Loading...
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Sync File validation framework
4 *
5 * Copyright (C) 2012 Google, Inc.
6 */
7
8#include <linux/file.h>
9#include <linux/fs.h>
10#include <linux/uaccess.h>
11#include <linux/slab.h>
12#include <linux/sync_file.h>
13
14#include "sync_debug.h"
15
16#define CREATE_TRACE_POINTS
17#include "sync_trace.h"
18
19/*
20 * SW SYNC validation framework
21 *
22 * A sync object driver that uses a 32bit counter to coordinate
23 * synchronization. Useful when there is no hardware primitive backing
24 * the synchronization.
25 *
26 * To start the framework just open:
27 *
28 * <debugfs>/sync/sw_sync
29 *
30 * That will create a sync timeline, all fences created under this timeline
31 * file descriptor will belong to the this timeline.
32 *
33 * The 'sw_sync' file can be opened many times as to create different
34 * timelines.
35 *
36 * Fences can be created with SW_SYNC_IOC_CREATE_FENCE ioctl with struct
37 * sw_sync_create_fence_data as parameter.
38 *
39 * To increment the timeline counter, SW_SYNC_IOC_INC ioctl should be used
40 * with the increment as u32. This will update the last signaled value
41 * from the timeline and signal any fence that has a seqno smaller or equal
42 * to it.
43 *
44 * struct sw_sync_create_fence_data
45 * @value: the seqno to initialise the fence with
46 * @name: the name of the new sync point
47 * @fence: return the fd of the new sync_file with the created fence
48 */
49struct sw_sync_create_fence_data {
50 __u32 value;
51 char name[32];
52 __s32 fence; /* fd of new fence */
53};
54
55/**
56 * struct sw_sync_get_deadline - get the deadline hint of a sw_sync fence
57 * @deadline_ns: absolute time of the deadline
58 * @pad: must be zero
59 * @fence_fd: the sw_sync fence fd (in)
60 *
61 * Return the earliest deadline set on the fence. The timebase for the
62 * deadline is CLOCK_MONOTONIC (same as vblank). If there is no deadline
63 * set on the fence, this ioctl will return -ENOENT.
64 */
65struct sw_sync_get_deadline {
66 __u64 deadline_ns;
67 __u32 pad;
68 __s32 fence_fd;
69};
70
71#define SW_SYNC_IOC_MAGIC 'W'
72
73#define SW_SYNC_IOC_CREATE_FENCE _IOWR(SW_SYNC_IOC_MAGIC, 0,\
74 struct sw_sync_create_fence_data)
75
76#define SW_SYNC_IOC_INC _IOW(SW_SYNC_IOC_MAGIC, 1, __u32)
77#define SW_SYNC_GET_DEADLINE _IOWR(SW_SYNC_IOC_MAGIC, 2, \
78 struct sw_sync_get_deadline)
79
80
81#define SW_SYNC_HAS_DEADLINE_BIT DMA_FENCE_FLAG_USER_BITS
82
83static const struct dma_fence_ops timeline_fence_ops;
84
85static inline struct sync_pt *dma_fence_to_sync_pt(struct dma_fence *fence)
86{
87 if (fence->ops != &timeline_fence_ops)
88 return NULL;
89 return container_of(fence, struct sync_pt, base);
90}
91
92/**
93 * sync_timeline_create() - creates a sync object
94 * @name: sync_timeline name
95 *
96 * Creates a new sync_timeline. Returns the sync_timeline object or NULL in
97 * case of error.
98 */
99static struct sync_timeline *sync_timeline_create(const char *name)
100{
101 struct sync_timeline *obj;
102
103 obj = kzalloc(sizeof(*obj), GFP_KERNEL);
104 if (!obj)
105 return NULL;
106
107 kref_init(&obj->kref);
108 obj->context = dma_fence_context_alloc(1);
109 strscpy(obj->name, name, sizeof(obj->name));
110
111 obj->pt_tree = RB_ROOT;
112 INIT_LIST_HEAD(&obj->pt_list);
113 spin_lock_init(&obj->lock);
114
115 sync_timeline_debug_add(obj);
116
117 return obj;
118}
119
120static void sync_timeline_free(struct kref *kref)
121{
122 struct sync_timeline *obj =
123 container_of(kref, struct sync_timeline, kref);
124
125 sync_timeline_debug_remove(obj);
126
127 kfree(obj);
128}
129
130static void sync_timeline_get(struct sync_timeline *obj)
131{
132 kref_get(&obj->kref);
133}
134
135static void sync_timeline_put(struct sync_timeline *obj)
136{
137 kref_put(&obj->kref, sync_timeline_free);
138}
139
140static const char *timeline_fence_get_driver_name(struct dma_fence *fence)
141{
142 return "sw_sync";
143}
144
145static const char *timeline_fence_get_timeline_name(struct dma_fence *fence)
146{
147 struct sync_timeline *parent = dma_fence_parent(fence);
148
149 return parent->name;
150}
151
152static void timeline_fence_release(struct dma_fence *fence)
153{
154 struct sync_pt *pt = dma_fence_to_sync_pt(fence);
155 struct sync_timeline *parent = dma_fence_parent(fence);
156 unsigned long flags;
157
158 spin_lock_irqsave(fence->lock, flags);
159 if (!list_empty(&pt->link)) {
160 list_del(&pt->link);
161 rb_erase(&pt->node, &parent->pt_tree);
162 }
163 spin_unlock_irqrestore(fence->lock, flags);
164
165 sync_timeline_put(parent);
166 dma_fence_free(fence);
167}
168
169static bool timeline_fence_signaled(struct dma_fence *fence)
170{
171 struct sync_timeline *parent = dma_fence_parent(fence);
172
173 return !__dma_fence_is_later(fence->seqno, parent->value, fence->ops);
174}
175
176static void timeline_fence_value_str(struct dma_fence *fence,
177 char *str, int size)
178{
179 snprintf(str, size, "%lld", fence->seqno);
180}
181
182static void timeline_fence_timeline_value_str(struct dma_fence *fence,
183 char *str, int size)
184{
185 struct sync_timeline *parent = dma_fence_parent(fence);
186
187 snprintf(str, size, "%d", parent->value);
188}
189
190static void timeline_fence_set_deadline(struct dma_fence *fence, ktime_t deadline)
191{
192 struct sync_pt *pt = dma_fence_to_sync_pt(fence);
193 unsigned long flags;
194
195 spin_lock_irqsave(fence->lock, flags);
196 if (test_bit(SW_SYNC_HAS_DEADLINE_BIT, &fence->flags)) {
197 if (ktime_before(deadline, pt->deadline))
198 pt->deadline = deadline;
199 } else {
200 pt->deadline = deadline;
201 __set_bit(SW_SYNC_HAS_DEADLINE_BIT, &fence->flags);
202 }
203 spin_unlock_irqrestore(fence->lock, flags);
204}
205
206static const struct dma_fence_ops timeline_fence_ops = {
207 .get_driver_name = timeline_fence_get_driver_name,
208 .get_timeline_name = timeline_fence_get_timeline_name,
209 .signaled = timeline_fence_signaled,
210 .release = timeline_fence_release,
211 .fence_value_str = timeline_fence_value_str,
212 .timeline_value_str = timeline_fence_timeline_value_str,
213 .set_deadline = timeline_fence_set_deadline,
214};
215
216/**
217 * sync_timeline_signal() - signal a status change on a sync_timeline
218 * @obj: sync_timeline to signal
219 * @inc: num to increment on timeline->value
220 *
221 * A sync implementation should call this any time one of it's fences
222 * has signaled or has an error condition.
223 */
224static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
225{
226 LIST_HEAD(signalled);
227 struct sync_pt *pt, *next;
228
229 trace_sync_timeline(obj);
230
231 spin_lock_irq(&obj->lock);
232
233 obj->value += inc;
234
235 list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
236 if (!timeline_fence_signaled(&pt->base))
237 break;
238
239 dma_fence_get(&pt->base);
240
241 list_move_tail(&pt->link, &signalled);
242 rb_erase(&pt->node, &obj->pt_tree);
243
244 dma_fence_signal_locked(&pt->base);
245 }
246
247 spin_unlock_irq(&obj->lock);
248
249 list_for_each_entry_safe(pt, next, &signalled, link) {
250 list_del_init(&pt->link);
251 dma_fence_put(&pt->base);
252 }
253}
254
255/**
256 * sync_pt_create() - creates a sync pt
257 * @obj: parent sync_timeline
258 * @value: value of the fence
259 *
260 * Creates a new sync_pt (fence) as a child of @parent. @size bytes will be
261 * allocated allowing for implementation specific data to be kept after
262 * the generic sync_timeline struct. Returns the sync_pt object or
263 * NULL in case of error.
264 */
265static struct sync_pt *sync_pt_create(struct sync_timeline *obj,
266 unsigned int value)
267{
268 struct sync_pt *pt;
269
270 pt = kzalloc(sizeof(*pt), GFP_KERNEL);
271 if (!pt)
272 return NULL;
273
274 sync_timeline_get(obj);
275 dma_fence_init(&pt->base, &timeline_fence_ops, &obj->lock,
276 obj->context, value);
277 INIT_LIST_HEAD(&pt->link);
278
279 spin_lock_irq(&obj->lock);
280 if (!dma_fence_is_signaled_locked(&pt->base)) {
281 struct rb_node **p = &obj->pt_tree.rb_node;
282 struct rb_node *parent = NULL;
283
284 while (*p) {
285 struct sync_pt *other;
286 int cmp;
287
288 parent = *p;
289 other = rb_entry(parent, typeof(*pt), node);
290 cmp = value - other->base.seqno;
291 if (cmp > 0) {
292 p = &parent->rb_right;
293 } else if (cmp < 0) {
294 p = &parent->rb_left;
295 } else {
296 if (dma_fence_get_rcu(&other->base)) {
297 sync_timeline_put(obj);
298 kfree(pt);
299 pt = other;
300 goto unlock;
301 }
302 p = &parent->rb_left;
303 }
304 }
305 rb_link_node(&pt->node, parent, p);
306 rb_insert_color(&pt->node, &obj->pt_tree);
307
308 parent = rb_next(&pt->node);
309 list_add_tail(&pt->link,
310 parent ? &rb_entry(parent, typeof(*pt), node)->link : &obj->pt_list);
311 }
312unlock:
313 spin_unlock_irq(&obj->lock);
314
315 return pt;
316}
317
318/*
319 * *WARNING*
320 *
321 * improper use of this can result in deadlocking kernel drivers from userspace.
322 */
323
324/* opening sw_sync create a new sync obj */
325static int sw_sync_debugfs_open(struct inode *inode, struct file *file)
326{
327 struct sync_timeline *obj;
328 char task_comm[TASK_COMM_LEN];
329
330 get_task_comm(task_comm, current);
331
332 obj = sync_timeline_create(task_comm);
333 if (!obj)
334 return -ENOMEM;
335
336 file->private_data = obj;
337
338 return 0;
339}
340
341static int sw_sync_debugfs_release(struct inode *inode, struct file *file)
342{
343 struct sync_timeline *obj = file->private_data;
344 struct sync_pt *pt, *next;
345
346 spin_lock_irq(&obj->lock);
347
348 list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
349 dma_fence_set_error(&pt->base, -ENOENT);
350 dma_fence_signal_locked(&pt->base);
351 }
352
353 spin_unlock_irq(&obj->lock);
354
355 sync_timeline_put(obj);
356 return 0;
357}
358
359static long sw_sync_ioctl_create_fence(struct sync_timeline *obj,
360 unsigned long arg)
361{
362 int fd = get_unused_fd_flags(O_CLOEXEC);
363 int err;
364 struct sync_pt *pt;
365 struct sync_file *sync_file;
366 struct sw_sync_create_fence_data data;
367
368 if (fd < 0)
369 return fd;
370
371 if (copy_from_user(&data, (void __user *)arg, sizeof(data))) {
372 err = -EFAULT;
373 goto err;
374 }
375
376 pt = sync_pt_create(obj, data.value);
377 if (!pt) {
378 err = -ENOMEM;
379 goto err;
380 }
381
382 sync_file = sync_file_create(&pt->base);
383 dma_fence_put(&pt->base);
384 if (!sync_file) {
385 err = -ENOMEM;
386 goto err;
387 }
388
389 data.fence = fd;
390 if (copy_to_user((void __user *)arg, &data, sizeof(data))) {
391 fput(sync_file->file);
392 err = -EFAULT;
393 goto err;
394 }
395
396 fd_install(fd, sync_file->file);
397
398 return 0;
399
400err:
401 put_unused_fd(fd);
402 return err;
403}
404
405static long sw_sync_ioctl_inc(struct sync_timeline *obj, unsigned long arg)
406{
407 u32 value;
408
409 if (copy_from_user(&value, (void __user *)arg, sizeof(value)))
410 return -EFAULT;
411
412 while (value > INT_MAX) {
413 sync_timeline_signal(obj, INT_MAX);
414 value -= INT_MAX;
415 }
416
417 sync_timeline_signal(obj, value);
418
419 return 0;
420}
421
422static int sw_sync_ioctl_get_deadline(struct sync_timeline *obj, unsigned long arg)
423{
424 struct sw_sync_get_deadline data;
425 struct dma_fence *fence;
426 unsigned long flags;
427 struct sync_pt *pt;
428 int ret = 0;
429
430 if (copy_from_user(&data, (void __user *)arg, sizeof(data)))
431 return -EFAULT;
432
433 if (data.deadline_ns || data.pad)
434 return -EINVAL;
435
436 fence = sync_file_get_fence(data.fence_fd);
437 if (!fence)
438 return -EINVAL;
439
440 pt = dma_fence_to_sync_pt(fence);
441 if (!pt)
442 return -EINVAL;
443
444 spin_lock_irqsave(fence->lock, flags);
445 if (test_bit(SW_SYNC_HAS_DEADLINE_BIT, &fence->flags)) {
446 data.deadline_ns = ktime_to_ns(pt->deadline);
447 } else {
448 ret = -ENOENT;
449 }
450 spin_unlock_irqrestore(fence->lock, flags);
451
452 dma_fence_put(fence);
453
454 if (ret)
455 return ret;
456
457 if (copy_to_user((void __user *)arg, &data, sizeof(data)))
458 return -EFAULT;
459
460 return 0;
461}
462
463static long sw_sync_ioctl(struct file *file, unsigned int cmd,
464 unsigned long arg)
465{
466 struct sync_timeline *obj = file->private_data;
467
468 switch (cmd) {
469 case SW_SYNC_IOC_CREATE_FENCE:
470 return sw_sync_ioctl_create_fence(obj, arg);
471
472 case SW_SYNC_IOC_INC:
473 return sw_sync_ioctl_inc(obj, arg);
474
475 case SW_SYNC_GET_DEADLINE:
476 return sw_sync_ioctl_get_deadline(obj, arg);
477
478 default:
479 return -ENOTTY;
480 }
481}
482
483const struct file_operations sw_sync_debugfs_fops = {
484 .open = sw_sync_debugfs_open,
485 .release = sw_sync_debugfs_release,
486 .unlocked_ioctl = sw_sync_ioctl,
487 .compat_ioctl = compat_ptr_ioctl,
488};
1/*
2 * Sync File validation framework
3 *
4 * Copyright (C) 2012 Google, Inc.
5 *
6 * This software is licensed under the terms of the GNU General Public
7 * License version 2, as published by the Free Software Foundation, and
8 * may be copied, distributed, and modified under those terms.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 */
16
17#include <linux/file.h>
18#include <linux/fs.h>
19#include <linux/uaccess.h>
20#include <linux/slab.h>
21#include <linux/sync_file.h>
22
23#include "sync_debug.h"
24
25#define CREATE_TRACE_POINTS
26#include "sync_trace.h"
27
28/*
29 * SW SYNC validation framework
30 *
31 * A sync object driver that uses a 32bit counter to coordinate
32 * synchronization. Useful when there is no hardware primitive backing
33 * the synchronization.
34 *
35 * To start the framework just open:
36 *
37 * <debugfs>/sync/sw_sync
38 *
39 * That will create a sync timeline, all fences created under this timeline
40 * file descriptor will belong to the this timeline.
41 *
42 * The 'sw_sync' file can be opened many times as to create different
43 * timelines.
44 *
45 * Fences can be created with SW_SYNC_IOC_CREATE_FENCE ioctl with struct
46 * sw_sync_create_fence_data as parameter.
47 *
48 * To increment the timeline counter, SW_SYNC_IOC_INC ioctl should be used
49 * with the increment as u32. This will update the last signaled value
50 * from the timeline and signal any fence that has a seqno smaller or equal
51 * to it.
52 *
53 * struct sw_sync_create_fence_data
54 * @value: the seqno to initialise the fence with
55 * @name: the name of the new sync point
56 * @fence: return the fd of the new sync_file with the created fence
57 */
58struct sw_sync_create_fence_data {
59 __u32 value;
60 char name[32];
61 __s32 fence; /* fd of new fence */
62};
63
64#define SW_SYNC_IOC_MAGIC 'W'
65
66#define SW_SYNC_IOC_CREATE_FENCE _IOWR(SW_SYNC_IOC_MAGIC, 0,\
67 struct sw_sync_create_fence_data)
68
69#define SW_SYNC_IOC_INC _IOW(SW_SYNC_IOC_MAGIC, 1, __u32)
70
71static const struct dma_fence_ops timeline_fence_ops;
72
73static inline struct sync_pt *dma_fence_to_sync_pt(struct dma_fence *fence)
74{
75 if (fence->ops != &timeline_fence_ops)
76 return NULL;
77 return container_of(fence, struct sync_pt, base);
78}
79
80/**
81 * sync_timeline_create() - creates a sync object
82 * @name: sync_timeline name
83 *
84 * Creates a new sync_timeline. Returns the sync_timeline object or NULL in
85 * case of error.
86 */
87static struct sync_timeline *sync_timeline_create(const char *name)
88{
89 struct sync_timeline *obj;
90
91 obj = kzalloc(sizeof(*obj), GFP_KERNEL);
92 if (!obj)
93 return NULL;
94
95 kref_init(&obj->kref);
96 obj->context = dma_fence_context_alloc(1);
97 strlcpy(obj->name, name, sizeof(obj->name));
98
99 obj->pt_tree = RB_ROOT;
100 INIT_LIST_HEAD(&obj->pt_list);
101 spin_lock_init(&obj->lock);
102
103 sync_timeline_debug_add(obj);
104
105 return obj;
106}
107
108static void sync_timeline_free(struct kref *kref)
109{
110 struct sync_timeline *obj =
111 container_of(kref, struct sync_timeline, kref);
112
113 sync_timeline_debug_remove(obj);
114
115 kfree(obj);
116}
117
118static void sync_timeline_get(struct sync_timeline *obj)
119{
120 kref_get(&obj->kref);
121}
122
123static void sync_timeline_put(struct sync_timeline *obj)
124{
125 kref_put(&obj->kref, sync_timeline_free);
126}
127
128static const char *timeline_fence_get_driver_name(struct dma_fence *fence)
129{
130 return "sw_sync";
131}
132
133static const char *timeline_fence_get_timeline_name(struct dma_fence *fence)
134{
135 struct sync_timeline *parent = dma_fence_parent(fence);
136
137 return parent->name;
138}
139
140static void timeline_fence_release(struct dma_fence *fence)
141{
142 struct sync_pt *pt = dma_fence_to_sync_pt(fence);
143 struct sync_timeline *parent = dma_fence_parent(fence);
144
145 if (!list_empty(&pt->link)) {
146 unsigned long flags;
147
148 spin_lock_irqsave(fence->lock, flags);
149 if (!list_empty(&pt->link)) {
150 list_del(&pt->link);
151 rb_erase(&pt->node, &parent->pt_tree);
152 }
153 spin_unlock_irqrestore(fence->lock, flags);
154 }
155
156 sync_timeline_put(parent);
157 dma_fence_free(fence);
158}
159
160static bool timeline_fence_signaled(struct dma_fence *fence)
161{
162 struct sync_timeline *parent = dma_fence_parent(fence);
163
164 return !__dma_fence_is_later(fence->seqno, parent->value);
165}
166
167static bool timeline_fence_enable_signaling(struct dma_fence *fence)
168{
169 return true;
170}
171
172static void timeline_fence_value_str(struct dma_fence *fence,
173 char *str, int size)
174{
175 snprintf(str, size, "%d", fence->seqno);
176}
177
178static void timeline_fence_timeline_value_str(struct dma_fence *fence,
179 char *str, int size)
180{
181 struct sync_timeline *parent = dma_fence_parent(fence);
182
183 snprintf(str, size, "%d", parent->value);
184}
185
186static const struct dma_fence_ops timeline_fence_ops = {
187 .get_driver_name = timeline_fence_get_driver_name,
188 .get_timeline_name = timeline_fence_get_timeline_name,
189 .enable_signaling = timeline_fence_enable_signaling,
190 .signaled = timeline_fence_signaled,
191 .wait = dma_fence_default_wait,
192 .release = timeline_fence_release,
193 .fence_value_str = timeline_fence_value_str,
194 .timeline_value_str = timeline_fence_timeline_value_str,
195};
196
197/**
198 * sync_timeline_signal() - signal a status change on a sync_timeline
199 * @obj: sync_timeline to signal
200 * @inc: num to increment on timeline->value
201 *
202 * A sync implementation should call this any time one of it's fences
203 * has signaled or has an error condition.
204 */
205static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
206{
207 struct sync_pt *pt, *next;
208
209 trace_sync_timeline(obj);
210
211 spin_lock_irq(&obj->lock);
212
213 obj->value += inc;
214
215 list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
216 if (!timeline_fence_signaled(&pt->base))
217 break;
218
219 list_del_init(&pt->link);
220 rb_erase(&pt->node, &obj->pt_tree);
221
222 /*
223 * A signal callback may release the last reference to this
224 * fence, causing it to be freed. That operation has to be
225 * last to avoid a use after free inside this loop, and must
226 * be after we remove the fence from the timeline in order to
227 * prevent deadlocking on timeline->lock inside
228 * timeline_fence_release().
229 */
230 dma_fence_signal_locked(&pt->base);
231 }
232
233 spin_unlock_irq(&obj->lock);
234}
235
236/**
237 * sync_pt_create() - creates a sync pt
238 * @obj: parent sync_timeline
239 * @value: value of the fence
240 *
241 * Creates a new sync_pt (fence) as a child of @parent. @size bytes will be
242 * allocated allowing for implementation specific data to be kept after
243 * the generic sync_timeline struct. Returns the sync_pt object or
244 * NULL in case of error.
245 */
246static struct sync_pt *sync_pt_create(struct sync_timeline *obj,
247 unsigned int value)
248{
249 struct sync_pt *pt;
250
251 pt = kzalloc(sizeof(*pt), GFP_KERNEL);
252 if (!pt)
253 return NULL;
254
255 sync_timeline_get(obj);
256 dma_fence_init(&pt->base, &timeline_fence_ops, &obj->lock,
257 obj->context, value);
258 INIT_LIST_HEAD(&pt->link);
259
260 spin_lock_irq(&obj->lock);
261 if (!dma_fence_is_signaled_locked(&pt->base)) {
262 struct rb_node **p = &obj->pt_tree.rb_node;
263 struct rb_node *parent = NULL;
264
265 while (*p) {
266 struct sync_pt *other;
267 int cmp;
268
269 parent = *p;
270 other = rb_entry(parent, typeof(*pt), node);
271 cmp = value - other->base.seqno;
272 if (cmp > 0) {
273 p = &parent->rb_right;
274 } else if (cmp < 0) {
275 p = &parent->rb_left;
276 } else {
277 if (dma_fence_get_rcu(&other->base)) {
278 dma_fence_put(&pt->base);
279 pt = other;
280 goto unlock;
281 }
282 p = &parent->rb_left;
283 }
284 }
285 rb_link_node(&pt->node, parent, p);
286 rb_insert_color(&pt->node, &obj->pt_tree);
287
288 parent = rb_next(&pt->node);
289 list_add_tail(&pt->link,
290 parent ? &rb_entry(parent, typeof(*pt), node)->link : &obj->pt_list);
291 }
292unlock:
293 spin_unlock_irq(&obj->lock);
294
295 return pt;
296}
297
298/*
299 * *WARNING*
300 *
301 * improper use of this can result in deadlocking kernel drivers from userspace.
302 */
303
304/* opening sw_sync create a new sync obj */
305static int sw_sync_debugfs_open(struct inode *inode, struct file *file)
306{
307 struct sync_timeline *obj;
308 char task_comm[TASK_COMM_LEN];
309
310 get_task_comm(task_comm, current);
311
312 obj = sync_timeline_create(task_comm);
313 if (!obj)
314 return -ENOMEM;
315
316 file->private_data = obj;
317
318 return 0;
319}
320
321static int sw_sync_debugfs_release(struct inode *inode, struct file *file)
322{
323 struct sync_timeline *obj = file->private_data;
324 struct sync_pt *pt, *next;
325
326 spin_lock_irq(&obj->lock);
327
328 list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
329 dma_fence_set_error(&pt->base, -ENOENT);
330 dma_fence_signal_locked(&pt->base);
331 }
332
333 spin_unlock_irq(&obj->lock);
334
335 sync_timeline_put(obj);
336 return 0;
337}
338
339static long sw_sync_ioctl_create_fence(struct sync_timeline *obj,
340 unsigned long arg)
341{
342 int fd = get_unused_fd_flags(O_CLOEXEC);
343 int err;
344 struct sync_pt *pt;
345 struct sync_file *sync_file;
346 struct sw_sync_create_fence_data data;
347
348 if (fd < 0)
349 return fd;
350
351 if (copy_from_user(&data, (void __user *)arg, sizeof(data))) {
352 err = -EFAULT;
353 goto err;
354 }
355
356 pt = sync_pt_create(obj, data.value);
357 if (!pt) {
358 err = -ENOMEM;
359 goto err;
360 }
361
362 sync_file = sync_file_create(&pt->base);
363 dma_fence_put(&pt->base);
364 if (!sync_file) {
365 err = -ENOMEM;
366 goto err;
367 }
368
369 data.fence = fd;
370 if (copy_to_user((void __user *)arg, &data, sizeof(data))) {
371 fput(sync_file->file);
372 err = -EFAULT;
373 goto err;
374 }
375
376 fd_install(fd, sync_file->file);
377
378 return 0;
379
380err:
381 put_unused_fd(fd);
382 return err;
383}
384
385static long sw_sync_ioctl_inc(struct sync_timeline *obj, unsigned long arg)
386{
387 u32 value;
388
389 if (copy_from_user(&value, (void __user *)arg, sizeof(value)))
390 return -EFAULT;
391
392 while (value > INT_MAX) {
393 sync_timeline_signal(obj, INT_MAX);
394 value -= INT_MAX;
395 }
396
397 sync_timeline_signal(obj, value);
398
399 return 0;
400}
401
402static long sw_sync_ioctl(struct file *file, unsigned int cmd,
403 unsigned long arg)
404{
405 struct sync_timeline *obj = file->private_data;
406
407 switch (cmd) {
408 case SW_SYNC_IOC_CREATE_FENCE:
409 return sw_sync_ioctl_create_fence(obj, arg);
410
411 case SW_SYNC_IOC_INC:
412 return sw_sync_ioctl_inc(obj, arg);
413
414 default:
415 return -ENOTTY;
416 }
417}
418
419const struct file_operations sw_sync_debugfs_fops = {
420 .open = sw_sync_debugfs_open,
421 .release = sw_sync_debugfs_release,
422 .unlocked_ioctl = sw_sync_ioctl,
423 .compat_ioctl = sw_sync_ioctl,
424};