On Thu, 2016-01-21 at 09:39 -0800, Laura Abbott wrote:
> On 01/21/2016 03:57 AM, Jon Medhurst (Tixy) wrote:
> > From: Liviu Dudau <Liviu.Dudau@xxxxxxx>
> >
> > ion_buffer_create() will allocate a buffer and then create a DMA
> > mapping for it, but it forgot to set the length of the page entries.
> >
> > Signed-off-by: Liviu Dudau <Liviu.Dudau@xxxxxxx>
> > Signed-off-by: Jon Medhurst <tixy@xxxxxxxxxx>
> > ---
> > drivers/staging/android/ion/ion.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
> > index e237e9f..df56021 100644
> > --- a/drivers/staging/android/ion/ion.c
> > +++ b/drivers/staging/android/ion/ion.c
> > @@ -251,8 +251,10 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap,
> > * memory coming from the heaps is ready for dma, ie if it has a
> > * cached mapping that mapping has been invalidated
> > */
> > - for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i)
> > + for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) {
> > sg_dma_address(sg) = sg_phys(sg);
> > + sg_dma_len(sg) = sg->length;
> > + }
> > mutex_lock(&dev->buffer_lock);
> > ion_buffer_add(dev, buffer);
> > mutex_unlock(&dev->buffer_lock);
> >
>
> So Ion is really doing it wrong by setting the sg_dma_address manually as
> the comment above notes. Ion has moved away from sg_dma_len though
> (see 06e0dcaeb4fd72a010a1f5ad0c03abd8e0a58ef9). This isn't technically
> a mapping as well. What's broken by not having sg_dma_len set?
I fear this could end up being embarrassing...
What's broken is that the out-of-tree kernel driver for ARM's Mali GPU
is getting passed a dma_buf corresponding to the ION buffer. It is then
calling dma_buf_map_attachment [1] on that and then parsing the
resultant scatter-gather list to get the physical pages so it can pass
them to the GPU hardware. In the process, it is using sg_dma_len() to
get the length, which is garbage for ION buffers if ion_buffer_create()
doesn't set it.
[1] http://git.linaro.org/landing-teams/working/arm/kernel-release.git/blob/9660bff61ab296be02aad111d0bc2b9919493de5:/drivers/gpu/arm/midgard/mali_kbase_jd.c#l333
Now, I just tried making the Mali driver use sg->length rather than
sg_dma_len() and, unsurprisingly, that also fixes the problem. So, my
questions would be...
Is it acceptable for a driver getting a dma_buf to parse the
scatter-gather list for that by had?
If so, should it use ->length or sg_dma_len() to get the length of each
element?
If sg_dma_len() is correct or acceptable then it seems to me that the
ION code should set that length. Especially as the comment in the code
implies it's faking a call to map_sg and grepping the kernel tree for
real implementations of that functionality seems to show the dma_address
getting set.
As you can probably tell, I feel I may be on shaky ground. This is
because I don't fully understanding the code and suspecting both the ION
and GPU code is rather dodgy (and possibly the bits in between :-)
--
Tixy
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
