Commit b1fa6d8a authored by Laura Abbott's avatar Laura Abbott Committed by Greg Kroah-Hartman
Browse files

staging: android: ion: Pull out ion ioctls to a separate file 



The number of Ion ioctls may continue to grow along with necessary
validation. Pull it out into a separate file for easier management
and review.

Signed-off-by: default avatarLaura Abbott <labbott@redhat.com>
Acked-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9c2edd8b

drivers/staging/android/ion/Makefile

+2 −1
Original line number Diff line number Diff line 
obj-$(CONFIG_ION) +=	ion.o ion_heap.o ion_page_pool.o ion_system_heap.o \

obj-$(CONFIG_ION) +=	ion.o ion-ioctl.o ion_heap.o \

			ion_page_pool.o ion_system_heap.o \

			ion_carveout_heap.o ion_chunk_heap.o ion_cma_heap.o

obj-$(CONFIG_ION_TEST) += ion_test.o

ifdef CONFIG_COMPAT

drivers/staging/android/ion/ion-ioctl.c

0 → 100644
+144 −0
Original line number Diff line number Diff line 
/*

 *

 * Copyright (C) 2011 Google, Inc.

 *

 * This software is licensed under the terms of the GNU General Public

 * License version 2, as published by the Free Software Foundation, and

 * may be copied, distributed, and modified under those terms.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 */



#include <linux/kernel.h>

#include <linux/file.h>

#include <linux/fs.h>

#include <linux/uaccess.h>



#include "ion.h"

#include "ion_priv.h"

#include "compat_ion.h"



/* fix up the cases where the ioctl direction bits are incorrect */

static unsigned int ion_ioctl_dir(unsigned int cmd)

{

	switch (cmd) {

	case ION_IOC_SYNC:

	case ION_IOC_FREE:

	case ION_IOC_CUSTOM:

		return _IOC_WRITE;

	default:

		return _IOC_DIR(cmd);

	}

}



long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)

{

	struct ion_client *client = filp->private_data;

	struct ion_device *dev = client->dev;

	struct ion_handle *cleanup_handle = NULL;

	int ret = 0;

	unsigned int dir;



	union {

		struct ion_fd_data fd;

		struct ion_allocation_data allocation;

		struct ion_handle_data handle;

		struct ion_custom_data custom;

	} data;



	dir = ion_ioctl_dir(cmd);



	if (_IOC_SIZE(cmd) > sizeof(data))

		return -EINVAL;



	if (dir & _IOC_WRITE)

		if (copy_from_user(&data, (void __user *)arg, _IOC_SIZE(cmd)))

			return -EFAULT;



	switch (cmd) {

	case ION_IOC_ALLOC:

	{

		struct ion_handle *handle;



		handle = ion_alloc(client, data.allocation.len,

						data.allocation.align,

						data.allocation.heap_id_mask,

						data.allocation.flags);

		if (IS_ERR(handle))

			return PTR_ERR(handle);



		data.allocation.handle = handle->id;



		cleanup_handle = handle;

		break;

	}

	case ION_IOC_FREE:

	{

		struct ion_handle *handle;



		mutex_lock(&client->lock);

		handle = ion_handle_get_by_id_nolock(client, data.handle.handle);

		if (IS_ERR(handle)) {

			mutex_unlock(&client->lock);

			return PTR_ERR(handle);

		}

		ion_free_nolock(client, handle);

		ion_handle_put_nolock(handle);

		mutex_unlock(&client->lock);

		break;

	}

	case ION_IOC_SHARE:

	case ION_IOC_MAP:

	{

		struct ion_handle *handle;



		handle = ion_handle_get_by_id(client, data.handle.handle);

		if (IS_ERR(handle))

			return PTR_ERR(handle);

		data.fd.fd = ion_share_dma_buf_fd(client, handle);

		ion_handle_put(handle);

		if (data.fd.fd < 0)

			ret = data.fd.fd;

		break;

	}

	case ION_IOC_IMPORT:

	{

		struct ion_handle *handle;



		handle = ion_import_dma_buf_fd(client, data.fd.fd);

		if (IS_ERR(handle))

			ret = PTR_ERR(handle);

		else

			data.handle.handle = handle->id;

		break;

	}

	case ION_IOC_SYNC:

	{

		ret = ion_sync_for_device(client, data.fd.fd);

		break;

	}

	case ION_IOC_CUSTOM:

	{

		if (!dev->custom_ioctl)

			return -ENOTTY;

		ret = dev->custom_ioctl(client, data.custom.cmd,

						data.custom.arg);

		break;

	}

	default:

		return -ENOTTY;

	}



	if (dir & _IOC_READ) {

		if (copy_to_user((void __user *)arg, &data, _IOC_SIZE(cmd))) {

			if (cleanup_handle)

				ion_free(client, cleanup_handle);

			return -EFAULT;

		}

	}

	return ret;

}

drivers/staging/android/ion/ion.c

+8 −204
Original line number Diff line number Diff line
@@ -41,80 +41,6 @@ 
#include "ion_priv.h"

#include "compat_ion.h"



/**

 * struct ion_device - the metadata of the ion device node

 * @dev:		the actual misc device

 * @buffers:		an rb tree of all the existing buffers

 * @buffer_lock:	lock protecting the tree of buffers

 * @lock:		rwsem protecting the tree of heaps and clients

 * @heaps:		list of all the heaps in the system

 * @user_clients:	list of all the clients created from userspace

 */

struct ion_device {

	struct miscdevice dev;

	struct rb_root buffers;

	struct mutex buffer_lock;

	struct rw_semaphore lock;

	struct plist_head heaps;

	long (*custom_ioctl)(struct ion_client *client, unsigned int cmd,

			     unsigned long arg);

	struct rb_root clients;

	struct dentry *debug_root;

	struct dentry *heaps_debug_root;

	struct dentry *clients_debug_root;

};



/**

 * struct ion_client - a process/hw block local address space

 * @node:		node in the tree of all clients

 * @dev:		backpointer to ion device

 * @handles:		an rb tree of all the handles in this client

 * @idr:		an idr space for allocating handle ids

 * @lock:		lock protecting the tree of handles

 * @name:		used for debugging

 * @display_name:	used for debugging (unique version of @name)

 * @display_serial:	used for debugging (to make display_name unique)

 * @task:		used for debugging

 *

 * A client represents a list of buffers this client may access.

 * The mutex stored here is used to protect both handles tree

 * as well as the handles themselves, and should be held while modifying either.

 */

struct ion_client {

	struct rb_node node;

	struct ion_device *dev;

	struct rb_root handles;

	struct idr idr;

	struct mutex lock;

	const char *name;

	char *display_name;

	int display_serial;

	struct task_struct *task;

	pid_t pid;

	struct dentry *debug_root;

};



/**

 * ion_handle - a client local reference to a buffer

 * @ref:		reference count

 * @client:		back pointer to the client the buffer resides in

 * @buffer:		pointer to the buffer

 * @node:		node in the client's handle rbtree

 * @kmap_cnt:		count of times this client has mapped to kernel

 * @id:			client-unique id allocated by client->idr

 *

 * Modifications to node, map_cnt or mapping should be protected by the

 * lock in the client.  Other fields are never changed after initialization.

 */

struct ion_handle {

	struct kref ref;

	struct ion_client *client;

	struct ion_buffer *buffer;

	struct rb_node node;

	unsigned int kmap_cnt;

	int id;

};



bool ion_buffer_fault_user_mappings(struct ion_buffer *buffer)

{

	return (buffer->flags & ION_FLAG_CACHED) &&
@@ -376,12 +302,12 @@ static void ion_handle_get(struct ion_handle *handle) 
	kref_get(&handle->ref);

}



static int ion_handle_put_nolock(struct ion_handle *handle)

int ion_handle_put_nolock(struct ion_handle *handle)

{

	return kref_put(&handle->ref, ion_handle_destroy);

}



static int ion_handle_put(struct ion_handle *handle)

int ion_handle_put(struct ion_handle *handle)

{

	struct ion_client *client = handle->client;

	int ret;
@@ -411,7 +337,7 @@ static struct ion_handle *ion_handle_lookup(struct ion_client *client, 
	return ERR_PTR(-EINVAL);

}



static struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client,

struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client,

					       int id)

{

	struct ion_handle *handle;
@@ -423,7 +349,7 @@ static struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client, 
	return handle ? handle : ERR_PTR(-EINVAL);

}



static struct ion_handle *ion_handle_get_by_id(struct ion_client *client,

struct ion_handle *ion_handle_get_by_id(struct ion_client *client,

					       int id)

{

	struct ion_handle *handle;
@@ -536,7 +462,7 @@ struct ion_handle *ion_alloc(struct ion_client *client, size_t len, 
}

EXPORT_SYMBOL(ion_alloc);



static void ion_free_nolock(struct ion_client *client,

void ion_free_nolock(struct ion_client *client,

		     struct ion_handle *handle)

{

	if (!ion_handle_validate(client, handle)) {
@@ -1209,7 +1135,7 @@ struct ion_handle *ion_import_dma_buf_fd(struct ion_client *client, int fd) 
}

EXPORT_SYMBOL(ion_import_dma_buf_fd);



static int ion_sync_for_device(struct ion_client *client, int fd)

int ion_sync_for_device(struct ion_client *client, int fd)

{

	struct dma_buf *dmabuf;

	struct ion_buffer *buffer;
@@ -1233,128 +1159,6 @@ static int ion_sync_for_device(struct ion_client *client, int fd) 
	return 0;

}



/* fix up the cases where the ioctl direction bits are incorrect */

static unsigned int ion_ioctl_dir(unsigned int cmd)

{

	switch (cmd) {

	case ION_IOC_SYNC:

	case ION_IOC_FREE:

	case ION_IOC_CUSTOM:

		return _IOC_WRITE;

	default:

		return _IOC_DIR(cmd);

	}

}



static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)

{

	struct ion_client *client = filp->private_data;

	struct ion_device *dev = client->dev;

	struct ion_handle *cleanup_handle = NULL;

	int ret = 0;

	unsigned int dir;



	union {

		struct ion_fd_data fd;

		struct ion_allocation_data allocation;

		struct ion_handle_data handle;

		struct ion_custom_data custom;

	} data;



	dir = ion_ioctl_dir(cmd);



	if (_IOC_SIZE(cmd) > sizeof(data))

		return -EINVAL;



	if (dir & _IOC_WRITE)

		if (copy_from_user(&data, (void __user *)arg, _IOC_SIZE(cmd)))

			return -EFAULT;



	switch (cmd) {

	case ION_IOC_ALLOC:

	{

		struct ion_handle *handle;



		handle = ion_alloc(client, data.allocation.len,

				   data.allocation.align,

				   data.allocation.heap_id_mask,

				   data.allocation.flags);

		if (IS_ERR(handle))

			return PTR_ERR(handle);



		data.allocation.handle = handle->id;



		cleanup_handle = handle;

		break;

	}

	case ION_IOC_FREE:

	{

		struct ion_handle *handle;



		mutex_lock(&client->lock);

		handle = ion_handle_get_by_id_nolock(client,

						     data.handle.handle);

		if (IS_ERR(handle)) {

			mutex_unlock(&client->lock);

			return PTR_ERR(handle);

		}

		ion_free_nolock(client, handle);

		ion_handle_put_nolock(handle);

		mutex_unlock(&client->lock);

		break;

	}

	case ION_IOC_SHARE:

	case ION_IOC_MAP:

	{

		struct ion_handle *handle;



		handle = ion_handle_get_by_id(client, data.handle.handle);

		if (IS_ERR(handle))

			return PTR_ERR(handle);

		data.fd.fd = ion_share_dma_buf_fd(client, handle);

		ion_handle_put(handle);

		if (data.fd.fd < 0)

			ret = data.fd.fd;

		break;

	}

	case ION_IOC_IMPORT:

	{

		struct ion_handle *handle;



		handle = ion_import_dma_buf_fd(client, data.fd.fd);

		if (IS_ERR(handle))

			ret = PTR_ERR(handle);

		else

			data.handle.handle = handle->id;

		break;

	}

	case ION_IOC_SYNC:

	{

		ret = ion_sync_for_device(client, data.fd.fd);

		break;

	}

	case ION_IOC_CUSTOM:

	{

		if (!dev->custom_ioctl)

			return -ENOTTY;

		ret = dev->custom_ioctl(client, data.custom.cmd,

						data.custom.arg);

		break;

	}

	default:

		return -ENOTTY;

	}



	if (dir & _IOC_READ) {

		if (copy_to_user((void __user *)arg, &data, _IOC_SIZE(cmd))) {

			if (cleanup_handle)

				ion_free(client, cleanup_handle);

			return -EFAULT;

		}

	}

	return ret;

}



static int ion_release(struct inode *inode, struct file *file)

{

	struct ion_client *client = file->private_data;

drivers/staging/android/ion/ion_priv.h

+91 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ 
#include <linux/sched.h>

#include <linux/shrinker.h>

#include <linux/types.h>

#include <linux/miscdevice.h>



#include "ion.h"
@@ -80,6 +81,80 @@ struct ion_buffer { 
};

void ion_buffer_destroy(struct ion_buffer *buffer);



/**

 * struct ion_device - the metadata of the ion device node

 * @dev:		the actual misc device

 * @buffers:		an rb tree of all the existing buffers

 * @buffer_lock:	lock protecting the tree of buffers

 * @lock:		rwsem protecting the tree of heaps and clients

 * @heaps:		list of all the heaps in the system

 * @user_clients:	list of all the clients created from userspace

 */

struct ion_device {

	struct miscdevice dev;

	struct rb_root buffers;

	struct mutex buffer_lock;

	struct rw_semaphore lock;

	struct plist_head heaps;

	long (*custom_ioctl)(struct ion_client *client, unsigned int cmd,

			     unsigned long arg);

	struct rb_root clients;

	struct dentry *debug_root;

	struct dentry *heaps_debug_root;

	struct dentry *clients_debug_root;

};



/**

 * struct ion_client - a process/hw block local address space

 * @node:		node in the tree of all clients

 * @dev:		backpointer to ion device

 * @handles:		an rb tree of all the handles in this client

 * @idr:		an idr space for allocating handle ids

 * @lock:		lock protecting the tree of handles

 * @name:		used for debugging

 * @display_name:	used for debugging (unique version of @name)

 * @display_serial:	used for debugging (to make display_name unique)

 * @task:		used for debugging

 *

 * A client represents a list of buffers this client may access.

 * The mutex stored here is used to protect both handles tree

 * as well as the handles themselves, and should be held while modifying either.

 */

struct ion_client {

	struct rb_node node;

	struct ion_device *dev;

	struct rb_root handles;

	struct idr idr;

	struct mutex lock;

	const char *name;

	char *display_name;

	int display_serial;

	struct task_struct *task;

	pid_t pid;

	struct dentry *debug_root;

};



/**

 * ion_handle - a client local reference to a buffer

 * @ref:		reference count

 * @client:		back pointer to the client the buffer resides in

 * @buffer:		pointer to the buffer

 * @node:		node in the client's handle rbtree

 * @kmap_cnt:		count of times this client has mapped to kernel

 * @id:			client-unique id allocated by client->idr

 *

 * Modifications to node, map_cnt or mapping should be protected by the

 * lock in the client.  Other fields are never changed after initialization.

 */

struct ion_handle {

	struct kref ref;

	struct ion_client *client;

	struct ion_buffer *buffer;

	struct rb_node node;

	unsigned int kmap_cnt;

	int id;

};



/**

 * struct ion_heap_ops - ops to operate on a given heap

 * @allocate:		allocate memory
@@ -376,4 +451,20 @@ int ion_page_pool_shrink(struct ion_page_pool *pool, gfp_t gfp_mask, 
void ion_pages_sync_for_device(struct device *dev, struct page *page,

		size_t size, enum dma_data_direction dir);



long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg);



int ion_sync_for_device(struct ion_client *client, int fd);



struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client,

						int id);



void ion_free_nolock(struct ion_client *client, struct ion_handle *handle);



int ion_handle_put_nolock(struct ion_handle *handle);



struct ion_handle *ion_handle_get_by_id(struct ion_client *client,

						int id);



int ion_handle_put(struct ion_handle *handle);



#endif /* _ION_PRIV_H */