LCOV - code coverage report
Current view: top level - drivers/dma-buf - dma-buf.c (source / functions) Hit Total Coverage
Test: combined.info Lines: 21 483 4.3 %
Date: 2022-03-28 13:20:08 Functions: 3 30 10.0 %
Branches: 4 321 1.2 %

           Branch data     Line data    Source code
       1                 :            : // SPDX-License-Identifier: GPL-2.0-only
       2                 :            : /*
       3                 :            :  * Framework for buffer objects that can be shared across devices/subsystems.
       4                 :            :  *
       5                 :            :  * Copyright(C) 2011 Linaro Limited. All rights reserved.
       6                 :            :  * Author: Sumit Semwal <sumit.semwal@ti.com>
       7                 :            :  *
       8                 :            :  * Many thanks to linaro-mm-sig list, and specially
       9                 :            :  * Arnd Bergmann <arnd@arndb.de>, Rob Clark <rob@ti.com> and
      10                 :            :  * Daniel Vetter <daniel@ffwll.ch> for their support in creation and
      11                 :            :  * refining of this idea.
      12                 :            :  */
      13                 :            : 
      14                 :            : #include <linux/fs.h>
      15                 :            : #include <linux/slab.h>
      16                 :            : #include <linux/dma-buf.h>
      17                 :            : #include <linux/dma-fence.h>
      18                 :            : #include <linux/anon_inodes.h>
      19                 :            : #include <linux/export.h>
      20                 :            : #include <linux/debugfs.h>
      21                 :            : #include <linux/module.h>
      22                 :            : #include <linux/seq_file.h>
      23                 :            : #include <linux/poll.h>
      24                 :            : #include <linux/dma-resv.h>
      25                 :            : #include <linux/mm.h>
      26                 :            : #include <linux/mount.h>
      27                 :            : #include <linux/pseudo_fs.h>
      28                 :            : 
      29                 :            : #include <uapi/linux/dma-buf.h>
      30                 :            : #include <uapi/linux/magic.h>
      31                 :            : 
      32                 :            : static inline int is_dma_buf_file(struct file *);
      33                 :            : 
      34                 :            : struct dma_buf_list {
      35                 :            :         struct list_head head;
      36                 :            :         struct mutex lock;
      37                 :            : };
      38                 :            : 
      39                 :            : static struct dma_buf_list db_list;
      40                 :            : 
      41                 :          0 : static char *dmabuffs_dname(struct dentry *dentry, char *buffer, int buflen)
      42                 :            : {
      43                 :          0 :         struct dma_buf *dmabuf;
      44                 :          0 :         char name[DMA_BUF_NAME_LEN];
      45                 :          0 :         size_t ret = 0;
      46                 :            : 
      47                 :          0 :         dmabuf = dentry->d_fsdata;
      48                 :          0 :         dma_resv_lock(dmabuf->resv, NULL);
      49         [ #  # ]:          0 :         if (dmabuf->name)
      50                 :          0 :                 ret = strlcpy(name, dmabuf->name, DMA_BUF_NAME_LEN);
      51                 :          0 :         dma_resv_unlock(dmabuf->resv);
      52                 :            : 
      53         [ #  # ]:          0 :         return dynamic_dname(dentry, buffer, buflen, "/%s:%s",
      54                 :            :                              dentry->d_name.name, ret > 0 ? name : "");
      55                 :            : }
      56                 :            : 
      57                 :            : static const struct dentry_operations dma_buf_dentry_ops = {
      58                 :            :         .d_dname = dmabuffs_dname,
      59                 :            : };
      60                 :            : 
      61                 :            : static struct vfsmount *dma_buf_mnt;
      62                 :            : 
      63                 :         30 : static int dma_buf_fs_init_context(struct fs_context *fc)
      64                 :            : {
      65                 :         30 :         struct pseudo_fs_context *ctx;
      66                 :            : 
      67                 :         30 :         ctx = init_pseudo(fc, DMA_BUF_MAGIC);
      68         [ +  - ]:         30 :         if (!ctx)
      69                 :            :                 return -ENOMEM;
      70                 :         30 :         ctx->dops = &dma_buf_dentry_ops;
      71                 :         30 :         return 0;
      72                 :            : }
      73                 :            : 
      74                 :            : static struct file_system_type dma_buf_fs_type = {
      75                 :            :         .name = "dmabuf",
      76                 :            :         .init_fs_context = dma_buf_fs_init_context,
      77                 :            :         .kill_sb = kill_anon_super,
      78                 :            : };
      79                 :            : 
      80                 :          0 : static int dma_buf_release(struct inode *inode, struct file *file)
      81                 :            : {
      82                 :          0 :         struct dma_buf *dmabuf;
      83                 :            : 
      84                 :          0 :         if (!is_dma_buf_file(file))
      85                 :            :                 return -EINVAL;
      86                 :            : 
      87                 :          0 :         dmabuf = file->private_data;
      88                 :            : 
      89         [ #  # ]:          0 :         BUG_ON(dmabuf->vmapping_counter);
      90                 :            : 
      91                 :            :         /*
      92                 :            :          * Any fences that a dma-buf poll can wait on should be signaled
      93                 :            :          * before releasing dma-buf. This is the responsibility of each
      94                 :            :          * driver that uses the reservation objects.
      95                 :            :          *
      96                 :            :          * If you hit this BUG() it means someone dropped their ref to the
      97                 :            :          * dma-buf while still having pending operation to the buffer.
      98                 :            :          */
      99   [ #  #  #  # ]:          0 :         BUG_ON(dmabuf->cb_shared.active || dmabuf->cb_excl.active);
     100                 :            : 
     101                 :          0 :         dmabuf->ops->release(dmabuf);
     102                 :            : 
     103                 :          0 :         mutex_lock(&db_list.lock);
     104                 :          0 :         list_del(&dmabuf->list_node);
     105                 :          0 :         mutex_unlock(&db_list.lock);
     106                 :            : 
     107         [ #  # ]:          0 :         if (dmabuf->resv == (struct dma_resv *)&dmabuf[1])
     108                 :          0 :                 dma_resv_fini(dmabuf->resv);
     109                 :            : 
     110                 :          0 :         module_put(dmabuf->owner);
     111                 :          0 :         kfree(dmabuf->name);
     112                 :          0 :         kfree(dmabuf);
     113                 :          0 :         return 0;
     114                 :            : }
     115                 :            : 
     116                 :          0 : static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma)
     117                 :            : {
     118                 :          0 :         struct dma_buf *dmabuf;
     119                 :            : 
     120                 :          0 :         if (!is_dma_buf_file(file))
     121                 :            :                 return -EINVAL;
     122                 :            : 
     123                 :          0 :         dmabuf = file->private_data;
     124                 :            : 
     125                 :            :         /* check if buffer supports mmap */
     126         [ #  # ]:          0 :         if (!dmabuf->ops->mmap)
     127                 :            :                 return -EINVAL;
     128                 :            : 
     129                 :            :         /* check for overflowing the buffer's size */
     130         [ #  # ]:          0 :         if (vma->vm_pgoff + vma_pages(vma) >
     131         [ #  # ]:          0 :             dmabuf->size >> PAGE_SHIFT)
     132                 :            :                 return -EINVAL;
     133                 :            : 
     134                 :          0 :         return dmabuf->ops->mmap(dmabuf, vma);
     135                 :            : }
     136                 :            : 
     137                 :          0 : static loff_t dma_buf_llseek(struct file *file, loff_t offset, int whence)
     138                 :            : {
     139                 :          0 :         struct dma_buf *dmabuf;
     140                 :          0 :         loff_t base;
     141                 :            : 
     142                 :          0 :         if (!is_dma_buf_file(file))
     143                 :            :                 return -EBADF;
     144                 :            : 
     145                 :          0 :         dmabuf = file->private_data;
     146                 :            : 
     147                 :            :         /* only support discovering the end of the buffer,
     148                 :            :            but also allow SEEK_SET to maintain the idiomatic
     149                 :            :            SEEK_END(0), SEEK_CUR(0) pattern */
     150         [ #  # ]:          0 :         if (whence == SEEK_END)
     151                 :          0 :                 base = dmabuf->size;
     152         [ #  # ]:          0 :         else if (whence == SEEK_SET)
     153                 :            :                 base = 0;
     154                 :            :         else
     155                 :            :                 return -EINVAL;
     156                 :            : 
     157         [ #  # ]:          0 :         if (offset != 0)
     158                 :            :                 return -EINVAL;
     159                 :            : 
     160                 :          0 :         return base + offset;
     161                 :            : }
     162                 :            : 
     163                 :            : /**
     164                 :            :  * DOC: fence polling
     165                 :            :  *
     166                 :            :  * To support cross-device and cross-driver synchronization of buffer access
     167                 :            :  * implicit fences (represented internally in the kernel with &struct fence) can
     168                 :            :  * be attached to a &dma_buf. The glue for that and a few related things are
     169                 :            :  * provided in the &dma_resv structure.
     170                 :            :  *
     171                 :            :  * Userspace can query the state of these implicitly tracked fences using poll()
     172                 :            :  * and related system calls:
     173                 :            :  *
     174                 :            :  * - Checking for EPOLLIN, i.e. read access, can be use to query the state of the
     175                 :            :  *   most recent write or exclusive fence.
     176                 :            :  *
     177                 :            :  * - Checking for EPOLLOUT, i.e. write access, can be used to query the state of
     178                 :            :  *   all attached fences, shared and exclusive ones.
     179                 :            :  *
     180                 :            :  * Note that this only signals the completion of the respective fences, i.e. the
     181                 :            :  * DMA transfers are complete. Cache flushing and any other necessary
     182                 :            :  * preparations before CPU access can begin still need to happen.
     183                 :            :  */
     184                 :            : 
     185                 :          0 : static void dma_buf_poll_cb(struct dma_fence *fence, struct dma_fence_cb *cb)
     186                 :            : {
     187                 :          0 :         struct dma_buf_poll_cb_t *dcb = (struct dma_buf_poll_cb_t *)cb;
     188                 :          0 :         unsigned long flags;
     189                 :            : 
     190                 :          0 :         spin_lock_irqsave(&dcb->poll->lock, flags);
     191                 :          0 :         wake_up_locked_poll(dcb->poll, dcb->active);
     192                 :          0 :         dcb->active = 0;
     193                 :          0 :         spin_unlock_irqrestore(&dcb->poll->lock, flags);
     194                 :          0 : }
     195                 :            : 
     196                 :          0 : static __poll_t dma_buf_poll(struct file *file, poll_table *poll)
     197                 :            : {
     198                 :          0 :         struct dma_buf *dmabuf;
     199                 :          0 :         struct dma_resv *resv;
     200                 :          0 :         struct dma_resv_list *fobj;
     201                 :          0 :         struct dma_fence *fence_excl;
     202                 :          0 :         __poll_t events;
     203                 :          0 :         unsigned shared_count, seq;
     204                 :            : 
     205                 :          0 :         dmabuf = file->private_data;
     206   [ #  #  #  # ]:          0 :         if (!dmabuf || !dmabuf->resv)
     207                 :            :                 return EPOLLERR;
     208                 :            : 
     209                 :          0 :         resv = dmabuf->resv;
     210                 :            : 
     211         [ #  # ]:          0 :         poll_wait(file, &dmabuf->poll, poll);
     212                 :            : 
     213         [ #  # ]:          0 :         events = poll_requested_events(poll) & (EPOLLIN | EPOLLOUT);
     214         [ #  # ]:          0 :         if (!events)
     215                 :            :                 return 0;
     216                 :            : 
     217                 :          0 : retry:
     218                 :          0 :         seq = read_seqcount_begin(&resv->seq);
     219                 :          0 :         rcu_read_lock();
     220                 :            : 
     221         [ #  # ]:          0 :         fobj = rcu_dereference(resv->fence);
     222         [ #  # ]:          0 :         if (fobj)
     223                 :          0 :                 shared_count = fobj->shared_count;
     224                 :            :         else
     225                 :            :                 shared_count = 0;
     226                 :          0 :         fence_excl = rcu_dereference(resv->fence_excl);
     227         [ #  # ]:          0 :         if (read_seqcount_retry(&resv->seq, seq)) {
     228                 :          0 :                 rcu_read_unlock();
     229                 :          0 :                 goto retry;
     230                 :            :         }
     231                 :            : 
     232   [ #  #  #  #  :          0 :         if (fence_excl && (!(events & EPOLLOUT) || shared_count == 0)) {
                   #  # ]
     233                 :          0 :                 struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_excl;
     234                 :          0 :                 __poll_t pevents = EPOLLIN;
     235                 :            : 
     236         [ #  # ]:          0 :                 if (shared_count == 0)
     237                 :          0 :                         pevents |= EPOLLOUT;
     238                 :            : 
     239                 :          0 :                 spin_lock_irq(&dmabuf->poll.lock);
     240         [ #  # ]:          0 :                 if (dcb->active) {
     241                 :          0 :                         dcb->active |= pevents;
     242                 :          0 :                         events &= ~pevents;
     243                 :            :                 } else
     244                 :          0 :                         dcb->active = pevents;
     245                 :          0 :                 spin_unlock_irq(&dmabuf->poll.lock);
     246                 :            : 
     247         [ #  # ]:          0 :                 if (events & pevents) {
     248                 :          0 :                         if (!dma_fence_get_rcu(fence_excl)) {
     249                 :            :                                 /* force a recheck */
     250                 :          0 :                                 events &= ~pevents;
     251                 :          0 :                                 dma_buf_poll_cb(NULL, &dcb->cb);
     252         [ #  # ]:          0 :                         } else if (!dma_fence_add_callback(fence_excl, &dcb->cb,
     253                 :            :                                                            dma_buf_poll_cb)) {
     254                 :          0 :                                 events &= ~pevents;
     255                 :          0 :                                 dma_fence_put(fence_excl);
     256                 :            :                         } else {
     257                 :            :                                 /*
     258                 :            :                                  * No callback queued, wake up any additional
     259                 :            :                                  * waiters.
     260                 :            :                                  */
     261                 :          0 :                                 dma_fence_put(fence_excl);
     262                 :          0 :                                 dma_buf_poll_cb(NULL, &dcb->cb);
     263                 :            :                         }
     264                 :            :                 }
     265                 :            :         }
     266                 :            : 
     267   [ #  #  #  # ]:          0 :         if ((events & EPOLLOUT) && shared_count > 0) {
     268                 :          0 :                 struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_shared;
     269                 :          0 :                 int i;
     270                 :            : 
     271                 :            :                 /* Only queue a new callback if no event has fired yet */
     272                 :          0 :                 spin_lock_irq(&dmabuf->poll.lock);
     273         [ #  # ]:          0 :                 if (dcb->active)
     274                 :          0 :                         events &= ~EPOLLOUT;
     275                 :            :                 else
     276                 :          0 :                         dcb->active = EPOLLOUT;
     277                 :          0 :                 spin_unlock_irq(&dmabuf->poll.lock);
     278                 :            : 
     279         [ #  # ]:          0 :                 if (!(events & EPOLLOUT))
     280                 :          0 :                         goto out;
     281                 :            : 
     282         [ #  # ]:          0 :                 for (i = 0; i < shared_count; ++i) {
     283                 :          0 :                         struct dma_fence *fence = rcu_dereference(fobj->shared[i]);
     284                 :            : 
     285         [ #  # ]:          0 :                         if (!dma_fence_get_rcu(fence)) {
     286                 :            :                                 /*
     287                 :            :                                  * fence refcount dropped to zero, this means
     288                 :            :                                  * that fobj has been freed
     289                 :            :                                  *
     290                 :            :                                  * call dma_buf_poll_cb and force a recheck!
     291                 :            :                                  */
     292                 :          0 :                                 events &= ~EPOLLOUT;
     293                 :          0 :                                 dma_buf_poll_cb(NULL, &dcb->cb);
     294                 :          0 :                                 break;
     295                 :            :                         }
     296         [ #  # ]:          0 :                         if (!dma_fence_add_callback(fence, &dcb->cb,
     297                 :            :                                                     dma_buf_poll_cb)) {
     298                 :          0 :                                 dma_fence_put(fence);
     299                 :          0 :                                 events &= ~EPOLLOUT;
     300                 :          0 :                                 break;
     301                 :            :                         }
     302                 :          0 :                         dma_fence_put(fence);
     303                 :            :                 }
     304                 :            : 
     305                 :            :                 /* No callback queued, wake up any additional waiters. */
     306         [ #  # ]:          0 :                 if (i == shared_count)
     307                 :          0 :                         dma_buf_poll_cb(NULL, &dcb->cb);
     308                 :            :         }
     309                 :            : 
     310                 :          0 : out:
     311                 :          0 :         rcu_read_unlock();
     312                 :          0 :         return events;
     313                 :            : }
     314                 :            : 
     315                 :            : /**
     316                 :            :  * dma_buf_set_name - Set a name to a specific dma_buf to track the usage.
     317                 :            :  * The name of the dma-buf buffer can only be set when the dma-buf is not
     318                 :            :  * attached to any devices. It could theoritically support changing the
     319                 :            :  * name of the dma-buf if the same piece of memory is used for multiple
     320                 :            :  * purpose between different devices.
     321                 :            :  *
     322                 :            :  * @dmabuf [in]     dmabuf buffer that will be renamed.
     323                 :            :  * @buf:   [in]     A piece of userspace memory that contains the name of
     324                 :            :  *                  the dma-buf.
     325                 :            :  *
     326                 :            :  * Returns 0 on success. If the dma-buf buffer is already attached to
     327                 :            :  * devices, return -EBUSY.
     328                 :            :  *
     329                 :            :  */
     330                 :          0 : static long dma_buf_set_name(struct dma_buf *dmabuf, const char __user *buf)
     331                 :            : {
     332                 :          0 :         char *name = strndup_user(buf, DMA_BUF_NAME_LEN);
     333                 :          0 :         long ret = 0;
     334                 :            : 
     335         [ #  # ]:          0 :         if (IS_ERR(name))
     336                 :          0 :                 return PTR_ERR(name);
     337                 :            : 
     338                 :          0 :         dma_resv_lock(dmabuf->resv, NULL);
     339         [ #  # ]:          0 :         if (!list_empty(&dmabuf->attachments)) {
     340                 :          0 :                 ret = -EBUSY;
     341                 :          0 :                 kfree(name);
     342                 :          0 :                 goto out_unlock;
     343                 :            :         }
     344                 :          0 :         kfree(dmabuf->name);
     345                 :          0 :         dmabuf->name = name;
     346                 :            : 
     347                 :          0 : out_unlock:
     348                 :          0 :         dma_resv_unlock(dmabuf->resv);
     349                 :          0 :         return ret;
     350                 :            : }
     351                 :            : 
     352                 :          0 : static long dma_buf_ioctl(struct file *file,
     353                 :            :                           unsigned int cmd, unsigned long arg)
     354                 :            : {
     355                 :          0 :         struct dma_buf *dmabuf;
     356                 :          0 :         struct dma_buf_sync sync;
     357                 :          0 :         enum dma_data_direction direction;
     358                 :          0 :         int ret;
     359                 :            : 
     360                 :          0 :         dmabuf = file->private_data;
     361                 :            : 
     362      [ #  #  # ]:          0 :         switch (cmd) {
     363                 :          0 :         case DMA_BUF_IOCTL_SYNC:
     364         [ #  # ]:          0 :                 if (copy_from_user(&sync, (void __user *) arg, sizeof(sync)))
     365                 :            :                         return -EFAULT;
     366                 :            : 
     367         [ #  # ]:          0 :                 if (sync.flags & ~DMA_BUF_SYNC_VALID_FLAGS_MASK)
     368                 :            :                         return -EINVAL;
     369                 :            : 
     370         [ #  # ]:          0 :                 switch (sync.flags & DMA_BUF_SYNC_RW) {
     371                 :            :                 case DMA_BUF_SYNC_READ:
     372                 :            :                         direction = DMA_FROM_DEVICE;
     373                 :            :                         break;
     374                 :            :                 case DMA_BUF_SYNC_WRITE:
     375                 :            :                         direction = DMA_TO_DEVICE;
     376                 :            :                         break;
     377                 :            :                 case DMA_BUF_SYNC_RW:
     378                 :            :                         direction = DMA_BIDIRECTIONAL;
     379                 :            :                         break;
     380                 :            :                 default:
     381                 :            :                         return -EINVAL;
     382                 :            :                 }
     383                 :            : 
     384         [ #  # ]:          0 :                 if (sync.flags & DMA_BUF_SYNC_END)
     385                 :          0 :                         ret = dma_buf_end_cpu_access(dmabuf, direction);
     386                 :            :                 else
     387                 :          0 :                         ret = dma_buf_begin_cpu_access(dmabuf, direction);
     388                 :            : 
     389                 :          0 :                 return ret;
     390                 :            : 
     391                 :          0 :         case DMA_BUF_SET_NAME:
     392                 :          0 :                 return dma_buf_set_name(dmabuf, (const char __user *)arg);
     393                 :            : 
     394                 :            :         default:
     395                 :            :                 return -ENOTTY;
     396                 :            :         }
     397                 :            : }
     398                 :            : 
     399                 :          0 : static void dma_buf_show_fdinfo(struct seq_file *m, struct file *file)
     400                 :            : {
     401                 :          0 :         struct dma_buf *dmabuf = file->private_data;
     402                 :            : 
     403                 :          0 :         seq_printf(m, "size:\t%zu\n", dmabuf->size);
     404                 :            :         /* Don't count the temporary reference taken inside procfs seq_show */
     405                 :          0 :         seq_printf(m, "count:\t%ld\n", file_count(dmabuf->file) - 1);
     406                 :          0 :         seq_printf(m, "exp_name:\t%s\n", dmabuf->exp_name);
     407                 :          0 :         dma_resv_lock(dmabuf->resv, NULL);
     408         [ #  # ]:          0 :         if (dmabuf->name)
     409                 :          0 :                 seq_printf(m, "name:\t%s\n", dmabuf->name);
     410                 :          0 :         dma_resv_unlock(dmabuf->resv);
     411                 :          0 : }
     412                 :            : 
     413                 :            : static const struct file_operations dma_buf_fops = {
     414                 :            :         .release        = dma_buf_release,
     415                 :            :         .mmap           = dma_buf_mmap_internal,
     416                 :            :         .llseek         = dma_buf_llseek,
     417                 :            :         .poll           = dma_buf_poll,
     418                 :            :         .unlocked_ioctl = dma_buf_ioctl,
     419                 :            :         .compat_ioctl   = compat_ptr_ioctl,
     420                 :            :         .show_fdinfo    = dma_buf_show_fdinfo,
     421                 :            : };
     422                 :            : 
     423                 :            : /*
     424                 :            :  * is_dma_buf_file - Check if struct file* is associated with dma_buf
     425                 :            :  */
     426                 :          0 : static inline int is_dma_buf_file(struct file *file)
     427                 :            : {
     428   [ #  #  #  #  :          0 :         return file->f_op == &dma_buf_fops;
                   #  # ]
     429                 :            : }
     430                 :            : 
     431                 :          0 : static struct file *dma_buf_getfile(struct dma_buf *dmabuf, int flags)
     432                 :            : {
     433                 :          0 :         struct file *file;
     434                 :          0 :         struct inode *inode = alloc_anon_inode(dma_buf_mnt->mnt_sb);
     435                 :            : 
     436         [ #  # ]:          0 :         if (IS_ERR(inode))
     437                 :            :                 return ERR_CAST(inode);
     438                 :            : 
     439                 :          0 :         inode->i_size = dmabuf->size;
     440                 :          0 :         inode_set_bytes(inode, dmabuf->size);
     441                 :            : 
     442                 :          0 :         file = alloc_file_pseudo(inode, dma_buf_mnt, "dmabuf",
     443                 :            :                                  flags, &dma_buf_fops);
     444         [ #  # ]:          0 :         if (IS_ERR(file))
     445                 :          0 :                 goto err_alloc_file;
     446                 :          0 :         file->f_flags = flags & (O_ACCMODE | O_NONBLOCK);
     447                 :          0 :         file->private_data = dmabuf;
     448                 :          0 :         file->f_path.dentry->d_fsdata = dmabuf;
     449                 :            : 
     450                 :          0 :         return file;
     451                 :            : 
     452                 :            : err_alloc_file:
     453                 :          0 :         iput(inode);
     454                 :          0 :         return file;
     455                 :            : }
     456                 :            : 
     457                 :            : /**
     458                 :            :  * DOC: dma buf device access
     459                 :            :  *
     460                 :            :  * For device DMA access to a shared DMA buffer the usual sequence of operations
     461                 :            :  * is fairly simple:
     462                 :            :  *
     463                 :            :  * 1. The exporter defines his exporter instance using
     464                 :            :  *    DEFINE_DMA_BUF_EXPORT_INFO() and calls dma_buf_export() to wrap a private
     465                 :            :  *    buffer object into a &dma_buf. It then exports that &dma_buf to userspace
     466                 :            :  *    as a file descriptor by calling dma_buf_fd().
     467                 :            :  *
     468                 :            :  * 2. Userspace passes this file-descriptors to all drivers it wants this buffer
     469                 :            :  *    to share with: First the filedescriptor is converted to a &dma_buf using
     470                 :            :  *    dma_buf_get(). Then the buffer is attached to the device using
     471                 :            :  *    dma_buf_attach().
     472                 :            :  *
     473                 :            :  *    Up to this stage the exporter is still free to migrate or reallocate the
     474                 :            :  *    backing storage.
     475                 :            :  *
     476                 :            :  * 3. Once the buffer is attached to all devices userspace can initiate DMA
     477                 :            :  *    access to the shared buffer. In the kernel this is done by calling
     478                 :            :  *    dma_buf_map_attachment() and dma_buf_unmap_attachment().
     479                 :            :  *
     480                 :            :  * 4. Once a driver is done with a shared buffer it needs to call
     481                 :            :  *    dma_buf_detach() (after cleaning up any mappings) and then release the
     482                 :            :  *    reference acquired with dma_buf_get by calling dma_buf_put().
     483                 :            :  *
     484                 :            :  * For the detailed semantics exporters are expected to implement see
     485                 :            :  * &dma_buf_ops.
     486                 :            :  */
     487                 :            : 
     488                 :            : /**
     489                 :            :  * dma_buf_export - Creates a new dma_buf, and associates an anon file
     490                 :            :  * with this buffer, so it can be exported.
     491                 :            :  * Also connect the allocator specific data and ops to the buffer.
     492                 :            :  * Additionally, provide a name string for exporter; useful in debugging.
     493                 :            :  *
     494                 :            :  * @exp_info:   [in]    holds all the export related information provided
     495                 :            :  *                      by the exporter. see &struct dma_buf_export_info
     496                 :            :  *                      for further details.
     497                 :            :  *
     498                 :            :  * Returns, on success, a newly created dma_buf object, which wraps the
     499                 :            :  * supplied private data and operations for dma_buf_ops. On either missing
     500                 :            :  * ops, or error in allocating struct dma_buf, will return negative error.
     501                 :            :  *
     502                 :            :  * For most cases the easiest way to create @exp_info is through the
     503                 :            :  * %DEFINE_DMA_BUF_EXPORT_INFO macro.
     504                 :            :  */
     505                 :          0 : struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
     506                 :            : {
     507                 :          0 :         struct dma_buf *dmabuf;
     508                 :          0 :         struct dma_resv *resv = exp_info->resv;
     509                 :          0 :         struct file *file;
     510                 :          0 :         size_t alloc_size = sizeof(struct dma_buf);
     511                 :          0 :         int ret;
     512                 :            : 
     513         [ #  # ]:          0 :         if (!exp_info->resv)
     514                 :            :                 alloc_size += sizeof(struct dma_resv);
     515                 :            :         else
     516                 :            :                 /* prevent &dma_buf[1] == dma_buf->resv */
     517                 :          0 :                 alloc_size += 1;
     518                 :            : 
     519   [ #  #  #  #  :          0 :         if (WARN_ON(!exp_info->priv
          #  #  #  #  #  
             #  #  #  #  
                      # ]
     520                 :            :                           || !exp_info->ops
     521                 :            :                           || !exp_info->ops->map_dma_buf
     522                 :            :                           || !exp_info->ops->unmap_dma_buf
     523                 :            :                           || !exp_info->ops->release)) {
     524                 :            :                 return ERR_PTR(-EINVAL);
     525                 :            :         }
     526                 :            : 
     527   [ #  #  #  #  :          0 :         if (WARN_ON(exp_info->ops->cache_sgt_mapping &&
             #  #  #  # ]
     528                 :            :                     exp_info->ops->dynamic_mapping))
     529                 :            :                 return ERR_PTR(-EINVAL);
     530                 :            : 
     531         [ #  # ]:          0 :         if (!try_module_get(exp_info->owner))
     532                 :            :                 return ERR_PTR(-ENOENT);
     533                 :            : 
     534                 :          0 :         dmabuf = kzalloc(alloc_size, GFP_KERNEL);
     535         [ #  # ]:          0 :         if (!dmabuf) {
     536                 :          0 :                 ret = -ENOMEM;
     537                 :          0 :                 goto err_module;
     538                 :            :         }
     539                 :            : 
     540                 :          0 :         dmabuf->priv = exp_info->priv;
     541                 :          0 :         dmabuf->ops = exp_info->ops;
     542                 :          0 :         dmabuf->size = exp_info->size;
     543                 :          0 :         dmabuf->exp_name = exp_info->exp_name;
     544                 :          0 :         dmabuf->owner = exp_info->owner;
     545                 :          0 :         init_waitqueue_head(&dmabuf->poll);
     546                 :          0 :         dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll;
     547                 :          0 :         dmabuf->cb_excl.active = dmabuf->cb_shared.active = 0;
     548                 :            : 
     549         [ #  # ]:          0 :         if (!resv) {
     550                 :          0 :                 resv = (struct dma_resv *)&dmabuf[1];
     551                 :          0 :                 dma_resv_init(resv);
     552                 :            :         }
     553                 :          0 :         dmabuf->resv = resv;
     554                 :            : 
     555                 :          0 :         file = dma_buf_getfile(dmabuf, exp_info->flags);
     556         [ #  # ]:          0 :         if (IS_ERR(file)) {
     557                 :          0 :                 ret = PTR_ERR(file);
     558                 :          0 :                 goto err_dmabuf;
     559                 :            :         }
     560                 :            : 
     561                 :          0 :         file->f_mode |= FMODE_LSEEK;
     562                 :          0 :         dmabuf->file = file;
     563                 :            : 
     564                 :          0 :         mutex_init(&dmabuf->lock);
     565                 :          0 :         INIT_LIST_HEAD(&dmabuf->attachments);
     566                 :            : 
     567                 :          0 :         mutex_lock(&db_list.lock);
     568                 :          0 :         list_add(&dmabuf->list_node, &db_list.head);
     569                 :          0 :         mutex_unlock(&db_list.lock);
     570                 :            : 
     571                 :          0 :         return dmabuf;
     572                 :            : 
     573                 :            : err_dmabuf:
     574                 :          0 :         kfree(dmabuf);
     575                 :          0 : err_module:
     576                 :          0 :         module_put(exp_info->owner);
     577                 :          0 :         return ERR_PTR(ret);
     578                 :            : }
     579                 :            : EXPORT_SYMBOL_GPL(dma_buf_export);
     580                 :            : 
     581                 :            : /**
     582                 :            :  * dma_buf_fd - returns a file descriptor for the given dma_buf
     583                 :            :  * @dmabuf:     [in]    pointer to dma_buf for which fd is required.
     584                 :            :  * @flags:      [in]    flags to give to fd
     585                 :            :  *
     586                 :            :  * On success, returns an associated 'fd'. Else, returns error.
     587                 :            :  */
     588                 :          0 : int dma_buf_fd(struct dma_buf *dmabuf, int flags)
     589                 :            : {
     590                 :          0 :         int fd;
     591                 :            : 
     592   [ #  #  #  # ]:          0 :         if (!dmabuf || !dmabuf->file)
     593                 :            :                 return -EINVAL;
     594                 :            : 
     595                 :          0 :         fd = get_unused_fd_flags(flags);
     596         [ #  # ]:          0 :         if (fd < 0)
     597                 :            :                 return fd;
     598                 :            : 
     599                 :          0 :         fd_install(fd, dmabuf->file);
     600                 :            : 
     601                 :          0 :         return fd;
     602                 :            : }
     603                 :            : EXPORT_SYMBOL_GPL(dma_buf_fd);
     604                 :            : 
     605                 :            : /**
     606                 :            :  * dma_buf_get - returns the dma_buf structure related to an fd
     607                 :            :  * @fd: [in]    fd associated with the dma_buf to be returned
     608                 :            :  *
     609                 :            :  * On success, returns the dma_buf structure associated with an fd; uses
     610                 :            :  * file's refcounting done by fget to increase refcount. returns ERR_PTR
     611                 :            :  * otherwise.
     612                 :            :  */
     613                 :          0 : struct dma_buf *dma_buf_get(int fd)
     614                 :            : {
     615                 :          0 :         struct file *file;
     616                 :            : 
     617                 :          0 :         file = fget(fd);
     618                 :            : 
     619         [ #  # ]:          0 :         if (!file)
     620                 :            :                 return ERR_PTR(-EBADF);
     621                 :            : 
     622         [ #  # ]:          0 :         if (!is_dma_buf_file(file)) {
     623                 :          0 :                 fput(file);
     624                 :          0 :                 return ERR_PTR(-EINVAL);
     625                 :            :         }
     626                 :            : 
     627                 :          0 :         return file->private_data;
     628                 :            : }
     629                 :            : EXPORT_SYMBOL_GPL(dma_buf_get);
     630                 :            : 
     631                 :            : /**
     632                 :            :  * dma_buf_put - decreases refcount of the buffer
     633                 :            :  * @dmabuf:     [in]    buffer to reduce refcount of
     634                 :            :  *
     635                 :            :  * Uses file's refcounting done implicitly by fput().
     636                 :            :  *
     637                 :            :  * If, as a result of this call, the refcount becomes 0, the 'release' file
     638                 :            :  * operation related to this fd is called. It calls &dma_buf_ops.release vfunc
     639                 :            :  * in turn, and frees the memory allocated for dmabuf when exported.
     640                 :            :  */
     641                 :          0 : void dma_buf_put(struct dma_buf *dmabuf)
     642                 :            : {
     643   [ #  #  #  #  :          0 :         if (WARN_ON(!dmabuf || !dmabuf->file))
             #  #  #  # ]
     644                 :            :                 return;
     645                 :            : 
     646                 :          0 :         fput(dmabuf->file);
     647                 :            : }
     648                 :            : EXPORT_SYMBOL_GPL(dma_buf_put);
     649                 :            : 
     650                 :            : /**
     651                 :            :  * dma_buf_dynamic_attach - Add the device to dma_buf's attachments list; optionally,
     652                 :            :  * calls attach() of dma_buf_ops to allow device-specific attach functionality
     653                 :            :  * @dmabuf:             [in]    buffer to attach device to.
     654                 :            :  * @dev:                [in]    device to be attached.
     655                 :            :  * @dynamic_mapping:    [in]    calling convention for map/unmap
     656                 :            :  *
     657                 :            :  * Returns struct dma_buf_attachment pointer for this attachment. Attachments
     658                 :            :  * must be cleaned up by calling dma_buf_detach().
     659                 :            :  *
     660                 :            :  * Returns:
     661                 :            :  *
     662                 :            :  * A pointer to newly created &dma_buf_attachment on success, or a negative
     663                 :            :  * error code wrapped into a pointer on failure.
     664                 :            :  *
     665                 :            :  * Note that this can fail if the backing storage of @dmabuf is in a place not
     666                 :            :  * accessible to @dev, and cannot be moved to a more suitable place. This is
     667                 :            :  * indicated with the error code -EBUSY.
     668                 :            :  */
     669                 :            : struct dma_buf_attachment *
     670                 :          0 : dma_buf_dynamic_attach(struct dma_buf *dmabuf, struct device *dev,
     671                 :            :                        bool dynamic_mapping)
     672                 :            : {
     673                 :          0 :         struct dma_buf_attachment *attach;
     674                 :          0 :         int ret;
     675                 :            : 
     676   [ #  #  #  # ]:          0 :         if (WARN_ON(!dmabuf || !dev))
     677                 :            :                 return ERR_PTR(-EINVAL);
     678                 :            : 
     679                 :          0 :         attach = kzalloc(sizeof(*attach), GFP_KERNEL);
     680         [ #  # ]:          0 :         if (!attach)
     681                 :            :                 return ERR_PTR(-ENOMEM);
     682                 :            : 
     683                 :          0 :         attach->dev = dev;
     684                 :          0 :         attach->dmabuf = dmabuf;
     685                 :          0 :         attach->dynamic_mapping = dynamic_mapping;
     686                 :            : 
     687         [ #  # ]:          0 :         if (dmabuf->ops->attach) {
     688                 :          0 :                 ret = dmabuf->ops->attach(dmabuf, attach);
     689         [ #  # ]:          0 :                 if (ret)
     690                 :          0 :                         goto err_attach;
     691                 :            :         }
     692                 :          0 :         dma_resv_lock(dmabuf->resv, NULL);
     693                 :          0 :         list_add(&attach->node, &dmabuf->attachments);
     694                 :          0 :         dma_resv_unlock(dmabuf->resv);
     695                 :            : 
     696                 :            :         /* When either the importer or the exporter can't handle dynamic
     697                 :            :          * mappings we cache the mapping here to avoid issues with the
     698                 :            :          * reservation object lock.
     699                 :            :          */
     700         [ #  # ]:          0 :         if (dma_buf_attachment_is_dynamic(attach) !=
     701         [ #  # ]:          0 :             dma_buf_is_dynamic(dmabuf)) {
     702                 :          0 :                 struct sg_table *sgt;
     703                 :            : 
     704         [ #  # ]:          0 :                 if (dma_buf_is_dynamic(attach->dmabuf))
     705                 :          0 :                         dma_resv_lock(attach->dmabuf->resv, NULL);
     706                 :            : 
     707                 :          0 :                 sgt = dmabuf->ops->map_dma_buf(attach, DMA_BIDIRECTIONAL);
     708         [ #  # ]:          0 :                 if (!sgt)
     709                 :          0 :                         sgt = ERR_PTR(-ENOMEM);
     710         [ #  # ]:          0 :                 if (IS_ERR(sgt)) {
     711         [ #  # ]:          0 :                         ret = PTR_ERR(sgt);
     712                 :          0 :                         goto err_unlock;
     713                 :            :                 }
     714         [ #  # ]:          0 :                 if (dma_buf_is_dynamic(attach->dmabuf))
     715                 :          0 :                         dma_resv_unlock(attach->dmabuf->resv);
     716                 :          0 :                 attach->sgt = sgt;
     717                 :          0 :                 attach->dir = DMA_BIDIRECTIONAL;
     718                 :            :         }
     719                 :            : 
     720                 :            :         return attach;
     721                 :            : 
     722                 :            : err_attach:
     723                 :          0 :         kfree(attach);
     724                 :          0 :         return ERR_PTR(ret);
     725                 :            : 
     726                 :            : err_unlock:
     727         [ #  # ]:          0 :         if (dma_buf_is_dynamic(attach->dmabuf))
     728                 :          0 :                 dma_resv_unlock(attach->dmabuf->resv);
     729                 :            : 
     730                 :          0 :         dma_buf_detach(dmabuf, attach);
     731                 :          0 :         return ERR_PTR(ret);
     732                 :            : }
     733                 :            : EXPORT_SYMBOL_GPL(dma_buf_dynamic_attach);
     734                 :            : 
     735                 :            : /**
     736                 :            :  * dma_buf_attach - Wrapper for dma_buf_dynamic_attach
     737                 :            :  * @dmabuf:     [in]    buffer to attach device to.
     738                 :            :  * @dev:        [in]    device to be attached.
     739                 :            :  *
     740                 :            :  * Wrapper to call dma_buf_dynamic_attach() for drivers which still use a static
     741                 :            :  * mapping.
     742                 :            :  */
     743                 :          0 : struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf,
     744                 :            :                                           struct device *dev)
     745                 :            : {
     746                 :          0 :         return dma_buf_dynamic_attach(dmabuf, dev, false);
     747                 :            : }
     748                 :            : EXPORT_SYMBOL_GPL(dma_buf_attach);
     749                 :            : 
     750                 :            : /**
     751                 :            :  * dma_buf_detach - Remove the given attachment from dmabuf's attachments list;
     752                 :            :  * optionally calls detach() of dma_buf_ops for device-specific detach
     753                 :            :  * @dmabuf:     [in]    buffer to detach from.
     754                 :            :  * @attach:     [in]    attachment to be detached; is free'd after this call.
     755                 :            :  *
     756                 :            :  * Clean up a device attachment obtained by calling dma_buf_attach().
     757                 :            :  */
     758                 :          0 : void dma_buf_detach(struct dma_buf *dmabuf, struct dma_buf_attachment *attach)
     759                 :            : {
     760   [ #  #  #  # ]:          0 :         if (WARN_ON(!dmabuf || !attach))
     761                 :            :                 return;
     762                 :            : 
     763         [ #  # ]:          0 :         if (attach->sgt) {
     764         [ #  # ]:          0 :                 if (dma_buf_is_dynamic(attach->dmabuf))
     765                 :          0 :                         dma_resv_lock(attach->dmabuf->resv, NULL);
     766                 :            : 
     767                 :          0 :                 dmabuf->ops->unmap_dma_buf(attach, attach->sgt, attach->dir);
     768                 :            : 
     769         [ #  # ]:          0 :                 if (dma_buf_is_dynamic(attach->dmabuf))
     770                 :          0 :                         dma_resv_unlock(attach->dmabuf->resv);
     771                 :            :         }
     772                 :            : 
     773                 :          0 :         dma_resv_lock(dmabuf->resv, NULL);
     774                 :          0 :         list_del(&attach->node);
     775                 :          0 :         dma_resv_unlock(dmabuf->resv);
     776         [ #  # ]:          0 :         if (dmabuf->ops->detach)
     777                 :          0 :                 dmabuf->ops->detach(dmabuf, attach);
     778                 :            : 
     779                 :          0 :         kfree(attach);
     780                 :            : }
     781                 :            : EXPORT_SYMBOL_GPL(dma_buf_detach);
     782                 :            : 
     783                 :            : /**
     784                 :            :  * dma_buf_map_attachment - Returns the scatterlist table of the attachment;
     785                 :            :  * mapped into _device_ address space. Is a wrapper for map_dma_buf() of the
     786                 :            :  * dma_buf_ops.
     787                 :            :  * @attach:     [in]    attachment whose scatterlist is to be returned
     788                 :            :  * @direction:  [in]    direction of DMA transfer
     789                 :            :  *
     790                 :            :  * Returns sg_table containing the scatterlist to be returned; returns ERR_PTR
     791                 :            :  * on error. May return -EINTR if it is interrupted by a signal.
     792                 :            :  *
     793                 :            :  * A mapping must be unmapped by using dma_buf_unmap_attachment(). Note that
     794                 :            :  * the underlying backing storage is pinned for as long as a mapping exists,
     795                 :            :  * therefore users/importers should not hold onto a mapping for undue amounts of
     796                 :            :  * time.
     797                 :            :  */
     798                 :          0 : struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach,
     799                 :            :                                         enum dma_data_direction direction)
     800                 :            : {
     801                 :          0 :         struct sg_table *sg_table;
     802                 :            : 
     803                 :          0 :         might_sleep();
     804                 :            : 
     805   [ #  #  #  #  :          0 :         if (WARN_ON(!attach || !attach->dmabuf))
             #  #  #  # ]
     806                 :            :                 return ERR_PTR(-EINVAL);
     807                 :            : 
     808         [ #  # ]:          0 :         if (dma_buf_attachment_is_dynamic(attach))
     809                 :          0 :                 dma_resv_assert_held(attach->dmabuf->resv);
     810                 :            : 
     811         [ #  # ]:          0 :         if (attach->sgt) {
     812                 :            :                 /*
     813                 :            :                  * Two mappings with different directions for the same
     814                 :            :                  * attachment are not allowed.
     815                 :            :                  */
     816   [ #  #  #  # ]:          0 :                 if (attach->dir != direction &&
     817                 :            :                     attach->dir != DMA_BIDIRECTIONAL)
     818                 :            :                         return ERR_PTR(-EBUSY);
     819                 :            : 
     820                 :          0 :                 return attach->sgt;
     821                 :            :         }
     822                 :            : 
     823                 :          0 :         if (dma_buf_is_dynamic(attach->dmabuf))
     824                 :          0 :                 dma_resv_assert_held(attach->dmabuf->resv);
     825                 :            : 
     826                 :          0 :         sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction);
     827         [ #  # ]:          0 :         if (!sg_table)
     828                 :          0 :                 sg_table = ERR_PTR(-ENOMEM);
     829                 :            : 
     830   [ #  #  #  # ]:          0 :         if (!IS_ERR(sg_table) && attach->dmabuf->ops->cache_sgt_mapping) {
     831                 :          0 :                 attach->sgt = sg_table;
     832                 :          0 :                 attach->dir = direction;
     833                 :            :         }
     834                 :            : 
     835                 :            :         return sg_table;
     836                 :            : }
     837                 :            : EXPORT_SYMBOL_GPL(dma_buf_map_attachment);
     838                 :            : 
     839                 :            : /**
     840                 :            :  * dma_buf_unmap_attachment - unmaps and decreases usecount of the buffer;might
     841                 :            :  * deallocate the scatterlist associated. Is a wrapper for unmap_dma_buf() of
     842                 :            :  * dma_buf_ops.
     843                 :            :  * @attach:     [in]    attachment to unmap buffer from
     844                 :            :  * @sg_table:   [in]    scatterlist info of the buffer to unmap
     845                 :            :  * @direction:  [in]    direction of DMA transfer
     846                 :            :  *
     847                 :            :  * This unmaps a DMA mapping for @attached obtained by dma_buf_map_attachment().
     848                 :            :  */
     849                 :          0 : void dma_buf_unmap_attachment(struct dma_buf_attachment *attach,
     850                 :            :                                 struct sg_table *sg_table,
     851                 :            :                                 enum dma_data_direction direction)
     852                 :            : {
     853                 :          0 :         might_sleep();
     854                 :            : 
     855   [ #  #  #  #  :          0 :         if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
          #  #  #  #  #  
                      # ]
     856                 :            :                 return;
     857                 :            : 
     858         [ #  # ]:          0 :         if (dma_buf_attachment_is_dynamic(attach))
     859                 :          0 :                 dma_resv_assert_held(attach->dmabuf->resv);
     860                 :            : 
     861         [ #  # ]:          0 :         if (attach->sgt == sg_table)
     862                 :            :                 return;
     863                 :            : 
     864                 :          0 :         if (dma_buf_is_dynamic(attach->dmabuf))
     865                 :          0 :                 dma_resv_assert_held(attach->dmabuf->resv);
     866                 :            : 
     867                 :          0 :         attach->dmabuf->ops->unmap_dma_buf(attach, sg_table, direction);
     868                 :            : }
     869                 :            : EXPORT_SYMBOL_GPL(dma_buf_unmap_attachment);
     870                 :            : 
     871                 :            : /**
     872                 :            :  * DOC: cpu access
     873                 :            :  *
     874                 :            :  * There are mutliple reasons for supporting CPU access to a dma buffer object:
     875                 :            :  *
     876                 :            :  * - Fallback operations in the kernel, for example when a device is connected
     877                 :            :  *   over USB and the kernel needs to shuffle the data around first before
     878                 :            :  *   sending it away. Cache coherency is handled by braketing any transactions
     879                 :            :  *   with calls to dma_buf_begin_cpu_access() and dma_buf_end_cpu_access()
     880                 :            :  *   access.
     881                 :            :  *
     882                 :            :  *   Since for most kernel internal dma-buf accesses need the entire buffer, a
     883                 :            :  *   vmap interface is introduced. Note that on very old 32-bit architectures
     884                 :            :  *   vmalloc space might be limited and result in vmap calls failing.
     885                 :            :  *
     886                 :            :  *   Interfaces::
     887                 :            :  *      void \*dma_buf_vmap(struct dma_buf \*dmabuf)
     888                 :            :  *      void dma_buf_vunmap(struct dma_buf \*dmabuf, void \*vaddr)
     889                 :            :  *
     890                 :            :  *   The vmap call can fail if there is no vmap support in the exporter, or if
     891                 :            :  *   it runs out of vmalloc space. Fallback to kmap should be implemented. Note
     892                 :            :  *   that the dma-buf layer keeps a reference count for all vmap access and
     893                 :            :  *   calls down into the exporter's vmap function only when no vmapping exists,
     894                 :            :  *   and only unmaps it once. Protection against concurrent vmap/vunmap calls is
     895                 :            :  *   provided by taking the dma_buf->lock mutex.
     896                 :            :  *
     897                 :            :  * - For full compatibility on the importer side with existing userspace
     898                 :            :  *   interfaces, which might already support mmap'ing buffers. This is needed in
     899                 :            :  *   many processing pipelines (e.g. feeding a software rendered image into a
     900                 :            :  *   hardware pipeline, thumbnail creation, snapshots, ...). Also, Android's ION
     901                 :            :  *   framework already supported this and for DMA buffer file descriptors to
     902                 :            :  *   replace ION buffers mmap support was needed.
     903                 :            :  *
     904                 :            :  *   There is no special interfaces, userspace simply calls mmap on the dma-buf
     905                 :            :  *   fd. But like for CPU access there's a need to braket the actual access,
     906                 :            :  *   which is handled by the ioctl (DMA_BUF_IOCTL_SYNC). Note that
     907                 :            :  *   DMA_BUF_IOCTL_SYNC can fail with -EAGAIN or -EINTR, in which case it must
     908                 :            :  *   be restarted.
     909                 :            :  *
     910                 :            :  *   Some systems might need some sort of cache coherency management e.g. when
     911                 :            :  *   CPU and GPU domains are being accessed through dma-buf at the same time.
     912                 :            :  *   To circumvent this problem there are begin/end coherency markers, that
     913                 :            :  *   forward directly to existing dma-buf device drivers vfunc hooks. Userspace
     914                 :            :  *   can make use of those markers through the DMA_BUF_IOCTL_SYNC ioctl. The
     915                 :            :  *   sequence would be used like following:
     916                 :            :  *
     917                 :            :  *     - mmap dma-buf fd
     918                 :            :  *     - for each drawing/upload cycle in CPU 1. SYNC_START ioctl, 2. read/write
     919                 :            :  *       to mmap area 3. SYNC_END ioctl. This can be repeated as often as you
     920                 :            :  *       want (with the new data being consumed by say the GPU or the scanout
     921                 :            :  *       device)
     922                 :            :  *     - munmap once you don't need the buffer any more
     923                 :            :  *
     924                 :            :  *    For correctness and optimal performance, it is always required to use
     925                 :            :  *    SYNC_START and SYNC_END before and after, respectively, when accessing the
     926                 :            :  *    mapped address. Userspace cannot rely on coherent access, even when there
     927                 :            :  *    are systems where it just works without calling these ioctls.
     928                 :            :  *
     929                 :            :  * - And as a CPU fallback in userspace processing pipelines.
     930                 :            :  *
     931                 :            :  *   Similar to the motivation for kernel cpu access it is again important that
     932                 :            :  *   the userspace code of a given importing subsystem can use the same
     933                 :            :  *   interfaces with a imported dma-buf buffer object as with a native buffer
     934                 :            :  *   object. This is especially important for drm where the userspace part of
     935                 :            :  *   contemporary OpenGL, X, and other drivers is huge, and reworking them to
     936                 :            :  *   use a different way to mmap a buffer rather invasive.
     937                 :            :  *
     938                 :            :  *   The assumption in the current dma-buf interfaces is that redirecting the
     939                 :            :  *   initial mmap is all that's needed. A survey of some of the existing
     940                 :            :  *   subsystems shows that no driver seems to do any nefarious thing like
     941                 :            :  *   syncing up with outstanding asynchronous processing on the device or
     942                 :            :  *   allocating special resources at fault time. So hopefully this is good
     943                 :            :  *   enough, since adding interfaces to intercept pagefaults and allow pte
     944                 :            :  *   shootdowns would increase the complexity quite a bit.
     945                 :            :  *
     946                 :            :  *   Interface::
     947                 :            :  *      int dma_buf_mmap(struct dma_buf \*, struct vm_area_struct \*,
     948                 :            :  *                     unsigned long);
     949                 :            :  *
     950                 :            :  *   If the importing subsystem simply provides a special-purpose mmap call to
     951                 :            :  *   set up a mapping in userspace, calling do_mmap with dma_buf->file will
     952                 :            :  *   equally achieve that for a dma-buf object.
     953                 :            :  */
     954                 :            : 
     955                 :          0 : static int __dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
     956                 :            :                                       enum dma_data_direction direction)
     957                 :            : {
     958                 :          0 :         bool write = (direction == DMA_BIDIRECTIONAL ||
     959                 :            :                       direction == DMA_TO_DEVICE);
     960                 :          0 :         struct dma_resv *resv = dmabuf->resv;
     961                 :          0 :         long ret;
     962                 :            : 
     963                 :            :         /* Wait on any implicit rendering fences */
     964                 :          0 :         ret = dma_resv_wait_timeout_rcu(resv, write, true,
     965                 :            :                                                   MAX_SCHEDULE_TIMEOUT);
     966                 :          0 :         if (ret < 0)
     967                 :            :                 return ret;
     968                 :            : 
     969                 :            :         return 0;
     970                 :            : }
     971                 :            : 
     972                 :            : /**
     973                 :            :  * dma_buf_begin_cpu_access - Must be called before accessing a dma_buf from the
     974                 :            :  * cpu in the kernel context. Calls begin_cpu_access to allow exporter-specific
     975                 :            :  * preparations. Coherency is only guaranteed in the specified range for the
     976                 :            :  * specified access direction.
     977                 :            :  * @dmabuf:     [in]    buffer to prepare cpu access for.
     978                 :            :  * @direction:  [in]    length of range for cpu access.
     979                 :            :  *
     980                 :            :  * After the cpu access is complete the caller should call
     981                 :            :  * dma_buf_end_cpu_access(). Only when cpu access is braketed by both calls is
     982                 :            :  * it guaranteed to be coherent with other DMA access.
     983                 :            :  *
     984                 :            :  * Can return negative error values, returns 0 on success.
     985                 :            :  */
     986                 :          0 : int dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
     987                 :            :                              enum dma_data_direction direction)
     988                 :            : {
     989                 :          0 :         int ret = 0;
     990                 :            : 
     991   [ #  #  #  # ]:          0 :         if (WARN_ON(!dmabuf))
     992                 :            :                 return -EINVAL;
     993                 :            : 
     994         [ #  # ]:          0 :         if (dmabuf->ops->begin_cpu_access)
     995                 :          0 :                 ret = dmabuf->ops->begin_cpu_access(dmabuf, direction);
     996                 :            : 
     997                 :            :         /* Ensure that all fences are waited upon - but we first allow
     998                 :            :          * the native handler the chance to do so more efficiently if it
     999                 :            :          * chooses. A double invocation here will be reasonably cheap no-op.
    1000                 :            :          */
    1001         [ #  # ]:          0 :         if (ret == 0)
    1002                 :          0 :                 ret = __dma_buf_begin_cpu_access(dmabuf, direction);
    1003                 :            : 
    1004                 :            :         return ret;
    1005                 :            : }
    1006                 :            : EXPORT_SYMBOL_GPL(dma_buf_begin_cpu_access);
    1007                 :            : 
    1008                 :            : /**
    1009                 :            :  * dma_buf_end_cpu_access - Must be called after accessing a dma_buf from the
    1010                 :            :  * cpu in the kernel context. Calls end_cpu_access to allow exporter-specific
    1011                 :            :  * actions. Coherency is only guaranteed in the specified range for the
    1012                 :            :  * specified access direction.
    1013                 :            :  * @dmabuf:     [in]    buffer to complete cpu access for.
    1014                 :            :  * @direction:  [in]    length of range for cpu access.
    1015                 :            :  *
    1016                 :            :  * This terminates CPU access started with dma_buf_begin_cpu_access().
    1017                 :            :  *
    1018                 :            :  * Can return negative error values, returns 0 on success.
    1019                 :            :  */
    1020                 :          0 : int dma_buf_end_cpu_access(struct dma_buf *dmabuf,
    1021                 :            :                            enum dma_data_direction direction)
    1022                 :            : {
    1023                 :          0 :         int ret = 0;
    1024                 :            : 
    1025   [ #  #  #  # ]:          0 :         WARN_ON(!dmabuf);
    1026                 :            : 
    1027   [ #  #  #  # ]:          0 :         if (dmabuf->ops->end_cpu_access)
    1028                 :          0 :                 ret = dmabuf->ops->end_cpu_access(dmabuf, direction);
    1029                 :            : 
    1030                 :          0 :         return ret;
    1031                 :            : }
    1032                 :            : EXPORT_SYMBOL_GPL(dma_buf_end_cpu_access);
    1033                 :            : 
    1034                 :            : 
    1035                 :            : /**
    1036                 :            :  * dma_buf_mmap - Setup up a userspace mmap with the given vma
    1037                 :            :  * @dmabuf:     [in]    buffer that should back the vma
    1038                 :            :  * @vma:        [in]    vma for the mmap
    1039                 :            :  * @pgoff:      [in]    offset in pages where this mmap should start within the
    1040                 :            :  *                      dma-buf buffer.
    1041                 :            :  *
    1042                 :            :  * This function adjusts the passed in vma so that it points at the file of the
    1043                 :            :  * dma_buf operation. It also adjusts the starting pgoff and does bounds
    1044                 :            :  * checking on the size of the vma. Then it calls the exporters mmap function to
    1045                 :            :  * set up the mapping.
    1046                 :            :  *
    1047                 :            :  * Can return negative error values, returns 0 on success.
    1048                 :            :  */
    1049                 :          0 : int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
    1050                 :            :                  unsigned long pgoff)
    1051                 :            : {
    1052                 :          0 :         struct file *oldfile;
    1053                 :          0 :         int ret;
    1054                 :            : 
    1055   [ #  #  #  # ]:          0 :         if (WARN_ON(!dmabuf || !vma))
    1056                 :            :                 return -EINVAL;
    1057                 :            : 
    1058                 :            :         /* check if buffer supports mmap */
    1059         [ #  # ]:          0 :         if (!dmabuf->ops->mmap)
    1060                 :            :                 return -EINVAL;
    1061                 :            : 
    1062                 :            :         /* check for offset overflow */
    1063         [ #  # ]:          0 :         if (pgoff + vma_pages(vma) < pgoff)
    1064                 :            :                 return -EOVERFLOW;
    1065                 :            : 
    1066                 :            :         /* check for overflowing the buffer's size */
    1067         [ #  # ]:          0 :         if (pgoff + vma_pages(vma) >
    1068         [ #  # ]:          0 :             dmabuf->size >> PAGE_SHIFT)
    1069                 :            :                 return -EINVAL;
    1070                 :            : 
    1071                 :            :         /* readjust the vma */
    1072                 :          0 :         get_file(dmabuf->file);
    1073                 :          0 :         oldfile = vma->vm_file;
    1074                 :          0 :         vma->vm_file = dmabuf->file;
    1075                 :          0 :         vma->vm_pgoff = pgoff;
    1076                 :            : 
    1077                 :          0 :         ret = dmabuf->ops->mmap(dmabuf, vma);
    1078         [ #  # ]:          0 :         if (ret) {
    1079                 :            :                 /* restore old parameters on failure */
    1080                 :          0 :                 vma->vm_file = oldfile;
    1081                 :          0 :                 fput(dmabuf->file);
    1082                 :            :         } else {
    1083         [ #  # ]:          0 :                 if (oldfile)
    1084                 :          0 :                         fput(oldfile);
    1085                 :            :         }
    1086                 :            :         return ret;
    1087                 :            : 
    1088                 :            : }
    1089                 :            : EXPORT_SYMBOL_GPL(dma_buf_mmap);
    1090                 :            : 
    1091                 :            : /**
    1092                 :            :  * dma_buf_vmap - Create virtual mapping for the buffer object into kernel
    1093                 :            :  * address space. Same restrictions as for vmap and friends apply.
    1094                 :            :  * @dmabuf:     [in]    buffer to vmap
    1095                 :            :  *
    1096                 :            :  * This call may fail due to lack of virtual mapping address space.
    1097                 :            :  * These calls are optional in drivers. The intended use for them
    1098                 :            :  * is for mapping objects linear in kernel space for high use objects.
    1099                 :            :  * Please attempt to use kmap/kunmap before thinking about these interfaces.
    1100                 :            :  *
    1101                 :            :  * Returns NULL on error.
    1102                 :            :  */
    1103                 :          0 : void *dma_buf_vmap(struct dma_buf *dmabuf)
    1104                 :            : {
    1105                 :          0 :         void *ptr;
    1106                 :            : 
    1107   [ #  #  #  # ]:          0 :         if (WARN_ON(!dmabuf))
    1108                 :            :                 return NULL;
    1109                 :            : 
    1110         [ #  # ]:          0 :         if (!dmabuf->ops->vmap)
    1111                 :            :                 return NULL;
    1112                 :            : 
    1113                 :          0 :         mutex_lock(&dmabuf->lock);
    1114         [ #  # ]:          0 :         if (dmabuf->vmapping_counter) {
    1115                 :          0 :                 dmabuf->vmapping_counter++;
    1116         [ #  # ]:          0 :                 BUG_ON(!dmabuf->vmap_ptr);
    1117                 :          0 :                 ptr = dmabuf->vmap_ptr;
    1118                 :          0 :                 goto out_unlock;
    1119                 :            :         }
    1120                 :            : 
    1121         [ #  # ]:          0 :         BUG_ON(dmabuf->vmap_ptr);
    1122                 :            : 
    1123                 :          0 :         ptr = dmabuf->ops->vmap(dmabuf);
    1124   [ #  #  #  # ]:          0 :         if (WARN_ON_ONCE(IS_ERR(ptr)))
    1125                 :            :                 ptr = NULL;
    1126         [ #  # ]:          0 :         if (!ptr)
    1127                 :          0 :                 goto out_unlock;
    1128                 :            : 
    1129                 :          0 :         dmabuf->vmap_ptr = ptr;
    1130                 :          0 :         dmabuf->vmapping_counter = 1;
    1131                 :            : 
    1132                 :          0 : out_unlock:
    1133                 :          0 :         mutex_unlock(&dmabuf->lock);
    1134                 :          0 :         return ptr;
    1135                 :            : }
    1136                 :            : EXPORT_SYMBOL_GPL(dma_buf_vmap);
    1137                 :            : 
    1138                 :            : /**
    1139                 :            :  * dma_buf_vunmap - Unmap a vmap obtained by dma_buf_vmap.
    1140                 :            :  * @dmabuf:     [in]    buffer to vunmap
    1141                 :            :  * @vaddr:      [in]    vmap to vunmap
    1142                 :            :  */
    1143                 :          0 : void dma_buf_vunmap(struct dma_buf *dmabuf, void *vaddr)
    1144                 :            : {
    1145   [ #  #  #  # ]:          0 :         if (WARN_ON(!dmabuf))
    1146                 :            :                 return;
    1147                 :            : 
    1148         [ #  # ]:          0 :         BUG_ON(!dmabuf->vmap_ptr);
    1149         [ #  # ]:          0 :         BUG_ON(dmabuf->vmapping_counter == 0);
    1150         [ #  # ]:          0 :         BUG_ON(dmabuf->vmap_ptr != vaddr);
    1151                 :            : 
    1152                 :          0 :         mutex_lock(&dmabuf->lock);
    1153         [ #  # ]:          0 :         if (--dmabuf->vmapping_counter == 0) {
    1154         [ #  # ]:          0 :                 if (dmabuf->ops->vunmap)
    1155                 :          0 :                         dmabuf->ops->vunmap(dmabuf, vaddr);
    1156                 :          0 :                 dmabuf->vmap_ptr = NULL;
    1157                 :            :         }
    1158                 :          0 :         mutex_unlock(&dmabuf->lock);
    1159                 :            : }
    1160                 :            : EXPORT_SYMBOL_GPL(dma_buf_vunmap);
    1161                 :            : 
    1162                 :            : #ifdef CONFIG_DEBUG_FS
    1163                 :          0 : static int dma_buf_debug_show(struct seq_file *s, void *unused)
    1164                 :            : {
    1165                 :          0 :         int ret;
    1166                 :          0 :         struct dma_buf *buf_obj;
    1167                 :          0 :         struct dma_buf_attachment *attach_obj;
    1168                 :          0 :         struct dma_resv *robj;
    1169                 :          0 :         struct dma_resv_list *fobj;
    1170                 :          0 :         struct dma_fence *fence;
    1171                 :          0 :         unsigned seq;
    1172                 :          0 :         int count = 0, attach_count, shared_count, i;
    1173                 :          0 :         size_t size = 0;
    1174                 :            : 
    1175                 :          0 :         ret = mutex_lock_interruptible(&db_list.lock);
    1176                 :            : 
    1177         [ #  # ]:          0 :         if (ret)
    1178                 :            :                 return ret;
    1179                 :            : 
    1180                 :          0 :         seq_puts(s, "\nDma-buf Objects:\n");
    1181                 :          0 :         seq_printf(s, "%-8s\t%-8s\t%-8s\t%-8s\texp_name\t%-8s\n",
    1182                 :            :                    "size", "flags", "mode", "count", "ino");
    1183                 :            : 
    1184         [ #  # ]:          0 :         list_for_each_entry(buf_obj, &db_list.head, list_node) {
    1185                 :            : 
    1186                 :          0 :                 ret = dma_resv_lock_interruptible(buf_obj->resv, NULL);
    1187         [ #  # ]:          0 :                 if (ret)
    1188                 :          0 :                         goto error_unlock;
    1189                 :            : 
    1190                 :          0 :                 seq_printf(s, "%08zu\t%08x\t%08x\t%08ld\t%s\t%08lu\t%s\n",
    1191                 :            :                                 buf_obj->size,
    1192                 :          0 :                                 buf_obj->file->f_flags, buf_obj->file->f_mode,
    1193                 :          0 :                                 file_count(buf_obj->file),
    1194                 :            :                                 buf_obj->exp_name,
    1195                 :          0 :                                 file_inode(buf_obj->file)->i_ino,
    1196         [ #  # ]:          0 :                                 buf_obj->name ?: "");
    1197                 :            : 
    1198                 :          0 :                 robj = buf_obj->resv;
    1199                 :          0 :                 while (true) {
    1200                 :          0 :                         seq = read_seqcount_begin(&robj->seq);
    1201                 :          0 :                         rcu_read_lock();
    1202         [ #  # ]:          0 :                         fobj = rcu_dereference(robj->fence);
    1203         [ #  # ]:          0 :                         shared_count = fobj ? fobj->shared_count : 0;
    1204                 :          0 :                         fence = rcu_dereference(robj->fence_excl);
    1205         [ #  # ]:          0 :                         if (!read_seqcount_retry(&robj->seq, seq))
    1206                 :            :                                 break;
    1207                 :          0 :                         rcu_read_unlock();
    1208                 :            :                 }
    1209                 :            : 
    1210         [ #  # ]:          0 :                 if (fence)
    1211         [ #  # ]:          0 :                         seq_printf(s, "\tExclusive fence: %s %s %ssignalled\n",
    1212                 :          0 :                                    fence->ops->get_driver_name(fence),
    1213                 :          0 :                                    fence->ops->get_timeline_name(fence),
    1214                 :          0 :                                    dma_fence_is_signaled(fence) ? "" : "un");
    1215         [ #  # ]:          0 :                 for (i = 0; i < shared_count; i++) {
    1216                 :          0 :                         fence = rcu_dereference(fobj->shared[i]);
    1217         [ #  # ]:          0 :                         if (!dma_fence_get_rcu(fence))
    1218                 :          0 :                                 continue;
    1219         [ #  # ]:          0 :                         seq_printf(s, "\tShared fence: %s %s %ssignalled\n",
    1220                 :          0 :                                    fence->ops->get_driver_name(fence),
    1221                 :          0 :                                    fence->ops->get_timeline_name(fence),
    1222                 :          0 :                                    dma_fence_is_signaled(fence) ? "" : "un");
    1223                 :          0 :                         dma_fence_put(fence);
    1224                 :            :                 }
    1225                 :          0 :                 rcu_read_unlock();
    1226                 :            : 
    1227                 :          0 :                 seq_puts(s, "\tAttached Devices:\n");
    1228                 :          0 :                 attach_count = 0;
    1229                 :            : 
    1230         [ #  # ]:          0 :                 list_for_each_entry(attach_obj, &buf_obj->attachments, node) {
    1231         [ #  # ]:          0 :                         seq_printf(s, "\t%s\n", dev_name(attach_obj->dev));
    1232                 :          0 :                         attach_count++;
    1233                 :            :                 }
    1234                 :          0 :                 dma_resv_unlock(buf_obj->resv);
    1235                 :            : 
    1236                 :          0 :                 seq_printf(s, "Total %d devices attached\n\n",
    1237                 :            :                                 attach_count);
    1238                 :            : 
    1239                 :          0 :                 count++;
    1240                 :          0 :                 size += buf_obj->size;
    1241                 :            :         }
    1242                 :            : 
    1243                 :          0 :         seq_printf(s, "\nTotal %d objects, %zu bytes\n", count, size);
    1244                 :            : 
    1245                 :          0 :         mutex_unlock(&db_list.lock);
    1246                 :          0 :         return 0;
    1247                 :            : 
    1248                 :            : error_unlock:
    1249                 :          0 :         mutex_unlock(&db_list.lock);
    1250                 :          0 :         return ret;
    1251                 :            : }
    1252                 :            : 
    1253                 :          0 : DEFINE_SHOW_ATTRIBUTE(dma_buf_debug);
    1254                 :            : 
    1255                 :            : static struct dentry *dma_buf_debugfs_dir;
    1256                 :            : 
    1257                 :         30 : static int dma_buf_init_debugfs(void)
    1258                 :            : {
    1259                 :         30 :         struct dentry *d;
    1260                 :         30 :         int err = 0;
    1261                 :            : 
    1262                 :         30 :         d = debugfs_create_dir("dma_buf", NULL);
    1263         [ -  + ]:         30 :         if (IS_ERR(d))
    1264                 :          0 :                 return PTR_ERR(d);
    1265                 :            : 
    1266                 :         30 :         dma_buf_debugfs_dir = d;
    1267                 :            : 
    1268                 :         30 :         d = debugfs_create_file("bufinfo", S_IRUGO, dma_buf_debugfs_dir,
    1269                 :            :                                 NULL, &dma_buf_debug_fops);
    1270         [ -  + ]:         30 :         if (IS_ERR(d)) {
    1271                 :          0 :                 pr_debug("dma_buf: debugfs: failed to create node bufinfo\n");
    1272                 :          0 :                 debugfs_remove_recursive(dma_buf_debugfs_dir);
    1273                 :          0 :                 dma_buf_debugfs_dir = NULL;
    1274                 :          0 :                 err = PTR_ERR(d);
    1275                 :            :         }
    1276                 :            : 
    1277                 :            :         return err;
    1278                 :            : }
    1279                 :            : 
    1280                 :          0 : static void dma_buf_uninit_debugfs(void)
    1281                 :            : {
    1282                 :          0 :         debugfs_remove_recursive(dma_buf_debugfs_dir);
    1283                 :            : }
    1284                 :            : #else
    1285                 :            : static inline int dma_buf_init_debugfs(void)
    1286                 :            : {
    1287                 :            :         return 0;
    1288                 :            : }
    1289                 :            : static inline void dma_buf_uninit_debugfs(void)
    1290                 :            : {
    1291                 :            : }
    1292                 :            : #endif
    1293                 :            : 
    1294                 :         30 : static int __init dma_buf_init(void)
    1295                 :            : {
    1296                 :         30 :         dma_buf_mnt = kern_mount(&dma_buf_fs_type);
    1297         [ -  + ]:         30 :         if (IS_ERR(dma_buf_mnt))
    1298                 :          0 :                 return PTR_ERR(dma_buf_mnt);
    1299                 :            : 
    1300                 :         30 :         mutex_init(&db_list.lock);
    1301                 :         30 :         INIT_LIST_HEAD(&db_list.head);
    1302                 :         30 :         dma_buf_init_debugfs();
    1303                 :         30 :         return 0;
    1304                 :            : }
    1305                 :            : subsys_initcall(dma_buf_init);
    1306                 :            : 
    1307                 :          0 : static void __exit dma_buf_deinit(void)
    1308                 :            : {
    1309                 :          0 :         dma_buf_uninit_debugfs();
    1310                 :          0 :         kern_unmount(dma_buf_mnt);
    1311                 :          0 : }
    1312                 :            : __exitcall(dma_buf_deinit);

Generated by: LCOV version 1.14