dma-buf.c 35.9 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-only
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
/*
 * Framework for buffer objects that can be shared across devices/subsystems.
 *
 * Copyright(C) 2011 Linaro Limited. All rights reserved.
 * Author: Sumit Semwal <sumit.semwal@ti.com>
 *
 * Many thanks to linaro-mm-sig list, and specially
 * Arnd Bergmann <arnd@arndb.de>, Rob Clark <rob@ti.com> and
 * Daniel Vetter <daniel@ffwll.ch> for their support in creation and
 * refining of this idea.
 */

#include <linux/fs.h>
#include <linux/slab.h>
#include <linux/dma-buf.h>
17
#include <linux/dma-fence.h>
18 19
#include <linux/anon_inodes.h>
#include <linux/export.h>
Sumit Semwal's avatar
Sumit Semwal committed
20
#include <linux/debugfs.h>
21
#include <linux/module.h>
Sumit Semwal's avatar
Sumit Semwal committed
22
#include <linux/seq_file.h>
23
#include <linux/poll.h>
24
#include <linux/reservation.h>
25
#include <linux/mm.h>
26
#include <linux/mount.h>
27
#include <linux/pseudo_fs.h>
28

29
#include <uapi/linux/dma-buf.h>
30
#include <uapi/linux/magic.h>
31

32 33
static inline int is_dma_buf_file(struct file *);

Sumit Semwal's avatar
Sumit Semwal committed
34 35 36 37 38 39 40
struct dma_buf_list {
	struct list_head head;
	struct mutex lock;
};

static struct dma_buf_list db_list;

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56
static char *dmabuffs_dname(struct dentry *dentry, char *buffer, int buflen)
{
	struct dma_buf *dmabuf;
	char name[DMA_BUF_NAME_LEN];
	size_t ret = 0;

	dmabuf = dentry->d_fsdata;
	mutex_lock(&dmabuf->lock);
	if (dmabuf->name)
		ret = strlcpy(name, dmabuf->name, DMA_BUF_NAME_LEN);
	mutex_unlock(&dmabuf->lock);

	return dynamic_dname(dentry, buffer, buflen, "/%s:%s",
			     dentry->d_name.name, ret > 0 ? name : "");
}

57
static const struct dentry_operations dma_buf_dentry_ops = {
58
	.d_dname = dmabuffs_dname,
59 60 61 62
};

static struct vfsmount *dma_buf_mnt;

63
static int dma_buf_fs_init_context(struct fs_context *fc)
64
{
65 66 67 68 69 70 71
	struct pseudo_fs_context *ctx;

	ctx = init_pseudo(fc, DMA_BUF_MAGIC);
	if (!ctx)
		return -ENOMEM;
	ctx->dops = &dma_buf_dentry_ops;
	return 0;
72 73 74 75
}

static struct file_system_type dma_buf_fs_type = {
	.name = "dmabuf",
76
	.init_fs_context = dma_buf_fs_init_context,
77 78 79
	.kill_sb = kill_anon_super,
};

80 81 82 83 84 85 86 87 88
static int dma_buf_release(struct inode *inode, struct file *file)
{
	struct dma_buf *dmabuf;

	if (!is_dma_buf_file(file))
		return -EINVAL;

	dmabuf = file->private_data;

89 90
	BUG_ON(dmabuf->vmapping_counter);

91 92 93 94 95 96 97 98 99 100
	/*
	 * Any fences that a dma-buf poll can wait on should be signaled
	 * before releasing dma-buf. This is the responsibility of each
	 * driver that uses the reservation objects.
	 *
	 * If you hit this BUG() it means someone dropped their ref to the
	 * dma-buf while still having pending operation to the buffer.
	 */
	BUG_ON(dmabuf->cb_shared.active || dmabuf->cb_excl.active);

101
	dmabuf->ops->release(dmabuf);
Sumit Semwal's avatar
Sumit Semwal committed
102 103 104 105 106

	mutex_lock(&db_list.lock);
	list_del(&dmabuf->list_node);
	mutex_unlock(&db_list.lock);

107 108 109
	if (dmabuf->resv == (struct reservation_object *)&dmabuf[1])
		reservation_object_fini(dmabuf->resv);

110
	module_put(dmabuf->owner);
111 112 113 114
	kfree(dmabuf);
	return 0;
}

Daniel Vetter's avatar
Daniel Vetter committed
115 116 117 118 119 120 121 122 123
static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma)
{
	struct dma_buf *dmabuf;

	if (!is_dma_buf_file(file))
		return -EINVAL;

	dmabuf = file->private_data;

124 125 126 127
	/* check if buffer supports mmap */
	if (!dmabuf->ops->mmap)
		return -EINVAL;

Daniel Vetter's avatar
Daniel Vetter committed
128
	/* check for overflowing the buffer's size */
129
	if (vma->vm_pgoff + vma_pages(vma) >
Daniel Vetter's avatar
Daniel Vetter committed
130 131 132 133 134 135
	    dmabuf->size >> PAGE_SHIFT)
		return -EINVAL;

	return dmabuf->ops->mmap(dmabuf, vma);
}

136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161
static loff_t dma_buf_llseek(struct file *file, loff_t offset, int whence)
{
	struct dma_buf *dmabuf;
	loff_t base;

	if (!is_dma_buf_file(file))
		return -EBADF;

	dmabuf = file->private_data;

	/* only support discovering the end of the buffer,
	   but also allow SEEK_SET to maintain the idiomatic
	   SEEK_END(0), SEEK_CUR(0) pattern */
	if (whence == SEEK_END)
		base = dmabuf->size;
	else if (whence == SEEK_SET)
		base = 0;
	else
		return -EINVAL;

	if (offset != 0)
		return -EINVAL;

	return base + offset;
}

162 163 164 165
/**
 * DOC: fence polling
 *
 * To support cross-device and cross-driver synchronization of buffer access
166
 * implicit fences (represented internally in the kernel with &struct fence) can
167 168 169 170 171 172
 * be attached to a &dma_buf. The glue for that and a few related things are
 * provided in the &reservation_object structure.
 *
 * Userspace can query the state of these implicitly tracked fences using poll()
 * and related system calls:
 *
173
 * - Checking for EPOLLIN, i.e. read access, can be use to query the state of the
174 175
 *   most recent write or exclusive fence.
 *
176
 * - Checking for EPOLLOUT, i.e. write access, can be used to query the state of
177 178 179 180 181 182 183
 *   all attached fences, shared and exclusive ones.
 *
 * Note that this only signals the completion of the respective fences, i.e. the
 * DMA transfers are complete. Cache flushing and any other necessary
 * preparations before CPU access can begin still need to happen.
 */

184
static void dma_buf_poll_cb(struct dma_fence *fence, struct dma_fence_cb *cb)
185 186 187 188 189 190 191 192 193 194
{
	struct dma_buf_poll_cb_t *dcb = (struct dma_buf_poll_cb_t *)cb;
	unsigned long flags;

	spin_lock_irqsave(&dcb->poll->lock, flags);
	wake_up_locked_poll(dcb->poll, dcb->active);
	dcb->active = 0;
	spin_unlock_irqrestore(&dcb->poll->lock, flags);
}

195
static __poll_t dma_buf_poll(struct file *file, poll_table *poll)
196 197 198
{
	struct dma_buf *dmabuf;
	struct reservation_object *resv;
199
	struct reservation_object_list *fobj;
200
	struct dma_fence *fence_excl;
Al Viro's avatar
Al Viro committed
201
	__poll_t events;
202
	unsigned shared_count, seq;
203 204 205

	dmabuf = file->private_data;
	if (!dmabuf || !dmabuf->resv)
206
		return EPOLLERR;
207 208 209 210 211

	resv = dmabuf->resv;

	poll_wait(file, &dmabuf->poll, poll);

212
	events = poll_requested_events(poll) & (EPOLLIN | EPOLLOUT);
213 214 215
	if (!events)
		return 0;

216 217 218
retry:
	seq = read_seqcount_begin(&resv->seq);
	rcu_read_lock();
219

220 221 222 223 224 225 226 227 228 229
	fobj = rcu_dereference(resv->fence);
	if (fobj)
		shared_count = fobj->shared_count;
	else
		shared_count = 0;
	fence_excl = rcu_dereference(resv->fence_excl);
	if (read_seqcount_retry(&resv->seq, seq)) {
		rcu_read_unlock();
		goto retry;
	}
230

231
	if (fence_excl && (!(events & EPOLLOUT) || shared_count == 0)) {
232
		struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_excl;
233
		__poll_t pevents = EPOLLIN;
234

235
		if (shared_count == 0)
236
			pevents |= EPOLLOUT;
237 238 239 240 241 242 243 244 245 246

		spin_lock_irq(&dmabuf->poll.lock);
		if (dcb->active) {
			dcb->active |= pevents;
			events &= ~pevents;
		} else
			dcb->active = pevents;
		spin_unlock_irq(&dmabuf->poll.lock);

		if (events & pevents) {
247
			if (!dma_fence_get_rcu(fence_excl)) {
248 249 250
				/* force a recheck */
				events &= ~pevents;
				dma_buf_poll_cb(NULL, &dcb->cb);
251 252
			} else if (!dma_fence_add_callback(fence_excl, &dcb->cb,
							   dma_buf_poll_cb)) {
253
				events &= ~pevents;
254
				dma_fence_put(fence_excl);
255
			} else {
256 257 258 259
				/*
				 * No callback queued, wake up any additional
				 * waiters.
				 */
260
				dma_fence_put(fence_excl);
261
				dma_buf_poll_cb(NULL, &dcb->cb);
262
			}
263 264 265
		}
	}

266
	if ((events & EPOLLOUT) && shared_count > 0) {
267 268 269 270 271 272
		struct dma_buf_poll_cb_t *dcb = &dmabuf->cb_shared;
		int i;

		/* Only queue a new callback if no event has fired yet */
		spin_lock_irq(&dmabuf->poll.lock);
		if (dcb->active)
273
			events &= ~EPOLLOUT;
274
		else
275
			dcb->active = EPOLLOUT;
276 277
		spin_unlock_irq(&dmabuf->poll.lock);

278
		if (!(events & EPOLLOUT))
279 280
			goto out;

281
		for (i = 0; i < shared_count; ++i) {
282
			struct dma_fence *fence = rcu_dereference(fobj->shared[i]);
283

284
			if (!dma_fence_get_rcu(fence)) {
285 286 287 288 289 290
				/*
				 * fence refcount dropped to zero, this means
				 * that fobj has been freed
				 *
				 * call dma_buf_poll_cb and force a recheck!
				 */
291
				events &= ~EPOLLOUT;
292 293 294
				dma_buf_poll_cb(NULL, &dcb->cb);
				break;
			}
295 296 297
			if (!dma_fence_add_callback(fence, &dcb->cb,
						    dma_buf_poll_cb)) {
				dma_fence_put(fence);
298
				events &= ~EPOLLOUT;
299 300
				break;
			}
301
			dma_fence_put(fence);
302
		}
303 304

		/* No callback queued, wake up any additional waiters. */
305
		if (i == shared_count)
306 307 308 309
			dma_buf_poll_cb(NULL, &dcb->cb);
	}

out:
310
	rcu_read_unlock();
311 312 313
	return events;
}

314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350
/**
 * dma_buf_set_name - Set a name to a specific dma_buf to track the usage.
 * The name of the dma-buf buffer can only be set when the dma-buf is not
 * attached to any devices. It could theoritically support changing the
 * name of the dma-buf if the same piece of memory is used for multiple
 * purpose between different devices.
 *
 * @dmabuf [in]     dmabuf buffer that will be renamed.
 * @buf:   [in]     A piece of userspace memory that contains the name of
 *                  the dma-buf.
 *
 * Returns 0 on success. If the dma-buf buffer is already attached to
 * devices, return -EBUSY.
 *
 */
static long dma_buf_set_name(struct dma_buf *dmabuf, const char __user *buf)
{
	char *name = strndup_user(buf, DMA_BUF_NAME_LEN);
	long ret = 0;

	if (IS_ERR(name))
		return PTR_ERR(name);

	mutex_lock(&dmabuf->lock);
	if (!list_empty(&dmabuf->attachments)) {
		ret = -EBUSY;
		kfree(name);
		goto out_unlock;
	}
	kfree(dmabuf->name);
	dmabuf->name = name;

out_unlock:
	mutex_unlock(&dmabuf->lock);
	return ret;
}

351 352 353 354 355 356
static long dma_buf_ioctl(struct file *file,
			  unsigned int cmd, unsigned long arg)
{
	struct dma_buf *dmabuf;
	struct dma_buf_sync sync;
	enum dma_data_direction direction;
357
	int ret;
358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383

	dmabuf = file->private_data;

	switch (cmd) {
	case DMA_BUF_IOCTL_SYNC:
		if (copy_from_user(&sync, (void __user *) arg, sizeof(sync)))
			return -EFAULT;

		if (sync.flags & ~DMA_BUF_SYNC_VALID_FLAGS_MASK)
			return -EINVAL;

		switch (sync.flags & DMA_BUF_SYNC_RW) {
		case DMA_BUF_SYNC_READ:
			direction = DMA_FROM_DEVICE;
			break;
		case DMA_BUF_SYNC_WRITE:
			direction = DMA_TO_DEVICE;
			break;
		case DMA_BUF_SYNC_RW:
			direction = DMA_BIDIRECTIONAL;
			break;
		default:
			return -EINVAL;
		}

		if (sync.flags & DMA_BUF_SYNC_END)
384
			ret = dma_buf_end_cpu_access(dmabuf, direction);
385
		else
386
			ret = dma_buf_begin_cpu_access(dmabuf, direction);
387

388
		return ret;
389 390 391 392

	case DMA_BUF_SET_NAME:
		return dma_buf_set_name(dmabuf, (const char __user *)arg);

393 394 395 396 397
	default:
		return -ENOTTY;
	}
}

398 399 400 401 402 403 404 405 406 407 408 409 410 411
static void dma_buf_show_fdinfo(struct seq_file *m, struct file *file)
{
	struct dma_buf *dmabuf = file->private_data;

	seq_printf(m, "size:\t%zu\n", dmabuf->size);
	/* Don't count the temporary reference taken inside procfs seq_show */
	seq_printf(m, "count:\t%ld\n", file_count(dmabuf->file) - 1);
	seq_printf(m, "exp_name:\t%s\n", dmabuf->exp_name);
	mutex_lock(&dmabuf->lock);
	if (dmabuf->name)
		seq_printf(m, "name:\t%s\n", dmabuf->name);
	mutex_unlock(&dmabuf->lock);
}

412 413
static const struct file_operations dma_buf_fops = {
	.release	= dma_buf_release,
Daniel Vetter's avatar
Daniel Vetter committed
414
	.mmap		= dma_buf_mmap_internal,
415
	.llseek		= dma_buf_llseek,
416
	.poll		= dma_buf_poll,
417
	.unlocked_ioctl	= dma_buf_ioctl,
418 419 420
#ifdef CONFIG_COMPAT
	.compat_ioctl	= dma_buf_ioctl,
#endif
421
	.show_fdinfo	= dma_buf_show_fdinfo,
422 423 424 425 426 427 428 429 430 431
};

/*
 * is_dma_buf_file - Check if struct file* is associated with dma_buf
 */
static inline int is_dma_buf_file(struct file *file)
{
	return file->f_op == &dma_buf_fops;
}

432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448
static struct file *dma_buf_getfile(struct dma_buf *dmabuf, int flags)
{
	struct file *file;
	struct inode *inode = alloc_anon_inode(dma_buf_mnt->mnt_sb);

	if (IS_ERR(inode))
		return ERR_CAST(inode);

	inode->i_size = dmabuf->size;
	inode_set_bytes(inode, dmabuf->size);

	file = alloc_file_pseudo(inode, dma_buf_mnt, "dmabuf",
				 flags, &dma_buf_fops);
	if (IS_ERR(file))
		goto err_alloc_file;
	file->f_flags = flags & (O_ACCMODE | O_NONBLOCK);
	file->private_data = dmabuf;
449
	file->f_path.dentry->d_fsdata = dmabuf;
450 451 452 453 454 455 456 457

	return file;

err_alloc_file:
	iput(inode);
	return file;
}

458 459 460 461 462 463 464 465 466 467 468 469 470
/**
 * DOC: dma buf device access
 *
 * For device DMA access to a shared DMA buffer the usual sequence of operations
 * is fairly simple:
 *
 * 1. The exporter defines his exporter instance using
 *    DEFINE_DMA_BUF_EXPORT_INFO() and calls dma_buf_export() to wrap a private
 *    buffer object into a &dma_buf. It then exports that &dma_buf to userspace
 *    as a file descriptor by calling dma_buf_fd().
 *
 * 2. Userspace passes this file-descriptors to all drivers it wants this buffer
 *    to share with: First the filedescriptor is converted to a &dma_buf using
471
 *    dma_buf_get(). Then the buffer is attached to the device using
472 473 474 475 476
 *    dma_buf_attach().
 *
 *    Up to this stage the exporter is still free to migrate or reallocate the
 *    backing storage.
 *
477
 * 3. Once the buffer is attached to all devices userspace can initiate DMA
478 479 480 481 482 483 484 485 486 487 488
 *    access to the shared buffer. In the kernel this is done by calling
 *    dma_buf_map_attachment() and dma_buf_unmap_attachment().
 *
 * 4. Once a driver is done with a shared buffer it needs to call
 *    dma_buf_detach() (after cleaning up any mappings) and then release the
 *    reference acquired with dma_buf_get by calling dma_buf_put().
 *
 * For the detailed semantics exporters are expected to implement see
 * &dma_buf_ops.
 */

489
/**
490
 * dma_buf_export - Creates a new dma_buf, and associates an anon file
491 492
 * with this buffer, so it can be exported.
 * Also connect the allocator specific data and ops to the buffer.
493
 * Additionally, provide a name string for exporter; useful in debugging.
494
 *
495
 * @exp_info:	[in]	holds all the export related information provided
496
 *			by the exporter. see &struct dma_buf_export_info
497
 *			for further details.
498 499 500 501 502
 *
 * Returns, on success, a newly created dma_buf object, which wraps the
 * supplied private data and operations for dma_buf_ops. On either missing
 * ops, or error in allocating struct dma_buf, will return negative error.
 *
503 504
 * For most cases the easiest way to create @exp_info is through the
 * %DEFINE_DMA_BUF_EXPORT_INFO macro.
505
 */
506
struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
507 508
{
	struct dma_buf *dmabuf;
509
	struct reservation_object *resv = exp_info->resv;
510
	struct file *file;
511
	size_t alloc_size = sizeof(struct dma_buf);
512
	int ret;
Jagan Teki's avatar
Jagan Teki committed
513

514
	if (!exp_info->resv)
515 516 517 518
		alloc_size += sizeof(struct reservation_object);
	else
		/* prevent &dma_buf[1] == dma_buf->resv */
		alloc_size += 1;
519

520 521 522 523
	if (WARN_ON(!exp_info->priv
			  || !exp_info->ops
			  || !exp_info->ops->map_dma_buf
			  || !exp_info->ops->unmap_dma_buf
524
			  || !exp_info->ops->release)) {
525 526 527
		return ERR_PTR(-EINVAL);
	}

528 529 530
	if (!try_module_get(exp_info->owner))
		return ERR_PTR(-ENOENT);

531
	dmabuf = kzalloc(alloc_size, GFP_KERNEL);
532
	if (!dmabuf) {
533 534
		ret = -ENOMEM;
		goto err_module;
535
	}
536

537 538 539 540
	dmabuf->priv = exp_info->priv;
	dmabuf->ops = exp_info->ops;
	dmabuf->size = exp_info->size;
	dmabuf->exp_name = exp_info->exp_name;
541
	dmabuf->owner = exp_info->owner;
542 543 544 545
	init_waitqueue_head(&dmabuf->poll);
	dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll;
	dmabuf->cb_excl.active = dmabuf->cb_shared.active = 0;

546 547 548 549 550
	if (!resv) {
		resv = (struct reservation_object *)&dmabuf[1];
		reservation_object_init(resv);
	}
	dmabuf->resv = resv;
551

552
	file = dma_buf_getfile(dmabuf, exp_info->flags);
553
	if (IS_ERR(file)) {
554 555
		ret = PTR_ERR(file);
		goto err_dmabuf;
556
	}
557 558

	file->f_mode |= FMODE_LSEEK;
559 560 561 562 563
	dmabuf->file = file;

	mutex_init(&dmabuf->lock);
	INIT_LIST_HEAD(&dmabuf->attachments);

Sumit Semwal's avatar
Sumit Semwal committed
564 565 566 567
	mutex_lock(&db_list.lock);
	list_add(&dmabuf->list_node, &db_list.head);
	mutex_unlock(&db_list.lock);

568
	return dmabuf;
569 570 571 572 573 574

err_dmabuf:
	kfree(dmabuf);
err_module:
	module_put(exp_info->owner);
	return ERR_PTR(ret);
575
}
576
EXPORT_SYMBOL_GPL(dma_buf_export);
577 578 579 580

/**
 * dma_buf_fd - returns a file descriptor for the given dma_buf
 * @dmabuf:	[in]	pointer to dma_buf for which fd is required.
581
 * @flags:      [in]    flags to give to fd
582 583 584
 *
 * On success, returns an associated 'fd'. Else, returns error.
 */
585
int dma_buf_fd(struct dma_buf *dmabuf, int flags)
586
{
Borislav Petkov's avatar
Borislav Petkov committed
587
	int fd;
588 589 590 591

	if (!dmabuf || !dmabuf->file)
		return -EINVAL;

Borislav Petkov's avatar
Borislav Petkov committed
592 593 594
	fd = get_unused_fd_flags(flags);
	if (fd < 0)
		return fd;
595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631

	fd_install(fd, dmabuf->file);

	return fd;
}
EXPORT_SYMBOL_GPL(dma_buf_fd);

/**
 * dma_buf_get - returns the dma_buf structure related to an fd
 * @fd:	[in]	fd associated with the dma_buf to be returned
 *
 * On success, returns the dma_buf structure associated with an fd; uses
 * file's refcounting done by fget to increase refcount. returns ERR_PTR
 * otherwise.
 */
struct dma_buf *dma_buf_get(int fd)
{
	struct file *file;

	file = fget(fd);

	if (!file)
		return ERR_PTR(-EBADF);

	if (!is_dma_buf_file(file)) {
		fput(file);
		return ERR_PTR(-EINVAL);
	}

	return file->private_data;
}
EXPORT_SYMBOL_GPL(dma_buf_get);

/**
 * dma_buf_put - decreases refcount of the buffer
 * @dmabuf:	[in]	buffer to reduce refcount of
 *
632 633 634
 * Uses file's refcounting done implicitly by fput().
 *
 * If, as a result of this call, the refcount becomes 0, the 'release' file
635 636
 * operation related to this fd is called. It calls &dma_buf_ops.release vfunc
 * in turn, and frees the memory allocated for dmabuf when exported.
637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652
 */
void dma_buf_put(struct dma_buf *dmabuf)
{
	if (WARN_ON(!dmabuf || !dmabuf->file))
		return;

	fput(dmabuf->file);
}
EXPORT_SYMBOL_GPL(dma_buf_put);

/**
 * dma_buf_attach - Add the device to dma_buf's attachments list; optionally,
 * calls attach() of dma_buf_ops to allow device-specific attach functionality
 * @dmabuf:	[in]	buffer to attach device to.
 * @dev:	[in]	device to be attached.
 *
653 654 655 656 657 658 659 660 661 662 663
 * Returns struct dma_buf_attachment pointer for this attachment. Attachments
 * must be cleaned up by calling dma_buf_detach().
 *
 * Returns:
 *
 * A pointer to newly created &dma_buf_attachment on success, or a negative
 * error code wrapped into a pointer on failure.
 *
 * Note that this can fail if the backing storage of @dmabuf is in a place not
 * accessible to @dev, and cannot be moved to a more suitable place. This is
 * indicated with the error code -EBUSY.
664 665 666 667 668 669 670
 */
struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf,
					  struct device *dev)
{
	struct dma_buf_attachment *attach;
	int ret;

671
	if (WARN_ON(!dmabuf || !dev))
672 673
		return ERR_PTR(-EINVAL);

674
	attach = kzalloc(sizeof(*attach), GFP_KERNEL);
675
	if (!attach)
676
		return ERR_PTR(-ENOMEM);
677 678 679

	attach->dev = dev;
	attach->dmabuf = dmabuf;
680 681 682

	mutex_lock(&dmabuf->lock);

683
	if (dmabuf->ops->attach) {
684
		ret = dmabuf->ops->attach(dmabuf, attach);
685 686 687 688 689 690
		if (ret)
			goto err_attach;
	}
	list_add(&attach->node, &dmabuf->attachments);

	mutex_unlock(&dmabuf->lock);
691

692 693 694 695 696 697 698 699 700 701 702 703 704 705 706
	return attach;

err_attach:
	kfree(attach);
	mutex_unlock(&dmabuf->lock);
	return ERR_PTR(ret);
}
EXPORT_SYMBOL_GPL(dma_buf_attach);

/**
 * dma_buf_detach - Remove the given attachment from dmabuf's attachments list;
 * optionally calls detach() of dma_buf_ops for device-specific detach
 * @dmabuf:	[in]	buffer to detach from.
 * @attach:	[in]	attachment to be detached; is free'd after this call.
 *
707
 * Clean up a device attachment obtained by calling dma_buf_attach().
708 709 710
 */
void dma_buf_detach(struct dma_buf *dmabuf, struct dma_buf_attachment *attach)
{
711
	if (WARN_ON(!dmabuf || !attach))
712 713
		return;

714 715 716
	if (attach->sgt)
		dmabuf->ops->unmap_dma_buf(attach, attach->sgt, attach->dir);

717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733
	mutex_lock(&dmabuf->lock);
	list_del(&attach->node);
	if (dmabuf->ops->detach)
		dmabuf->ops->detach(dmabuf, attach);

	mutex_unlock(&dmabuf->lock);
	kfree(attach);
}
EXPORT_SYMBOL_GPL(dma_buf_detach);

/**
 * dma_buf_map_attachment - Returns the scatterlist table of the attachment;
 * mapped into _device_ address space. Is a wrapper for map_dma_buf() of the
 * dma_buf_ops.
 * @attach:	[in]	attachment whose scatterlist is to be returned
 * @direction:	[in]	direction of DMA transfer
 *
734
 * Returns sg_table containing the scatterlist to be returned; returns ERR_PTR
735 736
 * on error. May return -EINTR if it is interrupted by a signal.
 *
737
 * A mapping must be unmapped by using dma_buf_unmap_attachment(). Note that
738 739 740
 * the underlying backing storage is pinned for as long as a mapping exists,
 * therefore users/importers should not hold onto a mapping for undue amounts of
 * time.
741 742 743 744
 */
struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach,
					enum dma_data_direction direction)
{
745
	struct sg_table *sg_table;
746 747 748

	might_sleep();

749
	if (WARN_ON(!attach || !attach->dmabuf))
750 751
		return ERR_PTR(-EINVAL);

752 753 754 755 756 757 758 759 760 761 762 763
	if (attach->sgt) {
		/*
		 * Two mappings with different directions for the same
		 * attachment are not allowed.
		 */
		if (attach->dir != direction &&
		    attach->dir != DMA_BIDIRECTIONAL)
			return ERR_PTR(-EBUSY);

		return attach->sgt;
	}

764
	sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction);
765 766
	if (!sg_table)
		sg_table = ERR_PTR(-ENOMEM);
767

768 769 770 771 772
	if (!IS_ERR(sg_table) && attach->dmabuf->ops->cache_sgt_mapping) {
		attach->sgt = sg_table;
		attach->dir = direction;
	}

773 774 775 776 777 778 779 780 781 782
	return sg_table;
}
EXPORT_SYMBOL_GPL(dma_buf_map_attachment);

/**
 * dma_buf_unmap_attachment - unmaps and decreases usecount of the buffer;might
 * deallocate the scatterlist associated. Is a wrapper for unmap_dma_buf() of
 * dma_buf_ops.
 * @attach:	[in]	attachment to unmap buffer from
 * @sg_table:	[in]	scatterlist info of the buffer to unmap
783
 * @direction:  [in]    direction of DMA transfer
784
 *
785
 * This unmaps a DMA mapping for @attached obtained by dma_buf_map_attachment().
786 787
 */
void dma_buf_unmap_attachment(struct dma_buf_attachment *attach,
788 789
				struct sg_table *sg_table,
				enum dma_data_direction direction)
790
{
791 792
	might_sleep();

793
	if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
794 795
		return;

796 797 798 799
	if (attach->sgt == sg_table)
		return;

	attach->dmabuf->ops->unmap_dma_buf(attach, sg_table, direction);
800 801
}
EXPORT_SYMBOL_GPL(dma_buf_unmap_attachment);
802

803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825
/**
 * DOC: cpu access
 *
 * There are mutliple reasons for supporting CPU access to a dma buffer object:
 *
 * - Fallback operations in the kernel, for example when a device is connected
 *   over USB and the kernel needs to shuffle the data around first before
 *   sending it away. Cache coherency is handled by braketing any transactions
 *   with calls to dma_buf_begin_cpu_access() and dma_buf_end_cpu_access()
 *   access.
 *
 *   To support dma_buf objects residing in highmem cpu access is page-based
 *   using an api similar to kmap. Accessing a dma_buf is done in aligned chunks
 *   of PAGE_SIZE size. Before accessing a chunk it needs to be mapped, which
 *   returns a pointer in kernel virtual address space. Afterwards the chunk
 *   needs to be unmapped again. There is no limit on how often a given chunk
 *   can be mapped and unmapped, i.e. the importer does not need to call
 *   begin_cpu_access again before mapping the same chunk again.
 *
 *   Interfaces::
 *      void \*dma_buf_kmap(struct dma_buf \*, unsigned long);
 *      void dma_buf_kunmap(struct dma_buf \*, unsigned long, void \*);
 *
826 827
 *   Implementing the functions is optional for exporters and for importers all
 *   the restrictions of using kmap apply.
828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906
 *
 *   dma_buf kmap calls outside of the range specified in begin_cpu_access are
 *   undefined. If the range is not PAGE_SIZE aligned, kmap needs to succeed on
 *   the partial chunks at the beginning and end but may return stale or bogus
 *   data outside of the range (in these partial chunks).
 *
 *   For some cases the overhead of kmap can be too high, a vmap interface
 *   is introduced. This interface should be used very carefully, as vmalloc
 *   space is a limited resources on many architectures.
 *
 *   Interfaces::
 *      void \*dma_buf_vmap(struct dma_buf \*dmabuf)
 *      void dma_buf_vunmap(struct dma_buf \*dmabuf, void \*vaddr)
 *
 *   The vmap call can fail if there is no vmap support in the exporter, or if
 *   it runs out of vmalloc space. Fallback to kmap should be implemented. Note
 *   that the dma-buf layer keeps a reference count for all vmap access and
 *   calls down into the exporter's vmap function only when no vmapping exists,
 *   and only unmaps it once. Protection against concurrent vmap/vunmap calls is
 *   provided by taking the dma_buf->lock mutex.
 *
 * - For full compatibility on the importer side with existing userspace
 *   interfaces, which might already support mmap'ing buffers. This is needed in
 *   many processing pipelines (e.g. feeding a software rendered image into a
 *   hardware pipeline, thumbnail creation, snapshots, ...). Also, Android's ION
 *   framework already supported this and for DMA buffer file descriptors to
 *   replace ION buffers mmap support was needed.
 *
 *   There is no special interfaces, userspace simply calls mmap on the dma-buf
 *   fd. But like for CPU access there's a need to braket the actual access,
 *   which is handled by the ioctl (DMA_BUF_IOCTL_SYNC). Note that
 *   DMA_BUF_IOCTL_SYNC can fail with -EAGAIN or -EINTR, in which case it must
 *   be restarted.
 *
 *   Some systems might need some sort of cache coherency management e.g. when
 *   CPU and GPU domains are being accessed through dma-buf at the same time.
 *   To circumvent this problem there are begin/end coherency markers, that
 *   forward directly to existing dma-buf device drivers vfunc hooks. Userspace
 *   can make use of those markers through the DMA_BUF_IOCTL_SYNC ioctl. The
 *   sequence would be used like following:
 *
 *     - mmap dma-buf fd
 *     - for each drawing/upload cycle in CPU 1. SYNC_START ioctl, 2. read/write
 *       to mmap area 3. SYNC_END ioctl. This can be repeated as often as you
 *       want (with the new data being consumed by say the GPU or the scanout
 *       device)
 *     - munmap once you don't need the buffer any more
 *
 *    For correctness and optimal performance, it is always required to use
 *    SYNC_START and SYNC_END before and after, respectively, when accessing the
 *    mapped address. Userspace cannot rely on coherent access, even when there
 *    are systems where it just works without calling these ioctls.
 *
 * - And as a CPU fallback in userspace processing pipelines.
 *
 *   Similar to the motivation for kernel cpu access it is again important that
 *   the userspace code of a given importing subsystem can use the same
 *   interfaces with a imported dma-buf buffer object as with a native buffer
 *   object. This is especially important for drm where the userspace part of
 *   contemporary OpenGL, X, and other drivers is huge, and reworking them to
 *   use a different way to mmap a buffer rather invasive.
 *
 *   The assumption in the current dma-buf interfaces is that redirecting the
 *   initial mmap is all that's needed. A survey of some of the existing
 *   subsystems shows that no driver seems to do any nefarious thing like
 *   syncing up with outstanding asynchronous processing on the device or
 *   allocating special resources at fault time. So hopefully this is good
 *   enough, since adding interfaces to intercept pagefaults and allow pte
 *   shootdowns would increase the complexity quite a bit.
 *
 *   Interface::
 *      int dma_buf_mmap(struct dma_buf \*, struct vm_area_struct \*,
 *		       unsigned long);
 *
 *   If the importing subsystem simply provides a special-purpose mmap call to
 *   set up a mapping in userspace, calling do_mmap with dma_buf->file will
 *   equally achieve that for a dma-buf object.
 */

907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922
static int __dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
				      enum dma_data_direction direction)
{
	bool write = (direction == DMA_BIDIRECTIONAL ||
		      direction == DMA_TO_DEVICE);
	struct reservation_object *resv = dmabuf->resv;
	long ret;

	/* Wait on any implicit rendering fences */
	ret = reservation_object_wait_timeout_rcu(resv, write, true,
						  MAX_SCHEDULE_TIMEOUT);
	if (ret < 0)
		return ret;

	return 0;
}
923 924 925 926 927 928

/**
 * dma_buf_begin_cpu_access - Must be called before accessing a dma_buf from the
 * cpu in the kernel context. Calls begin_cpu_access to allow exporter-specific
 * preparations. Coherency is only guaranteed in the specified range for the
 * specified access direction.
929
 * @dmabuf:	[in]	buffer to prepare cpu access for.
930 931
 * @direction:	[in]	length of range for cpu access.
 *
932 933 934 935
 * After the cpu access is complete the caller should call
 * dma_buf_end_cpu_access(). Only when cpu access is braketed by both calls is
 * it guaranteed to be coherent with other DMA access.
 *
936 937
 * Can return negative error values, returns 0 on success.
 */
938
int dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
939 940 941 942 943 944 945 946
			     enum dma_data_direction direction)
{
	int ret = 0;

	if (WARN_ON(!dmabuf))
		return -EINVAL;

	if (dmabuf->ops->begin_cpu_access)
947
		ret = dmabuf->ops->begin_cpu_access(dmabuf, direction);
948

949 950 951 952 953 954 955
	/* Ensure that all fences are waited upon - but we first allow
	 * the native handler the chance to do so more efficiently if it
	 * chooses. A double invocation here will be reasonably cheap no-op.
	 */
	if (ret == 0)
		ret = __dma_buf_begin_cpu_access(dmabuf, direction);

956 957 958 959 960 961 962 963 964
	return ret;
}
EXPORT_SYMBOL_GPL(dma_buf_begin_cpu_access);

/**
 * dma_buf_end_cpu_access - Must be called after accessing a dma_buf from the
 * cpu in the kernel context. Calls end_cpu_access to allow exporter-specific
 * actions. Coherency is only guaranteed in the specified range for the
 * specified access direction.
965
 * @dmabuf:	[in]	buffer to complete cpu access for.
966 967
 * @direction:	[in]	length of range for cpu access.
 *
968 969
 * This terminates CPU access started with dma_buf_begin_cpu_access().
 *
970
 * Can return negative error values, returns 0 on success.
971
 */
972 973
int dma_buf_end_cpu_access(struct dma_buf *dmabuf,
			   enum dma_data_direction direction)
974
{
975 976
	int ret = 0;

977 978 979
	WARN_ON(!dmabuf);

	if (dmabuf->ops->end_cpu_access)
980 981 982
		ret = dmabuf->ops->end_cpu_access(dmabuf, direction);

	return ret;
983 984 985 986 987 988
}
EXPORT_SYMBOL_GPL(dma_buf_end_cpu_access);

/**
 * dma_buf_kmap - Map a page of the buffer object into kernel address space. The
 * same restrictions as for kmap and friends apply.
989
 * @dmabuf:	[in]	buffer to map page from.
990 991 992 993 994 995 996 997 998
 * @page_num:	[in]	page in PAGE_SIZE units to map.
 *
 * This call must always succeed, any necessary preparations that might fail
 * need to be done in begin_cpu_access.
 */
void *dma_buf_kmap(struct dma_buf *dmabuf, unsigned long page_num)
{
	WARN_ON(!dmabuf);

999 1000
	if (!dmabuf->ops->map)
		return NULL;
1001
	return dmabuf->ops->map(dmabuf, page_num);
1002 1003 1004 1005 1006
}
EXPORT_SYMBOL_GPL(dma_buf_kmap);

/**
 * dma_buf_kunmap - Unmap a page obtained by dma_buf_kmap.
1007
 * @dmabuf:	[in]	buffer to unmap page from.
1008 1009 1010 1011 1012 1013 1014 1015 1016 1017
 * @page_num:	[in]	page in PAGE_SIZE units to unmap.
 * @vaddr:	[in]	kernel space pointer obtained from dma_buf_kmap.
 *
 * This call must always succeed.
 */
void dma_buf_kunmap(struct dma_buf *dmabuf, unsigned long page_num,
		    void *vaddr)
{
	WARN_ON(!dmabuf);

1018 1019
	if (dmabuf->ops->unmap)
		dmabuf->ops->unmap(dmabuf, page_num, vaddr);
1020 1021
}
EXPORT_SYMBOL_GPL(dma_buf_kunmap);
Daniel Vetter's avatar
Daniel Vetter committed
1022 1023 1024 1025


/**
 * dma_buf_mmap - Setup up a userspace mmap with the given vma
1026
 * @dmabuf:	[in]	buffer that should back the vma
Daniel Vetter's avatar
Daniel Vetter committed
1027 1028
 * @vma:	[in]	vma for the mmap
 * @pgoff:	[in]	offset in pages where this mmap should start within the
Jagan Teki's avatar
Jagan Teki committed
1029
 *			dma-buf buffer.
Daniel Vetter's avatar
Daniel Vetter committed
1030 1031
 *
 * This function adjusts the passed in vma so that it points at the file of the
1032
 * dma_buf operation. It also adjusts the starting pgoff and does bounds
Daniel Vetter's avatar
Daniel Vetter committed
1033 1034 1035 1036 1037 1038 1039 1040
 * checking on the size of the vma. Then it calls the exporters mmap function to
 * set up the mapping.
 *
 * Can return negative error values, returns 0 on success.
 */
int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
		 unsigned long pgoff)
{
1041 1042 1043
	struct file *oldfile;
	int ret;

Daniel Vetter's avatar
Daniel Vetter committed
1044 1045 1046
	if (WARN_ON(!dmabuf || !vma))
		return -EINVAL;

1047 1048 1049 1050
	/* check if buffer supports mmap */
	if (!dmabuf->ops->mmap)
		return -EINVAL;

Daniel Vetter's avatar
Daniel Vetter committed
1051
	/* check for offset overflow */
1052
	if (pgoff + vma_pages(vma) < pgoff)
Daniel Vetter's avatar
Daniel Vetter committed
1053 1054 1055
		return -EOVERFLOW;

	/* check for overflowing the buffer's size */
1056
	if (pgoff + vma_pages(vma) >
Daniel Vetter's avatar
Daniel Vetter committed
1057 1058 1059 1060
	    dmabuf->size >> PAGE_SHIFT)
		return -EINVAL;

	/* readjust the vma */
1061 1062 1063
	get_file(dmabuf->file);
	oldfile = vma->vm_file;
	vma->vm_file = dmabuf->file;
Daniel Vetter's avatar
Daniel Vetter committed
1064 1065
	vma->vm_pgoff = pgoff;

1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076
	ret = dmabuf->ops->mmap(dmabuf, vma);
	if (ret) {
		/* restore old parameters on failure */
		vma->vm_file = oldfile;
		fput(dmabuf->file);
	} else {
		if (oldfile)
			fput(oldfile);
	}
	return ret;

Daniel Vetter's avatar
Daniel Vetter committed
1077 1078
}
EXPORT_SYMBOL_GPL(dma_buf_mmap);
Dave Airlie's avatar
Dave Airlie committed
1079 1080

/**
1081 1082 1083
 * dma_buf_vmap - Create virtual mapping for the buffer object into kernel
 * address space. Same restrictions as for vmap and friends apply.
 * @dmabuf:	[in]	buffer to vmap
Dave Airlie's avatar
Dave Airlie committed
1084 1085 1086 1087 1088
 *
 * This call may fail due to lack of virtual mapping address space.
 * These calls are optional in drivers. The intended use for them
 * is for mapping objects linear in kernel space for high use objects.
 * Please attempt to use kmap/kunmap before thinking about these interfaces.
1089 1090
 *
 * Returns NULL on error.
Dave Airlie's avatar
Dave Airlie committed
1091 1092 1093
 */
void *dma_buf_vmap(struct dma_buf *dmabuf)
{
1094 1095
	void *ptr;

Dave Airlie's avatar
Dave Airlie committed
1096 1097 1098
	if (WARN_ON(!dmabuf))
		return NULL;

1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112
	if (!dmabuf->ops->vmap)
		return NULL;

	mutex_lock(&dmabuf->lock);
	if (dmabuf->vmapping_counter) {
		dmabuf->vmapping_counter++;
		BUG_ON(!dmabuf->vmap_ptr);
		ptr = dmabuf->vmap_ptr;
		goto out_unlock;
	}

	BUG_ON(dmabuf->vmap_ptr);

	ptr = dmabuf->ops->vmap(dmabuf);
1113 1114 1115
	if (WARN_ON_ONCE(IS_ERR(ptr)))
		ptr = NULL;
	if (!ptr)
1116 1117 1118 1119 1120 1121 1122 1123
		goto out_unlock;

	dmabuf->vmap_ptr = ptr;
	dmabuf->vmapping_counter = 1;

out_unlock:
	mutex_unlock(&dmabuf->lock);
	return ptr;
Dave Airlie's avatar
Dave Airlie committed
1124 1125 1126 1127 1128
}
EXPORT_SYMBOL_GPL(dma_buf_vmap);

/**
 * dma_buf_vunmap - Unmap a vmap obtained by dma_buf_vmap.
1129
 * @dmabuf:	[in]	buffer to vunmap
1130
 * @vaddr:	[in]	vmap to vunmap
Dave Airlie's avatar
Dave Airlie committed
1131 1132 1133 1134 1135 1136
 */
void dma_buf_vunmap(struct dma_buf *dmabuf, void *vaddr)
{
	if (WARN_ON(!dmabuf))
		return;

1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147
	BUG_ON(!dmabuf->vmap_ptr);
	BUG_ON(dmabuf->vmapping_counter == 0);
	BUG_ON(dmabuf->vmap_ptr != vaddr);

	mutex_lock(&dmabuf->lock);
	if (--dmabuf->vmapping_counter == 0) {
		if (dmabuf->ops->vunmap)
			dmabuf->ops->vunmap(dmabuf, vaddr);
		dmabuf->vmap_ptr = NULL;
	}
	mutex_unlock(&dmabuf->lock);
Dave Airlie's avatar
Dave Airlie committed
1148 1149
}
EXPORT_SYMBOL_GPL(dma_buf_vunmap);
Sumit Semwal's avatar
Sumit Semwal committed
1150 1151

#ifdef CONFIG_DEBUG_FS
1152
static int dma_buf_debug_show(struct seq_file *s, void *unused)
Sumit Semwal's avatar
Sumit Semwal committed
1153 1154 1155 1156
{
	int ret;
	struct dma_buf *buf_obj;
	struct dma_buf_attachment *attach_obj;
Russell King's avatar
Russell King committed
1157 1158 1159 1160 1161
	struct reservation_object *robj;
	struct reservation_object_list *fobj;
	struct dma_fence *fence;
	unsigned seq;
	int count = 0, attach_count, shared_count, i;
Sumit Semwal's avatar
Sumit Semwal committed
1162 1163 1164 1165 1166 1167 1168
	size_t size = 0;

	ret = mutex_lock_interruptible(&db_list.lock);

	if (ret)
		return ret;

Sumit Semwal's avatar
Sumit Semwal committed
1169
	seq_puts(s, "\nDma-buf Objects:\n");
1170 1171
	seq_printf(s, "%-8s\t%-8s\t%-8s\t%-8s\texp_name\t%-8s\n",
		   "size", "flags", "mode", "count", "ino");
Sumit Semwal's avatar
Sumit Semwal committed
1172 1173 1174 1175 1176

	list_for_each_entry(buf_obj, &db_list.head, list_node) {
		ret = mutex_lock_interruptible(&buf_obj->lock);

		if (ret) {
Sumit Semwal's avatar
Sumit Semwal committed
1177 1178
			seq_puts(s,
				 "\tERROR locking buffer object: skipping\n");
Sumit Semwal's avatar
Sumit Semwal committed
1179 1180 1181
			continue;
		}

1182
		seq_printf(s, "%08zu\t%08x\t%08x\t%08ld\t%s\t%08lu\t%s\n",
Sumit Semwal's avatar
Sumit Semwal committed
1183
				buf_obj->size,
Sumit Semwal's avatar
Sumit Semwal committed
1184
				buf_obj->file->f_flags, buf_obj->file->f_mode,
1185
				file_count(buf_obj->file),
1186
				buf_obj->exp_name,
1187 1188
				file_inode(buf_obj->file)->i_ino,
				buf_obj->name ?: "");
Sumit Semwal's avatar
Sumit Semwal committed
1189

Russell King's avatar
Russell King committed
1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214
		robj = buf_obj->resv;
		while (true) {
			seq = read_seqcount_begin(&robj->seq);
			rcu_read_lock();
			fobj = rcu_dereference(robj->fence);
			shared_count = fobj ? fobj->shared_count : 0;
			fence = rcu_dereference(robj->fence_excl);
			if (!read_seqcount_retry(&robj->seq, seq))
				break;
			rcu_read_unlock();
		}

		if (fence)
			seq_printf(s, "\tExclusive fence: %s %s %ssignalled\n",
				   fence->ops->get_driver_name(fence),
				   fence->ops->get_timeline_name(fence),
				   dma_fence_is_signaled(fence) ? "" : "un");
		for (i = 0; i < shared_count; i++) {
			fence = rcu_dereference(fobj->shared[i]);
			if (!dma_fence_get_rcu(fence))
				continue;
			seq_printf(s, "\tShared fence: %s %s %ssignalled\n",
				   fence->ops->get_driver_name(fence),
				   fence->ops->get_timeline_name(fence),
				   dma_fence_is_signaled(fence) ? "" : "un");
1215
			dma_fence_put(fence);
Russell King's avatar
Russell King committed
1216 1217 1218
		}
		rcu_read_unlock();

Sumit Semwal's avatar
Sumit Semwal committed
1219
		seq_puts(s, "\tAttached Devices:\n");
Sumit Semwal's avatar
Sumit Semwal committed
1220 1221 1222
		attach_count = 0;

		list_for_each_entry(attach_obj, &buf_obj->attachments, node) {
1223
			seq_printf(s, "\t%s\n", dev_name(attach_obj->dev));
Sumit Semwal's avatar
Sumit Semwal committed
1224 1225 1226
			attach_count++;
		}

Sumit Semwal's avatar
Sumit Semwal committed
1227
		seq_printf(s, "Total %d devices attached\n\n",
Sumit Semwal's avatar
Sumit Semwal committed
1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240
				attach_count);

		count++;
		size += buf_obj->size;
		mutex_unlock(&buf_obj->lock);
	}

	seq_printf(s, "\nTotal %d objects, %zu bytes\n", count, size);

	mutex_unlock(&db_list.lock);
	return 0;
}

1241
DEFINE_SHOW_ATTRIBUTE(dma_buf_debug);
Sumit Semwal's avatar
Sumit Semwal committed
1242 1243 1244 1245 1246

static struct dentry *dma_buf_debugfs_dir;

static int dma_buf_init_debugfs(void)
{
1247
	struct dentry *d;
Sumit Semwal's avatar
Sumit Semwal committed
1248
	int err = 0;
Jagan Teki's avatar
Jagan Teki committed
1249

1250 1251 1252
	d = debugfs_create_dir("dma_buf", NULL);
	if (IS_ERR(d))
		return PTR_ERR(d);
Jagan Teki's avatar
Jagan Teki committed
1253

1254
	dma_buf_debugfs_dir = d;
Sumit Semwal's avatar
Sumit Semwal committed
1255

1256 1257 1258
	d<