drivers/dma-buf/dma-buf.c

   1 /*
   2  * Framework for buffer objects that can be shared across devices/subsystems.
   3  *
   4  * Copyright(C) 2011 Linaro Limited. All rights reserved.
   5  * Author: Sumit Semwal <sumit.semwal@ti.com>
   6  *
   7  * Many thanks to linaro-mm-sig list, and specially
   8  * Arnd Bergmann <arnd@arndb.de>, Rob Clark <rob@ti.com> and
   9  * Daniel Vetter <daniel@ffwll.ch> for their support in creation and
  10  * refining of this idea.
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License version 2 as published by
  14  * the Free Software Foundation.
  15  *
  16  * This program is distributed in the hope that it will be useful, but WITHOUT
  17  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  18  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  19  * more details.
  20  *
  21  * You should have received a copy of the GNU General Public License along with
  22  * this program.  If not, see <http://www.gnu.org/licenses/>.
  23  */
  24
  25 #include <linux/fs.h>
  26 #include <linux/slab.h>
  27 #include <linux/dma-buf.h>
  28 #include <linux/fence.h>
  29 #include <linux/anon_inodes.h>
  30 #include <linux/export.h>
  31 #include <linux/debugfs.h>
  32 #include <linux/module.h>
  33 #include <linux/seq_file.h>
  34 #include <linux/poll.h>
  35 #include <linux/reservation.h>
  36
  37 #include <uapi/linux/dma-buf.h>
  38
  39 static inline int is_dma_buf_file(struct file *);
  40
  41 struct dma_buf_list {
  42         struct list_head head;
  43         struct mutex lock;
  44 };
  45
  46 static struct dma_buf_list db_list;
  47
  48 static int dma_buf_release(struct inode *inode, struct file *file)
  49 {
  50         struct dma_buf *dmabuf;
  51
  52         if (!is_dma_buf_file(file))
  53                 return -EINVAL;
  54
  55         dmabuf = file->private_data;
  56
  57         BUG_ON(dmabuf->vmapping_counter);
  58
  59         /*
  60          * Any fences that a dma-buf poll can wait on should be signaled
  61          * before releasing dma-buf. This is the responsibility of each
  62          * driver that uses the reservation objects.
  63          *
  64          * If you hit this BUG() it means someone dropped their ref to the
  65          * dma-buf while still having pending operation to the buffer.
  66          */
  67         BUG_ON(dmabuf->cb_shared.active || dmabuf->cb_excl.active);
  68
  69         dmabuf->ops->release(dmabuf);
  70
  71         mutex_lock(&db_list.lock);
  72         list_del(&dmabuf->list_node);
  73         mutex_unlock(&db_list.lock);
  74
  75         if (dmabuf->resv == (struct reservation_object *)&dmabuf[1])
  76                 reservation_object_fini(dmabuf->resv);
  77
  78         module_put(dmabuf->owner);
  79         kfree(dmabuf);
  80         return 0;
  81 }
  82
  83 static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma)
  84 {
  85         struct dma_buf *dmabuf;
  86
  87         if (!is_dma_buf_file(file))
  88                 return -EINVAL;
  89
  90         dmabuf = file->private_data;
  91
  92         /* check for overflowing the buffer's size */
  93         if (vma->vm_pgoff + ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT) >
  94             dmabuf->size >> PAGE_SHIFT)
  95                 return -EINVAL;
  96
  97         return dmabuf->ops->mmap(dmabuf, vma);
  98 }
  99
 100 static loff_t dma_buf_llseek(struct file *file, loff_t offset, int whence)
 101 {
 102         struct dma_buf *dmabuf;
 103         loff_t base;
 104
 105         if (!is_dma_buf_file(file))
 106                 return -EBADF;
 107
 108         dmabuf = file->private_data;
 109
 110         /* only support discovering the end of the buffer,
 111            but also allow SEEK_SET to maintain the idiomatic
 112            SEEK_END(0), SEEK_CUR(0) pattern */
 113         if (whence == SEEK_END)
 114                 base = dmabuf->size;
 115         else if (whence == SEEK_SET)
 116                 base = 0;
 117         else
 118                 return -EINVAL;
 119
 120         if (offset != 0)
 121                 return -EINVAL;
 122
 123         return base + offset;
 124 }
 125
 126 static void dma_buf_poll_cb(struct fence *fence, struct fence_cb *cb)
 127 {
 128         struct dma_buf_poll_cb_t *dcb = (struct dma_buf_poll_cb_t *)cb;
 129         unsigned long flags;
 130
 131         spin_lock_irqsave(&dcb->poll->lock, flags);
 132         wake_up_locked_poll(dcb->poll, dcb->active);
 133         dcb->active = 0;
 134         spin_unlock_irqrestore(&dcb->poll->lock, flags);
 135 }
 136
 137 static unsigned int dma_buf_poll(struct file *file, poll_table *poll)
 138 {
 139         struct dma_buf *dmabuf;
 140         struct reservation_object *resv;
 141         struct reservation_object_list *fobj;
 142         struct fence *fence_excl;
 143         unsigned long events;
 144         unsigned shared_count, seq;
 145
 146         dmabuf = file->private_data;
 147         if (!dmabuf || !dmabuf->resv)
 148                 return POLLERR;
 149
 150         resv = dmabuf->resv;
 151
 152         poll_wait(file, &dmabuf->poll, poll);
 153
 154         events = poll_requested_events(poll) & (POLLIN | POLLOUT);
 155         if (!events)
 156                 return 0;
 157
 158 retry:
 159         seq = read_seqcount_begin(&resv->seq);
 160         rcu_read_lock();
 161
 162         fobj = rcu_dereference(resv->fence);
 163         if (fobj)
 164                 shared_count = fobj->shared_count;
 165         else
 166                 shared_count = 0;
 167         fence_excl = rcu_dereference(resv->fence_excl);
 168         if (read_seqcount_retry(&resv->seq, seq)) {
 169                 rcu_read_unlock();
 170                 goto retry;
 171         }
 172
 173         if (fence_excl && (!(events & POLLOUT) || shared_count == 0)) {
 174                 struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_excl;
 175                 unsigned long pevents = POLLIN;
 176
 177                 if (shared_count == 0)
 178                         pevents |= POLLOUT;
 179
 180                 spin_lock_irq(&dmabuf->poll.lock);
 181                 if (dcb->active) {
 182                         dcb->active |= pevents;
 183                         events &= ~pevents;
 184                 } else
 185                         dcb->active = pevents;
 186                 spin_unlock_irq(&dmabuf->poll.lock);
 187
 188                 if (events & pevents) {
 189                         if (!fence_get_rcu(fence_excl)) {
 190                                 /* force a recheck */
 191                                 events &= ~pevents;
 192                                 dma_buf_poll_cb(NULL, &dcb->cb);
 193                         } else if (!fence_add_callback(fence_excl, &dcb->cb,
 194                                                        dma_buf_poll_cb)) {
 195                                 events &= ~pevents;
 196                                 fence_put(fence_excl);
 197                         } else {
 198                                 /*
 199                                  * No callback queued, wake up any additional
 200                                  * waiters.
 201                                  */
 202                                 fence_put(fence_excl);
 203                                 dma_buf_poll_cb(NULL, &dcb->cb);
 204                         }
 205                 }
 206         }
 207
 208         if ((events & POLLOUT) && shared_count > 0) {
 209                 struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_shared;
 210                 int i;
 211
 212                 /* Only queue a new callback if no event has fired yet */
 213                 spin_lock_irq(&dmabuf->poll.lock);
 214                 if (dcb->active)
 215                         events &= ~POLLOUT;
 216                 else
 217                         dcb->active = POLLOUT;
 218                 spin_unlock_irq(&dmabuf->poll.lock);
 219
 220                 if (!(events & POLLOUT))
 221                         goto out;
 222
 223                 for (i = 0; i < shared_count; ++i) {
 224                         struct fence *fence = rcu_dereference(fobj->shared[i]);
 225
 226                         if (!fence_get_rcu(fence)) {
 227                                 /*
 228                                  * fence refcount dropped to zero, this means
 229                                  * that fobj has been freed
 230                                  *
 231                                  * call dma_buf_poll_cb and force a recheck!
 232                                  */
 233                                 events &= ~POLLOUT;
 234                                 dma_buf_poll_cb(NULL, &dcb->cb);
 235                                 break;
 236                         }
 237                         if (!fence_add_callback(fence, &dcb->cb,
 238                                                 dma_buf_poll_cb)) {
 239                                 fence_put(fence);
 240                                 events &= ~POLLOUT;
 241                                 break;
 242                         }
 243                         fence_put(fence);
 244                 }
 245
 246                 /* No callback queued, wake up any additional waiters. */
 247                 if (i == shared_count)
 248                         dma_buf_poll_cb(NULL, &dcb->cb);
 249         }
 250
 251 out:
 252         rcu_read_unlock();
 253         return events;
 254 }
 255
 256 static long dma_buf_ioctl(struct file *file,
 257                           unsigned int cmd, unsigned long arg)
 258 {
 259         struct dma_buf *dmabuf;
 260         struct dma_buf_sync sync;
 261         enum dma_data_direction direction;
 262
 263         dmabuf = file->private_data;
 264
 265         switch (cmd) {
 266         case DMA_BUF_IOCTL_SYNC:
 267                 if (copy_from_user(&sync, (void __user *) arg, sizeof(sync)))
 268                         return -EFAULT;
 269
 270                 if (sync.flags & ~DMA_BUF_SYNC_VALID_FLAGS_MASK)
 271                         return -EINVAL;
 272
 273                 switch (sync.flags & DMA_BUF_SYNC_RW) {
 274                 case DMA_BUF_SYNC_READ:
 275                         direction = DMA_FROM_DEVICE;
 276                         break;
 277                 case DMA_BUF_SYNC_WRITE:
 278                         direction = DMA_TO_DEVICE;
 279                         break;
 280                 case DMA_BUF_SYNC_RW:
 281                         direction = DMA_BIDIRECTIONAL;
 282                         break;
 283                 default:
 284                         return -EINVAL;
 285                 }
 286
 287                 if (sync.flags & DMA_BUF_SYNC_END)
 288                         dma_buf_end_cpu_access(dmabuf, direction);
 289                 else
 290                         dma_buf_begin_cpu_access(dmabuf, direction);
 291
 292                 return 0;
 293         default:
 294                 return -ENOTTY;
 295         }
 296 }
 297
 298 static const struct file_operations dma_buf_fops = {
 299         .release        = dma_buf_release,
 300         .mmap           = dma_buf_mmap_internal,
 301         .llseek         = dma_buf_llseek,
 302         .poll           = dma_buf_poll,
 303         .unlocked_ioctl = dma_buf_ioctl,
 304 };
 305
 306 /*
 307  * is_dma_buf_file - Check if struct file* is associated with dma_buf
 308  */
 309 static inline int is_dma_buf_file(struct file *file)
 310 {
 311         return file->f_op == &dma_buf_fops;
 312 }
 313
 314 /**
 315  * dma_buf_export - Creates a new dma_buf, and associates an anon file
 316  * with this buffer, so it can be exported.
 317  * Also connect the allocator specific data and ops to the buffer.
 318  * Additionally, provide a name string for exporter; useful in debugging.
 319  *
 320  * @exp_info:   [in]    holds all the export related information provided
 321  *                      by the exporter. see struct dma_buf_export_info
 322  *                      for further details.
 323  *
 324  * Returns, on success, a newly created dma_buf object, which wraps the
 325  * supplied private data and operations for dma_buf_ops. On either missing
 326  * ops, or error in allocating struct dma_buf, will return negative error.
 327  *
 328  */
 329 struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
 330 {
 331         struct dma_buf *dmabuf;
 332         struct reservation_object *resv = exp_info->resv;
 333         struct file *file;
 334         size_t alloc_size = sizeof(struct dma_buf);
 335
 336         if (!exp_info->resv)
 337                 alloc_size += sizeof(struct reservation_object);
 338         else
 339                 /* prevent &dma_buf[1] == dma_buf->resv */
 340                 alloc_size += 1;
 341
 342         if (WARN_ON(!exp_info->priv
 343                           || !exp_info->ops
 344                           || !exp_info->ops->map_dma_buf
 345                           || !exp_info->ops->unmap_dma_buf
 346                           || !exp_info->ops->release
 347                           || !exp_info->ops->kmap_atomic
 348                           || !exp_info->ops->kmap
 349                           || !exp_info->ops->mmap)) {
 350                 return ERR_PTR(-EINVAL);
 351         }
 352
 353         if (!try_module_get(exp_info->owner))
 354                 return ERR_PTR(-ENOENT);
 355
 356         dmabuf = kzalloc(alloc_size, GFP_KERNEL);
 357         if (!dmabuf) {
 358                 module_put(exp_info->owner);
 359                 return ERR_PTR(-ENOMEM);
 360         }
 361
 362         dmabuf->priv = exp_info->priv;
 363         dmabuf->ops = exp_info->ops;
 364         dmabuf->size = exp_info->size;
 365         dmabuf->exp_name = exp_info->exp_name;
 366         dmabuf->owner = exp_info->owner;
 367         init_waitqueue_head(&dmabuf->poll);
 368         dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll;
 369         dmabuf->cb_excl.active = dmabuf->cb_shared.active = 0;
 370
 371         if (!resv) {
 372                 resv = (struct reservation_object *)&dmabuf[1];
 373                 reservation_object_init(resv);
 374         }
 375         dmabuf->resv = resv;
 376
 377         file = anon_inode_getfile("dmabuf", &dma_buf_fops, dmabuf,
 378                                         exp_info->flags);
 379         if (IS_ERR(file)) {
 380                 kfree(dmabuf);
 381                 return ERR_CAST(file);
 382         }
 383
 384         file->f_mode |= FMODE_LSEEK;
 385         dmabuf->file = file;
 386
 387         mutex_init(&dmabuf->lock);
 388         INIT_LIST_HEAD(&dmabuf->attachments);
 389
 390         mutex_lock(&db_list.lock);
 391         list_add(&dmabuf->list_node, &db_list.head);
 392         mutex_unlock(&db_list.lock);
 393
 394         return dmabuf;
 395 }
 396 EXPORT_SYMBOL_GPL(dma_buf_export);
 397
 398 /**
 399  * dma_buf_fd - returns a file descriptor for the given dma_buf
 400  * @dmabuf:     [in]    pointer to dma_buf for which fd is required.
 401  * @flags:      [in]    flags to give to fd
 402  *
 403  * On success, returns an associated 'fd'. Else, returns error.
 404  */
 405 int dma_buf_fd(struct dma_buf *dmabuf, int flags)
 406 {
 407         int fd;
 408
 409         if (!dmabuf || !dmabuf->file)
 410                 return -EINVAL;
 411
 412         fd = get_unused_fd_flags(flags);
 413         if (fd < 0)
 414                 return fd;
 415
 416         fd_install(fd, dmabuf->file);
 417
 418         return fd;
 419 }
 420 EXPORT_SYMBOL_GPL(dma_buf_fd);
 421
 422 /**
 423  * dma_buf_get - returns the dma_buf structure related to an fd
 424  * @fd: [in]    fd associated with the dma_buf to be returned
 425  *
 426  * On success, returns the dma_buf structure associated with an fd; uses
 427  * file's refcounting done by fget to increase refcount. returns ERR_PTR
 428  * otherwise.
 429  */
 430 struct dma_buf *dma_buf_get(int fd)
 431 {
 432         struct file *file;
 433
 434         file = fget(fd);
 435
 436         if (!file)
 437                 return ERR_PTR(-EBADF);
 438
 439         if (!is_dma_buf_file(file)) {
 440                 fput(file);
 441                 return ERR_PTR(-EINVAL);
 442         }
 443
 444         return file->private_data;
 445 }
 446 EXPORT_SYMBOL_GPL(dma_buf_get);
 447
 448 /**
 449  * dma_buf_put - decreases refcount of the buffer
 450  * @dmabuf:     [in]    buffer to reduce refcount of
 451  *
 452  * Uses file's refcounting done implicitly by fput()
 453  */
 454 void dma_buf_put(struct dma_buf *dmabuf)
 455 {
 456         if (WARN_ON(!dmabuf || !dmabuf->file))
 457                 return;
 458
 459         fput(dmabuf->file);
 460 }
 461 EXPORT_SYMBOL_GPL(dma_buf_put);
 462
 463 /**
 464  * dma_buf_attach - Add the device to dma_buf's attachments list; optionally,
 465  * calls attach() of dma_buf_ops to allow device-specific attach functionality
 466  * @dmabuf:     [in]    buffer to attach device to.
 467  * @dev:        [in]    device to be attached.
 468  *
 469  * Returns struct dma_buf_attachment * for this attachment; returns ERR_PTR on
 470  * error.
 471  */
 472 struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf,
 473                                           struct device *dev)
 474 {
 475         struct dma_buf_attachment *attach;
 476         int ret;
 477
 478         if (WARN_ON(!dmabuf || !dev))
 479                 return ERR_PTR(-EINVAL);
 480
 481         attach = kzalloc(sizeof(struct dma_buf_attachment), GFP_KERNEL);
 482         if (attach == NULL)
 483                 return ERR_PTR(-ENOMEM);
 484
 485         attach->dev = dev;
 486         attach->dmabuf = dmabuf;
 487
 488         mutex_lock(&dmabuf->lock);
 489
 490         if (dmabuf->ops->attach) {
 491                 ret = dmabuf->ops->attach(dmabuf, dev, attach);
 492                 if (ret)
 493                         goto err_attach;
 494         }
 495         list_add(&attach->node, &dmabuf->attachments);
 496
 497         mutex_unlock(&dmabuf->lock);
 498         return attach;
 499
 500 err_attach:
 501         kfree(attach);
 502         mutex_unlock(&dmabuf->lock);
 503         return ERR_PTR(ret);
 504 }
 505 EXPORT_SYMBOL_GPL(dma_buf_attach);
 506
 507 /**
 508  * dma_buf_detach - Remove the given attachment from dmabuf's attachments list;
 509  * optionally calls detach() of dma_buf_ops for device-specific detach
 510  * @dmabuf:     [in]    buffer to detach from.
 511  * @attach:     [in]    attachment to be detached; is free'd after this call.
 512  *
 513  */
 514 void dma_buf_detach(struct dma_buf *dmabuf, struct dma_buf_attachment *attach)
 515 {
 516         if (WARN_ON(!dmabuf || !attach))
 517                 return;
 518
 519         mutex_lock(&dmabuf->lock);
 520         list_del(&attach->node);
 521         if (dmabuf->ops->detach)
 522                 dmabuf->ops->detach(dmabuf, attach);
 523
 524         mutex_unlock(&dmabuf->lock);
 525         kfree(attach);
 526 }
 527 EXPORT_SYMBOL_GPL(dma_buf_detach);
 528
 529 /**
 530  * dma_buf_map_attachment - Returns the scatterlist table of the attachment;
 531  * mapped into _device_ address space. Is a wrapper for map_dma_buf() of the
 532  * dma_buf_ops.
 533  * @attach:     [in]    attachment whose scatterlist is to be returned
 534  * @direction:  [in]    direction of DMA transfer
 535  *
 536  * Returns sg_table containing the scatterlist to be returned; returns ERR_PTR
 537  * on error.
 538  */
 539 struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach,
 540                                         enum dma_data_direction direction)
 541 {
 542         struct sg_table *sg_table = ERR_PTR(-EINVAL);
 543
 544         might_sleep();
 545
 546         if (WARN_ON(!attach || !attach->dmabuf))
 547                 return ERR_PTR(-EINVAL);
 548
 549         sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction);
 550         if (!sg_table)
 551                 sg_table = ERR_PTR(-ENOMEM);
 552
 553         return sg_table;
 554 }
 555 EXPORT_SYMBOL_GPL(dma_buf_map_attachment);
 556
 557 /**
 558  * dma_buf_unmap_attachment - unmaps and decreases usecount of the buffer;might
 559  * deallocate the scatterlist associated. Is a wrapper for unmap_dma_buf() of
 560  * dma_buf_ops.
 561  * @attach:     [in]    attachment to unmap buffer from
 562  * @sg_table:   [in]    scatterlist info of the buffer to unmap
 563  * @direction:  [in]    direction of DMA transfer
 564  *
 565  */
 566 void dma_buf_unmap_attachment(struct dma_buf_attachment *attach,
 567                                 struct sg_table *sg_table,
 568                                 enum dma_data_direction direction)
 569 {
 570         might_sleep();
 571
 572         if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
 573                 return;
 574
 575         attach->dmabuf->ops->unmap_dma_buf(attach, sg_table,
 576                                                 direction);
 577 }
 578 EXPORT_SYMBOL_GPL(dma_buf_unmap_attachment);
 579
 580
 581 /**
 582  * dma_buf_begin_cpu_access - Must be called before accessing a dma_buf from the
 583  * cpu in the kernel context. Calls begin_cpu_access to allow exporter-specific
 584  * preparations. Coherency is only guaranteed in the specified range for the
 585  * specified access direction.
 586  * @dmabuf:     [in]    buffer to prepare cpu access for.
 587  * @direction:  [in]    length of range for cpu access.
 588  *
 589  * Can return negative error values, returns 0 on success.
 590  */
 591 int dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
 592                              enum dma_data_direction direction)
 593 {
 594         int ret = 0;
 595
 596         if (WARN_ON(!dmabuf))
 597                 return -EINVAL;
 598
 599         if (dmabuf->ops->begin_cpu_access)
 600                 ret = dmabuf->ops->begin_cpu_access(dmabuf, direction);
 601
 602         return ret;
 603 }
 604 EXPORT_SYMBOL_GPL(dma_buf_begin_cpu_access);
 605
 606 /**
 607  * dma_buf_end_cpu_access - Must be called after accessing a dma_buf from the
 608  * cpu in the kernel context. Calls end_cpu_access to allow exporter-specific
 609  * actions. Coherency is only guaranteed in the specified range for the
 610  * specified access direction.
 611  * @dmabuf:     [in]    buffer to complete cpu access for.
 612  * @direction:  [in]    length of range for cpu access.
 613  *
 614  * This call must always succeed.
 615  */
 616 void dma_buf_end_cpu_access(struct dma_buf *dmabuf,
 617                             enum dma_data_direction direction)
 618 {
 619         WARN_ON(!dmabuf);
 620
 621         if (dmabuf->ops->end_cpu_access)
 622                 dmabuf->ops->end_cpu_access(dmabuf, direction);
 623 }
 624 EXPORT_SYMBOL_GPL(dma_buf_end_cpu_access);
 625
 626 /**
 627  * dma_buf_kmap_atomic - Map a page of the buffer object into kernel address
 628  * space. The same restrictions as for kmap_atomic and friends apply.
 629  * @dmabuf:     [in]    buffer to map page from.
 630  * @page_num:   [in]    page in PAGE_SIZE units to map.
 631  *
 632  * This call must always succeed, any necessary preparations that might fail
 633  * need to be done in begin_cpu_access.
 634  */
 635 void *dma_buf_kmap_atomic(struct dma_buf *dmabuf, unsigned long page_num)
 636 {
 637         WARN_ON(!dmabuf);
 638
 639         return dmabuf->ops->kmap_atomic(dmabuf, page_num);
 640 }
 641 EXPORT_SYMBOL_GPL(dma_buf_kmap_atomic);
 642
 643 /**
 644  * dma_buf_kunmap_atomic - Unmap a page obtained by dma_buf_kmap_atomic.
 645  * @dmabuf:     [in]    buffer to unmap page from.
 646  * @page_num:   [in]    page in PAGE_SIZE units to unmap.
 647  * @vaddr:      [in]    kernel space pointer obtained from dma_buf_kmap_atomic.
 648  *
 649  * This call must always succeed.
 650  */
 651 void dma_buf_kunmap_atomic(struct dma_buf *dmabuf, unsigned long page_num,
 652                            void *vaddr)
 653 {
 654         WARN_ON(!dmabuf);
 655
 656         if (dmabuf->ops->kunmap_atomic)
 657                 dmabuf->ops->kunmap_atomic(dmabuf, page_num, vaddr);
 658 }
 659 EXPORT_SYMBOL_GPL(dma_buf_kunmap_atomic);
 660
 661 /**
 662  * dma_buf_kmap - Map a page of the buffer object into kernel address space. The
 663  * same restrictions as for kmap and friends apply.
 664  * @dmabuf:     [in]    buffer to map page from.
 665  * @page_num:   [in]    page in PAGE_SIZE units to map.
 666  *
 667  * This call must always succeed, any necessary preparations that might fail
 668  * need to be done in begin_cpu_access.
 669  */
 670 void *dma_buf_kmap(struct dma_buf *dmabuf, unsigned long page_num)
 671 {
 672         WARN_ON(!dmabuf);
 673
 674         return dmabuf->ops->kmap(dmabuf, page_num);
 675 }
 676 EXPORT_SYMBOL_GPL(dma_buf_kmap);
 677
 678 /**
 679  * dma_buf_kunmap - Unmap a page obtained by dma_buf_kmap.
 680  * @dmabuf:     [in]    buffer to unmap page from.
 681  * @page_num:   [in]    page in PAGE_SIZE units to unmap.
 682  * @vaddr:      [in]    kernel space pointer obtained from dma_buf_kmap.
 683  *
 684  * This call must always succeed.
 685  */
 686 void dma_buf_kunmap(struct dma_buf *dmabuf, unsigned long page_num,
 687                     void *vaddr)
 688 {
 689         WARN_ON(!dmabuf);
 690
 691         if (dmabuf->ops->kunmap)
 692                 dmabuf->ops->kunmap(dmabuf, page_num, vaddr);
 693 }
 694 EXPORT_SYMBOL_GPL(dma_buf_kunmap);
 695
 696
 697 /**
 698  * dma_buf_mmap - Setup up a userspace mmap with the given vma
 699  * @dmabuf:     [in]    buffer that should back the vma
 700  * @vma:        [in]    vma for the mmap
 701  * @pgoff:      [in]    offset in pages where this mmap should start within the
 702  *                      dma-buf buffer.
 703  *
 704  * This function adjusts the passed in vma so that it points at the file of the
 705  * dma_buf operation. It also adjusts the starting pgoff and does bounds
 706  * checking on the size of the vma. Then it calls the exporters mmap function to
 707  * set up the mapping.
 708  *
 709  * Can return negative error values, returns 0 on success.
 710  */
 711 int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
 712                  unsigned long pgoff)
 713 {
 714         struct file *oldfile;
 715         int ret;
 716
 717         if (WARN_ON(!dmabuf || !vma))
 718                 return -EINVAL;
 719
 720         /* check for offset overflow */
 721         if (pgoff + ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT) < pgoff)
 722                 return -EOVERFLOW;
 723
 724         /* check for overflowing the buffer's size */
 725         if (pgoff + ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT) >
 726             dmabuf->size >> PAGE_SHIFT)
 727                 return -EINVAL;
 728
 729         /* readjust the vma */
 730         get_file(dmabuf->file);
 731         oldfile = vma->vm_file;
 732         vma->vm_file = dmabuf->file;
 733         vma->vm_pgoff = pgoff;
 734
 735         ret = dmabuf->ops->mmap(dmabuf, vma);
 736         if (ret) {
 737                 /* restore old parameters on failure */
 738                 vma->vm_file = oldfile;
 739                 fput(dmabuf->file);
 740         } else {
 741                 if (oldfile)
 742                         fput(oldfile);
 743         }
 744         return ret;
 745
 746 }
 747 EXPORT_SYMBOL_GPL(dma_buf_mmap);
 748
 749 /**
 750  * dma_buf_vmap - Create virtual mapping for the buffer object into kernel
 751  * address space. Same restrictions as for vmap and friends apply.
 752  * @dmabuf:     [in]    buffer to vmap
 753  *
 754  * This call may fail due to lack of virtual mapping address space.
 755  * These calls are optional in drivers. The intended use for them
 756  * is for mapping objects linear in kernel space for high use objects.
 757  * Please attempt to use kmap/kunmap before thinking about these interfaces.
 758  *
 759  * Returns NULL on error.
 760  */
 761 void *dma_buf_vmap(struct dma_buf *dmabuf)
 762 {
 763         void *ptr;
 764
 765         if (WARN_ON(!dmabuf))
 766                 return NULL;
 767
 768         if (!dmabuf->ops->vmap)
 769                 return NULL;
 770
 771         mutex_lock(&dmabuf->lock);
 772         if (dmabuf->vmapping_counter) {
 773                 dmabuf->vmapping_counter++;
 774                 BUG_ON(!dmabuf->vmap_ptr);
 775                 ptr = dmabuf->vmap_ptr;
 776                 goto out_unlock;
 777         }
 778
 779         BUG_ON(dmabuf->vmap_ptr);
 780
 781         ptr = dmabuf->ops->vmap(dmabuf);
 782         if (WARN_ON_ONCE(IS_ERR(ptr)))
 783                 ptr = NULL;
 784         if (!ptr)
 785                 goto out_unlock;
 786
 787         dmabuf->vmap_ptr = ptr;
 788         dmabuf->vmapping_counter = 1;
 789
 790 out_unlock:
 791         mutex_unlock(&dmabuf->lock);
 792         return ptr;
 793 }
 794 EXPORT_SYMBOL_GPL(dma_buf_vmap);
 795
 796 /**
 797  * dma_buf_vunmap - Unmap a vmap obtained by dma_buf_vmap.
 798  * @dmabuf:     [in]    buffer to vunmap
 799  * @vaddr:      [in]    vmap to vunmap
 800  */
 801 void dma_buf_vunmap(struct dma_buf *dmabuf, void *vaddr)
 802 {
 803         if (WARN_ON(!dmabuf))
 804                 return;
 805
 806         BUG_ON(!dmabuf->vmap_ptr);
 807         BUG_ON(dmabuf->vmapping_counter == 0);
 808         BUG_ON(dmabuf->vmap_ptr != vaddr);
 809
 810         mutex_lock(&dmabuf->lock);
 811         if (--dmabuf->vmapping_counter == 0) {
 812                 if (dmabuf->ops->vunmap)
 813                         dmabuf->ops->vunmap(dmabuf, vaddr);
 814                 dmabuf->vmap_ptr = NULL;
 815         }
 816         mutex_unlock(&dmabuf->lock);
 817 }
 818 EXPORT_SYMBOL_GPL(dma_buf_vunmap);
 819
 820 #ifdef CONFIG_DEBUG_FS
 821 static int dma_buf_describe(struct seq_file *s)
 822 {
 823         int ret;
 824         struct dma_buf *buf_obj;
 825         struct dma_buf_attachment *attach_obj;
 826         int count = 0, attach_count;
 827         size_t size = 0;
 828
 829         ret = mutex_lock_interruptible(&db_list.lock);
 830
 831         if (ret)
 832                 return ret;
 833
 834         seq_puts(s, "\nDma-buf Objects:\n");
 835         seq_puts(s, "size\tflags\tmode\tcount\texp_name\n");
 836
 837         list_for_each_entry(buf_obj, &db_list.head, list_node) {
 838                 ret = mutex_lock_interruptible(&buf_obj->lock);
 839
 840                 if (ret) {
 841                         seq_puts(s,
 842                                  "\tERROR locking buffer object: skipping\n");
 843                         continue;
 844                 }
 845
 846                 seq_printf(s, "%08zu\t%08x\t%08x\t%08ld\t%s\n",
 847                                 buf_obj->size,
 848                                 buf_obj->file->f_flags, buf_obj->file->f_mode,
 849                                 file_count(buf_obj->file),
 850                                 buf_obj->exp_name);
 851
 852                 seq_puts(s, "\tAttached Devices:\n");
 853                 attach_count = 0;
 854
 855                 list_for_each_entry(attach_obj, &buf_obj->attachments, node) {
 856                         seq_puts(s, "\t");
 857
 858                         seq_printf(s, "%s\n", dev_name(attach_obj->dev));
 859                         attach_count++;
 860                 }
 861
 862                 seq_printf(s, "Total %d devices attached\n\n",
 863                                 attach_count);
 864
 865                 count++;
 866                 size += buf_obj->size;
 867                 mutex_unlock(&buf_obj->lock);
 868         }
 869
 870         seq_printf(s, "\nTotal %d objects, %zu bytes\n", count, size);
 871
 872         mutex_unlock(&db_list.lock);
 873         return 0;
 874 }
 875
 876 static int dma_buf_show(struct seq_file *s, void *unused)
 877 {
 878         void (*func)(struct seq_file *) = s->private;
 879
 880         func(s);
 881         return 0;
 882 }
 883
 884 static int dma_buf_debug_open(struct inode *inode, struct file *file)
 885 {
 886         return single_open(file, dma_buf_show, inode->i_private);
 887 }
 888
 889 static const struct file_operations dma_buf_debug_fops = {
 890         .open           = dma_buf_debug_open,
 891         .read           = seq_read,
 892         .llseek         = seq_lseek,
 893         .release        = single_release,
 894 };
 895
 896 static struct dentry *dma_buf_debugfs_dir;
 897
 898 static int dma_buf_init_debugfs(void)
 899 {
 900         int err = 0;
 901
 902         dma_buf_debugfs_dir = debugfs_create_dir("dma_buf", NULL);
 903
 904         if (IS_ERR(dma_buf_debugfs_dir)) {
 905                 err = PTR_ERR(dma_buf_debugfs_dir);
 906                 dma_buf_debugfs_dir = NULL;
 907                 return err;
 908         }
 909
 910         err = dma_buf_debugfs_create_file("bufinfo", dma_buf_describe);
 911
 912         if (err)
 913                 pr_debug("dma_buf: debugfs: failed to create node bufinfo\n");
 914
 915         return err;
 916 }
 917
 918 static void dma_buf_uninit_debugfs(void)
 919 {
 920         if (dma_buf_debugfs_dir)
 921                 debugfs_remove_recursive(dma_buf_debugfs_dir);
 922 }
 923
 924 int dma_buf_debugfs_create_file(const char *name,
 925                                 int (*write)(struct seq_file *))
 926 {
 927         struct dentry *d;
 928
 929         d = debugfs_create_file(name, S_IRUGO, dma_buf_debugfs_dir,
 930                         write, &dma_buf_debug_fops);
 931
 932         return PTR_ERR_OR_ZERO(d);
 933 }
 934 #else
 935 static inline int dma_buf_init_debugfs(void)
 936 {
 937         return 0;
 938 }
 939 static inline void dma_buf_uninit_debugfs(void)
 940 {
 941 }
 942 #endif
 943
 944 static int __init dma_buf_init(void)
 945 {
 946         mutex_init(&db_list.lock);
 947         INIT_LIST_HEAD(&db_list.head);
 948         dma_buf_init_debugfs();
 949         return 0;
 950 }
 951 subsys_initcall(dma_buf_init);
 952
 953 static void __exit dma_buf_deinit(void)
 954 {
 955         dma_buf_uninit_debugfs();
 956 }
 957 __exitcall(dma_buf_deinit);