Linaro-mm-sig July 2012

linaro-mm-sig@lists.linaro.org

19 participants
22 discussions

[PATCH] device: add dma_params->max_segment_count

by Rob Clark

From: Rob Clark <rob(a)ti.com> For devices which have constraints about maximum number of segments in an sglist. For example, a device which could only deal with contiguous buffers would set max_segment_count to 1. The initial motivation is for devices sharing buffers via dma-buf, to allow the buffer exporter to know the constraints of other devices which have attached to the buffer. The dma_mask and fields in 'struct device_dma_parameters' tell the exporter everything else that is needed, except whether the importer has constraints about maximum number of segments. Signed-off-by: Rob Clark <rob(a)ti.com> --- include/linux/device.h | 1 + include/linux/dma-mapping.h | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/include/linux/device.h b/include/linux/device.h index 161d962..3813735 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -568,6 +568,7 @@ struct device_dma_parameters { * sg limitations. */ unsigned int max_segment_size; + unsigned int max_segment_count; /* zero for unlimited */ unsigned long segment_boundary_mask; }; diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h index dfc099e..f380f79 100644 --- a/include/linux/dma-mapping.h +++ b/include/linux/dma-mapping.h @@ -111,6 +111,22 @@ static inline unsigned int dma_set_max_seg_size(struct device *dev, return -EIO; } +static inline unsigned int dma_get_max_seg_count(struct device *dev) +{ + return dev->dma_parms ? dev->dma_parms->max_segment_count : 0; +} + +static inline int dma_set_max_seg_count(struct device *dev, + unsigned int count) +{ + if (dev->dma_parms) { + dev->dma_parms->max_segment_count = count; + return 0; + } else + return -EIO; +} + + static inline unsigned long dma_get_seg_boundary(struct device *dev) { return dev->dma_parms ? -- 1.7.9.5

11 years, 9 months

Fwd: [Workshop-2011] Media summit at the Kernel Summit

by Hans Verkuil

FYI! If anyone is interested, then please discuss that on the linux-media mailinglist. I promised Mauro to forward it to a few mailinglists where this might be of interest, so here it is :-) Regards, Hans ---------- Forwarded Message ---------- Subject: [Workshop-2011] Media summit at the Kernel Summit - was: Fwd: Re: [Ksummit-2012-discuss] Organising Mini Summits within the Kernel Summit Date: Tue July 17 2012, 19:30:53 From: Mauro Carvalho Chehab <mchehab(a)redhat.com> To: Linux Media Mailing List <linux-media(a)vger.kernel.org>, workshop-2011(a)linuxtv.org As we did in 2012, we're planning to do a media summit again at KS/2012. The KS/2012 will happen in San Diego, CA, US, between Aug 26-28, just before the LinuxCon North America. In order to do it, I'd like to know who is interested on participate, and to get proposals about what subjects will be discussed there, in order to start planning the agenda. Thanks! Mauro

11 years, 9 months

[GIT PULL] CMA and DMA-mapping fixes for v3.5-rc7

by Marek Szyprowski

Hi Linus, I woukd like to ask you again for pulling another set of minor fixups for recently merged Contiguous Memory Allocator and ARM DMA-mapping changes. Those patches fix mysterious crashes on systems with CMA and Himem enabled as well as some corner cases caused by typical off-by-one bug. I'm sorry for a delay in sending this pull request which is caused by my vacations. The following changes since commit 6887a4131da3adaab011613776d865f4bcfb5678: Linux 3.5-rc5 (2012-06-30 16:08:57 -0700) with the top-most commit 46c87852e99cf8ce97e207b11cde19085837e39c ARM: dma-mapping: modify condition check while freeing pages are available in the git repository at: git://git.linaro.org/people/mszyprowski/linux-dma-mapping.git fixes-for-linus Marek Szyprowski (1): mm: cma: fix condition check when setting global cma area Prathyush K (1): ARM: dma-mapping: modify condition check while freeing pages Rabin Vincent (1): mm: cma: don't replace lowmem pages with highmem arch/arm/mm/dma-mapping.c | 4 ++-- include/asm-generic/dma-contiguous.h | 2 +- mm/page_alloc.c | 7 ++++++- 3 files changed, 9 insertions(+), 4 deletions(-) Thanks! Best regards Marek Szyprowski Samsung Poland R&D Center

11 years, 9 months

[RFC] dma-fence: dma-buf synchronization (v2)

by Rob Clark

From: Rob Clark <rob(a)ti.com> A dma-fence can be attached to a buffer which is being filled or consumed by hw, to allow userspace to pass the buffer without waiting to another device. For example, userspace can call page_flip ioctl to display the next frame of graphics after kicking the GPU but while the GPU is still rendering. The display device sharing the buffer with the GPU would attach a callback to get notified when the GPU's rendering-complete IRQ fires, to update the scan-out address of the display, without having to wake up userspace. A dma-fence is transient, one-shot deal. It is allocated and attached to dma-buf's list of fences. When the one that attached it is done, with the pending operation, it can signal the fence removing it from the dma-buf's list of fences: + dma_buf_attach_fence() + dma_fence_signal() Other drivers can access the current fence on the dma-buf (if any), which increment's the fences refcnt: + dma_buf_get_fence() + dma_fence_put() The one pending on the fence can add an async callback (and optionally cancel it.. for example, to recover from GPU hangs): + dma_fence_add_callback() + dma_fence_cancel_callback() Or wait synchronously (optionally with timeout or from atomic context): + dma_fence_wait() A default software-only implementation is provided, which can be used by drivers attaching a fence to a buffer when they have no other means for hw sync. But a memory backed fence is also envisioned, because it is common that GPU's can write to, or poll on some memory location for synchronization. For example: fence = dma_buf_get_fence(dmabuf); if (fence->ops == &mem_dma_fence_ops) { dma_buf *fence_buf; mem_dma_fence_get_buf(fence, &fence_buf, &offset); ... tell the hw the memory location to wait on ... } else { /* fall-back to sw sync * / dma_fence_add_callback(fence, my_cb); } The memory location is itself backed by dma-buf, to simplify mapping to the device's address space, an idea borrowed from Maarten Lankhorst. NOTE: the memory location fence is not implemented yet, the above is just for explaining how it would work. On SoC platforms, if some other hw mechanism is provided for synchronizing between IP blocks, it could be supported as an alternate implementation with it's own fence ops in a similar way. The other non-sw implementations would wrap the add/cancel_callback and wait fence ops, so that they can keep track if a device not supporting hw sync is waiting on the fence, and in this case should arrange to call dma_fence_signal() at some point after the condition has changed, to notify other devices waiting on the fence. If there are no sw waiters, this can be skipped to avoid waking the CPU unnecessarily. The intention is to provide a userspace interface (presumably via eventfd) later, to be used in conjunction with dma-buf's mmap support for sw access to buffers (or for userspace apps that would prefer to do their own synchronization). v1: original v2: After discussion w/ danvet and mlankhorst on #dri-devel, we decided that dma-fence didn't need to care about the sw->hw signaling path (it can be handled same as sw->sw case), and therefore the fence->ops can be simplified and more handled in the core. So remove the signal, add_callback, cancel_callback, and wait ops, and replace with a simple enable_signaling() op which can be used to inform a fence supporting hw->hw signaling that one or more devices which do not support hw signaling are waiting (and therefore it should enable an irq or do whatever is necessary in order that the CPU is notified when the fence is passed). --- drivers/base/Makefile | 2 +- drivers/base/dma-buf.c | 3 + drivers/base/dma-fence.c | 364 +++++++++++++++++++++++++++++++++++++++++++++ include/linux/dma-buf.h | 2 + include/linux/dma-fence.h | 128 ++++++++++++++++ 5 files changed, 498 insertions(+), 1 deletion(-) create mode 100644 drivers/base/dma-fence.c create mode 100644 include/linux/dma-fence.h diff --git a/drivers/base/Makefile b/drivers/base/Makefile index 5aa2d70..6e9f217 100644 --- a/drivers/base/Makefile +++ b/drivers/base/Makefile @@ -10,7 +10,7 @@ obj-$(CONFIG_CMA) += dma-contiguous.o obj-y += power/ obj-$(CONFIG_HAS_DMA) += dma-mapping.o obj-$(CONFIG_HAVE_GENERIC_DMA_COHERENT) += dma-coherent.o -obj-$(CONFIG_DMA_SHARED_BUFFER) += dma-buf.o +obj-$(CONFIG_DMA_SHARED_BUFFER) += dma-buf.o dma-fence.o obj-$(CONFIG_ISA) += isa.o obj-$(CONFIG_FW_LOADER) += firmware_class.o obj-$(CONFIG_NUMA) += node.o diff --git a/drivers/base/dma-buf.c b/drivers/base/dma-buf.c index 24e88fe..b053236 100644 --- a/drivers/base/dma-buf.c +++ b/drivers/base/dma-buf.c @@ -39,6 +39,8 @@ static int dma_buf_release(struct inode *inode, struct file *file) dmabuf = file->private_data; + WARN_ON(!list_empty(&dmabuf->fence_list)); + dmabuf->ops->release(dmabuf); kfree(dmabuf); return 0; @@ -119,6 +121,7 @@ struct dma_buf *dma_buf_export(void *priv, const struct dma_buf_ops *ops, mutex_init(&dmabuf->lock); INIT_LIST_HEAD(&dmabuf->attachments); + INIT_LIST_HEAD(&dmabuf->fence_list); return dmabuf; } diff --git a/drivers/base/dma-fence.c b/drivers/base/dma-fence.c new file mode 100644 index 0000000..2bc25df --- /dev/null +++ b/drivers/base/dma-fence.c @@ -0,0 +1,364 @@ +/* + * Fence mechanism for dma-buf to allow for asynchronous dma access + * + * Copyright (C) 2012 Texas Instruments + * Author: Rob Clark <rob.clark(a)linaro.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 as published by + * the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along with + * this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#include <linux/slab.h> +#include <linux/sched.h> +#include <linux/export.h> +#include <linux/dma-fence.h> + +#define ATTACHED (1 << 0) +#define SIGNALED (1 << 1) + +/** + * dma_buf_attach_fence - Attach a fence to a dma-buf. + * + * @buf: the dma-buf to attach to + * @fence: the fence to attach + * + * A fence can only be attached to a single dma-buf. The dma-buf takes + * ownership of the fence, which is unref'd when the fence is signaled. + * The fence takes a reference to the dma-buf so the buffer will not be + * freed while there is a pending fence. + */ +int dma_buf_attach_fence(struct dma_buf *buf, struct dma_fence *fence) +{ + unsigned long flags; + int ret = -EINVAL; + + if (WARN_ON(!buf || !fence)) + return -EINVAL; + + spin_lock_irqsave(&fence->event_queue.lock, flags); + if (!fence->attached) { + get_dma_buf(buf); + fence->attached = true; + list_add(&fence->list_node, &buf->fence_list); + ret = 0; + } + spin_unlock_irqrestore(&fence->event_queue.lock, flags); + + return ret; +} +EXPORT_SYMBOL_GPL(dma_buf_attach_fence); + +static void signal_fence(struct dma_fence *fence) +{ + list_del(&fence->list_node); + wake_up_all_locked(&fence->event_queue); +} + +/** + * dma_fence_signal - Signal a fence. + * + * @fence: The fence to signal + * + * All registered callbacks will be called directly (synchronously) and + * all blocked waters will be awoken. + * + * TODO: any value in adding a dma_fence_cancel(), for example to recov + * from hung gpu? It would behave like dma_fence_signal() but return + * an error to waiters and cb's to let them know that the condition they + * are waiting for will never happen. + */ +int dma_fence_signal(struct dma_fence *fence) +{ + unsigned long flags; + int ret = -EINVAL; + + if (WARN_ON(!fence)) + return -EINVAL; + + spin_lock_irqsave(&fence->event_queue.lock, flags); + if (fence->attached && !fence->signaled) { + fence->signaled = true; + signal_fence(fence); + ret = 0; + } + spin_unlock_irqrestore(&fence->event_queue.lock, flags); + + dma_fence_put(fence); + + return ret; +} +EXPORT_SYMBOL_GPL(dma_fence_signal); + +/** + * dma_buf_get_fence - Get the most recent pending fence attached to the + * dma-buf. + * + * @buf: the dma-buf whose fence to get + * + * If this returns NULL, there are no pending fences. Otherwise this + * takes a reference to the returned fence, so the caller must later + * call dma_fence_put() to release the reference. + */ +struct dma_fence *dma_buf_get_fence(struct dma_buf *buf) +{ + struct dma_fence *fence = NULL; + unsigned long flags; + + if (WARN_ON(!buf)) + return ERR_PTR(-EINVAL); + + spin_lock_irqsave(&fence->event_queue.lock, flags); + if (!list_empty(&buf->fence_list)) { + fence = list_first_entry(&buf->fence_list, + struct dma_fence, list_node); + dma_fence_get(fence); + } + spin_unlock_irqrestore(&fence->event_queue.lock, flags); + + return fence; +} +EXPORT_SYMBOL_GPL(dma_buf_get_fence); + +static void release_fence(struct kref *kref) +{ + struct dma_fence *fence = + container_of(kref, struct dma_fence, refcount); + + WARN_ON(waitqueue_active(&fence->event_queue)); + + kfree(fence); +} + +/** + * dma_fence_put - Release a reference to the fence. + */ +void dma_fence_put(struct dma_fence *fence) +{ + WARN_ON(!fence); + kref_put(&fence->refcount, release_fence); +} +EXPORT_SYMBOL_GPL(dma_fence_put); + +/** + * dma_fence_get - Take a reference to the fence. + * + * In most cases this is used only internally by dma-fence. + */ +void dma_fence_get(struct dma_fence *fence) +{ + WARN_ON(!fence); + kref_get(&fence->refcount); +} +EXPORT_SYMBOL_GPL(dma_fence_get); + +static int check_signaling(struct dma_fence *fence) +{ + bool enable_signaling = false; + unsigned long flags; + int ret = 0; + + spin_lock_irqsave(&fence->event_queue.lock, flags); + if (!fence->needs_sw_signal && !fence->signaled) + enable_signaling = fence->needs_sw_signal = true; + spin_unlock_irqrestore(&fence->event_queue.lock, flags); + + if (enable_signaling) + ret = fence->ops->enable_signaling(fence); + + return ret; +} + +/** + * dma_fence_add_callback - Add a callback to be called when the fence + * is signaled. + * + * @fence: The fence to wait on + * @cb: The callback to register + * + * Any number of callbacks can be registered to a fence, but a callback + * can only be registered to once fence at a time. + * + * Note that the callback can be called from an atomic context. If + * fence is already signaled, this function will return -ENOENT (and + * *not* call the callback) + */ +int dma_fence_add_callback(struct dma_fence *fence, + struct dma_fence_cb *cb) +{ + unsigned long flags; + int ret; + + if (WARN_ON(!fence || !cb)) + return -EINVAL; + + ret = check_signaling(fence); + + spin_lock_irqsave(&fence->event_queue.lock, flags); + if (ret == -ENOENT) { + /* if state changed while we dropped the lock, dispatch now */ + signal_fence(fence); + } else if (!fence->signaled && !ret) { + dma_fence_get(fence); + cb->fence = fence; + __add_wait_queue(&fence->event_queue, &cb->base); + ret = 0; + } else { + ret = -EINVAL; + } + spin_unlock_irqrestore(&fence->event_queue.lock, flags); + + return ret; +} +EXPORT_SYMBOL_GPL(dma_fence_add_callback); + +/** + * dma_fence_cancel_callback - Remove a previously registered callback. + * + * @cb: The callback to unregister + * + * The callback will not be called after this function returns, but could + * be called before this function returns. + */ +int dma_fence_cancel_callback(struct dma_fence_cb *cb) +{ + struct dma_fence *fence; + unsigned long flags; + int ret = -EINVAL; + + if (WARN_ON(!cb)) + return -EINVAL; + + fence = cb->fence; + + spin_lock_irqsave(&fence->event_queue.lock, flags); + if (fence) { + __remove_wait_queue(&fence->event_queue, &cb->base); + cb->fence = NULL; + dma_fence_put(fence); + ret = 0; + } + spin_unlock_irqrestore(&fence->event_queue.lock, flags); + + return ret; +} +EXPORT_SYMBOL_GPL(dma_fence_cancel_callback); + +/** + * dma_fence_wait - Wait for a fence to be signaled. + * + * @fence: The fence to wait on + * @interruptible: if true, do an interruptible wait + * @timeout: timeout, in jiffies + * + * Returns -ENOENT if the fence has already passed. + */ +int dma_fence_wait(struct dma_fence *fence, bool interruptible, long timeout) +{ + unsigned long flags; + int ret; + + if (WARN_ON(!fence)) + return -EINVAL; + + ret = check_signaling(fence); + if (ret == -ENOENT) { + spin_lock_irqsave(&fence->event_queue.lock, flags); + signal_fence(fence); + spin_unlock_irqrestore(&fence->event_queue.lock, flags); + return ret; + } + + if (ret) + return ret; + + if (interruptible) + ret = wait_event_interruptible_timeout(fence->event_queue, + fence->signaled, timeout); + else + ret = wait_event_timeout(fence->event_queue, + fence->signaled, timeout); + + return ret; +} +EXPORT_SYMBOL_GPL(dma_fence_wait); + +int __dma_fence_wake_func(wait_queue_t *wait, unsigned mode, + int flags, void *key) +{ + struct dma_fence_cb *cb = + container_of(wait, struct dma_fence_cb, base); + struct dma_fence *fence = cb->fence; + int ret; + + ret = cb->func(cb, fence); + cb->fence = NULL; + dma_fence_put(fence); + + return ret; +} +EXPORT_SYMBOL_GPL(__dma_fence_wake_func); + +/* + * Helpers intended to be used by the ops of the dma_fence implementation: + * + * NOTE: helpers and fxns intended to be used by other dma-fence + * implementations are not exported.. I'm not really sure if it makes + * sense to have a dma-fence implementation that is itself a module. + */ + +void __dma_fence_init(struct dma_fence *fence, struct dma_fence_ops *ops) +{ + WARN_ON(!ops || !ops->enable_signaling); + + kref_init(&fence->refcount); + fence->ops = ops; + init_waitqueue_head(&fence->event_queue); +} + +/* + * Pure sw implementation for dma-fence. The CPU always gets involved. + */ + +static int sw_enable_signaling(struct dma_fence *fence) +{ + /* + * pure sw, no irq's to enable, because the fence creator will + * always call dma_fence_signal() + */ + return 0; +} + +static struct dma_fence_ops sw_fence_ops = { + .enable_signaling = sw_enable_signaling, +}; + +/** + * dma_fence_create - Create a simple sw-only fence. + * + * This fence only supports signaling from/to CPU. Other implementations + * of dma-fence can be used to support hardware to hardware signaling, if + * supported by the hardware, and use the dma_fence_helper_* functions for + * compatibility with other devices that only support sw signaling. + */ +struct dma_fence *dma_fence_create(void) +{ + struct dma_fence *fence; + + fence = kzalloc(sizeof(struct dma_fence), GFP_KERNEL); + if (!fence) + return ERR_PTR(-ENOMEM); + + __dma_fence_init(fence, &sw_fence_ops); + + return fence; +} +EXPORT_SYMBOL_GPL(dma_fence_create); diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index eb48f38..ff4ec6c 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -122,6 +122,8 @@ struct dma_buf { /* mutex to serialize list manipulation and attach/detach */ struct mutex lock; void *priv; + /* list of pending dma_fence's */ + struct list_head fence_list; }; /** diff --git a/include/linux/dma-fence.h b/include/linux/dma-fence.h new file mode 100644 index 0000000..336afd2 --- /dev/null +++ b/include/linux/dma-fence.h @@ -0,0 +1,128 @@ +/* + * Fence mechanism for dma-buf to allow for asynchronous dma access + * + * Copyright (C) 2012 Texas Instruments + * Author: Rob Clark <rob.clark(a)linaro.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 as published by + * the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along with + * this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#ifndef __DMA_FENCE_H__ +#define __DMA_FENCE_H__ + +#include <linux/err.h> +#include <linux/list.h> +#include <linux/wait.h> +#include <linux/list.h> +#include <linux/dma-buf.h> + +struct dma_fence; +struct dma_fence_ops; +struct dma_fence_cb; + +struct dma_fence { + struct kref refcount; + struct dma_fence_ops *ops; + wait_queue_head_t event_queue; + struct list_head list_node; /* for dmabuf's fence_list */ + + /* has this fence been attached to a dma-buf yet? */ + bool attached : 1; + + /* has this fence been signaled yet? */ + bool signaled : 1; + + /* do we have one or more waiters or callbacks? */ + bool needs_sw_signal : 1; +}; + +typedef int (*dma_fence_func_t)(struct dma_fence_cb *cb, + struct dma_fence *fence); + +struct dma_fence_cb { + wait_queue_t base; + dma_fence_func_t func; + + /* + * This is initialized when the cb is added, and NULL'd when it + * is canceled or expired, so can be used to for error checking + * if the cb is already pending. A dma_fence_cb can be pending + * on at most one fence at a time. + */ + struct dma_fence *fence; +}; + +struct dma_fence_ops { + /** + * For fence implementations that have the capability for hw->hw + * signaling, they can implement this op to enable the necessary + * irqs, or insert commands into cmdstream, etc. This is called + * in the first wait() or add_callback() path to let the fence + * implementation know that there is another driver waiting on + * the signal (ie. hw->sw case). + * + * A return value of -ENOENT will indicate that the fence has + * already passed. + */ + int (*enable_signaling)(struct dma_fence *fence); +}; + +int __dma_fence_wake_func(wait_queue_t *wait, unsigned mode, + int flags, void *key); + +#define DMA_FENCE_CB_INITIALIZER(cb_func) { \ + .base = { .func = __dma_fence_wake_func }, \ + .func = (cb_func), \ + } + +#define DECLARE_DMA_FENCE(name, cb_func) \ + struct dma_fence_cb name = DMA_FENCE_CB_INITIALIZER(cb_func) + + +/* + * TODO does it make sense to be able to enable dma-fence without dma-buf, + * or visa versa? + */ +#ifdef CONFIG_DMA_SHARED_BUFFER + +int dma_buf_attach_fence(struct dma_buf *buf, struct dma_fence *fence); +struct dma_fence *dma_buf_get_fence(struct dma_buf *buf); + +/* create a basic (pure sw) fence: */ +struct dma_fence *dma_fence_create(void); + +/* intended to be used by other dma_fence implementations: */ +void __dma_fence_init(struct dma_fence *fence, struct dma_fence_ops *ops); + +void dma_fence_get(struct dma_fence *fence); +void dma_fence_put(struct dma_fence *fence); +int dma_fence_signal(struct dma_fence *fence); + +int dma_fence_add_callback(struct dma_fence *fence, + struct dma_fence_cb *cb); +int dma_fence_cancel_callback(struct dma_fence_cb *cb); +int dma_fence_wait(struct dma_fence *fence, bool interruptible, long timeout); + +/* helpers intended to be used by the ops of the dma_fence implementation: */ +int dma_fence_helper_signal(struct dma_fence *fence); +int dma_fence_helper_add_callback(struct dma_fence *fence, + struct dma_fence_cb *cb); +int dma_fence_helper_cancel_callback(struct dma_fence_cb *cb); +int dma_fence_helper_wait(struct dma_fence *fence, bool interruptible, + long timeout); + +#else +// TODO +#endif /* CONFIG_DMA_SHARED_BUFFER */ + +#endif /* __DMA_FENCE_H__ */ -- 1.7.9.5

11 years, 9 months

[PATCH v2] ARM: dma-mapping: modify condition check while freeing pages

by Prathyush K

WARNING: at mm/vmalloc.c:1471 __iommu_free_buffer+0xcc/0xd0() Trying to vfree() nonexistent vm area (ef095000) Modules linked in: [<c0015a18>] (unwind_backtrace+0x0/0xfc) from [<c0025a94>] (warn_slowpath_common+0x54/0x64) [<c0025a94>] (warn_slowpath_common+0x54/0x64) from [<c0025b38>] (warn_slowpath_fmt+0x30/0x40) [<c0025b38>] (warn_slowpath_fmt+0x30/0x40) from [<c0016de0>] (__iommu_free_buffer+0xcc/0xd0) [<c0016de0>] (__iommu_free_buffer+0xcc/0xd0) from [<c0229a5c>] (exynos_drm_free_buf+0xe4/0x138) [<c0229a5c>] (exynos_drm_free_buf+0xe4/0x138) from [<c022b358>] (exynos_drm_gem_destroy+0x80/0xfc) [<c022b358>] (exynos_drm_gem_destroy+0x80/0xfc) from [<c0211230>] (drm_gem_object_free+0x28/0x34) [<c0211230>] (drm_gem_object_free+0x28/0x34) from [<c0211bd0>] (drm_gem_object_release_handle+0xcc/0xd8) [<c0211bd0>] (drm_gem_object_release_handle+0xcc/0xd8) from [<c01abe10>] (idr_for_each+0x74/0xb8) [<c01abe10>] (idr_for_each+0x74/0xb8) from [<c02114e4>] (drm_gem_release+0x1c/0x30) [<c02114e4>] (drm_gem_release+0x1c/0x30) from [<c0210ae8>] (drm_release+0x608/0x694) [<c0210ae8>] (drm_release+0x608/0x694) from [<c00b75a0>] (fput+0xb8/0x228) [<c00b75a0>] (fput+0xb8/0x228) from [<c00b40c4>] (filp_close+0x64/0x84) [<c00b40c4>] (filp_close+0x64/0x84) from [<c0029d54>] (put_files_struct+0xe8/0x104) [<c0029d54>] (put_files_struct+0xe8/0x104) from [<c002b930>] (do_exit+0x608/0x774) [<c002b930>] (do_exit+0x608/0x774) from [<c002bae4>] (do_group_exit+0x48/0xb4) [<c002bae4>] (do_group_exit+0x48/0xb4) from [<c002bb60>] (sys_exit_group+0x10/0x18) [<c002bb60>] (sys_exit_group+0x10/0x18) from [<c000ee80>] (ret_fast_syscall+0x0/0x30) This patch modifies the condition while freeing to match the condition used while allocation. This fixes the above warning which arises when array size is equal to PAGE_SIZE where allocation is done using kzalloc but free is done using vfree. Signed-off-by: Prathyush K <prathyush.k(a)samsung.com> --- arch/arm/mm/dma-mapping.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c index dc560dc..0f9358b 100644 --- a/arch/arm/mm/dma-mapping.c +++ b/arch/arm/mm/dma-mapping.c @@ -1091,7 +1091,7 @@ error: while (--i) if (pages[i]) __free_pages(pages[i], 0); - if (array_size < PAGE_SIZE) + if (array_size <= PAGE_SIZE) kfree(pages); else vfree(pages); @@ -1106,7 +1106,7 @@ static int __iommu_free_buffer(struct device *dev, struct page **pages, size_t s for (i = 0; i < count; i++) if (pages[i]) __free_pages(pages[i], 0); - if (array_size < PAGE_SIZE) + if (array_size <= PAGE_SIZE) kfree(pages); else vfree(pages); -- 1.7.0.4

11 years, 9 months

Re: [Linaro-mm-sig] [RFC] dma-fence: dma-buf synchronization (v2)

by Rob Clark

On Fri, Jul 13, 2012 at 12:35 PM, Tom Cooksey <tom.cooksey(a)arm.com> wrote: > My other thought is around atomicity. Could this be extended to > (safely) allow for hardware devices which might want to access > multiple buffers simultaneously? I think it probably can with > some tweaks to the interface? An atomic function which does > something like "give me all the fences for all these buffers > and add this fence to each instead/as-well-as"? fwiw, what I'm leaning towards right now is combining dma-fence w/ Maarten's idea of dma-buf-mgr (not sure if you saw his patches?). And let dmabufmgr handle the multi-buffer reservation stuff. And possibly the read vs write access, although this I'm not 100% sure on... the other option being the concept of read vs write (or exclusive/non-exclusive) fences. In the current state, the fence is quite simple, and doesn't care *what* it is fencing, which seems advantageous when you get into trying to deal with combinations of devices sharing buffers, some of whom can do hw sync, and some who can't. So having a bit of partitioning from the code dealing w/ sequencing who can access the buffers when and for what purpose seems like it might not be a bad idea. Although I'm still working through the different alternatives. BR, -R

11 years, 9 months

[PATCH] dma-fence: dma-buf synchronization

by Rob Clark

From: Rob Clark <rob(a)ti.com> A dma-fence can be attached to a buffer which is being filled or consumed by hw, to allow userspace to pass the buffer without waiting to another device. For example, userspace can call page_flip ioctl to display the next frame of graphics after kicking the GPU but while the GPU is still rendering. The display device sharing the buffer with the GPU would attach a callback to get notified when the GPU's rendering-complete IRQ fires, to update the scan-out address of the display, without having to wake up userspace. A dma-fence is transient, one-shot deal. It is allocated and attached to dma-buf's list of fences. When the one that attached it is done, with the pending operation, it can signal the fence removing it from the dma-buf's list of fences: + dma_buf_attach_fence() + dma_fence_signal() Other drivers can access the current fence on the dma-buf (if any), which increment's the fences refcnt: + dma_buf_get_fence() + dma_fence_put() The one pending on the fence can add an async callback (and optionally cancel it.. for example, to recover from GPU hangs): + dma_fence_add_callback() + dma_fence_cancel_callback() Or wait synchronously (optionally with timeout or from atomic context): + dma_fence_wait() A default software-only implementation is provided, which can be used by drivers attaching a fence to a buffer when they have no other means for hw sync. But a memory backed fence is also envisioned, because it is common that GPU's can write to, or poll on some memory location for synchronization. For example: fence = dma_buf_get_fence(dmabuf); if (fence->ops == &mem_dma_fence_ops) { dma_buf *fence_buf; mem_dma_fence_get_buf(fence, &fence_buf, &offset); ... tell the hw the memory location to wait on ... } else { /* fall-back to sw sync * / dma_fence_add_callback(fence, my_cb); } The memory location is itself backed by dma-buf, to simplify mapping to the device's address space, an idea borrowed from Maarten Lankhorst. NOTE: the memory location fence is not implemented yet, the above is just for explaining how it would work. On SoC platforms, if some other hw mechanism is provided for synchronizing between IP blocks, it could be supported as an alternate implementation with it's own fence ops in a similar way. The other non-sw implementations would wrap the add/cancel_callback and wait fence ops, so that they can keep track if a device not supporting hw sync is waiting on the fence, and in this case should arrange to call dma_fence_signal() at some point after the condition has changed, to notify other devices waiting on the fence. If there are no sw waiters, this can be skipped to avoid waking the CPU unnecessarily. The intention is to provide a userspace interface (presumably via eventfd) later, to be used in conjunction with dma-buf's mmap support for sw access to buffers (or for userspace apps that would prefer to do their own synchronization). --- drivers/base/Makefile | 2 +- drivers/base/dma-buf.c | 3 + drivers/base/dma-fence.c | 325 +++++++++++++++++++++++++++++++++++++++++++++ include/linux/dma-buf.h | 3 + include/linux/dma-fence.h | 118 ++++++++++++++++ 5 files changed, 450 insertions(+), 1 deletion(-) create mode 100644 drivers/base/dma-fence.c create mode 100644 include/linux/dma-fence.h diff --git a/drivers/base/Makefile b/drivers/base/Makefile index 5aa2d70..6e9f217 100644 --- a/drivers/base/Makefile +++ b/drivers/base/Makefile @@ -10,7 +10,7 @@ obj-$(CONFIG_CMA) += dma-contiguous.o obj-y += power/ obj-$(CONFIG_HAS_DMA) += dma-mapping.o obj-$(CONFIG_HAVE_GENERIC_DMA_COHERENT) += dma-coherent.o -obj-$(CONFIG_DMA_SHARED_BUFFER) += dma-buf.o +obj-$(CONFIG_DMA_SHARED_BUFFER) += dma-buf.o dma-fence.o obj-$(CONFIG_ISA) += isa.o obj-$(CONFIG_FW_LOADER) += firmware_class.o obj-$(CONFIG_NUMA) += node.o diff --git a/drivers/base/dma-buf.c b/drivers/base/dma-buf.c index 24e88fe..b053236 100644 --- a/drivers/base/dma-buf.c +++ b/drivers/base/dma-buf.c @@ -39,6 +39,8 @@ static int dma_buf_release(struct inode *inode, struct file *file) dmabuf = file->private_data; + WARN_ON(!list_empty(&dmabuf->fence_list)); + dmabuf->ops->release(dmabuf); kfree(dmabuf); return 0; @@ -119,6 +121,7 @@ struct dma_buf *dma_buf_export(void *priv, const struct dma_buf_ops *ops, mutex_init(&dmabuf->lock); INIT_LIST_HEAD(&dmabuf->attachments); + INIT_LIST_HEAD(&dmabuf->fence_list); return dmabuf; } diff --git a/drivers/base/dma-fence.c b/drivers/base/dma-fence.c new file mode 100644 index 0000000..a94ed01 --- /dev/null +++ b/drivers/base/dma-fence.c @@ -0,0 +1,325 @@ +/* + * Fence mechanism for dma-buf to allow for asynchronous dma access + * + * Copyright (C) 2012 Texas Instruments + * Author: Rob Clark <rob.clark(a)linaro.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 as published by + * the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along with + * this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#include <linux/slab.h> +#include <linux/sched.h> +#include <linux/export.h> +#include <linux/dma-fence.h> + +static DEFINE_SPINLOCK(fence_lock); + +/** + * dma_buf_attach_fence - Attach a fence to a dma-buf. + * + * @buf: the dma-buf to attach to + * @fence: the fence to attach + * + * A fence can only be attached to a single dma-buf. The dma-buf takes + * ownership of the fence, which is unref'd when the fence is signaled. + * The fence takes a reference to the dma-buf so the buffer will not be + * freed while there is a pending fence. + */ +int dma_buf_attach_fence(struct dma_buf *buf, struct dma_fence *fence) +{ + if (WARN_ON(!buf || !fence || fence->buf)) + return -EINVAL; + + spin_lock(&fence_lock); + get_dma_buf(buf); + fence->buf = buf; + list_add(&fence->list_node, &buf->fence_list); + spin_unlock(&fence_lock); + + return 0; +} +EXPORT_SYMBOL_GPL(dma_buf_attach_fence); + +/** + * dma_fence_signal - Signal a fence. + * + * @fence: The fence to signal + * + * All registered callbacks will be called directly (synchronously) and + * all blocked waters will be awoken. + */ +int dma_fence_signal(struct dma_fence *fence) +{ + unsigned long flags; + int ret; + + if (WARN_ON(!fence || !fence->buf)) + return -EINVAL; + + spin_lock_irqsave(&fence_lock, flags); + list_del(&fence->list_node); + spin_unlock_irqrestore(&fence_lock, flags); + + dma_buf_put(fence->buf); + fence->buf = NULL; + + ret = fence->ops->signal(fence); + + dma_fence_put(fence); + + return ret; +} +EXPORT_SYMBOL_GPL(dma_fence_signal); + +/** + * dma_buf_get_fence - Get the most recent pending fence attached to the + * dma-buf. + * + * @buf: the dma-buf whose fence to get + * + * If this returns NULL, there are no pending fences. Otherwise this + * takes a reference to the returned fence, so the caller must later + * call dma_fence_put() to release the reference. + */ +struct dma_fence *dma_buf_get_fence(struct dma_buf *buf) +{ + struct dma_fence *fence = NULL; + + if (WARN_ON(!buf)) + return ERR_PTR(-EINVAL); + + spin_lock(&fence_lock); + if (!list_empty(&buf->fence_list)) { + fence = list_first_entry(&buf->fence_list, + struct dma_fence, list_node); + dma_fence_get(fence); + } + spin_unlock(&fence_lock); + + return fence; +} +EXPORT_SYMBOL_GPL(dma_buf_get_fence); + +static void release_fence(struct kref *kref) +{ + struct dma_fence *fence = + container_of(kref, struct dma_fence, refcount); + + WARN_ON(waitqueue_active(&fence->event_queue) || fence->buf); + + kfree(fence); +} + +/** + * dma_fence_put - Release a reference to the fence. + */ +void dma_fence_put(struct dma_fence *fence) +{ + WARN_ON(!fence); + kref_put(&fence->refcount, release_fence); +} +EXPORT_SYMBOL_GPL(dma_fence_put); + +/** + * dma_fence_get - Take a reference to the fence. + * + * In most cases this is used only internally by dma-fence. + */ +void dma_fence_get(struct dma_fence *fence) +{ + WARN_ON(!fence); + kref_get(&fence->refcount); +} +EXPORT_SYMBOL_GPL(dma_fence_get); + +/** + * dma_fence_add_callback - Add a callback to be called when the fence + * is signaled. + * + * @fence: The fence to wait on + * @cb: The callback to register + * + * Any number of callbacks can be registered to a fence, but a callback + * can only be registered to once fence at a time. + * + * Note that the callback can be called from an atomic context. If + * fence is already signaled, this function will return -EINVAL (and + * *not* call the callback) + */ +int dma_fence_add_callback(struct dma_fence *fence, + struct dma_fence_cb *cb) +{ + int ret = -EINVAL; + + if (WARN_ON(!fence || !cb)) + return -EINVAL; + + spin_lock(&fence_lock); + if (fence->buf) { + dma_fence_get(fence); + cb->fence = fence; + ret = fence->ops->add_callback(fence, cb); + } + spin_unlock(&fence_lock); + + return ret; +} +EXPORT_SYMBOL_GPL(dma_fence_add_callback); + +/** + * dma_fence_cancel_callback - Remove a previously registered callback. + * + * @cb: The callback to unregister + * + * The callback will not be called after this function returns, but could + * be called before this function returns. + */ +int dma_fence_cancel_callback(struct dma_fence_cb *cb) +{ + struct dma_fence *fence; + int ret = -EINVAL; + + if (WARN_ON(!cb)) + return -EINVAL; + + fence = cb->fence; + + spin_lock(&fence_lock); + if (fence) { + ret = fence->ops->cancel_callback(cb); + cb->fence = NULL; + dma_fence_put(fence); + } + spin_unlock(&fence_lock); + + return ret; +} +EXPORT_SYMBOL_GPL(dma_fence_cancel_callback); + +/** + * dma_fence_wait - Wait for a fence to be signaled. + * + * @fence: The fence to wait on + * @interruptible: if true, do an interruptible wait + * @timeout: timeout, in jiffies + */ +int dma_fence_wait(struct dma_fence *fence, bool interruptible, long timeout) +{ + if (WARN_ON(!fence)) + return -EINVAL; + + return fence->ops->wait(fence, interruptible, timeout); +} +EXPORT_SYMBOL_GPL(dma_fence_wait); + +int __dma_fence_wake_func(wait_queue_t *wait, unsigned mode, + int flags, void *key) +{ + struct dma_fence_cb *cb = + container_of(wait, struct dma_fence_cb, base); + int ret; + + ret = cb->func(cb, cb->fence); + dma_fence_put(cb->fence); + cb->fence = NULL; + + return ret; +} +EXPORT_SYMBOL_GPL(__dma_fence_wake_func); + +/* + * Helpers intended to be used by the ops of the dma_fence implementation: + * + * NOTE: helpers and fxns intended to be used by other dma-fence + * implementations are not exported.. I'm not really sure if it makes + * sense to have a dma-fence implementation that is itself a module. + */ + +void __dma_fence_init(struct dma_fence *fence, struct dma_fence_ops *ops) +{ + WARN_ON(!ops || !ops->signal || !ops->add_callback || + !ops->cancel_callback || !ops->wait); + + kref_init(&fence->refcount); + fence->ops = ops; + init_waitqueue_head(&fence->event_queue); +} + +int dma_fence_helper_signal(struct dma_fence *fence) +{ + wake_up_all(&fence->event_queue); + return 0; +} + +int dma_fence_helper_add_callback(struct dma_fence *fence, + struct dma_fence_cb *cb) +{ + add_wait_queue(&fence->event_queue, &cb->base); + return 0; +} + +int dma_fence_helper_cancel_callback(struct dma_fence_cb *cb) +{ + struct dma_fence *fence = cb->fence; + remove_wait_queue(&fence->event_queue, &cb->base); + return 0; +} + +int dma_fence_helper_wait(struct dma_fence *fence, bool interruptible, + long timeout) +{ + int ret; + + if (interruptible) { + ret = wait_event_interruptible_timeout(fence->event_queue, + !fence->buf, timeout); + } else { + ret = wait_event_timeout(fence->event_queue, + !fence->buf, timeout); + } + + return ret; +} + +/* + * Pure sw implementation for dma-fence. The CPU always gets involved. + */ + +static struct dma_fence_ops sw_fence_ops = { + .signal = dma_fence_helper_signal, + .add_callback = dma_fence_helper_add_callback, + .cancel_callback = dma_fence_helper_cancel_callback, + .wait = dma_fence_helper_wait, +}; + +/** + * dma_fence_create - Create a simple sw-only fence. + * + * This fence only supports signaling from/to CPU. Other implementations + * of dma-fence can be used to support hardware to hardware signaling, if + * supported by the hardware, and use the dma_fence_helper_* functions for + * compatibility with other devices that only support sw signaling. + */ +struct dma_fence *dma_fence_create(void) +{ + struct dma_fence *fence; + + fence = kzalloc(sizeof(struct dma_fence), GFP_KERNEL); + if (!fence) + return ERR_PTR(-ENOMEM); + + __dma_fence_init(fence, &sw_fence_ops); + + return fence; +} +EXPORT_SYMBOL_GPL(dma_fence_create); diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index eb48f38..a0a0b64 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -29,6 +29,7 @@ #include <linux/scatterlist.h> #include <linux/list.h> #include <linux/dma-mapping.h> +#include <linux/dma-fence.h> #include <linux/fs.h> struct device; @@ -122,6 +123,8 @@ struct dma_buf { /* mutex to serialize list manipulation and attach/detach */ struct mutex lock; void *priv; + /* list of pending dma_fence's */ + struct list_head fence_list; }; /** diff --git a/include/linux/dma-fence.h b/include/linux/dma-fence.h new file mode 100644 index 0000000..ecda334 --- /dev/null +++ b/include/linux/dma-fence.h @@ -0,0 +1,118 @@ +/* + * Fence mechanism for dma-buf to allow for asynchronous dma access + * + * Copyright (C) 2012 Texas Instruments + * Author: Rob Clark <rob.clark(a)linaro.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 as published by + * the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along with + * this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#ifndef __DMA_FENCE_H__ +#define __DMA_FENCE_H__ + +#include <linux/err.h> +#include <linux/list.h> +#include <linux/wait.h> +#include <linux/list.h> +#include <linux/dma-buf.h> + +struct dma_fence; +struct dma_fence_ops; +struct dma_fence_cb; + +struct dma_fence { + struct kref refcount; + struct dma_fence_ops *ops; + wait_queue_head_t event_queue; + struct list_head list_node; /* for dmabuf's fence_list */ + + /* + * This is initialized when the fence is attached to a dma-buf, + * and NULL'd before it is signaled. A fence can be attached to + * at most one dma-buf at a time. + */ + struct dma_buf *buf; +}; + +typedef int (*dma_fence_func_t)(struct dma_fence_cb *cb, + struct dma_fence *fence); + +struct dma_fence_ops { + int (*signal)(struct dma_fence *fence); + int (*add_callback)(struct dma_fence *fence, struct dma_fence_cb *cb); + int (*cancel_callback)(struct dma_fence_cb *cb); + int (*wait)(struct dma_fence *fence, bool interruptible, long timeout); +}; + +struct dma_fence_cb { + wait_queue_t base; + dma_fence_func_t func; + + /* + * This is initialized when the cb is added, and NULL'd when it + * is canceled or expired, so can be used to for error checking + * if the cb is already pending. A dma_fence_cb can be pending + * on at most one fence at a time. + */ + struct dma_fence *fence; +}; + +int __dma_fence_wake_func(wait_queue_t *wait, unsigned mode, + int flags, void *key); + +#define DMA_FENCE_CB_INITIALIZER(cb_func) { \ + .base = { .func = __dma_fence_wake_func }, \ + .func = (cb_func), \ + } + +#define DECLARE_DMA_FENCE(name, cb_func) \ + struct dma_fence_cb name = DMA_FENCE_CB_INITIALIZER(cb_func) + + +/* + * TODO does it make sense to be able to enable dma-fence without dma-buf, + * or visa versa? + */ +#ifdef CONFIG_DMA_SHARED_BUFFER + +int dma_buf_attach_fence(struct dma_buf *buf, struct dma_fence *fence); +struct dma_fence *dma_buf_get_fence(struct dma_buf *buf); + +/* create a basic (pure sw) fence: */ +struct dma_fence *dma_fence_create(void); + +/* intended to be used by other dma_fence implementations: */ +void __dma_fence_init(struct dma_fence *fence, struct dma_fence_ops *ops); + +void dma_fence_get(struct dma_fence *fence); +void dma_fence_put(struct dma_fence *fence); +int dma_fence_signal(struct dma_fence *fence); + +int dma_fence_add_callback(struct dma_fence *fence, + struct dma_fence_cb *cb); +int dma_fence_cancel_callback(struct dma_fence_cb *cb); +int dma_fence_wait(struct dma_fence *fence, bool interruptible, long timeout); + +/* helpers intended to be used by the ops of the dma_fence implementation: */ +int dma_fence_helper_signal(struct dma_fence *fence); +int dma_fence_helper_add_callback(struct dma_fence *fence, + struct dma_fence_cb *cb); +int dma_fence_helper_cancel_callback(struct dma_fence_cb *cb); +int dma_fence_helper_wait(struct dma_fence *fence, bool interruptible, + long timeout); + +#else +// TODO +#endif /* CONFIG_DMA_SHARED_BUFFER */ + +#endif /* __DMA_FENCE_H__ */ -- 1.7.9.5

11 years, 10 months

[RFC PATCH 0/8] Dmabuf synchronization

by Maarten Lankhorst

This patch implements my attempt at dmabuf synchronization. The core idea is that a lot of devices will have their own methods of synchronization, but more complicated devices allow some way of fencing, so why not export those as dma-buf? This patchset implements dmabufmgr, which is based on ttm's code. The ttm code deals with a lot more than just reservation however, I took out almost all the code not dealing with reservations. I used the drm-intel-next-queued tree as base. It contains some i915 flushing changes. I would rather use linux-next, but the deferred fput code makes my system unbootable. That is unfortunate since it would reduce the deadlocks happening in dma_buf_put when 2 devices release each other's dmabuf. The i915 changes implement a simple cpu wait only, the nouveau code imports the sync dmabuf read-only and maps it to affected channels, then performs a wait on it in hardware. Since the hardware may still be processing other commands, it could be the case that no hardware wait would have to be performed at all. Only the nouveau nv84 code is tested, but the nvc0 code should work as well.

11 years, 10 months

[PATCH] ARM: dma-mapping: modify condition check while freeing pages

by Prathyush K

WARNING: at mm/vmalloc.c:1471 __iommu_free_buffer+0xcc/0xd0() Trying to vfree() nonexistent vm area (ef095000) Modules linked in: [<c0015a18>] (unwind_backtrace+0x0/0xfc) from [<c0025a94>] (warn_slowpath_common+0x54/0x64) [<c0025a94>] (warn_slowpath_common+0x54/0x64) from [<c0025b38>] (warn_slowpath_fmt+0x30/0x40) [<c0025b38>] (warn_slowpath_fmt+0x30/0x40) from [<c0016de0>] (__iommu_free_buffer+0xcc/0xd0) [<c0016de0>] (__iommu_free_buffer+0xcc/0xd0) from [<c0229a5c>] (exynos_drm_free_buf+0xe4/0x138) [<c0229a5c>] (exynos_drm_free_buf+0xe4/0x138) from [<c022b358>] (exynos_drm_gem_destroy+0x80/0xfc) [<c022b358>] (exynos_drm_gem_destroy+0x80/0xfc) from [<c0211230>] (drm_gem_object_free+0x28/0x34) [<c0211230>] (drm_gem_object_free+0x28/0x34) from [<c0211bd0>] (drm_gem_object_release_handle+0xcc/0xd8) [<c0211bd0>] (drm_gem_object_release_handle+0xcc/0xd8) from [<c01abe10>] (idr_for_each+0x74/0xb8) [<c01abe10>] (idr_for_each+0x74/0xb8) from [<c02114e4>] (drm_gem_release+0x1c/0x30) [<c02114e4>] (drm_gem_release+0x1c/0x30) from [<c0210ae8>] (drm_release+0x608/0x694) [<c0210ae8>] (drm_release+0x608/0x694) from [<c00b75a0>] (fput+0xb8/0x228) [<c00b75a0>] (fput+0xb8/0x228) from [<c00b40c4>] (filp_close+0x64/0x84) [<c00b40c4>] (filp_close+0x64/0x84) from [<c0029d54>] (put_files_struct+0xe8/0x104) [<c0029d54>] (put_files_struct+0xe8/0x104) from [<c002b930>] (do_exit+0x608/0x774) [<c002b930>] (do_exit+0x608/0x774) from [<c002bae4>] (do_group_exit+0x48/0xb4) [<c002bae4>] (do_group_exit+0x48/0xb4) from [<c002bb60>] (sys_exit_group+0x10/0x18) [<c002bb60>] (sys_exit_group+0x10/0x18) from [<c000ee80>] (ret_fast_syscall+0x0/0x30) This patch modifies the condition while freeing to match the condition used while allocation. This fixes the above warning which arises when array size is equal to PAGE_SIZE where allocation is done using kzalloc but free is done using vfree. Signed-off-by: Prathyush K <prathyush.k(a)samsung.com> --- arch/arm/mm/dma-mapping.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c index dc560dc..62fefac 100644 --- a/arch/arm/mm/dma-mapping.c +++ b/arch/arm/mm/dma-mapping.c @@ -1106,7 +1106,7 @@ static int __iommu_free_buffer(struct device *dev, struct page **pages, size_t s for (i = 0; i < count; i++) if (pages[i]) __free_pages(pages[i], 0); - if (array_size < PAGE_SIZE) + if (array_size <= PAGE_SIZE) kfree(pages); else vfree(pages); -- 1.7.0.4

11 years, 10 months

Bad use of highmem with buffer_migrate_page?

by Laura Abbott

Hi, I did a backport of the Contiguous Memory Allocator to a 3.0.8 tree. I wrote fairly simple test case that, in 1MB chunks, allocs up to 40MB from a reserved area, maps, writes, unmaps and then frees in an infinite loop. When running this with another program in parallel to put some stress on the filesystem, I hit data aborts in the filesystem/journal layer, although not always the same backtrace. As an example: [<c02907a4>] (__ext4_check_dir_entry+0x20/0x184) from [<c029e1a8>] (add_dirent_to_buf+0x70/0x2ac) [<c029e1a8>] (add_dirent_to_buf+0x70/0x2ac) from [<c029f3f0>] (ext4_add_entry+0xd8/0x4bc) [<c029f3f0>] (ext4_add_entry+0xd8/0x4bc) from [<c029fe90>] (ext4_add_nondir+0x14/0x64) [<c029fe90>] (ext4_add_nondir+0x14/0x64) from [<c02a04c4>] (ext4_create+0xd8/0x120) [<c02a04c4>] (ext4_create+0xd8/0x120) from [<c022e134>] (vfs_create+0x74/0xa4) [<c022e134>] (vfs_create+0x74/0xa4) from [<c022ed3c>] (do_last+0x588/0x8d4) [<c022ed3c>] (do_last+0x588/0x8d4) from [<c022fe64>] (path_openat+0xc4/0x394) [<c022fe64>] (path_openat+0xc4/0x394) from [<c0230214>] (do_filp_open+0x30/0x7c) [<c0230214>] (do_filp_open+0x30/0x7c) from [<c0220cb4>] (do_sys_open+0xd8/0x174) [<c0220cb4>] (do_sys_open+0xd8/0x174) from [<c0105ea0>] (ret_fast_syscall+0x0/0x30) Every panic had the same issue where a struct buffer_head [1] had a b_data that was unexpectedly NULL. During the course of CMA, buffer_migrate_page could be called to migrate from a CMA page to a new page. buffer_migrate_page calls set_bh_page[2] to set the new page for the buffer_head. If the new page is a highmem page though, the bh->b_data ends up as NULL, which could produce the panics seen above. This seems to indicate that highmem pages are not not appropriate for use as pages to migrate to. The following made the problem go away for me: --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -5753,7 +5753,7 @@ static struct page * __alloc_contig_migrate_alloc(struct page *page, unsigned long private, int **resultp) { - return alloc_page(GFP_HIGHUSER_MOVABLE); + return alloc_page(GFP_USER | __GFP_MOVABLE); } Does this seem like an actual issue or is this an artifact of my backport to 3.0? I'm not familiar enough with the filesystem layer to be able to tell where highmem can actually be used. Thanks, Laura [1] http://lxr.free-electrons.com/source/include/linux/buffer_head.h#L59 [2] http://lxr.free-electrons.com/source/fs/buffer.c?v=3.0#L1441 -- Sent by an employee of the Qualcomm Innovation Center, Inc. The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

11 years, 10 months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig July 2012