drivers/dma-buf/udmabuf.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <linux/cred.h>
   3 #include <linux/device.h>
   4 #include <linux/dma-buf.h>
   5 #include <linux/highmem.h>
   6 #include <linux/init.h>
   7 #include <linux/kernel.h>
   8 #include <linux/memfd.h>
   9 #include <linux/miscdevice.h>
  10 #include <linux/module.h>
  11 #include <linux/shmem_fs.h>
  12 #include <linux/slab.h>
  13 #include <linux/udmabuf.h>
  14
  15 static const u32    list_limit = 1024;  /* udmabuf_create_list->count limit */
  16 static const size_t size_limit_mb = 64; /* total dmabuf size, in megabytes  */
  17
  18 struct udmabuf {
  19         pgoff_t pagecount;
  20         struct page **pages;
  21 };
  22
  23 static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf)
  24 {
  25         struct vm_area_struct *vma = vmf->vma;
  26         struct udmabuf *ubuf = vma->vm_private_data;
  27         pgoff_t pgoff = vmf->pgoff;
  28
  29         if (pgoff >= ubuf->pagecount)
  30                 return VM_FAULT_SIGBUS;
  31         vmf->page = ubuf->pages[pgoff];
  32         get_page(vmf->page);
  33         return 0;
  34 }
  35
  36 static const struct vm_operations_struct udmabuf_vm_ops = {
  37         .fault = udmabuf_vm_fault,
  38 };
  39
  40 static int mmap_udmabuf(struct dma_buf *buf, struct vm_area_struct *vma)
  41 {
  42         struct udmabuf *ubuf = buf->priv;
  43
  44         if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) == 0)
  45                 return -EINVAL;
  46
  47         vma->vm_ops = &udmabuf_vm_ops;
  48         vma->vm_private_data = ubuf;
  49         return 0;
  50 }
  51
  52 static struct sg_table *map_udmabuf(struct dma_buf_attachment *at,
  53                                     enum dma_data_direction direction)
  54 {
  55         struct udmabuf *ubuf = at->dmabuf->priv;
  56         struct sg_table *sg;
  57         int ret;
  58
  59         sg = kzalloc(sizeof(*sg), GFP_KERNEL);
  60         if (!sg)
  61                 return ERR_PTR(-ENOMEM);
  62         ret = sg_alloc_table_from_pages(sg, ubuf->pages, ubuf->pagecount,
  63                                         0, ubuf->pagecount << PAGE_SHIFT,
  64                                         GFP_KERNEL);
  65         if (ret < 0)
  66                 goto err;
  67         if (!dma_map_sg(at->dev, sg->sgl, sg->nents, direction)) {
  68                 ret = -EINVAL;
  69                 goto err;
  70         }
  71         return sg;
  72
  73 err:
  74         sg_free_table(sg);
  75         kfree(sg);
  76         return ERR_PTR(ret);
  77 }
  78
  79 static void unmap_udmabuf(struct dma_buf_attachment *at,
  80                           struct sg_table *sg,
  81                           enum dma_data_direction direction)
  82 {
  83         dma_unmap_sg(at->dev, sg->sgl, sg->nents, direction);
  84         sg_free_table(sg);
  85         kfree(sg);
  86 }
  87
  88 static void release_udmabuf(struct dma_buf *buf)
  89 {
  90         struct udmabuf *ubuf = buf->priv;
  91         pgoff_t pg;
  92
  93         for (pg = 0; pg < ubuf->pagecount; pg++)
  94                 put_page(ubuf->pages[pg]);
  95         kfree(ubuf->pages);
  96         kfree(ubuf);
  97 }
  98
  99 static void *kmap_udmabuf(struct dma_buf *buf, unsigned long page_num)
 100 {
 101         struct udmabuf *ubuf = buf->priv;
 102         struct page *page = ubuf->pages[page_num];
 103
 104         return kmap(page);
 105 }
 106
 107 static void kunmap_udmabuf(struct dma_buf *buf, unsigned long page_num,
 108                            void *vaddr)
 109 {
 110         kunmap(vaddr);
 111 }
 112
 113 static const struct dma_buf_ops udmabuf_ops = {
 114         .map_dma_buf      = map_udmabuf,
 115         .unmap_dma_buf    = unmap_udmabuf,
 116         .release          = release_udmabuf,
 117         .map              = kmap_udmabuf,
 118         .unmap            = kunmap_udmabuf,
 119         .mmap             = mmap_udmabuf,
 120 };
 121
 122 #define SEALS_WANTED (F_SEAL_SHRINK)
 123 #define SEALS_DENIED (F_SEAL_WRITE)
 124
 125 static long udmabuf_create(const struct udmabuf_create_list *head,
 126                            const struct udmabuf_create_item *list)
 127 {
 128         DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
 129         struct file *memfd = NULL;
 130         struct udmabuf *ubuf;
 131         struct dma_buf *buf;
 132         pgoff_t pgoff, pgcnt, pgidx, pgbuf = 0, pglimit;
 133         struct page *page;
 134         int seals, ret = -EINVAL;
 135         u32 i, flags;
 136
 137         ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL);
 138         if (!ubuf)
 139                 return -ENOMEM;
 140
 141         pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
 142         for (i = 0; i < head->count; i++) {
 143                 if (!IS_ALIGNED(list[i].offset, PAGE_SIZE))
 144                         goto err;
 145                 if (!IS_ALIGNED(list[i].size, PAGE_SIZE))
 146                         goto err;
 147                 ubuf->pagecount += list[i].size >> PAGE_SHIFT;
 148                 if (ubuf->pagecount > pglimit)
 149                         goto err;
 150         }
 151
 152         if (!ubuf->pagecount)
 153                 goto err;
 154
 155         ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
 156                                     GFP_KERNEL);
 157         if (!ubuf->pages) {
 158                 ret = -ENOMEM;
 159                 goto err;
 160         }
 161
 162         pgbuf = 0;
 163         for (i = 0; i < head->count; i++) {
 164                 ret = -EBADFD;
 165                 memfd = fget(list[i].memfd);
 166                 if (!memfd)
 167                         goto err;
 168                 if (!shmem_mapping(file_inode(memfd)->i_mapping))
 169                         goto err;
 170                 seals = memfd_fcntl(memfd, F_GET_SEALS, 0);
 171                 if (seals == -EINVAL)
 172                         goto err;
 173                 ret = -EINVAL;
 174                 if ((seals & SEALS_WANTED) != SEALS_WANTED ||
 175                     (seals & SEALS_DENIED) != 0)
 176                         goto err;
 177                 pgoff = list[i].offset >> PAGE_SHIFT;
 178                 pgcnt = list[i].size   >> PAGE_SHIFT;
 179                 for (pgidx = 0; pgidx < pgcnt; pgidx++) {
 180                         page = shmem_read_mapping_page(
 181                                 file_inode(memfd)->i_mapping, pgoff + pgidx);
 182                         if (IS_ERR(page)) {
 183                                 ret = PTR_ERR(page);
 184                                 goto err;
 185                         }
 186                         ubuf->pages[pgbuf++] = page;
 187                 }
 188                 fput(memfd);
 189                 memfd = NULL;
 190         }
 191
 192         exp_info.ops  = &udmabuf_ops;
 193         exp_info.size = ubuf->pagecount << PAGE_SHIFT;
 194         exp_info.priv = ubuf;
 195         exp_info.flags = O_RDWR;
 196
 197         buf = dma_buf_export(&exp_info);
 198         if (IS_ERR(buf)) {
 199                 ret = PTR_ERR(buf);
 200                 goto err;
 201         }
 202
 203         flags = 0;
 204         if (head->flags & UDMABUF_FLAGS_CLOEXEC)
 205                 flags |= O_CLOEXEC;
 206         return dma_buf_fd(buf, flags);
 207
 208 err:
 209         while (pgbuf > 0)
 210                 put_page(ubuf->pages[--pgbuf]);
 211         if (memfd)
 212                 fput(memfd);
 213         kfree(ubuf->pages);
 214         kfree(ubuf);
 215         return ret;
 216 }
 217
 218 static long udmabuf_ioctl_create(struct file *filp, unsigned long arg)
 219 {
 220         struct udmabuf_create create;
 221         struct udmabuf_create_list head;
 222         struct udmabuf_create_item list;
 223
 224         if (copy_from_user(&create, (void __user *)arg,
 225                            sizeof(create)))
 226                 return -EFAULT;
 227
 228         head.flags  = create.flags;
 229         head.count  = 1;
 230         list.memfd  = create.memfd;
 231         list.offset = create.offset;
 232         list.size   = create.size;
 233
 234         return udmabuf_create(&head, &list);
 235 }
 236
 237 static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg)
 238 {
 239         struct udmabuf_create_list head;
 240         struct udmabuf_create_item *list;
 241         int ret = -EINVAL;
 242         u32 lsize;
 243
 244         if (copy_from_user(&head, (void __user *)arg, sizeof(head)))
 245                 return -EFAULT;
 246         if (head.count > list_limit)
 247                 return -EINVAL;
 248         lsize = sizeof(struct udmabuf_create_item) * head.count;
 249         list = memdup_user((void __user *)(arg + sizeof(head)), lsize);
 250         if (IS_ERR(list))
 251                 return PTR_ERR(list);
 252
 253         ret = udmabuf_create(&head, list);
 254         kfree(list);
 255         return ret;
 256 }
 257
 258 static long udmabuf_ioctl(struct file *filp, unsigned int ioctl,
 259                           unsigned long arg)
 260 {
 261         long ret;
 262
 263         switch (ioctl) {
 264         case UDMABUF_CREATE:
 265                 ret = udmabuf_ioctl_create(filp, arg);
 266                 break;
 267         case UDMABUF_CREATE_LIST:
 268                 ret = udmabuf_ioctl_create_list(filp, arg);
 269                 break;
 270         default:
 271                 ret = -ENOTTY;
 272                 break;
 273         }
 274         return ret;
 275 }
 276
 277 static const struct file_operations udmabuf_fops = {
 278         .owner          = THIS_MODULE,
 279         .unlocked_ioctl = udmabuf_ioctl,
 280 };
 281
 282 static struct miscdevice udmabuf_misc = {
 283         .minor          = MISC_DYNAMIC_MINOR,
 284         .name           = "udmabuf",
 285         .fops           = &udmabuf_fops,
 286 };
 287
 288 static int __init udmabuf_dev_init(void)
 289 {
 290         int ret;
 291
 292         ret = misc_register(&udmabuf_misc);
 293         if (ret < 0) {
 294                 pr_err("Could not initialize udmabuf device\n");
 295                 return ret;
 296         }
 297
 298         ret = dma_coerce_mask_and_coherent(udmabuf_misc.this_device,
 299                                            DMA_BIT_MASK(64));
 300         if (ret < 0) {
 301                 pr_err("Could not setup DMA mask for udmabuf device\n");
 302                 misc_deregister(&udmabuf_misc);
 303                 return ret;
 304         }
 305
 306         return 0;
 307 }
 308
 309 static void __exit udmabuf_dev_exit(void)
 310 {
 311         misc_deregister(&udmabuf_misc);
 312 }
 313
 314 module_init(udmabuf_dev_init)
 315 module_exit(udmabuf_dev_exit)
 316
 317 MODULE_AUTHOR("Gerd Hoffmann <kraxel@redhat.com>");
 318 MODULE_LICENSE("GPL v2");