Messages in this thread | | | Date | Thu, 17 Aug 2023 14:13:47 +0100 | Subject | Re: [PATCH v3] misc: sram: Add DMA-BUF Heap exporting of SRAM areas | From | Robin Murphy <> |
| |
On 2023-07-13 20:13, Andrew Davis wrote: > This new export type exposes to userspace the SRAM area as a DMA-BUF Heap, > this allows for allocations of DMA-BUFs that can be consumed by various > DMA-BUF supporting devices. > > Signed-off-by: Andrew Davis <afd@ti.com> > --- > > Changes from v2: > - Make sram_dma_heap_allocate static (kernel test robot) > - Rebase on v6.5-rc1 > > drivers/misc/Kconfig | 7 + > drivers/misc/Makefile | 1 + > drivers/misc/sram-dma-heap.c | 245 +++++++++++++++++++++++++++++++++++ > drivers/misc/sram.c | 6 + > drivers/misc/sram.h | 16 +++ > 5 files changed, 275 insertions(+) > create mode 100644 drivers/misc/sram-dma-heap.c > > diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig > index 75e427f124b28..ee34dfb61605f 100644 > --- a/drivers/misc/Kconfig > +++ b/drivers/misc/Kconfig > @@ -448,6 +448,13 @@ config SRAM > config SRAM_EXEC > bool > > +config SRAM_DMA_HEAP > + bool "Export on-chip SRAM pools using DMA-Heaps" > + depends on DMABUF_HEAPS && SRAM > + help > + This driver allows the export of on-chip SRAM marked as both pool > + and exportable to userspace using the DMA-Heaps interface. > + > config DW_XDATA_PCIE > depends on PCI > tristate "Synopsys DesignWare xData PCIe driver" > diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile > index f2a4d1ff65d46..5e7516bfaa8de 100644 > --- a/drivers/misc/Makefile > +++ b/drivers/misc/Makefile > @@ -47,6 +47,7 @@ obj-$(CONFIG_VMWARE_VMCI) += vmw_vmci/ > obj-$(CONFIG_LATTICE_ECP3_CONFIG) += lattice-ecp3-config.o > obj-$(CONFIG_SRAM) += sram.o > obj-$(CONFIG_SRAM_EXEC) += sram-exec.o > +obj-$(CONFIG_SRAM_DMA_HEAP) += sram-dma-heap.o > obj-$(CONFIG_GENWQE) += genwqe/ > obj-$(CONFIG_ECHO) += echo/ > obj-$(CONFIG_CXL_BASE) += cxl/ > diff --git a/drivers/misc/sram-dma-heap.c b/drivers/misc/sram-dma-heap.c > new file mode 100644 > index 0000000000000..c054c04dff33e > --- /dev/null > +++ b/drivers/misc/sram-dma-heap.c > @@ -0,0 +1,245 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* > + * SRAM DMA-Heap userspace exporter > + * > + * Copyright (C) 2019-2022 Texas Instruments Incorporated - https://www.ti.com/ > + * Andrew Davis <afd@ti.com> > + */ > + > +#include <linux/dma-mapping.h> > +#include <linux/err.h> > +#include <linux/genalloc.h> > +#include <linux/io.h> > +#include <linux/mm.h> > +#include <linux/scatterlist.h> > +#include <linux/slab.h> > +#include <linux/dma-buf.h> > +#include <linux/dma-heap.h> > + > +#include "sram.h" > + > +struct sram_dma_heap { > + struct dma_heap *heap; > + struct gen_pool *pool; > +}; > + > +struct sram_dma_heap_buffer { > + struct gen_pool *pool; > + struct list_head attachments; > + struct mutex attachments_lock; > + unsigned long len; > + void *vaddr; > + phys_addr_t paddr; > +}; > + > +struct dma_heap_attachment { > + struct device *dev; > + struct sg_table *table; > + struct list_head list; > +}; > + > +static int dma_heap_attach(struct dma_buf *dmabuf, > + struct dma_buf_attachment *attachment) > +{ > + struct sram_dma_heap_buffer *buffer = dmabuf->priv; > + struct dma_heap_attachment *a; > + struct sg_table *table; > + > + a = kzalloc(sizeof(*a), GFP_KERNEL); > + if (!a) > + return -ENOMEM; > + > + table = kmalloc(sizeof(*table), GFP_KERNEL); > + if (!table) { > + kfree(a); > + return -ENOMEM; > + } > + if (sg_alloc_table(table, 1, GFP_KERNEL)) { > + kfree(table); > + kfree(a); > + return -ENOMEM; > + } > + sg_set_page(table->sgl, pfn_to_page(PFN_DOWN(buffer->paddr)), buffer->len, 0);
What happens if someone (reasonably) assumes that this struct page pointer isn't completely made up, and dereferences it?
(That's if pfn_to_page() itself doesn't blow up, which it potentially might, at least under CONFIG_SPARSEMEM)
I think this needs to be treated as P2PDMA if it's going to have any hope of working robustly.
> + > + a->table = table; > + a->dev = attachment->dev; > + INIT_LIST_HEAD(&a->list); > + > + attachment->priv = a; > + > + mutex_lock(&buffer->attachments_lock); > + list_add(&a->list, &buffer->attachments); > + mutex_unlock(&buffer->attachments_lock); > + > + return 0; > +} > + > +static void dma_heap_detatch(struct dma_buf *dmabuf, > + struct dma_buf_attachment *attachment) > +{ > + struct sram_dma_heap_buffer *buffer = dmabuf->priv; > + struct dma_heap_attachment *a = attachment->priv; > + > + mutex_lock(&buffer->attachments_lock); > + list_del(&a->list); > + mutex_unlock(&buffer->attachments_lock); > + > + sg_free_table(a->table); > + kfree(a->table); > + kfree(a); > +} > + > +static struct sg_table *dma_heap_map_dma_buf(struct dma_buf_attachment *attachment, > + enum dma_data_direction direction) > +{ > + struct dma_heap_attachment *a = attachment->priv; > + struct sg_table *table = a->table; > + > + /* > + * As this heap is backed by uncached SRAM memory we do not need to > + * perform any sync operations on the buffer before allowing device > + * domain access. For this reason we use SKIP_CPU_SYNC and also do > + * not use or provide begin/end_cpu_access() dma-buf functions. > + */
I bet that works really well with SWIOTLB ;)
Also note that SKIP_CPU_SYNC is only a hint, so the DMA API implementation is still at liberty to do the fatally dangerous things you're hoping it won't (e.g. dereferencing sg_virt()...)
Thanks, Robin.
> + if (!dma_map_sg_attrs(attachment->dev, table->sgl, table->nents, > + direction, DMA_ATTR_SKIP_CPU_SYNC)) > + return ERR_PTR(-ENOMEM); > + > + return table; > +} > + > +static void dma_heap_unmap_dma_buf(struct dma_buf_attachment *attachment, > + struct sg_table *table, > + enum dma_data_direction direction) > +{ > + dma_unmap_sg_attrs(attachment->dev, table->sgl, table->nents, > + direction, DMA_ATTR_SKIP_CPU_SYNC); > +} > + > +static void dma_heap_dma_buf_release(struct dma_buf *dmabuf) > +{ > + struct sram_dma_heap_buffer *buffer = dmabuf->priv; > + > + gen_pool_free(buffer->pool, (unsigned long)buffer->vaddr, buffer->len); > + kfree(buffer); > +} > + > +static int dma_heap_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma) > +{ > + struct sram_dma_heap_buffer *buffer = dmabuf->priv; > + int ret; > + > + /* SRAM mappings are not cached */ > + vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot); > + > + ret = vm_iomap_memory(vma, buffer->paddr, buffer->len); > + if (ret) > + pr_err("Could not map buffer to userspace\n"); > + > + return ret; > +} > + > +static int dma_heap_vmap(struct dma_buf *dmabuf, struct iosys_map *map) > +{ > + struct sram_dma_heap_buffer *buffer = dmabuf->priv; > + > + iosys_map_set_vaddr(map, buffer->vaddr); > + > + return 0; > +} > + > +static const struct dma_buf_ops sram_dma_heap_buf_ops = { > + .attach = dma_heap_attach, > + .detach = dma_heap_detatch, > + .map_dma_buf = dma_heap_map_dma_buf, > + .unmap_dma_buf = dma_heap_unmap_dma_buf, > + .release = dma_heap_dma_buf_release, > + .mmap = dma_heap_mmap, > + .vmap = dma_heap_vmap, > +}; > + > +static struct dma_buf *sram_dma_heap_allocate(struct dma_heap *heap, > + unsigned long len, > + unsigned long fd_flags, > + unsigned long heap_flags) > +{ > + struct sram_dma_heap *sram_dma_heap = dma_heap_get_drvdata(heap); > + struct sram_dma_heap_buffer *buffer; > + > + DEFINE_DMA_BUF_EXPORT_INFO(exp_info); > + struct dma_buf *dmabuf; > + int ret = 0; > + > + buffer = kzalloc(sizeof(*buffer), GFP_KERNEL); > + if (!buffer) > + return ERR_PTR(-ENOMEM); > + buffer->pool = sram_dma_heap->pool; > + INIT_LIST_HEAD(&buffer->attachments); > + mutex_init(&buffer->attachments_lock); > + buffer->len = len; > + > + buffer->vaddr = (void *)gen_pool_alloc(buffer->pool, buffer->len); > + if (!buffer->vaddr) { > + ret = -ENOMEM; > + goto free_buffer; > + } > + > + buffer->paddr = gen_pool_virt_to_phys(buffer->pool, (unsigned long)buffer->vaddr); > + if (buffer->paddr == -1) { > + ret = -ENOMEM; > + goto free_pool; > + } > + > + /* create the dmabuf */ > + exp_info.exp_name = dma_heap_get_name(heap); > + exp_info.ops = &sram_dma_heap_buf_ops; > + exp_info.size = buffer->len; > + exp_info.flags = fd_flags; > + exp_info.priv = buffer; > + dmabuf = dma_buf_export(&exp_info); > + if (IS_ERR(dmabuf)) { > + ret = PTR_ERR(dmabuf); > + goto free_pool; > + } > + > + return dmabuf; > + > +free_pool: > + gen_pool_free(buffer->pool, (unsigned long)buffer->vaddr, buffer->len); > +free_buffer: > + kfree(buffer); > + > + return ERR_PTR(ret); > +} > + > +static struct dma_heap_ops sram_dma_heap_ops = { > + .allocate = sram_dma_heap_allocate, > +}; > + > +int sram_add_dma_heap(struct sram_dev *sram, > + struct sram_reserve *block, > + phys_addr_t start, > + struct sram_partition *part) > +{ > + struct sram_dma_heap *sram_dma_heap; > + struct dma_heap_export_info exp_info; > + > + dev_info(sram->dev, "Exporting SRAM Heap '%s'\n", block->label); > + > + sram_dma_heap = kzalloc(sizeof(*sram_dma_heap), GFP_KERNEL); > + if (!sram_dma_heap) > + return -ENOMEM; > + sram_dma_heap->pool = part->pool; > + > + exp_info.name = kasprintf(GFP_KERNEL, "sram_%s", block->label); > + exp_info.ops = &sram_dma_heap_ops; > + exp_info.priv = sram_dma_heap; > + sram_dma_heap->heap = dma_heap_add(&exp_info); > + if (IS_ERR(sram_dma_heap->heap)) { > + int ret = PTR_ERR(sram_dma_heap->heap); > + kfree(sram_dma_heap); > + return ret; > + } > + > + return 0; > +} > diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c > index 5757adf418b1d..6dd173a2fba8e 100644 > --- a/drivers/misc/sram.c > +++ b/drivers/misc/sram.c > @@ -120,6 +120,12 @@ static int sram_add_partition(struct sram_dev *sram, struct sram_reserve *block, > ret = sram_add_pool(sram, block, start, part); > if (ret) > return ret; > + > + if (block->export) { > + ret = sram_add_dma_heap(sram, block, start, part); > + if (ret) > + return ret; > + } > } > if (block->export) { > ret = sram_add_export(sram, block, start, part); > diff --git a/drivers/misc/sram.h b/drivers/misc/sram.h > index 397205b8bf6ff..062bdd25fa068 100644 > --- a/drivers/misc/sram.h > +++ b/drivers/misc/sram.h > @@ -60,4 +60,20 @@ static inline int sram_add_protect_exec(struct sram_partition *part) > return -ENODEV; > } > #endif /* CONFIG_SRAM_EXEC */ > + > +#ifdef CONFIG_SRAM_DMA_HEAP > +int sram_add_dma_heap(struct sram_dev *sram, > + struct sram_reserve *block, > + phys_addr_t start, > + struct sram_partition *part); > +#else > +static inline int sram_add_dma_heap(struct sram_dev *sram, > + struct sram_reserve *block, > + phys_addr_t start, > + struct sram_partition *part) > +{ > + return 0; > +} > +#endif /* CONFIG_SRAM_DMA_HEAP */ > + > #endif /* __SRAM_H */
| |