1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3 * Header file for dma buffer sharing framework.
4 *
5 * Copyright(C) 2011 Linaro Limited. All rights reserved.
6 * Author: Sumit Semwal <sumit.semwal@ti.com>
7 *
8 * Many thanks to linaro-mm-sig list, and specially
9 * Arnd Bergmann <arnd@arndb.de>, Rob Clark <rob@ti.com> and
10 * Daniel Vetter <daniel@ffwll.ch> for their support in creation and
11 * refining of this idea.
12 */
13 #ifndef __DMA_BUF_H__
14 #define __DMA_BUF_H__
15
16 #include <linux/file.h>
17 #include <linux/err.h>
18 #include <linux/scatterlist.h>
19 #include <linux/list.h>
20 #include <linux/dma-mapping.h>
21 #include <linux/fs.h>
22 #include <linux/dma-fence.h>
23 #include <linux/wait.h>
24 #include <linux/android_kabi.h>
25
26 struct device;
27 struct dma_buf;
28 struct dma_buf_attachment;
29
30 /**
31 * struct dma_buf_ops - operations possible on struct dma_buf
32 * @vmap: [optional] creates a virtual mapping for the buffer into kernel
33 * address space. Same restrictions as for vmap and friends apply.
34 * @vunmap: [optional] unmaps a vmap from the buffer
35 */
36 struct dma_buf_ops {
37 /**
38 * @cache_sgt_mapping:
39 *
40 * If true the framework will cache the first mapping made for each
41 * attachment. This avoids creating mappings for attachments multiple
42 * times.
43 */
44 bool cache_sgt_mapping;
45
46 /**
47 * @attach:
48 *
49 * This is called from dma_buf_attach() to make sure that a given
50 * &dma_buf_attachment.dev can access the provided &dma_buf. Exporters
51 * which support buffer objects in special locations like VRAM or
52 * device-specific carveout areas should check whether the buffer could
53 * be move to system memory (or directly accessed by the provided
54 * device), and otherwise need to fail the attach operation.
55 *
56 * The exporter should also in general check whether the current
57 * allocation fullfills the DMA constraints of the new device. If this
58 * is not the case, and the allocation cannot be moved, it should also
59 * fail the attach operation.
60 *
61 * Any exporter-private housekeeping data can be stored in the
62 * &dma_buf_attachment.priv pointer.
63 *
64 * This callback is optional.
65 *
66 * Returns:
67 *
68 * 0 on success, negative error code on failure. It might return -EBUSY
69 * to signal that backing storage is already allocated and incompatible
70 * with the requirements of requesting device.
71 */
72 int (*attach)(struct dma_buf *, struct dma_buf_attachment *);
73
74 /**
75 * @detach:
76 *
77 * This is called by dma_buf_detach() to release a &dma_buf_attachment.
78 * Provided so that exporters can clean up any housekeeping for an
79 * &dma_buf_attachment.
80 *
81 * This callback is optional.
82 */
83 void (*detach)(struct dma_buf *, struct dma_buf_attachment *);
84
85 /**
86 * @pin:
87 *
88 * This is called by dma_buf_pin and lets the exporter know that the
89 * DMA-buf can't be moved any more.
90 *
91 * This is called with the dmabuf->resv object locked and is mutual
92 * exclusive with @cache_sgt_mapping.
93 *
94 * This callback is optional and should only be used in limited use
95 * cases like scanout and not for temporary pin operations.
96 *
97 * Returns:
98 *
99 * 0 on success, negative error code on failure.
100 */
101 int (*pin)(struct dma_buf_attachment *attach);
102
103 /**
104 * @unpin:
105 *
106 * This is called by dma_buf_unpin and lets the exporter know that the
107 * DMA-buf can be moved again.
108 *
109 * This is called with the dmabuf->resv object locked and is mutual
110 * exclusive with @cache_sgt_mapping.
111 *
112 * This callback is optional.
113 */
114 void (*unpin)(struct dma_buf_attachment *attach);
115
116 /**
117 * @map_dma_buf:
118 *
119 * This is called by dma_buf_map_attachment() and is used to map a
120 * shared &dma_buf into device address space, and it is mandatory. It
121 * can only be called if @attach has been called successfully.
122 *
123 * This call may sleep, e.g. when the backing storage first needs to be
124 * allocated, or moved to a location suitable for all currently attached
125 * devices.
126 *
127 * Note that any specific buffer attributes required for this function
128 * should get added to device_dma_parameters accessible via
129 * &device.dma_params from the &dma_buf_attachment. The @attach callback
130 * should also check these constraints.
131 *
132 * If this is being called for the first time, the exporter can now
133 * choose to scan through the list of attachments for this buffer,
134 * collate the requirements of the attached devices, and choose an
135 * appropriate backing storage for the buffer.
136 *
137 * Based on enum dma_data_direction, it might be possible to have
138 * multiple users accessing at the same time (for reading, maybe), or
139 * any other kind of sharing that the exporter might wish to make
140 * available to buffer-users.
141 *
142 * This is always called with the dmabuf->resv object locked when
143 * the dynamic_mapping flag is true.
144 *
145 * Returns:
146 *
147 * A &sg_table scatter list of or the backing storage of the DMA buffer,
148 * already mapped into the device address space of the &device attached
149 * with the provided &dma_buf_attachment.
150 *
151 * On failure, returns a negative error value wrapped into a pointer.
152 * May also return -EINTR when a signal was received while being
153 * blocked.
154 */
155 struct sg_table * (*map_dma_buf)(struct dma_buf_attachment *,
156 enum dma_data_direction);
157 /**
158 * @unmap_dma_buf:
159 *
160 * This is called by dma_buf_unmap_attachment() and should unmap and
161 * release the &sg_table allocated in @map_dma_buf, and it is mandatory.
162 * For static dma_buf handling this might also unpins the backing
163 * storage if this is the last mapping of the DMA buffer.
164 */
165 void (*unmap_dma_buf)(struct dma_buf_attachment *,
166 struct sg_table *,
167 enum dma_data_direction);
168
169 /* TODO: Add try_map_dma_buf version, to return immed with -EBUSY
170 * if the call would block.
171 */
172
173 /**
174 * @release:
175 *
176 * Called after the last dma_buf_put to release the &dma_buf, and
177 * mandatory.
178 */
179 void (*release)(struct dma_buf *);
180
181 /**
182 * @begin_cpu_access:
183 *
184 * This is called from dma_buf_begin_cpu_access() and allows the
185 * exporter to ensure that the memory is actually available for cpu
186 * access - the exporter might need to allocate or swap-in and pin the
187 * backing storage. The exporter also needs to ensure that cpu access is
188 * coherent for the access direction. The direction can be used by the
189 * exporter to optimize the cache flushing, i.e. access with a different
190 * direction (read instead of write) might return stale or even bogus
191 * data (e.g. when the exporter needs to copy the data to temporary
192 * storage).
193 *
194 * This callback is optional.
195 *
196 * FIXME: This is both called through the DMA_BUF_IOCTL_SYNC command
197 * from userspace (where storage shouldn't be pinned to avoid handing
198 * de-factor mlock rights to userspace) and for the kernel-internal
199 * users of the various kmap interfaces, where the backing storage must
200 * be pinned to guarantee that the atomic kmap calls can succeed. Since
201 * there's no in-kernel users of the kmap interfaces yet this isn't a
202 * real problem.
203 *
204 * Returns:
205 *
206 * 0 on success or a negative error code on failure. This can for
207 * example fail when the backing storage can't be allocated. Can also
208 * return -ERESTARTSYS or -EINTR when the call has been interrupted and
209 * needs to be restarted.
210 */
211 int (*begin_cpu_access)(struct dma_buf *, enum dma_data_direction);
212
213 /**
214 * @begin_cpu_access_partial:
215 *
216 * This is called from dma_buf_begin_cpu_access_partial() and allows the
217 * exporter to ensure that the memory specified in the range is
218 * available for cpu access - the exporter might need to allocate or
219 * swap-in and pin the backing storage.
220 * The exporter also needs to ensure that cpu access is
221 * coherent for the access direction. The direction can be used by the
222 * exporter to optimize the cache flushing, i.e. access with a different
223 * direction (read instead of write) might return stale or even bogus
224 * data (e.g. when the exporter needs to copy the data to temporary
225 * storage).
226 *
227 * This callback is optional.
228 *
229 * FIXME: This is both called through the DMA_BUF_IOCTL_SYNC command
230 * from userspace (where storage shouldn't be pinned to avoid handing
231 * de-factor mlock rights to userspace) and for the kernel-internal
232 * users of the various kmap interfaces, where the backing storage must
233 * be pinned to guarantee that the atomic kmap calls can succeed. Since
234 * there's no in-kernel users of the kmap interfaces yet this isn't a
235 * real problem.
236 *
237 * Returns:
238 *
239 * 0 on success or a negative error code on failure. This can for
240 * example fail when the backing storage can't be allocated. Can also
241 * return -ERESTARTSYS or -EINTR when the call has been interrupted and
242 * needs to be restarted.
243 */
244 int (*begin_cpu_access_partial)(struct dma_buf *dmabuf,
245 enum dma_data_direction,
246 unsigned int offset, unsigned int len);
247
248 /**
249 * @end_cpu_access:
250 *
251 * This is called from dma_buf_end_cpu_access() when the importer is
252 * done accessing the CPU. The exporter can use this to flush caches and
253 * unpin any resources pinned in @begin_cpu_access.
254 * The result of any dma_buf kmap calls after end_cpu_access is
255 * undefined.
256 *
257 * This callback is optional.
258 *
259 * Returns:
260 *
261 * 0 on success or a negative error code on failure. Can return
262 * -ERESTARTSYS or -EINTR when the call has been interrupted and needs
263 * to be restarted.
264 */
265 int (*end_cpu_access)(struct dma_buf *, enum dma_data_direction);
266
267 /**
268 * @end_cpu_access_partial:
269 *
270 * This is called from dma_buf_end_cpu_access_partial() when the
271 * importer is done accessing the CPU. The exporter can use to limit
272 * cache flushing to only the range specefied and to unpin any
273 * resources pinned in @begin_cpu_access_umapped.
274 * The result of any dma_buf kmap calls after end_cpu_access_partial is
275 * undefined.
276 *
277 * This callback is optional.
278 *
279 * Returns:
280 *
281 * 0 on success or a negative error code on failure. Can return
282 * -ERESTARTSYS or -EINTR when the call has been interrupted and needs
283 * to be restarted.
284 */
285 int (*end_cpu_access_partial)(struct dma_buf *dmabuf,
286 enum dma_data_direction,
287 unsigned int offset, unsigned int len);
288
289 /**
290 * @mmap:
291 *
292 * This callback is used by the dma_buf_mmap() function
293 *
294 * Note that the mapping needs to be incoherent, userspace is expected
295 * to braket CPU access using the DMA_BUF_IOCTL_SYNC interface.
296 *
297 * Because dma-buf buffers have invariant size over their lifetime, the
298 * dma-buf core checks whether a vma is too large and rejects such
299 * mappings. The exporter hence does not need to duplicate this check.
300 * Drivers do not need to check this themselves.
301 *
302 * If an exporter needs to manually flush caches and hence needs to fake
303 * coherency for mmap support, it needs to be able to zap all the ptes
304 * pointing at the backing storage. Now linux mm needs a struct
305 * address_space associated with the struct file stored in vma->vm_file
306 * to do that with the function unmap_mapping_range. But the dma_buf
307 * framework only backs every dma_buf fd with the anon_file struct file,
308 * i.e. all dma_bufs share the same file.
309 *
310 * Hence exporters need to setup their own file (and address_space)
311 * association by setting vma->vm_file and adjusting vma->vm_pgoff in
312 * the dma_buf mmap callback. In the specific case of a gem driver the
313 * exporter could use the shmem file already provided by gem (and set
314 * vm_pgoff = 0). Exporters can then zap ptes by unmapping the
315 * corresponding range of the struct address_space associated with their
316 * own file.
317 *
318 * This callback is optional.
319 *
320 * Returns:
321 *
322 * 0 on success or a negative error code on failure.
323 */
324 int (*mmap)(struct dma_buf *, struct vm_area_struct *vma);
325
326 void *(*vmap)(struct dma_buf *);
327 void (*vunmap)(struct dma_buf *, void *vaddr);
328
329 /**
330 * @get_uuid
331 *
332 * This is called by dma_buf_get_uuid to get the UUID which identifies
333 * the buffer to virtio devices.
334 *
335 * This callback is optional.
336 *
337 * Returns:
338 *
339 * 0 on success or a negative error code on failure. On success uuid
340 * will be populated with the buffer's UUID.
341 */
342 int (*get_uuid)(struct dma_buf *dmabuf, uuid_t *uuid);
343
344 /**
345 * @get_flags:
346 *
347 * This is called by dma_buf_get_flags and is used to get the buffer's
348 * flags.
349 * This callback is optional.
350 *
351 * Returns:
352 *
353 * 0 on success or a negative error code on failure. On success flags
354 * will be populated with the buffer's flags.
355 */
356 int (*get_flags)(struct dma_buf *dmabuf, unsigned long *flags);
357
358 ANDROID_KABI_RESERVE(1);
359 ANDROID_KABI_RESERVE(2);
360 };
361
362 /**
363 * struct dma_buf - shared buffer object
364 * @size: size of the buffer
365 * @file: file pointer used for sharing buffers across, and for refcounting.
366 * @attachments: list of dma_buf_attachment that denotes all devices attached,
367 * protected by dma_resv lock.
368 * @ops: dma_buf_ops associated with this buffer object.
369 * @lock: used internally to serialize list manipulation, attach/detach and
370 * vmap/unmap
371 * @vmapping_counter: used internally to refcnt the vmaps
372 * @vmap_ptr: the current vmap ptr if vmapping_counter > 0
373 * @exp_name: name of the exporter; useful for debugging.
374 * @name: userspace-provided name; useful for accounting and debugging,
375 * protected by @resv.
376 * @name_lock: spinlock to protect name access
377 * @owner: pointer to exporter module; used for refcounting when exporter is a
378 * kernel module.
379 * @list_node: node for dma_buf accounting and debugging.
380 * @priv: exporter specific private data for this buffer object.
381 * @resv: reservation object linked to this dma-buf
382 * @poll: for userspace poll support
383 * @cb_excl: for userspace poll support
384 * @cb_shared: for userspace poll support
385 * @sysfs_entry: for exposing information about this buffer in sysfs.
386 *
387 * This represents a shared buffer, created by calling dma_buf_export(). The
388 * userspace representation is a normal file descriptor, which can be created by
389 * calling dma_buf_fd().
390 *
391 * Shared dma buffers are reference counted using dma_buf_put() and
392 * get_dma_buf().
393 *
394 * Device DMA access is handled by the separate &struct dma_buf_attachment.
395 */
396 struct dma_buf {
397 size_t size;
398 struct file *file;
399 struct list_head attachments;
400 const struct dma_buf_ops *ops;
401 struct mutex lock;
402 unsigned vmapping_counter;
403 void *vmap_ptr;
404 const char *exp_name;
405 const char *name;
406 spinlock_t name_lock;
407 struct module *owner;
408 struct list_head list_node;
409 void *priv;
410 struct dma_resv *resv;
411
412 /* poll support */
413 wait_queue_head_t poll;
414
415 struct dma_buf_poll_cb_t {
416 struct dma_fence_cb cb;
417 wait_queue_head_t *poll;
418
419 __poll_t active;
420 } cb_excl, cb_shared;
421 #ifdef CONFIG_DMABUF_SYSFS_STATS
422 /* for sysfs stats */
423 struct dma_buf_sysfs_entry {
424 struct kobject kobj;
425 struct dma_buf *dmabuf;
426 } *sysfs_entry;
427 #endif
428
429 ANDROID_KABI_RESERVE(1);
430 ANDROID_KABI_RESERVE(2);
431 };
432
433 /**
434 * struct dma_buf_attach_ops - importer operations for an attachment
435 *
436 * Attachment operations implemented by the importer.
437 */
438 struct dma_buf_attach_ops {
439 /**
440 * @allow_peer2peer:
441 *
442 * If this is set to true the importer must be able to handle peer
443 * resources without struct pages.
444 */
445 bool allow_peer2peer;
446
447 /**
448 * @move_notify: [optional] notification that the DMA-buf is moving
449 *
450 * If this callback is provided the framework can avoid pinning the
451 * backing store while mappings exists.
452 *
453 * This callback is called with the lock of the reservation object
454 * associated with the dma_buf held and the mapping function must be
455 * called with this lock held as well. This makes sure that no mapping
456 * is created concurrently with an ongoing move operation.
457 *
458 * Mappings stay valid and are not directly affected by this callback.
459 * But the DMA-buf can now be in a different physical location, so all
460 * mappings should be destroyed and re-created as soon as possible.
461 *
462 * New mappings can be created after this callback returns, and will
463 * point to the new location of the DMA-buf.
464 */
465 void (*move_notify)(struct dma_buf_attachment *attach);
466 };
467
468 /**
469 * struct dma_buf_attachment - holds device-buffer attachment data
470 * @dmabuf: buffer for this attachment.
471 * @dev: device attached to the buffer.
472 * @node: list of dma_buf_attachment, protected by dma_resv lock of the dmabuf.
473 * @sgt: cached mapping.
474 * @dir: direction of cached mapping.
475 * @peer2peer: true if the importer can handle peer resources without pages.
476 * @priv: exporter specific attachment data.
477 * @importer_ops: importer operations for this attachment, if provided
478 * dma_buf_map/unmap_attachment() must be called with the dma_resv lock held.
479 * @importer_priv: importer specific attachment data.
480 * @dma_map_attrs: DMA attributes to be used when the exporter maps the buffer
481 * through dma_buf_map_attachment.
482 *
483 * This structure holds the attachment information between the dma_buf buffer
484 * and its user device(s). The list contains one attachment struct per device
485 * attached to the buffer.
486 *
487 * An attachment is created by calling dma_buf_attach(), and released again by
488 * calling dma_buf_detach(). The DMA mapping itself needed to initiate a
489 * transfer is created by dma_buf_map_attachment() and freed again by calling
490 * dma_buf_unmap_attachment().
491 */
492 struct dma_buf_attachment {
493 struct dma_buf *dmabuf;
494 struct device *dev;
495 struct list_head node;
496 struct sg_table *sgt;
497 enum dma_data_direction dir;
498 bool peer2peer;
499 const struct dma_buf_attach_ops *importer_ops;
500 void *importer_priv;
501 void *priv;
502 unsigned long dma_map_attrs;
503
504 ANDROID_KABI_RESERVE(1);
505 ANDROID_KABI_RESERVE(2);
506 };
507
508 /**
509 * struct dma_buf_export_info - holds information needed to export a dma_buf
510 * @exp_name: name of the exporter - useful for debugging.
511 * @owner: pointer to exporter module - used for refcounting kernel module
512 * @ops: Attach allocator-defined dma buf ops to the new buffer
513 * @size: Size of the buffer
514 * @flags: mode flags for the file
515 * @resv: reservation-object, NULL to allocate default one
516 * @priv: Attach private data of allocator to this buffer
517 *
518 * This structure holds the information required to export the buffer. Used
519 * with dma_buf_export() only.
520 */
521 struct dma_buf_export_info {
522 const char *exp_name;
523 struct module *owner;
524 const struct dma_buf_ops *ops;
525 size_t size;
526 int flags;
527 struct dma_resv *resv;
528 void *priv;
529
530 ANDROID_KABI_RESERVE(1);
531 ANDROID_KABI_RESERVE(2);
532 };
533
534 /**
535 * DEFINE_DMA_BUF_EXPORT_INFO - helper macro for exporters
536 * @name: export-info name
537 *
538 * DEFINE_DMA_BUF_EXPORT_INFO macro defines the &struct dma_buf_export_info,
539 * zeroes it out and pre-populates exp_name in it.
540 */
541 #define DEFINE_DMA_BUF_EXPORT_INFO(name) \
542 struct dma_buf_export_info name = { .exp_name = KBUILD_MODNAME, \
543 .owner = THIS_MODULE }
544
545 /**
546 * get_dma_buf - convenience wrapper for get_file.
547 * @dmabuf: [in] pointer to dma_buf
548 *
549 * Increments the reference count on the dma-buf, needed in case of drivers
550 * that either need to create additional references to the dmabuf on the
551 * kernel side. For example, an exporter that needs to keep a dmabuf ptr
552 * so that subsequent exports don't create a new dmabuf.
553 */
get_dma_buf(struct dma_buf * dmabuf)554 static inline void get_dma_buf(struct dma_buf *dmabuf)
555 {
556 get_file(dmabuf->file);
557 }
558
559 /**
560 * dma_buf_is_dynamic - check if a DMA-buf uses dynamic mappings.
561 * @dmabuf: the DMA-buf to check
562 *
563 * Returns true if a DMA-buf exporter wants to be called with the dma_resv
564 * locked for the map/unmap callbacks, false if it doesn't wants to be called
565 * with the lock held.
566 */
dma_buf_is_dynamic(struct dma_buf * dmabuf)567 static inline bool dma_buf_is_dynamic(struct dma_buf *dmabuf)
568 {
569 return !!dmabuf->ops->pin;
570 }
571
572 /**
573 * dma_buf_attachment_is_dynamic - check if a DMA-buf attachment uses dynamic
574 * mappinsg
575 * @attach: the DMA-buf attachment to check
576 *
577 * Returns true if a DMA-buf importer wants to call the map/unmap functions with
578 * the dma_resv lock held.
579 */
580 static inline bool
dma_buf_attachment_is_dynamic(struct dma_buf_attachment * attach)581 dma_buf_attachment_is_dynamic(struct dma_buf_attachment *attach)
582 {
583 return !!attach->importer_ops;
584 }
585
586 int get_each_dmabuf(int (*callback)(const struct dma_buf *dmabuf,
587 void *private), void *private);
588 int is_dma_buf_file(struct file *file);
589 struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf,
590 struct device *dev);
591 struct dma_buf_attachment *
592 dma_buf_dynamic_attach(struct dma_buf *dmabuf, struct device *dev,
593 const struct dma_buf_attach_ops *importer_ops,
594 void *importer_priv);
595 void dma_buf_detach(struct dma_buf *dmabuf,
596 struct dma_buf_attachment *attach);
597 int dma_buf_pin(struct dma_buf_attachment *attach);
598 void dma_buf_unpin(struct dma_buf_attachment *attach);
599
600 struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info);
601
602 int dma_buf_fd(struct dma_buf *dmabuf, int flags);
603 struct dma_buf *dma_buf_get(int fd);
604 void dma_buf_put(struct dma_buf *dmabuf);
605
606 struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *,
607 enum dma_data_direction);
608 void dma_buf_unmap_attachment(struct dma_buf_attachment *, struct sg_table *,
609 enum dma_data_direction);
610 void dma_buf_move_notify(struct dma_buf *dma_buf);
611 int dma_buf_begin_cpu_access(struct dma_buf *dma_buf,
612 enum dma_data_direction dir);
613 int dma_buf_begin_cpu_access_partial(struct dma_buf *dma_buf,
614 enum dma_data_direction dir,
615 unsigned int offset, unsigned int len);
616 int dma_buf_end_cpu_access(struct dma_buf *dma_buf,
617 enum dma_data_direction dir);
618 int dma_buf_end_cpu_access_partial(struct dma_buf *dma_buf,
619 enum dma_data_direction dir,
620 unsigned int offset, unsigned int len);
621
622 int dma_buf_mmap(struct dma_buf *, struct vm_area_struct *,
623 unsigned long);
624 void *dma_buf_vmap(struct dma_buf *);
625 void dma_buf_vunmap(struct dma_buf *, void *vaddr);
626 long dma_buf_set_name(struct dma_buf *dmabuf, const char *name);
627 int dma_buf_get_flags(struct dma_buf *dmabuf, unsigned long *flags);
628 int dma_buf_get_uuid(struct dma_buf *dmabuf, uuid_t *uuid);
629
630 #endif /* __DMA_BUF_H__ */
631