1// SPDX-License-Identifier: GPL-2.0
  2#include <linux/cred.h>
  3#include <linux/device.h>
  4#include <linux/dma-buf.h>
  5#include <linux/highmem.h>
  6#include <linux/init.h>
  7#include <linux/kernel.h>
  8#include <linux/memfd.h>
  9#include <linux/miscdevice.h>
 10#include <linux/module.h>
 11#include <linux/shmem_fs.h>
 12#include <linux/slab.h>
 13#include <linux/udmabuf.h>
 14
 15static const u32    list_limit = 1024;  /* udmabuf_create_list->count limit */
 16static const size_t size_limit_mb = 64; /* total dmabuf size, in megabytes  */
 17
 18struct udmabuf {
 19	pgoff_t pagecount;
 20	struct page **pages;
 21	struct sg_table *sg;
 22	struct miscdevice *device;
 23};
 24
 25static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf)
 26{
 27	struct vm_area_struct *vma = vmf->vma;
 28	struct udmabuf *ubuf = vma->vm_private_data;
 29
 30	vmf->page = ubuf->pages[vmf->pgoff];
 31	get_page(vmf->page);
 32	return 0;
 33}
 34
 35static const struct vm_operations_struct udmabuf_vm_ops = {
 36	.fault = udmabuf_vm_fault,
 37};
 38
 39static int mmap_udmabuf(struct dma_buf *buf, struct vm_area_struct *vma)
 40{
 41	struct udmabuf *ubuf = buf->priv;
 42
 43	if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) == 0)
 44		return -EINVAL;
 45
 46	vma->vm_ops = &udmabuf_vm_ops;
 47	vma->vm_private_data = ubuf;
 48	return 0;
 49}
 50
 51static struct sg_table *get_sg_table(struct device *dev, struct dma_buf *buf,
 52				     enum dma_data_direction direction)
 53{
 54	struct udmabuf *ubuf = buf->priv;
 55	struct sg_table *sg;
 56	int ret;
 57
 58	sg = kzalloc(sizeof(*sg), GFP_KERNEL);
 59	if (!sg)
 60		return ERR_PTR(-ENOMEM);
 61	ret = sg_alloc_table_from_pages(sg, ubuf->pages, ubuf->pagecount,
 62					0, ubuf->pagecount << PAGE_SHIFT,
 63					GFP_KERNEL);
 64	if (ret < 0)
 65		goto err;
 66	ret = dma_map_sgtable(dev, sg, direction, 0);
 67	if (ret < 0)
 68		goto err;
 69	return sg;
 70
 71err:
 72	sg_free_table(sg);
 73	kfree(sg);
 74	return ERR_PTR(ret);
 75}
 76
 77static void put_sg_table(struct device *dev, struct sg_table *sg,
 78			 enum dma_data_direction direction)
 79{
 80	dma_unmap_sgtable(dev, sg, direction, 0);
 81	sg_free_table(sg);
 82	kfree(sg);
 83}
 84
 85static struct sg_table *map_udmabuf(struct dma_buf_attachment *at,
 86				    enum dma_data_direction direction)
 87{
 88	return get_sg_table(at->dev, at->dmabuf, direction);
 89}
 90
 91static void unmap_udmabuf(struct dma_buf_attachment *at,
 92			  struct sg_table *sg,
 93			  enum dma_data_direction direction)
 94{
 95	return put_sg_table(at->dev, sg, direction);
 96}
 97
 98static void release_udmabuf(struct dma_buf *buf)
 99{
100	struct udmabuf *ubuf = buf->priv;
101	struct device *dev = ubuf->device->this_device;
102	pgoff_t pg;
103
104	if (ubuf->sg)
105		put_sg_table(dev, ubuf->sg, DMA_BIDIRECTIONAL);
106
107	for (pg = 0; pg < ubuf->pagecount; pg++)
108		put_page(ubuf->pages[pg]);
109	kfree(ubuf->pages);
110	kfree(ubuf);
111}
112
113static int begin_cpu_udmabuf(struct dma_buf *buf,
114			     enum dma_data_direction direction)
115{
116	struct udmabuf *ubuf = buf->priv;
117	struct device *dev = ubuf->device->this_device;
118
119	if (!ubuf->sg) {
120		ubuf->sg = get_sg_table(dev, buf, direction);
121		if (IS_ERR(ubuf->sg))
122			return PTR_ERR(ubuf->sg);
123	} else {
124		dma_sync_sg_for_cpu(dev, ubuf->sg->sgl, ubuf->sg->nents,
125				    direction);
126	}
127
128	return 0;
129}
130
131static int end_cpu_udmabuf(struct dma_buf *buf,
132			   enum dma_data_direction direction)
133{
134	struct udmabuf *ubuf = buf->priv;
135	struct device *dev = ubuf->device->this_device;
136
137	if (!ubuf->sg)
138		return -EINVAL;
139
140	dma_sync_sg_for_device(dev, ubuf->sg->sgl, ubuf->sg->nents, direction);
141	return 0;
142}
143
144static const struct dma_buf_ops udmabuf_ops = {
145	.cache_sgt_mapping = true,
146	.map_dma_buf	   = map_udmabuf,
147	.unmap_dma_buf	   = unmap_udmabuf,
148	.release	   = release_udmabuf,
149	.mmap		   = mmap_udmabuf,
150	.begin_cpu_access  = begin_cpu_udmabuf,
151	.end_cpu_access    = end_cpu_udmabuf,
152};
153
154#define SEALS_WANTED (F_SEAL_SHRINK)
155#define SEALS_DENIED (F_SEAL_WRITE)
156
157static long udmabuf_create(struct miscdevice *device,
158			   struct udmabuf_create_list *head,
159			   struct udmabuf_create_item *list)
160{
161	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
162	struct file *memfd = NULL;
163	struct udmabuf *ubuf;
164	struct dma_buf *buf;
165	pgoff_t pgoff, pgcnt, pgidx, pgbuf = 0, pglimit;
166	struct page *page;
167	int seals, ret = -EINVAL;
168	u32 i, flags;
169
170	ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL);
171	if (!ubuf)
172		return -ENOMEM;
173
174	pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
175	for (i = 0; i < head->count; i++) {
176		if (!IS_ALIGNED(list[i].offset, PAGE_SIZE))
177			goto err;
178		if (!IS_ALIGNED(list[i].size, PAGE_SIZE))
179			goto err;
180		ubuf->pagecount += list[i].size >> PAGE_SHIFT;
181		if (ubuf->pagecount > pglimit)
182			goto err;
183	}
184	ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
185				    GFP_KERNEL);
186	if (!ubuf->pages) {
187		ret = -ENOMEM;
188		goto err;
189	}
190
191	pgbuf = 0;
192	for (i = 0; i < head->count; i++) {
193		ret = -EBADFD;
194		memfd = fget(list[i].memfd);
195		if (!memfd)
196			goto err;
197		if (!shmem_mapping(file_inode(memfd)->i_mapping))
198			goto err;
199		seals = memfd_fcntl(memfd, F_GET_SEALS, 0);
200		if (seals == -EINVAL)
201			goto err;
202		ret = -EINVAL;
203		if ((seals & SEALS_WANTED) != SEALS_WANTED ||
204		    (seals & SEALS_DENIED) != 0)
205			goto err;
206		pgoff = list[i].offset >> PAGE_SHIFT;
207		pgcnt = list[i].size   >> PAGE_SHIFT;
208		for (pgidx = 0; pgidx < pgcnt; pgidx++) {
209			page = shmem_read_mapping_page(
210				file_inode(memfd)->i_mapping, pgoff + pgidx);
211			if (IS_ERR(page)) {
212				ret = PTR_ERR(page);
213				goto err;
214			}
215			ubuf->pages[pgbuf++] = page;
216		}
217		fput(memfd);
218		memfd = NULL;
219	}
220
221	exp_info.ops  = &udmabuf_ops;
222	exp_info.size = ubuf->pagecount << PAGE_SHIFT;
223	exp_info.priv = ubuf;
224	exp_info.flags = O_RDWR;
225
226	ubuf->device = device;
227	buf = dma_buf_export(&exp_info);
228	if (IS_ERR(buf)) {
229		ret = PTR_ERR(buf);
230		goto err;
231	}
232
233	flags = 0;
234	if (head->flags & UDMABUF_FLAGS_CLOEXEC)
235		flags |= O_CLOEXEC;
236	return dma_buf_fd(buf, flags);
237
238err:
239	while (pgbuf > 0)
240		put_page(ubuf->pages[--pgbuf]);
241	if (memfd)
242		fput(memfd);
243	kfree(ubuf->pages);
244	kfree(ubuf);
245	return ret;
246}
247
248static long udmabuf_ioctl_create(struct file *filp, unsigned long arg)
249{
250	struct udmabuf_create create;
251	struct udmabuf_create_list head;
252	struct udmabuf_create_item list;
253
254	if (copy_from_user(&create, (void __user *)arg,
255			   sizeof(create)))
256		return -EFAULT;
257
258	head.flags  = create.flags;
259	head.count  = 1;
260	list.memfd  = create.memfd;
261	list.offset = create.offset;
262	list.size   = create.size;
263
264	return udmabuf_create(filp->private_data, &head, &list);
265}
266
267static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg)
268{
269	struct udmabuf_create_list head;
270	struct udmabuf_create_item *list;
271	int ret = -EINVAL;
272	u32 lsize;
273
274	if (copy_from_user(&head, (void __user *)arg, sizeof(head)))
275		return -EFAULT;
276	if (head.count > list_limit)
277		return -EINVAL;
278	lsize = sizeof(struct udmabuf_create_item) * head.count;
279	list = memdup_user((void __user *)(arg + sizeof(head)), lsize);
280	if (IS_ERR(list))
281		return PTR_ERR(list);
282
283	ret = udmabuf_create(filp->private_data, &head, list);
284	kfree(list);
285	return ret;
286}
287
288static long udmabuf_ioctl(struct file *filp, unsigned int ioctl,
289			  unsigned long arg)
290{
291	long ret;
292
293	switch (ioctl) {
294	case UDMABUF_CREATE:
295		ret = udmabuf_ioctl_create(filp, arg);
296		break;
297	case UDMABUF_CREATE_LIST:
298		ret = udmabuf_ioctl_create_list(filp, arg);
299		break;
300	default:
301		ret = -ENOTTY;
302		break;
303	}
304	return ret;
305}
306
307static const struct file_operations udmabuf_fops = {
308	.owner		= THIS_MODULE,
309	.unlocked_ioctl = udmabuf_ioctl,
310#ifdef CONFIG_COMPAT
311	.compat_ioctl   = udmabuf_ioctl,
312#endif
313};
314
315static struct miscdevice udmabuf_misc = {
316	.minor          = MISC_DYNAMIC_MINOR,
317	.name           = "udmabuf",
318	.fops           = &udmabuf_fops,
319};
320
321static int __init udmabuf_dev_init(void)
322{
323	return misc_register(&udmabuf_misc);
324}
325
326static void __exit udmabuf_dev_exit(void)
327{
328	misc_deregister(&udmabuf_misc);
329}
330
331module_init(udmabuf_dev_init)
332module_exit(udmabuf_dev_exit)
333
334MODULE_AUTHOR("Gerd Hoffmann <kraxel@redhat.com>");
335MODULE_LICENSE("GPL v2");