drivers/dma-buf/udmabuf.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <linux/cred.h>
   3 #include <linux/device.h>
   4 #include <linux/dma-buf.h>
   5 #include <linux/highmem.h>
   6 #include <linux/init.h>
   7 #include <linux/kernel.h>
   8 #include <linux/memfd.h>
   9 #include <linux/miscdevice.h>
  10 #include <linux/module.h>
  11 #include <linux/shmem_fs.h>
  12 #include <linux/slab.h>
  13 #include <linux/udmabuf.h>
  14
  15 static const u32    list_limit = 1024;  /* udmabuf_create_list->count limit */
  16 static const size_t size_limit_mb = 64; /* total dmabuf size, in megabytes  */
  17
  18 struct udmabuf {
  19         pgoff_t pagecount;
  20         struct page **pages;
  21         struct sg_table *sg;
  22         struct miscdevice *device;
  23 };
  24
  25 static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf)
  26 {
  27         struct vm_area_struct *vma = vmf->vma;
  28         struct udmabuf *ubuf = vma->vm_private_data;
  29         pgoff_t pgoff = vmf->pgoff;
  30
  31         if (pgoff >= ubuf->pagecount)
  32                 return VM_FAULT_SIGBUS;
  33         vmf->page = ubuf->pages[pgoff];
  34         get_page(vmf->page);
  35         return 0;
  36 }
  37
  38 static const struct vm_operations_struct udmabuf_vm_ops = {
  39         .fault = udmabuf_vm_fault,
  40 };
  41
  42 static int mmap_udmabuf(struct dma_buf *buf, struct vm_area_struct *vma)
  43 {
  44         struct udmabuf *ubuf = buf->priv;
  45
  46         if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) == 0)
  47                 return -EINVAL;
  48
  49         vma->vm_ops = &udmabuf_vm_ops;
  50         vma->vm_private_data = ubuf;
  51         return 0;
  52 }
  53
  54 static struct sg_table *get_sg_table(struct device *dev, struct dma_buf *buf,
  55                                      enum dma_data_direction direction)
  56 {
  57         struct udmabuf *ubuf = buf->priv;
  58         struct sg_table *sg;
  59         int ret;
  60
  61         sg = kzalloc(sizeof(*sg), GFP_KERNEL);
  62         if (!sg)
  63                 return ERR_PTR(-ENOMEM);
  64         ret = sg_alloc_table_from_pages(sg, ubuf->pages, ubuf->pagecount,
  65                                         0, ubuf->pagecount << PAGE_SHIFT,
  66                                         GFP_KERNEL);
  67         if (ret < 0)
  68                 goto err;
  69         ret = dma_map_sgtable(dev, sg, direction, 0);
  70         if (ret < 0)
  71                 goto err;
  72         return sg;
  73
  74 err:
  75         sg_free_table(sg);
  76         kfree(sg);
  77         return ERR_PTR(ret);
  78 }
  79
  80 static void put_sg_table(struct device *dev, struct sg_table *sg,
  81                          enum dma_data_direction direction)
  82 {
  83         dma_unmap_sgtable(dev, sg, direction, 0);
  84         sg_free_table(sg);
  85         kfree(sg);
  86 }
  87
  88 static struct sg_table *map_udmabuf(struct dma_buf_attachment *at,
  89                                     enum dma_data_direction direction)
  90 {
  91         return get_sg_table(at->dev, at->dmabuf, direction);
  92 }
  93
  94 static void unmap_udmabuf(struct dma_buf_attachment *at,
  95                           struct sg_table *sg,
  96                           enum dma_data_direction direction)
  97 {
  98         return put_sg_table(at->dev, sg, direction);
  99 }
 100
 101 static void release_udmabuf(struct dma_buf *buf)
 102 {
 103         struct udmabuf *ubuf = buf->priv;
 104         struct device *dev = ubuf->device->this_device;
 105         pgoff_t pg;
 106
 107         if (ubuf->sg)
 108                 put_sg_table(dev, ubuf->sg, DMA_BIDIRECTIONAL);
 109
 110         for (pg = 0; pg < ubuf->pagecount; pg++)
 111                 put_page(ubuf->pages[pg]);
 112         kfree(ubuf->pages);
 113         kfree(ubuf);
 114 }
 115
 116 static int begin_cpu_udmabuf(struct dma_buf *buf,
 117                              enum dma_data_direction direction)
 118 {
 119         struct udmabuf *ubuf = buf->priv;
 120         struct device *dev = ubuf->device->this_device;
 121         int ret = 0;
 122
 123         if (!ubuf->sg) {
 124                 ubuf->sg = get_sg_table(dev, buf, direction);
 125                 if (IS_ERR(ubuf->sg)) {
 126                         ret = PTR_ERR(ubuf->sg);
 127                         ubuf->sg = NULL;
 128                 }
 129         } else {
 130                 dma_sync_sg_for_cpu(dev, ubuf->sg->sgl, ubuf->sg->nents,
 131                                     direction);
 132         }
 133
 134         return ret;
 135 }
 136
 137 static int end_cpu_udmabuf(struct dma_buf *buf,
 138                            enum dma_data_direction direction)
 139 {
 140         struct udmabuf *ubuf = buf->priv;
 141         struct device *dev = ubuf->device->this_device;
 142
 143         if (!ubuf->sg)
 144                 return -EINVAL;
 145
 146         dma_sync_sg_for_device(dev, ubuf->sg->sgl, ubuf->sg->nents, direction);
 147         return 0;
 148 }
 149
 150 static const struct dma_buf_ops udmabuf_ops = {
 151         .cache_sgt_mapping = true,
 152         .map_dma_buf       = map_udmabuf,
 153         .unmap_dma_buf     = unmap_udmabuf,
 154         .release           = release_udmabuf,
 155         .mmap              = mmap_udmabuf,
 156         .begin_cpu_access  = begin_cpu_udmabuf,
 157         .end_cpu_access    = end_cpu_udmabuf,
 158 };
 159
 160 #define SEALS_WANTED (F_SEAL_SHRINK)
 161 #define SEALS_DENIED (F_SEAL_WRITE)
 162
 163 static long udmabuf_create(struct miscdevice *device,
 164                            struct udmabuf_create_list *head,
 165                            struct udmabuf_create_item *list)
 166 {
 167         DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
 168         struct file *memfd = NULL;
 169         struct udmabuf *ubuf;
 170         struct dma_buf *buf;
 171         pgoff_t pgoff, pgcnt, pgidx, pgbuf = 0, pglimit;
 172         struct page *page;
 173         int seals, ret = -EINVAL;
 174         u32 i, flags;
 175
 176         ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL);
 177         if (!ubuf)
 178                 return -ENOMEM;
 179
 180         pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
 181         for (i = 0; i < head->count; i++) {
 182                 if (!IS_ALIGNED(list[i].offset, PAGE_SIZE))
 183                         goto err;
 184                 if (!IS_ALIGNED(list[i].size, PAGE_SIZE))
 185                         goto err;
 186                 ubuf->pagecount += list[i].size >> PAGE_SHIFT;
 187                 if (ubuf->pagecount > pglimit)
 188                         goto err;
 189         }
 190
 191         if (!ubuf->pagecount)
 192                 goto err;
 193
 194         ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
 195                                     GFP_KERNEL);
 196         if (!ubuf->pages) {
 197                 ret = -ENOMEM;
 198                 goto err;
 199         }
 200
 201         pgbuf = 0;
 202         for (i = 0; i < head->count; i++) {
 203                 ret = -EBADFD;
 204                 memfd = fget(list[i].memfd);
 205                 if (!memfd)
 206                         goto err;
 207                 if (!shmem_mapping(file_inode(memfd)->i_mapping))
 208                         goto err;
 209                 seals = memfd_fcntl(memfd, F_GET_SEALS, 0);
 210                 if (seals == -EINVAL)
 211                         goto err;
 212                 ret = -EINVAL;
 213                 if ((seals & SEALS_WANTED) != SEALS_WANTED ||
 214                     (seals & SEALS_DENIED) != 0)
 215                         goto err;
 216                 pgoff = list[i].offset >> PAGE_SHIFT;
 217                 pgcnt = list[i].size   >> PAGE_SHIFT;
 218                 for (pgidx = 0; pgidx < pgcnt; pgidx++) {
 219                         page = shmem_read_mapping_page(
 220                                 file_inode(memfd)->i_mapping, pgoff + pgidx);
 221                         if (IS_ERR(page)) {
 222                                 ret = PTR_ERR(page);
 223                                 goto err;
 224                         }
 225                         ubuf->pages[pgbuf++] = page;
 226                 }
 227                 fput(memfd);
 228                 memfd = NULL;
 229         }
 230
 231         exp_info.ops  = &udmabuf_ops;
 232         exp_info.size = ubuf->pagecount << PAGE_SHIFT;
 233         exp_info.priv = ubuf;
 234         exp_info.flags = O_RDWR;
 235
 236         ubuf->device = device;
 237         buf = dma_buf_export(&exp_info);
 238         if (IS_ERR(buf)) {
 239                 ret = PTR_ERR(buf);
 240                 goto err;
 241         }
 242
 243         flags = 0;
 244         if (head->flags & UDMABUF_FLAGS_CLOEXEC)
 245                 flags |= O_CLOEXEC;
 246         return dma_buf_fd(buf, flags);
 247
 248 err:
 249         while (pgbuf > 0)
 250                 put_page(ubuf->pages[--pgbuf]);
 251         if (memfd)
 252                 fput(memfd);
 253         kfree(ubuf->pages);
 254         kfree(ubuf);
 255         return ret;
 256 }
 257
 258 static long udmabuf_ioctl_create(struct file *filp, unsigned long arg)
 259 {
 260         struct udmabuf_create create;
 261         struct udmabuf_create_list head;
 262         struct udmabuf_create_item list;
 263
 264         if (copy_from_user(&create, (void __user *)arg,
 265                            sizeof(create)))
 266                 return -EFAULT;
 267
 268         head.flags  = create.flags;
 269         head.count  = 1;
 270         list.memfd  = create.memfd;
 271         list.offset = create.offset;
 272         list.size   = create.size;
 273
 274         return udmabuf_create(filp->private_data, &head, &list);
 275 }
 276
 277 static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg)
 278 {
 279         struct udmabuf_create_list head;
 280         struct udmabuf_create_item *list;
 281         int ret = -EINVAL;
 282         u32 lsize;
 283
 284         if (copy_from_user(&head, (void __user *)arg, sizeof(head)))
 285                 return -EFAULT;
 286         if (head.count > list_limit)
 287                 return -EINVAL;
 288         lsize = sizeof(struct udmabuf_create_item) * head.count;
 289         list = memdup_user((void __user *)(arg + sizeof(head)), lsize);
 290         if (IS_ERR(list))
 291                 return PTR_ERR(list);
 292
 293         ret = udmabuf_create(filp->private_data, &head, list);
 294         kfree(list);
 295         return ret;
 296 }
 297
 298 static long udmabuf_ioctl(struct file *filp, unsigned int ioctl,
 299                           unsigned long arg)
 300 {
 301         long ret;
 302
 303         switch (ioctl) {
 304         case UDMABUF_CREATE:
 305                 ret = udmabuf_ioctl_create(filp, arg);
 306                 break;
 307         case UDMABUF_CREATE_LIST:
 308                 ret = udmabuf_ioctl_create_list(filp, arg);
 309                 break;
 310         default:
 311                 ret = -ENOTTY;
 312                 break;
 313         }
 314         return ret;
 315 }
 316
 317 static const struct file_operations udmabuf_fops = {
 318         .owner          = THIS_MODULE,
 319         .unlocked_ioctl = udmabuf_ioctl,
 320 #ifdef CONFIG_COMPAT
 321         .compat_ioctl   = udmabuf_ioctl,
 322 #endif
 323 };
 324
 325 static struct miscdevice udmabuf_misc = {
 326         .minor          = MISC_DYNAMIC_MINOR,
 327         .name           = "udmabuf",
 328         .fops           = &udmabuf_fops,
 329 };
 330
 331 static int __init udmabuf_dev_init(void)
 332 {
 333         int ret;
 334
 335         ret = misc_register(&udmabuf_misc);
 336         if (ret < 0) {
 337                 pr_err("Could not initialize udmabuf device\n");
 338                 return ret;
 339         }
 340
 341         ret = dma_coerce_mask_and_coherent(udmabuf_misc.this_device,
 342                                            DMA_BIT_MASK(64));
 343         if (ret < 0) {
 344                 pr_err("Could not setup DMA mask for udmabuf device\n");
 345                 misc_deregister(&udmabuf_misc);
 346                 return ret;
 347         }
 348
 349         return 0;
 350 }
 351
 352 static void __exit udmabuf_dev_exit(void)
 353 {
 354         misc_deregister(&udmabuf_misc);
 355 }
 356
 357 module_init(udmabuf_dev_init)
 358 module_exit(udmabuf_dev_exit)
 359
 360 MODULE_AUTHOR("Gerd Hoffmann <kraxel@redhat.com>");
 361 MODULE_LICENSE("GPL v2");