1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/cred.h> 3 #include <linux/device.h> 4 #include <linux/dma-buf.h> 5 #include <linux/highmem.h> 6 #include <linux/init.h> 7 #include <linux/kernel.h> 8 #include <linux/memfd.h> 9 #include <linux/miscdevice.h> 10 #include <linux/module.h> 11 #include <linux/shmem_fs.h> 12 #include <linux/slab.h> 13 #include <linux/udmabuf.h> 14 15 static const u32 list_limit = 1024; /* udmabuf_create_list->count limit */ 16 static const size_t size_limit_mb = 64; /* total dmabuf size, in megabytes */ 17 18 struct udmabuf { 19 pgoff_t pagecount; 20 struct page **pages; 21 struct sg_table *sg; 22 struct miscdevice *device; 23 }; 24 25 static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf) 26 { 27 struct vm_area_struct *vma = vmf->vma; 28 struct udmabuf *ubuf = vma->vm_private_data; 29 30 vmf->page = ubuf->pages[vmf->pgoff]; 31 get_page(vmf->page); 32 return 0; 33 } 34 35 static const struct vm_operations_struct udmabuf_vm_ops = { 36 .fault = udmabuf_vm_fault, 37 }; 38 39 static int mmap_udmabuf(struct dma_buf *buf, struct vm_area_struct *vma) 40 { 41 struct udmabuf *ubuf = buf->priv; 42 43 if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) == 0) 44 return -EINVAL; 45 46 vma->vm_ops = &udmabuf_vm_ops; 47 vma->vm_private_data = ubuf; 48 return 0; 49 } 50 51 static struct sg_table *get_sg_table(struct device *dev, struct dma_buf *buf, 52 enum dma_data_direction direction) 53 { 54 struct udmabuf *ubuf = buf->priv; 55 struct sg_table *sg; 56 int ret; 57 58 sg = kzalloc(sizeof(*sg), GFP_KERNEL); 59 if (!sg) 60 return ERR_PTR(-ENOMEM); 61 ret = sg_alloc_table_from_pages(sg, ubuf->pages, ubuf->pagecount, 62 0, ubuf->pagecount << PAGE_SHIFT, 63 GFP_KERNEL); 64 if (ret < 0) 65 goto err; 66 ret = dma_map_sgtable(dev, sg, direction, 0); 67 if (ret < 0) 68 goto err; 69 return sg; 70 71 err: 72 sg_free_table(sg); 73 kfree(sg); 74 return ERR_PTR(ret); 75 } 76 77 static void put_sg_table(struct device *dev, struct sg_table *sg, 78 enum dma_data_direction direction) 79 { 80 dma_unmap_sgtable(dev, sg, direction, 0); 81 sg_free_table(sg); 82 kfree(sg); 83 } 84 85 static struct sg_table *map_udmabuf(struct dma_buf_attachment *at, 86 enum dma_data_direction direction) 87 { 88 return get_sg_table(at->dev, at->dmabuf, direction); 89 } 90 91 static void unmap_udmabuf(struct dma_buf_attachment *at, 92 struct sg_table *sg, 93 enum dma_data_direction direction) 94 { 95 return put_sg_table(at->dev, sg, direction); 96 } 97 98 static void release_udmabuf(struct dma_buf *buf) 99 { 100 struct udmabuf *ubuf = buf->priv; 101 struct device *dev = ubuf->device->this_device; 102 pgoff_t pg; 103 104 if (ubuf->sg) 105 put_sg_table(dev, ubuf->sg, DMA_BIDIRECTIONAL); 106 107 for (pg = 0; pg < ubuf->pagecount; pg++) 108 put_page(ubuf->pages[pg]); 109 kfree(ubuf->pages); 110 kfree(ubuf); 111 } 112 113 static int begin_cpu_udmabuf(struct dma_buf *buf, 114 enum dma_data_direction direction) 115 { 116 struct udmabuf *ubuf = buf->priv; 117 struct device *dev = ubuf->device->this_device; 118 119 if (!ubuf->sg) { 120 ubuf->sg = get_sg_table(dev, buf, direction); 121 if (IS_ERR(ubuf->sg)) 122 return PTR_ERR(ubuf->sg); 123 } else { 124 dma_sync_sg_for_cpu(dev, ubuf->sg->sgl, ubuf->sg->nents, 125 direction); 126 } 127 128 return 0; 129 } 130 131 static int end_cpu_udmabuf(struct dma_buf *buf, 132 enum dma_data_direction direction) 133 { 134 struct udmabuf *ubuf = buf->priv; 135 struct device *dev = ubuf->device->this_device; 136 137 if (!ubuf->sg) 138 return -EINVAL; 139 140 dma_sync_sg_for_device(dev, ubuf->sg->sgl, ubuf->sg->nents, direction); 141 return 0; 142 } 143 144 static const struct dma_buf_ops udmabuf_ops = { 145 .cache_sgt_mapping = true, 146 .map_dma_buf = map_udmabuf, 147 .unmap_dma_buf = unmap_udmabuf, 148 .release = release_udmabuf, 149 .mmap = mmap_udmabuf, 150 .begin_cpu_access = begin_cpu_udmabuf, 151 .end_cpu_access = end_cpu_udmabuf, 152 }; 153 154 #define SEALS_WANTED (F_SEAL_SHRINK) 155 #define SEALS_DENIED (F_SEAL_WRITE) 156 157 static long udmabuf_create(struct miscdevice *device, 158 struct udmabuf_create_list *head, 159 struct udmabuf_create_item *list) 160 { 161 DEFINE_DMA_BUF_EXPORT_INFO(exp_info); 162 struct file *memfd = NULL; 163 struct udmabuf *ubuf; 164 struct dma_buf *buf; 165 pgoff_t pgoff, pgcnt, pgidx, pgbuf = 0, pglimit; 166 struct page *page; 167 int seals, ret = -EINVAL; 168 u32 i, flags; 169 170 ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL); 171 if (!ubuf) 172 return -ENOMEM; 173 174 pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT; 175 for (i = 0; i < head->count; i++) { 176 if (!IS_ALIGNED(list[i].offset, PAGE_SIZE)) 177 goto err; 178 if (!IS_ALIGNED(list[i].size, PAGE_SIZE)) 179 goto err; 180 ubuf->pagecount += list[i].size >> PAGE_SHIFT; 181 if (ubuf->pagecount > pglimit) 182 goto err; 183 } 184 ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages), 185 GFP_KERNEL); 186 if (!ubuf->pages) { 187 ret = -ENOMEM; 188 goto err; 189 } 190 191 pgbuf = 0; 192 for (i = 0; i < head->count; i++) { 193 ret = -EBADFD; 194 memfd = fget(list[i].memfd); 195 if (!memfd) 196 goto err; 197 if (!shmem_mapping(file_inode(memfd)->i_mapping)) 198 goto err; 199 seals = memfd_fcntl(memfd, F_GET_SEALS, 0); 200 if (seals == -EINVAL) 201 goto err; 202 ret = -EINVAL; 203 if ((seals & SEALS_WANTED) != SEALS_WANTED || 204 (seals & SEALS_DENIED) != 0) 205 goto err; 206 pgoff = list[i].offset >> PAGE_SHIFT; 207 pgcnt = list[i].size >> PAGE_SHIFT; 208 for (pgidx = 0; pgidx < pgcnt; pgidx++) { 209 page = shmem_read_mapping_page( 210 file_inode(memfd)->i_mapping, pgoff + pgidx); 211 if (IS_ERR(page)) { 212 ret = PTR_ERR(page); 213 goto err; 214 } 215 ubuf->pages[pgbuf++] = page; 216 } 217 fput(memfd); 218 memfd = NULL; 219 } 220 221 exp_info.ops = &udmabuf_ops; 222 exp_info.size = ubuf->pagecount << PAGE_SHIFT; 223 exp_info.priv = ubuf; 224 exp_info.flags = O_RDWR; 225 226 ubuf->device = device; 227 buf = dma_buf_export(&exp_info); 228 if (IS_ERR(buf)) { 229 ret = PTR_ERR(buf); 230 goto err; 231 } 232 233 flags = 0; 234 if (head->flags & UDMABUF_FLAGS_CLOEXEC) 235 flags |= O_CLOEXEC; 236 return dma_buf_fd(buf, flags); 237 238 err: 239 while (pgbuf > 0) 240 put_page(ubuf->pages[--pgbuf]); 241 if (memfd) 242 fput(memfd); 243 kfree(ubuf->pages); 244 kfree(ubuf); 245 return ret; 246 } 247 248 static long udmabuf_ioctl_create(struct file *filp, unsigned long arg) 249 { 250 struct udmabuf_create create; 251 struct udmabuf_create_list head; 252 struct udmabuf_create_item list; 253 254 if (copy_from_user(&create, (void __user *)arg, 255 sizeof(create))) 256 return -EFAULT; 257 258 head.flags = create.flags; 259 head.count = 1; 260 list.memfd = create.memfd; 261 list.offset = create.offset; 262 list.size = create.size; 263 264 return udmabuf_create(filp->private_data, &head, &list); 265 } 266 267 static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg) 268 { 269 struct udmabuf_create_list head; 270 struct udmabuf_create_item *list; 271 int ret = -EINVAL; 272 u32 lsize; 273 274 if (copy_from_user(&head, (void __user *)arg, sizeof(head))) 275 return -EFAULT; 276 if (head.count > list_limit) 277 return -EINVAL; 278 lsize = sizeof(struct udmabuf_create_item) * head.count; 279 list = memdup_user((void __user *)(arg + sizeof(head)), lsize); 280 if (IS_ERR(list)) 281 return PTR_ERR(list); 282 283 ret = udmabuf_create(filp->private_data, &head, list); 284 kfree(list); 285 return ret; 286 } 287 288 static long udmabuf_ioctl(struct file *filp, unsigned int ioctl, 289 unsigned long arg) 290 { 291 long ret; 292 293 switch (ioctl) { 294 case UDMABUF_CREATE: 295 ret = udmabuf_ioctl_create(filp, arg); 296 break; 297 case UDMABUF_CREATE_LIST: 298 ret = udmabuf_ioctl_create_list(filp, arg); 299 break; 300 default: 301 ret = -ENOTTY; 302 break; 303 } 304 return ret; 305 } 306 307 static const struct file_operations udmabuf_fops = { 308 .owner = THIS_MODULE, 309 .unlocked_ioctl = udmabuf_ioctl, 310 #ifdef CONFIG_COMPAT 311 .compat_ioctl = udmabuf_ioctl, 312 #endif 313 }; 314 315 static struct miscdevice udmabuf_misc = { 316 .minor = MISC_DYNAMIC_MINOR, 317 .name = "udmabuf", 318 .fops = &udmabuf_fops, 319 }; 320 321 static int __init udmabuf_dev_init(void) 322 { 323 return misc_register(&udmabuf_misc); 324 } 325 326 static void __exit udmabuf_dev_exit(void) 327 { 328 misc_deregister(&udmabuf_misc); 329 } 330 331 module_init(udmabuf_dev_init) 332 module_exit(udmabuf_dev_exit) 333 334 MODULE_AUTHOR("Gerd Hoffmann <kraxel@redhat.com>"); 335 MODULE_LICENSE("GPL v2"); 336