blob: 011415745bd4f7b7b95e3ee7def4bbd701fc3664 [file] [log] [blame]
b.liue9582032025-04-17 19:18:16 +08001// SPDX-License-Identifier: GPL-2.0
2/*
3 * Framework for userspace DMA-BUF allocations
4 *
5 * Copyright (C) 2011 Google, Inc.
6 * Copyright (C) 2019 Linaro Ltd.
7 */
8
9#include <linux/cdev.h>
10#include <linux/debugfs.h>
11#include <linux/device.h>
12#include <linux/dma-buf.h>
13#include <linux/err.h>
14#include <linux/xarray.h>
15#include <linux/list.h>
16#include <linux/slab.h>
17#include <linux/uaccess.h>
18#include <linux/syscalls.h>
19#include <linux/dma-heap.h>
20#include <uapi/linux/dma-heap.h>
21
22#define DEVNAME "dma_heap"
23
24#define NUM_HEAP_MINORS 128
25
26/**
27 * struct dma_heap - represents a dmabuf heap in the system
28 * @name: used for debugging/device-node name
29 * @ops: ops struct for this heap
30 * @heap_devt heap device node
31 * @list list head connecting to list of heaps
32 * @heap_cdev heap char device
33 * @heap_dev heap device struct
34 *
35 * Represents a heap of memory from which buffers can be made.
36 */
37struct dma_heap {
38 const char *name;
39 const struct dma_heap_ops *ops;
40 void *priv;
41 dev_t heap_devt;
42 struct list_head list;
43 struct cdev heap_cdev;
44 struct kref refcount;
45 struct device *heap_dev;
46};
47
48static LIST_HEAD(heap_list);
49static DEFINE_MUTEX(heap_list_lock);
50static dev_t dma_heap_devt;
51static struct class *dma_heap_class;
52static DEFINE_XARRAY_ALLOC(dma_heap_minors);
53
54struct dma_heap *dma_heap_find(const char *name)
55{
56 struct dma_heap *h;
57
58 mutex_lock(&heap_list_lock);
59 list_for_each_entry(h, &heap_list, list) {
60 if (!strcmp(h->name, name)) {
61 kref_get(&h->refcount);
62 mutex_unlock(&heap_list_lock);
63 return h;
64 }
65 }
66 mutex_unlock(&heap_list_lock);
67 return NULL;
68}
69EXPORT_SYMBOL_GPL(dma_heap_find);
70
71
72void dma_heap_buffer_free(struct dma_buf *dmabuf)
73{
74 dma_buf_put(dmabuf);
75}
76EXPORT_SYMBOL_GPL(dma_heap_buffer_free);
77
78struct dma_buf *dma_heap_buffer_alloc(struct dma_heap *heap, size_t len,
79 unsigned int fd_flags,
80 unsigned int heap_flags)
81{
82 if (fd_flags & ~DMA_HEAP_VALID_FD_FLAGS)
83 return ERR_PTR(-EINVAL);
84
85 if (heap_flags & ~DMA_HEAP_VALID_HEAP_FLAGS)
86 return ERR_PTR(-EINVAL);
87 /*
88 * Allocations from all heaps have to begin
89 * and end on page boundaries.
90 */
91 len = PAGE_ALIGN(len);
92 if (!len)
93 return ERR_PTR(-EINVAL);
94
95 return heap->ops->allocate(heap, len, fd_flags, heap_flags);
96}
97EXPORT_SYMBOL_GPL(dma_heap_buffer_alloc);
98
99int dma_heap_bufferfd_alloc(struct dma_heap *heap, size_t len,
100 unsigned int fd_flags,
101 unsigned int heap_flags)
102{
103 struct dma_buf *dmabuf;
104 int fd;
105
106 dmabuf = dma_heap_buffer_alloc(heap, len, fd_flags, heap_flags);
107
108 if (IS_ERR(dmabuf))
109 return PTR_ERR(dmabuf);
110
111 fd = dma_buf_fd(dmabuf, fd_flags);
112 if (fd < 0) {
113 dma_buf_put(dmabuf);
114 /* just return, as put will call release and that will free */
115 }
116 return fd;
117
118}
119EXPORT_SYMBOL_GPL(dma_heap_bufferfd_alloc);
120
121static int dma_heap_open(struct inode *inode, struct file *file)
122{
123 struct dma_heap *heap;
124
125 heap = xa_load(&dma_heap_minors, iminor(inode));
126 if (!heap) {
127 pr_err("dma_heap: minor %d unknown.\n", iminor(inode));
128 return -ENODEV;
129 }
130
131 /* instance data as context */
132 file->private_data = heap;
133 nonseekable_open(inode, file);
134
135 return 0;
136}
137
138static long dma_heap_ioctl_allocate(struct file *file, void *data)
139{
140 struct dma_heap_allocation_data *heap_allocation = data;
141 struct dma_heap *heap = file->private_data;
142 int fd;
143
144 if (heap_allocation->fd)
145 return -EINVAL;
146
147 fd = dma_heap_bufferfd_alloc(heap, heap_allocation->len,
148 heap_allocation->fd_flags,
149 heap_allocation->heap_flags);
150 if (fd < 0)
151 return fd;
152
153 heap_allocation->fd = fd;
154
155 return 0;
156}
157
158static unsigned int dma_heap_ioctl_cmds[] = {
159 DMA_HEAP_IOCTL_ALLOC,
160};
161
162static long dma_heap_ioctl(struct file *file, unsigned int ucmd,
163 unsigned long arg)
164{
165 char stack_kdata[128];
166 char *kdata = stack_kdata;
167 unsigned int kcmd;
168 unsigned int in_size, out_size, drv_size, ksize;
169 int nr = _IOC_NR(ucmd);
170 int ret = 0;
171
172 if (nr >= ARRAY_SIZE(dma_heap_ioctl_cmds))
173 return -EINVAL;
174
175 /* Get the kernel ioctl cmd that matches */
176 kcmd = dma_heap_ioctl_cmds[nr];
177
178 /* Figure out the delta between user cmd size and kernel cmd size */
179 drv_size = _IOC_SIZE(kcmd);
180 out_size = _IOC_SIZE(ucmd);
181 in_size = out_size;
182 if ((ucmd & kcmd & IOC_IN) == 0)
183 in_size = 0;
184 if ((ucmd & kcmd & IOC_OUT) == 0)
185 out_size = 0;
186 ksize = max(max(in_size, out_size), drv_size);
187
188 /* If necessary, allocate buffer for ioctl argument */
189 if (ksize > sizeof(stack_kdata)) {
190 kdata = kmalloc(ksize, GFP_KERNEL);
191 if (!kdata)
192 return -ENOMEM;
193 }
194
195 if (copy_from_user(kdata, (void __user *)arg, in_size) != 0) {
196 ret = -EFAULT;
197 goto err;
198 }
199
200 /* zero out any difference between the kernel/user structure size */
201 if (ksize > in_size)
202 memset(kdata + in_size, 0, ksize - in_size);
203
204 switch (kcmd) {
205 case DMA_HEAP_IOCTL_ALLOC:
206 ret = dma_heap_ioctl_allocate(file, kdata);
207 break;
208 default:
209 ret = -ENOTTY;
210 goto err;
211 }
212
213 if (copy_to_user((void __user *)arg, kdata, out_size) != 0)
214 ret = -EFAULT;
215err:
216 if (kdata != stack_kdata)
217 kfree(kdata);
218 return ret;
219}
220
221static const struct file_operations dma_heap_fops = {
222 .owner = THIS_MODULE,
223 .open = dma_heap_open,
224 .unlocked_ioctl = dma_heap_ioctl,
225#ifdef CONFIG_COMPAT
226 .compat_ioctl = dma_heap_ioctl,
227#endif
228};
229
230/**
231 * dma_heap_get_drvdata() - get per-subdriver data for the heap
232 * @heap: DMA-Heap to retrieve private data for
233 *
234 * Returns:
235 * The per-subdriver data for the heap.
236 */
237void *dma_heap_get_drvdata(struct dma_heap *heap)
238{
239 return heap->priv;
240}
241EXPORT_SYMBOL_GPL(dma_heap_get_drvdata);
242
243static void dma_heap_release(struct kref *ref)
244{
245 struct dma_heap *heap = container_of(ref, struct dma_heap, refcount);
246 int minor = MINOR(heap->heap_devt);
247
248 /* Note, we already holding the heap_list_lock here */
249 list_del(&heap->list);
250
251 device_destroy(dma_heap_class, heap->heap_devt);
252 cdev_del(&heap->heap_cdev);
253 xa_erase(&dma_heap_minors, minor);
254
255 kfree(heap);
256}
257
258void dma_heap_put(struct dma_heap *h)
259{
260 /*
261 * Take the heap_list_lock now to avoid racing with code
262 * scanning the list and then taking a kref.
263 */
264 mutex_lock(&heap_list_lock);
265 kref_put(&h->refcount, dma_heap_release);
266 mutex_unlock(&heap_list_lock);
267}
268EXPORT_SYMBOL_GPL(dma_heap_put);
269
270/**
271 * dma_heap_get_dev() - get device struct for the heap
272 * @heap: DMA-Heap to retrieve device struct from
273 *
274 * Returns:
275 * The device struct for the heap.
276 */
277struct device *dma_heap_get_dev(struct dma_heap *heap)
278{
279 return heap->heap_dev;
280}
281EXPORT_SYMBOL_GPL(dma_heap_get_dev);
282
283/**
284 * dma_heap_get_name() - get heap name
285 * @heap: DMA-Heap to retrieve private data for
286 *
287 * Returns:
288 * The char* for the heap name.
289 */
290const char *dma_heap_get_name(struct dma_heap *heap)
291{
292 return heap->name;
293}
294EXPORT_SYMBOL_GPL(dma_heap_get_name);
295
296struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info)
297{
298 struct dma_heap *heap, *err_ret;
299 unsigned int minor;
300 int ret;
301
302 if (!exp_info->name || !strcmp(exp_info->name, "")) {
303 pr_err("dma_heap: Cannot add heap without a name\n");
304 return ERR_PTR(-EINVAL);
305 }
306
307 if (!exp_info->ops || !exp_info->ops->allocate) {
308 pr_err("dma_heap: Cannot add heap with invalid ops struct\n");
309 return ERR_PTR(-EINVAL);
310 }
311
312 /* check the name is unique */
313 heap = dma_heap_find(exp_info->name);
314 if (heap) {
315 pr_err("dma_heap: Already registered heap named %s\n",
316 exp_info->name);
317 dma_heap_put(heap);
318 return ERR_PTR(-EINVAL);
319 }
320
321 heap = kzalloc(sizeof(*heap), GFP_KERNEL);
322 if (!heap)
323 return ERR_PTR(-ENOMEM);
324
325 kref_init(&heap->refcount);
326 heap->name = exp_info->name;
327 heap->ops = exp_info->ops;
328 heap->priv = exp_info->priv;
329
330 /* Find unused minor number */
331 ret = xa_alloc(&dma_heap_minors, &minor, heap,
332 XA_LIMIT(0, NUM_HEAP_MINORS - 1), GFP_KERNEL);
333 if (ret < 0) {
334 pr_err("dma_heap: Unable to get minor number for heap\n");
335 err_ret = ERR_PTR(ret);
336 goto err0;
337 }
338
339 /* Create device */
340 heap->heap_devt = MKDEV(MAJOR(dma_heap_devt), minor);
341
342 cdev_init(&heap->heap_cdev, &dma_heap_fops);
343 ret = cdev_add(&heap->heap_cdev, heap->heap_devt, 1);
344 if (ret < 0) {
345 pr_err("dma_heap: Unable to add char device\n");
346 err_ret = ERR_PTR(ret);
347 goto err1;
348 }
349
350 heap->heap_dev = device_create(dma_heap_class,
351 NULL,
352 heap->heap_devt,
353 NULL,
354 heap->name);
355 if (IS_ERR(heap->heap_dev)) {
356 pr_err("dma_heap: Unable to create device\n");
357 err_ret = ERR_CAST(heap->heap_dev);
358 goto err2;
359 }
360
361 /* Make sure it doesn't disappear on us */
362 heap->heap_dev = get_device(heap->heap_dev);
363
364 /* Add heap to the list */
365 mutex_lock(&heap_list_lock);
366 list_add(&heap->list, &heap_list);
367 mutex_unlock(&heap_list_lock);
368
369 return heap;
370
371err2:
372 cdev_del(&heap->heap_cdev);
373err1:
374 xa_erase(&dma_heap_minors, minor);
375err0:
376 kfree(heap);
377 return err_ret;
378}
379EXPORT_SYMBOL_GPL(dma_heap_add);
380
381static char *dma_heap_devnode(struct device *dev, umode_t *mode)
382{
383 return kasprintf(GFP_KERNEL, "dma_heap/%s", dev_name(dev));
384}
385
386static int dma_heap_init(void)
387{
388 int ret;
389
390 ret = alloc_chrdev_region(&dma_heap_devt, 0, NUM_HEAP_MINORS, DEVNAME);
391 if (ret)
392 return ret;
393
394 dma_heap_class = class_create(THIS_MODULE, DEVNAME);
395 if (IS_ERR(dma_heap_class)) {
396 unregister_chrdev_region(dma_heap_devt, NUM_HEAP_MINORS);
397 return PTR_ERR(dma_heap_class);
398 }
399 dma_heap_class->devnode = dma_heap_devnode;
400
401 return 0;
402}
403subsys_initcall(dma_heap_init);