1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Framework for userspace DMA-BUF allocations 4 * 5 * Copyright (C) 2011 Google, Inc. 6 * Copyright (C) 2019 Linaro Ltd. 7 */ 8 9 #include <linux/cdev.h> 10 #include <linux/device.h> 11 #include <linux/dma-buf.h> 12 #include <linux/dma-heap.h> 13 #include <linux/err.h> 14 #include <linux/export.h> 15 #include <linux/list.h> 16 #include <linux/minmax.h> 17 #include <linux/nospec.h> 18 #include <linux/syscalls.h> 19 #include <linux/uaccess.h> 20 #include <linux/xarray.h> 21 #include <uapi/linux/dma-heap.h> 22 23 #define DEVNAME "dma_heap" 24 25 #define NUM_HEAP_MINORS 128 26 27 /** 28 * struct dma_heap - represents a dmabuf heap in the system 29 * @name: used for debugging/device-node name 30 * @ops: ops struct for this heap 31 * @priv: private data for this heap 32 * @heap_devt: heap device node 33 * @list: list head connecting to list of heaps 34 * @heap_cdev: heap char device 35 * 36 * Represents a heap of memory from which buffers can be made. 37 */ 38 struct dma_heap { 39 const char *name; 40 const struct dma_heap_ops *ops; 41 void *priv; 42 dev_t heap_devt; 43 struct list_head list; 44 struct cdev heap_cdev; 45 }; 46 47 static LIST_HEAD(heap_list); 48 static DEFINE_MUTEX(heap_list_lock); 49 static dev_t dma_heap_devt; 50 static struct class *dma_heap_class; 51 static DEFINE_XARRAY_ALLOC(dma_heap_minors); 52 53 bool __read_mostly mem_accounting; 54 module_param(mem_accounting, bool, 0444); 55 MODULE_PARM_DESC(mem_accounting, 56 "Enable cgroup-based memory accounting for dma-buf heap allocations (default=false)."); 57 EXPORT_SYMBOL_NS_GPL(mem_accounting, "DMA_BUF_HEAP"); 58 59 static int dma_heap_buffer_alloc(struct dma_heap *heap, size_t len, 60 u32 fd_flags, 61 u64 heap_flags) 62 { 63 struct dma_buf *dmabuf; 64 int fd; 65 66 /* 67 * Allocations from all heaps have to begin 68 * and end on page boundaries. 69 */ 70 len = PAGE_ALIGN(len); 71 if (!len) 72 return -EINVAL; 73 74 dmabuf = heap->ops->allocate(heap, len, fd_flags, heap_flags); 75 if (IS_ERR(dmabuf)) 76 return PTR_ERR(dmabuf); 77 78 fd = dma_buf_fd(dmabuf, fd_flags); 79 if (fd < 0) { 80 dma_buf_put(dmabuf); 81 /* just return, as put will call release and that will free */ 82 } 83 return fd; 84 } 85 86 static int dma_heap_open(struct inode *inode, struct file *file) 87 { 88 struct dma_heap *heap; 89 90 heap = xa_load(&dma_heap_minors, iminor(inode)); 91 if (!heap) { 92 pr_err("dma_heap: minor %d unknown.\n", iminor(inode)); 93 return -ENODEV; 94 } 95 96 /* instance data as context */ 97 file->private_data = heap; 98 nonseekable_open(inode, file); 99 100 return 0; 101 } 102 103 static long dma_heap_ioctl_allocate(struct file *file, void *data) 104 { 105 struct dma_heap_allocation_data *heap_allocation = data; 106 struct dma_heap *heap = file->private_data; 107 int fd; 108 109 if (heap_allocation->fd) 110 return -EINVAL; 111 112 if (heap_allocation->fd_flags & ~DMA_HEAP_VALID_FD_FLAGS) 113 return -EINVAL; 114 115 if (heap_allocation->heap_flags & ~DMA_HEAP_VALID_HEAP_FLAGS) 116 return -EINVAL; 117 118 fd = dma_heap_buffer_alloc(heap, heap_allocation->len, 119 heap_allocation->fd_flags, 120 heap_allocation->heap_flags); 121 if (fd < 0) 122 return fd; 123 124 heap_allocation->fd = fd; 125 126 return 0; 127 } 128 129 static unsigned int dma_heap_ioctl_cmds[] = { 130 DMA_HEAP_IOCTL_ALLOC, 131 }; 132 133 static long dma_heap_ioctl(struct file *file, unsigned int ucmd, 134 unsigned long arg) 135 { 136 char stack_kdata[128]; 137 char *kdata = stack_kdata; 138 unsigned int kcmd; 139 unsigned int in_size, out_size, drv_size, ksize; 140 int nr = _IOC_NR(ucmd); 141 int ret = 0; 142 143 if (nr >= ARRAY_SIZE(dma_heap_ioctl_cmds)) 144 return -EINVAL; 145 146 nr = array_index_nospec(nr, ARRAY_SIZE(dma_heap_ioctl_cmds)); 147 /* Get the kernel ioctl cmd that matches */ 148 kcmd = dma_heap_ioctl_cmds[nr]; 149 150 /* Figure out the delta between user cmd size and kernel cmd size */ 151 drv_size = _IOC_SIZE(kcmd); 152 out_size = _IOC_SIZE(ucmd); 153 in_size = out_size; 154 if ((ucmd & kcmd & IOC_IN) == 0) 155 in_size = 0; 156 if ((ucmd & kcmd & IOC_OUT) == 0) 157 out_size = 0; 158 ksize = max3(in_size, out_size, drv_size); 159 160 /* If necessary, allocate buffer for ioctl argument */ 161 if (ksize > sizeof(stack_kdata)) { 162 kdata = kmalloc(ksize, GFP_KERNEL); 163 if (!kdata) 164 return -ENOMEM; 165 } 166 167 if (copy_from_user(kdata, (void __user *)arg, in_size) != 0) { 168 ret = -EFAULT; 169 goto err; 170 } 171 172 /* zero out any difference between the kernel/user structure size */ 173 if (ksize > in_size) 174 memset(kdata + in_size, 0, ksize - in_size); 175 176 switch (kcmd) { 177 case DMA_HEAP_IOCTL_ALLOC: 178 ret = dma_heap_ioctl_allocate(file, kdata); 179 break; 180 default: 181 ret = -ENOTTY; 182 goto err; 183 } 184 185 if (copy_to_user((void __user *)arg, kdata, out_size) != 0) 186 ret = -EFAULT; 187 err: 188 if (kdata != stack_kdata) 189 kfree(kdata); 190 return ret; 191 } 192 193 static const struct file_operations dma_heap_fops = { 194 .owner = THIS_MODULE, 195 .open = dma_heap_open, 196 .unlocked_ioctl = dma_heap_ioctl, 197 #ifdef CONFIG_COMPAT 198 .compat_ioctl = dma_heap_ioctl, 199 #endif 200 }; 201 202 /** 203 * dma_heap_get_drvdata - get per-heap driver data 204 * @heap: DMA-Heap to retrieve private data for 205 * 206 * Returns: 207 * The per-heap data for the heap. 208 */ 209 void *dma_heap_get_drvdata(struct dma_heap *heap) 210 { 211 return heap->priv; 212 } 213 EXPORT_SYMBOL_NS_GPL(dma_heap_get_drvdata, "DMA_BUF_HEAP"); 214 215 /** 216 * dma_heap_get_name - get heap name 217 * @heap: DMA-Heap to retrieve the name of 218 * 219 * Returns: 220 * The char* for the heap name. 221 */ 222 const char *dma_heap_get_name(struct dma_heap *heap) 223 { 224 return heap->name; 225 } 226 EXPORT_SYMBOL_NS_GPL(dma_heap_get_name, "DMA_BUF_HEAP"); 227 228 /** 229 * dma_heap_add - adds a heap to dmabuf heaps 230 * @exp_info: information needed to register this heap 231 */ 232 struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info) 233 { 234 struct dma_heap *heap, *h, *err_ret; 235 struct device *dev_ret; 236 unsigned int minor; 237 int ret; 238 239 if (!exp_info->name || !strcmp(exp_info->name, "")) { 240 pr_err("dma_heap: Cannot add heap without a name\n"); 241 return ERR_PTR(-EINVAL); 242 } 243 244 if (!exp_info->ops || !exp_info->ops->allocate) { 245 pr_err("dma_heap: Cannot add heap with invalid ops struct\n"); 246 return ERR_PTR(-EINVAL); 247 } 248 249 heap = kzalloc_obj(*heap); 250 if (!heap) 251 return ERR_PTR(-ENOMEM); 252 253 heap->name = exp_info->name; 254 heap->ops = exp_info->ops; 255 heap->priv = exp_info->priv; 256 257 /* Find unused minor number */ 258 ret = xa_alloc(&dma_heap_minors, &minor, heap, 259 XA_LIMIT(0, NUM_HEAP_MINORS - 1), GFP_KERNEL); 260 if (ret < 0) { 261 pr_err("dma_heap: Unable to get minor number for heap\n"); 262 err_ret = ERR_PTR(ret); 263 goto err0; 264 } 265 266 /* Create device */ 267 heap->heap_devt = MKDEV(MAJOR(dma_heap_devt), minor); 268 269 cdev_init(&heap->heap_cdev, &dma_heap_fops); 270 ret = cdev_add(&heap->heap_cdev, heap->heap_devt, 1); 271 if (ret < 0) { 272 pr_err("dma_heap: Unable to add char device\n"); 273 err_ret = ERR_PTR(ret); 274 goto err1; 275 } 276 277 dev_ret = device_create(dma_heap_class, 278 NULL, 279 heap->heap_devt, 280 NULL, 281 heap->name); 282 if (IS_ERR(dev_ret)) { 283 pr_err("dma_heap: Unable to create device\n"); 284 err_ret = ERR_CAST(dev_ret); 285 goto err2; 286 } 287 288 mutex_lock(&heap_list_lock); 289 /* check the name is unique */ 290 list_for_each_entry(h, &heap_list, list) { 291 if (!strcmp(h->name, exp_info->name)) { 292 mutex_unlock(&heap_list_lock); 293 pr_err("dma_heap: Already registered heap named %s\n", 294 exp_info->name); 295 err_ret = ERR_PTR(-EINVAL); 296 goto err3; 297 } 298 } 299 300 /* Add heap to the list */ 301 list_add(&heap->list, &heap_list); 302 mutex_unlock(&heap_list_lock); 303 304 return heap; 305 306 err3: 307 device_destroy(dma_heap_class, heap->heap_devt); 308 err2: 309 cdev_del(&heap->heap_cdev); 310 err1: 311 xa_erase(&dma_heap_minors, minor); 312 err0: 313 kfree(heap); 314 return err_ret; 315 } 316 EXPORT_SYMBOL_NS_GPL(dma_heap_add, "DMA_BUF_HEAP"); 317 318 static char *dma_heap_devnode(const struct device *dev, umode_t *mode) 319 { 320 return kasprintf(GFP_KERNEL, "dma_heap/%s", dev_name(dev)); 321 } 322 323 static int dma_heap_init(void) 324 { 325 int ret; 326 327 ret = alloc_chrdev_region(&dma_heap_devt, 0, NUM_HEAP_MINORS, DEVNAME); 328 if (ret) 329 return ret; 330 331 dma_heap_class = class_create(DEVNAME); 332 if (IS_ERR(dma_heap_class)) { 333 unregister_chrdev_region(dma_heap_devt, NUM_HEAP_MINORS); 334 return PTR_ERR(dma_heap_class); 335 } 336 dma_heap_class->devnode = dma_heap_devnode; 337 338 return 0; 339 } 340 subsys_initcall(dma_heap_init); 341