1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * helper functions for SG DMA video4linux capture buffers
4 *
5 * The functions expect the hardware being able to scatter gather
6 * (i.e. the buffers are not linear in physical memory, but fragmented
7 * into PAGE_SIZE chunks).  They also assume the driver does not need
8 * to touch the video data.
9 *
10 * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
11 *
12 * Highly based on video-buf written originally by:
13 * (c) 2001,02 Gerd Knorr <kraxel@bytesex.org>
14 * (c) 2006 Mauro Carvalho Chehab, <mchehab@kernel.org>
15 * (c) 2006 Ted Walther and John Sokol
16 */
17
18#include <linux/init.h>
19#include <linux/module.h>
20#include <linux/moduleparam.h>
21#include <linux/sched/mm.h>
22#include <linux/slab.h>
23#include <linux/interrupt.h>
24#include <linux/pgtable.h>
25
26#include <linux/dma-mapping.h>
27#include <linux/vmalloc.h>
28#include <linux/pagemap.h>
29#include <linux/scatterlist.h>
30#include <asm/page.h>
31
32#include <media/videobuf-dma-sg.h>
33
34#define MAGIC_DMABUF 0x19721112
35#define MAGIC_SG_MEM 0x17890714
36
37#define MAGIC_CHECK(is, should)						\
38	if (unlikely((is) != (should))) {				\
39		printk(KERN_ERR "magic mismatch: %x (expected %x)\n",	\
40				is, should);				\
41		BUG();							\
42	}
43
44static int debug;
45module_param(debug, int, 0644);
46
47MODULE_DESCRIPTION("helper module to manage video4linux dma sg buffers");
48MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
49MODULE_LICENSE("GPL");
50
51#define dprintk(level, fmt, arg...)					\
52	if (debug >= level)						\
53		printk(KERN_DEBUG "vbuf-sg: " fmt , ## arg)
54
55/* --------------------------------------------------------------------- */
56
57/*
58 * Return a scatterlist for some page-aligned vmalloc()'ed memory
59 * block (NULL on errors).  Memory for the scatterlist is allocated
60 * using kmalloc.  The caller must free the memory.
61 */
62static struct scatterlist *videobuf_vmalloc_to_sg(unsigned char *virt,
63						  int nr_pages)
64{
65	struct scatterlist *sglist;
66	struct page *pg;
67	int i;
68
69	sglist = vzalloc(array_size(nr_pages, sizeof(*sglist)));
70	if (NULL == sglist)
71		return NULL;
72	sg_init_table(sglist, nr_pages);
73	for (i = 0; i < nr_pages; i++, virt += PAGE_SIZE) {
74		pg = vmalloc_to_page(virt);
75		if (NULL == pg)
76			goto err;
77		BUG_ON(PageHighMem(pg));
78		sg_set_page(&sglist[i], pg, PAGE_SIZE, 0);
79	}
80	return sglist;
81
82err:
83	vfree(sglist);
84	return NULL;
85}
86
87/*
88 * Return a scatterlist for a an array of userpages (NULL on errors).
89 * Memory for the scatterlist is allocated using kmalloc.  The caller
90 * must free the memory.
91 */
92static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
93					int nr_pages, int offset, size_t size)
94{
95	struct scatterlist *sglist;
96	int i;
97
98	if (NULL == pages[0])
99		return NULL;
100	sglist = vmalloc(array_size(nr_pages, sizeof(*sglist)));
101	if (NULL == sglist)
102		return NULL;
103	sg_init_table(sglist, nr_pages);
104
105	if (PageHighMem(pages[0]))
106		/* DMA to highmem pages might not work */
107		goto highmem;
108	sg_set_page(&sglist[0], pages[0],
109			min_t(size_t, PAGE_SIZE - offset, size), offset);
110	size -= min_t(size_t, PAGE_SIZE - offset, size);
111	for (i = 1; i < nr_pages; i++) {
112		if (NULL == pages[i])
113			goto nopage;
114		if (PageHighMem(pages[i]))
115			goto highmem;
116		sg_set_page(&sglist[i], pages[i], min_t(size_t, PAGE_SIZE, size), 0);
117		size -= min_t(size_t, PAGE_SIZE, size);
118	}
119	return sglist;
120
121nopage:
122	dprintk(2, "sgl: oops - no page\n");
123	vfree(sglist);
124	return NULL;
125
126highmem:
127	dprintk(2, "sgl: oops - highmem page\n");
128	vfree(sglist);
129	return NULL;
130}
131
132/* --------------------------------------------------------------------- */
133
134struct videobuf_dmabuf *videobuf_to_dma(struct videobuf_buffer *buf)
135{
136	struct videobuf_dma_sg_memory *mem = buf->priv;
137	BUG_ON(!mem);
138
139	MAGIC_CHECK(mem->magic, MAGIC_SG_MEM);
140
141	return &mem->dma;
142}
143EXPORT_SYMBOL_GPL(videobuf_to_dma);
144
145static void videobuf_dma_init(struct videobuf_dmabuf *dma)
146{
147	memset(dma, 0, sizeof(*dma));
148	dma->magic = MAGIC_DMABUF;
149}
150
151static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
152			int direction, unsigned long data, unsigned long size)
153{
154	unsigned int gup_flags = FOLL_LONGTERM;
155	unsigned long first, last;
156	int err;
157
158	dma->direction = direction;
159	switch (dma->direction) {
160	case DMA_FROM_DEVICE:
161		gup_flags |= FOLL_WRITE;
162		break;
163	case DMA_TO_DEVICE:
164		break;
165	default:
166		BUG();
167	}
168
169	first = (data          & PAGE_MASK) >> PAGE_SHIFT;
170	last  = ((data+size-1) & PAGE_MASK) >> PAGE_SHIFT;
171	dma->offset = data & ~PAGE_MASK;
172	dma->size = size;
173	dma->nr_pages = last-first+1;
174	dma->pages = kmalloc_array(dma->nr_pages, sizeof(struct page *),
175				   GFP_KERNEL);
176	if (NULL == dma->pages)
177		return -ENOMEM;
178
179	dprintk(1, "init user [0x%lx+0x%lx => %lu pages]\n",
180		data, size, dma->nr_pages);
181
182	err = pin_user_pages(data & PAGE_MASK, dma->nr_pages, gup_flags,
183			     dma->pages);
184
185	if (err != dma->nr_pages) {
186		dma->nr_pages = (err >= 0) ? err : 0;
187		dprintk(1, "pin_user_pages: err=%d [%lu]\n", err,
188			dma->nr_pages);
189		return err < 0 ? err : -EINVAL;
190	}
191	return 0;
192}
193
194static int videobuf_dma_init_user(struct videobuf_dmabuf *dma, int direction,
195			   unsigned long data, unsigned long size)
196{
197	int ret;
198
199	mmap_read_lock(current->mm);
200	ret = videobuf_dma_init_user_locked(dma, direction, data, size);
201	mmap_read_unlock(current->mm);
202
203	return ret;
204}
205
206static int videobuf_dma_init_kernel(struct videobuf_dmabuf *dma, int direction,
207				    unsigned long nr_pages)
208{
209	int i;
210
211	dprintk(1, "init kernel [%lu pages]\n", nr_pages);
212
213	dma->direction = direction;
214	dma->vaddr_pages = kcalloc(nr_pages, sizeof(*dma->vaddr_pages),
215				   GFP_KERNEL);
216	if (!dma->vaddr_pages)
217		return -ENOMEM;
218
219	dma->dma_addr = kcalloc(nr_pages, sizeof(*dma->dma_addr), GFP_KERNEL);
220	if (!dma->dma_addr) {
221		kfree(dma->vaddr_pages);
222		return -ENOMEM;
223	}
224	for (i = 0; i < nr_pages; i++) {
225		void *addr;
226
227		addr = dma_alloc_coherent(dma->dev, PAGE_SIZE,
228					  &(dma->dma_addr[i]), GFP_KERNEL);
229		if (addr == NULL)
230			goto out_free_pages;
231
232		dma->vaddr_pages[i] = virt_to_page(addr);
233	}
234	dma->vaddr = vmap(dma->vaddr_pages, nr_pages, VM_MAP | VM_IOREMAP,
235			  PAGE_KERNEL);
236	if (NULL == dma->vaddr) {
237		dprintk(1, "vmalloc_32(%lu pages) failed\n", nr_pages);
238		goto out_free_pages;
239	}
240
241	dprintk(1, "vmalloc is at addr %p, size=%lu\n",
242		dma->vaddr, nr_pages << PAGE_SHIFT);
243
244	memset(dma->vaddr, 0, nr_pages << PAGE_SHIFT);
245	dma->nr_pages = nr_pages;
246
247	return 0;
248out_free_pages:
249	while (i > 0) {
250		void *addr;
251
252		i--;
253		addr = page_address(dma->vaddr_pages[i]);
254		dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]);
255	}
256	kfree(dma->dma_addr);
257	dma->dma_addr = NULL;
258	kfree(dma->vaddr_pages);
259	dma->vaddr_pages = NULL;
260
261	return -ENOMEM;
262
263}
264
265static int videobuf_dma_init_overlay(struct videobuf_dmabuf *dma, int direction,
266			      dma_addr_t addr, unsigned long nr_pages)
267{
268	dprintk(1, "init overlay [%lu pages @ bus 0x%lx]\n",
269		nr_pages, (unsigned long)addr);
270	dma->direction = direction;
271
272	if (0 == addr)
273		return -EINVAL;
274
275	dma->bus_addr = addr;
276	dma->nr_pages = nr_pages;
277
278	return 0;
279}
280
281static int videobuf_dma_map(struct device *dev, struct videobuf_dmabuf *dma)
282{
283	MAGIC_CHECK(dma->magic, MAGIC_DMABUF);
284	BUG_ON(0 == dma->nr_pages);
285
286	if (dma->pages) {
287		dma->sglist = videobuf_pages_to_sg(dma->pages, dma->nr_pages,
288						   dma->offset, dma->size);
289	}
290	if (dma->vaddr) {
291		dma->sglist = videobuf_vmalloc_to_sg(dma->vaddr,
292						     dma->nr_pages);
293	}
294	if (dma->bus_addr) {
295		dma->sglist = vmalloc(sizeof(*dma->sglist));
296		if (NULL != dma->sglist) {
297			dma->sglen = 1;
298			sg_dma_address(&dma->sglist[0])	= dma->bus_addr
299							& PAGE_MASK;
300			dma->sglist[0].offset = dma->bus_addr & ~PAGE_MASK;
301			sg_dma_len(&dma->sglist[0]) = dma->nr_pages * PAGE_SIZE;
302		}
303	}
304	if (NULL == dma->sglist) {
305		dprintk(1, "scatterlist is NULL\n");
306		return -ENOMEM;
307	}
308	if (!dma->bus_addr) {
309		dma->sglen = dma_map_sg(dev, dma->sglist,
310					dma->nr_pages, dma->direction);
311		if (0 == dma->sglen) {
312			printk(KERN_WARNING
313			       "%s: videobuf_map_sg failed\n", __func__);
314			vfree(dma->sglist);
315			dma->sglist = NULL;
316			dma->sglen = 0;
317			return -ENOMEM;
318		}
319	}
320
321	return 0;
322}
323
324int videobuf_dma_unmap(struct device *dev, struct videobuf_dmabuf *dma)
325{
326	MAGIC_CHECK(dma->magic, MAGIC_DMABUF);
327
328	if (!dma->sglen)
329		return 0;
330
331	dma_unmap_sg(dev, dma->sglist, dma->nr_pages, dma->direction);
332
333	vfree(dma->sglist);
334	dma->sglist = NULL;
335	dma->sglen = 0;
336
337	return 0;
338}
339EXPORT_SYMBOL_GPL(videobuf_dma_unmap);
340
341int videobuf_dma_free(struct videobuf_dmabuf *dma)
342{
343	int i;
344	MAGIC_CHECK(dma->magic, MAGIC_DMABUF);
345	BUG_ON(dma->sglen);
346
347	if (dma->pages) {
348		unpin_user_pages_dirty_lock(dma->pages, dma->nr_pages,
349					    dma->direction == DMA_FROM_DEVICE);
350		kfree(dma->pages);
351		dma->pages = NULL;
352	}
353
354	if (dma->dma_addr) {
355		for (i = 0; i < dma->nr_pages; i++) {
356			void *addr;
357
358			addr = page_address(dma->vaddr_pages[i]);
359			dma_free_coherent(dma->dev, PAGE_SIZE, addr,
360					  dma->dma_addr[i]);
361		}
362		kfree(dma->dma_addr);
363		dma->dma_addr = NULL;
364		kfree(dma->vaddr_pages);
365		dma->vaddr_pages = NULL;
366		vunmap(dma->vaddr);
367		dma->vaddr = NULL;
368	}
369
370	if (dma->bus_addr)
371		dma->bus_addr = 0;
372	dma->direction = DMA_NONE;
373
374	return 0;
375}
376EXPORT_SYMBOL_GPL(videobuf_dma_free);
377
378/* --------------------------------------------------------------------- */
379
380static void videobuf_vm_open(struct vm_area_struct *vma)
381{
382	struct videobuf_mapping *map = vma->vm_private_data;
383
384	dprintk(2, "vm_open %p [count=%d,vma=%08lx-%08lx]\n", map,
385		map->count, vma->vm_start, vma->vm_end);
386
387	map->count++;
388}
389
390static void videobuf_vm_close(struct vm_area_struct *vma)
391{
392	struct videobuf_mapping *map = vma->vm_private_data;
393	struct videobuf_queue *q = map->q;
394	struct videobuf_dma_sg_memory *mem;
395	int i;
396
397	dprintk(2, "vm_close %p [count=%d,vma=%08lx-%08lx]\n", map,
398		map->count, vma->vm_start, vma->vm_end);
399
400	map->count--;
401	if (0 == map->count) {
402		dprintk(1, "munmap %p q=%p\n", map, q);
403		videobuf_queue_lock(q);
404		for (i = 0; i < VIDEO_MAX_FRAME; i++) {
405			if (NULL == q->bufs[i])
406				continue;
407			mem = q->bufs[i]->priv;
408			if (!mem)
409				continue;
410
411			MAGIC_CHECK(mem->magic, MAGIC_SG_MEM);
412
413			if (q->bufs[i]->map != map)
414				continue;
415			q->bufs[i]->map   = NULL;
416			q->bufs[i]->baddr = 0;
417			q->ops->buf_release(q, q->bufs[i]);
418		}
419		videobuf_queue_unlock(q);
420		kfree(map);
421	}
422}
423
424/*
425 * Get a anonymous page for the mapping.  Make sure we can DMA to that
426 * memory location with 32bit PCI devices (i.e. don't use highmem for
427 * now ...).  Bounce buffers don't work very well for the data rates
428 * video capture has.
429 */
430static vm_fault_t videobuf_vm_fault(struct vm_fault *vmf)
431{
432	struct vm_area_struct *vma = vmf->vma;
433	struct page *page;
434
435	dprintk(3, "fault: fault @ %08lx [vma %08lx-%08lx]\n",
436		vmf->address, vma->vm_start, vma->vm_end);
437
438	page = alloc_page(GFP_USER | __GFP_DMA32);
439	if (!page)
440		return VM_FAULT_OOM;
441	clear_user_highpage(page, vmf->address);
442	vmf->page = page;
443
444	return 0;
445}
446
447static const struct vm_operations_struct videobuf_vm_ops = {
448	.open	= videobuf_vm_open,
449	.close	= videobuf_vm_close,
450	.fault	= videobuf_vm_fault,
451};
452
453/* ---------------------------------------------------------------------
454 * SG handlers for the generic methods
455 */
456
457/* Allocated area consists on 3 parts:
458	struct video_buffer
459	struct <driver>_buffer (cx88_buffer, saa7134_buf, ...)
460	struct videobuf_dma_sg_memory
461 */
462
463static struct videobuf_buffer *__videobuf_alloc_vb(size_t size)
464{
465	struct videobuf_dma_sg_memory *mem;
466	struct videobuf_buffer *vb;
467
468	vb = kzalloc(size + sizeof(*mem), GFP_KERNEL);
469	if (!vb)
470		return vb;
471
472	mem = vb->priv = ((char *)vb) + size;
473	mem->magic = MAGIC_SG_MEM;
474
475	videobuf_dma_init(&mem->dma);
476
477	dprintk(1, "%s: allocated at %p(%ld+%ld) & %p(%ld)\n",
478		__func__, vb, (long)sizeof(*vb), (long)size - sizeof(*vb),
479		mem, (long)sizeof(*mem));
480
481	return vb;
482}
483
484static void *__videobuf_to_vaddr(struct videobuf_buffer *buf)
485{
486	struct videobuf_dma_sg_memory *mem = buf->priv;
487	BUG_ON(!mem);
488
489	MAGIC_CHECK(mem->magic, MAGIC_SG_MEM);
490
491	return mem->dma.vaddr;
492}
493
494static int __videobuf_iolock(struct videobuf_queue *q,
495			     struct videobuf_buffer *vb,
496			     struct v4l2_framebuffer *fbuf)
497{
498	struct videobuf_dma_sg_memory *mem = vb->priv;
499	unsigned long pages;
500	dma_addr_t bus;
501	int err;
502
503	BUG_ON(!mem);
504
505	MAGIC_CHECK(mem->magic, MAGIC_SG_MEM);
506
507	if (!mem->dma.dev)
508		mem->dma.dev = q->dev;
509	else
510		WARN_ON(mem->dma.dev != q->dev);
511
512	switch (vb->memory) {
513	case V4L2_MEMORY_MMAP:
514	case V4L2_MEMORY_USERPTR:
515		if (0 == vb->baddr) {
516			/* no userspace addr -- kernel bounce buffer */
517			pages = PAGE_ALIGN(vb->size) >> PAGE_SHIFT;
518			err = videobuf_dma_init_kernel(&mem->dma,
519						       DMA_FROM_DEVICE,
520						       pages);
521			if (0 != err)
522				return err;
523		} else if (vb->memory == V4L2_MEMORY_USERPTR) {
524			/* dma directly to userspace */
525			err = videobuf_dma_init_user(&mem->dma,
526						     DMA_FROM_DEVICE,
527						     vb->baddr, vb->bsize);
528			if (0 != err)
529				return err;
530		} else {
531			/* NOTE: HACK: videobuf_iolock on V4L2_MEMORY_MMAP
532			buffers can only be called from videobuf_qbuf
533			we take current->mm->mmap_lock there, to prevent
534			locking inversion, so don't take it here */
535
536			err = videobuf_dma_init_user_locked(&mem->dma,
537						      DMA_FROM_DEVICE,
538						      vb->baddr, vb->bsize);
539			if (0 != err)
540				return err;
541		}
542		break;
543	case V4L2_MEMORY_OVERLAY:
544		if (NULL == fbuf)
545			return -EINVAL;
546		/* FIXME: need sanity checks for vb->boff */
547		/*
548		 * Using a double cast to avoid compiler warnings when
549		 * building for PAE. Compiler doesn't like direct casting
550		 * of a 32 bit ptr to 64 bit integer.
551		 */
552		bus   = (dma_addr_t)(unsigned long)fbuf->base + vb->boff;
553		pages = PAGE_ALIGN(vb->size) >> PAGE_SHIFT;
554		err = videobuf_dma_init_overlay(&mem->dma, DMA_FROM_DEVICE,
555						bus, pages);
556		if (0 != err)
557			return err;
558		break;
559	default:
560		BUG();
561	}
562	err = videobuf_dma_map(q->dev, &mem->dma);
563	if (0 != err)
564		return err;
565
566	return 0;
567}
568
569static int __videobuf_sync(struct videobuf_queue *q,
570			   struct videobuf_buffer *buf)
571{
572	struct videobuf_dma_sg_memory *mem = buf->priv;
573	BUG_ON(!mem || !mem->dma.sglen);
574
575	MAGIC_CHECK(mem->magic, MAGIC_SG_MEM);
576	MAGIC_CHECK(mem->dma.magic, MAGIC_DMABUF);
577
578	dma_sync_sg_for_cpu(q->dev, mem->dma.sglist,
579			    mem->dma.nr_pages, mem->dma.direction);
580
581	return 0;
582}
583
584static int __videobuf_mmap_mapper(struct videobuf_queue *q,
585				  struct videobuf_buffer *buf,
586				  struct vm_area_struct *vma)
587{
588	struct videobuf_dma_sg_memory *mem = buf->priv;
589	struct videobuf_mapping *map;
590	unsigned int first, last, size = 0, i;
591	int retval;
592
593	retval = -EINVAL;
594
595	BUG_ON(!mem);
596	MAGIC_CHECK(mem->magic, MAGIC_SG_MEM);
597
598	/* look for first buffer to map */
599	for (first = 0; first < VIDEO_MAX_FRAME; first++) {
600		if (buf == q->bufs[first]) {
601			size = PAGE_ALIGN(q->bufs[first]->bsize);
602			break;
603		}
604	}
605
606	/* paranoia, should never happen since buf is always valid. */
607	if (!size) {
608		dprintk(1, "mmap app bug: offset invalid [offset=0x%lx]\n",
609				(vma->vm_pgoff << PAGE_SHIFT));
610		goto done;
611	}
612
613	last = first;
614
615	/* create mapping + update buffer list */
616	retval = -ENOMEM;
617	map = kmalloc(sizeof(struct videobuf_mapping), GFP_KERNEL);
618	if (NULL == map)
619		goto done;
620
621	size = 0;
622	for (i = first; i <= last; i++) {
623		if (NULL == q->bufs[i])
624			continue;
625		q->bufs[i]->map   = map;
626		q->bufs[i]->baddr = vma->vm_start + size;
627		size += PAGE_ALIGN(q->bufs[i]->bsize);
628	}
629
630	map->count    = 1;
631	map->q        = q;
632	vma->vm_ops   = &videobuf_vm_ops;
633	/* using shared anonymous pages */
634	vm_flags_mod(vma, VM_DONTEXPAND | VM_DONTDUMP, VM_IO);
635	vma->vm_private_data = map;
636	dprintk(1, "mmap %p: q=%p %08lx-%08lx pgoff %08lx bufs %d-%d\n",
637		map, q, vma->vm_start, vma->vm_end, vma->vm_pgoff, first, last);
638	retval = 0;
639
640done:
641	return retval;
642}
643
644static struct videobuf_qtype_ops sg_ops = {
645	.magic        = MAGIC_QTYPE_OPS,
646
647	.alloc_vb     = __videobuf_alloc_vb,
648	.iolock       = __videobuf_iolock,
649	.sync         = __videobuf_sync,
650	.mmap_mapper  = __videobuf_mmap_mapper,
651	.vaddr        = __videobuf_to_vaddr,
652};
653
654void *videobuf_sg_alloc(size_t size)
655{
656	struct videobuf_queue q;
657
658	/* Required to make generic handler to call __videobuf_alloc */
659	q.int_ops = &sg_ops;
660
661	q.msize = size;
662
663	return videobuf_alloc_vb(&q);
664}
665EXPORT_SYMBOL_GPL(videobuf_sg_alloc);
666
667void videobuf_queue_sg_init(struct videobuf_queue *q,
668			 const struct videobuf_queue_ops *ops,
669			 struct device *dev,
670			 spinlock_t *irqlock,
671			 enum v4l2_buf_type type,
672			 enum v4l2_field field,
673			 unsigned int msize,
674			 void *priv,
675			 struct mutex *ext_lock)
676{
677	videobuf_queue_core_init(q, ops, dev, irqlock, type, field, msize,
678				 priv, &sg_ops, ext_lock);
679}
680EXPORT_SYMBOL_GPL(videobuf_queue_sg_init);
681
682