1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/cred.h>
3 #include <linux/device.h>
4 #include <linux/dma-buf.h>
5 #include <linux/highmem.h>
6 #include <linux/init.h>
7 #include <linux/kernel.h>
8 #include <linux/memfd.h>
9 #include <linux/miscdevice.h>
10 #include <linux/module.h>
11 #include <linux/shmem_fs.h>
12 #include <linux/slab.h>
13 #include <linux/udmabuf.h>
14
15 static const u32 list_limit = 1024; /* udmabuf_create_list->count limit */
16 static const size_t size_limit_mb = 64; /* total dmabuf size, in megabytes */
17
18 struct udmabuf {
19 pgoff_t pagecount;
20 struct page **pages;
21 struct sg_table *sg;
22 struct miscdevice *device;
23 };
24
udmabuf_vm_fault(struct vm_fault * vmf)25 static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf)
26 {
27 struct vm_area_struct *vma = vmf->vma;
28 struct udmabuf *ubuf = vma->vm_private_data;
29 pgoff_t pgoff = vmf->pgoff;
30
31 if (pgoff >= ubuf->pagecount)
32 return VM_FAULT_SIGBUS;
33 vmf->page = ubuf->pages[pgoff];
34 get_page(vmf->page);
35 return 0;
36 }
37
38 static const struct vm_operations_struct udmabuf_vm_ops = {
39 .fault = udmabuf_vm_fault,
40 };
41
mmap_udmabuf(struct dma_buf * buf,struct vm_area_struct * vma)42 static int mmap_udmabuf(struct dma_buf *buf, struct vm_area_struct *vma)
43 {
44 struct udmabuf *ubuf = buf->priv;
45
46 if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) == 0)
47 return -EINVAL;
48
49 vma->vm_ops = &udmabuf_vm_ops;
50 vma->vm_private_data = ubuf;
51 return 0;
52 }
53
get_sg_table(struct device * dev,struct dma_buf * buf,enum dma_data_direction direction)54 static struct sg_table *get_sg_table(struct device *dev, struct dma_buf *buf,
55 enum dma_data_direction direction)
56 {
57 struct udmabuf *ubuf = buf->priv;
58 struct sg_table *sg;
59 int ret;
60
61 sg = kzalloc(sizeof(*sg), GFP_KERNEL);
62 if (!sg)
63 return ERR_PTR(-ENOMEM);
64 ret = sg_alloc_table_from_pages(sg, ubuf->pages, ubuf->pagecount,
65 0, ubuf->pagecount << PAGE_SHIFT,
66 GFP_KERNEL);
67 if (ret < 0)
68 goto err;
69 ret = dma_map_sgtable(dev, sg, direction, 0);
70 if (ret < 0)
71 goto err;
72 return sg;
73
74 err:
75 sg_free_table(sg);
76 kfree(sg);
77 return ERR_PTR(ret);
78 }
79
put_sg_table(struct device * dev,struct sg_table * sg,enum dma_data_direction direction)80 static void put_sg_table(struct device *dev, struct sg_table *sg,
81 enum dma_data_direction direction)
82 {
83 dma_unmap_sgtable(dev, sg, direction, 0);
84 sg_free_table(sg);
85 kfree(sg);
86 }
87
map_udmabuf(struct dma_buf_attachment * at,enum dma_data_direction direction)88 static struct sg_table *map_udmabuf(struct dma_buf_attachment *at,
89 enum dma_data_direction direction)
90 {
91 return get_sg_table(at->dev, at->dmabuf, direction);
92 }
93
unmap_udmabuf(struct dma_buf_attachment * at,struct sg_table * sg,enum dma_data_direction direction)94 static void unmap_udmabuf(struct dma_buf_attachment *at,
95 struct sg_table *sg,
96 enum dma_data_direction direction)
97 {
98 return put_sg_table(at->dev, sg, direction);
99 }
100
release_udmabuf(struct dma_buf * buf)101 static void release_udmabuf(struct dma_buf *buf)
102 {
103 struct udmabuf *ubuf = buf->priv;
104 struct device *dev = ubuf->device->this_device;
105 pgoff_t pg;
106
107 if (ubuf->sg)
108 put_sg_table(dev, ubuf->sg, DMA_BIDIRECTIONAL);
109
110 for (pg = 0; pg < ubuf->pagecount; pg++)
111 put_page(ubuf->pages[pg]);
112 kfree(ubuf->pages);
113 kfree(ubuf);
114 }
115
begin_cpu_udmabuf(struct dma_buf * buf,enum dma_data_direction direction)116 static int begin_cpu_udmabuf(struct dma_buf *buf,
117 enum dma_data_direction direction)
118 {
119 struct udmabuf *ubuf = buf->priv;
120 struct device *dev = ubuf->device->this_device;
121 int ret = 0;
122
123 if (!ubuf->sg) {
124 ubuf->sg = get_sg_table(dev, buf, direction);
125 if (IS_ERR(ubuf->sg)) {
126 ret = PTR_ERR(ubuf->sg);
127 ubuf->sg = NULL;
128 }
129 } else {
130 dma_sync_sg_for_cpu(dev, ubuf->sg->sgl, ubuf->sg->nents,
131 direction);
132 }
133
134 return ret;
135 }
136
end_cpu_udmabuf(struct dma_buf * buf,enum dma_data_direction direction)137 static int end_cpu_udmabuf(struct dma_buf *buf,
138 enum dma_data_direction direction)
139 {
140 struct udmabuf *ubuf = buf->priv;
141 struct device *dev = ubuf->device->this_device;
142
143 if (!ubuf->sg)
144 return -EINVAL;
145
146 dma_sync_sg_for_device(dev, ubuf->sg->sgl, ubuf->sg->nents, direction);
147 return 0;
148 }
149
150 static const struct dma_buf_ops udmabuf_ops = {
151 .cache_sgt_mapping = true,
152 .map_dma_buf = map_udmabuf,
153 .unmap_dma_buf = unmap_udmabuf,
154 .release = release_udmabuf,
155 .mmap = mmap_udmabuf,
156 .begin_cpu_access = begin_cpu_udmabuf,
157 .end_cpu_access = end_cpu_udmabuf,
158 };
159
160 #define SEALS_WANTED (F_SEAL_SHRINK)
161 #define SEALS_DENIED (F_SEAL_WRITE)
162
udmabuf_create(struct miscdevice * device,struct udmabuf_create_list * head,struct udmabuf_create_item * list)163 static long udmabuf_create(struct miscdevice *device,
164 struct udmabuf_create_list *head,
165 struct udmabuf_create_item *list)
166 {
167 DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
168 struct file *memfd = NULL;
169 struct udmabuf *ubuf;
170 struct dma_buf *buf;
171 pgoff_t pgoff, pgcnt, pgidx, pgbuf = 0, pglimit;
172 struct page *page;
173 int seals, ret = -EINVAL;
174 u32 i, flags;
175
176 ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL);
177 if (!ubuf)
178 return -ENOMEM;
179
180 pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
181 for (i = 0; i < head->count; i++) {
182 if (!IS_ALIGNED(list[i].offset, PAGE_SIZE))
183 goto err;
184 if (!IS_ALIGNED(list[i].size, PAGE_SIZE))
185 goto err;
186 ubuf->pagecount += list[i].size >> PAGE_SHIFT;
187 if (ubuf->pagecount > pglimit)
188 goto err;
189 }
190
191 if (!ubuf->pagecount)
192 goto err;
193
194 ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
195 GFP_KERNEL);
196 if (!ubuf->pages) {
197 ret = -ENOMEM;
198 goto err;
199 }
200
201 pgbuf = 0;
202 for (i = 0; i < head->count; i++) {
203 ret = -EBADFD;
204 memfd = fget(list[i].memfd);
205 if (!memfd)
206 goto err;
207 if (!shmem_mapping(file_inode(memfd)->i_mapping))
208 goto err;
209 seals = memfd_fcntl(memfd, F_GET_SEALS, 0);
210 if (seals == -EINVAL)
211 goto err;
212 ret = -EINVAL;
213 if ((seals & SEALS_WANTED) != SEALS_WANTED ||
214 (seals & SEALS_DENIED) != 0)
215 goto err;
216 pgoff = list[i].offset >> PAGE_SHIFT;
217 pgcnt = list[i].size >> PAGE_SHIFT;
218 for (pgidx = 0; pgidx < pgcnt; pgidx++) {
219 page = shmem_read_mapping_page(
220 file_inode(memfd)->i_mapping, pgoff + pgidx);
221 if (IS_ERR(page)) {
222 ret = PTR_ERR(page);
223 goto err;
224 }
225 ubuf->pages[pgbuf++] = page;
226 }
227 fput(memfd);
228 memfd = NULL;
229 }
230
231 exp_info.ops = &udmabuf_ops;
232 exp_info.size = ubuf->pagecount << PAGE_SHIFT;
233 exp_info.priv = ubuf;
234 exp_info.flags = O_RDWR;
235
236 ubuf->device = device;
237 buf = dma_buf_export(&exp_info);
238 if (IS_ERR(buf)) {
239 ret = PTR_ERR(buf);
240 goto err;
241 }
242
243 flags = 0;
244 if (head->flags & UDMABUF_FLAGS_CLOEXEC)
245 flags |= O_CLOEXEC;
246 return dma_buf_fd(buf, flags);
247
248 err:
249 while (pgbuf > 0)
250 put_page(ubuf->pages[--pgbuf]);
251 if (memfd)
252 fput(memfd);
253 kfree(ubuf->pages);
254 kfree(ubuf);
255 return ret;
256 }
257
udmabuf_ioctl_create(struct file * filp,unsigned long arg)258 static long udmabuf_ioctl_create(struct file *filp, unsigned long arg)
259 {
260 struct udmabuf_create create;
261 struct udmabuf_create_list head;
262 struct udmabuf_create_item list;
263
264 if (copy_from_user(&create, (void __user *)arg,
265 sizeof(create)))
266 return -EFAULT;
267
268 head.flags = create.flags;
269 head.count = 1;
270 list.memfd = create.memfd;
271 list.offset = create.offset;
272 list.size = create.size;
273
274 return udmabuf_create(filp->private_data, &head, &list);
275 }
276
udmabuf_ioctl_create_list(struct file * filp,unsigned long arg)277 static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg)
278 {
279 struct udmabuf_create_list head;
280 struct udmabuf_create_item *list;
281 int ret = -EINVAL;
282 u32 lsize;
283
284 if (copy_from_user(&head, (void __user *)arg, sizeof(head)))
285 return -EFAULT;
286 if (head.count > list_limit)
287 return -EINVAL;
288 lsize = sizeof(struct udmabuf_create_item) * head.count;
289 list = memdup_user((void __user *)(arg + sizeof(head)), lsize);
290 if (IS_ERR(list))
291 return PTR_ERR(list);
292
293 ret = udmabuf_create(filp->private_data, &head, list);
294 kfree(list);
295 return ret;
296 }
297
udmabuf_ioctl(struct file * filp,unsigned int ioctl,unsigned long arg)298 static long udmabuf_ioctl(struct file *filp, unsigned int ioctl,
299 unsigned long arg)
300 {
301 long ret;
302
303 switch (ioctl) {
304 case UDMABUF_CREATE:
305 ret = udmabuf_ioctl_create(filp, arg);
306 break;
307 case UDMABUF_CREATE_LIST:
308 ret = udmabuf_ioctl_create_list(filp, arg);
309 break;
310 default:
311 ret = -ENOTTY;
312 break;
313 }
314 return ret;
315 }
316
317 static const struct file_operations udmabuf_fops = {
318 .owner = THIS_MODULE,
319 .unlocked_ioctl = udmabuf_ioctl,
320 #ifdef CONFIG_COMPAT
321 .compat_ioctl = udmabuf_ioctl,
322 #endif
323 };
324
325 static struct miscdevice udmabuf_misc = {
326 .minor = MISC_DYNAMIC_MINOR,
327 .name = "udmabuf",
328 .fops = &udmabuf_fops,
329 };
330
udmabuf_dev_init(void)331 static int __init udmabuf_dev_init(void)
332 {
333 int ret;
334
335 ret = misc_register(&udmabuf_misc);
336 if (ret < 0) {
337 pr_err("Could not initialize udmabuf device\n");
338 return ret;
339 }
340
341 ret = dma_coerce_mask_and_coherent(udmabuf_misc.this_device,
342 DMA_BIT_MASK(64));
343 if (ret < 0) {
344 pr_err("Could not setup DMA mask for udmabuf device\n");
345 misc_deregister(&udmabuf_misc);
346 return ret;
347 }
348
349 return 0;
350 }
351
udmabuf_dev_exit(void)352 static void __exit udmabuf_dev_exit(void)
353 {
354 misc_deregister(&udmabuf_misc);
355 }
356
357 module_init(udmabuf_dev_init)
358 module_exit(udmabuf_dev_exit)
359
360 MODULE_AUTHOR("Gerd Hoffmann <kraxel@redhat.com>");
361 MODULE_LICENSE("GPL v2");
362