blob: 0007b792827b7ec16a21351f924522e7344a6c92 [file] [log] [blame]
Sumit Semwald15bd7e2011-12-26 14:53:15 +05301/*
2 * Framework for buffer objects that can be shared across devices/subsystems.
3 *
4 * Copyright(C) 2011 Linaro Limited. All rights reserved.
5 * Author: Sumit Semwal <sumit.semwal@ti.com>
6 *
7 * Many thanks to linaro-mm-sig list, and specially
8 * Arnd Bergmann <arnd@arndb.de>, Rob Clark <rob@ti.com> and
9 * Daniel Vetter <daniel@ffwll.ch> for their support in creation and
10 * refining of this idea.
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License version 2 as published by
14 * the Free Software Foundation.
15 *
16 * This program is distributed in the hope that it will be useful, but WITHOUT
17 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
18 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
19 * more details.
20 *
21 * You should have received a copy of the GNU General Public License along with
22 * this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25#include <linux/fs.h>
26#include <linux/slab.h>
27#include <linux/dma-buf.h>
Chris Wilsonf54d1862016-10-25 13:00:45 +010028#include <linux/dma-fence.h>
Sumit Semwald15bd7e2011-12-26 14:53:15 +053029#include <linux/anon_inodes.h>
30#include <linux/export.h>
Sumit Semwalb89e3562013-04-04 11:44:37 +053031#include <linux/debugfs.h>
Sumit Semwal9abdffe2015-05-05 14:56:15 +053032#include <linux/module.h>
Sumit Semwalb89e3562013-04-04 11:44:37 +053033#include <linux/seq_file.h>
Maarten Lankhorst9b495a52014-07-01 12:57:43 +020034#include <linux/poll.h>
Maarten Lankhorst3aac4502014-07-01 12:57:26 +020035#include <linux/reservation.h>
Muhammad Falak R Wanib02da6f2016-05-23 17:08:42 +053036#include <linux/mm.h>
Sumit Semwald15bd7e2011-12-26 14:53:15 +053037
Daniel Vetterc11e3912016-02-11 20:04:51 -020038#include <uapi/linux/dma-buf.h>
39
Sumit Semwald15bd7e2011-12-26 14:53:15 +053040static inline int is_dma_buf_file(struct file *);
41
Sumit Semwalb89e3562013-04-04 11:44:37 +053042struct dma_buf_list {
43 struct list_head head;
44 struct mutex lock;
45};
46
47static struct dma_buf_list db_list;
48
Sumit Semwald15bd7e2011-12-26 14:53:15 +053049static int dma_buf_release(struct inode *inode, struct file *file)
50{
51 struct dma_buf *dmabuf;
52
53 if (!is_dma_buf_file(file))
54 return -EINVAL;
55
56 dmabuf = file->private_data;
57
Daniel Vetterf00b4da2012-12-20 14:14:23 +010058 BUG_ON(dmabuf->vmapping_counter);
59
Maarten Lankhorst9b495a52014-07-01 12:57:43 +020060 /*
61 * Any fences that a dma-buf poll can wait on should be signaled
62 * before releasing dma-buf. This is the responsibility of each
63 * driver that uses the reservation objects.
64 *
65 * If you hit this BUG() it means someone dropped their ref to the
66 * dma-buf while still having pending operation to the buffer.
67 */
68 BUG_ON(dmabuf->cb_shared.active || dmabuf->cb_excl.active);
69
Sumit Semwald15bd7e2011-12-26 14:53:15 +053070 dmabuf->ops->release(dmabuf);
Sumit Semwalb89e3562013-04-04 11:44:37 +053071
72 mutex_lock(&db_list.lock);
73 list_del(&dmabuf->list_node);
74 mutex_unlock(&db_list.lock);
75
Maarten Lankhorst3aac4502014-07-01 12:57:26 +020076 if (dmabuf->resv == (struct reservation_object *)&dmabuf[1])
77 reservation_object_fini(dmabuf->resv);
78
Sumit Semwal9abdffe2015-05-05 14:56:15 +053079 module_put(dmabuf->owner);
Sumit Semwald15bd7e2011-12-26 14:53:15 +053080 kfree(dmabuf);
81 return 0;
82}
83
Daniel Vetter4c785132012-04-24 14:38:52 +053084static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma)
85{
86 struct dma_buf *dmabuf;
87
88 if (!is_dma_buf_file(file))
89 return -EINVAL;
90
91 dmabuf = file->private_data;
92
93 /* check for overflowing the buffer's size */
Muhammad Falak R Wanib02da6f2016-05-23 17:08:42 +053094 if (vma->vm_pgoff + vma_pages(vma) >
Daniel Vetter4c785132012-04-24 14:38:52 +053095 dmabuf->size >> PAGE_SHIFT)
96 return -EINVAL;
97
98 return dmabuf->ops->mmap(dmabuf, vma);
99}
100
Christopher James Halse Rogers19e86972013-09-10 11:36:45 +0530101static loff_t dma_buf_llseek(struct file *file, loff_t offset, int whence)
102{
103 struct dma_buf *dmabuf;
104 loff_t base;
105
106 if (!is_dma_buf_file(file))
107 return -EBADF;
108
109 dmabuf = file->private_data;
110
111 /* only support discovering the end of the buffer,
112 but also allow SEEK_SET to maintain the idiomatic
113 SEEK_END(0), SEEK_CUR(0) pattern */
114 if (whence == SEEK_END)
115 base = dmabuf->size;
116 else if (whence == SEEK_SET)
117 base = 0;
118 else
119 return -EINVAL;
120
121 if (offset != 0)
122 return -EINVAL;
123
124 return base + offset;
125}
126
Daniel Vettere7e21c72016-12-09 22:50:55 +0100127/**
128 * DOC: fence polling
129 *
130 * To support cross-device and cross-driver synchronization of buffer access
Daniel Vetterf641d3b2016-12-29 21:48:24 +0100131 * implicit fences (represented internally in the kernel with &struct fence) can
Daniel Vettere7e21c72016-12-09 22:50:55 +0100132 * be attached to a &dma_buf. The glue for that and a few related things are
133 * provided in the &reservation_object structure.
134 *
135 * Userspace can query the state of these implicitly tracked fences using poll()
136 * and related system calls:
137 *
138 * - Checking for POLLIN, i.e. read access, can be use to query the state of the
139 * most recent write or exclusive fence.
140 *
141 * - Checking for POLLOUT, i.e. write access, can be used to query the state of
142 * all attached fences, shared and exclusive ones.
143 *
144 * Note that this only signals the completion of the respective fences, i.e. the
145 * DMA transfers are complete. Cache flushing and any other necessary
146 * preparations before CPU access can begin still need to happen.
147 */
148
Chris Wilsonf54d1862016-10-25 13:00:45 +0100149static void dma_buf_poll_cb(struct dma_fence *fence, struct dma_fence_cb *cb)
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200150{
151 struct dma_buf_poll_cb_t *dcb = (struct dma_buf_poll_cb_t *)cb;
152 unsigned long flags;
153
154 spin_lock_irqsave(&dcb->poll->lock, flags);
155 wake_up_locked_poll(dcb->poll, dcb->active);
156 dcb->active = 0;
157 spin_unlock_irqrestore(&dcb->poll->lock, flags);
158}
159
160static unsigned int dma_buf_poll(struct file *file, poll_table *poll)
161{
162 struct dma_buf *dmabuf;
163 struct reservation_object *resv;
Maarten Lankhorst04a5faa2014-07-01 12:57:54 +0200164 struct reservation_object_list *fobj;
Chris Wilsonf54d1862016-10-25 13:00:45 +0100165 struct dma_fence *fence_excl;
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200166 unsigned long events;
Maarten Lankhorst3c3b1772014-07-01 12:58:00 +0200167 unsigned shared_count, seq;
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200168
169 dmabuf = file->private_data;
170 if (!dmabuf || !dmabuf->resv)
171 return POLLERR;
172
173 resv = dmabuf->resv;
174
175 poll_wait(file, &dmabuf->poll, poll);
176
177 events = poll_requested_events(poll) & (POLLIN | POLLOUT);
178 if (!events)
179 return 0;
180
Maarten Lankhorst3c3b1772014-07-01 12:58:00 +0200181retry:
182 seq = read_seqcount_begin(&resv->seq);
183 rcu_read_lock();
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200184
Maarten Lankhorst3c3b1772014-07-01 12:58:00 +0200185 fobj = rcu_dereference(resv->fence);
186 if (fobj)
187 shared_count = fobj->shared_count;
188 else
189 shared_count = 0;
190 fence_excl = rcu_dereference(resv->fence_excl);
191 if (read_seqcount_retry(&resv->seq, seq)) {
192 rcu_read_unlock();
193 goto retry;
194 }
Maarten Lankhorst04a5faa2014-07-01 12:57:54 +0200195
196 if (fence_excl && (!(events & POLLOUT) || shared_count == 0)) {
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200197 struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_excl;
198 unsigned long pevents = POLLIN;
199
Maarten Lankhorst04a5faa2014-07-01 12:57:54 +0200200 if (shared_count == 0)
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200201 pevents |= POLLOUT;
202
203 spin_lock_irq(&dmabuf->poll.lock);
204 if (dcb->active) {
205 dcb->active |= pevents;
206 events &= ~pevents;
207 } else
208 dcb->active = pevents;
209 spin_unlock_irq(&dmabuf->poll.lock);
210
211 if (events & pevents) {
Chris Wilsonf54d1862016-10-25 13:00:45 +0100212 if (!dma_fence_get_rcu(fence_excl)) {
Maarten Lankhorst3c3b1772014-07-01 12:58:00 +0200213 /* force a recheck */
214 events &= ~pevents;
215 dma_buf_poll_cb(NULL, &dcb->cb);
Chris Wilsonf54d1862016-10-25 13:00:45 +0100216 } else if (!dma_fence_add_callback(fence_excl, &dcb->cb,
217 dma_buf_poll_cb)) {
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200218 events &= ~pevents;
Chris Wilsonf54d1862016-10-25 13:00:45 +0100219 dma_fence_put(fence_excl);
Maarten Lankhorst04a5faa2014-07-01 12:57:54 +0200220 } else {
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200221 /*
222 * No callback queued, wake up any additional
223 * waiters.
224 */
Chris Wilsonf54d1862016-10-25 13:00:45 +0100225 dma_fence_put(fence_excl);
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200226 dma_buf_poll_cb(NULL, &dcb->cb);
Maarten Lankhorst04a5faa2014-07-01 12:57:54 +0200227 }
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200228 }
229 }
230
Maarten Lankhorst04a5faa2014-07-01 12:57:54 +0200231 if ((events & POLLOUT) && shared_count > 0) {
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200232 struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_shared;
233 int i;
234
235 /* Only queue a new callback if no event has fired yet */
236 spin_lock_irq(&dmabuf->poll.lock);
237 if (dcb->active)
238 events &= ~POLLOUT;
239 else
240 dcb->active = POLLOUT;
241 spin_unlock_irq(&dmabuf->poll.lock);
242
243 if (!(events & POLLOUT))
244 goto out;
245
Maarten Lankhorst04a5faa2014-07-01 12:57:54 +0200246 for (i = 0; i < shared_count; ++i) {
Chris Wilsonf54d1862016-10-25 13:00:45 +0100247 struct dma_fence *fence = rcu_dereference(fobj->shared[i]);
Maarten Lankhorst04a5faa2014-07-01 12:57:54 +0200248
Chris Wilsonf54d1862016-10-25 13:00:45 +0100249 if (!dma_fence_get_rcu(fence)) {
Maarten Lankhorst3c3b1772014-07-01 12:58:00 +0200250 /*
251 * fence refcount dropped to zero, this means
252 * that fobj has been freed
253 *
254 * call dma_buf_poll_cb and force a recheck!
255 */
256 events &= ~POLLOUT;
257 dma_buf_poll_cb(NULL, &dcb->cb);
258 break;
259 }
Chris Wilsonf54d1862016-10-25 13:00:45 +0100260 if (!dma_fence_add_callback(fence, &dcb->cb,
261 dma_buf_poll_cb)) {
262 dma_fence_put(fence);
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200263 events &= ~POLLOUT;
264 break;
265 }
Chris Wilsonf54d1862016-10-25 13:00:45 +0100266 dma_fence_put(fence);
Maarten Lankhorst04a5faa2014-07-01 12:57:54 +0200267 }
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200268
269 /* No callback queued, wake up any additional waiters. */
Maarten Lankhorst04a5faa2014-07-01 12:57:54 +0200270 if (i == shared_count)
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200271 dma_buf_poll_cb(NULL, &dcb->cb);
272 }
273
274out:
Maarten Lankhorst3c3b1772014-07-01 12:58:00 +0200275 rcu_read_unlock();
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200276 return events;
277}
278
Daniel Vetterc11e3912016-02-11 20:04:51 -0200279static long dma_buf_ioctl(struct file *file,
280 unsigned int cmd, unsigned long arg)
281{
282 struct dma_buf *dmabuf;
283 struct dma_buf_sync sync;
284 enum dma_data_direction direction;
Chris Wilson18b862d2016-03-18 20:02:39 +0000285 int ret;
Daniel Vetterc11e3912016-02-11 20:04:51 -0200286
287 dmabuf = file->private_data;
288
289 switch (cmd) {
290 case DMA_BUF_IOCTL_SYNC:
291 if (copy_from_user(&sync, (void __user *) arg, sizeof(sync)))
292 return -EFAULT;
293
294 if (sync.flags & ~DMA_BUF_SYNC_VALID_FLAGS_MASK)
295 return -EINVAL;
296
297 switch (sync.flags & DMA_BUF_SYNC_RW) {
298 case DMA_BUF_SYNC_READ:
299 direction = DMA_FROM_DEVICE;
300 break;
301 case DMA_BUF_SYNC_WRITE:
302 direction = DMA_TO_DEVICE;
303 break;
304 case DMA_BUF_SYNC_RW:
305 direction = DMA_BIDIRECTIONAL;
306 break;
307 default:
308 return -EINVAL;
309 }
310
311 if (sync.flags & DMA_BUF_SYNC_END)
Chris Wilson18b862d2016-03-18 20:02:39 +0000312 ret = dma_buf_end_cpu_access(dmabuf, direction);
Daniel Vetterc11e3912016-02-11 20:04:51 -0200313 else
Chris Wilson18b862d2016-03-18 20:02:39 +0000314 ret = dma_buf_begin_cpu_access(dmabuf, direction);
Daniel Vetterc11e3912016-02-11 20:04:51 -0200315
Chris Wilson18b862d2016-03-18 20:02:39 +0000316 return ret;
Daniel Vetterc11e3912016-02-11 20:04:51 -0200317 default:
318 return -ENOTTY;
319 }
320}
321
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530322static const struct file_operations dma_buf_fops = {
323 .release = dma_buf_release,
Daniel Vetter4c785132012-04-24 14:38:52 +0530324 .mmap = dma_buf_mmap_internal,
Christopher James Halse Rogers19e86972013-09-10 11:36:45 +0530325 .llseek = dma_buf_llseek,
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200326 .poll = dma_buf_poll,
Daniel Vetterc11e3912016-02-11 20:04:51 -0200327 .unlocked_ioctl = dma_buf_ioctl,
Marek Szyprowski888022c2017-02-21 14:21:01 +0100328#ifdef CONFIG_COMPAT
329 .compat_ioctl = dma_buf_ioctl,
330#endif
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530331};
332
333/*
334 * is_dma_buf_file - Check if struct file* is associated with dma_buf
335 */
336static inline int is_dma_buf_file(struct file *file)
337{
338 return file->f_op == &dma_buf_fops;
339}
340
341/**
Daniel Vetter2904a8c2016-12-09 19:53:07 +0100342 * DOC: dma buf device access
343 *
344 * For device DMA access to a shared DMA buffer the usual sequence of operations
345 * is fairly simple:
346 *
347 * 1. The exporter defines his exporter instance using
348 * DEFINE_DMA_BUF_EXPORT_INFO() and calls dma_buf_export() to wrap a private
349 * buffer object into a &dma_buf. It then exports that &dma_buf to userspace
350 * as a file descriptor by calling dma_buf_fd().
351 *
352 * 2. Userspace passes this file-descriptors to all drivers it wants this buffer
353 * to share with: First the filedescriptor is converted to a &dma_buf using
354 * dma_buf_get(). The the buffer is attached to the device using
355 * dma_buf_attach().
356 *
357 * Up to this stage the exporter is still free to migrate or reallocate the
358 * backing storage.
359 *
360 * 3. Once the buffer is attached to all devices userspace can inniate DMA
361 * access to the shared buffer. In the kernel this is done by calling
362 * dma_buf_map_attachment() and dma_buf_unmap_attachment().
363 *
364 * 4. Once a driver is done with a shared buffer it needs to call
365 * dma_buf_detach() (after cleaning up any mappings) and then release the
366 * reference acquired with dma_buf_get by calling dma_buf_put().
367 *
368 * For the detailed semantics exporters are expected to implement see
369 * &dma_buf_ops.
370 */
371
372/**
Sumit Semwald8fbe342015-01-23 12:53:43 +0530373 * dma_buf_export - Creates a new dma_buf, and associates an anon file
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530374 * with this buffer, so it can be exported.
375 * Also connect the allocator specific data and ops to the buffer.
Sumit Semwal78df9692013-03-22 18:22:16 +0530376 * Additionally, provide a name string for exporter; useful in debugging.
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530377 *
Sumit Semwald8fbe342015-01-23 12:53:43 +0530378 * @exp_info: [in] holds all the export related information provided
Daniel Vetterf641d3b2016-12-29 21:48:24 +0100379 * by the exporter. see &struct dma_buf_export_info
Sumit Semwald8fbe342015-01-23 12:53:43 +0530380 * for further details.
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530381 *
382 * Returns, on success, a newly created dma_buf object, which wraps the
383 * supplied private data and operations for dma_buf_ops. On either missing
384 * ops, or error in allocating struct dma_buf, will return negative error.
385 *
Daniel Vetter2904a8c2016-12-09 19:53:07 +0100386 * For most cases the easiest way to create @exp_info is through the
387 * %DEFINE_DMA_BUF_EXPORT_INFO macro.
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530388 */
Sumit Semwald8fbe342015-01-23 12:53:43 +0530389struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530390{
391 struct dma_buf *dmabuf;
Sumit Semwald8fbe342015-01-23 12:53:43 +0530392 struct reservation_object *resv = exp_info->resv;
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530393 struct file *file;
Maarten Lankhorst3aac4502014-07-01 12:57:26 +0200394 size_t alloc_size = sizeof(struct dma_buf);
Chris Wilsona026df42016-07-18 12:16:22 +0100395 int ret;
Jagan Teki51366292015-05-21 01:09:31 +0530396
Sumit Semwald8fbe342015-01-23 12:53:43 +0530397 if (!exp_info->resv)
Maarten Lankhorst3aac4502014-07-01 12:57:26 +0200398 alloc_size += sizeof(struct reservation_object);
399 else
400 /* prevent &dma_buf[1] == dma_buf->resv */
401 alloc_size += 1;
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530402
Sumit Semwald8fbe342015-01-23 12:53:43 +0530403 if (WARN_ON(!exp_info->priv
404 || !exp_info->ops
405 || !exp_info->ops->map_dma_buf
406 || !exp_info->ops->unmap_dma_buf
407 || !exp_info->ops->release
408 || !exp_info->ops->kmap_atomic
409 || !exp_info->ops->kmap
410 || !exp_info->ops->mmap)) {
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530411 return ERR_PTR(-EINVAL);
412 }
413
Sumit Semwal9abdffe2015-05-05 14:56:15 +0530414 if (!try_module_get(exp_info->owner))
415 return ERR_PTR(-ENOENT);
416
Maarten Lankhorst3aac4502014-07-01 12:57:26 +0200417 dmabuf = kzalloc(alloc_size, GFP_KERNEL);
Sumit Semwal9abdffe2015-05-05 14:56:15 +0530418 if (!dmabuf) {
Chris Wilsona026df42016-07-18 12:16:22 +0100419 ret = -ENOMEM;
420 goto err_module;
Sumit Semwal9abdffe2015-05-05 14:56:15 +0530421 }
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530422
Sumit Semwald8fbe342015-01-23 12:53:43 +0530423 dmabuf->priv = exp_info->priv;
424 dmabuf->ops = exp_info->ops;
425 dmabuf->size = exp_info->size;
426 dmabuf->exp_name = exp_info->exp_name;
Sumit Semwal9abdffe2015-05-05 14:56:15 +0530427 dmabuf->owner = exp_info->owner;
Maarten Lankhorst9b495a52014-07-01 12:57:43 +0200428 init_waitqueue_head(&dmabuf->poll);
429 dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll;
430 dmabuf->cb_excl.active = dmabuf->cb_shared.active = 0;
431
Maarten Lankhorst3aac4502014-07-01 12:57:26 +0200432 if (!resv) {
433 resv = (struct reservation_object *)&dmabuf[1];
434 reservation_object_init(resv);
435 }
436 dmabuf->resv = resv;
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530437
Sumit Semwald8fbe342015-01-23 12:53:43 +0530438 file = anon_inode_getfile("dmabuf", &dma_buf_fops, dmabuf,
439 exp_info->flags);
Tuomas Tynkkynen9022e242013-08-27 16:30:38 +0300440 if (IS_ERR(file)) {
Chris Wilsona026df42016-07-18 12:16:22 +0100441 ret = PTR_ERR(file);
442 goto err_dmabuf;
Tuomas Tynkkynen9022e242013-08-27 16:30:38 +0300443 }
Christopher James Halse Rogers19e86972013-09-10 11:36:45 +0530444
445 file->f_mode |= FMODE_LSEEK;
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530446 dmabuf->file = file;
447
448 mutex_init(&dmabuf->lock);
449 INIT_LIST_HEAD(&dmabuf->attachments);
450
Sumit Semwalb89e3562013-04-04 11:44:37 +0530451 mutex_lock(&db_list.lock);
452 list_add(&dmabuf->list_node, &db_list.head);
453 mutex_unlock(&db_list.lock);
454
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530455 return dmabuf;
Chris Wilsona026df42016-07-18 12:16:22 +0100456
457err_dmabuf:
458 kfree(dmabuf);
459err_module:
460 module_put(exp_info->owner);
461 return ERR_PTR(ret);
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530462}
Sumit Semwald8fbe342015-01-23 12:53:43 +0530463EXPORT_SYMBOL_GPL(dma_buf_export);
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530464
465/**
466 * dma_buf_fd - returns a file descriptor for the given dma_buf
467 * @dmabuf: [in] pointer to dma_buf for which fd is required.
Dave Airlie55c1c4c2012-03-16 10:34:02 +0000468 * @flags: [in] flags to give to fd
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530469 *
470 * On success, returns an associated 'fd'. Else, returns error.
471 */
Dave Airlie55c1c4c2012-03-16 10:34:02 +0000472int dma_buf_fd(struct dma_buf *dmabuf, int flags)
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530473{
Borislav Petkovf5e097f2012-12-11 16:05:26 +0100474 int fd;
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530475
476 if (!dmabuf || !dmabuf->file)
477 return -EINVAL;
478
Borislav Petkovf5e097f2012-12-11 16:05:26 +0100479 fd = get_unused_fd_flags(flags);
480 if (fd < 0)
481 return fd;
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530482
483 fd_install(fd, dmabuf->file);
484
485 return fd;
486}
487EXPORT_SYMBOL_GPL(dma_buf_fd);
488
489/**
490 * dma_buf_get - returns the dma_buf structure related to an fd
491 * @fd: [in] fd associated with the dma_buf to be returned
492 *
493 * On success, returns the dma_buf structure associated with an fd; uses
494 * file's refcounting done by fget to increase refcount. returns ERR_PTR
495 * otherwise.
496 */
497struct dma_buf *dma_buf_get(int fd)
498{
499 struct file *file;
500
501 file = fget(fd);
502
503 if (!file)
504 return ERR_PTR(-EBADF);
505
506 if (!is_dma_buf_file(file)) {
507 fput(file);
508 return ERR_PTR(-EINVAL);
509 }
510
511 return file->private_data;
512}
513EXPORT_SYMBOL_GPL(dma_buf_get);
514
515/**
516 * dma_buf_put - decreases refcount of the buffer
517 * @dmabuf: [in] buffer to reduce refcount of
518 *
Daniel Vetter2904a8c2016-12-09 19:53:07 +0100519 * Uses file's refcounting done implicitly by fput().
520 *
521 * If, as a result of this call, the refcount becomes 0, the 'release' file
Daniel Vettere9b4d7b2016-12-29 21:48:25 +0100522 * operation related to this fd is called. It calls &dma_buf_ops.release vfunc
523 * in turn, and frees the memory allocated for dmabuf when exported.
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530524 */
525void dma_buf_put(struct dma_buf *dmabuf)
526{
527 if (WARN_ON(!dmabuf || !dmabuf->file))
528 return;
529
530 fput(dmabuf->file);
531}
532EXPORT_SYMBOL_GPL(dma_buf_put);
533
534/**
535 * dma_buf_attach - Add the device to dma_buf's attachments list; optionally,
536 * calls attach() of dma_buf_ops to allow device-specific attach functionality
537 * @dmabuf: [in] buffer to attach device to.
538 * @dev: [in] device to be attached.
539 *
Daniel Vetter2904a8c2016-12-09 19:53:07 +0100540 * Returns struct dma_buf_attachment pointer for this attachment. Attachments
541 * must be cleaned up by calling dma_buf_detach().
542 *
543 * Returns:
544 *
545 * A pointer to newly created &dma_buf_attachment on success, or a negative
546 * error code wrapped into a pointer on failure.
547 *
548 * Note that this can fail if the backing storage of @dmabuf is in a place not
549 * accessible to @dev, and cannot be moved to a more suitable place. This is
550 * indicated with the error code -EBUSY.
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530551 */
552struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf,
553 struct device *dev)
554{
555 struct dma_buf_attachment *attach;
556 int ret;
557
Laurent Pinchartd1aa06a2012-01-26 12:27:23 +0100558 if (WARN_ON(!dmabuf || !dev))
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530559 return ERR_PTR(-EINVAL);
560
561 attach = kzalloc(sizeof(struct dma_buf_attachment), GFP_KERNEL);
562 if (attach == NULL)
Laurent Pincharta9fbc3b2012-01-26 12:27:24 +0100563 return ERR_PTR(-ENOMEM);
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530564
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530565 attach->dev = dev;
566 attach->dmabuf = dmabuf;
Laurent Pinchart2ed92012012-01-26 12:27:25 +0100567
568 mutex_lock(&dmabuf->lock);
569
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530570 if (dmabuf->ops->attach) {
571 ret = dmabuf->ops->attach(dmabuf, dev, attach);
572 if (ret)
573 goto err_attach;
574 }
575 list_add(&attach->node, &dmabuf->attachments);
576
577 mutex_unlock(&dmabuf->lock);
578 return attach;
579
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530580err_attach:
581 kfree(attach);
582 mutex_unlock(&dmabuf->lock);
583 return ERR_PTR(ret);
584}
585EXPORT_SYMBOL_GPL(dma_buf_attach);
586
587/**
588 * dma_buf_detach - Remove the given attachment from dmabuf's attachments list;
589 * optionally calls detach() of dma_buf_ops for device-specific detach
590 * @dmabuf: [in] buffer to detach from.
591 * @attach: [in] attachment to be detached; is free'd after this call.
592 *
Daniel Vetter2904a8c2016-12-09 19:53:07 +0100593 * Clean up a device attachment obtained by calling dma_buf_attach().
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530594 */
595void dma_buf_detach(struct dma_buf *dmabuf, struct dma_buf_attachment *attach)
596{
Laurent Pinchartd1aa06a2012-01-26 12:27:23 +0100597 if (WARN_ON(!dmabuf || !attach))
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530598 return;
599
600 mutex_lock(&dmabuf->lock);
601 list_del(&attach->node);
602 if (dmabuf->ops->detach)
603 dmabuf->ops->detach(dmabuf, attach);
604
605 mutex_unlock(&dmabuf->lock);
606 kfree(attach);
607}
608EXPORT_SYMBOL_GPL(dma_buf_detach);
609
610/**
611 * dma_buf_map_attachment - Returns the scatterlist table of the attachment;
612 * mapped into _device_ address space. Is a wrapper for map_dma_buf() of the
613 * dma_buf_ops.
614 * @attach: [in] attachment whose scatterlist is to be returned
615 * @direction: [in] direction of DMA transfer
616 *
Colin Crossfee0c542013-12-20 16:43:50 -0800617 * Returns sg_table containing the scatterlist to be returned; returns ERR_PTR
Daniel Vetter2904a8c2016-12-09 19:53:07 +0100618 * on error. May return -EINTR if it is interrupted by a signal.
619 *
620 * A mapping must be unmapped again using dma_buf_map_attachment(). Note that
621 * the underlying backing storage is pinned for as long as a mapping exists,
622 * therefore users/importers should not hold onto a mapping for undue amounts of
623 * time.
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530624 */
625struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach,
626 enum dma_data_direction direction)
627{
628 struct sg_table *sg_table = ERR_PTR(-EINVAL);
629
630 might_sleep();
631
Laurent Pinchartd1aa06a2012-01-26 12:27:23 +0100632 if (WARN_ON(!attach || !attach->dmabuf))
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530633 return ERR_PTR(-EINVAL);
634
Laurent Pinchartd1aa06a2012-01-26 12:27:23 +0100635 sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction);
Colin Crossfee0c542013-12-20 16:43:50 -0800636 if (!sg_table)
637 sg_table = ERR_PTR(-ENOMEM);
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530638
639 return sg_table;
640}
641EXPORT_SYMBOL_GPL(dma_buf_map_attachment);
642
643/**
644 * dma_buf_unmap_attachment - unmaps and decreases usecount of the buffer;might
645 * deallocate the scatterlist associated. Is a wrapper for unmap_dma_buf() of
646 * dma_buf_ops.
647 * @attach: [in] attachment to unmap buffer from
648 * @sg_table: [in] scatterlist info of the buffer to unmap
Sumit Semwal33ea2dc2012-01-27 15:09:27 +0530649 * @direction: [in] direction of DMA transfer
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530650 *
Daniel Vetter2904a8c2016-12-09 19:53:07 +0100651 * This unmaps a DMA mapping for @attached obtained by dma_buf_map_attachment().
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530652 */
653void dma_buf_unmap_attachment(struct dma_buf_attachment *attach,
Sumit Semwal33ea2dc2012-01-27 15:09:27 +0530654 struct sg_table *sg_table,
655 enum dma_data_direction direction)
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530656{
Rob Clarkb6fa0cd2012-09-28 09:29:43 +0200657 might_sleep();
658
Laurent Pinchartd1aa06a2012-01-26 12:27:23 +0100659 if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530660 return;
661
Sumit Semwal33ea2dc2012-01-27 15:09:27 +0530662 attach->dmabuf->ops->unmap_dma_buf(attach, sg_table,
663 direction);
Sumit Semwald15bd7e2011-12-26 14:53:15 +0530664}
665EXPORT_SYMBOL_GPL(dma_buf_unmap_attachment);
Daniel Vetterfc130202012-03-20 00:02:37 +0100666
Daniel Vetter0959a162016-12-09 19:53:08 +0100667/**
668 * DOC: cpu access
669 *
670 * There are mutliple reasons for supporting CPU access to a dma buffer object:
671 *
672 * - Fallback operations in the kernel, for example when a device is connected
673 * over USB and the kernel needs to shuffle the data around first before
674 * sending it away. Cache coherency is handled by braketing any transactions
675 * with calls to dma_buf_begin_cpu_access() and dma_buf_end_cpu_access()
676 * access.
677 *
678 * To support dma_buf objects residing in highmem cpu access is page-based
679 * using an api similar to kmap. Accessing a dma_buf is done in aligned chunks
680 * of PAGE_SIZE size. Before accessing a chunk it needs to be mapped, which
681 * returns a pointer in kernel virtual address space. Afterwards the chunk
682 * needs to be unmapped again. There is no limit on how often a given chunk
683 * can be mapped and unmapped, i.e. the importer does not need to call
684 * begin_cpu_access again before mapping the same chunk again.
685 *
686 * Interfaces::
687 * void \*dma_buf_kmap(struct dma_buf \*, unsigned long);
688 * void dma_buf_kunmap(struct dma_buf \*, unsigned long, void \*);
689 *
690 * There are also atomic variants of these interfaces. Like for kmap they
691 * facilitate non-blocking fast-paths. Neither the importer nor the exporter
692 * (in the callback) is allowed to block when using these.
693 *
694 * Interfaces::
695 * void \*dma_buf_kmap_atomic(struct dma_buf \*, unsigned long);
696 * void dma_buf_kunmap_atomic(struct dma_buf \*, unsigned long, void \*);
697 *
698 * For importers all the restrictions of using kmap apply, like the limited
699 * supply of kmap_atomic slots. Hence an importer shall only hold onto at
700 * max 2 atomic dma_buf kmaps at the same time (in any given process context).
701 *
702 * dma_buf kmap calls outside of the range specified in begin_cpu_access are
703 * undefined. If the range is not PAGE_SIZE aligned, kmap needs to succeed on
704 * the partial chunks at the beginning and end but may return stale or bogus
705 * data outside of the range (in these partial chunks).
706 *
707 * Note that these calls need to always succeed. The exporter needs to
708 * complete any preparations that might fail in begin_cpu_access.
709 *
710 * For some cases the overhead of kmap can be too high, a vmap interface
711 * is introduced. This interface should be used very carefully, as vmalloc
712 * space is a limited resources on many architectures.
713 *
714 * Interfaces::
715 * void \*dma_buf_vmap(struct dma_buf \*dmabuf)
716 * void dma_buf_vunmap(struct dma_buf \*dmabuf, void \*vaddr)
717 *
718 * The vmap call can fail if there is no vmap support in the exporter, or if
719 * it runs out of vmalloc space. Fallback to kmap should be implemented. Note
720 * that the dma-buf layer keeps a reference count for all vmap access and
721 * calls down into the exporter's vmap function only when no vmapping exists,
722 * and only unmaps it once. Protection against concurrent vmap/vunmap calls is
723 * provided by taking the dma_buf->lock mutex.
724 *
725 * - For full compatibility on the importer side with existing userspace
726 * interfaces, which might already support mmap'ing buffers. This is needed in
727 * many processing pipelines (e.g. feeding a software rendered image into a
728 * hardware pipeline, thumbnail creation, snapshots, ...). Also, Android's ION
729 * framework already supported this and for DMA buffer file descriptors to
730 * replace ION buffers mmap support was needed.
731 *
732 * There is no special interfaces, userspace simply calls mmap on the dma-buf
733 * fd. But like for CPU access there's a need to braket the actual access,
734 * which is handled by the ioctl (DMA_BUF_IOCTL_SYNC). Note that
735 * DMA_BUF_IOCTL_SYNC can fail with -EAGAIN or -EINTR, in which case it must
736 * be restarted.
737 *
738 * Some systems might need some sort of cache coherency management e.g. when
739 * CPU and GPU domains are being accessed through dma-buf at the same time.
740 * To circumvent this problem there are begin/end coherency markers, that
741 * forward directly to existing dma-buf device drivers vfunc hooks. Userspace
742 * can make use of those markers through the DMA_BUF_IOCTL_SYNC ioctl. The
743 * sequence would be used like following:
744 *
745 * - mmap dma-buf fd
746 * - for each drawing/upload cycle in CPU 1. SYNC_START ioctl, 2. read/write
747 * to mmap area 3. SYNC_END ioctl. This can be repeated as often as you
748 * want (with the new data being consumed by say the GPU or the scanout
749 * device)
750 * - munmap once you don't need the buffer any more
751 *
752 * For correctness and optimal performance, it is always required to use
753 * SYNC_START and SYNC_END before and after, respectively, when accessing the
754 * mapped address. Userspace cannot rely on coherent access, even when there
755 * are systems where it just works without calling these ioctls.
756 *
757 * - And as a CPU fallback in userspace processing pipelines.
758 *
759 * Similar to the motivation for kernel cpu access it is again important that
760 * the userspace code of a given importing subsystem can use the same
761 * interfaces with a imported dma-buf buffer object as with a native buffer
762 * object. This is especially important for drm where the userspace part of
763 * contemporary OpenGL, X, and other drivers is huge, and reworking them to
764 * use a different way to mmap a buffer rather invasive.
765 *
766 * The assumption in the current dma-buf interfaces is that redirecting the
767 * initial mmap is all that's needed. A survey of some of the existing
768 * subsystems shows that no driver seems to do any nefarious thing like
769 * syncing up with outstanding asynchronous processing on the device or
770 * allocating special resources at fault time. So hopefully this is good
771 * enough, since adding interfaces to intercept pagefaults and allow pte
772 * shootdowns would increase the complexity quite a bit.
773 *
774 * Interface::
775 * int dma_buf_mmap(struct dma_buf \*, struct vm_area_struct \*,
776 * unsigned long);
777 *
778 * If the importing subsystem simply provides a special-purpose mmap call to
779 * set up a mapping in userspace, calling do_mmap with dma_buf->file will
780 * equally achieve that for a dma-buf object.
781 */
782
Chris Wilsonae4e46b2016-08-15 16:42:18 +0100783static int __dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
784 enum dma_data_direction direction)
785{
786 bool write = (direction == DMA_BIDIRECTIONAL ||
787 direction == DMA_TO_DEVICE);
788 struct reservation_object *resv = dmabuf->resv;
789 long ret;
790
791 /* Wait on any implicit rendering fences */
792 ret = reservation_object_wait_timeout_rcu(resv, write, true,
793 MAX_SCHEDULE_TIMEOUT);
794 if (ret < 0)
795 return ret;
796
797 return 0;
798}
Daniel Vetterfc130202012-03-20 00:02:37 +0100799
800/**
801 * dma_buf_begin_cpu_access - Must be called before accessing a dma_buf from the
802 * cpu in the kernel context. Calls begin_cpu_access to allow exporter-specific
803 * preparations. Coherency is only guaranteed in the specified range for the
804 * specified access direction.
Randy Dunlapefb4df822012-04-17 17:03:30 -0700805 * @dmabuf: [in] buffer to prepare cpu access for.
Daniel Vetterfc130202012-03-20 00:02:37 +0100806 * @direction: [in] length of range for cpu access.
807 *
Daniel Vetter0959a162016-12-09 19:53:08 +0100808 * After the cpu access is complete the caller should call
809 * dma_buf_end_cpu_access(). Only when cpu access is braketed by both calls is
810 * it guaranteed to be coherent with other DMA access.
811 *
Daniel Vetterfc130202012-03-20 00:02:37 +0100812 * Can return negative error values, returns 0 on success.
813 */
Tiago Vignatti831e9da2015-12-22 19:36:45 -0200814int dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
Daniel Vetterfc130202012-03-20 00:02:37 +0100815 enum dma_data_direction direction)
816{
817 int ret = 0;
818
819 if (WARN_ON(!dmabuf))
820 return -EINVAL;
821
822 if (dmabuf->ops->begin_cpu_access)
Tiago Vignatti831e9da2015-12-22 19:36:45 -0200823 ret = dmabuf->ops->begin_cpu_access(dmabuf, direction);
Daniel Vetterfc130202012-03-20 00:02:37 +0100824
Chris Wilsonae4e46b2016-08-15 16:42:18 +0100825 /* Ensure that all fences are waited upon - but we first allow
826 * the native handler the chance to do so more efficiently if it
827 * chooses. A double invocation here will be reasonably cheap no-op.
828 */
829 if (ret == 0)
830 ret = __dma_buf_begin_cpu_access(dmabuf, direction);
831
Daniel Vetterfc130202012-03-20 00:02:37 +0100832 return ret;
833}
834EXPORT_SYMBOL_GPL(dma_buf_begin_cpu_access);
835
836/**
837 * dma_buf_end_cpu_access - Must be called after accessing a dma_buf from the
838 * cpu in the kernel context. Calls end_cpu_access to allow exporter-specific
839 * actions. Coherency is only guaranteed in the specified range for the
840 * specified access direction.
Randy Dunlapefb4df822012-04-17 17:03:30 -0700841 * @dmabuf: [in] buffer to complete cpu access for.
Daniel Vetterfc130202012-03-20 00:02:37 +0100842 * @direction: [in] length of range for cpu access.
843 *
Daniel Vetter0959a162016-12-09 19:53:08 +0100844 * This terminates CPU access started with dma_buf_begin_cpu_access().
845 *
Daniel Vetter87e332d2016-03-21 08:24:22 +0100846 * Can return negative error values, returns 0 on success.
Daniel Vetterfc130202012-03-20 00:02:37 +0100847 */
Chris Wilson18b862d2016-03-18 20:02:39 +0000848int dma_buf_end_cpu_access(struct dma_buf *dmabuf,
849 enum dma_data_direction direction)
Daniel Vetterfc130202012-03-20 00:02:37 +0100850{
Chris Wilson18b862d2016-03-18 20:02:39 +0000851 int ret = 0;
852
Daniel Vetterfc130202012-03-20 00:02:37 +0100853 WARN_ON(!dmabuf);
854
855 if (dmabuf->ops->end_cpu_access)
Chris Wilson18b862d2016-03-18 20:02:39 +0000856 ret = dmabuf->ops->end_cpu_access(dmabuf, direction);
857
858 return ret;
Daniel Vetterfc130202012-03-20 00:02:37 +0100859}
860EXPORT_SYMBOL_GPL(dma_buf_end_cpu_access);
861
862/**
863 * dma_buf_kmap_atomic - Map a page of the buffer object into kernel address
864 * space. The same restrictions as for kmap_atomic and friends apply.
Randy Dunlapefb4df822012-04-17 17:03:30 -0700865 * @dmabuf: [in] buffer to map page from.
Daniel Vetterfc130202012-03-20 00:02:37 +0100866 * @page_num: [in] page in PAGE_SIZE units to map.
867 *
868 * This call must always succeed, any necessary preparations that might fail
869 * need to be done in begin_cpu_access.
870 */
871void *dma_buf_kmap_atomic(struct dma_buf *dmabuf, unsigned long page_num)
872{
873 WARN_ON(!dmabuf);
874
875 return dmabuf->ops->kmap_atomic(dmabuf, page_num);
876}
877EXPORT_SYMBOL_GPL(dma_buf_kmap_atomic);
878
879/**
880 * dma_buf_kunmap_atomic - Unmap a page obtained by dma_buf_kmap_atomic.
Randy Dunlapefb4df822012-04-17 17:03:30 -0700881 * @dmabuf: [in] buffer to unmap page from.
Daniel Vetterfc130202012-03-20 00:02:37 +0100882 * @page_num: [in] page in PAGE_SIZE units to unmap.
883 * @vaddr: [in] kernel space pointer obtained from dma_buf_kmap_atomic.
884 *
885 * This call must always succeed.
886 */
887void dma_buf_kunmap_atomic(struct dma_buf *dmabuf, unsigned long page_num,
888 void *vaddr)
889{
890 WARN_ON(!dmabuf);
891
892 if (dmabuf->ops->kunmap_atomic)
893 dmabuf->ops->kunmap_atomic(dmabuf, page_num, vaddr);
894}
895EXPORT_SYMBOL_GPL(dma_buf_kunmap_atomic);
896
897/**
898 * dma_buf_kmap - Map a page of the buffer object into kernel address space. The
899 * same restrictions as for kmap and friends apply.
Randy Dunlapefb4df822012-04-17 17:03:30 -0700900 * @dmabuf: [in] buffer to map page from.
Daniel Vetterfc130202012-03-20 00:02:37 +0100901 * @page_num: [in] page in PAGE_SIZE units to map.
902 *
903 * This call must always succeed, any necessary preparations that might fail
904 * need to be done in begin_cpu_access.
905 */
906void *dma_buf_kmap(struct dma_buf *dmabuf, unsigned long page_num)
907{
908 WARN_ON(!dmabuf);
909
910 return dmabuf->ops->kmap(dmabuf, page_num);
911}
912EXPORT_SYMBOL_GPL(dma_buf_kmap);
913
914/**
915 * dma_buf_kunmap - Unmap a page obtained by dma_buf_kmap.
Randy Dunlapefb4df822012-04-17 17:03:30 -0700916 * @dmabuf: [in] buffer to unmap page from.
Daniel Vetterfc130202012-03-20 00:02:37 +0100917 * @page_num: [in] page in PAGE_SIZE units to unmap.
918 * @vaddr: [in] kernel space pointer obtained from dma_buf_kmap.
919 *
920 * This call must always succeed.
921 */
922void dma_buf_kunmap(struct dma_buf *dmabuf, unsigned long page_num,
923 void *vaddr)
924{
925 WARN_ON(!dmabuf);
926
927 if (dmabuf->ops->kunmap)
928 dmabuf->ops->kunmap(dmabuf, page_num, vaddr);
929}
930EXPORT_SYMBOL_GPL(dma_buf_kunmap);
Daniel Vetter4c785132012-04-24 14:38:52 +0530931
932
933/**
934 * dma_buf_mmap - Setup up a userspace mmap with the given vma
Sumit Semwal12c47272012-05-23 15:27:40 +0530935 * @dmabuf: [in] buffer that should back the vma
Daniel Vetter4c785132012-04-24 14:38:52 +0530936 * @vma: [in] vma for the mmap
937 * @pgoff: [in] offset in pages where this mmap should start within the
Jagan Teki51366292015-05-21 01:09:31 +0530938 * dma-buf buffer.
Daniel Vetter4c785132012-04-24 14:38:52 +0530939 *
940 * This function adjusts the passed in vma so that it points at the file of the
Javier Martinez Canillasecf1dba2014-04-10 01:30:05 +0200941 * dma_buf operation. It also adjusts the starting pgoff and does bounds
Daniel Vetter4c785132012-04-24 14:38:52 +0530942 * checking on the size of the vma. Then it calls the exporters mmap function to
943 * set up the mapping.
944 *
945 * Can return negative error values, returns 0 on success.
946 */
947int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
948 unsigned long pgoff)
949{
John Sheu495c10c2013-02-11 17:50:24 -0800950 struct file *oldfile;
951 int ret;
952
Daniel Vetter4c785132012-04-24 14:38:52 +0530953 if (WARN_ON(!dmabuf || !vma))
954 return -EINVAL;
955
956 /* check for offset overflow */
Muhammad Falak R Wanib02da6f2016-05-23 17:08:42 +0530957 if (pgoff + vma_pages(vma) < pgoff)
Daniel Vetter4c785132012-04-24 14:38:52 +0530958 return -EOVERFLOW;
959
960 /* check for overflowing the buffer's size */
Muhammad Falak R Wanib02da6f2016-05-23 17:08:42 +0530961 if (pgoff + vma_pages(vma) >
Daniel Vetter4c785132012-04-24 14:38:52 +0530962 dmabuf->size >> PAGE_SHIFT)
963 return -EINVAL;
964
965 /* readjust the vma */
John Sheu495c10c2013-02-11 17:50:24 -0800966 get_file(dmabuf->file);
967 oldfile = vma->vm_file;
968 vma->vm_file = dmabuf->file;
Daniel Vetter4c785132012-04-24 14:38:52 +0530969 vma->vm_pgoff = pgoff;
970
John Sheu495c10c2013-02-11 17:50:24 -0800971 ret = dmabuf->ops->mmap(dmabuf, vma);
972 if (ret) {
973 /* restore old parameters on failure */
974 vma->vm_file = oldfile;
975 fput(dmabuf->file);
976 } else {
977 if (oldfile)
978 fput(oldfile);
979 }
980 return ret;
981
Daniel Vetter4c785132012-04-24 14:38:52 +0530982}
983EXPORT_SYMBOL_GPL(dma_buf_mmap);
Dave Airlie98f86c92012-05-20 12:33:56 +0530984
985/**
Sumit Semwal12c47272012-05-23 15:27:40 +0530986 * dma_buf_vmap - Create virtual mapping for the buffer object into kernel
987 * address space. Same restrictions as for vmap and friends apply.
988 * @dmabuf: [in] buffer to vmap
Dave Airlie98f86c92012-05-20 12:33:56 +0530989 *
990 * This call may fail due to lack of virtual mapping address space.
991 * These calls are optional in drivers. The intended use for them
992 * is for mapping objects linear in kernel space for high use objects.
993 * Please attempt to use kmap/kunmap before thinking about these interfaces.
Colin Crossfee0c542013-12-20 16:43:50 -0800994 *
995 * Returns NULL on error.
Dave Airlie98f86c92012-05-20 12:33:56 +0530996 */
997void *dma_buf_vmap(struct dma_buf *dmabuf)
998{
Daniel Vetterf00b4da2012-12-20 14:14:23 +0100999 void *ptr;
1000
Dave Airlie98f86c92012-05-20 12:33:56 +05301001 if (WARN_ON(!dmabuf))
1002 return NULL;
1003
Daniel Vetterf00b4da2012-12-20 14:14:23 +01001004 if (!dmabuf->ops->vmap)
1005 return NULL;
1006
1007 mutex_lock(&dmabuf->lock);
1008 if (dmabuf->vmapping_counter) {
1009 dmabuf->vmapping_counter++;
1010 BUG_ON(!dmabuf->vmap_ptr);
1011 ptr = dmabuf->vmap_ptr;
1012 goto out_unlock;
1013 }
1014
1015 BUG_ON(dmabuf->vmap_ptr);
1016
1017 ptr = dmabuf->ops->vmap(dmabuf);
Colin Crossfee0c542013-12-20 16:43:50 -08001018 if (WARN_ON_ONCE(IS_ERR(ptr)))
1019 ptr = NULL;
1020 if (!ptr)
Daniel Vetterf00b4da2012-12-20 14:14:23 +01001021 goto out_unlock;
1022
1023 dmabuf->vmap_ptr = ptr;
1024 dmabuf->vmapping_counter = 1;
1025
1026out_unlock:
1027 mutex_unlock(&dmabuf->lock);
1028 return ptr;
Dave Airlie98f86c92012-05-20 12:33:56 +05301029}
1030EXPORT_SYMBOL_GPL(dma_buf_vmap);
1031
1032/**
1033 * dma_buf_vunmap - Unmap a vmap obtained by dma_buf_vmap.
Sumit Semwal12c47272012-05-23 15:27:40 +05301034 * @dmabuf: [in] buffer to vunmap
Randy Dunlap6e7b4a52012-06-09 15:02:59 -07001035 * @vaddr: [in] vmap to vunmap
Dave Airlie98f86c92012-05-20 12:33:56 +05301036 */
1037void dma_buf_vunmap(struct dma_buf *dmabuf, void *vaddr)
1038{
1039 if (WARN_ON(!dmabuf))
1040 return;
1041
Daniel Vetterf00b4da2012-12-20 14:14:23 +01001042 BUG_ON(!dmabuf->vmap_ptr);
1043 BUG_ON(dmabuf->vmapping_counter == 0);
1044 BUG_ON(dmabuf->vmap_ptr != vaddr);
1045
1046 mutex_lock(&dmabuf->lock);
1047 if (--dmabuf->vmapping_counter == 0) {
1048 if (dmabuf->ops->vunmap)
1049 dmabuf->ops->vunmap(dmabuf, vaddr);
1050 dmabuf->vmap_ptr = NULL;
1051 }
1052 mutex_unlock(&dmabuf->lock);
Dave Airlie98f86c92012-05-20 12:33:56 +05301053}
1054EXPORT_SYMBOL_GPL(dma_buf_vunmap);
Sumit Semwalb89e3562013-04-04 11:44:37 +05301055
1056#ifdef CONFIG_DEBUG_FS
Mathias Krauseeb0b9472016-06-19 14:31:29 +02001057static int dma_buf_debug_show(struct seq_file *s, void *unused)
Sumit Semwalb89e3562013-04-04 11:44:37 +05301058{
1059 int ret;
1060 struct dma_buf *buf_obj;
1061 struct dma_buf_attachment *attach_obj;
1062 int count = 0, attach_count;
1063 size_t size = 0;
1064
1065 ret = mutex_lock_interruptible(&db_list.lock);
1066
1067 if (ret)
1068 return ret;
1069
Sumit Semwalc0b00a52014-02-03 15:09:12 +05301070 seq_puts(s, "\nDma-buf Objects:\n");
1071 seq_puts(s, "size\tflags\tmode\tcount\texp_name\n");
Sumit Semwalb89e3562013-04-04 11:44:37 +05301072
1073 list_for_each_entry(buf_obj, &db_list.head, list_node) {
1074 ret = mutex_lock_interruptible(&buf_obj->lock);
1075
1076 if (ret) {
Sumit Semwalc0b00a52014-02-03 15:09:12 +05301077 seq_puts(s,
1078 "\tERROR locking buffer object: skipping\n");
Sumit Semwalb89e3562013-04-04 11:44:37 +05301079 continue;
1080 }
1081
Sumit Semwalc0b00a52014-02-03 15:09:12 +05301082 seq_printf(s, "%08zu\t%08x\t%08x\t%08ld\t%s\n",
1083 buf_obj->size,
Sumit Semwalb89e3562013-04-04 11:44:37 +05301084 buf_obj->file->f_flags, buf_obj->file->f_mode,
Al Viroa1f6dba2014-08-20 11:05:50 -04001085 file_count(buf_obj->file),
Sumit Semwalc0b00a52014-02-03 15:09:12 +05301086 buf_obj->exp_name);
Sumit Semwalb89e3562013-04-04 11:44:37 +05301087
Sumit Semwalc0b00a52014-02-03 15:09:12 +05301088 seq_puts(s, "\tAttached Devices:\n");
Sumit Semwalb89e3562013-04-04 11:44:37 +05301089 attach_count = 0;
1090
1091 list_for_each_entry(attach_obj, &buf_obj->attachments, node) {
Sumit Semwalc0b00a52014-02-03 15:09:12 +05301092 seq_puts(s, "\t");
Sumit Semwalb89e3562013-04-04 11:44:37 +05301093
Sumit Semwalc0b00a52014-02-03 15:09:12 +05301094 seq_printf(s, "%s\n", dev_name(attach_obj->dev));
Sumit Semwalb89e3562013-04-04 11:44:37 +05301095 attach_count++;
1096 }
1097
Sumit Semwalc0b00a52014-02-03 15:09:12 +05301098 seq_printf(s, "Total %d devices attached\n\n",
Sumit Semwalb89e3562013-04-04 11:44:37 +05301099 attach_count);
1100
1101 count++;
1102 size += buf_obj->size;
1103 mutex_unlock(&buf_obj->lock);
1104 }
1105
1106 seq_printf(s, "\nTotal %d objects, %zu bytes\n", count, size);
1107
1108 mutex_unlock(&db_list.lock);
1109 return 0;
1110}
1111
Sumit Semwalb89e3562013-04-04 11:44:37 +05301112static int dma_buf_debug_open(struct inode *inode, struct file *file)
1113{
Mathias Krauseeb0b9472016-06-19 14:31:29 +02001114 return single_open(file, dma_buf_debug_show, NULL);
Sumit Semwalb89e3562013-04-04 11:44:37 +05301115}
1116
1117static const struct file_operations dma_buf_debug_fops = {
1118 .open = dma_buf_debug_open,
1119 .read = seq_read,
1120 .llseek = seq_lseek,
1121 .release = single_release,
1122};
1123
1124static struct dentry *dma_buf_debugfs_dir;
1125
1126static int dma_buf_init_debugfs(void)
1127{
Mathias Krausebd3e2202016-06-19 14:31:31 +02001128 struct dentry *d;
Sumit Semwalb89e3562013-04-04 11:44:37 +05301129 int err = 0;
Jagan Teki51366292015-05-21 01:09:31 +05301130
Mathias Krausebd3e2202016-06-19 14:31:31 +02001131 d = debugfs_create_dir("dma_buf", NULL);
1132 if (IS_ERR(d))
1133 return PTR_ERR(d);
Jagan Teki51366292015-05-21 01:09:31 +05301134
Mathias Krausebd3e2202016-06-19 14:31:31 +02001135 dma_buf_debugfs_dir = d;
Sumit Semwalb89e3562013-04-04 11:44:37 +05301136
Mathias Krausebd3e2202016-06-19 14:31:31 +02001137 d = debugfs_create_file("bufinfo", S_IRUGO, dma_buf_debugfs_dir,
1138 NULL, &dma_buf_debug_fops);
1139 if (IS_ERR(d)) {
Sumit Semwalb89e3562013-04-04 11:44:37 +05301140 pr_debug("dma_buf: debugfs: failed to create node bufinfo\n");
Mathias Krauseb7479992016-06-19 14:31:30 +02001141 debugfs_remove_recursive(dma_buf_debugfs_dir);
1142 dma_buf_debugfs_dir = NULL;
Mathias Krausebd3e2202016-06-19 14:31:31 +02001143 err = PTR_ERR(d);
Mathias Krauseb7479992016-06-19 14:31:30 +02001144 }
Sumit Semwalb89e3562013-04-04 11:44:37 +05301145
1146 return err;
1147}
1148
1149static void dma_buf_uninit_debugfs(void)
1150{
1151 if (dma_buf_debugfs_dir)
1152 debugfs_remove_recursive(dma_buf_debugfs_dir);
1153}
Sumit Semwalb89e3562013-04-04 11:44:37 +05301154#else
1155static inline int dma_buf_init_debugfs(void)
1156{
1157 return 0;
1158}
1159static inline void dma_buf_uninit_debugfs(void)
1160{
1161}
1162#endif
1163
1164static int __init dma_buf_init(void)
1165{
1166 mutex_init(&db_list.lock);
1167 INIT_LIST_HEAD(&db_list.head);
1168 dma_buf_init_debugfs();
1169 return 0;
1170}
1171subsys_initcall(dma_buf_init);
1172
1173static void __exit dma_buf_deinit(void)
1174{
1175 dma_buf_uninit_debugfs();
1176}
1177__exitcall(dma_buf_deinit);