drivers/dma-buf/udmabuf.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <linux/cred.h>
   3 #include <linux/device.h>
   4 #include <linux/dma-buf.h>
   5 #include <linux/highmem.h>
   6 #include <linux/init.h>
   7 #include <linux/kernel.h>
   8 #include <linux/memfd.h>
   9 #include <linux/miscdevice.h>
  10 #include <linux/module.h>
  11 #include <linux/shmem_fs.h>
  12 #include <linux/slab.h>
  13 #include <linux/udmabuf.h>
  14
  15 static const u32    list_limit = 1024;  /* udmabuf_create_list->count limit */
  16 static const size_t size_limit_mb = 64; /* total dmabuf size, in megabytes  */
  17
  18 struct udmabuf {
  19         pgoff_t pagecount;
  20         struct page **pages;
  21         struct miscdevice *device;
  22 };
  23
  24 static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf)
  25 {
  26         struct vm_area_struct *vma = vmf->vma;
  27         struct udmabuf *ubuf = vma->vm_private_data;
  28
  29         vmf->page = ubuf->pages[vmf->pgoff];
  30         get_page(vmf->page);
  31         return 0;
  32 }
  33
  34 static const struct vm_operations_struct udmabuf_vm_ops = {
  35         .fault = udmabuf_vm_fault,
  36 };
  37
  38 static int mmap_udmabuf(struct dma_buf *buf, struct vm_area_struct *vma)
  39 {
  40         struct udmabuf *ubuf = buf->priv;
  41
  42         if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) == 0)
  43                 return -EINVAL;
  44
  45         vma->vm_ops = &udmabuf_vm_ops;
  46         vma->vm_private_data = ubuf;
  47         return 0;
  48 }
  49
  50 static struct sg_table *get_sg_table(struct device *dev, struct dma_buf *buf,
  51                                      enum dma_data_direction direction)
  52 {
  53         struct udmabuf *ubuf = buf->priv;
  54         struct sg_table *sg;
  55         int ret;
  56
  57         sg = kzalloc(sizeof(*sg), GFP_KERNEL);
  58         if (!sg)
  59                 return ERR_PTR(-ENOMEM);
  60         ret = sg_alloc_table_from_pages(sg, ubuf->pages, ubuf->pagecount,
  61                                         0, ubuf->pagecount << PAGE_SHIFT,
  62                                         GFP_KERNEL);
  63         if (ret < 0)
  64                 goto err;
  65         if (!dma_map_sg(dev, sg->sgl, sg->nents, direction)) {
  66                 ret = -EINVAL;
  67                 goto err;
  68         }
  69         return sg;
  70
  71 err:
  72         sg_free_table(sg);
  73         kfree(sg);
  74         return ERR_PTR(ret);
  75 }
  76
  77 static void put_sg_table(struct device *dev, struct sg_table *sg,
  78                          enum dma_data_direction direction)
  79 {
  80         dma_unmap_sg(dev, sg->sgl, sg->nents, direction);
  81         sg_free_table(sg);
  82         kfree(sg);
  83 }
  84
  85 static struct sg_table *map_udmabuf(struct dma_buf_attachment *at,
  86                                     enum dma_data_direction direction)
  87 {
  88         return get_sg_table(at->dev, at->dmabuf, direction);
  89 }
  90
  91 static void unmap_udmabuf(struct dma_buf_attachment *at,
  92                           struct sg_table *sg,
  93                           enum dma_data_direction direction)
  94 {
  95         return put_sg_table(at->dev, sg, direction);
  96 }
  97
  98 static void release_udmabuf(struct dma_buf *buf)
  99 {
 100         struct udmabuf *ubuf = buf->priv;
 101         pgoff_t pg;
 102
 103         for (pg = 0; pg < ubuf->pagecount; pg++)
 104                 put_page(ubuf->pages[pg]);
 105         kfree(ubuf->pages);
 106         kfree(ubuf);
 107 }
 108
 109 static const struct dma_buf_ops udmabuf_ops = {
 110         .cache_sgt_mapping = true,
 111         .map_dma_buf       = map_udmabuf,
 112         .unmap_dma_buf     = unmap_udmabuf,
 113         .release           = release_udmabuf,
 114         .mmap              = mmap_udmabuf,
 115 };
 116
 117 #define SEALS_WANTED (F_SEAL_SHRINK)
 118 #define SEALS_DENIED (F_SEAL_WRITE)
 119
 120 static long udmabuf_create(struct miscdevice *device,
 121                            struct udmabuf_create_list *head,
 122                            struct udmabuf_create_item *list)
 123 {
 124         DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
 125         struct file *memfd = NULL;
 126         struct udmabuf *ubuf;
 127         struct dma_buf *buf;
 128         pgoff_t pgoff, pgcnt, pgidx, pgbuf = 0, pglimit;
 129         struct page *page;
 130         int seals, ret = -EINVAL;
 131         u32 i, flags;
 132
 133         ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL);
 134         if (!ubuf)
 135                 return -ENOMEM;
 136
 137         pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
 138         for (i = 0; i < head->count; i++) {
 139                 if (!IS_ALIGNED(list[i].offset, PAGE_SIZE))
 140                         goto err;
 141                 if (!IS_ALIGNED(list[i].size, PAGE_SIZE))
 142                         goto err;
 143                 ubuf->pagecount += list[i].size >> PAGE_SHIFT;
 144                 if (ubuf->pagecount > pglimit)
 145                         goto err;
 146         }
 147         ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
 148                                     GFP_KERNEL);
 149         if (!ubuf->pages) {
 150                 ret = -ENOMEM;
 151                 goto err;
 152         }
 153
 154         pgbuf = 0;
 155         for (i = 0; i < head->count; i++) {
 156                 ret = -EBADFD;
 157                 memfd = fget(list[i].memfd);
 158                 if (!memfd)
 159                         goto err;
 160                 if (!shmem_mapping(file_inode(memfd)->i_mapping))
 161                         goto err;
 162                 seals = memfd_fcntl(memfd, F_GET_SEALS, 0);
 163                 if (seals == -EINVAL)
 164                         goto err;
 165                 ret = -EINVAL;
 166                 if ((seals & SEALS_WANTED) != SEALS_WANTED ||
 167                     (seals & SEALS_DENIED) != 0)
 168                         goto err;
 169                 pgoff = list[i].offset >> PAGE_SHIFT;
 170                 pgcnt = list[i].size   >> PAGE_SHIFT;
 171                 for (pgidx = 0; pgidx < pgcnt; pgidx++) {
 172                         page = shmem_read_mapping_page(
 173                                 file_inode(memfd)->i_mapping, pgoff + pgidx);
 174                         if (IS_ERR(page)) {
 175                                 ret = PTR_ERR(page);
 176                                 goto err;
 177                         }
 178                         ubuf->pages[pgbuf++] = page;
 179                 }
 180                 fput(memfd);
 181                 memfd = NULL;
 182         }
 183
 184         exp_info.ops  = &udmabuf_ops;
 185         exp_info.size = ubuf->pagecount << PAGE_SHIFT;
 186         exp_info.priv = ubuf;
 187         exp_info.flags = O_RDWR;
 188
 189         ubuf->device = device;
 190         buf = dma_buf_export(&exp_info);
 191         if (IS_ERR(buf)) {
 192                 ret = PTR_ERR(buf);
 193                 goto err;
 194         }
 195
 196         flags = 0;
 197         if (head->flags & UDMABUF_FLAGS_CLOEXEC)
 198                 flags |= O_CLOEXEC;
 199         return dma_buf_fd(buf, flags);
 200
 201 err:
 202         while (pgbuf > 0)
 203                 put_page(ubuf->pages[--pgbuf]);
 204         if (memfd)
 205                 fput(memfd);
 206         kfree(ubuf->pages);
 207         kfree(ubuf);
 208         return ret;
 209 }
 210
 211 static long udmabuf_ioctl_create(struct file *filp, unsigned long arg)
 212 {
 213         struct udmabuf_create create;
 214         struct udmabuf_create_list head;
 215         struct udmabuf_create_item list;
 216
 217         if (copy_from_user(&create, (void __user *)arg,
 218                            sizeof(create)))
 219                 return -EFAULT;
 220
 221         head.flags  = create.flags;
 222         head.count  = 1;
 223         list.memfd  = create.memfd;
 224         list.offset = create.offset;
 225         list.size   = create.size;
 226
 227         return udmabuf_create(filp->private_data, &head, &list);
 228 }
 229
 230 static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg)
 231 {
 232         struct udmabuf_create_list head;
 233         struct udmabuf_create_item *list;
 234         int ret = -EINVAL;
 235         u32 lsize;
 236
 237         if (copy_from_user(&head, (void __user *)arg, sizeof(head)))
 238                 return -EFAULT;
 239         if (head.count > list_limit)
 240                 return -EINVAL;
 241         lsize = sizeof(struct udmabuf_create_item) * head.count;
 242         list = memdup_user((void __user *)(arg + sizeof(head)), lsize);
 243         if (IS_ERR(list))
 244                 return PTR_ERR(list);
 245
 246         ret = udmabuf_create(filp->private_data, &head, list);
 247         kfree(list);
 248         return ret;
 249 }
 250
 251 static long udmabuf_ioctl(struct file *filp, unsigned int ioctl,
 252                           unsigned long arg)
 253 {
 254         long ret;
 255
 256         switch (ioctl) {
 257         case UDMABUF_CREATE:
 258                 ret = udmabuf_ioctl_create(filp, arg);
 259                 break;
 260         case UDMABUF_CREATE_LIST:
 261                 ret = udmabuf_ioctl_create_list(filp, arg);
 262                 break;
 263         default:
 264                 ret = -ENOTTY;
 265                 break;
 266         }
 267         return ret;
 268 }
 269
 270 static const struct file_operations udmabuf_fops = {
 271         .owner          = THIS_MODULE,
 272         .unlocked_ioctl = udmabuf_ioctl,
 273 };
 274
 275 static struct miscdevice udmabuf_misc = {
 276         .minor          = MISC_DYNAMIC_MINOR,
 277         .name           = "udmabuf",
 278         .fops           = &udmabuf_fops,
 279 };
 280
 281 static int __init udmabuf_dev_init(void)
 282 {
 283         return misc_register(&udmabuf_misc);
 284 }
 285
 286 static void __exit udmabuf_dev_exit(void)
 287 {
 288         misc_deregister(&udmabuf_misc);
 289 }
 290
 291 module_init(udmabuf_dev_init)
 292 module_exit(udmabuf_dev_exit)
 293
 294 MODULE_AUTHOR("Gerd Hoffmann <kraxel@redhat.com>");
 295 MODULE_LICENSE("GPL v2");