Linaro-mm-sig

linaro-mm-sig@lists.linaro.org

14 participants
3706 discussions

Re: [PATCH v6 07/12] mm/cma: Introduce cma_alloc_at() API

by Marek Szyprowski

On 04.09.2026 12:44, Thierry Reding wrote: > From: Thierry Reding <treding(a)nvidia.com> > > This API can be used to allocate a number of CMA pages starting at a > fixed offset. This is useful, for example, if the CMA area is used as > backing storage for a nested allocator that has stricter requirements > than CMA itself. > > In order to reuse most of the existing code, the cma_range_alloc() > function is enhanced to take as inputs a range of pages to look for a > free region. If this range encompasses the entire CMA range, the > behavior is as before, but the range can also be specified to match > the offset and size passed in from cma_alloc_at(), in which case that > is the range that will be allocated (or allocation will fail if the > range is not available). > > Suggested-by: Marek Szyprowski <m.szyprowski(a)samsung.com> > Signed-off-by: Thierry Reding <treding(a)nvidia.com> Acked-by: Marek Szyprowski <m.szyprowski(a)samsung.com> > --- > Changes in v6: > - refactor cma_range_alloc() so it can be reused for _at() code paths > --- > include/linux/cma.h | 4 +++ > include/trace/events/cma.h | 77 ++++++++++++++++++++++++++++++++++++++-- > mm/cma.c | 88 +++++++++++++++++++++++++++++++++++----------- > 3 files changed, 146 insertions(+), 23 deletions(-) > > diff --git a/include/linux/cma.h b/include/linux/cma.h > index 8555d38a97b1..844404459a42 100644 > --- a/include/linux/cma.h > +++ b/include/linux/cma.h > @@ -49,11 +49,15 @@ extern int cma_init_reserved_mem(phys_addr_t base, phys_addr_t size, > struct cma **res_cma); > extern struct page *cma_alloc(struct cma *cma, unsigned long count, unsigned int align, > bool no_warn); > +extern struct page *cma_alloc_at(struct cma *cma, unsigned long offset, > + unsigned long count, bool no_warn); > extern bool cma_release(struct cma *cma, const struct page *pages, unsigned long count); > > struct page *cma_alloc_frozen(struct cma *cma, unsigned long count, > unsigned int align, bool no_warn); > struct page *cma_alloc_frozen_compound(struct cma *cma, unsigned int order); > +struct page *cma_alloc_at_frozen(struct cma *cma, unsigned long offset, > + unsigned long count, bool no_warn); > bool cma_release_frozen(struct cma *cma, const struct page *pages, > unsigned long count); > > diff --git a/include/trace/events/cma.h b/include/trace/events/cma.h > index 37195edf2498..4e0ab63e303f 100644 > --- a/include/trace/events/cma.h > +++ b/include/trace/events/cma.h > @@ -38,13 +38,17 @@ TRACE_EVENT(cma_release, > > TRACE_EVENT(cma_alloc_start, > > - TP_PROTO(const char *name, unsigned long request_count, unsigned long available_count, > + TP_PROTO(const char *name, unsigned long start, unsigned long end, > + unsigned long request_count, unsigned long available_count, > unsigned long total_count, unsigned int align), > > - TP_ARGS(name, request_count, available_count, total_count, align), > + TP_ARGS(name, start, end, request_count, available_count, total_count, > + align), > > TP_STRUCT__entry( > __string(name, name) > + __field(unsigned long, start) > + __field(unsigned long, end) > __field(unsigned long, request_count) > __field(unsigned long, available_count) > __field(unsigned long, total_count) > @@ -53,14 +57,18 @@ TRACE_EVENT(cma_alloc_start, > > TP_fast_assign( > __assign_str(name); > + __entry->start = start; > + __entry->end = end; > __entry->request_count = request_count; > __entry->available_count = available_count; > __entry->total_count = total_count; > __entry->align = align; > ), > > - TP_printk("name=%s request_count=%lu available_count=%lu total_count=%lu align=%u", > + TP_printk("name=%s start=%lu end=%lu request_count=%lu available_count=%lu total_count=%lu align=%u", > __get_str(name), > + __entry->start, > + __entry->end, > __entry->request_count, > __entry->available_count, > __entry->total_count, > @@ -132,6 +140,69 @@ TRACE_EVENT(cma_alloc_busy_retry, > __entry->align) > ); > > +TRACE_EVENT(cma_alloc_at_start, > + > + TP_PROTO(const char *name, unsigned long pfn, > + unsigned long request_count, unsigned long available_count, > + unsigned long total_count), > + > + TP_ARGS(name, pfn, request_count, available_count, total_count), > + > + TP_STRUCT__entry( > + __string(name, name) > + __field(unsigned long, pfn) > + __field(unsigned long, request_count) > + __field(unsigned long, available_count) > + __field(unsigned long, total_count) > + ), > + > + TP_fast_assign( > + __assign_str(name); > + __entry->pfn = pfn; > + __entry->request_count = request_count; > + __entry->available_count = available_count; > + __entry->total_count = total_count; > + ), > + > + TP_printk("name=%s pfn=%lx, request_count=%lu available_count=%lu total_count=%lu", > + __get_str(name), > + __entry->pfn, > + __entry->request_count, > + __entry->available_count, > + __entry->total_count) > +); > + > +TRACE_EVENT(cma_alloc_at_finish, > + > + TP_PROTO(const char *name, unsigned long pfn, const struct page *page, > + unsigned long count, int errorno), > + > + TP_ARGS(name, pfn, page, count, errorno), > + > + TP_STRUCT__entry( > + __string(name, name) > + __field(unsigned long, pfn) > + __field(const struct page *, page) > + __field(unsigned long, count) > + __field(int, errorno) > + ), > + > + TP_fast_assign( > + __assign_str(name); > + __entry->pfn = pfn; > + __entry->page = page; > + __entry->count = count; > + __entry->errorno = errorno; > + ), > + > + TP_printk("name=%s pfn=0x%lx page=%p count=%lu errorno=%d", > + __get_str(name), > + __entry->pfn, > + __entry->page, > + __entry->count, > + __entry->errorno) > +); > + > #endif /* _TRACE_CMA_H */ > > /* This part must be outside protection */ > diff --git a/mm/cma.c b/mm/cma.c > index a10ea37a261d..f92d3a188209 100644 > --- a/mm/cma.c > +++ b/mm/cma.c > @@ -783,25 +783,32 @@ static void cma_debug_show_areas(struct cma *cma) > spin_unlock_irq(&cma->lock); > } > > +/* > + * Searches the CMA memrange, from @start to @end, for a free region of > + * @count bits. If @end is less or equal to @start, will search the entire > + * memrange. > + */ > static int cma_range_alloc(struct cma *cma, struct cma_memrange *cmr, > - unsigned long count, unsigned int align, > - struct page **pagep, gfp_t gfp) > + unsigned long start, unsigned long end, > + unsigned long count, unsigned int align, > + struct page **pagep, gfp_t gfp) > { > unsigned long bitmap_maxno, bitmap_no, bitmap_count; > - unsigned long start, pfn, mask, offset; > - int ret = -EBUSY; > + unsigned long pfn, mask, offset; > struct page *page = NULL; > + int ret = -EBUSY; > > mask = cma_bitmap_aligned_mask(cma, align); > offset = cma_bitmap_aligned_offset(cma, cmr, align); > - bitmap_maxno = cma_bitmap_maxno(cma, cmr); > + bitmap_maxno = (end > start) ? end : cma_bitmap_maxno(cma, cmr); > bitmap_count = cma_bitmap_pages_to_bits(cma, count); > > if (bitmap_count > bitmap_maxno) > goto out; > > - for (start = 0; ; start = bitmap_no + mask + 1) { > + while (true) { > spin_lock_irq(&cma->lock); > + > /* > * If the request is larger than the available number > * of pages, stop right away. > @@ -810,6 +817,7 @@ static int cma_range_alloc(struct cma *cma, struct cma_memrange *cmr, > spin_unlock_irq(&cma->lock); > break; > } > + > bitmap_no = bitmap_find_next_zero_area_off(cmr->bitmap, > bitmap_maxno, start, bitmap_count, mask, > offset); > @@ -835,10 +843,11 @@ static int cma_range_alloc(struct cma *cma, struct cma_memrange *cmr, > > bitmap_set(cmr->bitmap, bitmap_no, bitmap_count); > cma->available_count -= count; > + > /* > - * It's safe to drop the lock here. We've marked this region for > - * our exclusive use. If the migration fails we will take the > - * lock again and unmark it. > + * It's safe to drop the lock here. We've marked this region > + * for our exclusive use. If the migration fails we will take > + * the lock again and unmark it. > */ > spin_unlock_irq(&cma->lock); > > @@ -856,37 +865,45 @@ static int cma_range_alloc(struct cma *cma, struct cma_memrange *cmr, > __func__, pfn, page); > > trace_cma_alloc_busy_retry(cma->name, pfn, page, count, align); > + start = bitmap_no + mask + 1; > } > + > out: > if (!ret) > *pagep = page; > + > return ret; > } > > -static struct page *__cma_alloc_frozen(struct cma *cma, > - unsigned long count, unsigned int align, gfp_t gfp) > +static struct page *__cma_alloc_frozen(struct cma *cma, unsigned long start, > + unsigned long end, unsigned long count, > + unsigned int align, gfp_t gfp) > { > struct page *page = NULL; > int ret = -ENOMEM, r; > unsigned long i; > - const char *name = cma ? cma->name : NULL; > + > + /* cma_alloc_at() and friends will only work with single-range CMA */ > + if (WARN_ON_ONCE(start > 0 && cma->nranges != 1)) > + return page; > > if (!cma || !cma->count) > return page; > > - pr_debug("%s(cma %p, name: %s, count %lu, align %d)\n", __func__, > - (void *)cma, cma->name, count, align); > + pr_debug("%s(cma %p, name: %s, start %lu, end %lu, count %lu, align %d)\n", > + __func__, (void *)cma, cma->name, start, end, count, align); > > if (!count) > return page; > > - trace_cma_alloc_start(name, count, cma->available_count, cma->count, align); > + trace_cma_alloc_start(cma->name, start, end, count, > + cma->available_count, cma->count, align); > > for (r = 0; r < cma->nranges; r++) { > page = NULL; > > - ret = cma_range_alloc(cma, &cma->ranges[r], count, align, > - &page, gfp); > + ret = cma_range_alloc(cma, &cma->ranges[r], start, end, > + count, align, &page, gfp); > if (ret != -EBUSY || page) > break; > } > @@ -908,7 +925,7 @@ static struct page *__cma_alloc_frozen(struct cma *cma, > } > > pr_debug("%s(): returned %p\n", __func__, page); > - trace_cma_alloc_finish(name, page ? page_to_pfn(page) : 0, > + trace_cma_alloc_finish(cma->name, page ? page_to_pfn(page) : 0, > page, count, align, ret); > if (page) { > count_vm_event(CMA_ALLOC_SUCCESS); > @@ -926,14 +943,22 @@ struct page *cma_alloc_frozen(struct cma *cma, unsigned long count, > { > gfp_t gfp = GFP_KERNEL | (no_warn ? __GFP_NOWARN : 0); > > - return __cma_alloc_frozen(cma, count, align, gfp); > + return __cma_alloc_frozen(cma, 0, 0, count, align, gfp); > } > > struct page *cma_alloc_frozen_compound(struct cma *cma, unsigned int order) > { > gfp_t gfp = GFP_KERNEL | __GFP_COMP | __GFP_NOWARN; > > - return __cma_alloc_frozen(cma, 1 << order, order, gfp); > + return __cma_alloc_frozen(cma, 0, 0, 1 << order, order, gfp); > +} > + > +struct page *cma_alloc_at_frozen(struct cma *cma, unsigned long offset, > + unsigned long count, bool no_warn) > +{ > + gfp_t gfp = GFP_KERNEL | (no_warn ? __GFP_NOWARN : 0); > + > + return __cma_alloc_frozen(cma, offset, offset + count, count, 0, gfp); > } > > /** > @@ -959,6 +984,29 @@ struct page *cma_alloc(struct cma *cma, unsigned long count, > } > EXPORT_SYMBOL_GPL(cma_alloc); > > +/** > + * cma_alloc_at() - allocate pages from contiguous area at fixed offset > + * @cma: Contiguous memory region for which the allocation is performed. > + * @offset: Index of the first page to allocate. > + * @count: Requested number of pages (in PAGE_SIZE order). > + * @no_warn: Avoid printing message about failed allocation. > + * > + * This function allocates a part of the contiguous memory on a specific > + * contiguous memory area. > + */ > +struct page *cma_alloc_at(struct cma *cma, unsigned long offset, > + unsigned long count, bool no_warn) > +{ > + struct page *page; > + > + page = cma_alloc_at_frozen(cma, offset, count, no_warn); > + if (page) > + set_pages_refcounted(page, count); > + > + return page; > +} > +EXPORT_SYMBOL_GPL(cma_alloc_at); > + > static struct cma_memrange *find_cma_memrange(struct cma *cma, > const struct page *pages, unsigned long count) > { > Best regards -- Marek Szyprowski, PhD Samsung R&D Institute Poland

2 months

[PATCH v2] dma-buf: Document how exporters and importers agree on mapping lifetime

by Leon Romanovsky

From: Leon Romanovsky <leonro(a)nvidia.com> Nothing in DMA-buf declares whether a mapping may be moved or taken away. Nearly every callback on both sides is optional, so the answer follows from which ones are implemented and from whether dma_buf_pin() succeeds. Documentation/ says none of this, and the rules sit in the kdoc of dma_buf_ops.pin, dma_buf_attach_ops.invalidate_mappings and dma_buf_invalidate_mappings(), which a driver author has to know by name before finding them. Describe the three flows an importer has to handle, the callbacks each one asks of both sides, and dma_buf_pin() as the runtime negotiation. Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> --- Let's try this variant from importer POV. Thanks Changes in v2: - Split pci p2p documentation patch to separate series - Improved dma-buf documentation patch. - Link to v1: https://patch.msgid.link/20260825-document-dma-buf-v1-0-5ecfb3e1371c@nvidia… --- Documentation/driver-api/dma-buf.rst | 6 ++++ drivers/dma-buf/dma-buf.c | 69 +++++++++++++++++++++++++++++++++++- 2 files changed, 74 insertions(+), 1 deletion(-) diff --git a/Documentation/driver-api/dma-buf.rst b/Documentation/driver-api/dma-buf.rst index 2f36c21d9948..39c201f38aa6 100644 --- a/Documentation/driver-api/dma-buf.rst +++ b/Documentation/driver-api/dma-buf.rst @@ -113,6 +113,12 @@ Basic Operation and Device DMA Access .. kernel-doc:: drivers/dma-buf/dma-buf.c :doc: dma buf device access +Mapping Lifetime Negotiation +~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +.. kernel-doc:: drivers/dma-buf/dma-buf.c + :doc: mapping lifetime negotiation + CPU Access to DMA Buffer Objects ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index d504c636dc29..aa47142cd9ed 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -684,7 +684,74 @@ static struct file *dma_buf_getfile(size_t size, int flags) * reference acquired with dma_buf_get() by calling dma_buf_put(). * * For the detailed semantics exporters are expected to implement see - * &dma_buf_ops. + * &dma_buf_ops. Whether the exporter may still move or take away the backing + * storage after step 3 depends on what both sides implement. See the mapping + * lifetime negotiation section below. + */ + +/** + * DOC: mapping lifetime negotiation + * + * Nearly everything in DMA-buf is optional. No flag or enum says whether the + * exporter may move or take away the backing storage while an importer holds + * a mapping. Each side simply implements the callbacks it can offer, and + * dma_buf_pin() settles the result at runtime. + * + * Out of that optionality the importer sees three main flows. They are named + * from the importer's point of view, because each one demands a different + * capability of its hardware: + * + * - Pinned: the memory is never taken away. The importer offers no way + * to stop DMA. + * - Revoked: the storage never moves, but the exporter may take it away. The + * importer must be able to stop DMA, and may hit user visible errors while + * doing so. + * - Movable: the exporter may relocate the storage at any time. The importer + * must be able to pause DMA, and must raise no error while the storage is + * moving. + * + * An importer reaches its flow like this: + * + * 1. Attach with dma_buf_dynamic_attach(). Leaving out the optional + * &dma_buf_attach_ops.invalidate_mappings callback pins the buffer for as + * long as the attachment exists. + * 2. Call dma_buf_pin() under the reservation lock. + * 3. On failure, run the movable flow or give up. + * 4. On success, the flow is the revoked one if the optional + * &dma_buf_attach_ops.invalidate_mappings is implemented, and the pinned + * one if it is not. + * + * Pinned flow: + * + * - Exporter: implement &dma_buf_ops.pin and &dma_buf_ops.unpin to hold the + * storage still on request. An exporter whose storage never moves implements + * neither, and dma_buf_pin() then succeeds on its own. An exporter which + * refuses to be pinned implements &dma_buf_ops.pin and fails it. + * - Importer: nothing more. The mapping stays valid until the importer unmaps. + * + * Revoked flow: + * + * - Exporter: answer dma_buf_pin() as above. Call + * dma_buf_invalidate_mappings() when the storage goes away and fail + * &dma_buf_ops.map_dma_buf while it is gone. The two waits which complete a + * revocation are described in dma_buf_invalidate_mappings(). + * - Importer: &dma_buf_attach_ops.invalidate_mappings has to unmap within + * bounded time and drop the pin. + * + * Movable flow: + * + * - Exporter: call dma_buf_invalidate_mappings() before each move, then wait + * for the &dma_buf.resv fences. &dma_buf_ops.pin and &dma_buf_ops.unpin play + * no part here. + * - Importer: hold no pin. &dma_buf_attach_ops.invalidate_mappings drops the + * cached mapping and has to lead to dma_buf_unmap_attachment() within + * bounded time. It need not stop the hardware, because access runs until the + * importer's &dma_buf.resv fences retire. The importer maps again before the + * next DMA. + * + * &dma_buf_ops.attach is the best place for an exporter to turn an importer + * away, because the importer can still fall back to another flow and attach + * again. */ /** --- base-commit: 63367df6e7255067ad6a83abe0d2799dfa491876 change-id: 20260820-document-dma-buf-3f8b41e32f57 Best regards, -- Leon Romanovsky <leonro(a)nvidia.com>

2 months

[PATCH 0/2] Document the DMA-buf mapping lifetime negotiation

by Leon Romanovsky

DMA-buf lets an exporter pin, move or revoke the backing storage under an importer, and which of the three applies is decided by the optional callbacks each side implements and by whether dma_buf_pin() succeeds. Nothing in Documentation/ describes that, and the single reference to the mechanism still names move_notify(), removed in v7.1. Thanks Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> --- Leon Romanovsky (2): PCI/P2PDMA: Update DMABUF lifecycle docs after move_notify() rename dma-buf: Document how exporters and importers agree on mapping lifetime Documentation/driver-api/dma-buf.rst | 6 +++ Documentation/driver-api/pci/p2pdma.rst | 6 ++- drivers/dma-buf/dma-buf.c | 85 ++++++++++++++++++++++++++++++++- 3 files changed, 94 insertions(+), 3 deletions(-) --- base-commit: 8049741ac93acd3a590dac070e12571fddf0e294 change-id: 20260820-document-dma-buf-3f8b41e32f57 Best regards, -- Leon Romanovsky <leonro(a)nvidia.com>

2 months

Re: [PATCH] Documentation/gpu: Fix brackets

by Randy Dunlap

Hi, On 9/3/26 9:10 AM, Manuel Ebner wrote: > Remove needless '(' and add missing ')'. > > Signed-off-by: Manuel Ebner <manuelebnerli(a)mailbox.org> > --- > Documentation/gpu/drm-vm-bind-locking.rst | 2 +- > Documentation/gpu/nova/core/todo.rst | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) This patch probably should be 2 patches since these files have different maintainers. > diff --git a/Documentation/gpu/drm-vm-bind-locking.rst b/Documentation/gpu/drm-vm-bind-locking.rst > index a345aa513..df6cf0132 100644 > --- a/Documentation/gpu/drm-vm-bind-locking.rst > +++ b/Documentation/gpu/drm-vm-bind-locking.rst > @@ -170,7 +170,7 @@ submission is therefore preceded with a re-validation section: > validate_gem_bo(&gpu_vm_bo->gem_bo); > > // The following list iteration needs the Gem object's > - // dma_resv to be held (it protects the gpu_vm_bo's list of > + // dma_resv to be held. It protects the gpu_vm_bo's list of > // gpu_vmas, but since local gem objects share the gpu_vm's > // dma_resv, it is already held at this point. I think that I must like parenthetical phrases more than you do. ;) Acked-by: Randy Dunlap <rdunlap(a)infradead.org> Thanks. > for_each_gpu_vma_of_gpu_vm_bo(&gpu_vm_bo, &gpu_vma) > diff --git a/Documentation/gpu/nova/core/todo.rst b/Documentation/gpu/nova/core/todo.rst > index d5130b2b0..a01c362b1 100644 > --- a/Documentation/gpu/nova/core/todo.rst > +++ b/Documentation/gpu/nova/core/todo.rst > @@ -33,7 +33,7 @@ A good example from nova-core would be the ``Chipset`` enum type, which defines > the value ``AD102``. When probing the GPU the value ``0x192`` can be read from a > certain register indication the chipset AD102. Hence, the enum value ``AD102`` > should be derived from the number ``0x192``. Currently, nova-core uses a custom > -implementation (``Chipset::from_u32`` for this. > +implementation (``Chipset::from_u32``) for this. > > Instead, it would be desirable to have something like the ``FromPrimitive`` > trait [1] from the num crate. -- ~Randy

2 months, 1 week

Re: [PATCH v8 2/2] dma-buf: Split sgl by largest page-aligned chunk

by Jason Gunthorpe

On Wed, Sep 02, 2026 at 07:07:50PM -0400, David Hu wrote: > On Wed, Sep 2, 2026 at 8:08 AM Jason Gunthorpe <jgg(a)ziepe.ca> wrote: > > > > On Tue, Sep 01, 2026 at 05:08:49PM +0000, David Hu wrote: > > > From: David Hu <xuehaohu(a)google.com> > > > > > > Currently, `fill_sg_entry()` splits the scatterlist using `UINT_MAX`. > > > This creates a non-page-aligned DMA length (`0xFFFFFFFF`) for the > > > first entry, resulting in non-page-aligned DMA addresses for all > > > subsequent entries. > > > > This patch is fine, but pedenatically a scatterlist's entry limit > > should be bounded to dma_get_max_seg_size(), though I don't think it > > helps this. Operating scatterlists at the size limits has proven > > problematic in a number of places already... > > > > > In addition, a non-page-aligned sgl length will trigger an edge case > > > in `ib_umem_find_best_pgsz()`. In case of a discontinuity in later > > > buffers, we will have a `va` with lowest bit set to 1. That will lead > > > to `ib_umem_find_best_pgsz()` always return 0, and break the promise > > > to find best page size for the mapping on the NIC side. > > > > That's an IB side bug, the newer logic that joins adjacent SGLs should > > have avoided it? > > Hi Jason, > > Thank you for the review. I think you are right on both counts. > Regarding the IB side, the new SGL joining logic in > `ib_umem_find_best_pgsz()` indeed avoids the issue. `mask |= va` is > skipped for artifically split, contiguous SGLs. Since Christian has > already pulled v8 into drm-misc-next, I won't spin a v9 to avoid > creating unnecessary noise on the list. If you prefer a followup, > please let me know. Nope, I'm fine, it just explains why it wasn't seen in other tested. You were backporting and mix&matched things. It confirms the upstream kernel was fine from the start. There are other importers besides RDMA, so I still think that this is a good change regardless. Having each segment remain page aligned, and staying away from ULONG_MAX that might trigger overflows is a friendly and robust thing to do for less sophisticated importers. Jason

2 months, 1 week

Re: [PATCH v8 0/2] dma-buf: Fix silent overflow and alignment

by Christian König

On 9/1/26 19:08, David Hu wrote: > From: David Hu <xuehaohu(a)google.com> > > This series address two related issues in scatter-gather mapping, > specifically for the MMIO based dma-buf mapping. The fixes ensure > sgt mapping is correct, and proper for large MMIO regions. > > Patch 1 fixes a silent integer overflow for mapping length exceeding 4G > (Previously submitted as [PATCH v7] dma-buf: Fix silent overflow for > phys vec to sgt) > https://lore.kernel.org/all/20260609164047.486227-1-xuehaohu@google.com/ > > Patch 2 Splits sgl by largest page aligned chunk > (Previously submitted as [PATCH v3] dma-buf: Split sgl by largest page-aligned chunk) > https://lore.kernel.org/all/20260722233806.3922093-1-dhu@x6u.co/ *sigh* such issues are exactly the reason why I didn't wanted the dma-mapping stuff inside DMA-buf. That clearly doesn't belong here. I'm going to push those fixes to drm-misc-next now, but when there are more issues like that will mark the code as abandoned and not maintained. Regards, Christian. > > Changes in v8: > - Combined the two patches into one unified series to avoid merge > conflicts. > - Collected Reviewed-by tag from Leon Romanovsky for Patch 2. > > David Hu (2): > dma-buf: Fix silent overflow for phys vec to sgt > dma-buf: Split sgl by largest page-aligned chunk > > drivers/dma-buf/dma-buf-mapping.c | 31 +++++++++++++++++++++---------- > 1 file changed, 21 insertions(+), 10 deletions(-) > > -- > 2.55.0.897.gb25b4bd76c-goog >

2 months, 1 week

Re: [PATCH v5 4/5] accel/amdxdna: refuse to flush an imported BO

by Lizhi Hou

Applied this to drm-misc-fixes. On 8/19/26 15:44, Taimuraz Kaitmazov wrote: > SYNC_BO clflushes an imported BO's scatterlist. An importer may not do > that: the memory belongs to the exporter, and dma-buf gives the importer > no interface to ask for maintenance on it. Refuse the request instead. > > is_import_bo() is (obj)->attach, which covers more than foreign buffers. > A userptr BO arrives through a ubuf, and on a carveout device every share > BO and the device heap arrive through a cbuf, so SYNC_BO answers > -EOPNOTSUPP for those too, including the AMDXDNA_BO_DEV path that flushes > through its heap. > > Only the ubuf case gives up maintenance it was getting: on a 64 MiB > userptr BO a 4 KiB sync and a full sync both cost 659 us, this arm having > ignored the range. amdxdna_cbuf_map() fills in only the DMA address and > length, so drm_clflush_sg() already walks zero pages on carveout memory. > Userspace maintains these through the mapping it already holds, as XRT's > buffer::sync() does unless it is told to sync through the driver. > > Suggested-by: Lizhi Hou <lizhi.hou(a)amd.com> > Signed-off-by: Taimuraz Kaitmazov <taimuraz(a)kaitmazov.com> > Reviewed-by: Lizhi Hou <lizhi.hou(a)amd.com> > --- > drivers/accel/amdxdna/amdxdna_gem.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c > index 0e0f844526ca..4be5298d1062 100644 > --- a/drivers/accel/amdxdna/amdxdna_gem.c > +++ b/drivers/accel/amdxdna/amdxdna_gem.c > @@ -1224,6 +1224,9 @@ static int amdxdna_flush_bo(struct amdxdna_gem_obj *abo, u64 offset, u64 size) > { > u64 end; > > + if (is_import_bo(abo)) > + return -EOPNOTSUPP; > + > if (offset >= abo->mem.size) > return -EINVAL; > > @@ -1234,9 +1237,7 @@ static int amdxdna_flush_bo(struct amdxdna_gem_obj *abo, u64 offset, u64 size) > if (!size) > return 0; > > - if (is_import_bo(abo)) > - drm_clflush_sg(abo->base.sgt); > - else if (amdxdna_gem_vmap(abo)) > + if (amdxdna_gem_vmap(abo)) > drm_clflush_virt_range(amdxdna_gem_vmap(abo) + offset, size); > else if (abo->base.pages) > drm_clflush_pages(abo->base.pages, abo->mem.size >> PAGE_SHIFT);

2 months, 1 week

Re: [PATCH v8 2/2] dma-buf: Split sgl by largest page-aligned chunk

by Jason Gunthorpe

On Tue, Sep 01, 2026 at 05:08:49PM +0000, David Hu wrote: > From: David Hu <xuehaohu(a)google.com> > > Currently, `fill_sg_entry()` splits the scatterlist using `UINT_MAX`. > This creates a non-page-aligned DMA length (`0xFFFFFFFF`) for the > first entry, resulting in non-page-aligned DMA addresses for all > subsequent entries. This patch is fine, but pedenatically a scatterlist's entry limit should be bounded to dma_get_max_seg_size(), though I don't think it helps this. Operating scatterlists at the size limits has proven problematic in a number of places already... > In addition, a non-page-aligned sgl length will trigger an edge case > in `ib_umem_find_best_pgsz()`. In case of a discontinuity in later > buffers, we will have a `va` with lowest bit set to 1. That will lead > to `ib_umem_find_best_pgsz()` always return 0, and break the promise > to find best page size for the mapping on the NIC side. That's an IB side bug, the newer logic that joins adjacent SGLs should have avoided it? Jason

2 months, 1 week

Re: [PATCH v4 1/2] drm: Add common drm_user_fence helper

by Christian König

On 8/28/26 10:31, SHANMUGAM, SRINIVASAN wrote: > AMD General > >> -----Original Message----- >> From: Koenig, Christian <Christian.Koenig(a)amd.com> >> Sent: Friday, August 28, 2026 1:48 PM >> To: SHANMUGAM, SRINIVASAN <SRINIVASAN.SHANMUGAM(a)amd.com>; >> Matthew Brost <matthew.brost(a)intel.com> >> Cc: Deucher, Alexander <Alexander.Deucher(a)amd.com>; Maarten Lankhorst >> <maarten.lankhorst(a)linux.intel.com>; Maxime Ripard <mripard(a)kernel.org>; >> Thomas Zimmermann <tzimmermann(a)suse.de>; David Airlie >> <airlied(a)gmail.com>; Simona Vetter <simona(a)ffwll.ch>; Sumit Semwal >> <sumit.semwal(a)linaro.org>; Thomas Hellström >> <thomas.hellstrom(a)linux.intel.com>; dri-devel(a)lists.freedesktop.org; intel- >> xe(a)lists.freedesktop.org; linux-media(a)vger.kernel.org; linaro-mm- >> sig(a)lists.linaro.org; linux-kernel(a)vger.kernel.org; amd-gfx(a)lists.freedesktop.org >> Subject: Re: [PATCH v4 1/2] drm: Add common drm_user_fence helper >> >> On 8/28/26 10:06, SHANMUGAM, SRINIVASAN wrote: >> ... >>>>> +/** >>>>> + * struct drm_user_fence - embeddable DRM user fence >>>>> + * >>>>> + * Drivers embed this in their own structure and implement >>>>> + * &drm_user_fence_ops. Call drm_user_fence_init() at creation and >>>>> + * drm_user_fence_add_callback() to arm on a dma-fence. >>>>> + * Call drm_user_fence_cancel_sync() before driver teardown. >>>>> + */ >>>>> +struct drm_user_fence { >>>> >>>> Should this common layer be split into two distinct concepts? >>>> >>>> - drm_work_fence: 90% of what is here, minus the kthread_use_mm() and >>>> mm-related code. >>>> - drm_user_fence: a subclass of drm_work_fence that adds the >>>> kthread_use_mm() and mm-related code. >>>> >>>> I suggest this because I was thinking about it the other day (I >>>> forget the exact >>>> context) and reconsidered a pattern where a fence signals and then I >>>> need a worker because some work must be done outside of IRQ context. >>>> A user fence is one example, since copy_to_user() can fault, which is >>>> not allowed in IRQ context. At various times in Xe we've had multiple >>>> patterns like this, although at the moment user fences are probably >>>> the only case that requires it. If we looked across DRM as a whole, I suspect >> we'd find this pattern open-coded in a number of places. >>>> >>>> Yes, drm_user_fence would be a very thin layer on top of >>>> drm_work_fence, but I still see value in the split. >>> >>> Hi Matt, >>> >>> Thanks for the review and for being supportive of the idea. >>> >>> The split into drm_work_fence (general fence-to-workqueue pattern) and >>> drm_user_fence (subclass adding kthread_use_mm) makes sense. I'll >>> restructure v5 as follows: >>> >>> drm_work_fence: kref, work_struct, dma_fence_cb, stored fence ref, >>> wq, ops — add_callback, cancel, cancel_sync >> >> Yeah, this pattern came up so often that I already considered adding it to the core >> dma_fence framework. > > Hi Christian, > > Thanks for the feedback. > > On dma_fence_work: would you prefer I place the generic fence-to-work > helper directly in the core dma_fence framework (drivers/dma-buf/), > or is starting with drm_work_fence in DRM and promoting it later also > acceptable? Maybe ask AI to search for use cases. If you find something outside of drivers/gpu/drm then please place it under drivers/dma-buf. If you don't find any existing use case drivers/gpu/drm should do as well. Thanks, Christian. > > I'll add the value comparison logic and will add a clear note that this cannot be > used to implement dma_fence_ops. > > Thanks, > Srini

2 months, 1 week

Re: [PATCH v4 1/2] drm: Add common drm_user_fence helper

by Christian König

On 8/28/26 10:06, SHANMUGAM, SRINIVASAN wrote: ... >>> +/** >>> + * struct drm_user_fence - embeddable DRM user fence >>> + * >>> + * Drivers embed this in their own structure and implement >>> + * &drm_user_fence_ops. Call drm_user_fence_init() at creation and >>> + * drm_user_fence_add_callback() to arm on a dma-fence. >>> + * Call drm_user_fence_cancel_sync() before driver teardown. >>> + */ >>> +struct drm_user_fence { >> >> Should this common layer be split into two distinct concepts? >> >> - drm_work_fence: 90% of what is here, minus the kthread_use_mm() and >> mm-related code. >> - drm_user_fence: a subclass of drm_work_fence that adds the >> kthread_use_mm() and mm-related code. >> >> I suggest this because I was thinking about it the other day (I forget the exact >> context) and reconsidered a pattern where a fence signals and then I need a worker >> because some work must be done outside of IRQ context. A user fence is one >> example, since copy_to_user() can fault, which is not allowed in IRQ context. At >> various times in Xe we've had multiple patterns like this, although at the moment >> user fences are probably the only case that requires it. If we looked across DRM as >> a whole, I suspect we'd find this pattern open-coded in a number of places. >> >> Yes, drm_user_fence would be a very thin layer on top of drm_work_fence, but I still >> see value in the split. > > Hi Matt, > > Thanks for the review and for being supportive of the idea. > > The split into drm_work_fence (general fence-to-workqueue pattern) and > drm_user_fence (subclass adding kthread_use_mm) makes sense. I'll > restructure v5 as follows: > > drm_work_fence: kref, work_struct, dma_fence_cb, stored fence ref, > wq, ops — add_callback, cancel, cancel_sync Yeah, this pattern came up so often that I already considered adding it to the core dma_fence framework. So if you feel really brave make that a dma_fence_work helper. If I'm not completely mistaken AI should be able to find quite a number of use cases for that already. > > drm_user_fence: embeds drm_work_fence, adds mm_struct and the > kthread_use_mm/mmput boilerplate, thin wrappers > > XE will continue to use drm_user_fence. For AMDGPU, The long-term > per-signal filtering approach (reading the fence value via copy_from_user > before signaling) will use drm_user_fence — further validating both > layers of the split. It would be really nice if we could move those compare functionality (>, <, !=, == etc...) XE has for the user value into the drm_user_fence handling as well. We also need to add a heck of documentation that while this is able to consume dma_fences it *CAN'T* be used to implement dma_fence_ops. I had more than enough headache because of that. Regards, Christian. > > Regarding the CI failure — the root cause was a missing trailing newline > at the end of xe_sync_types.h which caused the kunit build to fail with > "unterminated #ifndef". I've set up kunit locally and confirmed the fix: > > Testing complete. Ran 588 tests: passed: 570, skipped: 18 > Elapsed time: 22.916s total, 3.949s configuring, 18.350s building, > 0.601s running > > The 18 skipped tests require Intel hardware — expected. The CI fix will > be included in v5 along with the drm_work_fence restructuring. > > Thanks, > Srini > >> >> Matt

2 months, 1 week

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig