[Linaro-mm-sig] Re: [PATCH 11/15] accel/qda: Add PRIME DMA-BUF import support

On 5/19/26 08:16, Ekansh Gupta via B4 Relay wrote:

From: Ekansh Gupta ekansh.gupta@oss.qualcomm.com

Allow user-space to import DMA-BUF file descriptors from other subsystems (GPU, camera, video) into the QDA driver via the standard DRM PRIME interface.

qda_prime.c Implements qda_gem_prime_import(), which is set as the driver's .gem_prime_import callback. On import it:

1. Short-circuits self-import: if the dma_buf was exported by this device and is not itself an import, the existing GEM object is returned with an incremented reference count.
2. Attaches to the dma_buf and maps it with DMA_BIDIRECTIONAL via dma_buf_map_attachment_unlocked(), obtaining an sg_table whose DMA addresses are IOMMU virtual addresses in the CB device's address space.
3. Calls qda_memory_manager_alloc() to record the IOMMU mapping and encode the SID in the upper 32 bits of the DMA address, matching the convention used for natively allocated buffers.

qda_prime_fd_to_handle() wraps drm_gem_prime_fd_to_handle() under qdev->import_lock, storing the calling file_priv in qdev->current_import_file_priv so that qda_gem_prime_import() can retrieve it (the .gem_prime_import callback does not receive file_priv directly).

qda_gem.c qda_gem_free_object() is extended to handle the imported-buffer teardown path: unmap the sg_table, detach from the dma_buf, and release the dma_buf reference. qda_gem_mmap_obj() rejects mmap requests on imported objects.

qda_memory_manager.c qda_memory_manager_map_imported() records the IOMMU-mapped DMA address from the first sg entry (the IOMMU maps the buffer as a contiguous range) and encodes the SID prefix.

No it doesn't.

qda_memory_manager_free() skips the DMA free path for imported buffers since the memory is owned by the exporter.

Assisted-by: Claude:claude-4-6-sonnet Signed-off-by: Ekansh Gupta ekansh.gupta@oss.qualcomm.com

---

drivers/accel/qda/Makefile | 1 + drivers/accel/qda/qda_drv.c | 12 ++- drivers/accel/qda/qda_drv.h | 4 + drivers/accel/qda/qda_gem.c | 25 ++++- drivers/accel/qda/qda_gem.h | 8 ++ drivers/accel/qda/qda_memory_manager.c | 47 ++++++++- drivers/accel/qda/qda_prime.c | 184 +++++++++++++++++++++++++++++++++ drivers/accel/qda/qda_prime.h | 18 ++++ 8 files changed, 295 insertions(+), 4 deletions(-)

diff --git a/drivers/accel/qda/Makefile b/drivers/accel/qda/Makefile index a46ddceecfc5..fb092e56d7f3 100644 --- a/drivers/accel/qda/Makefile +++ b/drivers/accel/qda/Makefile @@ -12,6 +12,7 @@ qda-y := \ qda_ioctl.o \ qda_memory_dma.o \ qda_memory_manager.o \

•   qda_prime.o \
    qda_rpmsg.o
  
  

obj-$(CONFIG_DRM_ACCEL_QDA_COMPUTE_BUS) += qda_compute_bus.o diff --git a/drivers/accel/qda/qda_drv.c b/drivers/accel/qda/qda_drv.c index c9b9e56dcb28..ef8bd573b836 100644 --- a/drivers/accel/qda/qda_drv.c +++ b/drivers/accel/qda/qda_drv.c @@ -7,10 +7,12 @@ #include <drm/drm_file.h> #include <drm/drm_gem.h> #include <drm/drm_ioctl.h> +#include <drm/drm_prime.h> #include <drm/drm_print.h> #include <drm/qda_accel.h>

#include "qda_drv.h" +#include "qda_prime.h" #include "qda_ioctl.h" #include "qda_rpmsg.h"

@@ -64,6 +66,8 @@ static const struct drm_driver qda_drm_driver = { .postclose = qda_postclose, .ioctls = qda_ioctls, .num_ioctls = ARRAY_SIZE(qda_ioctls),

•   .gem_prime_import = qda_gem_prime_import,
  

•   .prime_fd_to_handle = qda_prime_fd_to_handle,
    .name = QDA_DRIVER_NAME,
    .desc = "Qualcomm DSP Accelerator Driver",
  

}; @@ -100,6 +104,7 @@ static int init_memory_manager(struct qda_dev *qdev)

void qda_deinit_device(struct qda_dev *qdev) {

•   mutex_destroy(&qdev->import_lock);
    cleanup_memory_manager(qdev);
  

}

@@ -107,9 +112,14 @@ int qda_init_device(struct qda_dev *qdev) { int ret;

•   mutex_init(&qdev->import_lock);
  

•   qdev->current_import_file_priv = NULL;
  

•   ret = init_memory_manager(qdev);
  

•   if (ret)
  

•   if (ret) {
            drm_err(&qdev->drm_dev, "Failed to initialize memory manager: %d\n", ret);
  

•           mutex_destroy(&qdev->import_lock);
  

•   }
  
    return ret;
  

} diff --git a/drivers/accel/qda/qda_drv.h b/drivers/accel/qda/qda_drv.h index 8a7d647ac8fc..96ce4135e2d9 100644 --- a/drivers/accel/qda/qda_drv.h +++ b/drivers/accel/qda/qda_drv.h @@ -47,6 +47,10 @@ struct qda_dev { struct list_head cb_devs; /** @iommu_mgr: IOMMU/memory manager instance */ struct qda_memory_manager *iommu_mgr;

•   /** @import_lock: Lock protecting prime import context */
  

•   struct mutex import_lock;
  

•   /** @current_import_file_priv: Current file_priv during prime import */
  

•   struct drm_file *current_import_file_priv;
    /** @dsp_name: Name of the DSP domain (e.g. "cdsp", "adsp") */
    const char *dsp_name;
  

}; diff --git a/drivers/accel/qda/qda_gem.c b/drivers/accel/qda/qda_gem.c index 568b3c2e64b7..9e1ac7582d0c 100644 --- a/drivers/accel/qda/qda_gem.c +++ b/drivers/accel/qda/qda_gem.c @@ -9,6 +9,7 @@ #include "qda_gem.h" #include "qda_memory_manager.h" #include "qda_memory_dma.h" +#include "qda_prime.h"

static void setup_vma_flags(struct vm_area_struct *vma) { @@ -25,8 +26,20 @@ void qda_gem_free_object(struct drm_gem_object *gem_obj) struct qda_gem_obj *qda_gem_obj = to_qda_gem_obj(gem_obj); struct qda_dev *qdev = qda_dev_from_drm(gem_obj->dev);

•   if (qda_gem_obj->virt && qdev->iommu_mgr)
  

•           qda_memory_manager_free(qdev->iommu_mgr, qda_gem_obj);
  

•   if (qda_gem_obj->is_imported) {
  

•           if (qda_gem_obj->attachment && qda_gem_obj->sgt)
  

•                   dma_buf_unmap_attachment_unlocked(qda_gem_obj->attachment,
  

•                                                     qda_gem_obj->sgt, DMA_BIDIRECTIONAL);
  

•           if (qda_gem_obj->attachment)
  

•                   dma_buf_detach(qda_gem_obj->dma_buf, qda_gem_obj->attachment);
  

•           if (qda_gem_obj->dma_buf)
  

•                   dma_buf_put(qda_gem_obj->dma_buf);
  

•           if (qda_gem_obj->iommu_dev && qdev->iommu_mgr)
  

•                   qda_memory_manager_free(qdev->iommu_mgr, qda_gem_obj);
  

•   } else {
  

•           if (qda_gem_obj->virt && qdev->iommu_mgr)
  

•                   qda_memory_manager_free(qdev->iommu_mgr, qda_gem_obj);
  

•   }
  
    drm_gem_object_release(gem_obj);
    kfree(qda_gem_obj);
  

@@ -44,6 +57,10 @@ int qda_gem_mmap_obj(struct drm_gem_object *drm_obj, struct vm_area_struct *vma) struct qda_gem_obj *qda_gem_obj = to_qda_gem_obj(drm_obj); int ret;

•   /* Imported dma-buf objects must be mmap'd through the exporter, not the importer */
  

•   if (qda_gem_obj->is_imported)
  

•           return -EINVAL;
  

•   /* Reset vm_pgoff for DMA mmap */
    vma->vm_pgoff = 0;
  
  

@@ -143,6 +160,10 @@ struct drm_gem_object *qda_gem_create_object(struct drm_device *drm_dev, qda_gem_obj = qda_gem_alloc_object(drm_dev, aligned_size); if (IS_ERR(qda_gem_obj)) return ERR_CAST(qda_gem_obj);

•   qda_gem_obj->is_imported = false;
  

•   qda_gem_obj->dma_buf = NULL;
  

•   qda_gem_obj->attachment = NULL;
  

•   qda_gem_obj->sgt = NULL;
  
    ret = qda_memory_manager_alloc(iommu_mgr, qda_gem_obj, file_priv);
    if (ret) {
  

diff --git a/drivers/accel/qda/qda_gem.h b/drivers/accel/qda/qda_gem.h index bb18f8155aa4..0878f57715f6 100644 --- a/drivers/accel/qda/qda_gem.h +++ b/drivers/accel/qda/qda_gem.h @@ -22,12 +22,20 @@ struct qda_gem_obj { struct drm_gem_object base; /** @iommu_dev: IOMMU context bank device that performed the allocation */ struct qda_iommu_device *iommu_dev;

•   /** @dma_buf: Reference to imported dma_buf */
  

•   struct dma_buf *dma_buf;
  

•   /** @attachment: DMA buf attachment */
  

•   struct dma_buf_attachment *attachment;
  

•   /** @sgt: Scatter-gather table */
  

•   struct sg_table *sgt;
    /** @virt: Kernel virtual address of the allocated DMA memory */
    void *virt;
    /** @dma_addr: DMA address (with SID encoded in upper 32 bits) */
    dma_addr_t dma_addr;
    /** @size: Size of the buffer in bytes */
    size_t size;
  

•   /** @is_imported: True if buffer is imported, false if allocated */
  

•   bool is_imported;
  

};

/** diff --git a/drivers/accel/qda/qda_memory_manager.c b/drivers/accel/qda/qda_memory_manager.c index 82111275f420..d2aa0e0e65f5 100644 --- a/drivers/accel/qda/qda_memory_manager.c +++ b/drivers/accel/qda/qda_memory_manager.c @@ -202,6 +202,41 @@ static struct qda_iommu_device *get_or_assign_iommu_device(struct qda_memory_man return NULL; }

+static int qda_memory_manager_map_imported(struct qda_memory_manager *mem_mgr,

•                                      struct qda_gem_obj *gem_obj,
  

•                                      struct qda_iommu_device *iommu_dev)
  

+{

•   struct scatterlist *sg;
  

•   dma_addr_t dma_addr;
  

•   if (!gem_obj->is_imported || !gem_obj->sgt || !iommu_dev) {
  

•           drm_err(gem_obj->base.dev, "Invalid parameters for imported buffer mapping\n");
  

•           return -EINVAL;
  

•   }
  

•   sg = gem_obj->sgt->sgl;
  

•   if (!sg) {
  

•           drm_err(gem_obj->base.dev, "Invalid scatter-gather list for imported buffer\n");
  

•           return -EINVAL;
  

•   }
  

•   gem_obj->iommu_dev = iommu_dev;
  

•   /*
  

•    * After dma_buf_map_attachment_unlocked(), sg_dma_address() returns the
  

•    * IOMMU virtual address, not the physical address. The IOMMU maps the
  

•    * entire buffer as a contiguous range in the IOMMU address space even if
  

•    * the underlying physical memory is non-contiguous. Therefore the first
  

•    * sg entry's DMA address is the start of the complete contiguous
  

•    * IOMMU-mapped range and is sufficient to describe the buffer to the DSP.
  

•    */
  

•   dma_addr = sg_dma_address(sg);
  

•   dma_addr += ((u64)iommu_dev->sid << 32);
  

•   gem_obj->dma_addr = dma_addr;
  

That handling here is completely broken since it assumes that the exporter maps the buffer as contigious range.

But that's in no way guaranteed.

Regards, Christian.

•   return 0;
  

+}

/**

• qda_memory_manager_alloc() - Allocate memory for a GEM object
• @mem_mgr: Pointer to memory manager

@@ -237,7 +272,11 @@ int qda_memory_manager_alloc(struct qda_memory_manager *mem_mgr, struct qda_gem_ return -ENOMEM; }

•   ret = qda_dma_alloc(selected_dev, gem_obj, size);
  

•   if (gem_obj->is_imported)
  

•           ret = qda_memory_manager_map_imported(mem_mgr, gem_obj, selected_dev);
  

•   else
  

•           ret = qda_dma_alloc(selected_dev, gem_obj, size);
  

•   if (ret) {
            drm_err(gem_obj->base.dev, "Allocation failed: size=%zu, device_id=%u, ret=%d\n",
                    size, selected_dev->id, ret);
  

@@ -262,6 +301,12 @@ void qda_memory_manager_free(struct qda_memory_manager *mem_mgr, struct qda_gem_ return; }

•   if (gem_obj->is_imported) {
  

•           drm_dbg_driver(gem_obj->base.dev,
  

•                          "Freed imported buffer tracking (no DMA free needed)\n");
  

•           return;
  

•   }
  

•   qda_dma_free(gem_obj);
  

}

diff --git a/drivers/accel/qda/qda_prime.c b/drivers/accel/qda/qda_prime.c new file mode 100644 index 000000000000..acb0ac8c40fd --- /dev/null +++ b/drivers/accel/qda/qda_prime.c @@ -0,0 +1,184 @@ +// SPDX-License-Identifier: GPL-2.0-only +// Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. +#include <drm/drm_gem.h> +#include <drm/drm_prime.h> +#include <drm/drm_print.h> +#include <linux/slab.h> +#include <linux/dma-mapping.h> +#include "qda_drv.h" +#include "qda_gem.h" +#include "qda_prime.h" +#include "qda_memory_manager.h"

+static struct drm_gem_object *check_own_buffer(struct drm_device *dev, struct dma_buf *dma_buf) +{

•   struct drm_gem_object *existing_gem;
  

•   /* Only safe to access priv if this dma-buf was exported by this device */
  

•   if (!drm_gem_is_prime_exported_dma_buf(dev, dma_buf))
  

•           return NULL;
  

•   existing_gem = dma_buf->priv;
  

•   if (existing_gem->dev != dev)
  

•           return NULL;
  

•   if (to_qda_gem_obj(existing_gem)->is_imported)
  

•           return NULL;
  

•   drm_gem_object_get(existing_gem);
  

•   return existing_gem;
  

+}

+static struct qda_iommu_device *get_iommu_device_for_import(struct qda_dev *qdev,

•                                                       struct drm_file **file_priv_out)
  

+{

•   struct drm_file *file_priv;
  

•   struct qda_file_priv *qda_file_priv;
  

•   struct qda_iommu_device *iommu_dev = NULL;
  

•   int ret;
  

•   file_priv = qdev->current_import_file_priv;
  

•   *file_priv_out = file_priv;
  

•   if (!file_priv || !file_priv->driver_priv)
  

•           return NULL;
  

•   qda_file_priv = (struct qda_file_priv *)file_priv->driver_priv;
  

•   iommu_dev = qda_file_priv->assigned_iommu_dev;
  

•   if (!iommu_dev) {
  

•           ret = qda_memory_manager_assign_device(qdev->iommu_mgr, file_priv);
  

•           if (ret) {
  

•                   drm_err(&qdev->drm_dev, "Failed to assign IOMMU device: %d\n", ret);
  

•                   return NULL;
  

•           }
  

•           iommu_dev = qda_file_priv->assigned_iommu_dev;
  

•   }
  

•   return iommu_dev;
  

+}

+static int setup_dma_buf_mapping(struct qda_gem_obj *qda_gem_obj, struct dma_buf *dma_buf,

•                            struct device *attach_dev, struct qda_dev *qdev)
  

+{

•   struct dma_buf_attachment *attachment;
  

•   struct sg_table *sgt;
  

•   int ret;
  

•   attachment = dma_buf_attach(dma_buf, attach_dev);
  

•   if (IS_ERR(attachment)) {
  

•           ret = PTR_ERR(attachment);
  

•           drm_err(&qdev->drm_dev, "Failed to attach dma_buf: %d\n", ret);
  

•           return ret;
  

•   }
  

•   qda_gem_obj->attachment = attachment;
  

•   sgt = dma_buf_map_attachment_unlocked(attachment, DMA_BIDIRECTIONAL);
  

•   if (IS_ERR(sgt)) {
  

•           ret = PTR_ERR(sgt);
  

•           drm_err(&qdev->drm_dev, "Failed to map dma_buf attachment: %d\n", ret);
  

•           dma_buf_detach(dma_buf, attachment);
  

•           return ret;
  

•   }
  

•   qda_gem_obj->sgt = sgt;
  

•   return 0;
  

+}

+/**

• • qda_gem_prime_import() - Import a DMA-BUF as a GEM object
• • @dev: DRM device structure
• • @dma_buf: DMA-BUF to import
• • Return: Pointer to the imported GEM object on success, ERR_PTR on failure
• */

+struct drm_gem_object *qda_gem_prime_import(struct drm_device *dev, struct dma_buf *dma_buf) +{

•   struct qda_dev *qdev = qda_dev_from_drm(dev);
  

•   struct qda_gem_obj *qda_gem_obj;
  

•   struct drm_file *file_priv;
  

•   struct qda_iommu_device *iommu_dev;
  

•   struct drm_gem_object *existing_gem;
  

•   size_t aligned_size;
  

•   int ret;
  

•   if (!qdev->iommu_mgr) {
  

•           drm_err(dev, "Invalid iommu_mgr\n");
  

•           return ERR_PTR(-ENODEV);
  

•   }
  

•   existing_gem = check_own_buffer(dev, dma_buf);
  

•   if (existing_gem)
  

•           return existing_gem;
  

•   iommu_dev = get_iommu_device_for_import(qdev, &file_priv);
  

•   if (!iommu_dev || !iommu_dev->dev) {
  

•           drm_err(dev, "No IOMMU device assigned for prime import\n");
  

•           return ERR_PTR(-ENODEV);
  

•   }
  

•   drm_dbg_driver(dev, "Using IOMMU device %u for prime import\n", iommu_dev->id);
  

•   aligned_size = PAGE_ALIGN(dma_buf->size);
  

•   qda_gem_obj = qda_gem_alloc_object(dev, aligned_size);
  

•   if (IS_ERR(qda_gem_obj))
  

•           return ERR_CAST(qda_gem_obj);
  

•   qda_gem_obj->is_imported = true;
  

•   qda_gem_obj->dma_buf = dma_buf;
  

•   qda_gem_obj->virt = NULL;
  

•   qda_gem_obj->iommu_dev = iommu_dev;
  

•   get_dma_buf(dma_buf);
  

•   ret = setup_dma_buf_mapping(qda_gem_obj, dma_buf, iommu_dev->dev, qdev);
  

•   if (ret)
  

•           goto err_put_dma_buf;
  

•   ret = qda_memory_manager_alloc(qdev->iommu_mgr, qda_gem_obj, file_priv);
  

•   if (ret) {
  

•           drm_err(dev, "Failed to allocate IOMMU mapping: %d\n", ret);
  

•           goto err_unmap;
  

•   }
  

•   drm_dbg_driver(dev, "Prime import completed successfully size=%zu\n", aligned_size);
  

•   return &qda_gem_obj->base;
  

+err_unmap:

•   dma_buf_unmap_attachment_unlocked(qda_gem_obj->attachment,
  

•                                     qda_gem_obj->sgt, DMA_BIDIRECTIONAL);
  

•   dma_buf_detach(dma_buf, qda_gem_obj->attachment);
  

+err_put_dma_buf:

•   dma_buf_put(dma_buf);
  

•   qda_gem_cleanup_object(qda_gem_obj);
  

•   return ERR_PTR(ret);
  

+}

+/**

• • qda_prime_fd_to_handle() - Convert a PRIME fd to a GEM handle
• • @dev: DRM device structure
• • @file_priv: DRM file private data
• • @prime_fd: File descriptor of the PRIME buffer
• • @handle: Output GEM handle
• • Return: 0 on success, negative error code on failure
• */

+int qda_prime_fd_to_handle(struct drm_device *dev, struct drm_file *file_priv,

•                      int prime_fd, u32 *handle)
  

+{

•   struct qda_dev *qdev = qda_dev_from_drm(dev);
  

•   int ret;
  

•   mutex_lock(&qdev->import_lock);
  

•   qdev->current_import_file_priv = file_priv;
  

•   ret = drm_gem_prime_fd_to_handle(dev, file_priv, prime_fd, handle);
  

•   qdev->current_import_file_priv = NULL;
  

•   mutex_unlock(&qdev->import_lock);
  

•   return ret;
  

+}

+MODULE_IMPORT_NS("DMA_BUF"); diff --git a/drivers/accel/qda/qda_prime.h b/drivers/accel/qda/qda_prime.h new file mode 100644 index 000000000000..9b3850d54fa7 --- /dev/null +++ b/drivers/accel/qda/qda_prime.h @@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/*

• • Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
• */

+#ifndef __QDA_PRIME_H__ +#define __QDA_PRIME_H__

+#include <drm/drm_device.h> +#include <drm/drm_file.h> +#include <drm/drm_gem.h> +#include <linux/dma-buf.h>

+struct drm_gem_object *qda_gem_prime_import(struct drm_device *dev, struct dma_buf *dma_buf); +int qda_prime_fd_to_handle(struct drm_device *dev, struct drm_file *file_priv,

•                      int prime_fd, u32 *handle);
  

+#endif /* __QDA_PRIME_H__ */

-- 2.34.1