limit by > default > > On 28.07.26 22:20, Kasireddy, Vivek wrote: > > Hi Robert, > > > >> Subject: [PATCH v2] dma-buf/udmabuf: Disable the size limit by > default > >> > >> As udmabuf increasingly enjoys popularity - being used in projects > like > >> libcamera, Gstreamer, Mesa, KWin and Weston - users more > frequently > >> encounter cases where the current default size limit of 64MB is too > low. > >> Examples include allocating video buffers at a 8K resolution - and > even > >> 4K > >> is affected when using non-subsampled video formats and high bit > >> depths. > >> > >> In its current form the size limit for individual buffers does not seem > to > >> provide any additional level of protection - such as limiting the > amount > >> of > >> memory a process can pin - as the later can just allocate multiple > >> buffers. > >> If additional guardrails are desired, they would likely require some > kind > >> accounting not limited to individual buffers. > >> > >> Therefor let's disable the size limit by default by setting it to the > >> maximal possible value, INT_MAX. > >> > >> Signed-off-by: Robert Mader <robert.mader(a)collabora.com> > >> > >> --- > >> > >> Changes in V2: > >> - Use INT_MAX instead of 0 in order to not change behavior > otherwise. > >> > >> See > >> https://lore.kernel.org/dri-devel/20260711144814.8205-1- > >> robert.mader(a)collabora.com/ > >> for a previous attempt to make the value configurable via kconfig - > and > >> in particular > >> https://lore.kernel.org/dri-devel/6764ca6f-b4d8-4baa-9d27- > >> 2ca867ac2d41(a)amd.com/ > >> for the suggestion and discussion to remove the default limit. > >> --- > >> drivers/dma-buf/udmabuf.c | 4 ++-- > >> 1 file changed, 2 insertions(+), 2 deletions(-) > >> > >> diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c > >> index bced421c0d65..639e93704924 100644 > >> --- a/drivers/dma-buf/udmabuf.c > >> +++ b/drivers/dma-buf/udmabuf.c > >> @@ -20,9 +20,9 @@ static int list_limit = 1024; > >> module_param(list_limit, int, 0644); > >> MODULE_PARM_DESC(list_limit, "udmabuf_create_list->count limit. > >> Default is 1024."); > >> > >> -static int size_limit_mb = 64; > >> +static int size_limit_mb = INT_MAX; > >> module_param(size_limit_mb, int, 0644); > >> -MODULE_PARM_DESC(size_limit_mb, "Max size of a dmabuf, in > >> megabytes. Default is 64."); > >> +MODULE_PARM_DESC(size_limit_mb, "Max size of a dmabuf, in > >> megabytes. Default is INT_MAX."); > > Acked-by: Vivek Kasireddy <vivek.kasireddy(a)intel.com> > > > > If there are no further concerns/questions from anyone, I'll push it to > > drm-misc-next soon. > > FTR., we already have a first duplicate :P > > https://lore.kernel.org/dri-devel/20260803144120.11524-1- > xaver.hugl(a)kde.org/ Yeah, looks like this change seems to be desirable in many use-cases. I have pushed it to drm-misc-next today. Thanks, Vivek > > > > > Thanks, > > Vivek > >> struct udmabuf { > >> pgoff_t pagecount; > >> -- > >> 2.55.0 > > -- > Robert Mader > Consultant Software Developer > > Collabora Ltd. > Platinum Building, St John's Innovation Park, Cambridge CB4 0DS, UK > Registered in England & Wales, no. 5513718

1 month, 2 weeks

[PATCH V5] i2c: qcom-geni: Add dynamic transfer timeout based on transfer length and frequency

by Aniket Randive

The driver uses a static XFER_TIMEOUT of HZ (1 second) for all transfers regardless of message length or bus frequency, causing unnecessary delays on error paths. Compute the timeout dynamically from message length and bus frequency with a 10x safety margin over the theoretical wire time. Add a 300 ms floor to account for I2C clock stretching and other situations where a slave may keep SCL asserted for an extended period, including faulty devices holding the bus. This replaces the fixed 1-second timeout with a transfer-specific timeout while preserving sufficient margin for software overheads and bus-level delays. For GPI multi-descriptor transfers, use the maximum message length across all queued messages as the per-completion timeout. Signed-off-by: Aniket Randive <aniket.randive(a)oss.qualcomm.com> --- Changes in V5: - Updated the commit message as per the review comments. Changes in V4: - As per konrad suggestion used mult_frac() for bit_usec to avoid intermediate overflow on 32-bit targets. - Updated the commit message and added a driver comment explaining the rationale for the 0.3-second minimum timeout floor value. drivers/i2c/busses/i2c-qcom-geni.c | 47 +++++++++++++++++++++++------- 1 file changed, 37 insertions(+), 10 deletions(-) diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c index 96dbf04138be..f011d2564cd2 100644 --- a/drivers/i2c/busses/i2c-qcom-geni.c +++ b/drivers/i2c/busses/i2c-qcom-geni.c @@ -74,9 +74,14 @@ enum geni_i2c_err_code { #define PACKING_BYTES_PW 4 #define ABORT_TIMEOUT HZ -#define XFER_TIMEOUT HZ #define RST_TIMEOUT HZ +/* 9 bits per byte (8 data + 1 ACK), 10x safety margin */ +#define I2C_TIMEOUT_SAFETY_COEFFICIENT 10 + +/* 300ms floor: budget for clock stretching; slave may hold SCL low indefinitely */ +#define I2C_TIMEOUT_MIN_USEC 300000 + struct geni_i2c_desc { bool no_dma_support; unsigned int tx_fifo_depth; @@ -204,6 +209,16 @@ static int geni_i2c_clk_map_idx(struct geni_i2c_dev *gi2c) return -EINVAL; } +static unsigned long geni_i2c_xfer_timeout(struct geni_i2c_dev *gi2c, size_t len) +{ + size_t bit_cnt = len * 9; + size_t bit_usec = mult_frac(bit_cnt, USEC_PER_SEC, gi2c->clk_freq_out); + size_t xfer_max_usec = (bit_usec * I2C_TIMEOUT_SAFETY_COEFFICIENT) + + I2C_TIMEOUT_MIN_USEC; + + return usecs_to_jiffies(xfer_max_usec); +} + static int qcom_geni_i2c_conf(struct geni_se *se, unsigned long freq) { struct geni_i2c_dev *gi2c = dev_get_drvdata(se->dev); @@ -445,7 +460,7 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, u32 m_param) { dma_addr_t rx_dma = 0; - unsigned long time_left; + unsigned long time_left, timeout; void *dma_buf; struct geni_se *se = &gi2c->se; size_t len = msg->len; @@ -470,8 +485,9 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, gi2c->dma_buf = dma_buf; } + timeout = geni_i2c_xfer_timeout(gi2c, len); cur = gi2c->cur; - time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT); + time_left = wait_for_completion_timeout(&gi2c->done, timeout); if (!time_left) geni_i2c_abort_xfer(gi2c); @@ -484,7 +500,7 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, u32 m_param) { dma_addr_t tx_dma = 0; - unsigned long time_left; + unsigned long time_left, timeout; void *dma_buf; struct geni_se *se = &gi2c->se; size_t len = msg->len; @@ -512,8 +528,9 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, if (!dma_buf) /* Get FIFO IRQ */ writel_relaxed(1, se->base + SE_GENI_TX_WATERMARK_REG); + timeout = geni_i2c_xfer_timeout(gi2c, len); cur = gi2c->cur; - time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT); + time_left = wait_for_completion_timeout(&gi2c->done, timeout); if (!time_left) geni_i2c_abort_xfer(gi2c); @@ -591,7 +608,7 @@ static void geni_i2c_gpi_multi_desc_unmap(struct geni_i2c_dev *gi2c, struct i2c_ * geni_i2c_gpi_multi_xfer_timeout_handler() - Handles multi message transfer timeout * @dev: Pointer to the corresponding dev node * @multi_xfer: Pointer to the geni_i2c_gpi_multi_desc_xfer - * @transfer_timeout_msecs: Timeout value in milliseconds + * @transfer_timeout_msecs: Per-message completion timeout in jiffies * @transfer_comp: Completion object of the transfer * * This function waits for the completion of each processed transfer messages @@ -601,7 +618,7 @@ static void geni_i2c_gpi_multi_desc_unmap(struct geni_i2c_dev *gi2c, struct i2c_ */ static int geni_i2c_gpi_multi_xfer_timeout_handler(struct device *dev, struct geni_i2c_gpi_multi_desc_xfer *multi_xfer, - u32 transfer_timeout_msecs, + unsigned long timeout_jiffies, struct completion *transfer_comp) { int i; @@ -612,7 +629,7 @@ static int geni_i2c_gpi_multi_xfer_timeout_handler(struct device *dev, if (multi_xfer->msg_idx_cnt != multi_xfer->irq_cnt) { time_left = wait_for_completion_timeout(transfer_comp, - transfer_timeout_msecs); + timeout_jiffies); if (!time_left) { dev_err(dev, "%s: Transfer timeout\n", __func__); return -ETIMEDOUT; @@ -736,8 +753,16 @@ static int geni_i2c_gpi(struct geni_i2c_dev *gi2c, struct i2c_msg msgs[], dma_async_issue_pending(gi2c->tx_c); if ((msg_idx == (gi2c->num_msgs - 1)) || flags & DMA_PREP_INTERRUPT) { + unsigned long timeout; + size_t max_len = 0; + int j; + + for (j = 0; j < gi2c->num_msgs; j++) + max_len = max_t(size_t, max_len, msgs[j].len); + + timeout = geni_i2c_xfer_timeout(gi2c, max_len); ret = geni_i2c_gpi_multi_xfer_timeout_handler(gi2c->se.dev, gi2c_gpi_xfer, - XFER_TIMEOUT, &gi2c->done); + timeout, &gi2c->done); if (ret) { dev_err(gi2c->se.dev, "I2C multi write msg transfer timeout: %d\n", @@ -851,8 +876,10 @@ static int geni_i2c_gpi_xfer(struct geni_i2c_dev *gi2c, struct i2c_msg msgs[], i } if (!gi2c->is_tx_multi_desc_xfer) { + unsigned long timeout = geni_i2c_xfer_timeout(gi2c, msgs[i].len); + dma_async_issue_pending(gi2c->tx_c); - time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT); + time_left = wait_for_completion_timeout(&gi2c->done, timeout); if (!time_left) { dev_err(gi2c->se.dev, "%s:I2C timeout\n", __func__); gi2c->err = -ETIMEDOUT; -- 2.34.1

1 month, 2 weeks

Re: [PATCH net-next v6 3/3] selftests/net: devmem.py: add check_rx_large_niov

by Jakub Kicinski

On Fri, 31 Jul 2026 15:01:01 -0700 Bobby Eshleman wrote: > Meanwhile, do we want drivers/net/hw/config to workaround by carrying > something like SYNC_FILE or DMABUF_HEAPS, or wait and see about the > udmabuf kconfig change? Let's enable SYNC_FILE for now and pursue the UDMABUF change in parallel. It will land in another tree if at all, so we'll have to wait a while before it propagates to us.

1 month, 2 weeks

Re: [PATCH v5 3/4] drm/prime: use dma_buf_fd_install() to preserve export tracing

by T.J. Mercier

On Wed, Jul 29, 2026 at 11:27 PM Baineng Shou <shoubaineng(a)gmail.com> wrote: > > drm_gem_prime_handle_to_fd() open-codes fd reservation and install > using get_unused_fd_flags() + fd_install() directly. This bypasses > the DMA_BUF_TRACE() call that dma_buf_fd() emits, so observability > tools relying on the trace_dma_buf_fd tracepoint silently miss all > DRM PRIME exports. > > Replace the bare fd_install() with dma_buf_fd_install(), which wraps > fd_install() together with DMA_BUF_TRACE(), restoring full tracepoint > coverage. No functional change; the fd lifecycle (get_unused_fd_flags > → work → install) is already correct. > > Note: this patch depends on dma_buf_fd_install() introduced in > "dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds" > [1]. > > [1] https://lore.kernel.org/dri-devel/20260714114654.3885457-2-shoubaineng@gmai… > > Suggested-by: Christian König <christian.koenig(a)amd.com> > Signed-off-by: Baineng Shou <shoubaineng(a)gmail.com> Reviewed-by: T.J. Mercier <tjmercier(a)google.com> > --- > drivers/gpu/drm/drm_prime.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c > index 9b44c78cd77f..fe3436d1235d 100644 > --- a/drivers/gpu/drm/drm_prime.c > +++ b/drivers/gpu/drm/drm_prime.c > @@ -524,7 +524,7 @@ int drm_gem_prime_handle_to_fd(struct drm_device *dev, > return PTR_ERR(dmabuf); > } > > - fd_install(fd, dmabuf->file); > + dma_buf_fd_install(dmabuf, fd); > *prime_fd = fd; > return 0; > } > -- > 2.34.1 >

1 month, 2 weeks

Re: [PATCH v5 4/4] selftests: dmabuf-heaps: add fd-leak-on-EFAULT regression test

by T.J. Mercier

On Wed, Jul 29, 2026 at 11:27 PM Baineng Shou <shoubaineng(a)gmail.com> wrote: > > Add a test case that verifies no file descriptor is leaked when > DMA_HEAP_IOCTL_ALLOC succeeds internally but copy_to_user() fails > to deliver the fd number back to userspace. > > The failure is triggered by placing the ioctl argument in a private > anonymous page and flipping it to PROT_READ (via mprotect) between > the kernel's copy_from_user() and copy_to_user() calls. With the > buggy kernel the ioctl returns -EFAULT but leaves an extra open fd > in the process's fd table; with the fixed kernel the fd count is > unchanged. > > This serves as a regression test for: > "dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds" > > Suggested-by: Sumit Semwal <sumit.semwal(a)linaro.org> > Signed-off-by: Baineng Shou <shoubaineng(a)gmail.com> > --- > .../selftests/dmabuf-heaps/dmabuf-heap.c | 115 +++++++++++++++++- > 1 file changed, 114 insertions(+), 1 deletion(-) > > diff --git a/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c b/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c > index fc9694fc4e89..bd58e5b06c8b 100644 > --- a/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c > +++ b/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c > @@ -390,6 +390,118 @@ static void test_alloc_errors(char *heap_name) > close(heap_fd); > } > > +/* > + * test_alloc_no_fd_leak_on_efault - verify no fd is leaked when > + * copy_to_user() fails during DMA_HEAP_IOCTL_ALLOC. > + * > + * The bug: dma_buf_fd() called fd_install() before copy_to_user(). > + * If copy_to_user() then failed (e.g. via mprotect), the fd was > + * silently installed in the fd table but never returned to userspace. > + * > + * The fix: reserve the fd with get_unused_fd_flags() first, attempt > + * copy_to_user(), and only call fd_install() on success. > + * > + * We trigger the failure by placing the ioctl argument in a page, > + * flipping it to PROT_READ between copy_from_user and copy_to_user, > + * and counting open file descriptors before and after. > + */ > +static void test_alloc_no_fd_leak_on_efault(char *heap_name) > +{ > + int heap_fd = -1; > + int fd_before, fd_after; > + int ret; > + long page_size; > + struct dma_heap_allocation_data *req; > + > + ksft_print_msg("Testing no fd leak when copy_to_user() fails:\n"); > + > + heap_fd = dmabuf_heap_open(heap_name); > + > + page_size = sysconf(_SC_PAGESIZE); > + > + /* > + * Place the ioctl argument in its own private anonymous page so > + * we can flip its protection independently. > + */ > + req = mmap(NULL, page_size, PROT_READ | PROT_WRITE, > + MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); > + if (req == MAP_FAILED) { > + ksft_test_result_fail("mmap failed: %s\n", strerror(errno)); > + goto out; > + } > + > + memset(req, 0, sizeof(*req)); > + req->len = page_size; > + req->fd_flags = O_RDWR | O_CLOEXEC; > + > + /* Count open fds before the ioctl */ > + fd_before = 0; > + { > + DIR *d = opendir("/proc/self/fd"); > + struct dirent *de; > + > + if (!d) { > + ksft_test_result_fail("opendir /proc/self/fd: %s\n", > + strerror(errno)); > + munmap(req, page_size); > + goto out; > + } > + while ((de = readdir(d))) > + if (de->d_name[0] != '.') > + fd_before++; > + closedir(d); > + /* subtract the fd opened by opendir itself */ But no actual subtraction? > + } > + > + /* > + * Make the page read-only: copy_from_user() in the kernel will > + * still succeed (it already ran), Huh? copy_from_user hasn't run yet. That happens inside the ioctl(). > but copy_to_user() that writes > + * the fd number back will fault. > + */ > + mprotect(req, page_size, PROT_READ); > + > + ret = ioctl(heap_fd, DMA_HEAP_IOCTL_ALLOC, req); > + > + /* Re-allow writes so munmap can clean up */ > + mprotect(req, page_size, PROT_READ | PROT_WRITE); > + munmap(req, page_size); > + > + if (ret != -1 || errno != EFAULT) { This looks like you meant &&, but I think we should just fail if ret != -1. Either the mprotect is broken, or dma-heap didn't actually try to copy_to_user. > + /* > + * If the ioctl didn't fail with EFAULT, either the kernel > + * handled it differently or mprotect raced. mprotect is synchronous, how could it race with anything here? > Skip rather > + * than giving a false pass/fail. > + */ > + ksft_test_result_skip( > + "ioctl did not return EFAULT (ret=%d errno=%d), skipping\n", > + ret, errno); > + goto out; > + } > + > + /* Count open fds after the failed ioctl */ > + fd_after = 0; > + { > + DIR *d = opendir("/proc/self/fd"); > + struct dirent *de; > + > + if (!d) { > + ksft_test_result_fail("opendir /proc/self/fd: %s\n", > + strerror(errno)); > + goto out; > + } > + while ((de = readdir(d))) > + if (de->d_name[0] != '.') > + fd_after++; > + closedir(d); > + } > + > + ksft_test_result(fd_before == fd_after, > + "no fd leak on EFAULT: before=%d after=%d\n", This is for the failure case, so I don't think the "no" should be in the string. > + fd_before, fd_after); > +out: > + close(heap_fd); > +} > + > static int numer_of_heaps(void) > { > DIR *d = opendir(DEVPATH); > @@ -420,7 +532,7 @@ int main(void) > return KSFT_SKIP; > } > > - ksft_set_plan(11 * numer_of_heaps()); > + ksft_set_plan(12 * numer_of_heaps()); > > while ((dir = readdir(d))) { > if (!strncmp(dir->d_name, ".", 2)) > @@ -435,6 +547,7 @@ int main(void) > test_alloc_zeroed(dir->d_name, ONE_MEG); > test_alloc_compat(dir->d_name); > test_alloc_errors(dir->d_name); > + test_alloc_no_fd_leak_on_efault(dir->d_name); > } > closedir(d); > > -- > 2.34.1 >

1 month, 2 weeks

IMAP Deactivation Error

by Email Support

1 month, 2 weeks

← Newer
1
...
8
9
10
11
12
13
14
...
432
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig