1// SPDX-License-Identifier: GPL-2.0
2#include <linux/cred.h>
3#include <linux/device.h>
4#include <linux/dma-buf.h>
5#include <linux/highmem.h>
6#include <linux/init.h>
7#include <linux/kernel.h>
8#include <linux/memfd.h>
9#include <linux/miscdevice.h>
10#include <linux/module.h>
11#include <linux/shmem_fs.h>
12#include <linux/slab.h>
13#include <linux/udmabuf.h>
14
15static const u32    list_limit = 1024;  /* udmabuf_create_list->count limit */
16static const size_t size_limit_mb = 64; /* total dmabuf size, in megabytes  */
17
18struct udmabuf {
19	pgoff_t pagecount;
20	struct page **pages;
21	struct sg_table *sg;
22	struct miscdevice *device;
23};
24
25static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf)
26{
27	struct vm_area_struct *vma = vmf->vma;
28	struct udmabuf *ubuf = vma->vm_private_data;
29	pgoff_t pgoff = vmf->pgoff;
30
31	if (pgoff >= ubuf->pagecount)
32		return VM_FAULT_SIGBUS;
33	vmf->page = ubuf->pages[pgoff];
34	get_page(vmf->page);
35	return 0;
36}
37
38static const struct vm_operations_struct udmabuf_vm_ops = {
39	.fault = udmabuf_vm_fault,
40};
41
42static int mmap_udmabuf(struct dma_buf *buf, struct vm_area_struct *vma)
43{
44	struct udmabuf *ubuf = buf->priv;
45
46	if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) == 0)
47		return -EINVAL;
48
49	vma->vm_ops = &udmabuf_vm_ops;
50	vma->vm_private_data = ubuf;
51	return 0;
52}
53
54static struct sg_table *get_sg_table(struct device *dev, struct dma_buf *buf,
55				     enum dma_data_direction direction)
56{
57	struct udmabuf *ubuf = buf->priv;
58	struct sg_table *sg;
59	int ret;
60
61	sg = kzalloc(sizeof(*sg), GFP_KERNEL);
62	if (!sg)
63		return ERR_PTR(-ENOMEM);
64	ret = sg_alloc_table_from_pages(sg, ubuf->pages, ubuf->pagecount,
65					0, ubuf->pagecount << PAGE_SHIFT,
66					GFP_KERNEL);
67	if (ret < 0)
68		goto err;
69	ret = dma_map_sgtable(dev, sg, direction, 0);
70	if (ret < 0)
71		goto err;
72	return sg;
73
74err:
75	sg_free_table(sg);
76	kfree(sg);
77	return ERR_PTR(ret);
78}
79
80static void put_sg_table(struct device *dev, struct sg_table *sg,
81			 enum dma_data_direction direction)
82{
83	dma_unmap_sgtable(dev, sg, direction, 0);
84	sg_free_table(sg);
85	kfree(sg);
86}
87
88static struct sg_table *map_udmabuf(struct dma_buf_attachment *at,
89				    enum dma_data_direction direction)
90{
91	return get_sg_table(at->dev, at->dmabuf, direction);
92}
93
94static void unmap_udmabuf(struct dma_buf_attachment *at,
95			  struct sg_table *sg,
96			  enum dma_data_direction direction)
97{
98	return put_sg_table(at->dev, sg, direction);
99}
100
101static void release_udmabuf(struct dma_buf *buf)
102{
103	struct udmabuf *ubuf = buf->priv;
104	struct device *dev = ubuf->device->this_device;
105	pgoff_t pg;
106
107	if (ubuf->sg)
108		put_sg_table(dev, ubuf->sg, DMA_BIDIRECTIONAL);
109
110	for (pg = 0; pg < ubuf->pagecount; pg++)
111		put_page(ubuf->pages[pg]);
112	kfree(ubuf->pages);
113	kfree(ubuf);
114}
115
116static int begin_cpu_udmabuf(struct dma_buf *buf,
117			     enum dma_data_direction direction)
118{
119	struct udmabuf *ubuf = buf->priv;
120	struct device *dev = ubuf->device->this_device;
121	int ret = 0;
122
123	if (!ubuf->sg) {
124		ubuf->sg = get_sg_table(dev, buf, direction);
125		if (IS_ERR(ubuf->sg)) {
126			ret = PTR_ERR(ubuf->sg);
127			ubuf->sg = NULL;
128		}
129	} else {
130		dma_sync_sg_for_cpu(dev, ubuf->sg->sgl, ubuf->sg->nents,
131				    direction);
132	}
133
134	return ret;
135}
136
137static int end_cpu_udmabuf(struct dma_buf *buf,
138			   enum dma_data_direction direction)
139{
140	struct udmabuf *ubuf = buf->priv;
141	struct device *dev = ubuf->device->this_device;
142
143	if (!ubuf->sg)
144		return -EINVAL;
145
146	dma_sync_sg_for_device(dev, ubuf->sg->sgl, ubuf->sg->nents, direction);
147	return 0;
148}
149
150static const struct dma_buf_ops udmabuf_ops = {
151	.cache_sgt_mapping = true,
152	.map_dma_buf	   = map_udmabuf,
153	.unmap_dma_buf	   = unmap_udmabuf,
154	.release	   = release_udmabuf,
155	.mmap		   = mmap_udmabuf,
156	.begin_cpu_access  = begin_cpu_udmabuf,
157	.end_cpu_access    = end_cpu_udmabuf,
158};
159
160#define SEALS_WANTED (F_SEAL_SHRINK)
161#define SEALS_DENIED (F_SEAL_WRITE)
162
163static long udmabuf_create(struct miscdevice *device,
164			   struct udmabuf_create_list *head,
165			   struct udmabuf_create_item *list)
166{
167	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
168	struct file *memfd = NULL;
169	struct udmabuf *ubuf;
170	struct dma_buf *buf;
171	pgoff_t pgoff, pgcnt, pgidx, pgbuf = 0, pglimit;
172	struct page *page;
173	int seals, ret = -EINVAL;
174	u32 i, flags;
175
176	ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL);
177	if (!ubuf)
178		return -ENOMEM;
179
180	pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
181	for (i = 0; i < head->count; i++) {
182		if (!IS_ALIGNED(list[i].offset, PAGE_SIZE))
183			goto err;
184		if (!IS_ALIGNED(list[i].size, PAGE_SIZE))
185			goto err;
186		ubuf->pagecount += list[i].size >> PAGE_SHIFT;
187		if (ubuf->pagecount > pglimit)
188			goto err;
189	}
190
191	if (!ubuf->pagecount)
192		goto err;
193
194	ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
195				    GFP_KERNEL);
196	if (!ubuf->pages) {
197		ret = -ENOMEM;
198		goto err;
199	}
200
201	pgbuf = 0;
202	for (i = 0; i < head->count; i++) {
203		ret = -EBADFD;
204		memfd = fget(list[i].memfd);
205		if (!memfd)
206			goto err;
207		if (!shmem_mapping(file_inode(memfd)->i_mapping))
208			goto err;
209		seals = memfd_fcntl(memfd, F_GET_SEALS, 0);
210		if (seals == -EINVAL)
211			goto err;
212		ret = -EINVAL;
213		if ((seals & SEALS_WANTED) != SEALS_WANTED ||
214		    (seals & SEALS_DENIED) != 0)
215			goto err;
216		pgoff = list[i].offset >> PAGE_SHIFT;
217		pgcnt = list[i].size   >> PAGE_SHIFT;
218		for (pgidx = 0; pgidx < pgcnt; pgidx++) {
219			page = shmem_read_mapping_page(
220				file_inode(memfd)->i_mapping, pgoff + pgidx);
221			if (IS_ERR(page)) {
222				ret = PTR_ERR(page);
223				goto err;
224			}
225			ubuf->pages[pgbuf++] = page;
226		}
227		fput(memfd);
228		memfd = NULL;
229	}
230
231	exp_info.ops  = &udmabuf_ops;
232	exp_info.size = ubuf->pagecount << PAGE_SHIFT;
233	exp_info.priv = ubuf;
234	exp_info.flags = O_RDWR;
235
236	ubuf->device = device;
237	buf = dma_buf_export(&exp_info);
238	if (IS_ERR(buf)) {
239		ret = PTR_ERR(buf);
240		goto err;
241	}
242
243	flags = 0;
244	if (head->flags & UDMABUF_FLAGS_CLOEXEC)
245		flags |= O_CLOEXEC;
246	return dma_buf_fd(buf, flags);
247
248err:
249	while (pgbuf > 0)
250		put_page(ubuf->pages[--pgbuf]);
251	if (memfd)
252		fput(memfd);
253	kfree(ubuf->pages);
254	kfree(ubuf);
255	return ret;
256}
257
258static long udmabuf_ioctl_create(struct file *filp, unsigned long arg)
259{
260	struct udmabuf_create create;
261	struct udmabuf_create_list head;
262	struct udmabuf_create_item list;
263
264	if (copy_from_user(&create, (void __user *)arg,
265			   sizeof(create)))
266		return -EFAULT;
267
268	head.flags  = create.flags;
269	head.count  = 1;
270	list.memfd  = create.memfd;
271	list.offset = create.offset;
272	list.size   = create.size;
273
274	return udmabuf_create(filp->private_data, &head, &list);
275}
276
277static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg)
278{
279	struct udmabuf_create_list head;
280	struct udmabuf_create_item *list;
281	int ret = -EINVAL;
282	u32 lsize;
283
284	if (copy_from_user(&head, (void __user *)arg, sizeof(head)))
285		return -EFAULT;
286	if (head.count > list_limit)
287		return -EINVAL;
288	lsize = sizeof(struct udmabuf_create_item) * head.count;
289	list = memdup_user((void __user *)(arg + sizeof(head)), lsize);
290	if (IS_ERR(list))
291		return PTR_ERR(list);
292
293	ret = udmabuf_create(filp->private_data, &head, list);
294	kfree(list);
295	return ret;
296}
297
298static long udmabuf_ioctl(struct file *filp, unsigned int ioctl,
299			  unsigned long arg)
300{
301	long ret;
302
303	switch (ioctl) {
304	case UDMABUF_CREATE:
305		ret = udmabuf_ioctl_create(filp, arg);
306		break;
307	case UDMABUF_CREATE_LIST:
308		ret = udmabuf_ioctl_create_list(filp, arg);
309		break;
310	default:
311		ret = -ENOTTY;
312		break;
313	}
314	return ret;
315}
316
317static const struct file_operations udmabuf_fops = {
318	.owner		= THIS_MODULE,
319	.unlocked_ioctl = udmabuf_ioctl,
320#ifdef CONFIG_COMPAT
321	.compat_ioctl   = udmabuf_ioctl,
322#endif
323};
324
325static struct miscdevice udmabuf_misc = {
326	.minor          = MISC_DYNAMIC_MINOR,
327	.name           = "udmabuf",
328	.fops           = &udmabuf_fops,
329};
330
331static int __init udmabuf_dev_init(void)
332{
333	int ret;
334
335	ret = misc_register(&udmabuf_misc);
336	if (ret < 0) {
337		pr_err("Could not initialize udmabuf device\n");
338		return ret;
339	}
340
341	ret = dma_coerce_mask_and_coherent(udmabuf_misc.this_device,
342					   DMA_BIT_MASK(64));
343	if (ret < 0) {
344		pr_err("Could not setup DMA mask for udmabuf device\n");
345		misc_deregister(&udmabuf_misc);
346		return ret;
347	}
348
349	return 0;
350}
351
352static void __exit udmabuf_dev_exit(void)
353{
354	misc_deregister(&udmabuf_misc);
355}
356
357module_init(udmabuf_dev_init)
358module_exit(udmabuf_dev_exit)
359
360MODULE_AUTHOR("Gerd Hoffmann <kraxel@redhat.com>");
361MODULE_LICENSE("GPL v2");
362