On 19-05-2026 12:25, Christian König wrote:
> On 5/19/26 08:16, Ekansh Gupta via B4 Relay wrote:
>> From: Ekansh Gupta <[email protected]>
>>
>> Allow user-space to import DMA-BUF file descriptors from other
>> subsystems (GPU, camera, video) into the QDA driver via the standard
>> DRM PRIME interface.
>>
>> qda_prime.c
>> Implements qda_gem_prime_import(), which is set as the driver's
>> .gem_prime_import callback. On import it:
>> 1. Short-circuits self-import: if the dma_buf was exported by this
>> device and is not itself an import, the existing GEM object is
>> returned with an incremented reference count.
>> 2. Attaches to the dma_buf and maps it with DMA_BIDIRECTIONAL via
>> dma_buf_map_attachment_unlocked(), obtaining an sg_table whose
>> DMA addresses are IOMMU virtual addresses in the CB device's
>> address space.
>> 3. Calls qda_memory_manager_alloc() to record the IOMMU mapping and
>> encode the SID in the upper 32 bits of the DMA address, matching
>> the convention used for natively allocated buffers.
>>
>> qda_prime_fd_to_handle() wraps drm_gem_prime_fd_to_handle() under
>> qdev->import_lock, storing the calling file_priv in
>> qdev->current_import_file_priv so that qda_gem_prime_import() can
>> retrieve it (the .gem_prime_import callback does not receive
>> file_priv directly).
>>
>> qda_gem.c
>> qda_gem_free_object() is extended to handle the imported-buffer
>> teardown path: unmap the sg_table, detach from the dma_buf, and
>> release the dma_buf reference.
>> qda_gem_mmap_obj() rejects mmap requests on imported objects.
>>
>> qda_memory_manager.c
>> qda_memory_manager_map_imported() records the IOMMU-mapped DMA
>> address from the first sg entry (the IOMMU maps the buffer as a
>> contiguous range) and encodes the SID prefix.
>
> No it doesn't.
I see, it does not guarantee or enforce contiguous IOMMU mapping. I'll
fix the commit text.>
>> qda_memory_manager_free() skips the DMA free path for imported
>> buffers since the memory is owned by the exporter.
>>
>> Assisted-by: Claude:claude-4-6-sonnet
>> Signed-off-by: Ekansh Gupta <[email protected]>
>> ---
>> drivers/accel/qda/Makefile | 1 +
>> drivers/accel/qda/qda_drv.c | 12 ++-
>> drivers/accel/qda/qda_drv.h | 4 +
>> drivers/accel/qda/qda_gem.c | 25 ++++-
>> drivers/accel/qda/qda_gem.h | 8 ++
>> drivers/accel/qda/qda_memory_manager.c | 47 ++++++++-
>> drivers/accel/qda/qda_prime.c | 184
>> +++++++++++++++++++++++++++++++++
>> drivers/accel/qda/qda_prime.h | 18 ++++
>> 8 files changed, 295 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/accel/qda/Makefile b/drivers/accel/qda/Makefile
>> index a46ddceecfc5..fb092e56d7f3 100644
>> --- a/drivers/accel/qda/Makefile
>> +++ b/drivers/accel/qda/Makefile
>> @@ -12,6 +12,7 @@ qda-y := \
>> qda_ioctl.o \
>> qda_memory_dma.o \
>> qda_memory_manager.o \
>> + qda_prime.o \
>> qda_rpmsg.o
>>
>> obj-$(CONFIG_DRM_ACCEL_QDA_COMPUTE_BUS) += qda_compute_bus.o
>> diff --git a/drivers/accel/qda/qda_drv.c b/drivers/accel/qda/qda_drv.c
>> index c9b9e56dcb28..ef8bd573b836 100644
>> --- a/drivers/accel/qda/qda_drv.c
>> +++ b/drivers/accel/qda/qda_drv.c
>> @@ -7,10 +7,12 @@
>> #include <drm/drm_file.h>
>> #include <drm/drm_gem.h>
>> #include <drm/drm_ioctl.h>
>> +#include <drm/drm_prime.h>
>> #include <drm/drm_print.h>
>> #include <drm/qda_accel.h>
>>
>> #include "qda_drv.h"
>> +#include "qda_prime.h"
>> #include "qda_ioctl.h"
>> #include "qda_rpmsg.h"
>>
>> @@ -64,6 +66,8 @@ static const struct drm_driver qda_drm_driver = {
>> .postclose = qda_postclose,
>> .ioctls = qda_ioctls,
>> .num_ioctls = ARRAY_SIZE(qda_ioctls),
>> + .gem_prime_import = qda_gem_prime_import,
>> + .prime_fd_to_handle = qda_prime_fd_to_handle,
>> .name = QDA_DRIVER_NAME,
>> .desc = "Qualcomm DSP Accelerator Driver",
>> };
>> @@ -100,6 +104,7 @@ static int init_memory_manager(struct qda_dev *qdev)
>>
>> void qda_deinit_device(struct qda_dev *qdev)
>> {
>> + mutex_destroy(&qdev->import_lock);
>> cleanup_memory_manager(qdev);
>> }
>>
>> @@ -107,9 +112,14 @@ int qda_init_device(struct qda_dev *qdev)
>> {
>> int ret;
>>
>> + mutex_init(&qdev->import_lock);
>> + qdev->current_import_file_priv = NULL;
>> +
>> ret = init_memory_manager(qdev);
>> - if (ret)
>> + if (ret) {
>> drm_err(&qdev->drm_dev, "Failed to initialize memory
>> manager: %d\n", ret);
>> + mutex_destroy(&qdev->import_lock);
>> + }
>>
>> return ret;
>> }
>> diff --git a/drivers/accel/qda/qda_drv.h b/drivers/accel/qda/qda_drv.h
>> index 8a7d647ac8fc..96ce4135e2d9 100644
>> --- a/drivers/accel/qda/qda_drv.h
>> +++ b/drivers/accel/qda/qda_drv.h
>> @@ -47,6 +47,10 @@ struct qda_dev {
>> struct list_head cb_devs;
>> /** @iommu_mgr: IOMMU/memory manager instance */
>> struct qda_memory_manager *iommu_mgr;
>> + /** @import_lock: Lock protecting prime import context */
>> + struct mutex import_lock;
>> + /** @current_import_file_priv: Current file_priv during prime import
>> */
>> + struct drm_file *current_import_file_priv;
>> /** @dsp_name: Name of the DSP domain (e.g. "cdsp", "adsp") */
>> const char *dsp_name;
>> };
>> diff --git a/drivers/accel/qda/qda_gem.c b/drivers/accel/qda/qda_gem.c
>> index 568b3c2e64b7..9e1ac7582d0c 100644
>> --- a/drivers/accel/qda/qda_gem.c
>> +++ b/drivers/accel/qda/qda_gem.c
>> @@ -9,6 +9,7 @@
>> #include "qda_gem.h"
>> #include "qda_memory_manager.h"
>> #include "qda_memory_dma.h"
>> +#include "qda_prime.h"
>>
>> static void setup_vma_flags(struct vm_area_struct *vma)
>> {
>> @@ -25,8 +26,20 @@ void qda_gem_free_object(struct drm_gem_object *gem_obj)
>> struct qda_gem_obj *qda_gem_obj = to_qda_gem_obj(gem_obj);
>> struct qda_dev *qdev = qda_dev_from_drm(gem_obj->dev);
>>
>> - if (qda_gem_obj->virt && qdev->iommu_mgr)
>> - qda_memory_manager_free(qdev->iommu_mgr, qda_gem_obj);
>> + if (qda_gem_obj->is_imported) {
>> + if (qda_gem_obj->attachment && qda_gem_obj->sgt)
>> +
>> dma_buf_unmap_attachment_unlocked(qda_gem_obj->attachment,
>> + qda_gem_obj->sgt,
>> DMA_BIDIRECTIONAL);
>> + if (qda_gem_obj->attachment)
>> + dma_buf_detach(qda_gem_obj->dma_buf,
>> qda_gem_obj->attachment);
>> + if (qda_gem_obj->dma_buf)
>> + dma_buf_put(qda_gem_obj->dma_buf);
>> + if (qda_gem_obj->iommu_dev && qdev->iommu_mgr)
>> + qda_memory_manager_free(qdev->iommu_mgr,
>> qda_gem_obj);
>> + } else {
>> + if (qda_gem_obj->virt && qdev->iommu_mgr)
>> + qda_memory_manager_free(qdev->iommu_mgr,
>> qda_gem_obj);
>> + }
>>
>> drm_gem_object_release(gem_obj);
>> kfree(qda_gem_obj);
>> @@ -44,6 +57,10 @@ int qda_gem_mmap_obj(struct drm_gem_object *drm_obj,
>> struct vm_area_struct *vma)
>> struct qda_gem_obj *qda_gem_obj = to_qda_gem_obj(drm_obj);
>> int ret;
>>
>> + /* Imported dma-buf objects must be mmap'd through the exporter, not
>> the importer */
>> + if (qda_gem_obj->is_imported)
>> + return -EINVAL;
>> +
>> /* Reset vm_pgoff for DMA mmap */
>> vma->vm_pgoff = 0;
>>
>> @@ -143,6 +160,10 @@ struct drm_gem_object *qda_gem_create_object(struct
>> drm_device *drm_dev,
>> qda_gem_obj = qda_gem_alloc_object(drm_dev, aligned_size);
>> if (IS_ERR(qda_gem_obj))
>> return ERR_CAST(qda_gem_obj);
>> + qda_gem_obj->is_imported = false;
>> + qda_gem_obj->dma_buf = NULL;
>> + qda_gem_obj->attachment = NULL;
>> + qda_gem_obj->sgt = NULL;
>>
>> ret = qda_memory_manager_alloc(iommu_mgr, qda_gem_obj, file_priv);
>> if (ret) {
>> diff --git a/drivers/accel/qda/qda_gem.h b/drivers/accel/qda/qda_gem.h
>> index bb18f8155aa4..0878f57715f6 100644
>> --- a/drivers/accel/qda/qda_gem.h
>> +++ b/drivers/accel/qda/qda_gem.h
>> @@ -22,12 +22,20 @@ struct qda_gem_obj {
>> struct drm_gem_object base;
>> /** @iommu_dev: IOMMU context bank device that performed the
>> allocation */
>> struct qda_iommu_device *iommu_dev;
>> + /** @dma_buf: Reference to imported dma_buf */
>> + struct dma_buf *dma_buf;
>> + /** @attachment: DMA buf attachment */
>> + struct dma_buf_attachment *attachment;
>> + /** @sgt: Scatter-gather table */
>> + struct sg_table *sgt;
>> /** @virt: Kernel virtual address of the allocated DMA memory */
>> void *virt;
>> /** @dma_addr: DMA address (with SID encoded in upper 32 bits) */
>> dma_addr_t dma_addr;
>> /** @size: Size of the buffer in bytes */
>> size_t size;
>> + /** @is_imported: True if buffer is imported, false if allocated */
>> + bool is_imported;
>> };
>>
>> /**
>> diff --git a/drivers/accel/qda/qda_memory_manager.c
>> b/drivers/accel/qda/qda_memory_manager.c
>> index 82111275f420..d2aa0e0e65f5 100644
>> --- a/drivers/accel/qda/qda_memory_manager.c
>> +++ b/drivers/accel/qda/qda_memory_manager.c
>> @@ -202,6 +202,41 @@ static struct qda_iommu_device
>> *get_or_assign_iommu_device(struct qda_memory_man
>> return NULL;
>> }
>>
>> +static int qda_memory_manager_map_imported(struct qda_memory_manager
>> *mem_mgr,
>> + struct qda_gem_obj *gem_obj,
>> + struct qda_iommu_device
>> *iommu_dev)
>> +{
>> + struct scatterlist *sg;
>> + dma_addr_t dma_addr;
>> +
>> + if (!gem_obj->is_imported || !gem_obj->sgt || !iommu_dev) {
>> + drm_err(gem_obj->base.dev, "Invalid parameters for imported
>> buffer mapping\n");
>> + return -EINVAL;
>> + }
>> +
>> + sg = gem_obj->sgt->sgl;
>> + if (!sg) {
>> + drm_err(gem_obj->base.dev, "Invalid scatter-gather list for
>> imported buffer\n");
>> + return -EINVAL;
>> + }
>> +
>> + gem_obj->iommu_dev = iommu_dev;
>> +
>> + /*
>> + * After dma_buf_map_attachment_unlocked(), sg_dma_address() returns
>> the
>> + * IOMMU virtual address, not the physical address. The IOMMU maps
>> the
>> + * entire buffer as a contiguous range in the IOMMU address space
>> even if
>> + * the underlying physical memory is non-contiguous. Therefore the
>> first
>> + * sg entry's DMA address is the start of the complete contiguous
>> + * IOMMU-mapped range and is sufficient to describe the buffer to
>> the DSP.
>> + */
>> + dma_addr = sg_dma_address(sg);
>> + dma_addr += ((u64)iommu_dev->sid << 32);
>> + gem_obj->dma_addr = dma_addr;
>
> That handling here is completely broken since it assumes that the exporter
> maps the buffer as contigious range.
>
> But that's in no way guaranteed.
I'll collect more details and will try to implement this in the right
way, maybe by iterating the full sg_table.>
> Regards,
> Christian.
>
>> +
>> + return 0;
>> +}
>> +
>> /**
>> * qda_memory_manager_alloc() - Allocate memory for a GEM object
>> * @mem_mgr: Pointer to memory manager
>> @@ -237,7 +272,11 @@ int qda_memory_manager_alloc(struct qda_memory_manager
>> *mem_mgr, struct qda_gem_
>> return -ENOMEM;
>> }
>>
>> - ret = qda_dma_alloc(selected_dev, gem_obj, size);
>> + if (gem_obj->is_imported)
>> + ret = qda_memory_manager_map_imported(mem_mgr, gem_obj,
>> selected_dev);
>> + else
>> + ret = qda_dma_alloc(selected_dev, gem_obj, size);
>> +
>> if (ret) {
>> drm_err(gem_obj->base.dev, "Allocation failed: size=%zu,
>> device_id=%u, ret=%d\n",
>> size, selected_dev->id, ret);
>> @@ -262,6 +301,12 @@ void qda_memory_manager_free(struct qda_memory_manager
>> *mem_mgr, struct qda_gem_
>> return;
>> }
>>
>> + if (gem_obj->is_imported) {
>> + drm_dbg_driver(gem_obj->base.dev,
>> + "Freed imported buffer tracking (no DMA free
>> needed)\n");
>> + return;
>> + }
>> +
>> qda_dma_free(gem_obj);
>> }
>>
>> diff --git a/drivers/accel/qda/qda_prime.c b/drivers/accel/qda/qda_prime.c
>> new file mode 100644
>> index 000000000000..acb0ac8c40fd
>> --- /dev/null
>> +++ b/drivers/accel/qda/qda_prime.c
>> @@ -0,0 +1,184 @@
>> +// SPDX-License-Identifier: GPL-2.0-only
>> +// Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
>> +#include <drm/drm_gem.h>
>> +#include <drm/drm_prime.h>
>> +#include <drm/drm_print.h>
>> +#include <linux/slab.h>
>> +#include <linux/dma-mapping.h>
>> +#include "qda_drv.h"
>> +#include "qda_gem.h"
>> +#include "qda_prime.h"
>> +#include "qda_memory_manager.h"
>> +
>> +static struct drm_gem_object *check_own_buffer(struct drm_device *dev,
>> struct dma_buf *dma_buf)
>> +{
>> + struct drm_gem_object *existing_gem;
>> +
>> + /* Only safe to access priv if this dma-buf was exported by this
>> device */
>> + if (!drm_gem_is_prime_exported_dma_buf(dev, dma_buf))
>> + return NULL;
>> +
>> + existing_gem = dma_buf->priv;
>> + if (existing_gem->dev != dev)
>> + return NULL;
>> +
>> + if (to_qda_gem_obj(existing_gem)->is_imported)
>> + return NULL;
>> +
>> + drm_gem_object_get(existing_gem);
>> + return existing_gem;
>> +}
>> +
>> +static struct qda_iommu_device *get_iommu_device_for_import(struct qda_dev
>> *qdev,
>> + struct drm_file
>> **file_priv_out)
>> +{
>> + struct drm_file *file_priv;
>> + struct qda_file_priv *qda_file_priv;
>> + struct qda_iommu_device *iommu_dev = NULL;
>> + int ret;
>> +
>> + file_priv = qdev->current_import_file_priv;
>> + *file_priv_out = file_priv;
>> +
>> + if (!file_priv || !file_priv->driver_priv)
>> + return NULL;
>> +
>> + qda_file_priv = (struct qda_file_priv *)file_priv->driver_priv;
>> + iommu_dev = qda_file_priv->assigned_iommu_dev;
>> +
>> + if (!iommu_dev) {
>> + ret = qda_memory_manager_assign_device(qdev->iommu_mgr,
>> file_priv);
>> + if (ret) {
>> + drm_err(&qdev->drm_dev, "Failed to assign IOMMU
>> device: %d\n", ret);
>> + return NULL;
>> + }
>> +
>> + iommu_dev = qda_file_priv->assigned_iommu_dev;
>> + }
>> +
>> + return iommu_dev;
>> +}
>> +
>> +static int setup_dma_buf_mapping(struct qda_gem_obj *qda_gem_obj, struct
>> dma_buf *dma_buf,
>> + struct device *attach_dev, struct qda_dev
>> *qdev)
>> +{
>> + struct dma_buf_attachment *attachment;
>> + struct sg_table *sgt;
>> + int ret;
>> +
>> + attachment = dma_buf_attach(dma_buf, attach_dev);
>> + if (IS_ERR(attachment)) {
>> + ret = PTR_ERR(attachment);
>> + drm_err(&qdev->drm_dev, "Failed to attach dma_buf: %d\n",
>> ret);
>> + return ret;
>> + }
>> + qda_gem_obj->attachment = attachment;
>> +
>> + sgt = dma_buf_map_attachment_unlocked(attachment, DMA_BIDIRECTIONAL);
>> + if (IS_ERR(sgt)) {
>> + ret = PTR_ERR(sgt);
>> + drm_err(&qdev->drm_dev, "Failed to map dma_buf attachment:
>> %d\n", ret);
>> + dma_buf_detach(dma_buf, attachment);
>> + return ret;
>> + }
>> + qda_gem_obj->sgt = sgt;
>> +
>> + return 0;
>> +}
>> +
>> +/**
>> + * qda_gem_prime_import() - Import a DMA-BUF as a GEM object
>> + * @dev: DRM device structure
>> + * @dma_buf: DMA-BUF to import
>> + *
>> + * Return: Pointer to the imported GEM object on success, ERR_PTR on failure
>> + */
>> +struct drm_gem_object *qda_gem_prime_import(struct drm_device *dev, struct
>> dma_buf *dma_buf)
>> +{
>> + struct qda_dev *qdev = qda_dev_from_drm(dev);
>> + struct qda_gem_obj *qda_gem_obj;
>> + struct drm_file *file_priv;
>> + struct qda_iommu_device *iommu_dev;
>> + struct drm_gem_object *existing_gem;
>> + size_t aligned_size;
>> + int ret;
>> +
>> + if (!qdev->iommu_mgr) {
>> + drm_err(dev, "Invalid iommu_mgr\n");
>> + return ERR_PTR(-ENODEV);
>> + }
>> +
>> + existing_gem = check_own_buffer(dev, dma_buf);
>> + if (existing_gem)
>> + return existing_gem;
>> +
>> + iommu_dev = get_iommu_device_for_import(qdev, &file_priv);
>> + if (!iommu_dev || !iommu_dev->dev) {
>> + drm_err(dev, "No IOMMU device assigned for prime import\n");
>> + return ERR_PTR(-ENODEV);
>> + }
>> +
>> + drm_dbg_driver(dev, "Using IOMMU device %u for prime import\n",
>> iommu_dev->id);
>> +
>> + aligned_size = PAGE_ALIGN(dma_buf->size);
>> + qda_gem_obj = qda_gem_alloc_object(dev, aligned_size);
>> + if (IS_ERR(qda_gem_obj))
>> + return ERR_CAST(qda_gem_obj);
>> +
>> + qda_gem_obj->is_imported = true;
>> + qda_gem_obj->dma_buf = dma_buf;
>> + qda_gem_obj->virt = NULL;
>> + qda_gem_obj->iommu_dev = iommu_dev;
>> +
>> + get_dma_buf(dma_buf);
>> +
>> + ret = setup_dma_buf_mapping(qda_gem_obj, dma_buf, iommu_dev->dev,
>> qdev);
>> + if (ret)
>> + goto err_put_dma_buf;
>> +
>> + ret = qda_memory_manager_alloc(qdev->iommu_mgr, qda_gem_obj,
>> file_priv);
>> + if (ret) {
>> + drm_err(dev, "Failed to allocate IOMMU mapping: %d\n", ret);
>> + goto err_unmap;
>> + }
>> +
>> + drm_dbg_driver(dev, "Prime import completed successfully
>> size=%zu\n", aligned_size);
>> + return &qda_gem_obj->base;
>> +
>> +err_unmap:
>> + dma_buf_unmap_attachment_unlocked(qda_gem_obj->attachment,
>> + qda_gem_obj->sgt,
>> DMA_BIDIRECTIONAL);
>> + dma_buf_detach(dma_buf, qda_gem_obj->attachment);
>> +err_put_dma_buf:
>> + dma_buf_put(dma_buf);
>> + qda_gem_cleanup_object(qda_gem_obj);
>> + return ERR_PTR(ret);
>> +}
>> +
>> +/**
>> + * qda_prime_fd_to_handle() - Convert a PRIME fd to a GEM handle
>> + * @dev: DRM device structure
>> + * @file_priv: DRM file private data
>> + * @prime_fd: File descriptor of the PRIME buffer
>> + * @handle: Output GEM handle
>> + *
>> + * Return: 0 on success, negative error code on failure
>> + */
>> +int qda_prime_fd_to_handle(struct drm_device *dev, struct drm_file
>> *file_priv,
>> + int prime_fd, u32 *handle)
>> +{
>> + struct qda_dev *qdev = qda_dev_from_drm(dev);
>> + int ret;
>> +
>> + mutex_lock(&qdev->import_lock);
>> + qdev->current_import_file_priv = file_priv;
>> +
>> + ret = drm_gem_prime_fd_to_handle(dev, file_priv, prime_fd, handle);
>> +
>> + qdev->current_import_file_priv = NULL;
>> + mutex_unlock(&qdev->import_lock);
>> +
>> + return ret;
>> +}
>> +
>> +MODULE_IMPORT_NS("DMA_BUF");
>> diff --git a/drivers/accel/qda/qda_prime.h b/drivers/accel/qda/qda_prime.h
>> new file mode 100644
>> index 000000000000..9b3850d54fa7
>> --- /dev/null
>> +++ b/drivers/accel/qda/qda_prime.h
>> @@ -0,0 +1,18 @@
>> +/* SPDX-License-Identifier: GPL-2.0-only */
>> +/*
>> + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
>> + */
>> +
>> +#ifndef __QDA_PRIME_H__
>> +#define __QDA_PRIME_H__
>> +
>> +#include <drm/drm_device.h>
>> +#include <drm/drm_file.h>
>> +#include <drm/drm_gem.h>
>> +#include <linux/dma-buf.h>
>> +
>> +struct drm_gem_object *qda_gem_prime_import(struct drm_device *dev, struct
>> dma_buf *dma_buf);
>> +int qda_prime_fd_to_handle(struct drm_device *dev, struct drm_file
>> *file_priv,
>> + int prime_fd, u32 *handle);
>> +
>> +#endif /* __QDA_PRIME_H__ */
>>
>> --
>> 2.34.1
>>
>>
>
