drivers/dma-buf/udmabuf.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <linux/cred.h>
   3 #include <linux/device.h>
   4 #include <linux/dma-buf.h>
   5 #include <linux/highmem.h>
   6 #include <linux/init.h>
   7 #include <linux/kernel.h>
   8 #include <linux/memfd.h>
   9 #include <linux/miscdevice.h>
  10 #include <linux/module.h>
  11 #include <linux/shmem_fs.h>
  12 #include <linux/slab.h>
  13 #include <linux/udmabuf.h>
  14
  15 static const u32    list_limit = 1024;  /* udmabuf_create_list->count limit */
  16 static const size_t size_limit_mb = 64; /* total dmabuf size, in megabytes  */
  17
  18 struct udmabuf {
  19         pgoff_t pagecount;
  20         struct page **pages;
  21 };
  22
  23 static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf)
  24 {
  25         struct vm_area_struct *vma = vmf->vma;
  26         struct udmabuf *ubuf = vma->vm_private_data;
  27
  28         vmf->page = ubuf->pages[vmf->pgoff];
  29         get_page(vmf->page);
  30         return 0;
  31 }
  32
  33 static const struct vm_operations_struct udmabuf_vm_ops = {
  34         .fault = udmabuf_vm_fault,
  35 };
  36
  37 static int mmap_udmabuf(struct dma_buf *buf, struct vm_area_struct *vma)
  38 {
  39         struct udmabuf *ubuf = buf->priv;
  40
  41         if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) == 0)
  42                 return -EINVAL;
  43
  44         vma->vm_ops = &udmabuf_vm_ops;
  45         vma->vm_private_data = ubuf;
  46         return 0;
  47 }
  48
  49 static struct sg_table *map_udmabuf(struct dma_buf_attachment *at,
  50                                     enum dma_data_direction direction)
  51 {
  52         struct udmabuf *ubuf = at->dmabuf->priv;
  53         struct sg_table *sg;
  54         int ret;
  55
  56         sg = kzalloc(sizeof(*sg), GFP_KERNEL);
  57         if (!sg)
  58                 return ERR_PTR(-ENOMEM);
  59         ret = sg_alloc_table_from_pages(sg, ubuf->pages, ubuf->pagecount,
  60                                         0, ubuf->pagecount << PAGE_SHIFT,
  61                                         GFP_KERNEL);
  62         if (ret < 0)
  63                 goto err;
  64         if (!dma_map_sg(at->dev, sg->sgl, sg->nents, direction)) {
  65                 ret = -EINVAL;
  66                 goto err;
  67         }
  68         return sg;
  69
  70 err:
  71         sg_free_table(sg);
  72         kfree(sg);
  73         return ERR_PTR(ret);
  74 }
  75
  76 static void unmap_udmabuf(struct dma_buf_attachment *at,
  77                           struct sg_table *sg,
  78                           enum dma_data_direction direction)
  79 {
  80         dma_unmap_sg(at->dev, sg->sgl, sg->nents, direction);
  81         sg_free_table(sg);
  82         kfree(sg);
  83 }
  84
  85 static void release_udmabuf(struct dma_buf *buf)
  86 {
  87         struct udmabuf *ubuf = buf->priv;
  88         pgoff_t pg;
  89
  90         for (pg = 0; pg < ubuf->pagecount; pg++)
  91                 put_page(ubuf->pages[pg]);
  92         kfree(ubuf->pages);
  93         kfree(ubuf);
  94 }
  95
  96 static void *kmap_udmabuf(struct dma_buf *buf, unsigned long page_num)
  97 {
  98         struct udmabuf *ubuf = buf->priv;
  99         struct page *page = ubuf->pages[page_num];
 100
 101         return kmap(page);
 102 }
 103
 104 static void kunmap_udmabuf(struct dma_buf *buf, unsigned long page_num,
 105                            void *vaddr)
 106 {
 107         kunmap(vaddr);
 108 }
 109
 110 static const struct dma_buf_ops udmabuf_ops = {
 111         .map_dma_buf      = map_udmabuf,
 112         .unmap_dma_buf    = unmap_udmabuf,
 113         .release          = release_udmabuf,
 114         .map              = kmap_udmabuf,
 115         .unmap            = kunmap_udmabuf,
 116         .mmap             = mmap_udmabuf,
 117 };
 118
 119 #define SEALS_WANTED (F_SEAL_SHRINK)
 120 #define SEALS_DENIED (F_SEAL_WRITE)
 121
 122 static long udmabuf_create(const struct udmabuf_create_list *head,
 123                            const struct udmabuf_create_item *list)
 124 {
 125         DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
 126         struct file *memfd = NULL;
 127         struct udmabuf *ubuf;
 128         struct dma_buf *buf;
 129         pgoff_t pgoff, pgcnt, pgidx, pgbuf = 0, pglimit;
 130         struct page *page;
 131         int seals, ret = -EINVAL;
 132         u32 i, flags;
 133
 134         ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL);
 135         if (!ubuf)
 136                 return -ENOMEM;
 137
 138         pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
 139         for (i = 0; i < head->count; i++) {
 140                 if (!IS_ALIGNED(list[i].offset, PAGE_SIZE))
 141                         goto err;
 142                 if (!IS_ALIGNED(list[i].size, PAGE_SIZE))
 143                         goto err;
 144                 ubuf->pagecount += list[i].size >> PAGE_SHIFT;
 145                 if (ubuf->pagecount > pglimit)
 146                         goto err;
 147         }
 148
 149         if (!ubuf->pagecount)
 150                 goto err;
 151
 152         ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
 153                                     GFP_KERNEL);
 154         if (!ubuf->pages) {
 155                 ret = -ENOMEM;
 156                 goto err;
 157         }
 158
 159         pgbuf = 0;
 160         for (i = 0; i < head->count; i++) {
 161                 ret = -EBADFD;
 162                 memfd = fget(list[i].memfd);
 163                 if (!memfd)
 164                         goto err;
 165                 if (!shmem_mapping(file_inode(memfd)->i_mapping))
 166                         goto err;
 167                 seals = memfd_fcntl(memfd, F_GET_SEALS, 0);
 168                 if (seals == -EINVAL)
 169                         goto err;
 170                 ret = -EINVAL;
 171                 if ((seals & SEALS_WANTED) != SEALS_WANTED ||
 172                     (seals & SEALS_DENIED) != 0)
 173                         goto err;
 174                 pgoff = list[i].offset >> PAGE_SHIFT;
 175                 pgcnt = list[i].size   >> PAGE_SHIFT;
 176                 for (pgidx = 0; pgidx < pgcnt; pgidx++) {
 177                         page = shmem_read_mapping_page(
 178                                 file_inode(memfd)->i_mapping, pgoff + pgidx);
 179                         if (IS_ERR(page)) {
 180                                 ret = PTR_ERR(page);
 181                                 goto err;
 182                         }
 183                         ubuf->pages[pgbuf++] = page;
 184                 }
 185                 fput(memfd);
 186                 memfd = NULL;
 187         }
 188
 189         exp_info.ops  = &udmabuf_ops;
 190         exp_info.size = ubuf->pagecount << PAGE_SHIFT;
 191         exp_info.priv = ubuf;
 192         exp_info.flags = O_RDWR;
 193
 194         buf = dma_buf_export(&exp_info);
 195         if (IS_ERR(buf)) {
 196                 ret = PTR_ERR(buf);
 197                 goto err;
 198         }
 199
 200         flags = 0;
 201         if (head->flags & UDMABUF_FLAGS_CLOEXEC)
 202                 flags |= O_CLOEXEC;
 203         return dma_buf_fd(buf, flags);
 204
 205 err:
 206         while (pgbuf > 0)
 207                 put_page(ubuf->pages[--pgbuf]);
 208         if (memfd)
 209                 fput(memfd);
 210         kfree(ubuf->pages);
 211         kfree(ubuf);
 212         return ret;
 213 }
 214
 215 static long udmabuf_ioctl_create(struct file *filp, unsigned long arg)
 216 {
 217         struct udmabuf_create create;
 218         struct udmabuf_create_list head;
 219         struct udmabuf_create_item list;
 220
 221         if (copy_from_user(&create, (void __user *)arg,
 222                            sizeof(create)))
 223                 return -EFAULT;
 224
 225         head.flags  = create.flags;
 226         head.count  = 1;
 227         list.memfd  = create.memfd;
 228         list.offset = create.offset;
 229         list.size   = create.size;
 230
 231         return udmabuf_create(&head, &list);
 232 }
 233
 234 static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg)
 235 {
 236         struct udmabuf_create_list head;
 237         struct udmabuf_create_item *list;
 238         int ret = -EINVAL;
 239         u32 lsize;
 240
 241         if (copy_from_user(&head, (void __user *)arg, sizeof(head)))
 242                 return -EFAULT;
 243         if (head.count > list_limit)
 244                 return -EINVAL;
 245         lsize = sizeof(struct udmabuf_create_item) * head.count;
 246         list = memdup_user((void __user *)(arg + sizeof(head)), lsize);
 247         if (IS_ERR(list))
 248                 return PTR_ERR(list);
 249
 250         ret = udmabuf_create(&head, list);
 251         kfree(list);
 252         return ret;
 253 }
 254
 255 static long udmabuf_ioctl(struct file *filp, unsigned int ioctl,
 256                           unsigned long arg)
 257 {
 258         long ret;
 259
 260         switch (ioctl) {
 261         case UDMABUF_CREATE:
 262                 ret = udmabuf_ioctl_create(filp, arg);
 263                 break;
 264         case UDMABUF_CREATE_LIST:
 265                 ret = udmabuf_ioctl_create_list(filp, arg);
 266                 break;
 267         default:
 268                 ret = -ENOTTY;
 269                 break;
 270         }
 271         return ret;
 272 }
 273
 274 static const struct file_operations udmabuf_fops = {
 275         .owner          = THIS_MODULE,
 276         .unlocked_ioctl = udmabuf_ioctl,
 277 };
 278
 279 static struct miscdevice udmabuf_misc = {
 280         .minor          = MISC_DYNAMIC_MINOR,
 281         .name           = "udmabuf",
 282         .fops           = &udmabuf_fops,
 283 };
 284
 285 static int __init udmabuf_dev_init(void)
 286 {
 287         return misc_register(&udmabuf_misc);
 288 }
 289
 290 static void __exit udmabuf_dev_exit(void)
 291 {
 292         misc_deregister(&udmabuf_misc);
 293 }
 294
 295 module_init(udmabuf_dev_init)
 296 module_exit(udmabuf_dev_exit)
 297
 298 MODULE_AUTHOR("Gerd Hoffmann <kraxel@redhat.com>");
 299 MODULE_LICENSE("GPL v2");