On 5/19/26 08:16, Ekansh Gupta via B4 Relay wrote: > From: Ekansh Gupta <[email protected]> > > Allow user-space to import DMA-BUF file descriptors from other > subsystems (GPU, camera, video) into the QDA driver via the standard > DRM PRIME interface. > > qda_prime.c > Implements qda_gem_prime_import(), which is set as the driver's > .gem_prime_import callback. On import it: > 1. Short-circuits self-import: if the dma_buf was exported by this > device and is not itself an import, the existing GEM object is > returned with an incremented reference count. > 2. Attaches to the dma_buf and maps it with DMA_BIDIRECTIONAL via > dma_buf_map_attachment_unlocked(), obtaining an sg_table whose > DMA addresses are IOMMU virtual addresses in the CB device's > address space. > 3. Calls qda_memory_manager_alloc() to record the IOMMU mapping and > encode the SID in the upper 32 bits of the DMA address, matching > the convention used for natively allocated buffers. > > qda_prime_fd_to_handle() wraps drm_gem_prime_fd_to_handle() under > qdev->import_lock, storing the calling file_priv in > qdev->current_import_file_priv so that qda_gem_prime_import() can > retrieve it (the .gem_prime_import callback does not receive > file_priv directly). > > qda_gem.c > qda_gem_free_object() is extended to handle the imported-buffer > teardown path: unmap the sg_table, detach from the dma_buf, and > release the dma_buf reference. > qda_gem_mmap_obj() rejects mmap requests on imported objects. > > qda_memory_manager.c > qda_memory_manager_map_imported() records the IOMMU-mapped DMA > address from the first sg entry (the IOMMU maps the buffer as a > contiguous range) and encodes the SID prefix.
No it doesn't. > qda_memory_manager_free() skips the DMA free path for imported > buffers since the memory is owned by the exporter. > > Assisted-by: Claude:claude-4-6-sonnet > Signed-off-by: Ekansh Gupta <[email protected]> > --- > drivers/accel/qda/Makefile | 1 + > drivers/accel/qda/qda_drv.c | 12 ++- > drivers/accel/qda/qda_drv.h | 4 + > drivers/accel/qda/qda_gem.c | 25 ++++- > drivers/accel/qda/qda_gem.h | 8 ++ > drivers/accel/qda/qda_memory_manager.c | 47 ++++++++- > drivers/accel/qda/qda_prime.c | 184 > +++++++++++++++++++++++++++++++++ > drivers/accel/qda/qda_prime.h | 18 ++++ > 8 files changed, 295 insertions(+), 4 deletions(-) > > diff --git a/drivers/accel/qda/Makefile b/drivers/accel/qda/Makefile > index a46ddceecfc5..fb092e56d7f3 100644 > --- a/drivers/accel/qda/Makefile > +++ b/drivers/accel/qda/Makefile > @@ -12,6 +12,7 @@ qda-y := \ > qda_ioctl.o \ > qda_memory_dma.o \ > qda_memory_manager.o \ > + qda_prime.o \ > qda_rpmsg.o > > obj-$(CONFIG_DRM_ACCEL_QDA_COMPUTE_BUS) += qda_compute_bus.o > diff --git a/drivers/accel/qda/qda_drv.c b/drivers/accel/qda/qda_drv.c > index c9b9e56dcb28..ef8bd573b836 100644 > --- a/drivers/accel/qda/qda_drv.c > +++ b/drivers/accel/qda/qda_drv.c > @@ -7,10 +7,12 @@ > #include <drm/drm_file.h> > #include <drm/drm_gem.h> > #include <drm/drm_ioctl.h> > +#include <drm/drm_prime.h> > #include <drm/drm_print.h> > #include <drm/qda_accel.h> > > #include "qda_drv.h" > +#include "qda_prime.h" > #include "qda_ioctl.h" > #include "qda_rpmsg.h" > > @@ -64,6 +66,8 @@ static const struct drm_driver qda_drm_driver = { > .postclose = qda_postclose, > .ioctls = qda_ioctls, > .num_ioctls = ARRAY_SIZE(qda_ioctls), > + .gem_prime_import = qda_gem_prime_import, > + .prime_fd_to_handle = qda_prime_fd_to_handle, > .name = QDA_DRIVER_NAME, > .desc = "Qualcomm DSP Accelerator Driver", > }; > @@ -100,6 +104,7 @@ static int init_memory_manager(struct qda_dev *qdev) > > void qda_deinit_device(struct qda_dev *qdev) > { > + mutex_destroy(&qdev->import_lock); > cleanup_memory_manager(qdev); > } > > @@ -107,9 +112,14 @@ int qda_init_device(struct qda_dev *qdev) > { > int ret; > > + mutex_init(&qdev->import_lock); > + qdev->current_import_file_priv = NULL; > + > ret = init_memory_manager(qdev); > - if (ret) > + if (ret) { > drm_err(&qdev->drm_dev, "Failed to initialize memory manager: > %d\n", ret); > + mutex_destroy(&qdev->import_lock); > + } > > return ret; > } > diff --git a/drivers/accel/qda/qda_drv.h b/drivers/accel/qda/qda_drv.h > index 8a7d647ac8fc..96ce4135e2d9 100644 > --- a/drivers/accel/qda/qda_drv.h > +++ b/drivers/accel/qda/qda_drv.h > @@ -47,6 +47,10 @@ struct qda_dev { > struct list_head cb_devs; > /** @iommu_mgr: IOMMU/memory manager instance */ > struct qda_memory_manager *iommu_mgr; > + /** @import_lock: Lock protecting prime import context */ > + struct mutex import_lock; > + /** @current_import_file_priv: Current file_priv during prime import > */ > + struct drm_file *current_import_file_priv; > /** @dsp_name: Name of the DSP domain (e.g. "cdsp", "adsp") */ > const char *dsp_name; > }; > diff --git a/drivers/accel/qda/qda_gem.c b/drivers/accel/qda/qda_gem.c > index 568b3c2e64b7..9e1ac7582d0c 100644 > --- a/drivers/accel/qda/qda_gem.c > +++ b/drivers/accel/qda/qda_gem.c > @@ -9,6 +9,7 @@ > #include "qda_gem.h" > #include "qda_memory_manager.h" > #include "qda_memory_dma.h" > +#include "qda_prime.h" > > static void setup_vma_flags(struct vm_area_struct *vma) > { > @@ -25,8 +26,20 @@ void qda_gem_free_object(struct drm_gem_object *gem_obj) > struct qda_gem_obj *qda_gem_obj = to_qda_gem_obj(gem_obj); > struct qda_dev *qdev = qda_dev_from_drm(gem_obj->dev); > > - if (qda_gem_obj->virt && qdev->iommu_mgr) > - qda_memory_manager_free(qdev->iommu_mgr, qda_gem_obj); > + if (qda_gem_obj->is_imported) { > + if (qda_gem_obj->attachment && qda_gem_obj->sgt) > + > dma_buf_unmap_attachment_unlocked(qda_gem_obj->attachment, > + qda_gem_obj->sgt, > DMA_BIDIRECTIONAL); > + if (qda_gem_obj->attachment) > + dma_buf_detach(qda_gem_obj->dma_buf, > qda_gem_obj->attachment); > + if (qda_gem_obj->dma_buf) > + dma_buf_put(qda_gem_obj->dma_buf); > + if (qda_gem_obj->iommu_dev && qdev->iommu_mgr) > + qda_memory_manager_free(qdev->iommu_mgr, qda_gem_obj); > + } else { > + if (qda_gem_obj->virt && qdev->iommu_mgr) > + qda_memory_manager_free(qdev->iommu_mgr, qda_gem_obj); > + } > > drm_gem_object_release(gem_obj); > kfree(qda_gem_obj); > @@ -44,6 +57,10 @@ int qda_gem_mmap_obj(struct drm_gem_object *drm_obj, > struct vm_area_struct *vma) > struct qda_gem_obj *qda_gem_obj = to_qda_gem_obj(drm_obj); > int ret; > > + /* Imported dma-buf objects must be mmap'd through the exporter, not > the importer */ > + if (qda_gem_obj->is_imported) > + return -EINVAL; > + > /* Reset vm_pgoff for DMA mmap */ > vma->vm_pgoff = 0; > > @@ -143,6 +160,10 @@ struct drm_gem_object *qda_gem_create_object(struct > drm_device *drm_dev, > qda_gem_obj = qda_gem_alloc_object(drm_dev, aligned_size); > if (IS_ERR(qda_gem_obj)) > return ERR_CAST(qda_gem_obj); > + qda_gem_obj->is_imported = false; > + qda_gem_obj->dma_buf = NULL; > + qda_gem_obj->attachment = NULL; > + qda_gem_obj->sgt = NULL; > > ret = qda_memory_manager_alloc(iommu_mgr, qda_gem_obj, file_priv); > if (ret) { > diff --git a/drivers/accel/qda/qda_gem.h b/drivers/accel/qda/qda_gem.h > index bb18f8155aa4..0878f57715f6 100644 > --- a/drivers/accel/qda/qda_gem.h > +++ b/drivers/accel/qda/qda_gem.h > @@ -22,12 +22,20 @@ struct qda_gem_obj { > struct drm_gem_object base; > /** @iommu_dev: IOMMU context bank device that performed the > allocation */ > struct qda_iommu_device *iommu_dev; > + /** @dma_buf: Reference to imported dma_buf */ > + struct dma_buf *dma_buf; > + /** @attachment: DMA buf attachment */ > + struct dma_buf_attachment *attachment; > + /** @sgt: Scatter-gather table */ > + struct sg_table *sgt; > /** @virt: Kernel virtual address of the allocated DMA memory */ > void *virt; > /** @dma_addr: DMA address (with SID encoded in upper 32 bits) */ > dma_addr_t dma_addr; > /** @size: Size of the buffer in bytes */ > size_t size; > + /** @is_imported: True if buffer is imported, false if allocated */ > + bool is_imported; > }; > > /** > diff --git a/drivers/accel/qda/qda_memory_manager.c > b/drivers/accel/qda/qda_memory_manager.c > index 82111275f420..d2aa0e0e65f5 100644 > --- a/drivers/accel/qda/qda_memory_manager.c > +++ b/drivers/accel/qda/qda_memory_manager.c > @@ -202,6 +202,41 @@ static struct qda_iommu_device > *get_or_assign_iommu_device(struct qda_memory_man > return NULL; > } > > +static int qda_memory_manager_map_imported(struct qda_memory_manager > *mem_mgr, > + struct qda_gem_obj *gem_obj, > + struct qda_iommu_device *iommu_dev) > +{ > + struct scatterlist *sg; > + dma_addr_t dma_addr; > + > + if (!gem_obj->is_imported || !gem_obj->sgt || !iommu_dev) { > + drm_err(gem_obj->base.dev, "Invalid parameters for imported > buffer mapping\n"); > + return -EINVAL; > + } > + > + sg = gem_obj->sgt->sgl; > + if (!sg) { > + drm_err(gem_obj->base.dev, "Invalid scatter-gather list for > imported buffer\n"); > + return -EINVAL; > + } > + > + gem_obj->iommu_dev = iommu_dev; > + > + /* > + * After dma_buf_map_attachment_unlocked(), sg_dma_address() returns > the > + * IOMMU virtual address, not the physical address. The IOMMU maps the > + * entire buffer as a contiguous range in the IOMMU address space > even if > + * the underlying physical memory is non-contiguous. Therefore the > first > + * sg entry's DMA address is the start of the complete contiguous > + * IOMMU-mapped range and is sufficient to describe the buffer to the > DSP. > + */ > + dma_addr = sg_dma_address(sg); > + dma_addr += ((u64)iommu_dev->sid << 32); > + gem_obj->dma_addr = dma_addr; That handling here is completely broken since it assumes that the exporter maps the buffer as contigious range. But that's in no way guaranteed. Regards, Christian. > + > + return 0; > +} > + > /** > * qda_memory_manager_alloc() - Allocate memory for a GEM object > * @mem_mgr: Pointer to memory manager > @@ -237,7 +272,11 @@ int qda_memory_manager_alloc(struct qda_memory_manager > *mem_mgr, struct qda_gem_ > return -ENOMEM; > } > > - ret = qda_dma_alloc(selected_dev, gem_obj, size); > + if (gem_obj->is_imported) > + ret = qda_memory_manager_map_imported(mem_mgr, gem_obj, > selected_dev); > + else > + ret = qda_dma_alloc(selected_dev, gem_obj, size); > + > if (ret) { > drm_err(gem_obj->base.dev, "Allocation failed: size=%zu, > device_id=%u, ret=%d\n", > size, selected_dev->id, ret); > @@ -262,6 +301,12 @@ void qda_memory_manager_free(struct qda_memory_manager > *mem_mgr, struct qda_gem_ > return; > } > > + if (gem_obj->is_imported) { > + drm_dbg_driver(gem_obj->base.dev, > + "Freed imported buffer tracking (no DMA free > needed)\n"); > + return; > + } > + > qda_dma_free(gem_obj); > } > > diff --git a/drivers/accel/qda/qda_prime.c b/drivers/accel/qda/qda_prime.c > new file mode 100644 > index 000000000000..acb0ac8c40fd > --- /dev/null > +++ b/drivers/accel/qda/qda_prime.c > @@ -0,0 +1,184 @@ > +// SPDX-License-Identifier: GPL-2.0-only > +// Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. > +#include <drm/drm_gem.h> > +#include <drm/drm_prime.h> > +#include <drm/drm_print.h> > +#include <linux/slab.h> > +#include <linux/dma-mapping.h> > +#include "qda_drv.h" > +#include "qda_gem.h" > +#include "qda_prime.h" > +#include "qda_memory_manager.h" > + > +static struct drm_gem_object *check_own_buffer(struct drm_device *dev, > struct dma_buf *dma_buf) > +{ > + struct drm_gem_object *existing_gem; > + > + /* Only safe to access priv if this dma-buf was exported by this > device */ > + if (!drm_gem_is_prime_exported_dma_buf(dev, dma_buf)) > + return NULL; > + > + existing_gem = dma_buf->priv; > + if (existing_gem->dev != dev) > + return NULL; > + > + if (to_qda_gem_obj(existing_gem)->is_imported) > + return NULL; > + > + drm_gem_object_get(existing_gem); > + return existing_gem; > +} > + > +static struct qda_iommu_device *get_iommu_device_for_import(struct qda_dev > *qdev, > + struct drm_file > **file_priv_out) > +{ > + struct drm_file *file_priv; > + struct qda_file_priv *qda_file_priv; > + struct qda_iommu_device *iommu_dev = NULL; > + int ret; > + > + file_priv = qdev->current_import_file_priv; > + *file_priv_out = file_priv; > + > + if (!file_priv || !file_priv->driver_priv) > + return NULL; > + > + qda_file_priv = (struct qda_file_priv *)file_priv->driver_priv; > + iommu_dev = qda_file_priv->assigned_iommu_dev; > + > + if (!iommu_dev) { > + ret = qda_memory_manager_assign_device(qdev->iommu_mgr, > file_priv); > + if (ret) { > + drm_err(&qdev->drm_dev, "Failed to assign IOMMU > device: %d\n", ret); > + return NULL; > + } > + > + iommu_dev = qda_file_priv->assigned_iommu_dev; > + } > + > + return iommu_dev; > +} > + > +static int setup_dma_buf_mapping(struct qda_gem_obj *qda_gem_obj, struct > dma_buf *dma_buf, > + struct device *attach_dev, struct qda_dev > *qdev) > +{ > + struct dma_buf_attachment *attachment; > + struct sg_table *sgt; > + int ret; > + > + attachment = dma_buf_attach(dma_buf, attach_dev); > + if (IS_ERR(attachment)) { > + ret = PTR_ERR(attachment); > + drm_err(&qdev->drm_dev, "Failed to attach dma_buf: %d\n", > ret); > + return ret; > + } > + qda_gem_obj->attachment = attachment; > + > + sgt = dma_buf_map_attachment_unlocked(attachment, DMA_BIDIRECTIONAL); > + if (IS_ERR(sgt)) { > + ret = PTR_ERR(sgt); > + drm_err(&qdev->drm_dev, "Failed to map dma_buf attachment: > %d\n", ret); > + dma_buf_detach(dma_buf, attachment); > + return ret; > + } > + qda_gem_obj->sgt = sgt; > + > + return 0; > +} > + > +/** > + * qda_gem_prime_import() - Import a DMA-BUF as a GEM object > + * @dev: DRM device structure > + * @dma_buf: DMA-BUF to import > + * > + * Return: Pointer to the imported GEM object on success, ERR_PTR on failure > + */ > +struct drm_gem_object *qda_gem_prime_import(struct drm_device *dev, struct > dma_buf *dma_buf) > +{ > + struct qda_dev *qdev = qda_dev_from_drm(dev); > + struct qda_gem_obj *qda_gem_obj; > + struct drm_file *file_priv; > + struct qda_iommu_device *iommu_dev; > + struct drm_gem_object *existing_gem; > + size_t aligned_size; > + int ret; > + > + if (!qdev->iommu_mgr) { > + drm_err(dev, "Invalid iommu_mgr\n"); > + return ERR_PTR(-ENODEV); > + } > + > + existing_gem = check_own_buffer(dev, dma_buf); > + if (existing_gem) > + return existing_gem; > + > + iommu_dev = get_iommu_device_for_import(qdev, &file_priv); > + if (!iommu_dev || !iommu_dev->dev) { > + drm_err(dev, "No IOMMU device assigned for prime import\n"); > + return ERR_PTR(-ENODEV); > + } > + > + drm_dbg_driver(dev, "Using IOMMU device %u for prime import\n", > iommu_dev->id); > + > + aligned_size = PAGE_ALIGN(dma_buf->size); > + qda_gem_obj = qda_gem_alloc_object(dev, aligned_size); > + if (IS_ERR(qda_gem_obj)) > + return ERR_CAST(qda_gem_obj); > + > + qda_gem_obj->is_imported = true; > + qda_gem_obj->dma_buf = dma_buf; > + qda_gem_obj->virt = NULL; > + qda_gem_obj->iommu_dev = iommu_dev; > + > + get_dma_buf(dma_buf); > + > + ret = setup_dma_buf_mapping(qda_gem_obj, dma_buf, iommu_dev->dev, > qdev); > + if (ret) > + goto err_put_dma_buf; > + > + ret = qda_memory_manager_alloc(qdev->iommu_mgr, qda_gem_obj, > file_priv); > + if (ret) { > + drm_err(dev, "Failed to allocate IOMMU mapping: %d\n", ret); > + goto err_unmap; > + } > + > + drm_dbg_driver(dev, "Prime import completed successfully size=%zu\n", > aligned_size); > + return &qda_gem_obj->base; > + > +err_unmap: > + dma_buf_unmap_attachment_unlocked(qda_gem_obj->attachment, > + qda_gem_obj->sgt, > DMA_BIDIRECTIONAL); > + dma_buf_detach(dma_buf, qda_gem_obj->attachment); > +err_put_dma_buf: > + dma_buf_put(dma_buf); > + qda_gem_cleanup_object(qda_gem_obj); > + return ERR_PTR(ret); > +} > + > +/** > + * qda_prime_fd_to_handle() - Convert a PRIME fd to a GEM handle > + * @dev: DRM device structure > + * @file_priv: DRM file private data > + * @prime_fd: File descriptor of the PRIME buffer > + * @handle: Output GEM handle > + * > + * Return: 0 on success, negative error code on failure > + */ > +int qda_prime_fd_to_handle(struct drm_device *dev, struct drm_file > *file_priv, > + int prime_fd, u32 *handle) > +{ > + struct qda_dev *qdev = qda_dev_from_drm(dev); > + int ret; > + > + mutex_lock(&qdev->import_lock); > + qdev->current_import_file_priv = file_priv; > + > + ret = drm_gem_prime_fd_to_handle(dev, file_priv, prime_fd, handle); > + > + qdev->current_import_file_priv = NULL; > + mutex_unlock(&qdev->import_lock); > + > + return ret; > +} > + > +MODULE_IMPORT_NS("DMA_BUF"); > diff --git a/drivers/accel/qda/qda_prime.h b/drivers/accel/qda/qda_prime.h > new file mode 100644 > index 000000000000..9b3850d54fa7 > --- /dev/null > +++ b/drivers/accel/qda/qda_prime.h > @@ -0,0 +1,18 @@ > +/* SPDX-License-Identifier: GPL-2.0-only */ > +/* > + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. > + */ > + > +#ifndef __QDA_PRIME_H__ > +#define __QDA_PRIME_H__ > + > +#include <drm/drm_device.h> > +#include <drm/drm_file.h> > +#include <drm/drm_gem.h> > +#include <linux/dma-buf.h> > + > +struct drm_gem_object *qda_gem_prime_import(struct drm_device *dev, struct > dma_buf *dma_buf); > +int qda_prime_fd_to_handle(struct drm_device *dev, struct drm_file > *file_priv, > + int prime_fd, u32 *handle); > + > +#endif /* __QDA_PRIME_H__ */ > > -- > 2.34.1 > >
