1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Framework for userspace DMA-BUF allocations 4 * 5 * Copyright (C) 2011 Google, Inc. 6 * Copyright (C) 2019 Linaro Ltd. 7 */ 8 9 #include <linux/cdev.h> 10 #include <linux/device.h> 11 #include <linux/dma-buf.h> 12 #include <linux/dma-heap.h> 13 #include <linux/err.h> 14 #include <linux/export.h> 15 #include <linux/list.h> 16 #include <linux/nospec.h> 17 #include <linux/syscalls.h> 18 #include <linux/uaccess.h> 19 #include <linux/xarray.h> 20 #include <uapi/linux/dma-heap.h> 21 22 #define DEVNAME "dma_heap" 23 24 #define NUM_HEAP_MINORS 128 25 26 /** 27 * struct dma_heap - represents a dmabuf heap in the system 28 * @name: used for debugging/device-node name 29 * @ops: ops struct for this heap 30 * @priv: private data for this heap 31 * @heap_devt: heap device node 32 * @list: list head connecting to list of heaps 33 * @heap_cdev: heap char device 34 * 35 * Represents a heap of memory from which buffers can be made. 36 */ 37 struct dma_heap { 38 const char *name; 39 const struct dma_heap_ops *ops; 40 void *priv; 41 dev_t heap_devt; 42 struct list_head list; 43 struct cdev heap_cdev; 44 }; 45 46 static LIST_HEAD(heap_list); 47 static DEFINE_MUTEX(heap_list_lock); 48 static dev_t dma_heap_devt; 49 static struct class *dma_heap_class; 50 static DEFINE_XARRAY_ALLOC(dma_heap_minors); 51 52 bool __read_mostly mem_accounting; 53 module_param(mem_accounting, bool, 0444); 54 MODULE_PARM_DESC(mem_accounting, 55 "Enable cgroup-based memory accounting for dma-buf heap allocations (default=false)."); 56 57 static int dma_heap_buffer_alloc(struct dma_heap *heap, size_t len, 58 u32 fd_flags, 59 u64 heap_flags) 60 { 61 struct dma_buf *dmabuf; 62 int fd; 63 64 /* 65 * Allocations from all heaps have to begin 66 * and end on page boundaries. 67 */ 68 len = PAGE_ALIGN(len); 69 if (!len) 70 return -EINVAL; 71 72 dmabuf = heap->ops->allocate(heap, len, fd_flags, heap_flags); 73 if (IS_ERR(dmabuf)) 74 return PTR_ERR(dmabuf); 75 76 fd = dma_buf_fd(dmabuf, fd_flags); 77 if (fd < 0) { 78 dma_buf_put(dmabuf); 79 /* just return, as put will call release and that will free */ 80 } 81 return fd; 82 } 83 84 static int dma_heap_open(struct inode *inode, struct file *file) 85 { 86 struct dma_heap *heap; 87 88 heap = xa_load(&dma_heap_minors, iminor(inode)); 89 if (!heap) { 90 pr_err("dma_heap: minor %d unknown.\n", iminor(inode)); 91 return -ENODEV; 92 } 93 94 /* instance data as context */ 95 file->private_data = heap; 96 nonseekable_open(inode, file); 97 98 return 0; 99 } 100 101 static long dma_heap_ioctl_allocate(struct file *file, void *data) 102 { 103 struct dma_heap_allocation_data *heap_allocation = data; 104 struct dma_heap *heap = file->private_data; 105 int fd; 106 107 if (heap_allocation->fd) 108 return -EINVAL; 109 110 if (heap_allocation->fd_flags & ~DMA_HEAP_VALID_FD_FLAGS) 111 return -EINVAL; 112 113 if (heap_allocation->heap_flags & ~DMA_HEAP_VALID_HEAP_FLAGS) 114 return -EINVAL; 115 116 fd = dma_heap_buffer_alloc(heap, heap_allocation->len, 117 heap_allocation->fd_flags, 118 heap_allocation->heap_flags); 119 if (fd < 0) 120 return fd; 121 122 heap_allocation->fd = fd; 123 124 return 0; 125 } 126 127 static unsigned int dma_heap_ioctl_cmds[] = { 128 DMA_HEAP_IOCTL_ALLOC, 129 }; 130 131 static long dma_heap_ioctl(struct file *file, unsigned int ucmd, 132 unsigned long arg) 133 { 134 char stack_kdata[128]; 135 char *kdata = stack_kdata; 136 unsigned int kcmd; 137 unsigned int in_size, out_size, drv_size, ksize; 138 int nr = _IOC_NR(ucmd); 139 int ret = 0; 140 141 if (nr >= ARRAY_SIZE(dma_heap_ioctl_cmds)) 142 return -EINVAL; 143 144 nr = array_index_nospec(nr, ARRAY_SIZE(dma_heap_ioctl_cmds)); 145 /* Get the kernel ioctl cmd that matches */ 146 kcmd = dma_heap_ioctl_cmds[nr]; 147 148 /* Figure out the delta between user cmd size and kernel cmd size */ 149 drv_size = _IOC_SIZE(kcmd); 150 out_size = _IOC_SIZE(ucmd); 151 in_size = out_size; 152 if ((ucmd & kcmd & IOC_IN) == 0) 153 in_size = 0; 154 if ((ucmd & kcmd & IOC_OUT) == 0) 155 out_size = 0; 156 ksize = max(max(in_size, out_size), drv_size); 157 158 /* If necessary, allocate buffer for ioctl argument */ 159 if (ksize > sizeof(stack_kdata)) { 160 kdata = kmalloc(ksize, GFP_KERNEL); 161 if (!kdata) 162 return -ENOMEM; 163 } 164 165 if (copy_from_user(kdata, (void __user *)arg, in_size) != 0) { 166 ret = -EFAULT; 167 goto err; 168 } 169 170 /* zero out any difference between the kernel/user structure size */ 171 if (ksize > in_size) 172 memset(kdata + in_size, 0, ksize - in_size); 173 174 switch (kcmd) { 175 case DMA_HEAP_IOCTL_ALLOC: 176 ret = dma_heap_ioctl_allocate(file, kdata); 177 break; 178 default: 179 ret = -ENOTTY; 180 goto err; 181 } 182 183 if (copy_to_user((void __user *)arg, kdata, out_size) != 0) 184 ret = -EFAULT; 185 err: 186 if (kdata != stack_kdata) 187 kfree(kdata); 188 return ret; 189 } 190 191 static const struct file_operations dma_heap_fops = { 192 .owner = THIS_MODULE, 193 .open = dma_heap_open, 194 .unlocked_ioctl = dma_heap_ioctl, 195 #ifdef CONFIG_COMPAT 196 .compat_ioctl = dma_heap_ioctl, 197 #endif 198 }; 199 200 /** 201 * dma_heap_get_drvdata - get per-heap driver data 202 * @heap: DMA-Heap to retrieve private data for 203 * 204 * Returns: 205 * The per-heap data for the heap. 206 */ 207 void *dma_heap_get_drvdata(struct dma_heap *heap) 208 { 209 return heap->priv; 210 } 211 EXPORT_SYMBOL_NS_GPL(dma_heap_get_drvdata, "DMA_BUF_HEAP"); 212 213 /** 214 * dma_heap_get_name - get heap name 215 * @heap: DMA-Heap to retrieve the name of 216 * 217 * Returns: 218 * The char* for the heap name. 219 */ 220 const char *dma_heap_get_name(struct dma_heap *heap) 221 { 222 return heap->name; 223 } 224 EXPORT_SYMBOL_NS_GPL(dma_heap_get_name, "DMA_BUF_HEAP"); 225 226 /** 227 * dma_heap_add - adds a heap to dmabuf heaps 228 * @exp_info: information needed to register this heap 229 */ 230 struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info) 231 { 232 struct dma_heap *heap, *h, *err_ret; 233 struct device *dev_ret; 234 unsigned int minor; 235 int ret; 236 237 if (!exp_info->name || !strcmp(exp_info->name, "")) { 238 pr_err("dma_heap: Cannot add heap without a name\n"); 239 return ERR_PTR(-EINVAL); 240 } 241 242 if (!exp_info->ops || !exp_info->ops->allocate) { 243 pr_err("dma_heap: Cannot add heap with invalid ops struct\n"); 244 return ERR_PTR(-EINVAL); 245 } 246 247 heap = kzalloc(sizeof(*heap), GFP_KERNEL); 248 if (!heap) 249 return ERR_PTR(-ENOMEM); 250 251 heap->name = exp_info->name; 252 heap->ops = exp_info->ops; 253 heap->priv = exp_info->priv; 254 255 /* Find unused minor number */ 256 ret = xa_alloc(&dma_heap_minors, &minor, heap, 257 XA_LIMIT(0, NUM_HEAP_MINORS - 1), GFP_KERNEL); 258 if (ret < 0) { 259 pr_err("dma_heap: Unable to get minor number for heap\n"); 260 err_ret = ERR_PTR(ret); 261 goto err0; 262 } 263 264 /* Create device */ 265 heap->heap_devt = MKDEV(MAJOR(dma_heap_devt), minor); 266 267 cdev_init(&heap->heap_cdev, &dma_heap_fops); 268 ret = cdev_add(&heap->heap_cdev, heap->heap_devt, 1); 269 if (ret < 0) { 270 pr_err("dma_heap: Unable to add char device\n"); 271 err_ret = ERR_PTR(ret); 272 goto err1; 273 } 274 275 dev_ret = device_create(dma_heap_class, 276 NULL, 277 heap->heap_devt, 278 NULL, 279 heap->name); 280 if (IS_ERR(dev_ret)) { 281 pr_err("dma_heap: Unable to create device\n"); 282 err_ret = ERR_CAST(dev_ret); 283 goto err2; 284 } 285 286 mutex_lock(&heap_list_lock); 287 /* check the name is unique */ 288 list_for_each_entry(h, &heap_list, list) { 289 if (!strcmp(h->name, exp_info->name)) { 290 mutex_unlock(&heap_list_lock); 291 pr_err("dma_heap: Already registered heap named %s\n", 292 exp_info->name); 293 err_ret = ERR_PTR(-EINVAL); 294 goto err3; 295 } 296 } 297 298 /* Add heap to the list */ 299 list_add(&heap->list, &heap_list); 300 mutex_unlock(&heap_list_lock); 301 302 return heap; 303 304 err3: 305 device_destroy(dma_heap_class, heap->heap_devt); 306 err2: 307 cdev_del(&heap->heap_cdev); 308 err1: 309 xa_erase(&dma_heap_minors, minor); 310 err0: 311 kfree(heap); 312 return err_ret; 313 } 314 EXPORT_SYMBOL_NS_GPL(dma_heap_add, "DMA_BUF_HEAP"); 315 316 static char *dma_heap_devnode(const struct device *dev, umode_t *mode) 317 { 318 return kasprintf(GFP_KERNEL, "dma_heap/%s", dev_name(dev)); 319 } 320 321 static int dma_heap_init(void) 322 { 323 int ret; 324 325 ret = alloc_chrdev_region(&dma_heap_devt, 0, NUM_HEAP_MINORS, DEVNAME); 326 if (ret) 327 return ret; 328 329 dma_heap_class = class_create(DEVNAME); 330 if (IS_ERR(dma_heap_class)) { 331 unregister_chrdev_region(dma_heap_devt, NUM_HEAP_MINORS); 332 return PTR_ERR(dma_heap_class); 333 } 334 dma_heap_class->devnode = dma_heap_devnode; 335 336 return 0; 337 } 338 subsys_initcall(dma_heap_init); 339