drivers/dma-buf/dma-buf.c

   1 /*
   2  * Framework for buffer objects that can be shared across devices/subsystems.
   3  *
   4  * Copyright(C) 2011 Linaro Limited. All rights reserved.
   5  * Author: Sumit Semwal <sumit.semwal@ti.com>
   6  *
   7  * Many thanks to linaro-mm-sig list, and specially
   8  * Arnd Bergmann <arnd@arndb.de>, Rob Clark <rob@ti.com> and
   9  * Daniel Vetter <daniel@ffwll.ch> for their support in creation and
  10  * refining of this idea.
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License version 2 as published by
  14  * the Free Software Foundation.
  15  *
  16  * This program is distributed in the hope that it will be useful, but WITHOUT
  17  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  18  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  19  * more details.
  20  *
  21  * You should have received a copy of the GNU General Public License along with
  22  * this program.  If not, see <http://www.gnu.org/licenses/>.
  23  */
  24
  25 #include <linux/fs.h>
  26 #include <linux/slab.h>
  27 #include <linux/dma-buf.h>
  28 #include <linux/fence.h>
  29 #include <linux/anon_inodes.h>
  30 #include <linux/export.h>
  31 #include <linux/debugfs.h>
  32 #include <linux/module.h>
  33 #include <linux/seq_file.h>
  34 #include <linux/poll.h>
  35 #include <linux/reservation.h>
  36 #include <linux/mm.h>
  37
  38 #include <uapi/linux/dma-buf.h>
  39
  40 static inline int is_dma_buf_file(struct file *);
  41
  42 struct dma_buf_list {
  43         struct list_head head;
  44         struct mutex lock;
  45 };
  46
  47 static struct dma_buf_list db_list;
  48
  49 static int dma_buf_release(struct inode *inode, struct file *file)
  50 {
  51         struct dma_buf *dmabuf;
  52
  53         if (!is_dma_buf_file(file))
  54                 return -EINVAL;
  55
  56         dmabuf = file->private_data;
  57
  58         BUG_ON(dmabuf->vmapping_counter);
  59
  60         /*
  61          * Any fences that a dma-buf poll can wait on should be signaled
  62          * before releasing dma-buf. This is the responsibility of each
  63          * driver that uses the reservation objects.
  64          *
  65          * If you hit this BUG() it means someone dropped their ref to the
  66          * dma-buf while still having pending operation to the buffer.
  67          */
  68         BUG_ON(dmabuf->cb_shared.active || dmabuf->cb_excl.active);
  69
  70         dmabuf->ops->release(dmabuf);
  71
  72         mutex_lock(&db_list.lock);
  73         list_del(&dmabuf->list_node);
  74         mutex_unlock(&db_list.lock);
  75
  76         if (dmabuf->resv == (struct reservation_object *)&dmabuf[1])
  77                 reservation_object_fini(dmabuf->resv);
  78
  79         module_put(dmabuf->owner);
  80         kfree(dmabuf);
  81         return 0;
  82 }
  83
  84 static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma)
  85 {
  86         struct dma_buf *dmabuf;
  87
  88         if (!is_dma_buf_file(file))
  89                 return -EINVAL;
  90
  91         dmabuf = file->private_data;
  92
  93         /* check for overflowing the buffer's size */
  94         if (vma->vm_pgoff + vma_pages(vma) >
  95             dmabuf->size >> PAGE_SHIFT)
  96                 return -EINVAL;
  97
  98         return dmabuf->ops->mmap(dmabuf, vma);
  99 }
 100
 101 static loff_t dma_buf_llseek(struct file *file, loff_t offset, int whence)
 102 {
 103         struct dma_buf *dmabuf;
 104         loff_t base;
 105
 106         if (!is_dma_buf_file(file))
 107                 return -EBADF;
 108
 109         dmabuf = file->private_data;
 110
 111         /* only support discovering the end of the buffer,
 112            but also allow SEEK_SET to maintain the idiomatic
 113            SEEK_END(0), SEEK_CUR(0) pattern */
 114         if (whence == SEEK_END)
 115                 base = dmabuf->size;
 116         else if (whence == SEEK_SET)
 117                 base = 0;
 118         else
 119                 return -EINVAL;
 120
 121         if (offset != 0)
 122                 return -EINVAL;
 123
 124         return base + offset;
 125 }
 126
 127 static void dma_buf_poll_cb(struct fence *fence, struct fence_cb *cb)
 128 {
 129         struct dma_buf_poll_cb_t *dcb = (struct dma_buf_poll_cb_t *)cb;
 130         unsigned long flags;
 131
 132         spin_lock_irqsave(&dcb->poll->lock, flags);
 133         wake_up_locked_poll(dcb->poll, dcb->active);
 134         dcb->active = 0;
 135         spin_unlock_irqrestore(&dcb->poll->lock, flags);
 136 }
 137
 138 static unsigned int dma_buf_poll(struct file *file, poll_table *poll)
 139 {
 140         struct dma_buf *dmabuf;
 141         struct reservation_object *resv;
 142         struct reservation_object_list *fobj;
 143         struct fence *fence_excl;
 144         unsigned long events;
 145         unsigned shared_count, seq;
 146
 147         dmabuf = file->private_data;
 148         if (!dmabuf || !dmabuf->resv)
 149                 return POLLERR;
 150
 151         resv = dmabuf->resv;
 152
 153         poll_wait(file, &dmabuf->poll, poll);
 154
 155         events = poll_requested_events(poll) & (POLLIN | POLLOUT);
 156         if (!events)
 157                 return 0;
 158
 159 retry:
 160         seq = read_seqcount_begin(&resv->seq);
 161         rcu_read_lock();
 162
 163         fobj = rcu_dereference(resv->fence);
 164         if (fobj)
 165                 shared_count = fobj->shared_count;
 166         else
 167                 shared_count = 0;
 168         fence_excl = rcu_dereference(resv->fence_excl);
 169         if (read_seqcount_retry(&resv->seq, seq)) {
 170                 rcu_read_unlock();
 171                 goto retry;
 172         }
 173
 174         if (fence_excl && (!(events & POLLOUT) || shared_count == 0)) {
 175                 struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_excl;
 176                 unsigned long pevents = POLLIN;
 177
 178                 if (shared_count == 0)
 179                         pevents |= POLLOUT;
 180
 181                 spin_lock_irq(&dmabuf->poll.lock);
 182                 if (dcb->active) {
 183                         dcb->active |= pevents;
 184                         events &= ~pevents;
 185                 } else
 186                         dcb->active = pevents;
 187                 spin_unlock_irq(&dmabuf->poll.lock);
 188
 189                 if (events & pevents) {
 190                         if (!fence_get_rcu(fence_excl)) {
 191                                 /* force a recheck */
 192                                 events &= ~pevents;
 193                                 dma_buf_poll_cb(NULL, &dcb->cb);
 194                         } else if (!fence_add_callback(fence_excl, &dcb->cb,
 195                                                        dma_buf_poll_cb)) {
 196                                 events &= ~pevents;
 197                                 fence_put(fence_excl);
 198                         } else {
 199                                 /*
 200                                  * No callback queued, wake up any additional
 201                                  * waiters.
 202                                  */
 203                                 fence_put(fence_excl);
 204                                 dma_buf_poll_cb(NULL, &dcb->cb);
 205                         }
 206                 }
 207         }
 208
 209         if ((events & POLLOUT) && shared_count > 0) {
 210                 struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_shared;
 211                 int i;
 212
 213                 /* Only queue a new callback if no event has fired yet */
 214                 spin_lock_irq(&dmabuf->poll.lock);
 215                 if (dcb->active)
 216                         events &= ~POLLOUT;
 217                 else
 218                         dcb->active = POLLOUT;
 219                 spin_unlock_irq(&dmabuf->poll.lock);
 220
 221                 if (!(events & POLLOUT))
 222                         goto out;
 223
 224                 for (i = 0; i < shared_count; ++i) {
 225                         struct fence *fence = rcu_dereference(fobj->shared[i]);
 226
 227                         if (!fence_get_rcu(fence)) {
 228                                 /*
 229                                  * fence refcount dropped to zero, this means
 230                                  * that fobj has been freed
 231                                  *
 232                                  * call dma_buf_poll_cb and force a recheck!
 233                                  */
 234                                 events &= ~POLLOUT;
 235                                 dma_buf_poll_cb(NULL, &dcb->cb);
 236                                 break;
 237                         }
 238                         if (!fence_add_callback(fence, &dcb->cb,
 239                                                 dma_buf_poll_cb)) {
 240                                 fence_put(fence);
 241                                 events &= ~POLLOUT;
 242                                 break;
 243                         }
 244                         fence_put(fence);
 245                 }
 246
 247                 /* No callback queued, wake up any additional waiters. */
 248                 if (i == shared_count)
 249                         dma_buf_poll_cb(NULL, &dcb->cb);
 250         }
 251
 252 out:
 253         rcu_read_unlock();
 254         return events;
 255 }
 256
 257 static long dma_buf_ioctl(struct file *file,
 258                           unsigned int cmd, unsigned long arg)
 259 {
 260         struct dma_buf *dmabuf;
 261         struct dma_buf_sync sync;
 262         enum dma_data_direction direction;
 263         int ret;
 264
 265         dmabuf = file->private_data;
 266
 267         switch (cmd) {
 268         case DMA_BUF_IOCTL_SYNC:
 269                 if (copy_from_user(&sync, (void __user *) arg, sizeof(sync)))
 270                         return -EFAULT;
 271
 272                 if (sync.flags & ~DMA_BUF_SYNC_VALID_FLAGS_MASK)
 273                         return -EINVAL;
 274
 275                 switch (sync.flags & DMA_BUF_SYNC_RW) {
 276                 case DMA_BUF_SYNC_READ:
 277                         direction = DMA_FROM_DEVICE;
 278                         break;
 279                 case DMA_BUF_SYNC_WRITE:
 280                         direction = DMA_TO_DEVICE;
 281                         break;
 282                 case DMA_BUF_SYNC_RW:
 283                         direction = DMA_BIDIRECTIONAL;
 284                         break;
 285                 default:
 286                         return -EINVAL;
 287                 }
 288
 289                 if (sync.flags & DMA_BUF_SYNC_END)
 290                         ret = dma_buf_end_cpu_access(dmabuf, direction);
 291                 else
 292                         ret = dma_buf_begin_cpu_access(dmabuf, direction);
 293
 294                 return ret;
 295         default:
 296                 return -ENOTTY;
 297         }
 298 }
 299
 300 static const struct file_operations dma_buf_fops = {
 301         .release        = dma_buf_release,
 302         .mmap           = dma_buf_mmap_internal,
 303         .llseek         = dma_buf_llseek,
 304         .poll           = dma_buf_poll,
 305         .unlocked_ioctl = dma_buf_ioctl,
 306 #ifdef CONFIG_COMPAT
 307         .compat_ioctl   = dma_buf_ioctl,
 308 #endif
 309 };
 310
 311 /*
 312  * is_dma_buf_file - Check if struct file* is associated with dma_buf
 313  */
 314 static inline int is_dma_buf_file(struct file *file)
 315 {
 316         return file->f_op == &dma_buf_fops;
 317 }
 318
 319 /**
 320  * dma_buf_export - Creates a new dma_buf, and associates an anon file
 321  * with this buffer, so it can be exported.
 322  * Also connect the allocator specific data and ops to the buffer.
 323  * Additionally, provide a name string for exporter; useful in debugging.
 324  *
 325  * @exp_info:   [in]    holds all the export related information provided
 326  *                      by the exporter. see struct dma_buf_export_info
 327  *                      for further details.
 328  *
 329  * Returns, on success, a newly created dma_buf object, which wraps the
 330  * supplied private data and operations for dma_buf_ops. On either missing
 331  * ops, or error in allocating struct dma_buf, will return negative error.
 332  *
 333  */
 334 struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
 335 {
 336         struct dma_buf *dmabuf;
 337         struct reservation_object *resv = exp_info->resv;
 338         struct file *file;
 339         size_t alloc_size = sizeof(struct dma_buf);
 340         int ret;
 341
 342         if (!exp_info->resv)
 343                 alloc_size += sizeof(struct reservation_object);
 344         else
 345                 /* prevent &dma_buf[1] == dma_buf->resv */
 346                 alloc_size += 1;
 347
 348         if (WARN_ON(!exp_info->priv
 349                           || !exp_info->ops
 350                           || !exp_info->ops->map_dma_buf
 351                           || !exp_info->ops->unmap_dma_buf
 352                           || !exp_info->ops->release
 353                           || !exp_info->ops->kmap_atomic
 354                           || !exp_info->ops->kmap
 355                           || !exp_info->ops->mmap)) {
 356                 return ERR_PTR(-EINVAL);
 357         }
 358
 359         if (!try_module_get(exp_info->owner))
 360                 return ERR_PTR(-ENOENT);
 361
 362         dmabuf = kzalloc(alloc_size, GFP_KERNEL);
 363         if (!dmabuf) {
 364                 ret = -ENOMEM;
 365                 goto err_module;
 366         }
 367
 368         dmabuf->priv = exp_info->priv;
 369         dmabuf->ops = exp_info->ops;
 370         dmabuf->size = exp_info->size;
 371         dmabuf->exp_name = exp_info->exp_name;
 372         dmabuf->owner = exp_info->owner;
 373         init_waitqueue_head(&dmabuf->poll);
 374         dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll;
 375         dmabuf->cb_excl.active = dmabuf->cb_shared.active = 0;
 376
 377         if (!resv) {
 378                 resv = (struct reservation_object *)&dmabuf[1];
 379                 reservation_object_init(resv);
 380         }
 381         dmabuf->resv = resv;
 382
 383         file = anon_inode_getfile("dmabuf", &dma_buf_fops, dmabuf,
 384                                         exp_info->flags);
 385         if (IS_ERR(file)) {
 386                 ret = PTR_ERR(file);
 387                 goto err_dmabuf;
 388         }
 389
 390         file->f_mode |= FMODE_LSEEK;
 391         dmabuf->file = file;
 392
 393         mutex_init(&dmabuf->lock);
 394         INIT_LIST_HEAD(&dmabuf->attachments);
 395
 396         mutex_lock(&db_list.lock);
 397         list_add(&dmabuf->list_node, &db_list.head);
 398         mutex_unlock(&db_list.lock);
 399
 400         return dmabuf;
 401
 402 err_dmabuf:
 403         kfree(dmabuf);
 404 err_module:
 405         module_put(exp_info->owner);
 406         return ERR_PTR(ret);
 407 }
 408 EXPORT_SYMBOL_GPL(dma_buf_export);
 409
 410 /**
 411  * dma_buf_fd - returns a file descriptor for the given dma_buf
 412  * @dmabuf:     [in]    pointer to dma_buf for which fd is required.
 413  * @flags:      [in]    flags to give to fd
 414  *
 415  * On success, returns an associated 'fd'. Else, returns error.
 416  */
 417 int dma_buf_fd(struct dma_buf *dmabuf, int flags)
 418 {
 419         int fd;
 420
 421         if (!dmabuf || !dmabuf->file)
 422                 return -EINVAL;
 423
 424         fd = get_unused_fd_flags(flags);
 425         if (fd < 0)
 426                 return fd;
 427
 428         fd_install(fd, dmabuf->file);
 429
 430         return fd;
 431 }
 432 EXPORT_SYMBOL_GPL(dma_buf_fd);
 433
 434 /**
 435  * dma_buf_get - returns the dma_buf structure related to an fd
 436  * @fd: [in]    fd associated with the dma_buf to be returned
 437  *
 438  * On success, returns the dma_buf structure associated with an fd; uses
 439  * file's refcounting done by fget to increase refcount. returns ERR_PTR
 440  * otherwise.
 441  */
 442 struct dma_buf *dma_buf_get(int fd)
 443 {
 444         struct file *file;
 445
 446         file = fget(fd);
 447
 448         if (!file)
 449                 return ERR_PTR(-EBADF);
 450
 451         if (!is_dma_buf_file(file)) {
 452                 fput(file);
 453                 return ERR_PTR(-EINVAL);
 454         }
 455
 456         return file->private_data;
 457 }
 458 EXPORT_SYMBOL_GPL(dma_buf_get);
 459
 460 /**
 461  * dma_buf_put - decreases refcount of the buffer
 462  * @dmabuf:     [in]    buffer to reduce refcount of
 463  *
 464  * Uses file's refcounting done implicitly by fput()
 465  */
 466 void dma_buf_put(struct dma_buf *dmabuf)
 467 {
 468         if (WARN_ON(!dmabuf || !dmabuf->file))
 469                 return;
 470
 471         fput(dmabuf->file);
 472 }
 473 EXPORT_SYMBOL_GPL(dma_buf_put);
 474
 475 /**
 476  * dma_buf_attach - Add the device to dma_buf's attachments list; optionally,
 477  * calls attach() of dma_buf_ops to allow device-specific attach functionality
 478  * @dmabuf:     [in]    buffer to attach device to.
 479  * @dev:        [in]    device to be attached.
 480  *
 481  * Returns struct dma_buf_attachment * for this attachment; returns ERR_PTR on
 482  * error.
 483  */
 484 struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf,
 485                                           struct device *dev)
 486 {
 487         struct dma_buf_attachment *attach;
 488         int ret;
 489
 490         if (WARN_ON(!dmabuf || !dev))
 491                 return ERR_PTR(-EINVAL);
 492
 493         attach = kzalloc(sizeof(struct dma_buf_attachment), GFP_KERNEL);
 494         if (attach == NULL)
 495                 return ERR_PTR(-ENOMEM);
 496
 497         attach->dev = dev;
 498         attach->dmabuf = dmabuf;
 499
 500         mutex_lock(&dmabuf->lock);
 501
 502         if (dmabuf->ops->attach) {
 503                 ret = dmabuf->ops->attach(dmabuf, dev, attach);
 504                 if (ret)
 505                         goto err_attach;
 506         }
 507         list_add(&attach->node, &dmabuf->attachments);
 508
 509         mutex_unlock(&dmabuf->lock);
 510         return attach;
 511
 512 err_attach:
 513         kfree(attach);
 514         mutex_unlock(&dmabuf->lock);
 515         return ERR_PTR(ret);
 516 }
 517 EXPORT_SYMBOL_GPL(dma_buf_attach);
 518
 519 /**
 520  * dma_buf_detach - Remove the given attachment from dmabuf's attachments list;
 521  * optionally calls detach() of dma_buf_ops for device-specific detach
 522  * @dmabuf:     [in]    buffer to detach from.
 523  * @attach:     [in]    attachment to be detached; is free'd after this call.
 524  *
 525  */
 526 void dma_buf_detach(struct dma_buf *dmabuf, struct dma_buf_attachment *attach)
 527 {
 528         if (WARN_ON(!dmabuf || !attach))
 529                 return;
 530
 531         mutex_lock(&dmabuf->lock);
 532         list_del(&attach->node);
 533         if (dmabuf->ops->detach)
 534                 dmabuf->ops->detach(dmabuf, attach);
 535
 536         mutex_unlock(&dmabuf->lock);
 537         kfree(attach);
 538 }
 539 EXPORT_SYMBOL_GPL(dma_buf_detach);
 540
 541 /**
 542  * dma_buf_map_attachment - Returns the scatterlist table of the attachment;
 543  * mapped into _device_ address space. Is a wrapper for map_dma_buf() of the
 544  * dma_buf_ops.
 545  * @attach:     [in]    attachment whose scatterlist is to be returned
 546  * @direction:  [in]    direction of DMA transfer
 547  *
 548  * Returns sg_table containing the scatterlist to be returned; returns ERR_PTR
 549  * on error.
 550  */
 551 struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach,
 552                                         enum dma_data_direction direction)
 553 {
 554         struct sg_table *sg_table;
 555
 556         might_sleep();
 557
 558         if (WARN_ON(!attach || !attach->dmabuf))
 559                 return ERR_PTR(-EINVAL);
 560
 561         sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction);
 562         if (!sg_table)
 563                 sg_table = ERR_PTR(-ENOMEM);
 564
 565         return sg_table;
 566 }
 567 EXPORT_SYMBOL_GPL(dma_buf_map_attachment);
 568
 569 /**
 570  * dma_buf_unmap_attachment - unmaps and decreases usecount of the buffer;might
 571  * deallocate the scatterlist associated. Is a wrapper for unmap_dma_buf() of
 572  * dma_buf_ops.
 573  * @attach:     [in]    attachment to unmap buffer from
 574  * @sg_table:   [in]    scatterlist info of the buffer to unmap
 575  * @direction:  [in]    direction of DMA transfer
 576  *
 577  */
 578 void dma_buf_unmap_attachment(struct dma_buf_attachment *attach,
 579                                 struct sg_table *sg_table,
 580                                 enum dma_data_direction direction)
 581 {
 582         might_sleep();
 583
 584         if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
 585                 return;
 586
 587         attach->dmabuf->ops->unmap_dma_buf(attach, sg_table,
 588                                                 direction);
 589 }
 590 EXPORT_SYMBOL_GPL(dma_buf_unmap_attachment);
 591
 592 static int __dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
 593                                       enum dma_data_direction direction)
 594 {
 595         bool write = (direction == DMA_BIDIRECTIONAL ||
 596                       direction == DMA_TO_DEVICE);
 597         struct reservation_object *resv = dmabuf->resv;
 598         long ret;
 599
 600         /* Wait on any implicit rendering fences */
 601         ret = reservation_object_wait_timeout_rcu(resv, write, true,
 602                                                   MAX_SCHEDULE_TIMEOUT);
 603         if (ret < 0)
 604                 return ret;
 605
 606         return 0;
 607 }
 608
 609 /**
 610  * dma_buf_begin_cpu_access - Must be called before accessing a dma_buf from the
 611  * cpu in the kernel context. Calls begin_cpu_access to allow exporter-specific
 612  * preparations. Coherency is only guaranteed in the specified range for the
 613  * specified access direction.
 614  * @dmabuf:     [in]    buffer to prepare cpu access for.
 615  * @direction:  [in]    length of range for cpu access.
 616  *
 617  * Can return negative error values, returns 0 on success.
 618  */
 619 int dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
 620                              enum dma_data_direction direction)
 621 {
 622         int ret = 0;
 623
 624         if (WARN_ON(!dmabuf))
 625                 return -EINVAL;
 626
 627         if (dmabuf->ops->begin_cpu_access)
 628                 ret = dmabuf->ops->begin_cpu_access(dmabuf, direction);
 629
 630         /* Ensure that all fences are waited upon - but we first allow
 631          * the native handler the chance to do so more efficiently if it
 632          * chooses. A double invocation here will be reasonably cheap no-op.
 633          */
 634         if (ret == 0)
 635                 ret = __dma_buf_begin_cpu_access(dmabuf, direction);
 636
 637         return ret;
 638 }
 639 EXPORT_SYMBOL_GPL(dma_buf_begin_cpu_access);
 640
 641 /**
 642  * dma_buf_end_cpu_access - Must be called after accessing a dma_buf from the
 643  * cpu in the kernel context. Calls end_cpu_access to allow exporter-specific
 644  * actions. Coherency is only guaranteed in the specified range for the
 645  * specified access direction.
 646  * @dmabuf:     [in]    buffer to complete cpu access for.
 647  * @direction:  [in]    length of range for cpu access.
 648  *
 649  * Can return negative error values, returns 0 on success.
 650  */
 651 int dma_buf_end_cpu_access(struct dma_buf *dmabuf,
 652                            enum dma_data_direction direction)
 653 {
 654         int ret = 0;
 655
 656         WARN_ON(!dmabuf);
 657
 658         if (dmabuf->ops->end_cpu_access)
 659                 ret = dmabuf->ops->end_cpu_access(dmabuf, direction);
 660
 661         return ret;
 662 }
 663 EXPORT_SYMBOL_GPL(dma_buf_end_cpu_access);
 664
 665 /**
 666  * dma_buf_kmap_atomic - Map a page of the buffer object into kernel address
 667  * space. The same restrictions as for kmap_atomic and friends apply.
 668  * @dmabuf:     [in]    buffer to map page from.
 669  * @page_num:   [in]    page in PAGE_SIZE units to map.
 670  *
 671  * This call must always succeed, any necessary preparations that might fail
 672  * need to be done in begin_cpu_access.
 673  */
 674 void *dma_buf_kmap_atomic(struct dma_buf *dmabuf, unsigned long page_num)
 675 {
 676         WARN_ON(!dmabuf);
 677
 678         return dmabuf->ops->kmap_atomic(dmabuf, page_num);
 679 }
 680 EXPORT_SYMBOL_GPL(dma_buf_kmap_atomic);
 681
 682 /**
 683  * dma_buf_kunmap_atomic - Unmap a page obtained by dma_buf_kmap_atomic.
 684  * @dmabuf:     [in]    buffer to unmap page from.
 685  * @page_num:   [in]    page in PAGE_SIZE units to unmap.
 686  * @vaddr:      [in]    kernel space pointer obtained from dma_buf_kmap_atomic.
 687  *
 688  * This call must always succeed.
 689  */
 690 void dma_buf_kunmap_atomic(struct dma_buf *dmabuf, unsigned long page_num,
 691                            void *vaddr)
 692 {
 693         WARN_ON(!dmabuf);
 694
 695         if (dmabuf->ops->kunmap_atomic)
 696                 dmabuf->ops->kunmap_atomic(dmabuf, page_num, vaddr);
 697 }
 698 EXPORT_SYMBOL_GPL(dma_buf_kunmap_atomic);
 699
 700 /**
 701  * dma_buf_kmap - Map a page of the buffer object into kernel address space. The
 702  * same restrictions as for kmap and friends apply.
 703  * @dmabuf:     [in]    buffer to map page from.
 704  * @page_num:   [in]    page in PAGE_SIZE units to map.
 705  *
 706  * This call must always succeed, any necessary preparations that might fail
 707  * need to be done in begin_cpu_access.
 708  */
 709 void *dma_buf_kmap(struct dma_buf *dmabuf, unsigned long page_num)
 710 {
 711         WARN_ON(!dmabuf);
 712
 713         return dmabuf->ops->kmap(dmabuf, page_num);
 714 }
 715 EXPORT_SYMBOL_GPL(dma_buf_kmap);
 716
 717 /**
 718  * dma_buf_kunmap - Unmap a page obtained by dma_buf_kmap.
 719  * @dmabuf:     [in]    buffer to unmap page from.
 720  * @page_num:   [in]    page in PAGE_SIZE units to unmap.
 721  * @vaddr:      [in]    kernel space pointer obtained from dma_buf_kmap.
 722  *
 723  * This call must always succeed.
 724  */
 725 void dma_buf_kunmap(struct dma_buf *dmabuf, unsigned long page_num,
 726                     void *vaddr)
 727 {
 728         WARN_ON(!dmabuf);
 729
 730         if (dmabuf->ops->kunmap)
 731                 dmabuf->ops->kunmap(dmabuf, page_num, vaddr);
 732 }
 733 EXPORT_SYMBOL_GPL(dma_buf_kunmap);
 734
 735
 736 /**
 737  * dma_buf_mmap - Setup up a userspace mmap with the given vma
 738  * @dmabuf:     [in]    buffer that should back the vma
 739  * @vma:        [in]    vma for the mmap
 740  * @pgoff:      [in]    offset in pages where this mmap should start within the
 741  *                      dma-buf buffer.
 742  *
 743  * This function adjusts the passed in vma so that it points at the file of the
 744  * dma_buf operation. It also adjusts the starting pgoff and does bounds
 745  * checking on the size of the vma. Then it calls the exporters mmap function to
 746  * set up the mapping.
 747  *
 748  * Can return negative error values, returns 0 on success.
 749  */
 750 int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
 751                  unsigned long pgoff)
 752 {
 753         struct file *oldfile;
 754         int ret;
 755
 756         if (WARN_ON(!dmabuf || !vma))
 757                 return -EINVAL;
 758
 759         /* check for offset overflow */
 760         if (pgoff + vma_pages(vma) < pgoff)
 761                 return -EOVERFLOW;
 762
 763         /* check for overflowing the buffer's size */
 764         if (pgoff + vma_pages(vma) >
 765             dmabuf->size >> PAGE_SHIFT)
 766                 return -EINVAL;
 767
 768         /* readjust the vma */
 769         get_file(dmabuf->file);
 770         oldfile = vma->vm_file;
 771         vma->vm_file = dmabuf->file;
 772         vma->vm_pgoff = pgoff;
 773
 774         ret = dmabuf->ops->mmap(dmabuf, vma);
 775         if (ret) {
 776                 /* restore old parameters on failure */
 777                 vma->vm_file = oldfile;
 778                 fput(dmabuf->file);
 779         } else {
 780                 if (oldfile)
 781                         fput(oldfile);
 782         }
 783         return ret;
 784
 785 }
 786 EXPORT_SYMBOL_GPL(dma_buf_mmap);
 787
 788 /**
 789  * dma_buf_vmap - Create virtual mapping for the buffer object into kernel
 790  * address space. Same restrictions as for vmap and friends apply.
 791  * @dmabuf:     [in]    buffer to vmap
 792  *
 793  * This call may fail due to lack of virtual mapping address space.
 794  * These calls are optional in drivers. The intended use for them
 795  * is for mapping objects linear in kernel space for high use objects.
 796  * Please attempt to use kmap/kunmap before thinking about these interfaces.
 797  *
 798  * Returns NULL on error.
 799  */
 800 void *dma_buf_vmap(struct dma_buf *dmabuf)
 801 {
 802         void *ptr;
 803
 804         if (WARN_ON(!dmabuf))
 805                 return NULL;
 806
 807         if (!dmabuf->ops->vmap)
 808                 return NULL;
 809
 810         mutex_lock(&dmabuf->lock);
 811         if (dmabuf->vmapping_counter) {
 812                 dmabuf->vmapping_counter++;
 813                 BUG_ON(!dmabuf->vmap_ptr);
 814                 ptr = dmabuf->vmap_ptr;
 815                 goto out_unlock;
 816         }
 817
 818         BUG_ON(dmabuf->vmap_ptr);
 819
 820         ptr = dmabuf->ops->vmap(dmabuf);
 821         if (WARN_ON_ONCE(IS_ERR(ptr)))
 822                 ptr = NULL;
 823         if (!ptr)
 824                 goto out_unlock;
 825
 826         dmabuf->vmap_ptr = ptr;
 827         dmabuf->vmapping_counter = 1;
 828
 829 out_unlock:
 830         mutex_unlock(&dmabuf->lock);
 831         return ptr;
 832 }
 833 EXPORT_SYMBOL_GPL(dma_buf_vmap);
 834
 835 /**
 836  * dma_buf_vunmap - Unmap a vmap obtained by dma_buf_vmap.
 837  * @dmabuf:     [in]    buffer to vunmap
 838  * @vaddr:      [in]    vmap to vunmap
 839  */
 840 void dma_buf_vunmap(struct dma_buf *dmabuf, void *vaddr)
 841 {
 842         if (WARN_ON(!dmabuf))
 843                 return;
 844
 845         BUG_ON(!dmabuf->vmap_ptr);
 846         BUG_ON(dmabuf->vmapping_counter == 0);
 847         BUG_ON(dmabuf->vmap_ptr != vaddr);
 848
 849         mutex_lock(&dmabuf->lock);
 850         if (--dmabuf->vmapping_counter == 0) {
 851                 if (dmabuf->ops->vunmap)
 852                         dmabuf->ops->vunmap(dmabuf, vaddr);
 853                 dmabuf->vmap_ptr = NULL;
 854         }
 855         mutex_unlock(&dmabuf->lock);
 856 }
 857 EXPORT_SYMBOL_GPL(dma_buf_vunmap);
 858
 859 #ifdef CONFIG_DEBUG_FS
 860 static int dma_buf_debug_show(struct seq_file *s, void *unused)
 861 {
 862         int ret;
 863         struct dma_buf *buf_obj;
 864         struct dma_buf_attachment *attach_obj;
 865         int count = 0, attach_count;
 866         size_t size = 0;
 867
 868         ret = mutex_lock_interruptible(&db_list.lock);
 869
 870         if (ret)
 871                 return ret;
 872
 873         seq_puts(s, "\nDma-buf Objects:\n");
 874         seq_puts(s, "size\tflags\tmode\tcount\texp_name\n");
 875
 876         list_for_each_entry(buf_obj, &db_list.head, list_node) {
 877                 ret = mutex_lock_interruptible(&buf_obj->lock);
 878
 879                 if (ret) {
 880                         seq_puts(s,
 881                                  "\tERROR locking buffer object: skipping\n");
 882                         continue;
 883                 }
 884
 885                 seq_printf(s, "%08zu\t%08x\t%08x\t%08ld\t%s\n",
 886                                 buf_obj->size,
 887                                 buf_obj->file->f_flags, buf_obj->file->f_mode,
 888                                 file_count(buf_obj->file),
 889                                 buf_obj->exp_name);
 890
 891                 seq_puts(s, "\tAttached Devices:\n");
 892                 attach_count = 0;
 893
 894                 list_for_each_entry(attach_obj, &buf_obj->attachments, node) {
 895                         seq_puts(s, "\t");
 896
 897                         seq_printf(s, "%s\n", dev_name(attach_obj->dev));
 898                         attach_count++;
 899                 }
 900
 901                 seq_printf(s, "Total %d devices attached\n\n",
 902                                 attach_count);
 903
 904                 count++;
 905                 size += buf_obj->size;
 906                 mutex_unlock(&buf_obj->lock);
 907         }
 908
 909         seq_printf(s, "\nTotal %d objects, %zu bytes\n", count, size);
 910
 911         mutex_unlock(&db_list.lock);
 912         return 0;
 913 }
 914
 915 static int dma_buf_debug_open(struct inode *inode, struct file *file)
 916 {
 917         return single_open(file, dma_buf_debug_show, NULL);
 918 }
 919
 920 static const struct file_operations dma_buf_debug_fops = {
 921         .open           = dma_buf_debug_open,
 922         .read           = seq_read,
 923         .llseek         = seq_lseek,
 924         .release        = single_release,
 925 };
 926
 927 static struct dentry *dma_buf_debugfs_dir;
 928
 929 static int dma_buf_init_debugfs(void)
 930 {
 931         struct dentry *d;
 932         int err = 0;
 933
 934         d = debugfs_create_dir("dma_buf", NULL);
 935         if (IS_ERR(d))
 936                 return PTR_ERR(d);
 937
 938         dma_buf_debugfs_dir = d;
 939
 940         d = debugfs_create_file("bufinfo", S_IRUGO, dma_buf_debugfs_dir,
 941                                 NULL, &dma_buf_debug_fops);
 942         if (IS_ERR(d)) {
 943                 pr_debug("dma_buf: debugfs: failed to create node bufinfo\n");
 944                 debugfs_remove_recursive(dma_buf_debugfs_dir);
 945                 dma_buf_debugfs_dir = NULL;
 946                 err = PTR_ERR(d);
 947         }
 948
 949         return err;
 950 }
 951
 952 static void dma_buf_uninit_debugfs(void)
 953 {
 954         if (dma_buf_debugfs_dir)
 955                 debugfs_remove_recursive(dma_buf_debugfs_dir);
 956 }
 957 #else
 958 static inline int dma_buf_init_debugfs(void)
 959 {
 960         return 0;
 961 }
 962 static inline void dma_buf_uninit_debugfs(void)
 963 {
 964 }
 965 #endif
 966
 967 static int __init dma_buf_init(void)
 968 {
 969         mutex_init(&db_list.lock);
 970         INIT_LIST_HEAD(&db_list.head);
 971         dma_buf_init_debugfs();
 972         return 0;
 973 }
 974 subsys_initcall(dma_buf_init);
 975
 976 static void __exit dma_buf_deinit(void)
 977 {
 978         dma_buf_uninit_debugfs();
 979 }
 980 __exitcall(dma_buf_deinit);