drm: omapdrm: Export correct scatterlist for TILER backed BOs

Memory of BOs backed by TILER is not contiguous, but omap_gem_map_dma_buf()
exports it like it is. This leads to (possibly) invalid memory accesses if
another device imports such a BO.

Fix that by providing sg that correctly describes TILER memory layout.
Align TILER allocations to page, so importer to be able to correctly set
its MMU if have one. Set export size accounting for the alignment. Also,
make sure to destroy sg on unpin, as it is no longer valid.

Tested on Motorola Droid4 by using GPU (sgx540) to render.

Suggested-by: Matthijs van Duin <matthijsvanduin@gmail.com>
Signed-off-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1637309180-31032-1-git-send-email-ivo.g.dimitrov.75@gmail.com

authored by

Ivaylo Dimitrov and committed by

Tomi Valkeinen 4 years ago fe4d0b63 f8378c04

+85 -30

3 changed files

expand all

drivers

gpu

drm

omapdrm

omap_gem.c

omap_gem.h

omap_gem_dmabuf.c

+78 -1

drivers/gpu/drm/omapdrm/omap_gem.c

··· 789 789 if (omap_obj->flags & OMAP_BO_TILED_MASK) { 790 790 block = tiler_reserve_2d(fmt, 791 791 omap_obj->width, 792 - omap_obj->height, 0); 792 + omap_obj->height, PAGE_SIZE); 793 793 } else { 794 794 block = tiler_reserve_1d(obj->size); 795 795 } ··· 851 851 return; 852 852 853 853 if (refcount_dec_and_test(&omap_obj->dma_addr_cnt)) { 854 + if (omap_obj->sgt) { 855 + sg_free_table(omap_obj->sgt); 856 + kfree(omap_obj->sgt); 857 + omap_obj->sgt = NULL; 858 + } 854 859 ret = tiler_unpin(omap_obj->block); 855 860 if (ret) { 856 861 dev_err(obj->dev->dev, ··· 966 961 * released the pages.. 967 962 */ 968 963 return 0; 964 + } 965 + 966 + struct sg_table *omap_gem_get_sg(struct drm_gem_object *obj) 967 + { 968 + struct omap_gem_object *omap_obj = to_omap_bo(obj); 969 + dma_addr_t addr; 970 + struct sg_table *sgt; 971 + struct scatterlist *sg; 972 + unsigned int count, len, stride, i; 973 + int ret; 974 + 975 + ret = omap_gem_pin(obj, &addr); 976 + if (ret) 977 + return ERR_PTR(ret); 978 + 979 + mutex_lock(&omap_obj->lock); 980 + 981 + sgt = omap_obj->sgt; 982 + if (sgt) 983 + goto out; 984 + 985 + sgt = kzalloc(sizeof(*sgt), GFP_KERNEL); 986 + if (!sgt) { 987 + ret = -ENOMEM; 988 + goto err_unpin; 989 + } 990 + 991 + if (omap_obj->flags & OMAP_BO_TILED_MASK) { 992 + enum tiler_fmt fmt = gem2fmt(omap_obj->flags); 993 + 994 + len = omap_obj->width << (int)fmt; 995 + count = omap_obj->height; 996 + stride = tiler_stride(fmt, 0); 997 + } else { 998 + len = obj->size; 999 + count = 1; 1000 + stride = 0; 1001 + } 1002 + 1003 + ret = sg_alloc_table(sgt, count, GFP_KERNEL); 1004 + if (ret) 1005 + goto err_free; 1006 + 1007 + for_each_sg(sgt->sgl, sg, count, i) { 1008 + sg_set_page(sg, phys_to_page(addr), len, offset_in_page(addr)); 1009 + sg_dma_address(sg) = addr; 1010 + sg_dma_len(sg) = len; 1011 + 1012 + addr += stride; 1013 + } 1014 + 1015 + omap_obj->sgt = sgt; 1016 + out: 1017 + mutex_unlock(&omap_obj->lock); 1018 + return sgt; 1019 + 1020 + err_free: 1021 + kfree(sgt); 1022 + err_unpin: 1023 + mutex_unlock(&omap_obj->lock); 1024 + omap_gem_unpin(obj); 1025 + return ERR_PTR(ret); 1026 + } 1027 + 1028 + void omap_gem_put_sg(struct drm_gem_object *obj, struct sg_table *sgt) 1029 + { 1030 + struct omap_gem_object *omap_obj = to_omap_bo(obj); 1031 + 1032 + if (WARN_ON(omap_obj->sgt != sgt)) 1033 + return; 1034 + 1035 + omap_gem_unpin(obj); 969 1036 } 970 1037 971 1038 #ifdef CONFIG_DRM_FBDEV_EMULATION

drivers/gpu/drm/omapdrm/omap_gem.h

··· 82 82 int omap_gem_rotated_dma_addr(struct drm_gem_object *obj, u32 orient, 83 83 int x, int y, dma_addr_t *dma_addr); 84 84 int omap_gem_tiled_stride(struct drm_gem_object *obj, u32 orient); 85 + struct sg_table *omap_gem_get_sg(struct drm_gem_object *obj); 86 + void omap_gem_put_sg(struct drm_gem_object *obj, struct sg_table *sgt); 85 87 86 88 #endif /* __OMAPDRM_GEM_H__ */

+5 -29

drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c

··· 23 23 { 24 24 struct drm_gem_object *obj = attachment->dmabuf->priv; 25 25 struct sg_table *sg; 26 - dma_addr_t dma_addr; 27 - int ret; 28 - 29 - sg = kzalloc(sizeof(*sg), GFP_KERNEL); 30 - if (!sg) 31 - return ERR_PTR(-ENOMEM); 32 - 33 - /* camera, etc, need physically contiguous.. but we need a 34 - * better way to know this.. 35 - */ 36 - ret = omap_gem_pin(obj, &dma_addr); 37 - if (ret) 38 - goto out; 39 - 40 - ret = sg_alloc_table(sg, 1, GFP_KERNEL); 41 - if (ret) 42 - goto out; 43 - 44 - sg_init_table(sg->sgl, 1); 45 - sg_dma_len(sg->sgl) = obj->size; 46 - sg_set_page(sg->sgl, pfn_to_page(PFN_DOWN(dma_addr)), obj->size, 0); 47 - sg_dma_address(sg->sgl) = dma_addr; 26 + sg = omap_gem_get_sg(obj); 27 + if (IS_ERR(sg)) 28 + return sg; 48 29 49 30 /* this must be after omap_gem_pin() to ensure we have pages attached */ 50 31 omap_gem_dma_sync_buffer(obj, dir); 51 32 52 33 return sg; 53 - out: 54 - kfree(sg); 55 - return ERR_PTR(ret); 56 34 } 57 35 58 36 static void omap_gem_unmap_dma_buf(struct dma_buf_attachment *attachment, 59 37 struct sg_table *sg, enum dma_data_direction dir) 60 38 { 61 39 struct drm_gem_object *obj = attachment->dmabuf->priv; 62 - omap_gem_unpin(obj); 63 - sg_free_table(sg); 64 - kfree(sg); 40 + omap_gem_put_sg(obj, sg); 65 41 } 66 42 67 43 static int omap_gem_dmabuf_begin_cpu_access(struct dma_buf *buffer, ··· 90 114 DEFINE_DMA_BUF_EXPORT_INFO(exp_info); 91 115 92 116 exp_info.ops = &omap_dmabuf_ops; 93 - exp_info.size = obj->size; 117 + exp_info.size = omap_gem_mmap_size(obj); 94 118 exp_info.flags = flags; 95 119 exp_info.priv = obj; 96 120

Configure Feed

Configure Feed