Hi Vinod,

Le jeudi 21 décembre 2023 à 20:44 +0530, Vinod Koul a écrit :

On 19-12-23, 18:50, Paul Cercueil wrote:

...

This function can be used to initiate a scatter-gather DMA transfer, where the address and size of each segment is located in one entry of the dma_vec array.

The major difference with dmaengine_prep_slave_sg() is that it supports specifying the lengths of each DMA transfer; as trying to override the length of the transfer with dmaengine_prep_slave_sg() is a very tedious process. The introduction of a new API function is also justified by the fact that scatterlists are on their way out.

Note that dmaengine_prep_interleaved_dma() is not helpful either in that case, as it assumes that the address of each segment will be higher than the one of the previous segment, which we just cannot guarantee in case of a scatter-gather transfer.

Signed-off-by: Paul Cercueil paul@crapouillou.net

---

v3: New patch

v5: Replace with function dmaengine_prep_slave_dma_vec(), and struct     'dma_vec'.     Note that at some point we will need to support cyclic transfers     using dmaengine_prep_slave_dma_vec(). Maybe with a new "flags"     parameter to the function?

---

include/linux/dmaengine.h | 25 +++++++++++++++++++++++++  1 file changed, 25 insertions(+)

diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h index 3df70d6131c8..ee5931ddb42f 100644 --- a/include/linux/dmaengine.h +++ b/include/linux/dmaengine.h @@ -160,6 +160,16 @@ struct dma_interleaved_template {   struct data_chunk sgl[];  };   +/**

• • struct dma_vec - DMA vector
• • @addr: Bus address of the start of the vector
• • @len: Length in bytes of the DMA vector
• */

+struct dma_vec {

• dma_addr_t addr;
• size_t len;

+};

so you want to transfer multiple buffers, right? why not use dmaengine_prep_slave_sg(). If there is reason for not using that one?

Well I think I answer that in the commit message, don't I?

Furthermore I missed replying to your email earlier on use of dmaengine_prep_interleaved_dma(), my apologies. That can be made to work for you as well. Please see the notes where icg can be ignored and it does not need icg value to be set

Infact, interleaved api can be made to work in most of these cases I can think of...

So if I want to transfer 16 bytes from 0x10, then 16 bytes from 0x0, then 16 bytes from 0x20, how should I configure the dma_interleaved_template?

Cheers, -Paul

...

/**   * enum dma_ctrl_flags - DMA flags to augment operation preparation,   *  control completion, and communicate status. @@ -910,6 +920,10 @@ struct dma_device {   struct dma_async_tx_descriptor *(*device_prep_dma_interrupt)(   struct dma_chan *chan, unsigned long flags);

• struct dma_async_tx_descriptor

*(*device_prep_slave_dma_vec)(

• struct dma_chan *chan, const struct dma_vec *vecs,
  

• size_t nents, enum dma_transfer_direction
  

direction,

• unsigned long flags);
  

struct dma_async_tx_descriptor *(*device_prep_slave_sg)(   struct dma_chan *chan, struct scatterlist *sgl,   unsigned int sg_len, enum dma_transfer_direction direction, @@ -972,6 +986,17 @@ static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_single(     dir, flags, NULL);  }   +static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_dma_vec(

• struct dma_chan *chan, const struct dma_vec *vecs, size_t

nents,

• enum dma_transfer_direction dir, unsigned long flags)

+{

• if (!chan || !chan->device || !chan->device-

...

device_prep_slave_dma_vec)

• return NULL;
  

• return chan->device->device_prep_slave_dma_vec(chan, vecs,

nents,

• 				       dir,
  

flags); +}

static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_sg(   struct dma_chan *chan, struct scatterlist *sgl, unsigned int sg_len,   enum dma_transfer_direction dir, unsigned long flags) -- 2.43.0

Hi Paul,

On 08-01-24, 13:20, Paul Cercueil wrote:

Hi Vinod,

Le jeudi 21 décembre 2023 à 20:44 +0530, Vinod Koul a écrit :

...

On 19-12-23, 18:50, Paul Cercueil wrote:

...

This function can be used to initiate a scatter-gather DMA transfer, where the address and size of each segment is located in one entry of the dma_vec array.

The major difference with dmaengine_prep_slave_sg() is that it supports specifying the lengths of each DMA transfer; as trying to override the length of the transfer with dmaengine_prep_slave_sg() is a very tedious process. The introduction of a new API function is also justified by the fact that scatterlists are on their way out.

Note that dmaengine_prep_interleaved_dma() is not helpful either in that case, as it assumes that the address of each segment will be higher than the one of the previous segment, which we just cannot guarantee in case of a scatter-gather transfer.

Signed-off-by: Paul Cercueil paul@crapouillou.net

---

v3: New patch

v5: Replace with function dmaengine_prep_slave_dma_vec(), and struct     'dma_vec'.     Note that at some point we will need to support cyclic transfers     using dmaengine_prep_slave_dma_vec(). Maybe with a new "flags"     parameter to the function?

---

include/linux/dmaengine.h | 25 +++++++++++++++++++++++++  1 file changed, 25 insertions(+)

diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h index 3df70d6131c8..ee5931ddb42f 100644 --- a/include/linux/dmaengine.h +++ b/include/linux/dmaengine.h @@ -160,6 +160,16 @@ struct dma_interleaved_template {   struct data_chunk sgl[];  };   +/**

• • struct dma_vec - DMA vector
• • @addr: Bus address of the start of the vector
• • @len: Length in bytes of the DMA vector
• */

+struct dma_vec {

• dma_addr_t addr;
• size_t len;

+};

I don't want to be pushy, but I'd like to know how to solve this now, otherwise I'll just send the same patches for my v6.

...

so you want to transfer multiple buffers, right? why not use dmaengine_prep_slave_sg(). If there is reason for not using that one?

The reason is that we want to have the possibility to transfer less than the total size of the scatterlist, and that's currently very hard to do - scatterlists were designed to not be tampered with.

Christian König then suggested to introduce a "dma_vec" which had been on his TODO list for a while now.

Yeah for this interleaved seems overkill. Lets go with this api. I would suggest change the name of the API replacing slave with peripheral though

On Tue, Dec 19, 2023 at 06:50:06PM +0100, Paul Cercueil wrote:

Add the necessary infrastructure to the IIO core to support a new optional DMABUF based interface.

With this new interface, DMABUF objects (externally created) can be attached to a IIO buffer, and subsequently used for data transfer.

A userspace application can then use this interface to share DMABUF objects between several interfaces, allowing it to transfer data in a zero-copy fashion, for instance between IIO and the USB stack.

The userspace application can also memory-map the DMABUF objects, and access the sample data directly. The advantage of doing this vs. the read() interface is that it avoids an extra copy of the data between the kernel and userspace. This is particularly userful for high-speed devices which produce several megabytes or even gigabytes of data per second.

As part of the interface, 3 new IOCTLs have been added:

IIO_BUFFER_DMABUF_ATTACH_IOCTL(int fd): Attach the DMABUF object identified by the given file descriptor to the buffer.

IIO_BUFFER_DMABUF_DETACH_IOCTL(int fd): Detach the DMABUF object identified by the given file descriptor from the buffer. Note that closing the IIO buffer's file descriptor will automatically detach all previously attached DMABUF objects.

IIO_BUFFER_DMABUF_ENQUEUE_IOCTL(struct iio_dmabuf *): Request a data transfer to/from the given DMABUF object. Its file descriptor, as well as the transfer size and flags are provided in the "iio_dmabuf" structure.

These three IOCTLs have to be performed on the IIO buffer's file descriptor, obtained using the IIO_BUFFER_GET_FD_IOCTL() ioctl.

Signed-off-by: Paul Cercueil paul@crapouillou.net

---

v2: Only allow the new IOCTLs on the buffer FD created with IIO_BUFFER_GET_FD_IOCTL().

v3: - Get rid of the old IOCTLs. The IIO subsystem does not create or manage DMABUFs anymore, and only attaches/detaches externally created DMABUFs. - Add IIO_BUFFER_DMABUF_CYCLIC to the supported flags.

v5: - Use dev_err() instead of pr_err() - Inline to_iio_dma_fence() - Add comment to explain why we unref twice when detaching dmabuf - Remove TODO comment. It is actually safe to free the file's private data even when transfers are still pending because it won't be accessed. - Fix documentation of new fields in struct iio_buffer_access_funcs - iio_dma_resv_lock() does not need to be exported, make it static

---

drivers/iio/industrialio-buffer.c | 402 ++++++++++++++++++++++++++++++ include/linux/iio/buffer_impl.h | 26 ++ include/uapi/linux/iio/buffer.h | 22 ++ 3 files changed, 450 insertions(+)

diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c index 09c41e9ccf87..24c040e073a7 100644 --- a/drivers/iio/industrialio-buffer.c +++ b/drivers/iio/industrialio-buffer.c @@ -13,10 +13,14 @@ #include <linux/kernel.h> #include <linux/export.h> #include <linux/device.h> +#include <linux/dma-buf.h> +#include <linux/dma-fence.h> +#include <linux/dma-resv.h> #include <linux/file.h> #include <linux/fs.h> #include <linux/cdev.h> #include <linux/slab.h> +#include <linux/mm.h> #include <linux/poll.h> #include <linux/sched/signal.h> @@ -28,6 +32,31 @@ #include <linux/iio/buffer.h> #include <linux/iio/buffer_impl.h> +#define DMABUF_ENQUEUE_TIMEOUT_MS 5000

+struct iio_dma_fence;

+struct iio_dmabuf_priv {

• struct list_head entry;
• struct kref ref;
• struct iio_buffer *buffer;
• struct iio_dma_buffer_block *block;
• u64 context;
• spinlock_t lock;
• struct dma_buf_attachment *attach;
• struct iio_dma_fence *fence;

+};

+struct iio_dma_fence {

• struct dma_fence base;
• struct iio_dmabuf_priv *priv;
• struct sg_table *sgt;
• enum dma_data_direction dir;

+};

static const char * const iio_endian_prefix[] = { [IIO_BE] = "be", [IIO_LE] = "le", @@ -332,6 +361,7 @@ void iio_buffer_init(struct iio_buffer *buffer) { INIT_LIST_HEAD(&buffer->demux_list); INIT_LIST_HEAD(&buffer->buffer_list);

• INIT_LIST_HEAD(&buffer->dmabufs); init_waitqueue_head(&buffer->pollq); kref_init(&buffer->ref); if (!buffer->watermark)

@@ -1519,14 +1549,54 @@ static void iio_buffer_unregister_legacy_sysfs_groups(struct iio_dev *indio_dev) kfree(iio_dev_opaque->legacy_scan_el_group.attrs); } +static void iio_buffer_dmabuf_release(struct kref *ref) +{

• struct iio_dmabuf_priv *priv = container_of(ref, struct iio_dmabuf_priv, ref);
• struct dma_buf_attachment *attach = priv->attach;
• struct iio_buffer *buffer = priv->buffer;
• struct dma_buf *dmabuf = attach->dmabuf;
• buffer->access->detach_dmabuf(buffer, priv->block);
• dma_buf_detach(attach->dmabuf, attach);
• dma_buf_put(dmabuf);
• kfree(priv);

+}

+void iio_buffer_dmabuf_get(struct dma_buf_attachment *attach) +{

• struct iio_dmabuf_priv *priv = attach->importer_priv;
• kref_get(&priv->ref);

+} +EXPORT_SYMBOL_GPL(iio_buffer_dmabuf_get);

+void iio_buffer_dmabuf_put(struct dma_buf_attachment *attach) +{

• struct iio_dmabuf_priv *priv = attach->importer_priv;
• kref_put(&priv->ref, iio_buffer_dmabuf_release);

+} +EXPORT_SYMBOL_GPL(iio_buffer_dmabuf_put);

static int iio_buffer_chrdev_release(struct inode *inode, struct file *filep) { struct iio_dev_buffer_pair *ib = filep->private_data; struct iio_dev *indio_dev = ib->indio_dev; struct iio_buffer *buffer = ib->buffer;

• struct iio_dmabuf_priv *priv, *tmp;

wake_up(&buffer->pollq);

• /* Close all attached DMABUFs */
• list_for_each_entry_safe(priv, tmp, &buffer->dmabufs, entry) {

• list_del_init(&priv->entry);
  

• iio_buffer_dmabuf_put(priv->attach);
  

• }
• if (!list_empty(&buffer->dmabufs))

• dev_warn(&indio_dev->dev, "Buffer FD closed with active transfers\n");
  

• kfree(ib); clear_bit(IIO_BUSY_BIT_POS, &buffer->flags); iio_device_put(indio_dev);

@@ -1534,11 +1604,343 @@ static int iio_buffer_chrdev_release(struct inode *inode, struct file *filep) return 0; } +static int iio_dma_resv_lock(struct dma_buf *dmabuf, bool nonblock) +{

• int ret;
• ret = dma_resv_lock_interruptible(dmabuf->resv, NULL);
• if (ret) {

• if (ret != -EDEADLK)
  

• 	goto out;
  

• if (nonblock) {
  

• 	ret = -EBUSY;
  

• 	goto out;
  

• }
  

• ret = dma_resv_lock_slow_interruptible(dmabuf->resv, NULL);
  

This is overkill, without a reservation context you never get -EDEADLK and so never have to go into the slowpath locking mode. You can check this with the CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y build option.

• }

+out:

• return ret;

+}

+static struct dma_buf_attachment * +iio_buffer_find_attachment(struct iio_dev *indio_dev, struct dma_buf *dmabuf) +{

• struct dma_buf_attachment *elm, *attach = NULL;
• int ret;
• ret = iio_dma_resv_lock(dmabuf, false);
• if (ret)

• return ERR_PTR(ret);
  

• list_for_each_entry(elm, &dmabuf->attachments, node) {

• if (elm->dev == indio_dev->dev.parent) {
  

• 	attach = elm;
  

• 	break;
  

• }
  

• }
• if (attach)

• iio_buffer_dmabuf_get(elm);
  

Same comment as on your usb gagdet support: This must be a kref_get_unless_zero, and I'd really prefer if you use your own list+locking instead of digging around in dma-buf internals in a lifetime-relevant way.

• dma_resv_unlock(dmabuf->resv);
• return attach ?: ERR_PTR(-EPERM);

+}

+static int iio_buffer_attach_dmabuf(struct iio_dev_buffer_pair *ib,

• 		    int __user *user_fd)
  

+{

• struct iio_dev *indio_dev = ib->indio_dev;
• struct iio_buffer *buffer = ib->buffer;
• struct dma_buf_attachment *attach;
• struct iio_dmabuf_priv *priv;
• struct dma_buf *dmabuf;
• int err, fd;
• if (!buffer->access->attach_dmabuf

•    || !buffer->access->detach_dmabuf
  

•    || !buffer->access->enqueue_dmabuf)
  

• return -EPERM;
  

• if (copy_from_user(&fd, user_fd, sizeof(fd)))

• return -EFAULT;
  

• priv = kzalloc(sizeof(*priv), GFP_KERNEL);
• if (!priv)

• return -ENOMEM;
  

• spin_lock_init(&priv->lock);
• priv->context = dma_fence_context_alloc(1);
• dmabuf = dma_buf_get(fd);
• if (IS_ERR(dmabuf)) {

• err = PTR_ERR(dmabuf);
  

• goto err_free_priv;
  

• }
• attach = dma_buf_attach(dmabuf, indio_dev->dev.parent);
• if (IS_ERR(attach)) {

• err = PTR_ERR(attach);
  

• goto err_dmabuf_put;
  

• }
• kref_init(&priv->ref);
• priv->buffer = buffer;
• priv->attach = attach;
• attach->importer_priv = priv;
• priv->block = buffer->access->attach_dmabuf(buffer, attach);
• if (IS_ERR(priv->block)) {

• err = PTR_ERR(priv->block);
  

• goto err_dmabuf_detach;
  

• }
• list_add(&priv->entry, &buffer->dmabufs);

This list seems to have no locking. And I think you want to tie the attach refcount 1:1 to this list, to make sure userspace can't double-detach and hence underrun any refcount here. Would also address my concern with your find_attachment() function.

• return 0;

+err_dmabuf_detach:

• dma_buf_detach(dmabuf, attach);

+err_dmabuf_put:

• dma_buf_put(dmabuf);

+err_free_priv:

• kfree(priv);
• return err;

+}

+static int iio_buffer_detach_dmabuf(struct iio_dev_buffer_pair *ib, int *user_req) +{

• struct dma_buf_attachment *attach;
• struct iio_dmabuf_priv *priv;
• struct dma_buf *dmabuf;
• int dmabuf_fd, ret = 0;
• if (copy_from_user(&dmabuf_fd, user_req, sizeof(dmabuf_fd)))

• return -EFAULT;
  

• dmabuf = dma_buf_get(dmabuf_fd);
• if (IS_ERR(dmabuf))

• return PTR_ERR(dmabuf);
  

• attach = iio_buffer_find_attachment(ib->indio_dev, dmabuf);
• if (IS_ERR(attach)) {

• ret = PTR_ERR(attach);
  

• goto out_dmabuf_put;
  

• }
• priv = attach->importer_priv;
• list_del_init(&priv->entry);
• /*

• * Unref twice to release the reference obtained with
  

• * iio_buffer_find_attachment() above, and the one obtained in
  

• * iio_buffer_attach_dmabuf().
  

• */
  

Again like in the usb gagdet code, this looks like it's exploitable to provoke a refcount underflow by userspace.

• iio_buffer_dmabuf_put(attach);
• iio_buffer_dmabuf_put(attach);

+out_dmabuf_put:

• dma_buf_put(dmabuf);
• return ret;

+}

+static const char * +iio_buffer_dma_fence_get_driver_name(struct dma_fence *fence) +{

• return "iio";

+}

+static void iio_buffer_dma_fence_release(struct dma_fence *fence) +{

• struct iio_dma_fence *iio_fence =

• container_of(fence, struct iio_dma_fence, base);
  

• kfree(iio_fence);

+}

+static const struct dma_fence_ops iio_buffer_dma_fence_ops = {

• .get_driver_name = iio_buffer_dma_fence_get_driver_name,
• .get_timeline_name = iio_buffer_dma_fence_get_driver_name,
• .release = iio_buffer_dma_fence_release,

+};

+static int iio_buffer_enqueue_dmabuf(struct iio_dev_buffer_pair *ib,

• 		     struct iio_dmabuf __user *iio_dmabuf_req,
  

• 		     bool nonblock)
  

+{

• struct iio_dev *indio_dev = ib->indio_dev;
• struct iio_buffer *buffer = ib->buffer;
• struct iio_dmabuf iio_dmabuf;
• struct dma_buf_attachment *attach;
• struct iio_dmabuf_priv *priv;
• enum dma_data_direction dir;
• struct iio_dma_fence *fence;
• struct dma_buf *dmabuf;
• struct sg_table *sgt;
• unsigned long timeout;
• bool dma_to_ram;
• bool cyclic;
• int ret;
• if (copy_from_user(&iio_dmabuf, iio_dmabuf_req, sizeof(iio_dmabuf)))

• return -EFAULT;
  

• if (iio_dmabuf.flags & ~IIO_BUFFER_DMABUF_SUPPORTED_FLAGS)

• return -EINVAL;
  

• cyclic = iio_dmabuf.flags & IIO_BUFFER_DMABUF_CYCLIC;
• /* Cyclic flag is only supported on output buffers */
• if (cyclic && buffer->direction != IIO_BUFFER_DIRECTION_OUT)

• return -EINVAL;
  

• dmabuf = dma_buf_get(iio_dmabuf.fd);
• if (IS_ERR(dmabuf))

• return PTR_ERR(dmabuf);
  

• if (!iio_dmabuf.bytes_used || iio_dmabuf.bytes_used > dmabuf->size) {

• ret = -EINVAL;
  

• goto err_dmabuf_put;
  

• }
• attach = iio_buffer_find_attachment(indio_dev, dmabuf);
• if (IS_ERR(attach)) {

• ret = PTR_ERR(attach);
  

• goto err_dmabuf_put;
  

• }
• priv = attach->importer_priv;
• dma_to_ram = buffer->direction == IIO_BUFFER_DIRECTION_IN;
• dir = dma_to_ram ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
• sgt = dma_buf_map_attachment(attach, dir);
• if (IS_ERR(sgt)) {

• ret = PTR_ERR(sgt);
  

• dev_err(&indio_dev->dev, "Unable to map attachment: %d\n", ret);
  

• goto err_attachment_put;
  

• }
• fence = kmalloc(sizeof(*fence), GFP_KERNEL);
• if (!fence) {

• ret = -ENOMEM;
  

• goto err_unmap_attachment;
  

• }
• fence->priv = priv;
• fence->sgt = sgt;
• fence->dir = dir;
• priv->fence = fence;
• dma_fence_init(&fence->base, &iio_buffer_dma_fence_ops,

•        &priv->lock, priv->context, 0);
  

Same comment as for the usb gadget patch: You need a real seqno here (and iio must then guarantee that all transactions are ordered), or a new unordered dma_fence (meaning a new context for each fence, currently there's no non-hackish way to make that happen).

• ret = iio_dma_resv_lock(dmabuf, nonblock);
• if (ret)

• goto err_fence_put;
  

• timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS);
• /* Make sure we don't have writers */
• ret = (int) dma_resv_wait_timeout(dmabuf->resv, DMA_RESV_USAGE_WRITE,

• 			  true, timeout);
  

• if (ret == 0)

• ret = -EBUSY;
  

• if (ret < 0)

• goto err_resv_unlock;
  

• if (dma_to_ram) {

• /*
  

•  * If we're writing to the DMABUF, make sure we don't have
  

•  * readers
  

•  */
  

• ret = (int) dma_resv_wait_timeout(dmabuf->resv,
  

• 				  DMA_RESV_USAGE_READ, true,
  

• 				  timeout);
  

• if (ret == 0)
  

• 	ret = -EBUSY;
  

• if (ret < 0)
  

• 	goto err_resv_unlock;
  

• }
• ret = dma_resv_reserve_fences(dmabuf->resv, 1);
• if (ret)

• goto err_resv_unlock;
  

• dma_resv_add_fence(dmabuf->resv, &fence->base,

• 	   dma_resv_usage_rw(dma_to_ram));
  

• dma_resv_unlock(dmabuf->resv);

Please add dma_buf_begin/end_signalling annotations here to make sure the locking/memory allocation rules for dma_fence are followed. Same suggestion would also be good in the usb gadget code.

• ret = buffer->access->enqueue_dmabuf(buffer, priv->block, sgt,

• 			     iio_dmabuf.bytes_used, cyclic);
  

• if (ret)

• iio_buffer_signal_dmabuf_done(attach, ret);
  

• dma_buf_put(dmabuf);
• return ret;

+err_resv_unlock:

• dma_resv_unlock(dmabuf->resv);

+err_fence_put:

• dma_fence_put(&fence->base);

+err_unmap_attachment:

• dma_buf_unmap_attachment(attach, sgt, dir);

+err_attachment_put:

• iio_buffer_dmabuf_put(attach);

+err_dmabuf_put:

• dma_buf_put(dmabuf);
• return ret;

+}

+void iio_buffer_signal_dmabuf_done(struct dma_buf_attachment *attach, int ret) +{

• struct iio_dmabuf_priv *priv = attach->importer_priv;
• struct iio_dma_fence *fence = priv->fence;
• enum dma_data_direction dir = fence->dir;
• struct sg_table *sgt = fence->sgt;
• dma_fence_get(&fence->base);
• fence->base.error = ret;
• dma_fence_signal(&fence->base);
• dma_fence_put(&fence->base);
• dma_buf_unmap_attachment(attach, sgt, dir);
• iio_buffer_dmabuf_put(attach);

Like with the usb gadget code I have concerns that you might hold up the entire completion machinery here by taking the wrong locks. You probably want to add dma_fence_begin/end_signalling annotations here, and also split out the final attachment unref with all the refcount unravelling into a preallocated worker.

The other issue is dma_buf_unmap_attachment here. That must be called with dma_resv_lock held, but you can't do that here because this is dma_fence completion code.

Usually drivers cache this stuff, but I guess you could also just put that into your unref worker. The more gnarly issue is that if you need this for cache coherency maintainance, then that should be _before_ the dma_fence_signal(), but currently we don't have a dma_buf function which does only the cache maintenance (which wouldn't need dma_resv_lock) and not also the unmapping.

I think to make sure we don't have a big design issue here we need:

- dma_fence_begin/end_signalling critical section annotations in both iio and usb gadget code, for anything that could potentially hold up the dma_fence_signal at any point after a fence has been installed into the dma_resv object.

- probably dma-api debugging or a platform that needs cache flushes to make sure this works. For gpu dma-buf sharing we pretty much side-step this all by assuming everyone does only write-combined mappings ever, or at least the interconnect fabric is reasonable enough that flushing only around cpu access is enough. This assumption very much does not hold in general, and it's fallen apart enough times even for gpu dma-buf sharing in the past.

Otherwise I think we might end up opening pandoras box here a bit and merge code that works in tech demo mode, but which would need serious amounts of subsystem rework in iio or usb gadget to make it work correctly across the board.

Cheers, Sima

+} +EXPORT_SYMBOL_GPL(iio_buffer_signal_dmabuf_done);

+static long iio_buffer_chrdev_ioctl(struct file *filp,

• 		    unsigned int cmd, unsigned long arg)
  

+{

• struct iio_dev_buffer_pair *ib = filp->private_data;
• void __user *_arg = (void __user *)arg;
• switch (cmd) {
• case IIO_BUFFER_DMABUF_ATTACH_IOCTL:

• return iio_buffer_attach_dmabuf(ib, _arg);
  

• case IIO_BUFFER_DMABUF_DETACH_IOCTL:

• return iio_buffer_detach_dmabuf(ib, _arg);
  

• case IIO_BUFFER_DMABUF_ENQUEUE_IOCTL:

• return iio_buffer_enqueue_dmabuf(ib, _arg,
  

• 				 filp->f_flags & O_NONBLOCK);
  

• default:

• return IIO_IOCTL_UNHANDLED;
  

• }

+}

static const struct file_operations iio_buffer_chrdev_fileops = { .owner = THIS_MODULE, .llseek = noop_llseek, .read = iio_buffer_read, .write = iio_buffer_write,

• .unlocked_ioctl = iio_buffer_chrdev_ioctl,
• .compat_ioctl = compat_ptr_ioctl, .poll = iio_buffer_poll, .release = iio_buffer_chrdev_release,

}; diff --git a/include/linux/iio/buffer_impl.h b/include/linux/iio/buffer_impl.h index 89c3fd7c29ca..55d93705c96b 100644 --- a/include/linux/iio/buffer_impl.h +++ b/include/linux/iio/buffer_impl.h @@ -9,8 +9,11 @@ #include <uapi/linux/iio/buffer.h> #include <linux/iio/buffer.h> +struct dma_buf_attachment; struct iio_dev; +struct iio_dma_buffer_block; struct iio_buffer; +struct sg_table; /**

• INDIO_BUFFER_FLAG_FIXED_WATERMARK - Watermark level of the buffer can not be

@@ -39,6 +42,13 @@ struct iio_buffer;

•                  device stops sampling. Calles are balanced with @enable.
  

• @release: called when the last reference to the buffer is dropped,

• 	should free all resources allocated by the buffer.
  

• • @attach_dmabuf: called from userspace via ioctl to attach one external

• • 	DMABUF.
    

• • @detach_dmabuf: called from userspace via ioctl to detach one previously

• • 	attached DMABUF.
    

• • @enqueue_dmabuf: called from userspace via ioctl to queue this DMABUF

• • 	object to this buffer. Requires a valid DMABUF fd, that
    

• • 	was previouly attached to this buffer.
    

  • @modes: Supported operating modes by this buffer type
  • @flags: A bitmask combination of INDIO_BUFFER_FLAG_*

@@ -68,6 +78,14 @@ struct iio_buffer_access_funcs { void (*release)(struct iio_buffer *buffer);

• struct iio_dma_buffer_block * (*attach_dmabuf)(struct iio_buffer *buffer,

• 				       struct dma_buf_attachment *attach);
  

• void (*detach_dmabuf)(struct iio_buffer *buffer,

• 	      struct iio_dma_buffer_block *block);
  

• int (*enqueue_dmabuf)(struct iio_buffer *buffer,

• 	      struct iio_dma_buffer_block *block,
  

• 	      struct sg_table *sgt, size_t size, bool cyclic);
  

• unsigned int modes; unsigned int flags;

}; @@ -136,6 +154,9 @@ struct iio_buffer { /* @ref: Reference count of the buffer. */ struct kref ref;

• /* @dmabufs: List of DMABUF attachments */
• struct list_head dmabufs;

}; /** @@ -156,9 +177,14 @@ int iio_update_buffers(struct iio_dev *indio_dev, **/ void iio_buffer_init(struct iio_buffer *buffer); +void iio_buffer_dmabuf_get(struct dma_buf_attachment *attach); +void iio_buffer_dmabuf_put(struct dma_buf_attachment *attach);

struct iio_buffer *iio_buffer_get(struct iio_buffer *buffer); void iio_buffer_put(struct iio_buffer *buffer); +void iio_buffer_signal_dmabuf_done(struct dma_buf_attachment *attach, int ret);

#else /* CONFIG_IIO_BUFFER */ static inline void iio_buffer_get(struct iio_buffer *buffer) {} diff --git a/include/uapi/linux/iio/buffer.h b/include/uapi/linux/iio/buffer.h index 13939032b3f6..c666aa95e532 100644 --- a/include/uapi/linux/iio/buffer.h +++ b/include/uapi/linux/iio/buffer.h @@ -5,6 +5,28 @@ #ifndef _UAPI_IIO_BUFFER_H_ #define _UAPI_IIO_BUFFER_H_ +#include <linux/types.h>

+/* Flags for iio_dmabuf.flags */ +#define IIO_BUFFER_DMABUF_CYCLIC (1 << 0) +#define IIO_BUFFER_DMABUF_SUPPORTED_FLAGS 0x00000001

+/**

• • struct iio_dmabuf - Descriptor for a single IIO DMABUF object
• • @fd: file descriptor of the DMABUF object
• • @flags: one or more IIO_BUFFER_DMABUF_* flags
• • @bytes_used: number of bytes used in this DMABUF for the data transfer.

• • Should generally be set to the DMABUF's size.
    

• */

+struct iio_dmabuf {

• __u32 fd;
• __u32 flags;
• __u64 bytes_used;

+};

#define IIO_BUFFER_GET_FD_IOCTL _IOWR('i', 0x91, int) +#define IIO_BUFFER_DMABUF_ATTACH_IOCTL _IOW('i', 0x92, int) +#define IIO_BUFFER_DMABUF_DETACH_IOCTL _IOW('i', 0x93, int) +#define IIO_BUFFER_DMABUF_ENQUEUE_IOCTL _IOW('i', 0x94, struct iio_dmabuf)

#endif /* _UAPI_IIO_BUFFER_H_ */

2.43.0

On Tue, 19 Dec 2023 18:50:07 +0100 Paul Cercueil paul@crapouillou.net wrote:

Implement iio_dma_buffer_attach_dmabuf(), iio_dma_buffer_detach_dmabuf() and iio_dma_buffer_transfer_dmabuf(), which can then be used by the IIO DMA buffer implementations.

Signed-off-by: Paul Cercueil paul@crapouillou.net

Hi Paul,

A few comments in here. Mostly places where the cleanup.h guard() stuff can simplify error paths.

Overall this looks reasonable to me.

Jonathan

---

v3: Update code to provide the functions that will be used as callbacks for the new IOCTLs.

---

drivers/iio/buffer/industrialio-buffer-dma.c | 157 +++++++++++++++++-- include/linux/iio/buffer-dma.h | 26 +++ 2 files changed, 170 insertions(+), 13 deletions(-)

diff --git a/drivers/iio/buffer/industrialio-buffer-dma.c b/drivers/iio/buffer/industrialio-buffer-dma.c index 5610ba67925e..adb64f975064 100644 --- a/drivers/iio/buffer/industrialio-buffer-dma.c +++ b/drivers/iio/buffer/industrialio-buffer-dma.c @@ -14,6 +14,7 @@ #include <linux/poll.h> #include <linux/iio/buffer_impl.h> #include <linux/iio/buffer-dma.h> +#include <linux/dma-buf.h> #include <linux/dma-mapping.h> #include <linux/sizes.h> @@ -94,14 +95,24 @@ static void iio_buffer_block_release(struct kref *kref) { struct iio_dma_buffer_block *block = container_of(kref, struct iio_dma_buffer_block, kref);

• struct iio_dma_buffer_queue *queue = block->queue;

• WARN_ON(block->state != IIO_BLOCK_STATE_DEAD);

• WARN_ON(block->fileio && block->state != IIO_BLOCK_STATE_DEAD);

• dma_free_coherent(block->queue->dev, PAGE_ALIGN(block->size),

• 			block->vaddr, block->phys_addr);
  

• mutex_lock(&queue->lock);

• iio_buffer_put(&block->queue->buffer);

• if (block->fileio) {

• dma_free_coherent(queue->dev, PAGE_ALIGN(block->size),
  

• 		  block->vaddr, block->phys_addr);
  

• queue->num_fileio_blocks--;
  

• }
• queue->num_blocks--; kfree(block);
• mutex_unlock(&queue->lock);
• iio_buffer_put(&queue->buffer);

} static void iio_buffer_block_get(struct iio_dma_buffer_block *block) @@ -163,7 +174,7 @@ static struct iio_dma_buffer_queue *iio_buffer_to_queue(struct iio_buffer *buf) } static struct iio_dma_buffer_block *iio_dma_buffer_alloc_block(

• struct iio_dma_buffer_queue *queue, size_t size)

• struct iio_dma_buffer_queue *queue, size_t size, bool fileio)

{ struct iio_dma_buffer_block *block; @@ -171,13 +182,16 @@ static struct iio_dma_buffer_block *iio_dma_buffer_alloc_block( if (!block) return NULL;

• block->vaddr = dma_alloc_coherent(queue->dev, PAGE_ALIGN(size),

• &block->phys_addr, GFP_KERNEL);
  

• if (!block->vaddr) {

• kfree(block);
  

• return NULL;
  

• if (fileio) {

• block->vaddr = dma_alloc_coherent(queue->dev, PAGE_ALIGN(size),
  

• 				  &block->phys_addr, GFP_KERNEL);
  

• if (!block->vaddr) {
  

• 	kfree(block);
  

• 	return NULL;
  

• }
  

  }

• block->fileio = fileio; block->size = size; block->state = IIO_BLOCK_STATE_DONE; block->queue = queue;

@@ -186,6 +200,9 @@ static struct iio_dma_buffer_block *iio_dma_buffer_alloc_block( iio_buffer_get(&queue->buffer);

• queue->num_blocks++;
• queue->num_fileio_blocks += fileio;

Adding a boolean is non intuitive.

if (fileio) queue->num_fileio_blocks++;

probably easier to read and compiler should be able to figure out how to optimise the condition away.

• return block;

} @@ -211,6 +228,9 @@ void iio_dma_buffer_block_done(struct iio_dma_buffer_block *block) _iio_dma_buffer_block_done(block); spin_unlock_irqrestore(&queue->list_lock, flags);

• if (!block->fileio)

• iio_buffer_signal_dmabuf_done(block->attach, 0);
  

• iio_buffer_block_put_atomic(block); wake_up_interruptible_poll(&queue->buffer.pollq, EPOLLIN | EPOLLRDNORM);

} @@ -237,10 +257,14 @@ void iio_dma_buffer_block_list_abort(struct iio_dma_buffer_queue *queue, list_del(&block->head); block->bytes_used = 0; _iio_dma_buffer_block_done(block);

• if (!block->fileio)
  

• 	iio_buffer_signal_dmabuf_done(block->attach, -EINTR);
  

  iio_buffer_block_put_atomic(block); } spin_unlock_irqrestore(&queue->list_lock, flags);

• queue->fileio.enabled = false;

While this obviously doesn't need to be conditional if it can already be false it might be easier to follow the code flow it if didn't check if we were doing fileio or not before disabling it.

wake_up_interruptible_poll(&queue->buffer.pollq, EPOLLIN | EPOLLRDNORM); } EXPORT_SYMBOL_GPL(iio_dma_buffer_block_list_abort); @@ -261,6 +285,12 @@ static bool iio_dma_block_reusable(struct iio_dma_buffer_block *block) } } +static bool iio_dma_buffer_fileio_mode(struct iio_dma_buffer_queue *queue) +{

• return queue->fileio.enabled ||

• queue->num_blocks == queue->num_fileio_blocks;
  

This is a little odd. So would be good have a comment on why this condition. Or rename the function to imply it's checking if enabled, or can be enabled.

At first glanced I expected a function with this name to just be an accessor function. e.g. return queue->fileio.enabled;

+}

/**

• iio_dma_buffer_request_update() - DMA buffer request_update callback
• @buffer: The buffer which to request an update

@@ -287,6 +317,12 @@ int iio_dma_buffer_request_update(struct iio_buffer *buffer) mutex_lock(&queue->lock);

• queue->fileio.enabled = iio_dma_buffer_fileio_mode(queue);
• /* If DMABUFs were created, disable fileio interface */
• if (!queue->fileio.enabled)

• goto out_unlock;
  

• /* Allocations are page aligned */ if (PAGE_ALIGN(queue->fileio.block_size) == PAGE_ALIGN(size)) try_reuse = true;

@@ -317,7 +353,7 @@ int iio_dma_buffer_request_update(struct iio_buffer *buffer) block = queue->fileio.blocks[i]; if (block->state == IIO_BLOCK_STATE_DEAD) { /* Could not reuse it */

• 		iio_buffer_block_put(block);
  

• 		iio_buffer_block_put_atomic(block);
  	block = NULL;
  } else {
  	block->size = size;
  

@@ -327,7 +363,7 @@ int iio_dma_buffer_request_update(struct iio_buffer *buffer) } if (!block) {

• 	block = iio_dma_buffer_alloc_block(queue, size);
  

• 	block = iio_dma_buffer_alloc_block(queue, size, true);
  if (!block) {
  	ret = -ENOMEM;
  	goto out_unlock;
  

@@ -363,7 +399,7 @@ static void iio_dma_buffer_fileio_free(struct iio_dma_buffer_queue *queue) for (i = 0; i < ARRAY_SIZE(queue->fileio.blocks); i++) { if (!queue->fileio.blocks[i]) continue;

• iio_buffer_block_put(queue->fileio.blocks[i]);
  

• iio_buffer_block_put_atomic(queue->fileio.blocks[i]);
  

For these cases that are atomic or not, it might be worth calling out why they need to be atomic.

queue->fileio.blocks[i] = NULL;

} queue->fileio.active_block = NULL; @@ -384,8 +420,12 @@ static void iio_dma_buffer_submit_block(struct iio_dma_buffer_queue *queue, block->state = IIO_BLOCK_STATE_ACTIVE; iio_buffer_block_get(block);

• ret = queue->ops->submit(queue, block); if (ret) {

• if (!block->fileio)
  

• 	iio_buffer_signal_dmabuf_done(block->attach, ret);
  

• /*
  • This is a bit of a problem and there is not much we can do
  • other then wait for the buffer to be disabled and re-enabled

@@ -588,6 +628,97 @@ size_t iio_dma_buffer_data_available(struct iio_buffer *buf) } EXPORT_SYMBOL_GPL(iio_dma_buffer_data_available); +struct iio_dma_buffer_block * +iio_dma_buffer_attach_dmabuf(struct iio_buffer *buffer,

• 	     struct dma_buf_attachment *attach)
  

+{

• struct iio_dma_buffer_queue *queue = iio_buffer_to_queue(buffer);
• struct iio_dma_buffer_block *block;
• int err;
• mutex_lock(&queue->lock);

guard(mutex)(&queue->lock);

• /*

• * If the buffer is enabled and in fileio mode new blocks can't be
  

• * allocated.
  

• */
  

• if (queue->fileio.enabled) {

• err = -EBUSY;
  

return ERR_PTR(-EBUSY);

• goto err_unlock;
  

• }
• block = iio_dma_buffer_alloc_block(queue, attach->dmabuf->size, false);
• if (!block) {

• err = -ENOMEM;
  

return

• goto err_unlock;
  

• }
• block->attach = attach;
• /* Free memory that might be in use for fileio mode */
• iio_dma_buffer_fileio_free(queue);
• mutex_unlock(&queue->lock);

Drop this as unneeded if you use guard()

• return block;

+err_unlock:

• mutex_unlock(&queue->lock);
• return ERR_PTR(err);

+} +EXPORT_SYMBOL_GPL(iio_dma_buffer_attach_dmabuf);

+static int iio_dma_can_enqueue_block(struct iio_dma_buffer_block *block) +{

• struct iio_dma_buffer_queue *queue = block->queue;
• /* If in fileio mode buffers can't be enqueued. */
• if (queue->fileio.enabled)

• return -EBUSY;
  

• switch (block->state) {
• case IIO_BLOCK_STATE_QUEUED:

• return -EPERM;
  

• case IIO_BLOCK_STATE_DONE:

• return 0;
  

• default:

• return -EBUSY;
  

Is this a real condition or just avoiding a compile warning? If it's real I'd like the various states that lead to it be listed here just so we can more easily understand why -EBUSY is appropriate.

• }

+}

+int iio_dma_buffer_enqueue_dmabuf(struct iio_buffer *buffer,

• 		  struct iio_dma_buffer_block *block,
  

• 		  struct sg_table *sgt,
  

• 		  size_t size, bool cyclic)
  

+{

• struct iio_dma_buffer_queue *queue = iio_buffer_to_queue(buffer);
• int ret = 0;

No need to init as it's always set.

• mutex_lock(&queue->lock);

guard(mutex)(&queue->lock);

Then can do direct returns on error and not bother with the manual unlock.

• ret = iio_dma_can_enqueue_block(block);
• if (ret < 0)

• goto out_mutex_unlock;
  

• block->bytes_used = size;
• block->cyclic = cyclic;
• block->sg_table = sgt;
• iio_dma_buffer_enqueue(queue, block);

+out_mutex_unlock:

• mutex_unlock(&queue->lock);
• return ret;

+} +EXPORT_SYMBOL_GPL(iio_dma_buffer_enqueue_dmabuf);

On Tue, 19 Dec 2023 18:50:08 +0100 Paul Cercueil paul@crapouillou.net wrote:

Use the functions provided by the buffer-dma core to implement the DMABUF userspace API in the buffer-dmaengine IIO buffer implementation.

Since we want to be able to transfer an arbitrary number of bytes and not necesarily the full DMABUF, the associated scatterlist is converted to an array of DMA addresses + lengths, which is then passed to dmaengine_prep_slave_dma_array().

Signed-off-by: Paul Cercueil paul@crapouillou.net

One question inline. Otherwise looks fine to me.

J

---

v3: Use the new dmaengine_prep_slave_dma_array(), and adapt the code to work with the new functions introduced in industrialio-buffer-dma.c.

v5: - Use the new dmaengine_prep_slave_dma_vec(). - Restrict to input buffers, since output buffers are not yet supported by IIO buffers.

---

.../buffer/industrialio-buffer-dmaengine.c | 52 ++++++++++++++++--- 1 file changed, 46 insertions(+), 6 deletions(-)

diff --git a/drivers/iio/buffer/industrialio-buffer-dmaengine.c b/drivers/iio/buffer/industrialio-buffer-dmaengine.c index 5f85ba38e6f6..825d76a24a67 100644 --- a/drivers/iio/buffer/industrialio-buffer-dmaengine.c +++ b/drivers/iio/buffer/industrialio-buffer-dmaengine.c @@ -64,15 +64,51 @@ static int iio_dmaengine_buffer_submit_block(struct iio_dma_buffer_queue *queue, struct dmaengine_buffer *dmaengine_buffer = iio_buffer_to_dmaengine_buffer(&queue->buffer); struct dma_async_tx_descriptor *desc;

• unsigned int i, nents;
• struct scatterlist *sgl;
• struct dma_vec *vecs;
• size_t max_size; dma_cookie_t cookie;
• size_t len_total;

• block->bytes_used = min(block->size, dmaengine_buffer->max_size);
• block->bytes_used = round_down(block->bytes_used,

• 	dmaengine_buffer->align);
  

• if (queue->buffer.direction != IIO_BUFFER_DIRECTION_IN) {

• /* We do not yet support output buffers. */
  

• return -EINVAL;
  

• }

• desc = dmaengine_prep_slave_single(dmaengine_buffer->chan,

• block->phys_addr, block->bytes_used, DMA_DEV_TO_MEM,
  

• DMA_PREP_INTERRUPT);
  

• if (block->sg_table) {

• sgl = block->sg_table->sgl;
  

• nents = sg_nents_for_len(sgl, block->bytes_used);
  

Are we guaranteed the length in the sglist is enough? If not this can return an error code.

• vecs = kmalloc_array(nents, sizeof(*vecs), GFP_KERNEL);
  

• if (!vecs)
  

• 	return -ENOMEM;
  

• len_total = block->bytes_used;
  

• for (i = 0; i < nents; i++) {
  

• 	vecs[i].addr = sg_dma_address(sgl);
  

• 	vecs[i].len = min(sg_dma_len(sgl), len_total);
  

• 	len_total -= vecs[i].len;
  

• 	sgl = sg_next(sgl);
  

• }
  

• desc = dmaengine_prep_slave_dma_vec(dmaengine_buffer->chan,
  

• 				    vecs, nents, DMA_DEV_TO_MEM,
  

• 				    DMA_PREP_INTERRUPT);
  

• kfree(vecs);
  

• } else {

• max_size = min(block->size, dmaengine_buffer->max_size);
  

• max_size = round_down(max_size, dmaengine_buffer->align);
  

• block->bytes_used = max_size;
  

• desc = dmaengine_prep_slave_single(dmaengine_buffer->chan,
  

• 				   block->phys_addr,
  

• 				   block->bytes_used,
  

• 				   DMA_DEV_TO_MEM,
  

• 				   DMA_PREP_INTERRUPT);
  

• } if (!desc) return -ENOMEM;

On Thu, 2023-12-21 at 18:30 +0100, Paul Cercueil wrote:

Hi Jonathan,

Le jeudi 21 décembre 2023 à 16:12 +0000, Jonathan Cameron a écrit :

...

On Tue, 19 Dec 2023 18:50:08 +0100 Paul Cercueil paul@crapouillou.net wrote:

...

Use the functions provided by the buffer-dma core to implement the DMABUF userspace API in the buffer-dmaengine IIO buffer implementation.

Since we want to be able to transfer an arbitrary number of bytes and not necesarily the full DMABUF, the associated scatterlist is converted to an array of DMA addresses + lengths, which is then passed to dmaengine_prep_slave_dma_array().

Signed-off-by: Paul Cercueil paul@crapouillou.net

One question inline. Otherwise looks fine to me.

J

...

---

v3: Use the new dmaengine_prep_slave_dma_array(), and adapt the code to     work with the new functions introduced in industrialio-buffer- dma.c.

v5: - Use the new dmaengine_prep_slave_dma_vec().     - Restrict to input buffers, since output buffers are not yet       supported by IIO buffers.

---

.../buffer/industrialio-buffer-dmaengine.c    | 52 ++++++++++++++++---  1 file changed, 46 insertions(+), 6 deletions(-)

diff --git a/drivers/iio/buffer/industrialio-buffer-dmaengine.c b/drivers/iio/buffer/industrialio-buffer-dmaengine.c index 5f85ba38e6f6..825d76a24a67 100644 --- a/drivers/iio/buffer/industrialio-buffer-dmaengine.c +++ b/drivers/iio/buffer/industrialio-buffer-dmaengine.c @@ -64,15 +64,51 @@ static int iio_dmaengine_buffer_submit_block(struct iio_dma_buffer_queue *queue,         struct dmaengine_buffer *dmaengine_buffer =                 iio_buffer_to_dmaengine_buffer(&queue->buffer);         struct dma_async_tx_descriptor *desc; +       unsigned int i, nents; +       struct scatterlist *sgl; +       struct dma_vec *vecs; +       size_t max_size;         dma_cookie_t cookie; +       size_t len_total;   -       block->bytes_used = min(block->size, dmaengine_buffer-

...

max_size);

-       block->bytes_used = round_down(block->bytes_used, -                       dmaengine_buffer->align); +       if (queue->buffer.direction != IIO_BUFFER_DIRECTION_IN) { +               /* We do not yet support output buffers. */ +               return -EINVAL; +       }   -       desc = dmaengine_prep_slave_single(dmaengine_buffer->chan, -               block->phys_addr, block->bytes_used, DMA_DEV_TO_MEM, -               DMA_PREP_INTERRUPT); +       if (block->sg_table) { +               sgl = block->sg_table->sgl; +               nents = sg_nents_for_len(sgl, block->bytes_used);

Are we guaranteed the length in the sglist is enough?  If not this can return an error code.

The length of the sglist will always be enough, the iio_buffer_enqueue_dmabuf() function already checks that block-

...

bytes_used is equal or smaller than the size of the DMABUF.

It is quite a few functions above in the call stack though, so I can handle the errors of sg_nents_for_len() here if you think makes sense.

Maybe putting something like the above in a comment?

- Nuno Sá