Linaro-mm-sig

linaro-mm-sig@lists.linaro.org

26 participants
7081 discussions

Re: [PATCH v4 06/14] block: introduce dma map backed bio type

by Christoph Hellwig

> - bio->bi_io_vec = bio_src->bi_io_vec; > + > + if (op_is_dmabuf(bio->bi_opf)) { > + bio->bi_dmabuf_map = bio_src->bi_dmabuf_map; > + } else { > + bio->bi_io_vec = bio_src->bi_io_vec; > + } No need for the braces. But given that these are the fields why even bother doing both sides and not rely on the union? > +void bio_dmabuf_map_set(struct bio *bio, struct iov_iter *iter) > +{ > + WARN_ON_ONCE(bio->bi_max_vecs); > + > + bio->bi_dmabuf_map = iter->dmabuf_map; > + bio->bi_vcnt = 0; > + bio->bi_iter.bi_offset = iter->iov_offset; > + bio->bi_iter.bi_size = iov_iter_count(iter); > + bio->bi_opf |= REQ_NOMERGE | REQ_DMABUF; This seems to be largely copied from bio_iov_bvec_set, but misses the REQ_CLONE there that we should probably set as well to indicate that the data descriptor is not owned (although not setting it is not really a bug). What about merging these two into a single and easier to use interface like this: diff --git a/block/bio.c b/block/bio.c index cc2bb9183c1a..25393bdd119d 100644 --- a/block/bio.c +++ b/block/bio.c @@ -860,12 +860,9 @@ static int __bio_clone(struct bio *bio, struct bio *bio_src, gfp_t gfp) bio->bi_write_hint = bio_src->bi_write_hint; bio->bi_write_stream = bio_src->bi_write_stream; bio->bi_iter = bio_src->bi_iter; - - if (op_is_dmabuf(bio->bi_opf)) { - bio->bi_dmabuf_map = bio_src->bi_dmabuf_map; - } else { - bio->bi_io_vec = bio_src->bi_io_vec; - } + static_assert(offsetof(struct bio, bi_io_vec) == + offsetof(struct bio, bi_dmabuf_map)); + bio->bi_io_vec = bio_src->bi_io_vec; if (bio->bi_bdev) { if (bio->bi_bdev == bio_src->bi_bdev && @@ -1186,26 +1183,21 @@ void __bio_release_pages(struct bio *bio, bool mark_dirty) } EXPORT_SYMBOL_GPL(__bio_release_pages); -void bio_iov_bvec_set(struct bio *bio, const struct iov_iter *iter) +bool bio_iov_iter_set(struct bio *bio, const struct iov_iter *iter) { WARN_ON_ONCE(bio->bi_max_vecs); + if (!iov_iter_is_bvec(iter) && !iov_iter_is_dmabuf_map(iter)) + return false; + bio->bi_io_vec = (struct bio_vec *)iter->bvec; bio->bi_iter.bi_idx = 0; bio->bi_iter.bi_offset = iter->iov_offset; bio->bi_iter.bi_size = iov_iter_count(iter); bio_set_flag(bio, BIO_CLONED); -} - -void bio_dmabuf_map_set(struct bio *bio, struct iov_iter *iter) -{ - WARN_ON_ONCE(bio->bi_max_vecs); - - bio->bi_dmabuf_map = iter->dmabuf_map; - bio->bi_vcnt = 0; - bio->bi_iter.bi_offset = iter->iov_offset; - bio->bi_iter.bi_size = iov_iter_count(iter); - bio->bi_opf |= REQ_NOMERGE | REQ_DMABUF; + if (iov_iter_is_dmabuf_map(iter)) + bio->bi_opf |= REQ_NOMERGE | REQ_DMABUF; + return true; } /* @@ -1265,13 +1257,7 @@ int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter, if (WARN_ON_ONCE(bio_flagged(bio, BIO_CLONED))) return -EIO; - if (iov_iter_is_bvec(iter)) { - bio_iov_bvec_set(bio, iter); - iov_iter_advance(iter, bio->bi_iter.bi_size); - return 0; - } - if (iov_iter_is_dmabuf_map(iter)) { - bio_dmabuf_map_set(bio, iter); + if (bio_iov_iter_set(bio, iter)) { iov_iter_advance(iter, bio->bi_iter.bi_size); return 0; } diff --git a/block/blk-map.c b/block/blk-map.c index d1d6bbe0ecf1..34816e6e64de 100644 --- a/block/blk-map.c +++ b/block/blk-map.c @@ -473,7 +473,7 @@ static int blk_rq_map_user_bvec(struct request *rq, const struct iov_iter *iter) bio = blk_rq_map_bio_alloc(rq, 0, GFP_KERNEL); if (!bio) return -ENOMEM; - bio_iov_bvec_set(bio, iter); + bio_iov_iter_set(bio, iter); ret = blk_rq_append_bio(rq, bio); if (ret) diff --git a/block/fops.c b/block/fops.c index d83cdbab65a6..97fb124a19b2 100644 --- a/block/fops.c +++ b/block/fops.c @@ -340,17 +340,12 @@ static ssize_t __blkdev_direct_IO_async(struct kiocb *iocb, bio->bi_end_io = blkdev_bio_end_io_async; bio->bi_ioprio = iocb->ki_ioprio; - if (iov_iter_is_bvec(iter)) { - /* - * Users don't rely on the iterator being in any particular - * state for async I/O returning -EIOCBQUEUED, hence we can - * avoid expensive iov_iter_advance(). Bypass - * bio_iov_iter_get_pages() and set the bvec directly. - */ - bio_iov_bvec_set(bio, iter); - } else if (iov_iter_is_dmabuf_map(iter)) { - bio_dmabuf_map_set(bio, iter); - } else { + /* + * Users don't rely on the iterator being in any particular state for + * async I/O returning -EIOCBQUEUED, hence we can avoid the expensive + * iov_iter_advance() if we could set the bvec/dmabuf directly. + */ + if (!bio_iov_iter_set(bio, iter)) { ret = blkdev_iov_iter_get_pages(bio, iter, bdev); if (unlikely(ret)) goto out_bio_put; diff --git a/include/linux/bio.h b/include/linux/bio.h index c053e9444514..1eff02a843ef 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -484,8 +484,7 @@ int bdev_rw_virt(struct block_device *bdev, sector_t sector, void *data, int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter, unsigned len_align_mask); -void bio_iov_bvec_set(struct bio *bio, const struct iov_iter *iter); -void bio_dmabuf_map_set(struct bio *bio, struct iov_iter *iter); +bool bio_iov_iter_set(struct bio *bio, const struct iov_iter *iter); void __bio_release_pages(struct bio *bio, bool mark_dirty); extern void bio_set_pages_dirty(struct bio *bio); extern void bio_check_pages_dirty(struct bio *bio);

3 weeks, 5 days

Re: [PATCH v4 05/14] block: move bvec init into __bio_clone

by Christoph Hellwig

Looks good: Reviewed-by: Christoph Hellwig <hch(a)lst.de>

3 weeks, 5 days

Re: [PATCH v4 04/14] block: always adjust bi_offset on bio_advance_iter

by Christoph Hellwig

Looks good: Reviewed-by: Christoph Hellwig <hch(a)lst.de>

3 weeks, 5 days

Re: [PATCH v4 03/14] block: rename bi_bvec_done

by Christoph Hellwig

Looks good: Reviewed-by: Christoph Hellwig <hch(a)lst.de>

3 weeks, 5 days

Re: [PATCH v4 02/14] iov_iter: add iterator type for dmabuf maps

by Christoph Hellwig

On Tue, Jul 28, 2026 at 10:29:14PM +0100, Pavel Begunkov wrote: > Introduce a new iterator type for dmabuf maps. The map in an opaque > object with internals and format specific to the subsystem / driver, and > only it can use that subsystem / driver for issuing IO. The task of the > middle layers is to pass the map / iterator further down, maybe doing > basic splitting and length checking. The iterator can only be used by > operations of the file the associated map was created for. > > Suggested-by: Keith Busch <kbusch(a)kernel.org> > Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Looks good: Reviewed-by: Christoph Hellwig <hch(a)lst.de> I'm also pretty sure I reviewed this and vairous other patches before..

3 weeks, 5 days

Re: [PATCH v4 01/14] dma-buf: introduce initial file I/O infrastructure

by Christoph Hellwig

The method name feels a bit convoluted, but given all the previous discussions I don't care too strongly. I'll leave the dma-buf side review to those who understand it.

3 weeks, 5 days

Re: [PATCH v4 00/14] Add dmabuf read/write via io_uring

by Christoph Hellwig

Might help to say this applies to Jens' for-next branch for those trying to apply the patches..

3 weeks, 5 days

Re: [PATCH v2] dma-buf/udmabuf: Disable the size limit by default

by Kasireddy, Vivek

Hi Robert, > Subject: [PATCH v2] dma-buf/udmabuf: Disable the size limit by default > > As udmabuf increasingly enjoys popularity - being used in projects like > libcamera, Gstreamer, Mesa, KWin and Weston - users more frequently > encounter cases where the current default size limit of 64MB is too low. > Examples include allocating video buffers at a 8K resolution - and even > 4K > is affected when using non-subsampled video formats and high bit > depths. > > In its current form the size limit for individual buffers does not seem to > provide any additional level of protection - such as limiting the amount > of > memory a process can pin - as the later can just allocate multiple > buffers. > If additional guardrails are desired, they would likely require some kind > accounting not limited to individual buffers. > > Therefor let's disable the size limit by default by setting it to the > maximal possible value, INT_MAX. > > Signed-off-by: Robert Mader <robert.mader(a)collabora.com> > > --- > > Changes in V2: > - Use INT_MAX instead of 0 in order to not change behavior otherwise. > > See > https://lore.kernel.org/dri-devel/20260711144814.8205-1- > robert.mader(a)collabora.com/ > for a previous attempt to make the value configurable via kconfig - and > in particular > https://lore.kernel.org/dri-devel/6764ca6f-b4d8-4baa-9d27- > 2ca867ac2d41(a)amd.com/ > for the suggestion and discussion to remove the default limit. > --- > drivers/dma-buf/udmabuf.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c > index bced421c0d65..639e93704924 100644 > --- a/drivers/dma-buf/udmabuf.c > +++ b/drivers/dma-buf/udmabuf.c > @@ -20,9 +20,9 @@ static int list_limit = 1024; > module_param(list_limit, int, 0644); > MODULE_PARM_DESC(list_limit, "udmabuf_create_list->count limit. > Default is 1024."); > > -static int size_limit_mb = 64; > +static int size_limit_mb = INT_MAX; > module_param(size_limit_mb, int, 0644); > -MODULE_PARM_DESC(size_limit_mb, "Max size of a dmabuf, in > megabytes. Default is 64."); > +MODULE_PARM_DESC(size_limit_mb, "Max size of a dmabuf, in > megabytes. Default is INT_MAX."); Acked-by: Vivek Kasireddy <vivek.kasireddy(a)intel.com> If there are no further concerns/questions from anyone, I'll push it to drm-misc-next soon. Thanks, Vivek > > struct udmabuf { > pgoff_t pagecount; > -- > 2.55.0

3 weeks, 5 days

Re: [PATCH] drm/gem: Move pages_to_sg helper into drm_gem.c

by Liviu Dudau

On Fri, Jul 24, 2026 at 01:08:58PM +0100, Adrián Larumbe wrote: > None of the semantics of the function tell of it being a PRIME-exclusive > entry point. In fact, most drivers seem to be using it to translate a list > of pages into an sg table that can be used for GPU mapping later on, rather > than just for sharing an object's pages with another driver. > > Move it across files and rename accordingly. > > Signed-off-by: Adrián Larumbe <adrian.larumbe(a)collabora.com> > --- > drm_prime_pages_to_sg() has no real dependency on PRIME/dma-buf interfaces. > It is a generic helper that converts a page array into a scatter/gather > table via dma_map_sg_attrs. Nothing in its implementation touches struct > dma_buf or import/export logic. > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 6 ++--- > drivers/gpu/drm/drm_gem.c | 35 ++++++++++++++++++++++++++ > drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- > drivers/gpu/drm/drm_prime.c | 38 ----------------------------- > drivers/gpu/drm/etnaviv/etnaviv_gem.c | 3 +-- > drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 3 ++- > drivers/gpu/drm/loongson/lsdc_gem.c | 3 +-- > drivers/gpu/drm/msm/msm_gem.c | 2 +- > drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- > drivers/gpu/drm/nouveau/nouveau_prime.c | 4 +-- > drivers/gpu/drm/panthor/panthor_gem.c | 6 ++--- For Panthor and the general rename: Reviewed-by: Liviu Dudau <liviu.dudau(a)arm.com> Best regards, Liviu > drivers/gpu/drm/radeon/radeon_prime.c | 5 ++-- > drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 6 ++--- > drivers/gpu/drm/tegra/gem.c | 4 +-- > drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 4 +-- > drivers/gpu/drm/xe/xe_dma_buf.c | 6 ++--- > drivers/gpu/drm/xen/xen_drm_front_gem.c | 2 +- > include/drm/drm_gem.h | 5 +++- > include/drm/drm_prime.h | 2 -- > 19 files changed, 68 insertions(+), 70 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c > index b33c300e26e2..c9a98aec7eb6 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c > @@ -203,9 +203,9 @@ static struct sg_table *amdgpu_dma_buf_map(struct dma_buf_attachment *attach, > > switch (bo->tbo.resource->mem_type) { > case TTM_PL_TT: > - sgt = drm_prime_pages_to_sg(obj->dev, > - bo->tbo.ttm->pages, > - bo->tbo.ttm->num_pages); > + sgt = drm_pages_to_sg(obj->dev, > + bo->tbo.ttm->pages, > + bo->tbo.ttm->num_pages); > if (IS_ERR(sgt)) > return sgt; > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > index 018df97d590d..22c8a3b5f667 100644 > --- a/drivers/gpu/drm/drm_gem.c > +++ b/drivers/gpu/drm/drm_gem.c > @@ -780,6 +780,41 @@ void drm_gem_put_pages(struct drm_gem_object *obj, struct page **pages, > } > EXPORT_SYMBOL(drm_gem_put_pages); > > +/** > + * drm_pages_to_sg - converts a page array into an sg list > + * @dev: DRM device > + * @pages: pointer to the array of page pointers to convert > + * @nr_pages: length of the page vector > + * > + * This helper creates an sg table object from a set of pages. > + * This is useful for implementing &drm_gem_object_funcs.get_sg_table. > + */ > +struct sg_table *drm_pages_to_sg(struct drm_device *dev, > + struct page **pages, unsigned int nr_pages) > +{ > + struct sg_table *sg; > + size_t max_segment = 0; > + int err; > + > + sg = kmalloc_obj(struct sg_table); > + if (!sg) > + return ERR_PTR(-ENOMEM); > + > + if (dev) > + max_segment = dma_max_mapping_size(drm_dev_dma_dev(dev)); > + if (max_segment == 0) > + max_segment = UINT_MAX; > + err = sg_alloc_table_from_pages_segment(sg, pages, nr_pages, 0, > + (unsigned long)nr_pages << PAGE_SHIFT, > + max_segment, GFP_KERNEL); > + if (err) { > + kfree(sg); > + sg = ERR_PTR(err); > + } > + return sg; > +} > +EXPORT_SYMBOL(drm_pages_to_sg); > + > static int objects_lookup(struct drm_file *filp, u32 *handle, int count, > struct drm_gem_object **objs) > { > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c > index 22ec52e2ffb8..144d088a477f 100644 > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > @@ -825,7 +825,7 @@ struct sg_table *drm_gem_shmem_get_sg_table(struct drm_gem_shmem_object *shmem) > > drm_WARN_ON(obj->dev, drm_gem_is_imported(obj)); > > - return drm_prime_pages_to_sg(obj->dev, shmem->pages, obj->size >> PAGE_SHIFT); > + return drm_pages_to_sg(obj->dev, shmem->pages, obj->size >> PAGE_SHIFT); > } > EXPORT_SYMBOL_GPL(drm_gem_shmem_get_sg_table); > > diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c > index 9b44c78cd77f..54539a8929c1 100644 > --- a/drivers/gpu/drm/drm_prime.c > +++ b/drivers/gpu/drm/drm_prime.c > @@ -835,44 +835,6 @@ static const struct dma_buf_ops drm_gem_prime_dmabuf_ops = { > .vunmap = drm_gem_dmabuf_vunmap, > }; > > -/** > - * drm_prime_pages_to_sg - converts a page array into an sg list > - * @dev: DRM device > - * @pages: pointer to the array of page pointers to convert > - * @nr_pages: length of the page vector > - * > - * This helper creates an sg table object from a set of pages > - * the driver is responsible for mapping the pages into the > - * importers address space for use with dma_buf itself. > - * > - * This is useful for implementing &drm_gem_object_funcs.get_sg_table. > - */ > -struct sg_table *drm_prime_pages_to_sg(struct drm_device *dev, > - struct page **pages, unsigned int nr_pages) > -{ > - struct sg_table *sg; > - size_t max_segment = 0; > - int err; > - > - sg = kmalloc_obj(struct sg_table); > - if (!sg) > - return ERR_PTR(-ENOMEM); > - > - if (dev) > - max_segment = dma_max_mapping_size(drm_dev_dma_dev(dev)); > - if (max_segment == 0) > - max_segment = UINT_MAX; > - err = sg_alloc_table_from_pages_segment(sg, pages, nr_pages, 0, > - (unsigned long)nr_pages << PAGE_SHIFT, > - max_segment, GFP_KERNEL); > - if (err) { > - kfree(sg); > - sg = ERR_PTR(err); > - } > - return sg; > -} > -EXPORT_SYMBOL(drm_prime_pages_to_sg); > - > /** > * drm_prime_get_contiguous_size - returns the contiguous size of the buffer > * @sgt: sg_table describing the buffer to check > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c > index b0436a1e103f..a8e8614f8210 100644 > --- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c > +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c > @@ -3,7 +3,6 @@ > * Copyright (C) 2015-2018 Etnaviv Project > */ > > -#include <drm/drm_prime.h> > #include <drm/drm_print.h> > #include <linux/dma-mapping.h> > #include <linux/shmem_fs.h> > @@ -104,7 +103,7 @@ struct page **etnaviv_gem_get_pages(struct etnaviv_gem_object *etnaviv_obj) > unsigned int npages = etnaviv_obj->base.size >> PAGE_SHIFT; > struct sg_table *sgt; > > - sgt = drm_prime_pages_to_sg(dev, etnaviv_obj->pages, npages); > + sgt = drm_pages_to_sg(dev, etnaviv_obj->pages, npages); > if (IS_ERR(sgt)) { > dev_err(dev->dev, "failed to allocate sgt: %ld\n", > PTR_ERR(sgt)); > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > index 6757ae6ec304..f44484325ddb 100644 > --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > @@ -3,6 +3,7 @@ > * Copyright (C) 2014-2018 Etnaviv Project > */ > > +#include <drm/drm_gem.h> > #include <drm/drm_prime.h> > #include <linux/dma-buf.h> > #include <linux/module.h> > @@ -22,7 +23,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj) > if (WARN_ON(!etnaviv_obj->pages)) /* should have already pinned! */ > return ERR_PTR(-EINVAL); > > - return drm_prime_pages_to_sg(obj->dev, etnaviv_obj->pages, npages); > + return drm_pages_to_sg(obj->dev, etnaviv_obj->pages, npages); > } > > int etnaviv_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map) > diff --git a/drivers/gpu/drm/loongson/lsdc_gem.c b/drivers/gpu/drm/loongson/lsdc_gem.c > index 2fb03487c983..37160228244c 100644 > --- a/drivers/gpu/drm/loongson/lsdc_gem.c > +++ b/drivers/gpu/drm/loongson/lsdc_gem.c > @@ -9,7 +9,6 @@ > #include <drm/drm_dumb_buffers.h> > #include <drm/drm_file.h> > #include <drm/drm_gem.h> > -#include <drm/drm_prime.h> > #include <drm/drm_print.h> > > #include "lsdc_drv.h" > @@ -51,7 +50,7 @@ static struct sg_table *lsdc_gem_prime_get_sg_table(struct drm_gem_object *obj) > return ERR_PTR(-ENOMEM); > } > > - return drm_prime_pages_to_sg(obj->dev, tt->pages, tt->num_pages); > + return drm_pages_to_sg(obj->dev, tt->pages, tt->num_pages); > } > > static void lsdc_gem_object_free(struct drm_gem_object *obj) > diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c > index efd3d3c9a449..7e3418290c22 100644 > --- a/drivers/gpu/drm/msm/msm_gem.c > +++ b/drivers/gpu/drm/msm/msm_gem.c > @@ -207,7 +207,7 @@ static struct page **get_pages(struct drm_gem_object *obj) > > msm_obj->pages = p; > > - msm_obj->sgt = drm_prime_pages_to_sg(obj->dev, p, npages); > + msm_obj->sgt = drm_pages_to_sg(obj->dev, p, npages); > if (IS_ERR(msm_obj->sgt)) { > void *ptr = ERR_CAST(msm_obj->sgt); > > diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c > index 036d34c674d9..d25393a9e549 100644 > --- a/drivers/gpu/drm/msm/msm_gem_prime.c > +++ b/drivers/gpu/drm/msm/msm_gem_prime.c > @@ -23,7 +23,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj) > if (WARN_ON(!msm_obj->pages)) /* should have already pinned! */ > return ERR_PTR(-ENOMEM); > > - return drm_prime_pages_to_sg(obj->dev, msm_obj->pages, npages); > + return drm_pages_to_sg(obj->dev, msm_obj->pages, npages); > } > > int msm_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map) > diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c > index caab60fc62f6..b95f2f07df74 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_prime.c > +++ b/drivers/gpu/drm/nouveau/nouveau_prime.c > @@ -32,8 +32,8 @@ struct sg_table *nouveau_gem_prime_get_sg_table(struct drm_gem_object *obj) > { > struct nouveau_bo *nvbo = nouveau_gem_object(obj); > > - return drm_prime_pages_to_sg(obj->dev, nvbo->bo.ttm->pages, > - nvbo->bo.ttm->num_pages); > + return drm_pages_to_sg(obj->dev, nvbo->bo.ttm->pages, > + nvbo->bo.ttm->num_pages); > } > > struct drm_gem_object *nouveau_gem_prime_import_sg_table(struct drm_device *dev, > diff --git a/drivers/gpu/drm/panthor/panthor_gem.c b/drivers/gpu/drm/panthor/panthor_gem.c > index 9855df738194..ec530d254fa4 100644 > --- a/drivers/gpu/drm/panthor/panthor_gem.c > +++ b/drivers/gpu/drm/panthor/panthor_gem.c > @@ -321,8 +321,8 @@ panthor_gem_dev_map_get_sgt_locked(struct panthor_gem_object *bo) > if (ret) > return ERR_PTR(ret); > > - sgt = drm_prime_pages_to_sg(bo->base.dev, bo->backing.pages, > - bo->base.size >> PAGE_SHIFT); > + sgt = drm_pages_to_sg(bo->base.dev, bo->backing.pages, > + bo->base.size >> PAGE_SHIFT); > if (IS_ERR(sgt)) > return sgt; > > @@ -702,7 +702,7 @@ static struct sg_table *panthor_gem_get_sg_table(struct drm_gem_object *obj) > drm_WARN_ON_ONCE(obj->dev, !bo->backing.pages); > drm_WARN_ON_ONCE(obj->dev, !refcount_read(&bo->backing.pin_count)); > > - return drm_prime_pages_to_sg(obj->dev, bo->backing.pages, obj->size >> PAGE_SHIFT); > + return drm_pages_to_sg(obj->dev, bo->backing.pages, obj->size >> PAGE_SHIFT); > } > > static int panthor_gem_vmap_locked(struct drm_gem_object *obj, > diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c > index a77881f035e7..4cfc4282a59c 100644 > --- a/drivers/gpu/drm/radeon/radeon_prime.c > +++ b/drivers/gpu/drm/radeon/radeon_prime.c > @@ -26,6 +26,7 @@ > > #include <linux/dma-buf.h> > > +#include <drm/drm_gem.h> > #include <drm/drm_prime.h> > #include <drm/radeon_drm.h> > > @@ -38,8 +39,8 @@ struct sg_table *radeon_gem_prime_get_sg_table(struct drm_gem_object *obj) > { > struct radeon_bo *bo = gem_to_radeon_bo(obj); > > - return drm_prime_pages_to_sg(obj->dev, bo->tbo.ttm->pages, > - bo->tbo.ttm->num_pages); > + return drm_pages_to_sg(obj->dev, bo->tbo.ttm->pages, > + bo->tbo.ttm->num_pages); > } > > struct drm_gem_object *radeon_gem_prime_import_sg_table(struct drm_device *dev, > diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > index b188539dca0b..7897da0becf4 100644 > --- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > +++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > @@ -89,8 +89,8 @@ static int rockchip_gem_get_pages(struct rockchip_gem_object *rk_obj) > > rk_obj->num_pages = rk_obj->base.size >> PAGE_SHIFT; > > - rk_obj->sgt = drm_prime_pages_to_sg(rk_obj->base.dev, > - rk_obj->pages, rk_obj->num_pages); > + rk_obj->sgt = drm_pages_to_sg(rk_obj->base.dev, > + rk_obj->pages, rk_obj->num_pages); > if (IS_ERR(rk_obj->sgt)) { > ret = PTR_ERR(rk_obj->sgt); > goto err_put_pages; > @@ -432,7 +432,7 @@ struct sg_table *rockchip_gem_prime_get_sg_table(struct drm_gem_object *obj) > int ret; > > if (rk_obj->pages) > - return drm_prime_pages_to_sg(obj->dev, rk_obj->pages, rk_obj->num_pages); > + return drm_pages_to_sg(obj->dev, rk_obj->pages, rk_obj->num_pages); > > sgt = kzalloc_obj(*sgt); > if (!sgt) > diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c > index 436394e04812..701af672b4e5 100644 > --- a/drivers/gpu/drm/tegra/gem.c > +++ b/drivers/gpu/drm/tegra/gem.c > @@ -17,7 +17,7 @@ > > #include <drm/drm_drv.h> > #include <drm/drm_dumb_buffers.h> > -#include <drm/drm_prime.h> > +#include <drm/drm_gem.h> > > #include "drm.h" > #include "gem.h" > @@ -352,7 +352,7 @@ static int tegra_bo_get_pages(struct drm_device *drm, struct tegra_bo *bo) > > bo->num_pages = bo->gem.size >> PAGE_SHIFT; > > - bo->sgt = drm_prime_pages_to_sg(bo->gem.dev, bo->pages, bo->num_pages); > + bo->sgt = drm_pages_to_sg(bo->gem.dev, bo->pages, bo->num_pages); > if (IS_ERR(bo->sgt)) { > err = PTR_ERR(bo->sgt); > goto put_pages; > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c > index 39f8c46550c2..c9e7f2e3668c 100644 > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c > @@ -28,7 +28,7 @@ > #include "vmwgfx_bo.h" > #include "vmwgfx_drv.h" > > -#include "drm/drm_prime.h" > +#include "drm/drm_gem.h" > #include "drm/drm_gem_ttm_helper.h" > > #include <linux/debugfs.h> > @@ -76,7 +76,7 @@ static struct sg_table *vmw_gem_object_get_sg_table(struct drm_gem_object *obj) > if (vmw_tt->vsgt.sgt) > return vmw_tt->vsgt.sgt; > > - return drm_prime_pages_to_sg(obj->dev, vmw_tt->dma_ttm.pages, vmw_tt->dma_ttm.num_pages); > + return drm_pages_to_sg(obj->dev, vmw_tt->dma_ttm.pages, vmw_tt->dma_ttm.num_pages); > } > > static int vmw_gem_vmap(struct drm_gem_object *obj, struct iosys_map *map) > diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c > index 8a920e58245c..f0fe80706b79 100644 > --- a/drivers/gpu/drm/xe/xe_dma_buf.c > +++ b/drivers/gpu/drm/xe/xe_dma_buf.c > @@ -118,9 +118,9 @@ static struct sg_table *xe_dma_buf_map(struct dma_buf_attachment *attach, > > switch (bo->ttm.resource->mem_type) { > case XE_PL_TT: > - sgt = drm_prime_pages_to_sg(obj->dev, > - bo->ttm.ttm->pages, > - obj->size >> PAGE_SHIFT); > + sgt = drm_pages_to_sg(obj->dev, > + bo->ttm.ttm->pages, > + obj->size >> PAGE_SHIFT); > if (IS_ERR(sgt)) > return sgt; > > diff --git a/drivers/gpu/drm/xen/xen_drm_front_gem.c b/drivers/gpu/drm/xen/xen_drm_front_gem.c > index eec4c1da3f9e..a4a7c7f2c91c 100644 > --- a/drivers/gpu/drm/xen/xen_drm_front_gem.c > +++ b/drivers/gpu/drm/xen/xen_drm_front_gem.c > @@ -236,7 +236,7 @@ struct sg_table *xen_drm_front_gem_get_sg_table(struct drm_gem_object *gem_obj) > if (!xen_obj->pages) > return ERR_PTR(-ENOMEM); > > - return drm_prime_pages_to_sg(gem_obj->dev, > + return drm_pages_to_sg(gem_obj->dev, > xen_obj->pages, xen_obj->num_pages); > } > > diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h > index 885244e375d3..7b9cc6335689 100644 > --- a/include/drm/drm_gem.h > +++ b/include/drm/drm_gem.h > @@ -155,7 +155,7 @@ struct drm_gem_object_funcs { > * here cannot be used for sg tables pointing at driver private memory > * ranges. > * > - * See also drm_prime_pages_to_sg(). > + * See also drm_pages_to_sg(). > */ > struct sg_table *(*get_sg_table)(struct drm_gem_object *obj); > > @@ -589,6 +589,9 @@ struct page **drm_gem_get_pages(struct drm_gem_object *obj); > void drm_gem_put_pages(struct drm_gem_object *obj, struct page **pages, > bool dirty, bool accessed); > > +struct sg_table *drm_pages_to_sg(struct drm_device *dev, > + struct page **pages, unsigned int nr_pages); > + > void drm_gem_lock(struct drm_gem_object *obj); > void drm_gem_unlock(struct drm_gem_object *obj); > > diff --git a/include/drm/drm_prime.h b/include/drm/drm_prime.h > index f50f862f0d8b..603e16a40ae7 100644 > --- a/include/drm/drm_prime.h > +++ b/include/drm/drm_prime.h > @@ -92,8 +92,6 @@ void drm_gem_dmabuf_vunmap(struct dma_buf *dma_buf, struct iosys_map *map); > int drm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma); > int drm_gem_dmabuf_mmap(struct dma_buf *dma_buf, struct vm_area_struct *vma); > > -struct sg_table *drm_prime_pages_to_sg(struct drm_device *dev, > - struct page **pages, unsigned int nr_pages); > struct dma_buf *drm_gem_prime_export(struct drm_gem_object *obj, > int flags); > > > --- > base-commit: 48dd37d1fef33fbf42f1d6887c61e242fd21d00d > change-id: 20260724-get_pages-e2e91c53eaa3 > > Best regards, > -- > Adrián Larumbe <adrian.larumbe(a)collabora.com> > -- ==================== | I would like to | | fix the world, | | but they're not | | giving me the | \ source code! / --------------- ¯\_(ツ)_/¯

3 weeks, 6 days

Re: [PATCH v3 1/2] dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

by Sumit Semwal

Hello Baineng, On Mon, 27 Jul 2026 at 08:56, 寿柏能 <shoubaineng(a)gmail.com> wrote: > > Ping. Any chance this can be picked up? Thank you for the patch. While discussing with T J, we realised that adding a selftest for this would also be helpful. Could you please re-submit with a selftest added? > > Baineng Thanks and best regards, Sumit. > > 寿柏能 <shoubaineng(a)gmail.com> 于2026年7月15日周三 10:04写道： >> >> Hi David >> >> The rollback here is the simplest possible case (put_unused_fd + >> dma_buf_put), not the complex sockopt scenario you describe. >> >> Baineng >> >> David Laight <david.laight.linux(a)gmail.com> 于2026年7月14日周二 22:33写道： >>> >>> On Tue, 14 Jul 2026 21:38:07 +0800 >>> 寿柏能 <shoubaineng(a)gmail.com> wrote: >>> >>> > Hi David, >>> > >>> > Thanks for the feedback. >>> > >>> > The concern is not just about the EFAULT return — it's about the race >>> > window between fd_install() and copy_to_user(). Once fd_install() >>> > returns, the fd is immediately observable by other threads in the same >>> > process (via /proc/self/fd, SCM_RIGHTS, etc.), even before >>> > copy_to_user() has a chance to fail. The triggering condition is a >>> > deliberate mprotect() flip, not a corrupted heap. >>> >>> That is what makes doing the close wrong. >>> But that is a program aggressively trying to hit the timing window, >>> not a normal program that has managed to pass an invalid pointer. >>> The most likely reason for a real program passing an invalid pointer >>> is a corrupted heap (assuming the stupid coding errors are fixed). >>> >>> It is really no different from the sockopt code that receives >>> SCM_RIGHTS messages. >>> In that case once you've removed the FILE from the socket (or similar) >>> you really don't want to have to put it back because the write to the >>> sockopt buffer or length field fails. >>> The chance of correctly reverting the kernel state is small - and won't >>> be tested. >>> >>> David >>> >>> > >>> > The fix itself is small and follows the standard kernel idiom: >>> > get_unused_fd_flags() reserves the fd without publishing it, so the >>> > window between reservation and install is entirely under kernel control. >>> > >>> > Baineng >>> > >>> > David Laight <david.laight.linux(a)gmail.com> 于2026年7月14日周二 21:14写道： >>> > >>> > > On Tue, 14 Jul 2026 19:46:53 +0800 >>> > > Baineng Shou <shoubaineng(a)gmail.com> wrote: >>> > > >>> > > > DMA_HEAP_IOCTL_ALLOC allocates a dma-buf and installs an fd into the >>> > > > caller's fd table via dma_buf_fd() -> fd_install() before >>> > > > dma_heap_ioctl() copies the result back to userspace. If the trailing >>> > > > copy_to_user() fails, userspace never learns the fd number, but the >>> > > > fd (and the underlying dma-buf reference) are already visible to >>> > > > other threads in the same process and are leaked for the lifetime of >>> > > > the process. >>> > > > >>> > > > The obvious "close it on the failure path" fix is unsafe: once >>> > > > fd_install() has run, another thread can already dup() the fd, send >>> > > > it via SCM_RIGHTS, or close() it and let its number be reused, so a >>> > > > subsequent close_fd() from the ioctl path can operate on an unrelated >>> > > > file. This was pointed out by Christian König on v1 [1]. >>> > > ... >>> > > >>> > > My 2c: >>> > > >>> > > The other option is just to leave it as a 'problem for user space'. >>> > > No reasonable program is going to handle the EFAULT return by doing >>> > > anything other than exiting. >>> > > Even getting an EFAULT is really an indication that the application >>> > > is already in a real mess - most likely with a badly corrupted heap. >>> > > >>> > > Anything else leaves error recovery code in the kernel that is pretty >>> > > much never executed and open to a variety of bugs. >>> > > While the recovery here is probably ok, there are some sockopt calls >>> > > where it is all more complicated. >>> > > >>> > > David >>> > > >>>

3 weeks, 6 days

← Newer
1
...
8
9
10
11
12
13
14
...
709
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig