xref: /openbmc/linux/drivers/dma-buf/udmabuf.c (revision af9b2ff010f593d81e2f5fb04155e9fc25b9dfd0)
1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/cred.h>
3 #include <linux/device.h>
4 #include <linux/dma-buf.h>
5 #include <linux/dma-resv.h>
6 #include <linux/highmem.h>
7 #include <linux/init.h>
8 #include <linux/kernel.h>
9 #include <linux/memfd.h>
10 #include <linux/miscdevice.h>
11 #include <linux/module.h>
12 #include <linux/shmem_fs.h>
13 #include <linux/slab.h>
14 #include <linux/udmabuf.h>
15 #include <linux/vmalloc.h>
16 #include <linux/iosys-map.h>
17 
18 static int list_limit = 1024;
19 module_param(list_limit, int, 0644);
20 MODULE_PARM_DESC(list_limit, "udmabuf_create_list->count limit. Default is 1024.");
21 
22 static int size_limit_mb = 64;
23 module_param(size_limit_mb, int, 0644);
24 MODULE_PARM_DESC(size_limit_mb, "Max size of a dmabuf, in megabytes. Default is 64.");
25 
26 struct udmabuf {
27 	pgoff_t pagecount;
28 	struct page **pages;
29 	struct sg_table *sg;
30 	struct miscdevice *device;
31 };
32 
udmabuf_vm_fault(struct vm_fault * vmf)33 static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf)
34 {
35 	struct vm_area_struct *vma = vmf->vma;
36 	struct udmabuf *ubuf = vma->vm_private_data;
37 	pgoff_t pgoff = vmf->pgoff;
38 	unsigned long pfn;
39 
40 	if (pgoff >= ubuf->pagecount)
41 		return VM_FAULT_SIGBUS;
42 
43 	pfn = page_to_pfn(ubuf->pages[pgoff]);
44 	return vmf_insert_pfn(vma, vmf->address, pfn);
45 }
46 
47 static const struct vm_operations_struct udmabuf_vm_ops = {
48 	.fault = udmabuf_vm_fault,
49 };
50 
mmap_udmabuf(struct dma_buf * buf,struct vm_area_struct * vma)51 static int mmap_udmabuf(struct dma_buf *buf, struct vm_area_struct *vma)
52 {
53 	struct udmabuf *ubuf = buf->priv;
54 
55 	if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) == 0)
56 		return -EINVAL;
57 
58 	vma->vm_ops = &udmabuf_vm_ops;
59 	vma->vm_private_data = ubuf;
60 	vm_flags_set(vma, VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP);
61 	return 0;
62 }
63 
vmap_udmabuf(struct dma_buf * buf,struct iosys_map * map)64 static int vmap_udmabuf(struct dma_buf *buf, struct iosys_map *map)
65 {
66 	struct udmabuf *ubuf = buf->priv;
67 	void *vaddr;
68 
69 	dma_resv_assert_held(buf->resv);
70 
71 	vaddr = vm_map_ram(ubuf->pages, ubuf->pagecount, -1);
72 	if (!vaddr)
73 		return -EINVAL;
74 
75 	iosys_map_set_vaddr(map, vaddr);
76 	return 0;
77 }
78 
vunmap_udmabuf(struct dma_buf * buf,struct iosys_map * map)79 static void vunmap_udmabuf(struct dma_buf *buf, struct iosys_map *map)
80 {
81 	struct udmabuf *ubuf = buf->priv;
82 
83 	dma_resv_assert_held(buf->resv);
84 
85 	vm_unmap_ram(map->vaddr, ubuf->pagecount);
86 }
87 
get_sg_table(struct device * dev,struct dma_buf * buf,enum dma_data_direction direction)88 static struct sg_table *get_sg_table(struct device *dev, struct dma_buf *buf,
89 				     enum dma_data_direction direction)
90 {
91 	struct udmabuf *ubuf = buf->priv;
92 	struct sg_table *sg;
93 	int ret;
94 
95 	sg = kzalloc(sizeof(*sg), GFP_KERNEL);
96 	if (!sg)
97 		return ERR_PTR(-ENOMEM);
98 	ret = sg_alloc_table_from_pages(sg, ubuf->pages, ubuf->pagecount,
99 					0, ubuf->pagecount << PAGE_SHIFT,
100 					GFP_KERNEL);
101 	if (ret < 0)
102 		goto err;
103 	ret = dma_map_sgtable(dev, sg, direction, 0);
104 	if (ret < 0)
105 		goto err;
106 	return sg;
107 
108 err:
109 	sg_free_table(sg);
110 	kfree(sg);
111 	return ERR_PTR(ret);
112 }
113 
put_sg_table(struct device * dev,struct sg_table * sg,enum dma_data_direction direction)114 static void put_sg_table(struct device *dev, struct sg_table *sg,
115 			 enum dma_data_direction direction)
116 {
117 	dma_unmap_sgtable(dev, sg, direction, 0);
118 	sg_free_table(sg);
119 	kfree(sg);
120 }
121 
map_udmabuf(struct dma_buf_attachment * at,enum dma_data_direction direction)122 static struct sg_table *map_udmabuf(struct dma_buf_attachment *at,
123 				    enum dma_data_direction direction)
124 {
125 	return get_sg_table(at->dev, at->dmabuf, direction);
126 }
127 
unmap_udmabuf(struct dma_buf_attachment * at,struct sg_table * sg,enum dma_data_direction direction)128 static void unmap_udmabuf(struct dma_buf_attachment *at,
129 			  struct sg_table *sg,
130 			  enum dma_data_direction direction)
131 {
132 	return put_sg_table(at->dev, sg, direction);
133 }
134 
release_udmabuf(struct dma_buf * buf)135 static void release_udmabuf(struct dma_buf *buf)
136 {
137 	struct udmabuf *ubuf = buf->priv;
138 	struct device *dev = ubuf->device->this_device;
139 	pgoff_t pg;
140 
141 	if (ubuf->sg)
142 		put_sg_table(dev, ubuf->sg, DMA_BIDIRECTIONAL);
143 
144 	for (pg = 0; pg < ubuf->pagecount; pg++)
145 		put_page(ubuf->pages[pg]);
146 	kfree(ubuf->pages);
147 	kfree(ubuf);
148 }
149 
begin_cpu_udmabuf(struct dma_buf * buf,enum dma_data_direction direction)150 static int begin_cpu_udmabuf(struct dma_buf *buf,
151 			     enum dma_data_direction direction)
152 {
153 	struct udmabuf *ubuf = buf->priv;
154 	struct device *dev = ubuf->device->this_device;
155 	int ret = 0;
156 
157 	if (!ubuf->sg) {
158 		ubuf->sg = get_sg_table(dev, buf, direction);
159 		if (IS_ERR(ubuf->sg)) {
160 			ret = PTR_ERR(ubuf->sg);
161 			ubuf->sg = NULL;
162 		}
163 	} else {
164 		dma_sync_sgtable_for_cpu(dev, ubuf->sg, direction);
165 	}
166 
167 	return ret;
168 }
169 
end_cpu_udmabuf(struct dma_buf * buf,enum dma_data_direction direction)170 static int end_cpu_udmabuf(struct dma_buf *buf,
171 			   enum dma_data_direction direction)
172 {
173 	struct udmabuf *ubuf = buf->priv;
174 	struct device *dev = ubuf->device->this_device;
175 
176 	if (!ubuf->sg)
177 		return -EINVAL;
178 
179 	dma_sync_sgtable_for_device(dev, ubuf->sg, direction);
180 	return 0;
181 }
182 
183 static const struct dma_buf_ops udmabuf_ops = {
184 	.cache_sgt_mapping = true,
185 	.map_dma_buf	   = map_udmabuf,
186 	.unmap_dma_buf	   = unmap_udmabuf,
187 	.release	   = release_udmabuf,
188 	.mmap		   = mmap_udmabuf,
189 	.vmap		   = vmap_udmabuf,
190 	.vunmap		   = vunmap_udmabuf,
191 	.begin_cpu_access  = begin_cpu_udmabuf,
192 	.end_cpu_access    = end_cpu_udmabuf,
193 };
194 
195 #define SEALS_WANTED (F_SEAL_SHRINK)
196 #define SEALS_DENIED (F_SEAL_WRITE|F_SEAL_FUTURE_WRITE)
197 
udmabuf_create(struct miscdevice * device,struct udmabuf_create_list * head,struct udmabuf_create_item * list)198 static long udmabuf_create(struct miscdevice *device,
199 			   struct udmabuf_create_list *head,
200 			   struct udmabuf_create_item *list)
201 {
202 	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
203 	struct file *memfd = NULL;
204 	struct address_space *mapping = NULL;
205 	struct udmabuf *ubuf;
206 	struct dma_buf *buf;
207 	pgoff_t pgoff, pgcnt, pgidx, pgbuf = 0, pglimit;
208 	struct page *page;
209 	int seals, ret = -EINVAL;
210 	u32 i, flags;
211 
212 	ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL);
213 	if (!ubuf)
214 		return -ENOMEM;
215 
216 	pglimit = ((u64)size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
217 	for (i = 0; i < head->count; i++) {
218 		if (!IS_ALIGNED(list[i].offset, PAGE_SIZE))
219 			goto err;
220 		if (!IS_ALIGNED(list[i].size, PAGE_SIZE))
221 			goto err;
222 		ubuf->pagecount += list[i].size >> PAGE_SHIFT;
223 		if (ubuf->pagecount > pglimit)
224 			goto err;
225 	}
226 
227 	if (!ubuf->pagecount)
228 		goto err;
229 
230 	ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
231 				    GFP_KERNEL);
232 	if (!ubuf->pages) {
233 		ret = -ENOMEM;
234 		goto err;
235 	}
236 
237 	pgbuf = 0;
238 	for (i = 0; i < head->count; i++) {
239 		ret = -EBADFD;
240 		memfd = fget(list[i].memfd);
241 		if (!memfd)
242 			goto err;
243 		mapping = memfd->f_mapping;
244 		if (!shmem_mapping(mapping))
245 			goto err;
246 		seals = memfd_fcntl(memfd, F_GET_SEALS, 0);
247 		if (seals == -EINVAL)
248 			goto err;
249 		ret = -EINVAL;
250 		if ((seals & SEALS_WANTED) != SEALS_WANTED ||
251 		    (seals & SEALS_DENIED) != 0)
252 			goto err;
253 		pgoff = list[i].offset >> PAGE_SHIFT;
254 		pgcnt = list[i].size   >> PAGE_SHIFT;
255 		for (pgidx = 0; pgidx < pgcnt; pgidx++) {
256 			page = shmem_read_mapping_page(mapping, pgoff + pgidx);
257 			if (IS_ERR(page)) {
258 				ret = PTR_ERR(page);
259 				goto err;
260 			}
261 			ubuf->pages[pgbuf++] = page;
262 		}
263 		fput(memfd);
264 		memfd = NULL;
265 	}
266 
267 	exp_info.ops  = &udmabuf_ops;
268 	exp_info.size = ubuf->pagecount << PAGE_SHIFT;
269 	exp_info.priv = ubuf;
270 	exp_info.flags = O_RDWR;
271 
272 	ubuf->device = device;
273 	buf = dma_buf_export(&exp_info);
274 	if (IS_ERR(buf)) {
275 		ret = PTR_ERR(buf);
276 		goto err;
277 	}
278 
279 	flags = 0;
280 	if (head->flags & UDMABUF_FLAGS_CLOEXEC)
281 		flags |= O_CLOEXEC;
282 	return dma_buf_fd(buf, flags);
283 
284 err:
285 	while (pgbuf > 0)
286 		put_page(ubuf->pages[--pgbuf]);
287 	if (memfd)
288 		fput(memfd);
289 	kfree(ubuf->pages);
290 	kfree(ubuf);
291 	return ret;
292 }
293 
udmabuf_ioctl_create(struct file * filp,unsigned long arg)294 static long udmabuf_ioctl_create(struct file *filp, unsigned long arg)
295 {
296 	struct udmabuf_create create;
297 	struct udmabuf_create_list head;
298 	struct udmabuf_create_item list;
299 
300 	if (copy_from_user(&create, (void __user *)arg,
301 			   sizeof(create)))
302 		return -EFAULT;
303 
304 	head.flags  = create.flags;
305 	head.count  = 1;
306 	list.memfd  = create.memfd;
307 	list.offset = create.offset;
308 	list.size   = create.size;
309 
310 	return udmabuf_create(filp->private_data, &head, &list);
311 }
312 
udmabuf_ioctl_create_list(struct file * filp,unsigned long arg)313 static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg)
314 {
315 	struct udmabuf_create_list head;
316 	struct udmabuf_create_item *list;
317 	int ret = -EINVAL;
318 	u32 lsize;
319 
320 	if (copy_from_user(&head, (void __user *)arg, sizeof(head)))
321 		return -EFAULT;
322 	if (head.count > list_limit)
323 		return -EINVAL;
324 	lsize = sizeof(struct udmabuf_create_item) * head.count;
325 	list = memdup_user((void __user *)(arg + sizeof(head)), lsize);
326 	if (IS_ERR(list))
327 		return PTR_ERR(list);
328 
329 	ret = udmabuf_create(filp->private_data, &head, list);
330 	kfree(list);
331 	return ret;
332 }
333 
udmabuf_ioctl(struct file * filp,unsigned int ioctl,unsigned long arg)334 static long udmabuf_ioctl(struct file *filp, unsigned int ioctl,
335 			  unsigned long arg)
336 {
337 	long ret;
338 
339 	switch (ioctl) {
340 	case UDMABUF_CREATE:
341 		ret = udmabuf_ioctl_create(filp, arg);
342 		break;
343 	case UDMABUF_CREATE_LIST:
344 		ret = udmabuf_ioctl_create_list(filp, arg);
345 		break;
346 	default:
347 		ret = -ENOTTY;
348 		break;
349 	}
350 	return ret;
351 }
352 
353 static const struct file_operations udmabuf_fops = {
354 	.owner		= THIS_MODULE,
355 	.unlocked_ioctl = udmabuf_ioctl,
356 #ifdef CONFIG_COMPAT
357 	.compat_ioctl   = udmabuf_ioctl,
358 #endif
359 };
360 
361 static struct miscdevice udmabuf_misc = {
362 	.minor          = MISC_DYNAMIC_MINOR,
363 	.name           = "udmabuf",
364 	.fops           = &udmabuf_fops,
365 };
366 
udmabuf_dev_init(void)367 static int __init udmabuf_dev_init(void)
368 {
369 	int ret;
370 
371 	ret = misc_register(&udmabuf_misc);
372 	if (ret < 0) {
373 		pr_err("Could not initialize udmabuf device\n");
374 		return ret;
375 	}
376 
377 	ret = dma_coerce_mask_and_coherent(udmabuf_misc.this_device,
378 					   DMA_BIT_MASK(64));
379 	if (ret < 0) {
380 		pr_err("Could not setup DMA mask for udmabuf device\n");
381 		misc_deregister(&udmabuf_misc);
382 		return ret;
383 	}
384 
385 	return 0;
386 }
387 
udmabuf_dev_exit(void)388 static void __exit udmabuf_dev_exit(void)
389 {
390 	misc_deregister(&udmabuf_misc);
391 }
392 
393 module_init(udmabuf_dev_init)
394 module_exit(udmabuf_dev_exit)
395 
396 MODULE_AUTHOR("Gerd Hoffmann <kraxel@redhat.com>");
397