1 /* 2 * Framework for buffer objects that can be shared across devices/subsystems. 3 * 4 * Copyright(C) 2011 Linaro Limited. All rights reserved. 5 * Author: Sumit Semwal <sumit.semwal@ti.com> 6 * 7 * Many thanks to linaro-mm-sig list, and specially 8 * Arnd Bergmann <arnd@arndb.de>, Rob Clark <rob@ti.com> and 9 * Daniel Vetter <daniel@ffwll.ch> for their support in creation and 10 * refining of this idea. 11 * 12 * This program is free software; you can redistribute it and/or modify it 13 * under the terms of the GNU General Public License version 2 as published by 14 * the Free Software Foundation. 15 * 16 * This program is distributed in the hope that it will be useful, but WITHOUT 17 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 18 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 19 * more details. 20 * 21 * You should have received a copy of the GNU General Public License along with 22 * this program. If not, see <http://www.gnu.org/licenses/>. 23 */ 24 25 #include <linux/fs.h> 26 #include <linux/slab.h> 27 #include <linux/dma-buf.h> 28 #include <linux/fence.h> 29 #include <linux/anon_inodes.h> 30 #include <linux/export.h> 31 #include <linux/debugfs.h> 32 #include <linux/module.h> 33 #include <linux/seq_file.h> 34 #include <linux/poll.h> 35 #include <linux/reservation.h> 36 37 #include <uapi/linux/dma-buf.h> 38 39 static inline int is_dma_buf_file(struct file *); 40 41 struct dma_buf_list { 42 struct list_head head; 43 struct mutex lock; 44 }; 45 46 static struct dma_buf_list db_list; 47 48 static int dma_buf_release(struct inode *inode, struct file *file) 49 { 50 struct dma_buf *dmabuf; 51 52 if (!is_dma_buf_file(file)) 53 return -EINVAL; 54 55 dmabuf = file->private_data; 56 57 BUG_ON(dmabuf->vmapping_counter); 58 59 /* 60 * Any fences that a dma-buf poll can wait on should be signaled 61 * before releasing dma-buf. This is the responsibility of each 62 * driver that uses the reservation objects. 63 * 64 * If you hit this BUG() it means someone dropped their ref to the 65 * dma-buf while still having pending operation to the buffer. 66 */ 67 BUG_ON(dmabuf->cb_shared.active || dmabuf->cb_excl.active); 68 69 dmabuf->ops->release(dmabuf); 70 71 mutex_lock(&db_list.lock); 72 list_del(&dmabuf->list_node); 73 mutex_unlock(&db_list.lock); 74 75 if (dmabuf->resv == (struct reservation_object *)&dmabuf[1]) 76 reservation_object_fini(dmabuf->resv); 77 78 module_put(dmabuf->owner); 79 kfree(dmabuf); 80 return 0; 81 } 82 83 static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma) 84 { 85 struct dma_buf *dmabuf; 86 87 if (!is_dma_buf_file(file)) 88 return -EINVAL; 89 90 dmabuf = file->private_data; 91 92 /* check for overflowing the buffer's size */ 93 if (vma->vm_pgoff + ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT) > 94 dmabuf->size >> PAGE_SHIFT) 95 return -EINVAL; 96 97 return dmabuf->ops->mmap(dmabuf, vma); 98 } 99 100 static loff_t dma_buf_llseek(struct file *file, loff_t offset, int whence) 101 { 102 struct dma_buf *dmabuf; 103 loff_t base; 104 105 if (!is_dma_buf_file(file)) 106 return -EBADF; 107 108 dmabuf = file->private_data; 109 110 /* only support discovering the end of the buffer, 111 but also allow SEEK_SET to maintain the idiomatic 112 SEEK_END(0), SEEK_CUR(0) pattern */ 113 if (whence == SEEK_END) 114 base = dmabuf->size; 115 else if (whence == SEEK_SET) 116 base = 0; 117 else 118 return -EINVAL; 119 120 if (offset != 0) 121 return -EINVAL; 122 123 return base + offset; 124 } 125 126 static void dma_buf_poll_cb(struct fence *fence, struct fence_cb *cb) 127 { 128 struct dma_buf_poll_cb_t *dcb = (struct dma_buf_poll_cb_t *)cb; 129 unsigned long flags; 130 131 spin_lock_irqsave(&dcb->poll->lock, flags); 132 wake_up_locked_poll(dcb->poll, dcb->active); 133 dcb->active = 0; 134 spin_unlock_irqrestore(&dcb->poll->lock, flags); 135 } 136 137 static unsigned int dma_buf_poll(struct file *file, poll_table *poll) 138 { 139 struct dma_buf *dmabuf; 140 struct reservation_object *resv; 141 struct reservation_object_list *fobj; 142 struct fence *fence_excl; 143 unsigned long events; 144 unsigned shared_count, seq; 145 146 dmabuf = file->private_data; 147 if (!dmabuf || !dmabuf->resv) 148 return POLLERR; 149 150 resv = dmabuf->resv; 151 152 poll_wait(file, &dmabuf->poll, poll); 153 154 events = poll_requested_events(poll) & (POLLIN | POLLOUT); 155 if (!events) 156 return 0; 157 158 retry: 159 seq = read_seqcount_begin(&resv->seq); 160 rcu_read_lock(); 161 162 fobj = rcu_dereference(resv->fence); 163 if (fobj) 164 shared_count = fobj->shared_count; 165 else 166 shared_count = 0; 167 fence_excl = rcu_dereference(resv->fence_excl); 168 if (read_seqcount_retry(&resv->seq, seq)) { 169 rcu_read_unlock(); 170 goto retry; 171 } 172 173 if (fence_excl && (!(events & POLLOUT) || shared_count == 0)) { 174 struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_excl; 175 unsigned long pevents = POLLIN; 176 177 if (shared_count == 0) 178 pevents |= POLLOUT; 179 180 spin_lock_irq(&dmabuf->poll.lock); 181 if (dcb->active) { 182 dcb->active |= pevents; 183 events &= ~pevents; 184 } else 185 dcb->active = pevents; 186 spin_unlock_irq(&dmabuf->poll.lock); 187 188 if (events & pevents) { 189 if (!fence_get_rcu(fence_excl)) { 190 /* force a recheck */ 191 events &= ~pevents; 192 dma_buf_poll_cb(NULL, &dcb->cb); 193 } else if (!fence_add_callback(fence_excl, &dcb->cb, 194 dma_buf_poll_cb)) { 195 events &= ~pevents; 196 fence_put(fence_excl); 197 } else { 198 /* 199 * No callback queued, wake up any additional 200 * waiters. 201 */ 202 fence_put(fence_excl); 203 dma_buf_poll_cb(NULL, &dcb->cb); 204 } 205 } 206 } 207 208 if ((events & POLLOUT) && shared_count > 0) { 209 struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_shared; 210 int i; 211 212 /* Only queue a new callback if no event has fired yet */ 213 spin_lock_irq(&dmabuf->poll.lock); 214 if (dcb->active) 215 events &= ~POLLOUT; 216 else 217 dcb->active = POLLOUT; 218 spin_unlock_irq(&dmabuf->poll.lock); 219 220 if (!(events & POLLOUT)) 221 goto out; 222 223 for (i = 0; i < shared_count; ++i) { 224 struct fence *fence = rcu_dereference(fobj->shared[i]); 225 226 if (!fence_get_rcu(fence)) { 227 /* 228 * fence refcount dropped to zero, this means 229 * that fobj has been freed 230 * 231 * call dma_buf_poll_cb and force a recheck! 232 */ 233 events &= ~POLLOUT; 234 dma_buf_poll_cb(NULL, &dcb->cb); 235 break; 236 } 237 if (!fence_add_callback(fence, &dcb->cb, 238 dma_buf_poll_cb)) { 239 fence_put(fence); 240 events &= ~POLLOUT; 241 break; 242 } 243 fence_put(fence); 244 } 245 246 /* No callback queued, wake up any additional waiters. */ 247 if (i == shared_count) 248 dma_buf_poll_cb(NULL, &dcb->cb); 249 } 250 251 out: 252 rcu_read_unlock(); 253 return events; 254 } 255 256 static long dma_buf_ioctl(struct file *file, 257 unsigned int cmd, unsigned long arg) 258 { 259 struct dma_buf *dmabuf; 260 struct dma_buf_sync sync; 261 enum dma_data_direction direction; 262 int ret; 263 264 dmabuf = file->private_data; 265 266 switch (cmd) { 267 case DMA_BUF_IOCTL_SYNC: 268 if (copy_from_user(&sync, (void __user *) arg, sizeof(sync))) 269 return -EFAULT; 270 271 if (sync.flags & ~DMA_BUF_SYNC_VALID_FLAGS_MASK) 272 return -EINVAL; 273 274 switch (sync.flags & DMA_BUF_SYNC_RW) { 275 case DMA_BUF_SYNC_READ: 276 direction = DMA_FROM_DEVICE; 277 break; 278 case DMA_BUF_SYNC_WRITE: 279 direction = DMA_TO_DEVICE; 280 break; 281 case DMA_BUF_SYNC_RW: 282 direction = DMA_BIDIRECTIONAL; 283 break; 284 default: 285 return -EINVAL; 286 } 287 288 if (sync.flags & DMA_BUF_SYNC_END) 289 ret = dma_buf_end_cpu_access(dmabuf, direction); 290 else 291 ret = dma_buf_begin_cpu_access(dmabuf, direction); 292 293 return ret; 294 default: 295 return -ENOTTY; 296 } 297 } 298 299 static const struct file_operations dma_buf_fops = { 300 .release = dma_buf_release, 301 .mmap = dma_buf_mmap_internal, 302 .llseek = dma_buf_llseek, 303 .poll = dma_buf_poll, 304 .unlocked_ioctl = dma_buf_ioctl, 305 }; 306 307 /* 308 * is_dma_buf_file - Check if struct file* is associated with dma_buf 309 */ 310 static inline int is_dma_buf_file(struct file *file) 311 { 312 return file->f_op == &dma_buf_fops; 313 } 314 315 /** 316 * dma_buf_export - Creates a new dma_buf, and associates an anon file 317 * with this buffer, so it can be exported. 318 * Also connect the allocator specific data and ops to the buffer. 319 * Additionally, provide a name string for exporter; useful in debugging. 320 * 321 * @exp_info: [in] holds all the export related information provided 322 * by the exporter. see struct dma_buf_export_info 323 * for further details. 324 * 325 * Returns, on success, a newly created dma_buf object, which wraps the 326 * supplied private data and operations for dma_buf_ops. On either missing 327 * ops, or error in allocating struct dma_buf, will return negative error. 328 * 329 */ 330 struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info) 331 { 332 struct dma_buf *dmabuf; 333 struct reservation_object *resv = exp_info->resv; 334 struct file *file; 335 size_t alloc_size = sizeof(struct dma_buf); 336 337 if (!exp_info->resv) 338 alloc_size += sizeof(struct reservation_object); 339 else 340 /* prevent &dma_buf[1] == dma_buf->resv */ 341 alloc_size += 1; 342 343 if (WARN_ON(!exp_info->priv 344 || !exp_info->ops 345 || !exp_info->ops->map_dma_buf 346 || !exp_info->ops->unmap_dma_buf 347 || !exp_info->ops->release 348 || !exp_info->ops->kmap_atomic 349 || !exp_info->ops->kmap 350 || !exp_info->ops->mmap)) { 351 return ERR_PTR(-EINVAL); 352 } 353 354 if (!try_module_get(exp_info->owner)) 355 return ERR_PTR(-ENOENT); 356 357 dmabuf = kzalloc(alloc_size, GFP_KERNEL); 358 if (!dmabuf) { 359 module_put(exp_info->owner); 360 return ERR_PTR(-ENOMEM); 361 } 362 363 dmabuf->priv = exp_info->priv; 364 dmabuf->ops = exp_info->ops; 365 dmabuf->size = exp_info->size; 366 dmabuf->exp_name = exp_info->exp_name; 367 dmabuf->owner = exp_info->owner; 368 init_waitqueue_head(&dmabuf->poll); 369 dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll; 370 dmabuf->cb_excl.active = dmabuf->cb_shared.active = 0; 371 372 if (!resv) { 373 resv = (struct reservation_object *)&dmabuf[1]; 374 reservation_object_init(resv); 375 } 376 dmabuf->resv = resv; 377 378 file = anon_inode_getfile("dmabuf", &dma_buf_fops, dmabuf, 379 exp_info->flags); 380 if (IS_ERR(file)) { 381 kfree(dmabuf); 382 return ERR_CAST(file); 383 } 384 385 file->f_mode |= FMODE_LSEEK; 386 dmabuf->file = file; 387 388 mutex_init(&dmabuf->lock); 389 INIT_LIST_HEAD(&dmabuf->attachments); 390 391 mutex_lock(&db_list.lock); 392 list_add(&dmabuf->list_node, &db_list.head); 393 mutex_unlock(&db_list.lock); 394 395 return dmabuf; 396 } 397 EXPORT_SYMBOL_GPL(dma_buf_export); 398 399 /** 400 * dma_buf_fd - returns a file descriptor for the given dma_buf 401 * @dmabuf: [in] pointer to dma_buf for which fd is required. 402 * @flags: [in] flags to give to fd 403 * 404 * On success, returns an associated 'fd'. Else, returns error. 405 */ 406 int dma_buf_fd(struct dma_buf *dmabuf, int flags) 407 { 408 int fd; 409 410 if (!dmabuf || !dmabuf->file) 411 return -EINVAL; 412 413 fd = get_unused_fd_flags(flags); 414 if (fd < 0) 415 return fd; 416 417 fd_install(fd, dmabuf->file); 418 419 return fd; 420 } 421 EXPORT_SYMBOL_GPL(dma_buf_fd); 422 423 /** 424 * dma_buf_get - returns the dma_buf structure related to an fd 425 * @fd: [in] fd associated with the dma_buf to be returned 426 * 427 * On success, returns the dma_buf structure associated with an fd; uses 428 * file's refcounting done by fget to increase refcount. returns ERR_PTR 429 * otherwise. 430 */ 431 struct dma_buf *dma_buf_get(int fd) 432 { 433 struct file *file; 434 435 file = fget(fd); 436 437 if (!file) 438 return ERR_PTR(-EBADF); 439 440 if (!is_dma_buf_file(file)) { 441 fput(file); 442 return ERR_PTR(-EINVAL); 443 } 444 445 return file->private_data; 446 } 447 EXPORT_SYMBOL_GPL(dma_buf_get); 448 449 /** 450 * dma_buf_put - decreases refcount of the buffer 451 * @dmabuf: [in] buffer to reduce refcount of 452 * 453 * Uses file's refcounting done implicitly by fput() 454 */ 455 void dma_buf_put(struct dma_buf *dmabuf) 456 { 457 if (WARN_ON(!dmabuf || !dmabuf->file)) 458 return; 459 460 fput(dmabuf->file); 461 } 462 EXPORT_SYMBOL_GPL(dma_buf_put); 463 464 /** 465 * dma_buf_attach - Add the device to dma_buf's attachments list; optionally, 466 * calls attach() of dma_buf_ops to allow device-specific attach functionality 467 * @dmabuf: [in] buffer to attach device to. 468 * @dev: [in] device to be attached. 469 * 470 * Returns struct dma_buf_attachment * for this attachment; returns ERR_PTR on 471 * error. 472 */ 473 struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf, 474 struct device *dev) 475 { 476 struct dma_buf_attachment *attach; 477 int ret; 478 479 if (WARN_ON(!dmabuf || !dev)) 480 return ERR_PTR(-EINVAL); 481 482 attach = kzalloc(sizeof(struct dma_buf_attachment), GFP_KERNEL); 483 if (attach == NULL) 484 return ERR_PTR(-ENOMEM); 485 486 attach->dev = dev; 487 attach->dmabuf = dmabuf; 488 489 mutex_lock(&dmabuf->lock); 490 491 if (dmabuf->ops->attach) { 492 ret = dmabuf->ops->attach(dmabuf, dev, attach); 493 if (ret) 494 goto err_attach; 495 } 496 list_add(&attach->node, &dmabuf->attachments); 497 498 mutex_unlock(&dmabuf->lock); 499 return attach; 500 501 err_attach: 502 kfree(attach); 503 mutex_unlock(&dmabuf->lock); 504 return ERR_PTR(ret); 505 } 506 EXPORT_SYMBOL_GPL(dma_buf_attach); 507 508 /** 509 * dma_buf_detach - Remove the given attachment from dmabuf's attachments list; 510 * optionally calls detach() of dma_buf_ops for device-specific detach 511 * @dmabuf: [in] buffer to detach from. 512 * @attach: [in] attachment to be detached; is free'd after this call. 513 * 514 */ 515 void dma_buf_detach(struct dma_buf *dmabuf, struct dma_buf_attachment *attach) 516 { 517 if (WARN_ON(!dmabuf || !attach)) 518 return; 519 520 mutex_lock(&dmabuf->lock); 521 list_del(&attach->node); 522 if (dmabuf->ops->detach) 523 dmabuf->ops->detach(dmabuf, attach); 524 525 mutex_unlock(&dmabuf->lock); 526 kfree(attach); 527 } 528 EXPORT_SYMBOL_GPL(dma_buf_detach); 529 530 /** 531 * dma_buf_map_attachment - Returns the scatterlist table of the attachment; 532 * mapped into _device_ address space. Is a wrapper for map_dma_buf() of the 533 * dma_buf_ops. 534 * @attach: [in] attachment whose scatterlist is to be returned 535 * @direction: [in] direction of DMA transfer 536 * 537 * Returns sg_table containing the scatterlist to be returned; returns ERR_PTR 538 * on error. 539 */ 540 struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach, 541 enum dma_data_direction direction) 542 { 543 struct sg_table *sg_table = ERR_PTR(-EINVAL); 544 545 might_sleep(); 546 547 if (WARN_ON(!attach || !attach->dmabuf)) 548 return ERR_PTR(-EINVAL); 549 550 sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction); 551 if (!sg_table) 552 sg_table = ERR_PTR(-ENOMEM); 553 554 return sg_table; 555 } 556 EXPORT_SYMBOL_GPL(dma_buf_map_attachment); 557 558 /** 559 * dma_buf_unmap_attachment - unmaps and decreases usecount of the buffer;might 560 * deallocate the scatterlist associated. Is a wrapper for unmap_dma_buf() of 561 * dma_buf_ops. 562 * @attach: [in] attachment to unmap buffer from 563 * @sg_table: [in] scatterlist info of the buffer to unmap 564 * @direction: [in] direction of DMA transfer 565 * 566 */ 567 void dma_buf_unmap_attachment(struct dma_buf_attachment *attach, 568 struct sg_table *sg_table, 569 enum dma_data_direction direction) 570 { 571 might_sleep(); 572 573 if (WARN_ON(!attach || !attach->dmabuf || !sg_table)) 574 return; 575 576 attach->dmabuf->ops->unmap_dma_buf(attach, sg_table, 577 direction); 578 } 579 EXPORT_SYMBOL_GPL(dma_buf_unmap_attachment); 580 581 582 /** 583 * dma_buf_begin_cpu_access - Must be called before accessing a dma_buf from the 584 * cpu in the kernel context. Calls begin_cpu_access to allow exporter-specific 585 * preparations. Coherency is only guaranteed in the specified range for the 586 * specified access direction. 587 * @dmabuf: [in] buffer to prepare cpu access for. 588 * @direction: [in] length of range for cpu access. 589 * 590 * Can return negative error values, returns 0 on success. 591 */ 592 int dma_buf_begin_cpu_access(struct dma_buf *dmabuf, 593 enum dma_data_direction direction) 594 { 595 int ret = 0; 596 597 if (WARN_ON(!dmabuf)) 598 return -EINVAL; 599 600 if (dmabuf->ops->begin_cpu_access) 601 ret = dmabuf->ops->begin_cpu_access(dmabuf, direction); 602 603 return ret; 604 } 605 EXPORT_SYMBOL_GPL(dma_buf_begin_cpu_access); 606 607 /** 608 * dma_buf_end_cpu_access - Must be called after accessing a dma_buf from the 609 * cpu in the kernel context. Calls end_cpu_access to allow exporter-specific 610 * actions. Coherency is only guaranteed in the specified range for the 611 * specified access direction. 612 * @dmabuf: [in] buffer to complete cpu access for. 613 * @direction: [in] length of range for cpu access. 614 * 615 * Can return negative error values, returns 0 on success. 616 */ 617 int dma_buf_end_cpu_access(struct dma_buf *dmabuf, 618 enum dma_data_direction direction) 619 { 620 int ret = 0; 621 622 WARN_ON(!dmabuf); 623 624 if (dmabuf->ops->end_cpu_access) 625 ret = dmabuf->ops->end_cpu_access(dmabuf, direction); 626 627 return ret; 628 } 629 EXPORT_SYMBOL_GPL(dma_buf_end_cpu_access); 630 631 /** 632 * dma_buf_kmap_atomic - Map a page of the buffer object into kernel address 633 * space. The same restrictions as for kmap_atomic and friends apply. 634 * @dmabuf: [in] buffer to map page from. 635 * @page_num: [in] page in PAGE_SIZE units to map. 636 * 637 * This call must always succeed, any necessary preparations that might fail 638 * need to be done in begin_cpu_access. 639 */ 640 void *dma_buf_kmap_atomic(struct dma_buf *dmabuf, unsigned long page_num) 641 { 642 WARN_ON(!dmabuf); 643 644 return dmabuf->ops->kmap_atomic(dmabuf, page_num); 645 } 646 EXPORT_SYMBOL_GPL(dma_buf_kmap_atomic); 647 648 /** 649 * dma_buf_kunmap_atomic - Unmap a page obtained by dma_buf_kmap_atomic. 650 * @dmabuf: [in] buffer to unmap page from. 651 * @page_num: [in] page in PAGE_SIZE units to unmap. 652 * @vaddr: [in] kernel space pointer obtained from dma_buf_kmap_atomic. 653 * 654 * This call must always succeed. 655 */ 656 void dma_buf_kunmap_atomic(struct dma_buf *dmabuf, unsigned long page_num, 657 void *vaddr) 658 { 659 WARN_ON(!dmabuf); 660 661 if (dmabuf->ops->kunmap_atomic) 662 dmabuf->ops->kunmap_atomic(dmabuf, page_num, vaddr); 663 } 664 EXPORT_SYMBOL_GPL(dma_buf_kunmap_atomic); 665 666 /** 667 * dma_buf_kmap - Map a page of the buffer object into kernel address space. The 668 * same restrictions as for kmap and friends apply. 669 * @dmabuf: [in] buffer to map page from. 670 * @page_num: [in] page in PAGE_SIZE units to map. 671 * 672 * This call must always succeed, any necessary preparations that might fail 673 * need to be done in begin_cpu_access. 674 */ 675 void *dma_buf_kmap(struct dma_buf *dmabuf, unsigned long page_num) 676 { 677 WARN_ON(!dmabuf); 678 679 return dmabuf->ops->kmap(dmabuf, page_num); 680 } 681 EXPORT_SYMBOL_GPL(dma_buf_kmap); 682 683 /** 684 * dma_buf_kunmap - Unmap a page obtained by dma_buf_kmap. 685 * @dmabuf: [in] buffer to unmap page from. 686 * @page_num: [in] page in PAGE_SIZE units to unmap. 687 * @vaddr: [in] kernel space pointer obtained from dma_buf_kmap. 688 * 689 * This call must always succeed. 690 */ 691 void dma_buf_kunmap(struct dma_buf *dmabuf, unsigned long page_num, 692 void *vaddr) 693 { 694 WARN_ON(!dmabuf); 695 696 if (dmabuf->ops->kunmap) 697 dmabuf->ops->kunmap(dmabuf, page_num, vaddr); 698 } 699 EXPORT_SYMBOL_GPL(dma_buf_kunmap); 700 701 702 /** 703 * dma_buf_mmap - Setup up a userspace mmap with the given vma 704 * @dmabuf: [in] buffer that should back the vma 705 * @vma: [in] vma for the mmap 706 * @pgoff: [in] offset in pages where this mmap should start within the 707 * dma-buf buffer. 708 * 709 * This function adjusts the passed in vma so that it points at the file of the 710 * dma_buf operation. It also adjusts the starting pgoff and does bounds 711 * checking on the size of the vma. Then it calls the exporters mmap function to 712 * set up the mapping. 713 * 714 * Can return negative error values, returns 0 on success. 715 */ 716 int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma, 717 unsigned long pgoff) 718 { 719 struct file *oldfile; 720 int ret; 721 722 if (WARN_ON(!dmabuf || !vma)) 723 return -EINVAL; 724 725 /* check for offset overflow */ 726 if (pgoff + ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT) < pgoff) 727 return -EOVERFLOW; 728 729 /* check for overflowing the buffer's size */ 730 if (pgoff + ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT) > 731 dmabuf->size >> PAGE_SHIFT) 732 return -EINVAL; 733 734 /* readjust the vma */ 735 get_file(dmabuf->file); 736 oldfile = vma->vm_file; 737 vma->vm_file = dmabuf->file; 738 vma->vm_pgoff = pgoff; 739 740 ret = dmabuf->ops->mmap(dmabuf, vma); 741 if (ret) { 742 /* restore old parameters on failure */ 743 vma->vm_file = oldfile; 744 fput(dmabuf->file); 745 } else { 746 if (oldfile) 747 fput(oldfile); 748 } 749 return ret; 750 751 } 752 EXPORT_SYMBOL_GPL(dma_buf_mmap); 753 754 /** 755 * dma_buf_vmap - Create virtual mapping for the buffer object into kernel 756 * address space. Same restrictions as for vmap and friends apply. 757 * @dmabuf: [in] buffer to vmap 758 * 759 * This call may fail due to lack of virtual mapping address space. 760 * These calls are optional in drivers. The intended use for them 761 * is for mapping objects linear in kernel space for high use objects. 762 * Please attempt to use kmap/kunmap before thinking about these interfaces. 763 * 764 * Returns NULL on error. 765 */ 766 void *dma_buf_vmap(struct dma_buf *dmabuf) 767 { 768 void *ptr; 769 770 if (WARN_ON(!dmabuf)) 771 return NULL; 772 773 if (!dmabuf->ops->vmap) 774 return NULL; 775 776 mutex_lock(&dmabuf->lock); 777 if (dmabuf->vmapping_counter) { 778 dmabuf->vmapping_counter++; 779 BUG_ON(!dmabuf->vmap_ptr); 780 ptr = dmabuf->vmap_ptr; 781 goto out_unlock; 782 } 783 784 BUG_ON(dmabuf->vmap_ptr); 785 786 ptr = dmabuf->ops->vmap(dmabuf); 787 if (WARN_ON_ONCE(IS_ERR(ptr))) 788 ptr = NULL; 789 if (!ptr) 790 goto out_unlock; 791 792 dmabuf->vmap_ptr = ptr; 793 dmabuf->vmapping_counter = 1; 794 795 out_unlock: 796 mutex_unlock(&dmabuf->lock); 797 return ptr; 798 } 799 EXPORT_SYMBOL_GPL(dma_buf_vmap); 800 801 /** 802 * dma_buf_vunmap - Unmap a vmap obtained by dma_buf_vmap. 803 * @dmabuf: [in] buffer to vunmap 804 * @vaddr: [in] vmap to vunmap 805 */ 806 void dma_buf_vunmap(struct dma_buf *dmabuf, void *vaddr) 807 { 808 if (WARN_ON(!dmabuf)) 809 return; 810 811 BUG_ON(!dmabuf->vmap_ptr); 812 BUG_ON(dmabuf->vmapping_counter == 0); 813 BUG_ON(dmabuf->vmap_ptr != vaddr); 814 815 mutex_lock(&dmabuf->lock); 816 if (--dmabuf->vmapping_counter == 0) { 817 if (dmabuf->ops->vunmap) 818 dmabuf->ops->vunmap(dmabuf, vaddr); 819 dmabuf->vmap_ptr = NULL; 820 } 821 mutex_unlock(&dmabuf->lock); 822 } 823 EXPORT_SYMBOL_GPL(dma_buf_vunmap); 824 825 #ifdef CONFIG_DEBUG_FS 826 static int dma_buf_describe(struct seq_file *s) 827 { 828 int ret; 829 struct dma_buf *buf_obj; 830 struct dma_buf_attachment *attach_obj; 831 int count = 0, attach_count; 832 size_t size = 0; 833 834 ret = mutex_lock_interruptible(&db_list.lock); 835 836 if (ret) 837 return ret; 838 839 seq_puts(s, "\nDma-buf Objects:\n"); 840 seq_puts(s, "size\tflags\tmode\tcount\texp_name\n"); 841 842 list_for_each_entry(buf_obj, &db_list.head, list_node) { 843 ret = mutex_lock_interruptible(&buf_obj->lock); 844 845 if (ret) { 846 seq_puts(s, 847 "\tERROR locking buffer object: skipping\n"); 848 continue; 849 } 850 851 seq_printf(s, "%08zu\t%08x\t%08x\t%08ld\t%s\n", 852 buf_obj->size, 853 buf_obj->file->f_flags, buf_obj->file->f_mode, 854 file_count(buf_obj->file), 855 buf_obj->exp_name); 856 857 seq_puts(s, "\tAttached Devices:\n"); 858 attach_count = 0; 859 860 list_for_each_entry(attach_obj, &buf_obj->attachments, node) { 861 seq_puts(s, "\t"); 862 863 seq_printf(s, "%s\n", dev_name(attach_obj->dev)); 864 attach_count++; 865 } 866 867 seq_printf(s, "Total %d devices attached\n\n", 868 attach_count); 869 870 count++; 871 size += buf_obj->size; 872 mutex_unlock(&buf_obj->lock); 873 } 874 875 seq_printf(s, "\nTotal %d objects, %zu bytes\n", count, size); 876 877 mutex_unlock(&db_list.lock); 878 return 0; 879 } 880 881 static int dma_buf_show(struct seq_file *s, void *unused) 882 { 883 void (*func)(struct seq_file *) = s->private; 884 885 func(s); 886 return 0; 887 } 888 889 static int dma_buf_debug_open(struct inode *inode, struct file *file) 890 { 891 return single_open(file, dma_buf_show, inode->i_private); 892 } 893 894 static const struct file_operations dma_buf_debug_fops = { 895 .open = dma_buf_debug_open, 896 .read = seq_read, 897 .llseek = seq_lseek, 898 .release = single_release, 899 }; 900 901 static struct dentry *dma_buf_debugfs_dir; 902 903 static int dma_buf_init_debugfs(void) 904 { 905 int err = 0; 906 907 dma_buf_debugfs_dir = debugfs_create_dir("dma_buf", NULL); 908 909 if (IS_ERR(dma_buf_debugfs_dir)) { 910 err = PTR_ERR(dma_buf_debugfs_dir); 911 dma_buf_debugfs_dir = NULL; 912 return err; 913 } 914 915 err = dma_buf_debugfs_create_file("bufinfo", dma_buf_describe); 916 917 if (err) 918 pr_debug("dma_buf: debugfs: failed to create node bufinfo\n"); 919 920 return err; 921 } 922 923 static void dma_buf_uninit_debugfs(void) 924 { 925 if (dma_buf_debugfs_dir) 926 debugfs_remove_recursive(dma_buf_debugfs_dir); 927 } 928 929 int dma_buf_debugfs_create_file(const char *name, 930 int (*write)(struct seq_file *)) 931 { 932 struct dentry *d; 933 934 d = debugfs_create_file(name, S_IRUGO, dma_buf_debugfs_dir, 935 write, &dma_buf_debug_fops); 936 937 return PTR_ERR_OR_ZERO(d); 938 } 939 #else 940 static inline int dma_buf_init_debugfs(void) 941 { 942 return 0; 943 } 944 static inline void dma_buf_uninit_debugfs(void) 945 { 946 } 947 #endif 948 949 static int __init dma_buf_init(void) 950 { 951 mutex_init(&db_list.lock); 952 INIT_LIST_HEAD(&db_list.head); 953 dma_buf_init_debugfs(); 954 return 0; 955 } 956 subsys_initcall(dma_buf_init); 957 958 static void __exit dma_buf_deinit(void) 959 { 960 dma_buf_uninit_debugfs(); 961 } 962 __exitcall(dma_buf_deinit); 963