iio: Add reference counting for buffers

Since the buffer is accessed by userspace we can not just free the buffers
memory once we are done with it in kernel space. There might still be open file
descriptors and userspace still might be accessing the buffer. This patch adds
support for reference counting to the IIO buffers. When a buffer is created and
initialized its initial reference count is set to 1. Instead of freeing the
memory of the buffer the buffer's _free() function will drop that reference
again. But only after the last reference to the buffer has been dropped the
buffer the buffer's memory will be freed. The IIO device will take a reference
to its primary buffer. The patch adds a small helper function for this called
iio_device_attach_buffer() which will get a reference to the buffer and assign
the buffer to the IIO device. This function must be used instead of assigning
the buffer to the device by hand. The reference is only dropped once the IIO
device is freed and we can be sure that there are no more open file handles. A
reference to a buffer will also be taken whenever the buffer is active to avoid
the buffer being freed while data is still being send to it.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>

1 files changed, 61 insertions, 5 deletions

diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index e9f389b9da69..36c39dcad850 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -74,6 +74,7 @@ void iio_buffer_init(struct iio_buffer *buffer)
         INIT_LIST_HEAD(&buffer->demux_list);
         INIT_LIST_HEAD(&buffer->buffer_list);
         init_waitqueue_head(&buffer->pollq);
+        kref_init(&buffer->ref);
 }
 EXPORT_SYMBOL(iio_buffer_init);
 
@@ -454,6 +455,19 @@ static int iio_compute_scan_bytes(struct iio_dev *indio_dev,
         return bytes;
 }
 
+static void iio_buffer_activate(struct iio_dev *indio_dev,
+        struct iio_buffer *buffer)
+{
+        iio_buffer_get(buffer);
+        list_add(&buffer->buffer_list, &indio_dev->buffer_list);
+}
+
+static void iio_buffer_deactivate(struct iio_buffer *buffer)
+{
+        list_del_init(&buffer->buffer_list);
+        iio_buffer_put(buffer);
+}
+
 void iio_disable_all_buffers(struct iio_dev *indio_dev)
 {
         struct iio_buffer *buffer, *_buffer;
@@ -466,7 +480,7 @@ void iio_disable_all_buffers(struct iio_dev *indio_dev)
 
         list_for_each_entry_safe(buffer, _buffer,
                         &indio_dev->buffer_list, buffer_list)
-                list_del_init(&buffer->buffer_list);
+                iio_buffer_deactivate(buffer);
 
         indio_dev->currentmode = INDIO_DIRECT_MODE;
         if (indio_dev->setup_ops->postdisable)
@@ -503,9 +517,9 @@ int iio_update_buffers(struct iio_dev *indio_dev,
                 indio_dev->active_scan_mask = NULL;
 
         if (remove_buffer)
-                list_del_init(&remove_buffer->buffer_list);
+                iio_buffer_deactivate(remove_buffer);
         if (insert_buffer)
-                list_add(&insert_buffer->buffer_list, &indio_dev->buffer_list);
+                iio_buffer_activate(indio_dev, insert_buffer);
 
         /* If no buffers in list, we are done */
         if (list_empty(&indio_dev->buffer_list)) {
@@ -540,7 +554,7 @@ int iio_update_buffers(struct iio_dev *indio_dev,
                          * Roll back.
                          * Note can only occur when adding a buffer.
                          */
-                        list_del_init(&insert_buffer->buffer_list);
+                        iio_buffer_deactivate(insert_buffer);
                         if (old_mask) {
                                 indio_dev->active_scan_mask = old_mask;
                                 success = -EINVAL;
@@ -631,7 +645,7 @@ error_run_postdisable:
 error_remove_inserted:
 
         if (insert_buffer)
-                list_del_init(&insert_buffer->buffer_list);
+                iio_buffer_deactivate(insert_buffer);
         indio_dev->active_scan_mask = old_mask;
         kfree(compound_mask);
 error_ret:
@@ -952,3 +966,45 @@ error_clear_mux_table:
         return ret;
 }
 EXPORT_SYMBOL_GPL(iio_update_demux);
+
+/**
+ * iio_buffer_release() - Free a buffer's resources
+ * @ref: Pointer to the kref embedded in the iio_buffer struct
+ *
+ * This function is called when the last reference to the buffer has been
+ * dropped. It will typically free all resources allocated by the buffer. Do not
+ * call this function manually, always use iio_buffer_put() when done using a
+ * buffer.
+ */
+static void iio_buffer_release(struct kref *ref)
+{
+        struct iio_buffer *buffer = container_of(ref, struct iio_buffer, ref);
+
+        buffer->access->release(buffer);
+}
+
+/**
+ * iio_buffer_get() - Grab a reference to the buffer
+ * @buffer: The buffer to grab a reference for, may be NULL
+ *
+ * Returns the pointer to the buffer that was passed into the function.
+ */
+struct iio_buffer *iio_buffer_get(struct iio_buffer *buffer)
+{
+        if (buffer)
+                kref_get(&buffer->ref);
+
+        return buffer;
+}
+EXPORT_SYMBOL_GPL(iio_buffer_get);
+
+/**
+ * iio_buffer_put() - Release the reference to the buffer
+ * @buffer: The buffer to release the reference for, may be NULL
+ */
+void iio_buffer_put(struct iio_buffer *buffer)
+{
+        if (buffer)
+                kref_put(&buffer->ref, iio_buffer_release);
+}
+EXPORT_SYMBOL_GPL(iio_buffer_put);