drm/ast: Add detect function support
[linux-2.6-block.git] / drivers / dma-buf / dma-buf.c
CommitLineData
caab277b 1// SPDX-License-Identifier: GPL-2.0-only
d15bd7ee
SS
2/*
3 * Framework for buffer objects that can be shared across devices/subsystems.
4 *
5 * Copyright(C) 2011 Linaro Limited. All rights reserved.
6 * Author: Sumit Semwal <sumit.semwal@ti.com>
7 *
8 * Many thanks to linaro-mm-sig list, and specially
9 * Arnd Bergmann <arnd@arndb.de>, Rob Clark <rob@ti.com> and
10 * Daniel Vetter <daniel@ffwll.ch> for their support in creation and
11 * refining of this idea.
d15bd7ee
SS
12 */
13
14#include <linux/fs.h>
15#include <linux/slab.h>
16#include <linux/dma-buf.h>
f54d1867 17#include <linux/dma-fence.h>
d15bd7ee
SS
18#include <linux/anon_inodes.h>
19#include <linux/export.h>
b89e3563 20#include <linux/debugfs.h>
9abdffe2 21#include <linux/module.h>
b89e3563 22#include <linux/seq_file.h>
9b495a58 23#include <linux/poll.h>
52791eee 24#include <linux/dma-resv.h>
b02da6f8 25#include <linux/mm.h>
ed63bb1d 26#include <linux/mount.h>
933a90bf 27#include <linux/pseudo_fs.h>
d15bd7ee 28
c11e391d 29#include <uapi/linux/dma-buf.h>
ed63bb1d 30#include <uapi/linux/magic.h>
c11e391d 31
d15bd7ee
SS
32static inline int is_dma_buf_file(struct file *);
33
b89e3563
SS
34struct dma_buf_list {
35 struct list_head head;
36 struct mutex lock;
37};
38
39static struct dma_buf_list db_list;
40
bb2bb903
GH
41static char *dmabuffs_dname(struct dentry *dentry, char *buffer, int buflen)
42{
43 struct dma_buf *dmabuf;
44 char name[DMA_BUF_NAME_LEN];
45 size_t ret = 0;
46
47 dmabuf = dentry->d_fsdata;
6348dd29 48 spin_lock(&dmabuf->name_lock);
bb2bb903
GH
49 if (dmabuf->name)
50 ret = strlcpy(name, dmabuf->name, DMA_BUF_NAME_LEN);
6348dd29 51 spin_unlock(&dmabuf->name_lock);
bb2bb903
GH
52
53 return dynamic_dname(dentry, buffer, buflen, "/%s:%s",
54 dentry->d_name.name, ret > 0 ? name : "");
55}
56
4ab59c3c 57static void dma_buf_release(struct dentry *dentry)
d15bd7ee
SS
58{
59 struct dma_buf *dmabuf;
60
4ab59c3c 61 dmabuf = dentry->d_fsdata;
19a508bd
CTR
62 if (unlikely(!dmabuf))
63 return;
d15bd7ee 64
f00b4dad
DV
65 BUG_ON(dmabuf->vmapping_counter);
66
9b495a58
ML
67 /*
68 * Any fences that a dma-buf poll can wait on should be signaled
69 * before releasing dma-buf. This is the responsibility of each
70 * driver that uses the reservation objects.
71 *
72 * If you hit this BUG() it means someone dropped their ref to the
73 * dma-buf while still having pending operation to the buffer.
74 */
75 BUG_ON(dmabuf->cb_shared.active || dmabuf->cb_excl.active);
76
d15bd7ee 77 dmabuf->ops->release(dmabuf);
b89e3563 78
52791eee
CK
79 if (dmabuf->resv == (struct dma_resv *)&dmabuf[1])
80 dma_resv_fini(dmabuf->resv);
3aac4502 81
9abdffe2 82 module_put(dmabuf->owner);
d1f37226 83 kfree(dmabuf->name);
d15bd7ee 84 kfree(dmabuf);
4ab59c3c
SS
85}
86
05cd8469
CTR
87static int dma_buf_file_release(struct inode *inode, struct file *file)
88{
89 struct dma_buf *dmabuf;
90
91 if (!is_dma_buf_file(file))
92 return -EINVAL;
93
94 dmabuf = file->private_data;
95
96 mutex_lock(&db_list.lock);
97 list_del(&dmabuf->list_node);
98 mutex_unlock(&db_list.lock);
99
100 return 0;
101}
102
4ab59c3c
SS
103static const struct dentry_operations dma_buf_dentry_ops = {
104 .d_dname = dmabuffs_dname,
105 .d_release = dma_buf_release,
106};
107
108static struct vfsmount *dma_buf_mnt;
109
110static int dma_buf_fs_init_context(struct fs_context *fc)
111{
112 struct pseudo_fs_context *ctx;
113
114 ctx = init_pseudo(fc, DMA_BUF_MAGIC);
115 if (!ctx)
116 return -ENOMEM;
117 ctx->dops = &dma_buf_dentry_ops;
d15bd7ee
SS
118 return 0;
119}
120
4ab59c3c
SS
121static struct file_system_type dma_buf_fs_type = {
122 .name = "dmabuf",
123 .init_fs_context = dma_buf_fs_init_context,
124 .kill_sb = kill_anon_super,
125};
126
4c78513e
DV
127static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma)
128{
129 struct dma_buf *dmabuf;
130
131 if (!is_dma_buf_file(file))
132 return -EINVAL;
133
134 dmabuf = file->private_data;
135
e3a9d6c5
AD
136 /* check if buffer supports mmap */
137 if (!dmabuf->ops->mmap)
138 return -EINVAL;
139
4c78513e 140 /* check for overflowing the buffer's size */
b02da6f8 141 if (vma->vm_pgoff + vma_pages(vma) >
4c78513e
DV
142 dmabuf->size >> PAGE_SHIFT)
143 return -EINVAL;
144
145 return dmabuf->ops->mmap(dmabuf, vma);
146}
147
19e8697b
CJHR
148static loff_t dma_buf_llseek(struct file *file, loff_t offset, int whence)
149{
150 struct dma_buf *dmabuf;
151 loff_t base;
152
153 if (!is_dma_buf_file(file))
154 return -EBADF;
155
156 dmabuf = file->private_data;
157
158 /* only support discovering the end of the buffer,
159 but also allow SEEK_SET to maintain the idiomatic
160 SEEK_END(0), SEEK_CUR(0) pattern */
161 if (whence == SEEK_END)
162 base = dmabuf->size;
163 else if (whence == SEEK_SET)
164 base = 0;
165 else
166 return -EINVAL;
167
168 if (offset != 0)
169 return -EINVAL;
170
171 return base + offset;
172}
173
e7e21c72 174/**
102514ec 175 * DOC: implicit fence polling
e7e21c72
DV
176 *
177 * To support cross-device and cross-driver synchronization of buffer access
102514ec
DV
178 * implicit fences (represented internally in the kernel with &struct dma_fence)
179 * can be attached to a &dma_buf. The glue for that and a few related things are
52791eee 180 * provided in the &dma_resv structure.
e7e21c72
DV
181 *
182 * Userspace can query the state of these implicitly tracked fences using poll()
183 * and related system calls:
184 *
a9a08845 185 * - Checking for EPOLLIN, i.e. read access, can be use to query the state of the
e7e21c72
DV
186 * most recent write or exclusive fence.
187 *
a9a08845 188 * - Checking for EPOLLOUT, i.e. write access, can be used to query the state of
e7e21c72
DV
189 * all attached fences, shared and exclusive ones.
190 *
191 * Note that this only signals the completion of the respective fences, i.e. the
192 * DMA transfers are complete. Cache flushing and any other necessary
193 * preparations before CPU access can begin still need to happen.
194 */
195
f54d1867 196static void dma_buf_poll_cb(struct dma_fence *fence, struct dma_fence_cb *cb)
9b495a58
ML
197{
198 struct dma_buf_poll_cb_t *dcb = (struct dma_buf_poll_cb_t *)cb;
199 unsigned long flags;
200
201 spin_lock_irqsave(&dcb->poll->lock, flags);
202 wake_up_locked_poll(dcb->poll, dcb->active);
203 dcb->active = 0;
204 spin_unlock_irqrestore(&dcb->poll->lock, flags);
205}
206
afc9a42b 207static __poll_t dma_buf_poll(struct file *file, poll_table *poll)
9b495a58
ML
208{
209 struct dma_buf *dmabuf;
52791eee
CK
210 struct dma_resv *resv;
211 struct dma_resv_list *fobj;
f54d1867 212 struct dma_fence *fence_excl;
01699437 213 __poll_t events;
b016cd6e 214 unsigned shared_count, seq;
9b495a58
ML
215
216 dmabuf = file->private_data;
217 if (!dmabuf || !dmabuf->resv)
a9a08845 218 return EPOLLERR;
9b495a58
ML
219
220 resv = dmabuf->resv;
221
222 poll_wait(file, &dmabuf->poll, poll);
223
a9a08845 224 events = poll_requested_events(poll) & (EPOLLIN | EPOLLOUT);
9b495a58
ML
225 if (!events)
226 return 0;
227
b016cd6e
CW
228retry:
229 seq = read_seqcount_begin(&resv->seq);
3c3b177a 230 rcu_read_lock();
b016cd6e
CW
231
232 fobj = rcu_dereference(resv->fence);
233 if (fobj)
234 shared_count = fobj->shared_count;
235 else
236 shared_count = 0;
6edbd6ab 237 fence_excl = dma_resv_excl_fence(resv);
b016cd6e
CW
238 if (read_seqcount_retry(&resv->seq, seq)) {
239 rcu_read_unlock();
240 goto retry;
241 }
242
a9a08845 243 if (fence_excl && (!(events & EPOLLOUT) || shared_count == 0)) {
9b495a58 244 struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_excl;
a9a08845 245 __poll_t pevents = EPOLLIN;
9b495a58 246
04a5faa8 247 if (shared_count == 0)
a9a08845 248 pevents |= EPOLLOUT;
9b495a58
ML
249
250 spin_lock_irq(&dmabuf->poll.lock);
251 if (dcb->active) {
252 dcb->active |= pevents;
253 events &= ~pevents;
254 } else
255 dcb->active = pevents;
256 spin_unlock_irq(&dmabuf->poll.lock);
257
258 if (events & pevents) {
f54d1867 259 if (!dma_fence_get_rcu(fence_excl)) {
3c3b177a
ML
260 /* force a recheck */
261 events &= ~pevents;
262 dma_buf_poll_cb(NULL, &dcb->cb);
f54d1867
CW
263 } else if (!dma_fence_add_callback(fence_excl, &dcb->cb,
264 dma_buf_poll_cb)) {
9b495a58 265 events &= ~pevents;
f54d1867 266 dma_fence_put(fence_excl);
04a5faa8 267 } else {
9b495a58
ML
268 /*
269 * No callback queued, wake up any additional
270 * waiters.
271 */
f54d1867 272 dma_fence_put(fence_excl);
9b495a58 273 dma_buf_poll_cb(NULL, &dcb->cb);
04a5faa8 274 }
9b495a58
ML
275 }
276 }
277
a9a08845 278 if ((events & EPOLLOUT) && shared_count > 0) {
9b495a58
ML
279 struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_shared;
280 int i;
281
282 /* Only queue a new callback if no event has fired yet */
283 spin_lock_irq(&dmabuf->poll.lock);
284 if (dcb->active)
a9a08845 285 events &= ~EPOLLOUT;
9b495a58 286 else
a9a08845 287 dcb->active = EPOLLOUT;
9b495a58
ML
288 spin_unlock_irq(&dmabuf->poll.lock);
289
a9a08845 290 if (!(events & EPOLLOUT))
9b495a58
ML
291 goto out;
292
04a5faa8 293 for (i = 0; i < shared_count; ++i) {
f54d1867 294 struct dma_fence *fence = rcu_dereference(fobj->shared[i]);
04a5faa8 295
f54d1867 296 if (!dma_fence_get_rcu(fence)) {
3c3b177a
ML
297 /*
298 * fence refcount dropped to zero, this means
299 * that fobj has been freed
300 *
301 * call dma_buf_poll_cb and force a recheck!
302 */
a9a08845 303 events &= ~EPOLLOUT;
3c3b177a
ML
304 dma_buf_poll_cb(NULL, &dcb->cb);
305 break;
306 }
f54d1867
CW
307 if (!dma_fence_add_callback(fence, &dcb->cb,
308 dma_buf_poll_cb)) {
309 dma_fence_put(fence);
a9a08845 310 events &= ~EPOLLOUT;
9b495a58
ML
311 break;
312 }
f54d1867 313 dma_fence_put(fence);
04a5faa8 314 }
9b495a58
ML
315
316 /* No callback queued, wake up any additional waiters. */
04a5faa8 317 if (i == shared_count)
9b495a58
ML
318 dma_buf_poll_cb(NULL, &dcb->cb);
319 }
320
321out:
3c3b177a 322 rcu_read_unlock();
9b495a58
ML
323 return events;
324}
325
bb2bb903
GH
326/**
327 * dma_buf_set_name - Set a name to a specific dma_buf to track the usage.
328 * The name of the dma-buf buffer can only be set when the dma-buf is not
329 * attached to any devices. It could theoritically support changing the
330 * name of the dma-buf if the same piece of memory is used for multiple
331 * purpose between different devices.
332 *
6d3ba803
KK
333 * @dmabuf: [in] dmabuf buffer that will be renamed.
334 * @buf: [in] A piece of userspace memory that contains the name of
335 * the dma-buf.
bb2bb903
GH
336 *
337 * Returns 0 on success. If the dma-buf buffer is already attached to
338 * devices, return -EBUSY.
339 *
340 */
341static long dma_buf_set_name(struct dma_buf *dmabuf, const char __user *buf)
342{
343 char *name = strndup_user(buf, DMA_BUF_NAME_LEN);
344 long ret = 0;
345
346 if (IS_ERR(name))
347 return PTR_ERR(name);
348
15fd552d 349 dma_resv_lock(dmabuf->resv, NULL);
bb2bb903
GH
350 if (!list_empty(&dmabuf->attachments)) {
351 ret = -EBUSY;
352 kfree(name);
353 goto out_unlock;
354 }
6348dd29 355 spin_lock(&dmabuf->name_lock);
bb2bb903
GH
356 kfree(dmabuf->name);
357 dmabuf->name = name;
6348dd29 358 spin_unlock(&dmabuf->name_lock);
bb2bb903
GH
359
360out_unlock:
15fd552d 361 dma_resv_unlock(dmabuf->resv);
bb2bb903
GH
362 return ret;
363}
364
c11e391d
DV
365static long dma_buf_ioctl(struct file *file,
366 unsigned int cmd, unsigned long arg)
367{
368 struct dma_buf *dmabuf;
369 struct dma_buf_sync sync;
370 enum dma_data_direction direction;
18b862dc 371 int ret;
c11e391d
DV
372
373 dmabuf = file->private_data;
374
375 switch (cmd) {
376 case DMA_BUF_IOCTL_SYNC:
377 if (copy_from_user(&sync, (void __user *) arg, sizeof(sync)))
378 return -EFAULT;
379
380 if (sync.flags & ~DMA_BUF_SYNC_VALID_FLAGS_MASK)
381 return -EINVAL;
382
383 switch (sync.flags & DMA_BUF_SYNC_RW) {
384 case DMA_BUF_SYNC_READ:
385 direction = DMA_FROM_DEVICE;
386 break;
387 case DMA_BUF_SYNC_WRITE:
388 direction = DMA_TO_DEVICE;
389 break;
390 case DMA_BUF_SYNC_RW:
391 direction = DMA_BIDIRECTIONAL;
392 break;
393 default:
394 return -EINVAL;
395 }
396
397 if (sync.flags & DMA_BUF_SYNC_END)
18b862dc 398 ret = dma_buf_end_cpu_access(dmabuf, direction);
c11e391d 399 else
18b862dc 400 ret = dma_buf_begin_cpu_access(dmabuf, direction);
c11e391d 401
18b862dc 402 return ret;
bb2bb903 403
a5bff92e
DV
404 case DMA_BUF_SET_NAME_A:
405 case DMA_BUF_SET_NAME_B:
bb2bb903
GH
406 return dma_buf_set_name(dmabuf, (const char __user *)arg);
407
c11e391d
DV
408 default:
409 return -ENOTTY;
410 }
411}
412
bcc07111
GH
413static void dma_buf_show_fdinfo(struct seq_file *m, struct file *file)
414{
415 struct dma_buf *dmabuf = file->private_data;
416
417 seq_printf(m, "size:\t%zu\n", dmabuf->size);
418 /* Don't count the temporary reference taken inside procfs seq_show */
419 seq_printf(m, "count:\t%ld\n", file_count(dmabuf->file) - 1);
420 seq_printf(m, "exp_name:\t%s\n", dmabuf->exp_name);
6348dd29 421 spin_lock(&dmabuf->name_lock);
bcc07111
GH
422 if (dmabuf->name)
423 seq_printf(m, "name:\t%s\n", dmabuf->name);
6348dd29 424 spin_unlock(&dmabuf->name_lock);
bcc07111
GH
425}
426
d15bd7ee 427static const struct file_operations dma_buf_fops = {
05cd8469 428 .release = dma_buf_file_release,
4c78513e 429 .mmap = dma_buf_mmap_internal,
19e8697b 430 .llseek = dma_buf_llseek,
9b495a58 431 .poll = dma_buf_poll,
c11e391d 432 .unlocked_ioctl = dma_buf_ioctl,
1832f2d8 433 .compat_ioctl = compat_ptr_ioctl,
bcc07111 434 .show_fdinfo = dma_buf_show_fdinfo,
d15bd7ee
SS
435};
436
437/*
438 * is_dma_buf_file - Check if struct file* is associated with dma_buf
439 */
440static inline int is_dma_buf_file(struct file *file)
441{
442 return file->f_op == &dma_buf_fops;
443}
444
ed63bb1d
GH
445static struct file *dma_buf_getfile(struct dma_buf *dmabuf, int flags)
446{
447 struct file *file;
448 struct inode *inode = alloc_anon_inode(dma_buf_mnt->mnt_sb);
449
450 if (IS_ERR(inode))
451 return ERR_CAST(inode);
452
453 inode->i_size = dmabuf->size;
454 inode_set_bytes(inode, dmabuf->size);
455
456 file = alloc_file_pseudo(inode, dma_buf_mnt, "dmabuf",
457 flags, &dma_buf_fops);
458 if (IS_ERR(file))
459 goto err_alloc_file;
460 file->f_flags = flags & (O_ACCMODE | O_NONBLOCK);
461 file->private_data = dmabuf;
bb2bb903 462 file->f_path.dentry->d_fsdata = dmabuf;
ed63bb1d
GH
463
464 return file;
465
466err_alloc_file:
467 iput(inode);
468 return file;
469}
470
2904a8c1
DV
471/**
472 * DOC: dma buf device access
473 *
474 * For device DMA access to a shared DMA buffer the usual sequence of operations
475 * is fairly simple:
476 *
477 * 1. The exporter defines his exporter instance using
478 * DEFINE_DMA_BUF_EXPORT_INFO() and calls dma_buf_export() to wrap a private
479 * buffer object into a &dma_buf. It then exports that &dma_buf to userspace
480 * as a file descriptor by calling dma_buf_fd().
481 *
482 * 2. Userspace passes this file-descriptors to all drivers it wants this buffer
483 * to share with: First the filedescriptor is converted to a &dma_buf using
c138782d 484 * dma_buf_get(). Then the buffer is attached to the device using
2904a8c1
DV
485 * dma_buf_attach().
486 *
487 * Up to this stage the exporter is still free to migrate or reallocate the
488 * backing storage.
489 *
c138782d 490 * 3. Once the buffer is attached to all devices userspace can initiate DMA
2904a8c1
DV
491 * access to the shared buffer. In the kernel this is done by calling
492 * dma_buf_map_attachment() and dma_buf_unmap_attachment().
493 *
494 * 4. Once a driver is done with a shared buffer it needs to call
495 * dma_buf_detach() (after cleaning up any mappings) and then release the
85804b70 496 * reference acquired with dma_buf_get() by calling dma_buf_put().
2904a8c1
DV
497 *
498 * For the detailed semantics exporters are expected to implement see
499 * &dma_buf_ops.
500 */
501
d15bd7ee 502/**
d8fbe341 503 * dma_buf_export - Creates a new dma_buf, and associates an anon file
d15bd7ee
SS
504 * with this buffer, so it can be exported.
505 * Also connect the allocator specific data and ops to the buffer.
78df9695 506 * Additionally, provide a name string for exporter; useful in debugging.
d15bd7ee 507 *
d8fbe341 508 * @exp_info: [in] holds all the export related information provided
f641d3b5 509 * by the exporter. see &struct dma_buf_export_info
d8fbe341 510 * for further details.
d15bd7ee 511 *
85804b70
DV
512 * Returns, on success, a newly created struct dma_buf object, which wraps the
513 * supplied private data and operations for struct dma_buf_ops. On either
514 * missing ops, or error in allocating struct dma_buf, will return negative
515 * error.
d15bd7ee 516 *
2904a8c1
DV
517 * For most cases the easiest way to create @exp_info is through the
518 * %DEFINE_DMA_BUF_EXPORT_INFO macro.
d15bd7ee 519 */
d8fbe341 520struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
d15bd7ee
SS
521{
522 struct dma_buf *dmabuf;
52791eee 523 struct dma_resv *resv = exp_info->resv;
d15bd7ee 524 struct file *file;
3aac4502 525 size_t alloc_size = sizeof(struct dma_buf);
a026df4c 526 int ret;
5136629d 527
d8fbe341 528 if (!exp_info->resv)
52791eee 529 alloc_size += sizeof(struct dma_resv);
3aac4502
ML
530 else
531 /* prevent &dma_buf[1] == dma_buf->resv */
532 alloc_size += 1;
d15bd7ee 533
d8fbe341
SS
534 if (WARN_ON(!exp_info->priv
535 || !exp_info->ops
536 || !exp_info->ops->map_dma_buf
537 || !exp_info->ops->unmap_dma_buf
e3a9d6c5 538 || !exp_info->ops->release)) {
d15bd7ee
SS
539 return ERR_PTR(-EINVAL);
540 }
541
15fd552d 542 if (WARN_ON(exp_info->ops->cache_sgt_mapping &&
bd2275ee 543 (exp_info->ops->pin || exp_info->ops->unpin)))
15fd552d
CK
544 return ERR_PTR(-EINVAL);
545
bd2275ee 546 if (WARN_ON(!exp_info->ops->pin != !exp_info->ops->unpin))
15fd552d
CK
547 return ERR_PTR(-EINVAL);
548
9abdffe2
SS
549 if (!try_module_get(exp_info->owner))
550 return ERR_PTR(-ENOENT);
551
3aac4502 552 dmabuf = kzalloc(alloc_size, GFP_KERNEL);
9abdffe2 553 if (!dmabuf) {
a026df4c
CW
554 ret = -ENOMEM;
555 goto err_module;
9abdffe2 556 }
d15bd7ee 557
d8fbe341
SS
558 dmabuf->priv = exp_info->priv;
559 dmabuf->ops = exp_info->ops;
560 dmabuf->size = exp_info->size;
561 dmabuf->exp_name = exp_info->exp_name;
9abdffe2 562 dmabuf->owner = exp_info->owner;
6348dd29 563 spin_lock_init(&dmabuf->name_lock);
9b495a58
ML
564 init_waitqueue_head(&dmabuf->poll);
565 dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll;
566 dmabuf->cb_excl.active = dmabuf->cb_shared.active = 0;
567
3aac4502 568 if (!resv) {
52791eee
CK
569 resv = (struct dma_resv *)&dmabuf[1];
570 dma_resv_init(resv);
3aac4502
ML
571 }
572 dmabuf->resv = resv;
d15bd7ee 573
ed63bb1d 574 file = dma_buf_getfile(dmabuf, exp_info->flags);
9022e24e 575 if (IS_ERR(file)) {
a026df4c
CW
576 ret = PTR_ERR(file);
577 goto err_dmabuf;
9022e24e 578 }
19e8697b
CJHR
579
580 file->f_mode |= FMODE_LSEEK;
d15bd7ee
SS
581 dmabuf->file = file;
582
583 mutex_init(&dmabuf->lock);
584 INIT_LIST_HEAD(&dmabuf->attachments);
585
b89e3563
SS
586 mutex_lock(&db_list.lock);
587 list_add(&dmabuf->list_node, &db_list.head);
588 mutex_unlock(&db_list.lock);
589
d15bd7ee 590 return dmabuf;
a026df4c
CW
591
592err_dmabuf:
593 kfree(dmabuf);
594err_module:
595 module_put(exp_info->owner);
596 return ERR_PTR(ret);
d15bd7ee 597}
d8fbe341 598EXPORT_SYMBOL_GPL(dma_buf_export);
d15bd7ee
SS
599
600/**
85804b70 601 * dma_buf_fd - returns a file descriptor for the given struct dma_buf
d15bd7ee 602 * @dmabuf: [in] pointer to dma_buf for which fd is required.
55c1c4ca 603 * @flags: [in] flags to give to fd
d15bd7ee
SS
604 *
605 * On success, returns an associated 'fd'. Else, returns error.
606 */
55c1c4ca 607int dma_buf_fd(struct dma_buf *dmabuf, int flags)
d15bd7ee 608{
f5e097f0 609 int fd;
d15bd7ee
SS
610
611 if (!dmabuf || !dmabuf->file)
612 return -EINVAL;
613
f5e097f0
BP
614 fd = get_unused_fd_flags(flags);
615 if (fd < 0)
616 return fd;
d15bd7ee
SS
617
618 fd_install(fd, dmabuf->file);
619
620 return fd;
621}
622EXPORT_SYMBOL_GPL(dma_buf_fd);
623
624/**
85804b70
DV
625 * dma_buf_get - returns the struct dma_buf related to an fd
626 * @fd: [in] fd associated with the struct dma_buf to be returned
d15bd7ee 627 *
85804b70 628 * On success, returns the struct dma_buf associated with an fd; uses
d15bd7ee
SS
629 * file's refcounting done by fget to increase refcount. returns ERR_PTR
630 * otherwise.
631 */
632struct dma_buf *dma_buf_get(int fd)
633{
634 struct file *file;
635
636 file = fget(fd);
637
638 if (!file)
639 return ERR_PTR(-EBADF);
640
641 if (!is_dma_buf_file(file)) {
642 fput(file);
643 return ERR_PTR(-EINVAL);
644 }
645
646 return file->private_data;
647}
648EXPORT_SYMBOL_GPL(dma_buf_get);
649
650/**
651 * dma_buf_put - decreases refcount of the buffer
652 * @dmabuf: [in] buffer to reduce refcount of
653 *
2904a8c1
DV
654 * Uses file's refcounting done implicitly by fput().
655 *
656 * If, as a result of this call, the refcount becomes 0, the 'release' file
e9b4d7b5
DV
657 * operation related to this fd is called. It calls &dma_buf_ops.release vfunc
658 * in turn, and frees the memory allocated for dmabuf when exported.
d15bd7ee
SS
659 */
660void dma_buf_put(struct dma_buf *dmabuf)
661{
662 if (WARN_ON(!dmabuf || !dmabuf->file))
663 return;
664
665 fput(dmabuf->file);
666}
667EXPORT_SYMBOL_GPL(dma_buf_put);
668
84335675
DV
669static void mangle_sg_table(struct sg_table *sg_table)
670{
671#ifdef CONFIG_DMABUF_DEBUG
672 int i;
673 struct scatterlist *sg;
674
675 /* To catch abuse of the underlying struct page by importers mix
676 * up the bits, but take care to preserve the low SG_ bits to
677 * not corrupt the sgt. The mixing is undone in __unmap_dma_buf
678 * before passing the sgt back to the exporter. */
679 for_each_sgtable_sg(sg_table, sg, i)
680 sg->page_link ^= ~0xffUL;
681#endif
682
683}
684static struct sg_table * __map_dma_buf(struct dma_buf_attachment *attach,
685 enum dma_data_direction direction)
686{
687 struct sg_table *sg_table;
688
689 sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction);
690
691 if (!IS_ERR_OR_NULL(sg_table))
692 mangle_sg_table(sg_table);
693
694 return sg_table;
695}
696
d15bd7ee 697/**
85804b70 698 * dma_buf_dynamic_attach - Add the device to dma_buf's attachments list
15fd552d
CK
699 * @dmabuf: [in] buffer to attach device to.
700 * @dev: [in] device to be attached.
6f49c251
RD
701 * @importer_ops: [in] importer operations for the attachment
702 * @importer_priv: [in] importer private pointer for the attachment
d15bd7ee 703 *
2904a8c1
DV
704 * Returns struct dma_buf_attachment pointer for this attachment. Attachments
705 * must be cleaned up by calling dma_buf_detach().
706 *
85804b70
DV
707 * Optionally this calls &dma_buf_ops.attach to allow device-specific attach
708 * functionality.
709 *
2904a8c1
DV
710 * Returns:
711 *
712 * A pointer to newly created &dma_buf_attachment on success, or a negative
713 * error code wrapped into a pointer on failure.
714 *
715 * Note that this can fail if the backing storage of @dmabuf is in a place not
716 * accessible to @dev, and cannot be moved to a more suitable place. This is
717 * indicated with the error code -EBUSY.
d15bd7ee 718 */
15fd552d
CK
719struct dma_buf_attachment *
720dma_buf_dynamic_attach(struct dma_buf *dmabuf, struct device *dev,
bb42df46
CK
721 const struct dma_buf_attach_ops *importer_ops,
722 void *importer_priv)
d15bd7ee
SS
723{
724 struct dma_buf_attachment *attach;
725 int ret;
726
d1aa06a1 727 if (WARN_ON(!dmabuf || !dev))
d15bd7ee
SS
728 return ERR_PTR(-EINVAL);
729
4981cdb0
CK
730 if (WARN_ON(importer_ops && !importer_ops->move_notify))
731 return ERR_PTR(-EINVAL);
732
db7942b6 733 attach = kzalloc(sizeof(*attach), GFP_KERNEL);
34d84ec4 734 if (!attach)
a9fbc3b7 735 return ERR_PTR(-ENOMEM);
d15bd7ee 736
d15bd7ee
SS
737 attach->dev = dev;
738 attach->dmabuf = dmabuf;
09606b54
CK
739 if (importer_ops)
740 attach->peer2peer = importer_ops->allow_peer2peer;
bb42df46
CK
741 attach->importer_ops = importer_ops;
742 attach->importer_priv = importer_priv;
2ed9201b 743
d15bd7ee 744 if (dmabuf->ops->attach) {
a19741e5 745 ret = dmabuf->ops->attach(dmabuf, attach);
d15bd7ee
SS
746 if (ret)
747 goto err_attach;
748 }
15fd552d 749 dma_resv_lock(dmabuf->resv, NULL);
d15bd7ee 750 list_add(&attach->node, &dmabuf->attachments);
15fd552d 751 dma_resv_unlock(dmabuf->resv);
d15bd7ee 752
15fd552d
CK
753 /* When either the importer or the exporter can't handle dynamic
754 * mappings we cache the mapping here to avoid issues with the
755 * reservation object lock.
756 */
757 if (dma_buf_attachment_is_dynamic(attach) !=
758 dma_buf_is_dynamic(dmabuf)) {
759 struct sg_table *sgt;
760
bb42df46 761 if (dma_buf_is_dynamic(attach->dmabuf)) {
15fd552d 762 dma_resv_lock(attach->dmabuf->resv, NULL);
7e008b02 763 ret = dmabuf->ops->pin(attach);
bb42df46
CK
764 if (ret)
765 goto err_unlock;
766 }
15fd552d 767
84335675 768 sgt = __map_dma_buf(attach, DMA_BIDIRECTIONAL);
15fd552d
CK
769 if (!sgt)
770 sgt = ERR_PTR(-ENOMEM);
771 if (IS_ERR(sgt)) {
772 ret = PTR_ERR(sgt);
bb42df46 773 goto err_unpin;
15fd552d
CK
774 }
775 if (dma_buf_is_dynamic(attach->dmabuf))
776 dma_resv_unlock(attach->dmabuf->resv);
777 attach->sgt = sgt;
778 attach->dir = DMA_BIDIRECTIONAL;
779 }
780
d15bd7ee
SS
781 return attach;
782
d15bd7ee
SS
783err_attach:
784 kfree(attach);
d15bd7ee 785 return ERR_PTR(ret);
15fd552d 786
bb42df46
CK
787err_unpin:
788 if (dma_buf_is_dynamic(attach->dmabuf))
7e008b02 789 dmabuf->ops->unpin(attach);
bb42df46 790
15fd552d
CK
791err_unlock:
792 if (dma_buf_is_dynamic(attach->dmabuf))
793 dma_resv_unlock(attach->dmabuf->resv);
794
795 dma_buf_detach(dmabuf, attach);
796 return ERR_PTR(ret);
797}
798EXPORT_SYMBOL_GPL(dma_buf_dynamic_attach);
799
800/**
801 * dma_buf_attach - Wrapper for dma_buf_dynamic_attach
802 * @dmabuf: [in] buffer to attach device to.
803 * @dev: [in] device to be attached.
804 *
805 * Wrapper to call dma_buf_dynamic_attach() for drivers which still use a static
806 * mapping.
807 */
808struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf,
809 struct device *dev)
810{
bb42df46 811 return dma_buf_dynamic_attach(dmabuf, dev, NULL, NULL);
d15bd7ee
SS
812}
813EXPORT_SYMBOL_GPL(dma_buf_attach);
814
84335675
DV
815static void __unmap_dma_buf(struct dma_buf_attachment *attach,
816 struct sg_table *sg_table,
817 enum dma_data_direction direction)
818{
819 /* uses XOR, hence this unmangles */
820 mangle_sg_table(sg_table);
821
822 attach->dmabuf->ops->unmap_dma_buf(attach, sg_table, direction);
823}
824
d15bd7ee 825/**
85804b70 826 * dma_buf_detach - Remove the given attachment from dmabuf's attachments list
d15bd7ee
SS
827 * @dmabuf: [in] buffer to detach from.
828 * @attach: [in] attachment to be detached; is free'd after this call.
829 *
2904a8c1 830 * Clean up a device attachment obtained by calling dma_buf_attach().
85804b70
DV
831 *
832 * Optionally this calls &dma_buf_ops.detach for device-specific detach.
d15bd7ee
SS
833 */
834void dma_buf_detach(struct dma_buf *dmabuf, struct dma_buf_attachment *attach)
835{
d1aa06a1 836 if (WARN_ON(!dmabuf || !attach))
d15bd7ee
SS
837 return;
838
15fd552d
CK
839 if (attach->sgt) {
840 if (dma_buf_is_dynamic(attach->dmabuf))
841 dma_resv_lock(attach->dmabuf->resv, NULL);
842
84335675 843 __unmap_dma_buf(attach, attach->sgt, attach->dir);
f13e143e 844
bb42df46 845 if (dma_buf_is_dynamic(attach->dmabuf)) {
7e008b02 846 dmabuf->ops->unpin(attach);
15fd552d 847 dma_resv_unlock(attach->dmabuf->resv);
bb42df46 848 }
15fd552d
CK
849 }
850
15fd552d 851 dma_resv_lock(dmabuf->resv, NULL);
d15bd7ee 852 list_del(&attach->node);
15fd552d 853 dma_resv_unlock(dmabuf->resv);
d15bd7ee
SS
854 if (dmabuf->ops->detach)
855 dmabuf->ops->detach(dmabuf, attach);
856
d15bd7ee
SS
857 kfree(attach);
858}
859EXPORT_SYMBOL_GPL(dma_buf_detach);
860
bb42df46
CK
861/**
862 * dma_buf_pin - Lock down the DMA-buf
bb42df46
CK
863 * @attach: [in] attachment which should be pinned
864 *
c545781e
DV
865 * Only dynamic importers (who set up @attach with dma_buf_dynamic_attach()) may
866 * call this, and only for limited use cases like scanout and not for temporary
867 * pin operations. It is not permitted to allow userspace to pin arbitrary
868 * amounts of buffers through this interface.
869 *
870 * Buffers must be unpinned by calling dma_buf_unpin().
871 *
bb42df46
CK
872 * Returns:
873 * 0 on success, negative error code on failure.
874 */
875int dma_buf_pin(struct dma_buf_attachment *attach)
876{
877 struct dma_buf *dmabuf = attach->dmabuf;
878 int ret = 0;
879
c545781e
DV
880 WARN_ON(!dma_buf_attachment_is_dynamic(attach));
881
bb42df46
CK
882 dma_resv_assert_held(dmabuf->resv);
883
884 if (dmabuf->ops->pin)
885 ret = dmabuf->ops->pin(attach);
886
887 return ret;
888}
889EXPORT_SYMBOL_GPL(dma_buf_pin);
890
891/**
c545781e 892 * dma_buf_unpin - Unpin a DMA-buf
bb42df46 893 * @attach: [in] attachment which should be unpinned
c545781e
DV
894 *
895 * This unpins a buffer pinned by dma_buf_pin() and allows the exporter to move
896 * any mapping of @attach again and inform the importer through
897 * &dma_buf_attach_ops.move_notify.
bb42df46
CK
898 */
899void dma_buf_unpin(struct dma_buf_attachment *attach)
900{
901 struct dma_buf *dmabuf = attach->dmabuf;
902
c545781e
DV
903 WARN_ON(!dma_buf_attachment_is_dynamic(attach));
904
bb42df46
CK
905 dma_resv_assert_held(dmabuf->resv);
906
907 if (dmabuf->ops->unpin)
908 dmabuf->ops->unpin(attach);
909}
910EXPORT_SYMBOL_GPL(dma_buf_unpin);
911
d15bd7ee
SS
912/**
913 * dma_buf_map_attachment - Returns the scatterlist table of the attachment;
914 * mapped into _device_ address space. Is a wrapper for map_dma_buf() of the
915 * dma_buf_ops.
916 * @attach: [in] attachment whose scatterlist is to be returned
917 * @direction: [in] direction of DMA transfer
918 *
fee0c54e 919 * Returns sg_table containing the scatterlist to be returned; returns ERR_PTR
2904a8c1
DV
920 * on error. May return -EINTR if it is interrupted by a signal.
921 *
ac80cd17
JX
922 * On success, the DMA addresses and lengths in the returned scatterlist are
923 * PAGE_SIZE aligned.
924 *
c138782d 925 * A mapping must be unmapped by using dma_buf_unmap_attachment(). Note that
2904a8c1
DV
926 * the underlying backing storage is pinned for as long as a mapping exists,
927 * therefore users/importers should not hold onto a mapping for undue amounts of
928 * time.
d15bd7ee
SS
929 */
930struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach,
931 enum dma_data_direction direction)
932{
531beb06 933 struct sg_table *sg_table;
bb42df46 934 int r;
d15bd7ee
SS
935
936 might_sleep();
937
d1aa06a1 938 if (WARN_ON(!attach || !attach->dmabuf))
d15bd7ee
SS
939 return ERR_PTR(-EINVAL);
940
15fd552d
CK
941 if (dma_buf_attachment_is_dynamic(attach))
942 dma_resv_assert_held(attach->dmabuf->resv);
943
f13e143e
CK
944 if (attach->sgt) {
945 /*
946 * Two mappings with different directions for the same
947 * attachment are not allowed.
948 */
949 if (attach->dir != direction &&
950 attach->dir != DMA_BIDIRECTIONAL)
951 return ERR_PTR(-EBUSY);
952
953 return attach->sgt;
954 }
955
bb42df46 956 if (dma_buf_is_dynamic(attach->dmabuf)) {
15fd552d 957 dma_resv_assert_held(attach->dmabuf->resv);
4981cdb0 958 if (!IS_ENABLED(CONFIG_DMABUF_MOVE_NOTIFY)) {
7e008b02 959 r = attach->dmabuf->ops->pin(attach);
bb42df46
CK
960 if (r)
961 return ERR_PTR(r);
962 }
963 }
15fd552d 964
84335675 965 sg_table = __map_dma_buf(attach, direction);
fee0c54e
CC
966 if (!sg_table)
967 sg_table = ERR_PTR(-ENOMEM);
d15bd7ee 968
bb42df46 969 if (IS_ERR(sg_table) && dma_buf_is_dynamic(attach->dmabuf) &&
4981cdb0 970 !IS_ENABLED(CONFIG_DMABUF_MOVE_NOTIFY))
7e008b02 971 attach->dmabuf->ops->unpin(attach);
bb42df46 972
f13e143e
CK
973 if (!IS_ERR(sg_table) && attach->dmabuf->ops->cache_sgt_mapping) {
974 attach->sgt = sg_table;
975 attach->dir = direction;
976 }
977
ac80cd17 978#ifdef CONFIG_DMA_API_DEBUG
00efd65a 979 if (!IS_ERR(sg_table)) {
ac80cd17
JX
980 struct scatterlist *sg;
981 u64 addr;
982 int len;
983 int i;
984
985 for_each_sgtable_dma_sg(sg_table, sg, i) {
986 addr = sg_dma_address(sg);
987 len = sg_dma_len(sg);
988 if (!PAGE_ALIGNED(addr) || !PAGE_ALIGNED(len)) {
989 pr_debug("%s: addr %llx or len %x is not page aligned!\n",
990 __func__, addr, len);
991 }
992 }
993 }
994#endif /* CONFIG_DMA_API_DEBUG */
995
d15bd7ee
SS
996 return sg_table;
997}
998EXPORT_SYMBOL_GPL(dma_buf_map_attachment);
999
1000/**
1001 * dma_buf_unmap_attachment - unmaps and decreases usecount of the buffer;might
1002 * deallocate the scatterlist associated. Is a wrapper for unmap_dma_buf() of
1003 * dma_buf_ops.
1004 * @attach: [in] attachment to unmap buffer from
1005 * @sg_table: [in] scatterlist info of the buffer to unmap
33ea2dcb 1006 * @direction: [in] direction of DMA transfer
d15bd7ee 1007 *
2904a8c1 1008 * This unmaps a DMA mapping for @attached obtained by dma_buf_map_attachment().
d15bd7ee
SS
1009 */
1010void dma_buf_unmap_attachment(struct dma_buf_attachment *attach,
33ea2dcb
SS
1011 struct sg_table *sg_table,
1012 enum dma_data_direction direction)
d15bd7ee 1013{
b6fa0cd6
RC
1014 might_sleep();
1015
d1aa06a1 1016 if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
d15bd7ee
SS
1017 return;
1018
15fd552d
CK
1019 if (dma_buf_attachment_is_dynamic(attach))
1020 dma_resv_assert_held(attach->dmabuf->resv);
1021
f13e143e
CK
1022 if (attach->sgt == sg_table)
1023 return;
1024
15fd552d
CK
1025 if (dma_buf_is_dynamic(attach->dmabuf))
1026 dma_resv_assert_held(attach->dmabuf->resv);
1027
84335675 1028 __unmap_dma_buf(attach, sg_table, direction);
bb42df46
CK
1029
1030 if (dma_buf_is_dynamic(attach->dmabuf) &&
4981cdb0 1031 !IS_ENABLED(CONFIG_DMABUF_MOVE_NOTIFY))
bb42df46 1032 dma_buf_unpin(attach);
d15bd7ee
SS
1033}
1034EXPORT_SYMBOL_GPL(dma_buf_unmap_attachment);
fc13020e 1035
bb42df46
CK
1036/**
1037 * dma_buf_move_notify - notify attachments that DMA-buf is moving
1038 *
1039 * @dmabuf: [in] buffer which is moving
1040 *
1041 * Informs all attachmenst that they need to destroy and recreated all their
1042 * mappings.
1043 */
1044void dma_buf_move_notify(struct dma_buf *dmabuf)
1045{
1046 struct dma_buf_attachment *attach;
1047
1048 dma_resv_assert_held(dmabuf->resv);
1049
1050 list_for_each_entry(attach, &dmabuf->attachments, node)
4981cdb0 1051 if (attach->importer_ops)
bb42df46
CK
1052 attach->importer_ops->move_notify(attach);
1053}
1054EXPORT_SYMBOL_GPL(dma_buf_move_notify);
1055
0959a168
DV
1056/**
1057 * DOC: cpu access
1058 *
1059 * There are mutliple reasons for supporting CPU access to a dma buffer object:
1060 *
1061 * - Fallback operations in the kernel, for example when a device is connected
1062 * over USB and the kernel needs to shuffle the data around first before
1063 * sending it away. Cache coherency is handled by braketing any transactions
1064 * with calls to dma_buf_begin_cpu_access() and dma_buf_end_cpu_access()
1065 * access.
1066 *
7f0de8d8
DV
1067 * Since for most kernel internal dma-buf accesses need the entire buffer, a
1068 * vmap interface is introduced. Note that on very old 32-bit architectures
1069 * vmalloc space might be limited and result in vmap calls failing.
0959a168
DV
1070 *
1071 * Interfaces::
de9114ec 1072 *
0959a168
DV
1073 * void \*dma_buf_vmap(struct dma_buf \*dmabuf)
1074 * void dma_buf_vunmap(struct dma_buf \*dmabuf, void \*vaddr)
1075 *
1076 * The vmap call can fail if there is no vmap support in the exporter, or if
de9114ec
DV
1077 * it runs out of vmalloc space. Note that the dma-buf layer keeps a reference
1078 * count for all vmap access and calls down into the exporter's vmap function
1079 * only when no vmapping exists, and only unmaps it once. Protection against
1080 * concurrent vmap/vunmap calls is provided by taking the &dma_buf.lock mutex.
0959a168
DV
1081 *
1082 * - For full compatibility on the importer side with existing userspace
1083 * interfaces, which might already support mmap'ing buffers. This is needed in
1084 * many processing pipelines (e.g. feeding a software rendered image into a
1085 * hardware pipeline, thumbnail creation, snapshots, ...). Also, Android's ION
1086 * framework already supported this and for DMA buffer file descriptors to
1087 * replace ION buffers mmap support was needed.
1088 *
1089 * There is no special interfaces, userspace simply calls mmap on the dma-buf
1090 * fd. But like for CPU access there's a need to braket the actual access,
1091 * which is handled by the ioctl (DMA_BUF_IOCTL_SYNC). Note that
1092 * DMA_BUF_IOCTL_SYNC can fail with -EAGAIN or -EINTR, in which case it must
1093 * be restarted.
1094 *
1095 * Some systems might need some sort of cache coherency management e.g. when
1096 * CPU and GPU domains are being accessed through dma-buf at the same time.
1097 * To circumvent this problem there are begin/end coherency markers, that
1098 * forward directly to existing dma-buf device drivers vfunc hooks. Userspace
1099 * can make use of those markers through the DMA_BUF_IOCTL_SYNC ioctl. The
1100 * sequence would be used like following:
1101 *
1102 * - mmap dma-buf fd
1103 * - for each drawing/upload cycle in CPU 1. SYNC_START ioctl, 2. read/write
1104 * to mmap area 3. SYNC_END ioctl. This can be repeated as often as you
1105 * want (with the new data being consumed by say the GPU or the scanout
1106 * device)
1107 * - munmap once you don't need the buffer any more
1108 *
1109 * For correctness and optimal performance, it is always required to use
1110 * SYNC_START and SYNC_END before and after, respectively, when accessing the
1111 * mapped address. Userspace cannot rely on coherent access, even when there
1112 * are systems where it just works without calling these ioctls.
1113 *
1114 * - And as a CPU fallback in userspace processing pipelines.
1115 *
1116 * Similar to the motivation for kernel cpu access it is again important that
1117 * the userspace code of a given importing subsystem can use the same
1118 * interfaces with a imported dma-buf buffer object as with a native buffer
1119 * object. This is especially important for drm where the userspace part of
1120 * contemporary OpenGL, X, and other drivers is huge, and reworking them to
1121 * use a different way to mmap a buffer rather invasive.
1122 *
1123 * The assumption in the current dma-buf interfaces is that redirecting the
1124 * initial mmap is all that's needed. A survey of some of the existing
1125 * subsystems shows that no driver seems to do any nefarious thing like
1126 * syncing up with outstanding asynchronous processing on the device or
1127 * allocating special resources at fault time. So hopefully this is good
1128 * enough, since adding interfaces to intercept pagefaults and allow pte
1129 * shootdowns would increase the complexity quite a bit.
1130 *
1131 * Interface::
85804b70 1132 *
0959a168
DV
1133 * int dma_buf_mmap(struct dma_buf \*, struct vm_area_struct \*,
1134 * unsigned long);
1135 *
1136 * If the importing subsystem simply provides a special-purpose mmap call to
85804b70 1137 * set up a mapping in userspace, calling do_mmap with &dma_buf.file will
0959a168
DV
1138 * equally achieve that for a dma-buf object.
1139 */
1140
ae4e46b1
CW
1141static int __dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
1142 enum dma_data_direction direction)
1143{
1144 bool write = (direction == DMA_BIDIRECTIONAL ||
1145 direction == DMA_TO_DEVICE);
52791eee 1146 struct dma_resv *resv = dmabuf->resv;
ae4e46b1
CW
1147 long ret;
1148
1149 /* Wait on any implicit rendering fences */
d3fae3b3 1150 ret = dma_resv_wait_timeout(resv, write, true, MAX_SCHEDULE_TIMEOUT);
ae4e46b1
CW
1151 if (ret < 0)
1152 return ret;
1153
1154 return 0;
1155}
fc13020e
DV
1156
1157/**
1158 * dma_buf_begin_cpu_access - Must be called before accessing a dma_buf from the
1159 * cpu in the kernel context. Calls begin_cpu_access to allow exporter-specific
1160 * preparations. Coherency is only guaranteed in the specified range for the
1161 * specified access direction.
efb4df82 1162 * @dmabuf: [in] buffer to prepare cpu access for.
fc13020e
DV
1163 * @direction: [in] length of range for cpu access.
1164 *
0959a168
DV
1165 * After the cpu access is complete the caller should call
1166 * dma_buf_end_cpu_access(). Only when cpu access is braketed by both calls is
1167 * it guaranteed to be coherent with other DMA access.
1168 *
de9114ec
DV
1169 * This function will also wait for any DMA transactions tracked through
1170 * implicit synchronization in &dma_buf.resv. For DMA transactions with explicit
1171 * synchronization this function will only ensure cache coherency, callers must
1172 * ensure synchronization with such DMA transactions on their own.
1173 *
fc13020e
DV
1174 * Can return negative error values, returns 0 on success.
1175 */
831e9da7 1176int dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
fc13020e
DV
1177 enum dma_data_direction direction)
1178{
1179 int ret = 0;
1180
1181 if (WARN_ON(!dmabuf))
1182 return -EINVAL;
1183
8ccf0a29
DV
1184 might_lock(&dmabuf->resv->lock.base);
1185
fc13020e 1186 if (dmabuf->ops->begin_cpu_access)
831e9da7 1187 ret = dmabuf->ops->begin_cpu_access(dmabuf, direction);
fc13020e 1188
ae4e46b1
CW
1189 /* Ensure that all fences are waited upon - but we first allow
1190 * the native handler the chance to do so more efficiently if it
1191 * chooses. A double invocation here will be reasonably cheap no-op.
1192 */
1193 if (ret == 0)
1194 ret = __dma_buf_begin_cpu_access(dmabuf, direction);
1195
fc13020e
DV
1196 return ret;
1197}
1198EXPORT_SYMBOL_GPL(dma_buf_begin_cpu_access);
1199
1200/**
1201 * dma_buf_end_cpu_access - Must be called after accessing a dma_buf from the
1202 * cpu in the kernel context. Calls end_cpu_access to allow exporter-specific
1203 * actions. Coherency is only guaranteed in the specified range for the
1204 * specified access direction.
efb4df82 1205 * @dmabuf: [in] buffer to complete cpu access for.
fc13020e
DV
1206 * @direction: [in] length of range for cpu access.
1207 *
0959a168
DV
1208 * This terminates CPU access started with dma_buf_begin_cpu_access().
1209 *
87e332d5 1210 * Can return negative error values, returns 0 on success.
fc13020e 1211 */
18b862dc
CW
1212int dma_buf_end_cpu_access(struct dma_buf *dmabuf,
1213 enum dma_data_direction direction)
fc13020e 1214{
18b862dc
CW
1215 int ret = 0;
1216
fc13020e
DV
1217 WARN_ON(!dmabuf);
1218
8ccf0a29
DV
1219 might_lock(&dmabuf->resv->lock.base);
1220
fc13020e 1221 if (dmabuf->ops->end_cpu_access)
18b862dc
CW
1222 ret = dmabuf->ops->end_cpu_access(dmabuf, direction);
1223
1224 return ret;
fc13020e
DV
1225}
1226EXPORT_SYMBOL_GPL(dma_buf_end_cpu_access);
1227
4c78513e
DV
1228
1229/**
1230 * dma_buf_mmap - Setup up a userspace mmap with the given vma
12c4727e 1231 * @dmabuf: [in] buffer that should back the vma
4c78513e
DV
1232 * @vma: [in] vma for the mmap
1233 * @pgoff: [in] offset in pages where this mmap should start within the
5136629d 1234 * dma-buf buffer.
4c78513e
DV
1235 *
1236 * This function adjusts the passed in vma so that it points at the file of the
ecf1dbac 1237 * dma_buf operation. It also adjusts the starting pgoff and does bounds
4c78513e
DV
1238 * checking on the size of the vma. Then it calls the exporters mmap function to
1239 * set up the mapping.
1240 *
1241 * Can return negative error values, returns 0 on success.
1242 */
1243int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
1244 unsigned long pgoff)
1245{
1246 if (WARN_ON(!dmabuf || !vma))
1247 return -EINVAL;
1248
e3a9d6c5
AD
1249 /* check if buffer supports mmap */
1250 if (!dmabuf->ops->mmap)
1251 return -EINVAL;
1252
4c78513e 1253 /* check for offset overflow */
b02da6f8 1254 if (pgoff + vma_pages(vma) < pgoff)
4c78513e
DV
1255 return -EOVERFLOW;
1256
1257 /* check for overflowing the buffer's size */
b02da6f8 1258 if (pgoff + vma_pages(vma) >
4c78513e
DV
1259 dmabuf->size >> PAGE_SHIFT)
1260 return -EINVAL;
1261
1262 /* readjust the vma */
295992fb 1263 vma_set_file(vma, dmabuf->file);
4c78513e
DV
1264 vma->vm_pgoff = pgoff;
1265
1527f926 1266 return dmabuf->ops->mmap(dmabuf, vma);
4c78513e
DV
1267}
1268EXPORT_SYMBOL_GPL(dma_buf_mmap);
98f86c9e
DA
1269
1270/**
12c4727e
SS
1271 * dma_buf_vmap - Create virtual mapping for the buffer object into kernel
1272 * address space. Same restrictions as for vmap and friends apply.
1273 * @dmabuf: [in] buffer to vmap
6619ccf1 1274 * @map: [out] returns the vmap pointer
98f86c9e
DA
1275 *
1276 * This call may fail due to lack of virtual mapping address space.
1277 * These calls are optional in drivers. The intended use for them
1278 * is for mapping objects linear in kernel space for high use objects.
de9114ec
DV
1279 *
1280 * To ensure coherency users must call dma_buf_begin_cpu_access() and
1281 * dma_buf_end_cpu_access() around any cpu access performed through this
1282 * mapping.
fee0c54e 1283 *
6619ccf1 1284 * Returns 0 on success, or a negative errno code otherwise.
98f86c9e 1285 */
6619ccf1 1286int dma_buf_vmap(struct dma_buf *dmabuf, struct dma_buf_map *map)
98f86c9e 1287{
6619ccf1
TZ
1288 struct dma_buf_map ptr;
1289 int ret = 0;
1290
1291 dma_buf_map_clear(map);
f00b4dad 1292
98f86c9e 1293 if (WARN_ON(!dmabuf))
6619ccf1 1294 return -EINVAL;
98f86c9e 1295
f00b4dad 1296 if (!dmabuf->ops->vmap)
6619ccf1 1297 return -EINVAL;
f00b4dad
DV
1298
1299 mutex_lock(&dmabuf->lock);
1300 if (dmabuf->vmapping_counter) {
1301 dmabuf->vmapping_counter++;
01fd30da 1302 BUG_ON(dma_buf_map_is_null(&dmabuf->vmap_ptr));
6619ccf1 1303 *map = dmabuf->vmap_ptr;
f00b4dad
DV
1304 goto out_unlock;
1305 }
1306
01fd30da 1307 BUG_ON(dma_buf_map_is_set(&dmabuf->vmap_ptr));
f00b4dad 1308
6619ccf1
TZ
1309 ret = dmabuf->ops->vmap(dmabuf, &ptr);
1310 if (WARN_ON_ONCE(ret))
f00b4dad
DV
1311 goto out_unlock;
1312
6619ccf1 1313 dmabuf->vmap_ptr = ptr;
f00b4dad
DV
1314 dmabuf->vmapping_counter = 1;
1315
6619ccf1
TZ
1316 *map = dmabuf->vmap_ptr;
1317
f00b4dad
DV
1318out_unlock:
1319 mutex_unlock(&dmabuf->lock);
6619ccf1 1320 return ret;
98f86c9e
DA
1321}
1322EXPORT_SYMBOL_GPL(dma_buf_vmap);
1323
1324/**
1325 * dma_buf_vunmap - Unmap a vmap obtained by dma_buf_vmap.
12c4727e 1326 * @dmabuf: [in] buffer to vunmap
20e76f1a 1327 * @map: [in] vmap pointer to vunmap
98f86c9e 1328 */
20e76f1a 1329void dma_buf_vunmap(struct dma_buf *dmabuf, struct dma_buf_map *map)
98f86c9e
DA
1330{
1331 if (WARN_ON(!dmabuf))
1332 return;
1333
01fd30da 1334 BUG_ON(dma_buf_map_is_null(&dmabuf->vmap_ptr));
f00b4dad 1335 BUG_ON(dmabuf->vmapping_counter == 0);
20e76f1a 1336 BUG_ON(!dma_buf_map_is_equal(&dmabuf->vmap_ptr, map));
f00b4dad
DV
1337
1338 mutex_lock(&dmabuf->lock);
1339 if (--dmabuf->vmapping_counter == 0) {
1340 if (dmabuf->ops->vunmap)
20e76f1a 1341 dmabuf->ops->vunmap(dmabuf, map);
01fd30da 1342 dma_buf_map_clear(&dmabuf->vmap_ptr);
f00b4dad
DV
1343 }
1344 mutex_unlock(&dmabuf->lock);
98f86c9e
DA
1345}
1346EXPORT_SYMBOL_GPL(dma_buf_vunmap);
b89e3563
SS
1347
1348#ifdef CONFIG_DEBUG_FS
eb0b947e 1349static int dma_buf_debug_show(struct seq_file *s, void *unused)
b89e3563 1350{
b89e3563
SS
1351 struct dma_buf *buf_obj;
1352 struct dma_buf_attachment *attach_obj;
52791eee
CK
1353 struct dma_resv *robj;
1354 struct dma_resv_list *fobj;
5eb2c72c 1355 struct dma_fence *fence;
5eb2c72c 1356 int count = 0, attach_count, shared_count, i;
b89e3563 1357 size_t size = 0;
680753dd 1358 int ret;
b89e3563
SS
1359
1360 ret = mutex_lock_interruptible(&db_list.lock);
1361
1362 if (ret)
1363 return ret;
1364
c0b00a52 1365 seq_puts(s, "\nDma-buf Objects:\n");
ed63bb1d
GH
1366 seq_printf(s, "%-8s\t%-8s\t%-8s\t%-8s\texp_name\t%-8s\n",
1367 "size", "flags", "mode", "count", "ino");
b89e3563
SS
1368
1369 list_for_each_entry(buf_obj, &db_list.head, list_node) {
15fd552d 1370
15fd552d
CK
1371 ret = dma_resv_lock_interruptible(buf_obj->resv, NULL);
1372 if (ret)
f45f57cc 1373 goto error_unlock;
b89e3563 1374
bb2bb903 1375 seq_printf(s, "%08zu\t%08x\t%08x\t%08ld\t%s\t%08lu\t%s\n",
c0b00a52 1376 buf_obj->size,
b89e3563 1377 buf_obj->file->f_flags, buf_obj->file->f_mode,
a1f6dbac 1378 file_count(buf_obj->file),
ed63bb1d 1379 buf_obj->exp_name,
bb2bb903
GH
1380 file_inode(buf_obj->file)->i_ino,
1381 buf_obj->name ?: "");
b89e3563 1382
5eb2c72c 1383 robj = buf_obj->resv;
6edbd6ab 1384 fence = dma_resv_excl_fence(robj);
5eb2c72c
RK
1385 if (fence)
1386 seq_printf(s, "\tExclusive fence: %s %s %ssignalled\n",
1387 fence->ops->get_driver_name(fence),
1388 fence->ops->get_timeline_name(fence),
1389 dma_fence_is_signaled(fence) ? "" : "un");
680753dd
CK
1390
1391 fobj = rcu_dereference_protected(robj->fence,
1392 dma_resv_held(robj));
1393 shared_count = fobj ? fobj->shared_count : 0;
5eb2c72c 1394 for (i = 0; i < shared_count; i++) {
680753dd
CK
1395 fence = rcu_dereference_protected(fobj->shared[i],
1396 dma_resv_held(robj));
5eb2c72c
RK
1397 seq_printf(s, "\tShared fence: %s %s %ssignalled\n",
1398 fence->ops->get_driver_name(fence),
1399 fence->ops->get_timeline_name(fence),
1400 dma_fence_is_signaled(fence) ? "" : "un");
1401 }
5eb2c72c 1402
c0b00a52 1403 seq_puts(s, "\tAttached Devices:\n");
b89e3563
SS
1404 attach_count = 0;
1405
1406 list_for_each_entry(attach_obj, &buf_obj->attachments, node) {
9eddb41d 1407 seq_printf(s, "\t%s\n", dev_name(attach_obj->dev));
b89e3563
SS
1408 attach_count++;
1409 }
15fd552d 1410 dma_resv_unlock(buf_obj->resv);
b89e3563 1411
c0b00a52 1412 seq_printf(s, "Total %d devices attached\n\n",
b89e3563
SS
1413 attach_count);
1414
1415 count++;
1416 size += buf_obj->size;
b89e3563
SS
1417 }
1418
1419 seq_printf(s, "\nTotal %d objects, %zu bytes\n", count, size);
1420
1421 mutex_unlock(&db_list.lock);
1422 return 0;
15fd552d 1423
f45f57cc 1424error_unlock:
15fd552d
CK
1425 mutex_unlock(&db_list.lock);
1426 return ret;
b89e3563
SS
1427}
1428
2674305a 1429DEFINE_SHOW_ATTRIBUTE(dma_buf_debug);
b89e3563
SS
1430
1431static struct dentry *dma_buf_debugfs_dir;
1432
1433static int dma_buf_init_debugfs(void)
1434{
bd3e2208 1435 struct dentry *d;
b89e3563 1436 int err = 0;
5136629d 1437
bd3e2208
MK
1438 d = debugfs_create_dir("dma_buf", NULL);
1439 if (IS_ERR(d))
1440 return PTR_ERR(d);
5136629d 1441
bd3e2208 1442 dma_buf_debugfs_dir = d;
b89e3563 1443
bd3e2208
MK
1444 d = debugfs_create_file("bufinfo", S_IRUGO, dma_buf_debugfs_dir,
1445 NULL, &dma_buf_debug_fops);
1446 if (IS_ERR(d)) {
b89e3563 1447 pr_debug("dma_buf: debugfs: failed to create node bufinfo\n");
b7479990
MK
1448 debugfs_remove_recursive(dma_buf_debugfs_dir);
1449 dma_buf_debugfs_dir = NULL;
bd3e2208 1450 err = PTR_ERR(d);
b7479990 1451 }
b89e3563
SS
1452
1453 return err;
1454}
1455
1456static void dma_buf_uninit_debugfs(void)
1457{
298b6a81 1458 debugfs_remove_recursive(dma_buf_debugfs_dir);
b89e3563 1459}
b89e3563
SS
1460#else
1461static inline int dma_buf_init_debugfs(void)
1462{
1463 return 0;
1464}
1465static inline void dma_buf_uninit_debugfs(void)
1466{
1467}
1468#endif
1469
1470static int __init dma_buf_init(void)
1471{
ed63bb1d
GH
1472 dma_buf_mnt = kern_mount(&dma_buf_fs_type);
1473 if (IS_ERR(dma_buf_mnt))
1474 return PTR_ERR(dma_buf_mnt);
1475
b89e3563
SS
1476 mutex_init(&db_list.lock);
1477 INIT_LIST_HEAD(&db_list.head);
1478 dma_buf_init_debugfs();
1479 return 0;
1480}
1481subsys_initcall(dma_buf_init);
1482
1483static void __exit dma_buf_deinit(void)
1484{
1485 dma_buf_uninit_debugfs();
ed63bb1d 1486 kern_unmount(dma_buf_mnt);
b89e3563
SS
1487}
1488__exitcall(dma_buf_deinit);