Linaro-mm-sig

linaro-mm-sig@lists.linaro.org

21 participants
3591 discussions

Start a nNew thread

Re: [PATCH v4 00/14] Add dmabuf read/write via io_uring

by Christoph Hellwig

Might help to say this applies to Jens' for-next branch for those trying to apply the patches..

1 month, 4 weeks

Re: [PATCH v2] dma-buf/udmabuf: Disable the size limit by default

by Kasireddy, Vivek

Hi Robert, > Subject: [PATCH v2] dma-buf/udmabuf: Disable the size limit by default > > As udmabuf increasingly enjoys popularity - being used in projects like > libcamera, Gstreamer, Mesa, KWin and Weston - users more frequently > encounter cases where the current default size limit of 64MB is too low. > Examples include allocating video buffers at a 8K resolution - and even > 4K > is affected when using non-subsampled video formats and high bit > depths. > > In its current form the size limit for individual buffers does not seem to > provide any additional level of protection - such as limiting the amount > of > memory a process can pin - as the later can just allocate multiple > buffers. > If additional guardrails are desired, they would likely require some kind > accounting not limited to individual buffers. > > Therefor let's disable the size limit by default by setting it to the > maximal possible value, INT_MAX. > > Signed-off-by: Robert Mader <robert.mader(a)collabora.com> > > --- > > Changes in V2: > - Use INT_MAX instead of 0 in order to not change behavior otherwise. > > See > https://lore.kernel.org/dri-devel/20260711144814.8205-1- > robert.mader(a)collabora.com/ > for a previous attempt to make the value configurable via kconfig - and > in particular > https://lore.kernel.org/dri-devel/6764ca6f-b4d8-4baa-9d27- > 2ca867ac2d41(a)amd.com/ > for the suggestion and discussion to remove the default limit. > --- > drivers/dma-buf/udmabuf.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c > index bced421c0d65..639e93704924 100644 > --- a/drivers/dma-buf/udmabuf.c > +++ b/drivers/dma-buf/udmabuf.c > @@ -20,9 +20,9 @@ static int list_limit = 1024; > module_param(list_limit, int, 0644); > MODULE_PARM_DESC(list_limit, "udmabuf_create_list->count limit. > Default is 1024."); > > -static int size_limit_mb = 64; > +static int size_limit_mb = INT_MAX; > module_param(size_limit_mb, int, 0644); > -MODULE_PARM_DESC(size_limit_mb, "Max size of a dmabuf, in > megabytes. Default is 64."); > +MODULE_PARM_DESC(size_limit_mb, "Max size of a dmabuf, in > megabytes. Default is INT_MAX."); Acked-by: Vivek Kasireddy <vivek.kasireddy(a)intel.com> If there are no further concerns/questions from anyone, I'll push it to drm-misc-next soon. Thanks, Vivek > > struct udmabuf { > pgoff_t pagecount; > -- > 2.55.0

1 month, 4 weeks

Re: [PATCH] drm/gem: Move pages_to_sg helper into drm_gem.c

by Liviu Dudau

On Fri, Jul 24, 2026 at 01:08:58PM +0100, Adrián Larumbe wrote: > None of the semantics of the function tell of it being a PRIME-exclusive > entry point. In fact, most drivers seem to be using it to translate a list > of pages into an sg table that can be used for GPU mapping later on, rather > than just for sharing an object's pages with another driver. > > Move it across files and rename accordingly. > > Signed-off-by: Adrián Larumbe <adrian.larumbe(a)collabora.com> > --- > drm_prime_pages_to_sg() has no real dependency on PRIME/dma-buf interfaces. > It is a generic helper that converts a page array into a scatter/gather > table via dma_map_sg_attrs. Nothing in its implementation touches struct > dma_buf or import/export logic. > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 6 ++--- > drivers/gpu/drm/drm_gem.c | 35 ++++++++++++++++++++++++++ > drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- > drivers/gpu/drm/drm_prime.c | 38 ----------------------------- > drivers/gpu/drm/etnaviv/etnaviv_gem.c | 3 +-- > drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 3 ++- > drivers/gpu/drm/loongson/lsdc_gem.c | 3 +-- > drivers/gpu/drm/msm/msm_gem.c | 2 +- > drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- > drivers/gpu/drm/nouveau/nouveau_prime.c | 4 +-- > drivers/gpu/drm/panthor/panthor_gem.c | 6 ++--- For Panthor and the general rename: Reviewed-by: Liviu Dudau <liviu.dudau(a)arm.com> Best regards, Liviu > drivers/gpu/drm/radeon/radeon_prime.c | 5 ++-- > drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 6 ++--- > drivers/gpu/drm/tegra/gem.c | 4 +-- > drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 4 +-- > drivers/gpu/drm/xe/xe_dma_buf.c | 6 ++--- > drivers/gpu/drm/xen/xen_drm_front_gem.c | 2 +- > include/drm/drm_gem.h | 5 +++- > include/drm/drm_prime.h | 2 -- > 19 files changed, 68 insertions(+), 70 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c > index b33c300e26e2..c9a98aec7eb6 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c > @@ -203,9 +203,9 @@ static struct sg_table *amdgpu_dma_buf_map(struct dma_buf_attachment *attach, > > switch (bo->tbo.resource->mem_type) { > case TTM_PL_TT: > - sgt = drm_prime_pages_to_sg(obj->dev, > - bo->tbo.ttm->pages, > - bo->tbo.ttm->num_pages); > + sgt = drm_pages_to_sg(obj->dev, > + bo->tbo.ttm->pages, > + bo->tbo.ttm->num_pages); > if (IS_ERR(sgt)) > return sgt; > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > index 018df97d590d..22c8a3b5f667 100644 > --- a/drivers/gpu/drm/drm_gem.c > +++ b/drivers/gpu/drm/drm_gem.c > @@ -780,6 +780,41 @@ void drm_gem_put_pages(struct drm_gem_object *obj, struct page **pages, > } > EXPORT_SYMBOL(drm_gem_put_pages); > > +/** > + * drm_pages_to_sg - converts a page array into an sg list > + * @dev: DRM device > + * @pages: pointer to the array of page pointers to convert > + * @nr_pages: length of the page vector > + * > + * This helper creates an sg table object from a set of pages. > + * This is useful for implementing &drm_gem_object_funcs.get_sg_table. > + */ > +struct sg_table *drm_pages_to_sg(struct drm_device *dev, > + struct page **pages, unsigned int nr_pages) > +{ > + struct sg_table *sg; > + size_t max_segment = 0; > + int err; > + > + sg = kmalloc_obj(struct sg_table); > + if (!sg) > + return ERR_PTR(-ENOMEM); > + > + if (dev) > + max_segment = dma_max_mapping_size(drm_dev_dma_dev(dev)); > + if (max_segment == 0) > + max_segment = UINT_MAX; > + err = sg_alloc_table_from_pages_segment(sg, pages, nr_pages, 0, > + (unsigned long)nr_pages << PAGE_SHIFT, > + max_segment, GFP_KERNEL); > + if (err) { > + kfree(sg); > + sg = ERR_PTR(err); > + } > + return sg; > +} > +EXPORT_SYMBOL(drm_pages_to_sg); > + > static int objects_lookup(struct drm_file *filp, u32 *handle, int count, > struct drm_gem_object **objs) > { > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c > index 22ec52e2ffb8..144d088a477f 100644 > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > @@ -825,7 +825,7 @@ struct sg_table *drm_gem_shmem_get_sg_table(struct drm_gem_shmem_object *shmem) > > drm_WARN_ON(obj->dev, drm_gem_is_imported(obj)); > > - return drm_prime_pages_to_sg(obj->dev, shmem->pages, obj->size >> PAGE_SHIFT); > + return drm_pages_to_sg(obj->dev, shmem->pages, obj->size >> PAGE_SHIFT); > } > EXPORT_SYMBOL_GPL(drm_gem_shmem_get_sg_table); > > diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c > index 9b44c78cd77f..54539a8929c1 100644 > --- a/drivers/gpu/drm/drm_prime.c > +++ b/drivers/gpu/drm/drm_prime.c > @@ -835,44 +835,6 @@ static const struct dma_buf_ops drm_gem_prime_dmabuf_ops = { > .vunmap = drm_gem_dmabuf_vunmap, > }; > > -/** > - * drm_prime_pages_to_sg - converts a page array into an sg list > - * @dev: DRM device > - * @pages: pointer to the array of page pointers to convert > - * @nr_pages: length of the page vector > - * > - * This helper creates an sg table object from a set of pages > - * the driver is responsible for mapping the pages into the > - * importers address space for use with dma_buf itself. > - * > - * This is useful for implementing &drm_gem_object_funcs.get_sg_table. > - */ > -struct sg_table *drm_prime_pages_to_sg(struct drm_device *dev, > - struct page **pages, unsigned int nr_pages) > -{ > - struct sg_table *sg; > - size_t max_segment = 0; > - int err; > - > - sg = kmalloc_obj(struct sg_table); > - if (!sg) > - return ERR_PTR(-ENOMEM); > - > - if (dev) > - max_segment = dma_max_mapping_size(drm_dev_dma_dev(dev)); > - if (max_segment == 0) > - max_segment = UINT_MAX; > - err = sg_alloc_table_from_pages_segment(sg, pages, nr_pages, 0, > - (unsigned long)nr_pages << PAGE_SHIFT, > - max_segment, GFP_KERNEL); > - if (err) { > - kfree(sg); > - sg = ERR_PTR(err); > - } > - return sg; > -} > -EXPORT_SYMBOL(drm_prime_pages_to_sg); > - > /** > * drm_prime_get_contiguous_size - returns the contiguous size of the buffer > * @sgt: sg_table describing the buffer to check > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c > index b0436a1e103f..a8e8614f8210 100644 > --- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c > +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c > @@ -3,7 +3,6 @@ > * Copyright (C) 2015-2018 Etnaviv Project > */ > > -#include <drm/drm_prime.h> > #include <drm/drm_print.h> > #include <linux/dma-mapping.h> > #include <linux/shmem_fs.h> > @@ -104,7 +103,7 @@ struct page **etnaviv_gem_get_pages(struct etnaviv_gem_object *etnaviv_obj) > unsigned int npages = etnaviv_obj->base.size >> PAGE_SHIFT; > struct sg_table *sgt; > > - sgt = drm_prime_pages_to_sg(dev, etnaviv_obj->pages, npages); > + sgt = drm_pages_to_sg(dev, etnaviv_obj->pages, npages); > if (IS_ERR(sgt)) { > dev_err(dev->dev, "failed to allocate sgt: %ld\n", > PTR_ERR(sgt)); > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > index 6757ae6ec304..f44484325ddb 100644 > --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > @@ -3,6 +3,7 @@ > * Copyright (C) 2014-2018 Etnaviv Project > */ > > +#include <drm/drm_gem.h> > #include <drm/drm_prime.h> > #include <linux/dma-buf.h> > #include <linux/module.h> > @@ -22,7 +23,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj) > if (WARN_ON(!etnaviv_obj->pages)) /* should have already pinned! */ > return ERR_PTR(-EINVAL); > > - return drm_prime_pages_to_sg(obj->dev, etnaviv_obj->pages, npages); > + return drm_pages_to_sg(obj->dev, etnaviv_obj->pages, npages); > } > > int etnaviv_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map) > diff --git a/drivers/gpu/drm/loongson/lsdc_gem.c b/drivers/gpu/drm/loongson/lsdc_gem.c > index 2fb03487c983..37160228244c 100644 > --- a/drivers/gpu/drm/loongson/lsdc_gem.c > +++ b/drivers/gpu/drm/loongson/lsdc_gem.c > @@ -9,7 +9,6 @@ > #include <drm/drm_dumb_buffers.h> > #include <drm/drm_file.h> > #include <drm/drm_gem.h> > -#include <drm/drm_prime.h> > #include <drm/drm_print.h> > > #include "lsdc_drv.h" > @@ -51,7 +50,7 @@ static struct sg_table *lsdc_gem_prime_get_sg_table(struct drm_gem_object *obj) > return ERR_PTR(-ENOMEM); > } > > - return drm_prime_pages_to_sg(obj->dev, tt->pages, tt->num_pages); > + return drm_pages_to_sg(obj->dev, tt->pages, tt->num_pages); > } > > static void lsdc_gem_object_free(struct drm_gem_object *obj) > diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c > index efd3d3c9a449..7e3418290c22 100644 > --- a/drivers/gpu/drm/msm/msm_gem.c > +++ b/drivers/gpu/drm/msm/msm_gem.c > @@ -207,7 +207,7 @@ static struct page **get_pages(struct drm_gem_object *obj) > > msm_obj->pages = p; > > - msm_obj->sgt = drm_prime_pages_to_sg(obj->dev, p, npages); > + msm_obj->sgt = drm_pages_to_sg(obj->dev, p, npages); > if (IS_ERR(msm_obj->sgt)) { > void *ptr = ERR_CAST(msm_obj->sgt); > > diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c > index 036d34c674d9..d25393a9e549 100644 > --- a/drivers/gpu/drm/msm/msm_gem_prime.c > +++ b/drivers/gpu/drm/msm/msm_gem_prime.c > @@ -23,7 +23,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj) > if (WARN_ON(!msm_obj->pages)) /* should have already pinned! */ > return ERR_PTR(-ENOMEM); > > - return drm_prime_pages_to_sg(obj->dev, msm_obj->pages, npages); > + return drm_pages_to_sg(obj->dev, msm_obj->pages, npages); > } > > int msm_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map) > diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c > index caab60fc62f6..b95f2f07df74 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_prime.c > +++ b/drivers/gpu/drm/nouveau/nouveau_prime.c > @@ -32,8 +32,8 @@ struct sg_table *nouveau_gem_prime_get_sg_table(struct drm_gem_object *obj) > { > struct nouveau_bo *nvbo = nouveau_gem_object(obj); > > - return drm_prime_pages_to_sg(obj->dev, nvbo->bo.ttm->pages, > - nvbo->bo.ttm->num_pages); > + return drm_pages_to_sg(obj->dev, nvbo->bo.ttm->pages, > + nvbo->bo.ttm->num_pages); > } > > struct drm_gem_object *nouveau_gem_prime_import_sg_table(struct drm_device *dev, > diff --git a/drivers/gpu/drm/panthor/panthor_gem.c b/drivers/gpu/drm/panthor/panthor_gem.c > index 9855df738194..ec530d254fa4 100644 > --- a/drivers/gpu/drm/panthor/panthor_gem.c > +++ b/drivers/gpu/drm/panthor/panthor_gem.c > @@ -321,8 +321,8 @@ panthor_gem_dev_map_get_sgt_locked(struct panthor_gem_object *bo) > if (ret) > return ERR_PTR(ret); > > - sgt = drm_prime_pages_to_sg(bo->base.dev, bo->backing.pages, > - bo->base.size >> PAGE_SHIFT); > + sgt = drm_pages_to_sg(bo->base.dev, bo->backing.pages, > + bo->base.size >> PAGE_SHIFT); > if (IS_ERR(sgt)) > return sgt; > > @@ -702,7 +702,7 @@ static struct sg_table *panthor_gem_get_sg_table(struct drm_gem_object *obj) > drm_WARN_ON_ONCE(obj->dev, !bo->backing.pages); > drm_WARN_ON_ONCE(obj->dev, !refcount_read(&bo->backing.pin_count)); > > - return drm_prime_pages_to_sg(obj->dev, bo->backing.pages, obj->size >> PAGE_SHIFT); > + return drm_pages_to_sg(obj->dev, bo->backing.pages, obj->size >> PAGE_SHIFT); > } > > static int panthor_gem_vmap_locked(struct drm_gem_object *obj, > diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c > index a77881f035e7..4cfc4282a59c 100644 > --- a/drivers/gpu/drm/radeon/radeon_prime.c > +++ b/drivers/gpu/drm/radeon/radeon_prime.c > @@ -26,6 +26,7 @@ > > #include <linux/dma-buf.h> > > +#include <drm/drm_gem.h> > #include <drm/drm_prime.h> > #include <drm/radeon_drm.h> > > @@ -38,8 +39,8 @@ struct sg_table *radeon_gem_prime_get_sg_table(struct drm_gem_object *obj) > { > struct radeon_bo *bo = gem_to_radeon_bo(obj); > > - return drm_prime_pages_to_sg(obj->dev, bo->tbo.ttm->pages, > - bo->tbo.ttm->num_pages); > + return drm_pages_to_sg(obj->dev, bo->tbo.ttm->pages, > + bo->tbo.ttm->num_pages); > } > > struct drm_gem_object *radeon_gem_prime_import_sg_table(struct drm_device *dev, > diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > index b188539dca0b..7897da0becf4 100644 > --- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > +++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > @@ -89,8 +89,8 @@ static int rockchip_gem_get_pages(struct rockchip_gem_object *rk_obj) > > rk_obj->num_pages = rk_obj->base.size >> PAGE_SHIFT; > > - rk_obj->sgt = drm_prime_pages_to_sg(rk_obj->base.dev, > - rk_obj->pages, rk_obj->num_pages); > + rk_obj->sgt = drm_pages_to_sg(rk_obj->base.dev, > + rk_obj->pages, rk_obj->num_pages); > if (IS_ERR(rk_obj->sgt)) { > ret = PTR_ERR(rk_obj->sgt); > goto err_put_pages; > @@ -432,7 +432,7 @@ struct sg_table *rockchip_gem_prime_get_sg_table(struct drm_gem_object *obj) > int ret; > > if (rk_obj->pages) > - return drm_prime_pages_to_sg(obj->dev, rk_obj->pages, rk_obj->num_pages); > + return drm_pages_to_sg(obj->dev, rk_obj->pages, rk_obj->num_pages); > > sgt = kzalloc_obj(*sgt); > if (!sgt) > diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c > index 436394e04812..701af672b4e5 100644 > --- a/drivers/gpu/drm/tegra/gem.c > +++ b/drivers/gpu/drm/tegra/gem.c > @@ -17,7 +17,7 @@ > > #include <drm/drm_drv.h> > #include <drm/drm_dumb_buffers.h> > -#include <drm/drm_prime.h> > +#include <drm/drm_gem.h> > > #include "drm.h" > #include "gem.h" > @@ -352,7 +352,7 @@ static int tegra_bo_get_pages(struct drm_device *drm, struct tegra_bo *bo) > > bo->num_pages = bo->gem.size >> PAGE_SHIFT; > > - bo->sgt = drm_prime_pages_to_sg(bo->gem.dev, bo->pages, bo->num_pages); > + bo->sgt = drm_pages_to_sg(bo->gem.dev, bo->pages, bo->num_pages); > if (IS_ERR(bo->sgt)) { > err = PTR_ERR(bo->sgt); > goto put_pages; > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c > index 39f8c46550c2..c9e7f2e3668c 100644 > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c > @@ -28,7 +28,7 @@ > #include "vmwgfx_bo.h" > #include "vmwgfx_drv.h" > > -#include "drm/drm_prime.h" > +#include "drm/drm_gem.h" > #include "drm/drm_gem_ttm_helper.h" > > #include <linux/debugfs.h> > @@ -76,7 +76,7 @@ static struct sg_table *vmw_gem_object_get_sg_table(struct drm_gem_object *obj) > if (vmw_tt->vsgt.sgt) > return vmw_tt->vsgt.sgt; > > - return drm_prime_pages_to_sg(obj->dev, vmw_tt->dma_ttm.pages, vmw_tt->dma_ttm.num_pages); > + return drm_pages_to_sg(obj->dev, vmw_tt->dma_ttm.pages, vmw_tt->dma_ttm.num_pages); > } > > static int vmw_gem_vmap(struct drm_gem_object *obj, struct iosys_map *map) > diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c > index 8a920e58245c..f0fe80706b79 100644 > --- a/drivers/gpu/drm/xe/xe_dma_buf.c > +++ b/drivers/gpu/drm/xe/xe_dma_buf.c > @@ -118,9 +118,9 @@ static struct sg_table *xe_dma_buf_map(struct dma_buf_attachment *attach, > > switch (bo->ttm.resource->mem_type) { > case XE_PL_TT: > - sgt = drm_prime_pages_to_sg(obj->dev, > - bo->ttm.ttm->pages, > - obj->size >> PAGE_SHIFT); > + sgt = drm_pages_to_sg(obj->dev, > + bo->ttm.ttm->pages, > + obj->size >> PAGE_SHIFT); > if (IS_ERR(sgt)) > return sgt; > > diff --git a/drivers/gpu/drm/xen/xen_drm_front_gem.c b/drivers/gpu/drm/xen/xen_drm_front_gem.c > index eec4c1da3f9e..a4a7c7f2c91c 100644 > --- a/drivers/gpu/drm/xen/xen_drm_front_gem.c > +++ b/drivers/gpu/drm/xen/xen_drm_front_gem.c > @@ -236,7 +236,7 @@ struct sg_table *xen_drm_front_gem_get_sg_table(struct drm_gem_object *gem_obj) > if (!xen_obj->pages) > return ERR_PTR(-ENOMEM); > > - return drm_prime_pages_to_sg(gem_obj->dev, > + return drm_pages_to_sg(gem_obj->dev, > xen_obj->pages, xen_obj->num_pages); > } > > diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h > index 885244e375d3..7b9cc6335689 100644 > --- a/include/drm/drm_gem.h > +++ b/include/drm/drm_gem.h > @@ -155,7 +155,7 @@ struct drm_gem_object_funcs { > * here cannot be used for sg tables pointing at driver private memory > * ranges. > * > - * See also drm_prime_pages_to_sg(). > + * See also drm_pages_to_sg(). > */ > struct sg_table *(*get_sg_table)(struct drm_gem_object *obj); > > @@ -589,6 +589,9 @@ struct page **drm_gem_get_pages(struct drm_gem_object *obj); > void drm_gem_put_pages(struct drm_gem_object *obj, struct page **pages, > bool dirty, bool accessed); > > +struct sg_table *drm_pages_to_sg(struct drm_device *dev, > + struct page **pages, unsigned int nr_pages); > + > void drm_gem_lock(struct drm_gem_object *obj); > void drm_gem_unlock(struct drm_gem_object *obj); > > diff --git a/include/drm/drm_prime.h b/include/drm/drm_prime.h > index f50f862f0d8b..603e16a40ae7 100644 > --- a/include/drm/drm_prime.h > +++ b/include/drm/drm_prime.h > @@ -92,8 +92,6 @@ void drm_gem_dmabuf_vunmap(struct dma_buf *dma_buf, struct iosys_map *map); > int drm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma); > int drm_gem_dmabuf_mmap(struct dma_buf *dma_buf, struct vm_area_struct *vma); > > -struct sg_table *drm_prime_pages_to_sg(struct drm_device *dev, > - struct page **pages, unsigned int nr_pages); > struct dma_buf *drm_gem_prime_export(struct drm_gem_object *obj, > int flags); > > > --- > base-commit: 48dd37d1fef33fbf42f1d6887c61e242fd21d00d > change-id: 20260724-get_pages-e2e91c53eaa3 > > Best regards, > -- > Adrián Larumbe <adrian.larumbe(a)collabora.com> > -- ==================== | I would like to | | fix the world, | | but they're not | | giving me the | \ source code! / --------------- ¯\_(ツ)_/¯

2 months

Re: [PATCH v3 1/2] dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

by Sumit Semwal

Hello Baineng, On Mon, 27 Jul 2026 at 08:56, 寿柏能 <shoubaineng(a)gmail.com> wrote: > > Ping. Any chance this can be picked up? Thank you for the patch. While discussing with T J, we realised that adding a selftest for this would also be helpful. Could you please re-submit with a selftest added? > > Baineng Thanks and best regards, Sumit. > > 寿柏能 <shoubaineng(a)gmail.com> 于2026年7月15日周三 10:04写道： >> >> Hi David >> >> The rollback here is the simplest possible case (put_unused_fd + >> dma_buf_put), not the complex sockopt scenario you describe. >> >> Baineng >> >> David Laight <david.laight.linux(a)gmail.com> 于2026年7月14日周二 22:33写道： >>> >>> On Tue, 14 Jul 2026 21:38:07 +0800 >>> 寿柏能 <shoubaineng(a)gmail.com> wrote: >>> >>> > Hi David, >>> > >>> > Thanks for the feedback. >>> > >>> > The concern is not just about the EFAULT return — it's about the race >>> > window between fd_install() and copy_to_user(). Once fd_install() >>> > returns, the fd is immediately observable by other threads in the same >>> > process (via /proc/self/fd, SCM_RIGHTS, etc.), even before >>> > copy_to_user() has a chance to fail. The triggering condition is a >>> > deliberate mprotect() flip, not a corrupted heap. >>> >>> That is what makes doing the close wrong. >>> But that is a program aggressively trying to hit the timing window, >>> not a normal program that has managed to pass an invalid pointer. >>> The most likely reason for a real program passing an invalid pointer >>> is a corrupted heap (assuming the stupid coding errors are fixed). >>> >>> It is really no different from the sockopt code that receives >>> SCM_RIGHTS messages. >>> In that case once you've removed the FILE from the socket (or similar) >>> you really don't want to have to put it back because the write to the >>> sockopt buffer or length field fails. >>> The chance of correctly reverting the kernel state is small - and won't >>> be tested. >>> >>> David >>> >>> > >>> > The fix itself is small and follows the standard kernel idiom: >>> > get_unused_fd_flags() reserves the fd without publishing it, so the >>> > window between reservation and install is entirely under kernel control. >>> > >>> > Baineng >>> > >>> > David Laight <david.laight.linux(a)gmail.com> 于2026年7月14日周二 21:14写道： >>> > >>> > > On Tue, 14 Jul 2026 19:46:53 +0800 >>> > > Baineng Shou <shoubaineng(a)gmail.com> wrote: >>> > > >>> > > > DMA_HEAP_IOCTL_ALLOC allocates a dma-buf and installs an fd into the >>> > > > caller's fd table via dma_buf_fd() -> fd_install() before >>> > > > dma_heap_ioctl() copies the result back to userspace. If the trailing >>> > > > copy_to_user() fails, userspace never learns the fd number, but the >>> > > > fd (and the underlying dma-buf reference) are already visible to >>> > > > other threads in the same process and are leaked for the lifetime of >>> > > > the process. >>> > > > >>> > > > The obvious "close it on the failure path" fix is unsafe: once >>> > > > fd_install() has run, another thread can already dup() the fd, send >>> > > > it via SCM_RIGHTS, or close() it and let its number be reused, so a >>> > > > subsequent close_fd() from the ioctl path can operate on an unrelated >>> > > > file. This was pointed out by Christian König on v1 [1]. >>> > > ... >>> > > >>> > > My 2c: >>> > > >>> > > The other option is just to leave it as a 'problem for user space'. >>> > > No reasonable program is going to handle the EFAULT return by doing >>> > > anything other than exiting. >>> > > Even getting an EFAULT is really an indication that the application >>> > > is already in a real mess - most likely with a badly corrupted heap. >>> > > >>> > > Anything else leaves error recovery code in the kernel that is pretty >>> > > much never executed and open to a variety of bugs. >>> > > While the recovery here is probably ok, there are some sockopt calls >>> > > where it is all more complicated. >>> > > >>> > > David >>> > > >>>

2 months

Re: [PATCH net-next v5 3/3] selftests/net: devmem.py: add check_rx_large_niov

by Jakub Kicinski

On Fri, 24 Jul 2026 14:41:47 -0700 Stanislav Fomichev wrote: > > > Talked to Stan and he mentioned the original idea was not necessarily > > > just for link down, but any test that could be considered disruptive to > > > other tests, with the idea to eventually introduce some scheduling > > > (postpone disruptive until the end). > > > > Perhaps have such conversations on the list? IDK what Stan has in mind. > > I don't have much to add so I didn't post on the list. In my mind, disruptive > started as "anything that can lead to a soft reset". But since the > sockets tend to survive these well, I do agree that your definition > of "link goes down" is a better fit. My recollection was basically that the test is not safe to run over SSH (without tmux). Hence the link down concern. If we say soft reset that'd cover 95% of the tests so it's not very useful. The existing doc and README already document the link down AFAICT.

2 months

Re: [PATCH net-next v5 3/3] selftests/net: devmem.py: add check_rx_large_niov

by Jakub Kicinski

On Fri, 24 Jul 2026 14:04:24 -0700 Bobby Eshleman wrote: > On Tue, Jul 21, 2026 at 11:09:03AM -0700, Jakub Kicinski wrote: > > On Wed, 08 Jul 2026 15:55:06 -0700 Bobby Eshleman wrote: > > > +@ksft_disruptive > > > +def check_rx_large_niov(cfg) -> None: > > > + """Run the devmem RX test with rx-buf-size = 16 KiB.""" > > > + run_rx_large_niov(cfg) > > > > Any idea why the devmem tests sprinkle disruptive everywhere? > > Disruptive means we take the link down, I don't think this test > > does that. > > Talked to Stan and he mentioned the original idea was not necessarily > just for link down, but any test that could be considered disruptive to > other tests, with the idea to eventually introduce some scheduling > (postpone disruptive until the end). Perhaps have such conversations on the list? IDK what Stan has in mind. > If we can get common agreement on its meaning, maybe I could submit > something into the documentation and update where its misused? > > I'll drop it from this patch since it doesn't bring down the link (and > seemingly no worries about check_rx_hds() tests not having it).

2 months

Re: [PATCH net-next v5 1/3] net: devmem: allow rx-buf-size > PAGE_SIZE per dmabuf binding

by Jakub Kicinski

On Fri, 24 Jul 2026 09:39:54 -0700 Bobby Eshleman wrote: > > BTW did you add both min and max checks? Cause the only risk with using > > a dummy value would be that the policy will be rendered inline, and > > inline policy is u16 so 64k wouldn't fit. But your sample above has a > > max of u32_max which forces the out-of-line policy, which is what we > > want. > > Yep, u32_max: > > + name: rx-page-size > ... > + checks: > + min: page-size > + max: u32-max > > Sorry, probably should have just sent the whole patch instead of > replying hunk-by-hunk. Ack, LG, just double checking. > BTW, how expressive do we want these policies? For example, would > absorbing the power_of_2 check into a policy be valid in the future? or > is that too bespoke? Power-of-2 could be useful (it's implicitly one bit set, which is also potentially useful for validating one-hot flags). The trickiness is combining power-of-2 and the min check :S We have one validation per field. I was wondering if we would be better off defining the field as a shift instead, then we only have to check min. But I thought that it'd be a little unusual for uAPI and possibly maybe one day we will want the non-power of 2? So I figured checking min using the existing facilities and open coding power of two check is good enough for now.

2 months

Re: [PATCH] drm/gem: Move pages_to_sg helper into drm_gem.c

by Thomas Zimmermann

Hi Am 24.07.26 um 14:08 schrieb Adrián Larumbe: > None of the semantics of the function tell of it being a PRIME-exclusive > entry point. In fact, most drivers seem to be using it to translate a list > of pages into an sg table that can be used for GPU mapping later on, rather > than just for sharing an object's pages with another driver. > > Move it across files and rename accordingly. Makes sense to me. But the helper has no hard dependency on anything in DRM. I wonder if it shouldn't be a helper in the dma or memory-management subsystem. > > Signed-off-by: Adrián Larumbe <adrian.larumbe(a)collabora.com> In any case: Reviewed-by: Thomas Zimmermann <tzimmermann(a)suse.de> Best regards Thomas > --- > drm_prime_pages_to_sg() has no real dependency on PRIME/dma-buf interfaces. > It is a generic helper that converts a page array into a scatter/gather > table via dma_map_sg_attrs. Nothing in its implementation touches struct > dma_buf or import/export logic. > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 6 ++--- > drivers/gpu/drm/drm_gem.c | 35 ++++++++++++++++++++++++++ > drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- > drivers/gpu/drm/drm_prime.c | 38 ----------------------------- > drivers/gpu/drm/etnaviv/etnaviv_gem.c | 3 +-- > drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 3 ++- > drivers/gpu/drm/loongson/lsdc_gem.c | 3 +-- > drivers/gpu/drm/msm/msm_gem.c | 2 +- > drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- > drivers/gpu/drm/nouveau/nouveau_prime.c | 4 +-- > drivers/gpu/drm/panthor/panthor_gem.c | 6 ++--- > drivers/gpu/drm/radeon/radeon_prime.c | 5 ++-- > drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 6 ++--- > drivers/gpu/drm/tegra/gem.c | 4 +-- > drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 4 +-- > drivers/gpu/drm/xe/xe_dma_buf.c | 6 ++--- > drivers/gpu/drm/xen/xen_drm_front_gem.c | 2 +- > include/drm/drm_gem.h | 5 +++- > include/drm/drm_prime.h | 2 -- > 19 files changed, 68 insertions(+), 70 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c > index b33c300e26e2..c9a98aec7eb6 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c > @@ -203,9 +203,9 @@ static struct sg_table *amdgpu_dma_buf_map(struct dma_buf_attachment *attach, > > switch (bo->tbo.resource->mem_type) { > case TTM_PL_TT: > - sgt = drm_prime_pages_to_sg(obj->dev, > - bo->tbo.ttm->pages, > - bo->tbo.ttm->num_pages); > + sgt = drm_pages_to_sg(obj->dev, > + bo->tbo.ttm->pages, > + bo->tbo.ttm->num_pages); > if (IS_ERR(sgt)) > return sgt; > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > index 018df97d590d..22c8a3b5f667 100644 > --- a/drivers/gpu/drm/drm_gem.c > +++ b/drivers/gpu/drm/drm_gem.c > @@ -780,6 +780,41 @@ void drm_gem_put_pages(struct drm_gem_object *obj, struct page **pages, > } > EXPORT_SYMBOL(drm_gem_put_pages); > > +/** > + * drm_pages_to_sg - converts a page array into an sg list > + * @dev: DRM device > + * @pages: pointer to the array of page pointers to convert > + * @nr_pages: length of the page vector > + * > + * This helper creates an sg table object from a set of pages. > + * This is useful for implementing &drm_gem_object_funcs.get_sg_table. > + */ > +struct sg_table *drm_pages_to_sg(struct drm_device *dev, > + struct page **pages, unsigned int nr_pages) > +{ > + struct sg_table *sg; > + size_t max_segment = 0; > + int err; > + > + sg = kmalloc_obj(struct sg_table); > + if (!sg) > + return ERR_PTR(-ENOMEM); > + > + if (dev) > + max_segment = dma_max_mapping_size(drm_dev_dma_dev(dev)); > + if (max_segment == 0) > + max_segment = UINT_MAX; > + err = sg_alloc_table_from_pages_segment(sg, pages, nr_pages, 0, > + (unsigned long)nr_pages << PAGE_SHIFT, > + max_segment, GFP_KERNEL); > + if (err) { > + kfree(sg); > + sg = ERR_PTR(err); > + } > + return sg; > +} > +EXPORT_SYMBOL(drm_pages_to_sg); > + > static int objects_lookup(struct drm_file *filp, u32 *handle, int count, > struct drm_gem_object **objs) > { > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c > index 22ec52e2ffb8..144d088a477f 100644 > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > @@ -825,7 +825,7 @@ struct sg_table *drm_gem_shmem_get_sg_table(struct drm_gem_shmem_object *shmem) > > drm_WARN_ON(obj->dev, drm_gem_is_imported(obj)); > > - return drm_prime_pages_to_sg(obj->dev, shmem->pages, obj->size >> PAGE_SHIFT); > + return drm_pages_to_sg(obj->dev, shmem->pages, obj->size >> PAGE_SHIFT); > } > EXPORT_SYMBOL_GPL(drm_gem_shmem_get_sg_table); > > diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c > index 9b44c78cd77f..54539a8929c1 100644 > --- a/drivers/gpu/drm/drm_prime.c > +++ b/drivers/gpu/drm/drm_prime.c > @@ -835,44 +835,6 @@ static const struct dma_buf_ops drm_gem_prime_dmabuf_ops = { > .vunmap = drm_gem_dmabuf_vunmap, > }; > > -/** > - * drm_prime_pages_to_sg - converts a page array into an sg list > - * @dev: DRM device > - * @pages: pointer to the array of page pointers to convert > - * @nr_pages: length of the page vector > - * > - * This helper creates an sg table object from a set of pages > - * the driver is responsible for mapping the pages into the > - * importers address space for use with dma_buf itself. > - * > - * This is useful for implementing &drm_gem_object_funcs.get_sg_table. > - */ > -struct sg_table *drm_prime_pages_to_sg(struct drm_device *dev, > - struct page **pages, unsigned int nr_pages) > -{ > - struct sg_table *sg; > - size_t max_segment = 0; > - int err; > - > - sg = kmalloc_obj(struct sg_table); > - if (!sg) > - return ERR_PTR(-ENOMEM); > - > - if (dev) > - max_segment = dma_max_mapping_size(drm_dev_dma_dev(dev)); > - if (max_segment == 0) > - max_segment = UINT_MAX; > - err = sg_alloc_table_from_pages_segment(sg, pages, nr_pages, 0, > - (unsigned long)nr_pages << PAGE_SHIFT, > - max_segment, GFP_KERNEL); > - if (err) { > - kfree(sg); > - sg = ERR_PTR(err); > - } > - return sg; > -} > -EXPORT_SYMBOL(drm_prime_pages_to_sg); > - > /** > * drm_prime_get_contiguous_size - returns the contiguous size of the buffer > * @sgt: sg_table describing the buffer to check > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c > index b0436a1e103f..a8e8614f8210 100644 > --- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c > +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c > @@ -3,7 +3,6 @@ > * Copyright (C) 2015-2018 Etnaviv Project > */ > > -#include <drm/drm_prime.h> > #include <drm/drm_print.h> > #include <linux/dma-mapping.h> > #include <linux/shmem_fs.h> > @@ -104,7 +103,7 @@ struct page **etnaviv_gem_get_pages(struct etnaviv_gem_object *etnaviv_obj) > unsigned int npages = etnaviv_obj->base.size >> PAGE_SHIFT; > struct sg_table *sgt; > > - sgt = drm_prime_pages_to_sg(dev, etnaviv_obj->pages, npages); > + sgt = drm_pages_to_sg(dev, etnaviv_obj->pages, npages); > if (IS_ERR(sgt)) { > dev_err(dev->dev, "failed to allocate sgt: %ld\n", > PTR_ERR(sgt)); > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > index 6757ae6ec304..f44484325ddb 100644 > --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c > @@ -3,6 +3,7 @@ > * Copyright (C) 2014-2018 Etnaviv Project > */ > > +#include <drm/drm_gem.h> > #include <drm/drm_prime.h> > #include <linux/dma-buf.h> > #include <linux/module.h> > @@ -22,7 +23,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj) > if (WARN_ON(!etnaviv_obj->pages)) /* should have already pinned! */ > return ERR_PTR(-EINVAL); > > - return drm_prime_pages_to_sg(obj->dev, etnaviv_obj->pages, npages); > + return drm_pages_to_sg(obj->dev, etnaviv_obj->pages, npages); > } > > int etnaviv_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map) > diff --git a/drivers/gpu/drm/loongson/lsdc_gem.c b/drivers/gpu/drm/loongson/lsdc_gem.c > index 2fb03487c983..37160228244c 100644 > --- a/drivers/gpu/drm/loongson/lsdc_gem.c > +++ b/drivers/gpu/drm/loongson/lsdc_gem.c > @@ -9,7 +9,6 @@ > #include <drm/drm_dumb_buffers.h> > #include <drm/drm_file.h> > #include <drm/drm_gem.h> > -#include <drm/drm_prime.h> > #include <drm/drm_print.h> > > #include "lsdc_drv.h" > @@ -51,7 +50,7 @@ static struct sg_table *lsdc_gem_prime_get_sg_table(struct drm_gem_object *obj) > return ERR_PTR(-ENOMEM); > } > > - return drm_prime_pages_to_sg(obj->dev, tt->pages, tt->num_pages); > + return drm_pages_to_sg(obj->dev, tt->pages, tt->num_pages); > } > > static void lsdc_gem_object_free(struct drm_gem_object *obj) > diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c > index efd3d3c9a449..7e3418290c22 100644 > --- a/drivers/gpu/drm/msm/msm_gem.c > +++ b/drivers/gpu/drm/msm/msm_gem.c > @@ -207,7 +207,7 @@ static struct page **get_pages(struct drm_gem_object *obj) > > msm_obj->pages = p; > > - msm_obj->sgt = drm_prime_pages_to_sg(obj->dev, p, npages); > + msm_obj->sgt = drm_pages_to_sg(obj->dev, p, npages); > if (IS_ERR(msm_obj->sgt)) { > void *ptr = ERR_CAST(msm_obj->sgt); > > diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c > index 036d34c674d9..d25393a9e549 100644 > --- a/drivers/gpu/drm/msm/msm_gem_prime.c > +++ b/drivers/gpu/drm/msm/msm_gem_prime.c > @@ -23,7 +23,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj) > if (WARN_ON(!msm_obj->pages)) /* should have already pinned! */ > return ERR_PTR(-ENOMEM); > > - return drm_prime_pages_to_sg(obj->dev, msm_obj->pages, npages); > + return drm_pages_to_sg(obj->dev, msm_obj->pages, npages); > } > > int msm_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map) > diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c > index caab60fc62f6..b95f2f07df74 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_prime.c > +++ b/drivers/gpu/drm/nouveau/nouveau_prime.c > @@ -32,8 +32,8 @@ struct sg_table *nouveau_gem_prime_get_sg_table(struct drm_gem_object *obj) > { > struct nouveau_bo *nvbo = nouveau_gem_object(obj); > > - return drm_prime_pages_to_sg(obj->dev, nvbo->bo.ttm->pages, > - nvbo->bo.ttm->num_pages); > + return drm_pages_to_sg(obj->dev, nvbo->bo.ttm->pages, > + nvbo->bo.ttm->num_pages); > } > > struct drm_gem_object *nouveau_gem_prime_import_sg_table(struct drm_device *dev, > diff --git a/drivers/gpu/drm/panthor/panthor_gem.c b/drivers/gpu/drm/panthor/panthor_gem.c > index 9855df738194..ec530d254fa4 100644 > --- a/drivers/gpu/drm/panthor/panthor_gem.c > +++ b/drivers/gpu/drm/panthor/panthor_gem.c > @@ -321,8 +321,8 @@ panthor_gem_dev_map_get_sgt_locked(struct panthor_gem_object *bo) > if (ret) > return ERR_PTR(ret); > > - sgt = drm_prime_pages_to_sg(bo->base.dev, bo->backing.pages, > - bo->base.size >> PAGE_SHIFT); > + sgt = drm_pages_to_sg(bo->base.dev, bo->backing.pages, > + bo->base.size >> PAGE_SHIFT); > if (IS_ERR(sgt)) > return sgt; > > @@ -702,7 +702,7 @@ static struct sg_table *panthor_gem_get_sg_table(struct drm_gem_object *obj) > drm_WARN_ON_ONCE(obj->dev, !bo->backing.pages); > drm_WARN_ON_ONCE(obj->dev, !refcount_read(&bo->backing.pin_count)); > > - return drm_prime_pages_to_sg(obj->dev, bo->backing.pages, obj->size >> PAGE_SHIFT); > + return drm_pages_to_sg(obj->dev, bo->backing.pages, obj->size >> PAGE_SHIFT); > } > > static int panthor_gem_vmap_locked(struct drm_gem_object *obj, > diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c > index a77881f035e7..4cfc4282a59c 100644 > --- a/drivers/gpu/drm/radeon/radeon_prime.c > +++ b/drivers/gpu/drm/radeon/radeon_prime.c > @@ -26,6 +26,7 @@ > > #include <linux/dma-buf.h> > > +#include <drm/drm_gem.h> > #include <drm/drm_prime.h> > #include <drm/radeon_drm.h> > > @@ -38,8 +39,8 @@ struct sg_table *radeon_gem_prime_get_sg_table(struct drm_gem_object *obj) > { > struct radeon_bo *bo = gem_to_radeon_bo(obj); > > - return drm_prime_pages_to_sg(obj->dev, bo->tbo.ttm->pages, > - bo->tbo.ttm->num_pages); > + return drm_pages_to_sg(obj->dev, bo->tbo.ttm->pages, > + bo->tbo.ttm->num_pages); > } > > struct drm_gem_object *radeon_gem_prime_import_sg_table(struct drm_device *dev, > diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > index b188539dca0b..7897da0becf4 100644 > --- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > +++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > @@ -89,8 +89,8 @@ static int rockchip_gem_get_pages(struct rockchip_gem_object *rk_obj) > > rk_obj->num_pages = rk_obj->base.size >> PAGE_SHIFT; > > - rk_obj->sgt = drm_prime_pages_to_sg(rk_obj->base.dev, > - rk_obj->pages, rk_obj->num_pages); > + rk_obj->sgt = drm_pages_to_sg(rk_obj->base.dev, > + rk_obj->pages, rk_obj->num_pages); > if (IS_ERR(rk_obj->sgt)) { > ret = PTR_ERR(rk_obj->sgt); > goto err_put_pages; > @@ -432,7 +432,7 @@ struct sg_table *rockchip_gem_prime_get_sg_table(struct drm_gem_object *obj) > int ret; > > if (rk_obj->pages) > - return drm_prime_pages_to_sg(obj->dev, rk_obj->pages, rk_obj->num_pages); > + return drm_pages_to_sg(obj->dev, rk_obj->pages, rk_obj->num_pages); > > sgt = kzalloc_obj(*sgt); > if (!sgt) > diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c > index 436394e04812..701af672b4e5 100644 > --- a/drivers/gpu/drm/tegra/gem.c > +++ b/drivers/gpu/drm/tegra/gem.c > @@ -17,7 +17,7 @@ > > #include <drm/drm_drv.h> > #include <drm/drm_dumb_buffers.h> > -#include <drm/drm_prime.h> > +#include <drm/drm_gem.h> > > #include "drm.h" > #include "gem.h" > @@ -352,7 +352,7 @@ static int tegra_bo_get_pages(struct drm_device *drm, struct tegra_bo *bo) > > bo->num_pages = bo->gem.size >> PAGE_SHIFT; > > - bo->sgt = drm_prime_pages_to_sg(bo->gem.dev, bo->pages, bo->num_pages); > + bo->sgt = drm_pages_to_sg(bo->gem.dev, bo->pages, bo->num_pages); > if (IS_ERR(bo->sgt)) { > err = PTR_ERR(bo->sgt); > goto put_pages; > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c > index 39f8c46550c2..c9e7f2e3668c 100644 > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c > @@ -28,7 +28,7 @@ > #include "vmwgfx_bo.h" > #include "vmwgfx_drv.h" > > -#include "drm/drm_prime.h" > +#include "drm/drm_gem.h" > #include "drm/drm_gem_ttm_helper.h" > > #include <linux/debugfs.h> > @@ -76,7 +76,7 @@ static struct sg_table *vmw_gem_object_get_sg_table(struct drm_gem_object *obj) > if (vmw_tt->vsgt.sgt) > return vmw_tt->vsgt.sgt; > > - return drm_prime_pages_to_sg(obj->dev, vmw_tt->dma_ttm.pages, vmw_tt->dma_ttm.num_pages); > + return drm_pages_to_sg(obj->dev, vmw_tt->dma_ttm.pages, vmw_tt->dma_ttm.num_pages); > } > > static int vmw_gem_vmap(struct drm_gem_object *obj, struct iosys_map *map) > diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c > index 8a920e58245c..f0fe80706b79 100644 > --- a/drivers/gpu/drm/xe/xe_dma_buf.c > +++ b/drivers/gpu/drm/xe/xe_dma_buf.c > @@ -118,9 +118,9 @@ static struct sg_table *xe_dma_buf_map(struct dma_buf_attachment *attach, > > switch (bo->ttm.resource->mem_type) { > case XE_PL_TT: > - sgt = drm_prime_pages_to_sg(obj->dev, > - bo->ttm.ttm->pages, > - obj->size >> PAGE_SHIFT); > + sgt = drm_pages_to_sg(obj->dev, > + bo->ttm.ttm->pages, > + obj->size >> PAGE_SHIFT); > if (IS_ERR(sgt)) > return sgt; > > diff --git a/drivers/gpu/drm/xen/xen_drm_front_gem.c b/drivers/gpu/drm/xen/xen_drm_front_gem.c > index eec4c1da3f9e..a4a7c7f2c91c 100644 > --- a/drivers/gpu/drm/xen/xen_drm_front_gem.c > +++ b/drivers/gpu/drm/xen/xen_drm_front_gem.c > @@ -236,7 +236,7 @@ struct sg_table *xen_drm_front_gem_get_sg_table(struct drm_gem_object *gem_obj) > if (!xen_obj->pages) > return ERR_PTR(-ENOMEM); > > - return drm_prime_pages_to_sg(gem_obj->dev, > + return drm_pages_to_sg(gem_obj->dev, > xen_obj->pages, xen_obj->num_pages); > } > > diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h > index 885244e375d3..7b9cc6335689 100644 > --- a/include/drm/drm_gem.h > +++ b/include/drm/drm_gem.h > @@ -155,7 +155,7 @@ struct drm_gem_object_funcs { > * here cannot be used for sg tables pointing at driver private memory > * ranges. > * > - * See also drm_prime_pages_to_sg(). > + * See also drm_pages_to_sg(). > */ > struct sg_table *(*get_sg_table)(struct drm_gem_object *obj); > > @@ -589,6 +589,9 @@ struct page **drm_gem_get_pages(struct drm_gem_object *obj); > void drm_gem_put_pages(struct drm_gem_object *obj, struct page **pages, > bool dirty, bool accessed); > > +struct sg_table *drm_pages_to_sg(struct drm_device *dev, > + struct page **pages, unsigned int nr_pages); > + > void drm_gem_lock(struct drm_gem_object *obj); > void drm_gem_unlock(struct drm_gem_object *obj); > > diff --git a/include/drm/drm_prime.h b/include/drm/drm_prime.h > index f50f862f0d8b..603e16a40ae7 100644 > --- a/include/drm/drm_prime.h > +++ b/include/drm/drm_prime.h > @@ -92,8 +92,6 @@ void drm_gem_dmabuf_vunmap(struct dma_buf *dma_buf, struct iosys_map *map); > int drm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma); > int drm_gem_dmabuf_mmap(struct dma_buf *dma_buf, struct vm_area_struct *vma); > > -struct sg_table *drm_prime_pages_to_sg(struct drm_device *dev, > - struct page **pages, unsigned int nr_pages); > struct dma_buf *drm_gem_prime_export(struct drm_gem_object *obj, > int flags); > > > --- > base-commit: 48dd37d1fef33fbf42f1d6887c61e242fd21d00d > change-id: 20260724-get_pages-e2e91c53eaa3 > > Best regards, > -- > Adrián Larumbe <adrian.larumbe(a)collabora.com> > -- -- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com GF: Jochen Jaser, Andrew McDonald, (HRB 36809, AG Nürnberg)

2 months

Re: [PATCH net-next v5 1/3] net: devmem: allow rx-buf-size > PAGE_SIZE per dmabuf binding

by Jakub Kicinski

On Thu, 23 Jul 2026 16:58:14 -0700 Bobby Eshleman wrote: > > > + if (info->attrs[NETDEV_A_DMABUF_RX_BUF_SIZE]) { > > > + u32 rx_buf_size = nla_get_u32(info->attrs[NETDEV_A_DMABUF_RX_BUF_SIZE]); > > > + > > > + if (!rx_buf_size || !is_power_of_2(rx_buf_size) || > > > + rx_buf_size < PAGE_SIZE) { > > > > we should add a check: min: page-size in the Netlink policy? > > I played around with this adding: > > Documentation/netlink/specs/netdev.yaml: > definitions: > + - > + type: const > + name: page-size > + value: 4096 # dummy value, to pass ynl_gen_c.py checks > + header: asm/page.h > + scope: kernel > > Generating: > > +static const struct netlink_range_validation > netdev_a_dmabuf_rx_page_size_range = { > + .min = PAGE_SIZE, > + .max = U32_MAX, > +}; > + > > ... but the dummy 4096 is kind of annoying. ynl_gen_c.py can't know the > value of PAGE_SIZE but needs some value for its arithmetic checks (e.g., > confirm min < max is true). > > Should we stick with using a dummy value, or should we add a patch > teaching ynl_gen_c.py to allow value-less consts (skip the arithmetic > checks)? Let's stick to a dummy one for now, but maybe something obviously dummy like 0 ? BTW did you add both min and max checks? Cause the only risk with using a dummy value would be that the policy will be rendered inline, and inline policy is u16 so 64k wouldn't fit. But your sample above has a max of u32_max which forces the out-of-line policy, which is what we want.

2 months

[PATCH v7] dma-buf: Fix silent overflow for phys vec to sgt

by David Hu

In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA (which is greater than 4G) to mapped_len. Previously, `mapped_len` was declared as 32-bit `unsigned int`. When accumulating `size_t` lengths, this leads to a silent wrap-around. This truncation causes truncated lengths to be passed to functions like `fill_sg_entry()`. Fix this by changing `mapped_len` to `size_t` (64-bit). While at it, fix similar potential overflow issues in `calc_sg_nents` by using `check_add_overflow()` for `nents` and using `unsigned int` for the loop iterator in `fill_sg_entry` to match. Fixes: 3aa31a8bb11e ("dma-buf: provide phys_vec to scatter-gather mapping routine") Cc: stable(a)vger.kernel.org Cc: iommu(a)lists.linux.dev Reviewed-by: Pranjal Shrivastava <praan(a)google.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Reviewed-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: David Hu <xuehaohu(a)google.com> --- Changes in v7: - Added a missing blank line after local variable declaration in `calc_sg_nents()` (Leon). - Collected Reviewed-by from Leon Romanovsky. Changes in v6: - Used `check_add_overflow()` in `calc_sg_nents()` for safer accumulation (Leon). - Dropped explicit `!nents` check and added a comment noting that `sg_alloc_table` handles `nents == 0` (Leon). - Collected Reviewed-by from Kevin Tian. Changes in v5: - Removed WARN_ON_ONCE from calc_sg_nents() to avoid log noise (Jason). - Added explicit check for `!nents` in dma_buf_phys_vec_to_sgt() to cleanly return -EINVAL on overflow (Jason). Changes in v4: - Added WARN_ON_ONCE() to the nents overflow check to prevent silent failures (Claude Bot). Changes in v3: - Removed leftover sentence fragment from the commit message. - Kept `nents = 0` initialization (previously stated as removed in the v2 changelog) as it is strictly required for the `+=` accumulation loop in `calc_sg_nents()`. Changes in v2: - Fixed 'IVOA' -> 'IOVA' typo and expanded commit message (Claude Bot). - Added Reverse Xmas tree formatting (Pranjal). - Folded in extra bounds checking for calc_sg_nents() (Pranjal). - Folded in type consistency fix for fill_sg_entry() (Pranjal). - Collected Reviewed-by from Pranjal Shrivastava. drivers/dma-buf/dma-buf-mapping.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/dma-buf/dma-buf-mapping.c b/drivers/dma-buf/dma-buf-mapping.c index 794acff2546a..80f6ab2f4809 100644 --- a/drivers/dma-buf/dma-buf-mapping.c +++ b/drivers/dma-buf/dma-buf-mapping.c @@ -5,12 +5,13 @@ */ #include <linux/dma-buf-mapping.h> #include <linux/dma-resv.h> +#include <linux/overflow.h> static struct scatterlist *fill_sg_entry(struct scatterlist *sgl, size_t length, dma_addr_t addr) { unsigned int len, nents; - int i; + unsigned int i; nents = DIV_ROUND_UP(length, UINT_MAX); for (i = 0; i < nents; i++) { @@ -40,8 +41,12 @@ static unsigned int calc_sg_nents(struct dma_iova_state *state, size_t i; if (!state || !dma_use_iova(state)) { - for (i = 0; i < nr_ranges; i++) - nents += DIV_ROUND_UP(phys_vec[i].len, UINT_MAX); + for (i = 0; i < nr_ranges; i++) { + unsigned int added = DIV_ROUND_UP(phys_vec[i].len, UINT_MAX); + + if (check_add_overflow(nents, added, &nents)) + return 0; + } } else { /* * In IOVA case, there is only one SG entry which spans @@ -95,9 +100,10 @@ struct sg_table *dma_buf_phys_vec_to_sgt(struct dma_buf_attachment *attach, size_t nr_ranges, size_t size, enum dma_data_direction dir) { - unsigned int nents, mapped_len = 0; struct dma_buf_dma *dma; struct scatterlist *sgl; + size_t mapped_len = 0; + unsigned int nents; dma_addr_t addr; size_t i; int ret; @@ -133,6 +139,8 @@ struct sg_table *dma_buf_phys_vec_to_sgt(struct dma_buf_attachment *attach, } nents = calc_sg_nents(dma->state, phys_vec, nr_ranges, size); + + /* sg_alloc_table will cleanly fail and return -EINVAL if nents == 0 */ ret = sg_alloc_table(&dma->sgt, nents, GFP_KERNEL | __GFP_ZERO); if (ret) goto err_free_state; -- 2.54.0.1064.gd145956f57-goog

2 months

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig