Linux Audio

Check our new training course

Loading...
v6.2
  1// SPDX-License-Identifier: GPL-2.0-only
  2/*
  3 * Sync File validation framework
  4 *
  5 * Copyright (C) 2012 Google, Inc.
 
 
 
 
 
 
 
 
 
 
  6 */
  7
  8#include <linux/file.h>
  9#include <linux/fs.h>
 10#include <linux/uaccess.h>
 11#include <linux/slab.h>
 12#include <linux/sync_file.h>
 13
 14#include "sync_debug.h"
 15
 16#define CREATE_TRACE_POINTS
 17#include "sync_trace.h"
 18
 19/*
 20 * SW SYNC validation framework
 21 *
 22 * A sync object driver that uses a 32bit counter to coordinate
 23 * synchronization.  Useful when there is no hardware primitive backing
 24 * the synchronization.
 25 *
 26 * To start the framework just open:
 27 *
 28 * <debugfs>/sync/sw_sync
 29 *
 30 * That will create a sync timeline, all fences created under this timeline
 31 * file descriptor will belong to the this timeline.
 32 *
 33 * The 'sw_sync' file can be opened many times as to create different
 34 * timelines.
 35 *
 36 * Fences can be created with SW_SYNC_IOC_CREATE_FENCE ioctl with struct
 37 * sw_sync_create_fence_data as parameter.
 38 *
 39 * To increment the timeline counter, SW_SYNC_IOC_INC ioctl should be used
 40 * with the increment as u32. This will update the last signaled value
 41 * from the timeline and signal any fence that has a seqno smaller or equal
 42 * to it.
 43 *
 44 * struct sw_sync_create_fence_data
 45 * @value:	the seqno to initialise the fence with
 46 * @name:	the name of the new sync point
 47 * @fence:	return the fd of the new sync_file with the created fence
 48 */
 49struct sw_sync_create_fence_data {
 50	__u32	value;
 51	char	name[32];
 52	__s32	fence; /* fd of new fence */
 53};
 54
 55#define SW_SYNC_IOC_MAGIC	'W'
 56
 57#define SW_SYNC_IOC_CREATE_FENCE	_IOWR(SW_SYNC_IOC_MAGIC, 0,\
 58		struct sw_sync_create_fence_data)
 59
 60#define SW_SYNC_IOC_INC			_IOW(SW_SYNC_IOC_MAGIC, 1, __u32)
 61
 62static const struct dma_fence_ops timeline_fence_ops;
 63
 64static inline struct sync_pt *dma_fence_to_sync_pt(struct dma_fence *fence)
 65{
 66	if (fence->ops != &timeline_fence_ops)
 67		return NULL;
 68	return container_of(fence, struct sync_pt, base);
 69}
 70
 71/**
 72 * sync_timeline_create() - creates a sync object
 73 * @name:	sync_timeline name
 74 *
 75 * Creates a new sync_timeline. Returns the sync_timeline object or NULL in
 76 * case of error.
 77 */
 78static struct sync_timeline *sync_timeline_create(const char *name)
 79{
 80	struct sync_timeline *obj;
 81
 82	obj = kzalloc(sizeof(*obj), GFP_KERNEL);
 83	if (!obj)
 84		return NULL;
 85
 86	kref_init(&obj->kref);
 87	obj->context = dma_fence_context_alloc(1);
 88	strlcpy(obj->name, name, sizeof(obj->name));
 89
 90	obj->pt_tree = RB_ROOT;
 91	INIT_LIST_HEAD(&obj->pt_list);
 92	spin_lock_init(&obj->lock);
 93
 94	sync_timeline_debug_add(obj);
 95
 96	return obj;
 97}
 98
 99static void sync_timeline_free(struct kref *kref)
100{
101	struct sync_timeline *obj =
102		container_of(kref, struct sync_timeline, kref);
103
104	sync_timeline_debug_remove(obj);
105
106	kfree(obj);
107}
108
109static void sync_timeline_get(struct sync_timeline *obj)
110{
111	kref_get(&obj->kref);
112}
113
114static void sync_timeline_put(struct sync_timeline *obj)
115{
116	kref_put(&obj->kref, sync_timeline_free);
117}
118
119static const char *timeline_fence_get_driver_name(struct dma_fence *fence)
120{
121	return "sw_sync";
122}
123
124static const char *timeline_fence_get_timeline_name(struct dma_fence *fence)
125{
126	struct sync_timeline *parent = dma_fence_parent(fence);
127
128	return parent->name;
129}
130
131static void timeline_fence_release(struct dma_fence *fence)
132{
133	struct sync_pt *pt = dma_fence_to_sync_pt(fence);
134	struct sync_timeline *parent = dma_fence_parent(fence);
135	unsigned long flags;
136
137	spin_lock_irqsave(fence->lock, flags);
138	if (!list_empty(&pt->link)) {
139		list_del(&pt->link);
140		rb_erase(&pt->node, &parent->pt_tree);
 
 
 
 
 
 
141	}
142	spin_unlock_irqrestore(fence->lock, flags);
143
144	sync_timeline_put(parent);
145	dma_fence_free(fence);
146}
147
148static bool timeline_fence_signaled(struct dma_fence *fence)
149{
150	struct sync_timeline *parent = dma_fence_parent(fence);
151
152	return !__dma_fence_is_later(fence->seqno, parent->value, fence->ops);
153}
154
155static bool timeline_fence_enable_signaling(struct dma_fence *fence)
156{
157	return true;
158}
159
160static void timeline_fence_value_str(struct dma_fence *fence,
161				    char *str, int size)
162{
163	snprintf(str, size, "%lld", fence->seqno);
164}
165
166static void timeline_fence_timeline_value_str(struct dma_fence *fence,
167					     char *str, int size)
168{
169	struct sync_timeline *parent = dma_fence_parent(fence);
170
171	snprintf(str, size, "%d", parent->value);
172}
173
174static const struct dma_fence_ops timeline_fence_ops = {
175	.get_driver_name = timeline_fence_get_driver_name,
176	.get_timeline_name = timeline_fence_get_timeline_name,
177	.enable_signaling = timeline_fence_enable_signaling,
178	.signaled = timeline_fence_signaled,
 
179	.release = timeline_fence_release,
180	.fence_value_str = timeline_fence_value_str,
181	.timeline_value_str = timeline_fence_timeline_value_str,
182};
183
184/**
185 * sync_timeline_signal() - signal a status change on a sync_timeline
186 * @obj:	sync_timeline to signal
187 * @inc:	num to increment on timeline->value
188 *
189 * A sync implementation should call this any time one of it's fences
190 * has signaled or has an error condition.
191 */
192static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
193{
194	struct sync_pt *pt, *next;
195
196	trace_sync_timeline(obj);
197
198	spin_lock_irq(&obj->lock);
199
200	obj->value += inc;
201
202	list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
203		if (!timeline_fence_signaled(&pt->base))
204			break;
205
206		list_del_init(&pt->link);
207		rb_erase(&pt->node, &obj->pt_tree);
208
209		/*
210		 * A signal callback may release the last reference to this
211		 * fence, causing it to be freed. That operation has to be
212		 * last to avoid a use after free inside this loop, and must
213		 * be after we remove the fence from the timeline in order to
214		 * prevent deadlocking on timeline->lock inside
215		 * timeline_fence_release().
216		 */
217		dma_fence_signal_locked(&pt->base);
218	}
219
220	spin_unlock_irq(&obj->lock);
221}
222
223/**
224 * sync_pt_create() - creates a sync pt
225 * @obj:	parent sync_timeline
226 * @value:	value of the fence
227 *
228 * Creates a new sync_pt (fence) as a child of @parent.  @size bytes will be
229 * allocated allowing for implementation specific data to be kept after
230 * the generic sync_timeline struct. Returns the sync_pt object or
231 * NULL in case of error.
232 */
233static struct sync_pt *sync_pt_create(struct sync_timeline *obj,
234				      unsigned int value)
235{
236	struct sync_pt *pt;
237
238	pt = kzalloc(sizeof(*pt), GFP_KERNEL);
239	if (!pt)
240		return NULL;
241
242	sync_timeline_get(obj);
243	dma_fence_init(&pt->base, &timeline_fence_ops, &obj->lock,
244		       obj->context, value);
245	INIT_LIST_HEAD(&pt->link);
246
247	spin_lock_irq(&obj->lock);
248	if (!dma_fence_is_signaled_locked(&pt->base)) {
249		struct rb_node **p = &obj->pt_tree.rb_node;
250		struct rb_node *parent = NULL;
251
252		while (*p) {
253			struct sync_pt *other;
254			int cmp;
255
256			parent = *p;
257			other = rb_entry(parent, typeof(*pt), node);
258			cmp = value - other->base.seqno;
259			if (cmp > 0) {
260				p = &parent->rb_right;
261			} else if (cmp < 0) {
262				p = &parent->rb_left;
263			} else {
264				if (dma_fence_get_rcu(&other->base)) {
265					sync_timeline_put(obj);
266					kfree(pt);
267					pt = other;
268					goto unlock;
269				}
270				p = &parent->rb_left;
271			}
272		}
273		rb_link_node(&pt->node, parent, p);
274		rb_insert_color(&pt->node, &obj->pt_tree);
275
276		parent = rb_next(&pt->node);
277		list_add_tail(&pt->link,
278			      parent ? &rb_entry(parent, typeof(*pt), node)->link : &obj->pt_list);
279	}
280unlock:
281	spin_unlock_irq(&obj->lock);
282
283	return pt;
284}
285
286/*
287 * *WARNING*
288 *
289 * improper use of this can result in deadlocking kernel drivers from userspace.
290 */
291
292/* opening sw_sync create a new sync obj */
293static int sw_sync_debugfs_open(struct inode *inode, struct file *file)
294{
295	struct sync_timeline *obj;
296	char task_comm[TASK_COMM_LEN];
297
298	get_task_comm(task_comm, current);
299
300	obj = sync_timeline_create(task_comm);
301	if (!obj)
302		return -ENOMEM;
303
304	file->private_data = obj;
305
306	return 0;
307}
308
309static int sw_sync_debugfs_release(struct inode *inode, struct file *file)
310{
311	struct sync_timeline *obj = file->private_data;
312	struct sync_pt *pt, *next;
313
314	spin_lock_irq(&obj->lock);
315
316	list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
317		dma_fence_set_error(&pt->base, -ENOENT);
318		dma_fence_signal_locked(&pt->base);
319	}
320
321	spin_unlock_irq(&obj->lock);
322
323	sync_timeline_put(obj);
324	return 0;
325}
326
327static long sw_sync_ioctl_create_fence(struct sync_timeline *obj,
328				       unsigned long arg)
329{
330	int fd = get_unused_fd_flags(O_CLOEXEC);
331	int err;
332	struct sync_pt *pt;
333	struct sync_file *sync_file;
334	struct sw_sync_create_fence_data data;
335
336	if (fd < 0)
337		return fd;
338
339	if (copy_from_user(&data, (void __user *)arg, sizeof(data))) {
340		err = -EFAULT;
341		goto err;
342	}
343
344	pt = sync_pt_create(obj, data.value);
345	if (!pt) {
346		err = -ENOMEM;
347		goto err;
348	}
349
350	sync_file = sync_file_create(&pt->base);
351	dma_fence_put(&pt->base);
352	if (!sync_file) {
353		err = -ENOMEM;
354		goto err;
355	}
356
357	data.fence = fd;
358	if (copy_to_user((void __user *)arg, &data, sizeof(data))) {
359		fput(sync_file->file);
360		err = -EFAULT;
361		goto err;
362	}
363
364	fd_install(fd, sync_file->file);
365
366	return 0;
367
368err:
369	put_unused_fd(fd);
370	return err;
371}
372
373static long sw_sync_ioctl_inc(struct sync_timeline *obj, unsigned long arg)
374{
375	u32 value;
376
377	if (copy_from_user(&value, (void __user *)arg, sizeof(value)))
378		return -EFAULT;
379
380	while (value > INT_MAX)  {
381		sync_timeline_signal(obj, INT_MAX);
382		value -= INT_MAX;
383	}
384
385	sync_timeline_signal(obj, value);
386
387	return 0;
388}
389
390static long sw_sync_ioctl(struct file *file, unsigned int cmd,
391			  unsigned long arg)
392{
393	struct sync_timeline *obj = file->private_data;
394
395	switch (cmd) {
396	case SW_SYNC_IOC_CREATE_FENCE:
397		return sw_sync_ioctl_create_fence(obj, arg);
398
399	case SW_SYNC_IOC_INC:
400		return sw_sync_ioctl_inc(obj, arg);
401
402	default:
403		return -ENOTTY;
404	}
405}
406
407const struct file_operations sw_sync_debugfs_fops = {
408	.open           = sw_sync_debugfs_open,
409	.release        = sw_sync_debugfs_release,
410	.unlocked_ioctl = sw_sync_ioctl,
411	.compat_ioctl	= compat_ptr_ioctl,
412};
v4.17
 
  1/*
  2 * Sync File validation framework
  3 *
  4 * Copyright (C) 2012 Google, Inc.
  5 *
  6 * This software is licensed under the terms of the GNU General Public
  7 * License version 2, as published by the Free Software Foundation, and
  8 * may be copied, distributed, and modified under those terms.
  9 *
 10 * This program is distributed in the hope that it will be useful,
 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 13 * GNU General Public License for more details.
 14 *
 15 */
 16
 17#include <linux/file.h>
 18#include <linux/fs.h>
 19#include <linux/uaccess.h>
 20#include <linux/slab.h>
 21#include <linux/sync_file.h>
 22
 23#include "sync_debug.h"
 24
 25#define CREATE_TRACE_POINTS
 26#include "sync_trace.h"
 27
 28/*
 29 * SW SYNC validation framework
 30 *
 31 * A sync object driver that uses a 32bit counter to coordinate
 32 * synchronization.  Useful when there is no hardware primitive backing
 33 * the synchronization.
 34 *
 35 * To start the framework just open:
 36 *
 37 * <debugfs>/sync/sw_sync
 38 *
 39 * That will create a sync timeline, all fences created under this timeline
 40 * file descriptor will belong to the this timeline.
 41 *
 42 * The 'sw_sync' file can be opened many times as to create different
 43 * timelines.
 44 *
 45 * Fences can be created with SW_SYNC_IOC_CREATE_FENCE ioctl with struct
 46 * sw_sync_create_fence_data as parameter.
 47 *
 48 * To increment the timeline counter, SW_SYNC_IOC_INC ioctl should be used
 49 * with the increment as u32. This will update the last signaled value
 50 * from the timeline and signal any fence that has a seqno smaller or equal
 51 * to it.
 52 *
 53 * struct sw_sync_create_fence_data
 54 * @value:	the seqno to initialise the fence with
 55 * @name:	the name of the new sync point
 56 * @fence:	return the fd of the new sync_file with the created fence
 57 */
 58struct sw_sync_create_fence_data {
 59	__u32	value;
 60	char	name[32];
 61	__s32	fence; /* fd of new fence */
 62};
 63
 64#define SW_SYNC_IOC_MAGIC	'W'
 65
 66#define SW_SYNC_IOC_CREATE_FENCE	_IOWR(SW_SYNC_IOC_MAGIC, 0,\
 67		struct sw_sync_create_fence_data)
 68
 69#define SW_SYNC_IOC_INC			_IOW(SW_SYNC_IOC_MAGIC, 1, __u32)
 70
 71static const struct dma_fence_ops timeline_fence_ops;
 72
 73static inline struct sync_pt *dma_fence_to_sync_pt(struct dma_fence *fence)
 74{
 75	if (fence->ops != &timeline_fence_ops)
 76		return NULL;
 77	return container_of(fence, struct sync_pt, base);
 78}
 79
 80/**
 81 * sync_timeline_create() - creates a sync object
 82 * @name:	sync_timeline name
 83 *
 84 * Creates a new sync_timeline. Returns the sync_timeline object or NULL in
 85 * case of error.
 86 */
 87static struct sync_timeline *sync_timeline_create(const char *name)
 88{
 89	struct sync_timeline *obj;
 90
 91	obj = kzalloc(sizeof(*obj), GFP_KERNEL);
 92	if (!obj)
 93		return NULL;
 94
 95	kref_init(&obj->kref);
 96	obj->context = dma_fence_context_alloc(1);
 97	strlcpy(obj->name, name, sizeof(obj->name));
 98
 99	obj->pt_tree = RB_ROOT;
100	INIT_LIST_HEAD(&obj->pt_list);
101	spin_lock_init(&obj->lock);
102
103	sync_timeline_debug_add(obj);
104
105	return obj;
106}
107
108static void sync_timeline_free(struct kref *kref)
109{
110	struct sync_timeline *obj =
111		container_of(kref, struct sync_timeline, kref);
112
113	sync_timeline_debug_remove(obj);
114
115	kfree(obj);
116}
117
118static void sync_timeline_get(struct sync_timeline *obj)
119{
120	kref_get(&obj->kref);
121}
122
123static void sync_timeline_put(struct sync_timeline *obj)
124{
125	kref_put(&obj->kref, sync_timeline_free);
126}
127
128static const char *timeline_fence_get_driver_name(struct dma_fence *fence)
129{
130	return "sw_sync";
131}
132
133static const char *timeline_fence_get_timeline_name(struct dma_fence *fence)
134{
135	struct sync_timeline *parent = dma_fence_parent(fence);
136
137	return parent->name;
138}
139
140static void timeline_fence_release(struct dma_fence *fence)
141{
142	struct sync_pt *pt = dma_fence_to_sync_pt(fence);
143	struct sync_timeline *parent = dma_fence_parent(fence);
 
144
 
145	if (!list_empty(&pt->link)) {
146		unsigned long flags;
147
148		spin_lock_irqsave(fence->lock, flags);
149		if (!list_empty(&pt->link)) {
150			list_del(&pt->link);
151			rb_erase(&pt->node, &parent->pt_tree);
152		}
153		spin_unlock_irqrestore(fence->lock, flags);
154	}
 
155
156	sync_timeline_put(parent);
157	dma_fence_free(fence);
158}
159
160static bool timeline_fence_signaled(struct dma_fence *fence)
161{
162	struct sync_timeline *parent = dma_fence_parent(fence);
163
164	return !__dma_fence_is_later(fence->seqno, parent->value);
165}
166
167static bool timeline_fence_enable_signaling(struct dma_fence *fence)
168{
169	return true;
170}
171
172static void timeline_fence_value_str(struct dma_fence *fence,
173				    char *str, int size)
174{
175	snprintf(str, size, "%d", fence->seqno);
176}
177
178static void timeline_fence_timeline_value_str(struct dma_fence *fence,
179					     char *str, int size)
180{
181	struct sync_timeline *parent = dma_fence_parent(fence);
182
183	snprintf(str, size, "%d", parent->value);
184}
185
186static const struct dma_fence_ops timeline_fence_ops = {
187	.get_driver_name = timeline_fence_get_driver_name,
188	.get_timeline_name = timeline_fence_get_timeline_name,
189	.enable_signaling = timeline_fence_enable_signaling,
190	.signaled = timeline_fence_signaled,
191	.wait = dma_fence_default_wait,
192	.release = timeline_fence_release,
193	.fence_value_str = timeline_fence_value_str,
194	.timeline_value_str = timeline_fence_timeline_value_str,
195};
196
197/**
198 * sync_timeline_signal() - signal a status change on a sync_timeline
199 * @obj:	sync_timeline to signal
200 * @inc:	num to increment on timeline->value
201 *
202 * A sync implementation should call this any time one of it's fences
203 * has signaled or has an error condition.
204 */
205static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
206{
207	struct sync_pt *pt, *next;
208
209	trace_sync_timeline(obj);
210
211	spin_lock_irq(&obj->lock);
212
213	obj->value += inc;
214
215	list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
216		if (!timeline_fence_signaled(&pt->base))
217			break;
218
219		list_del_init(&pt->link);
220		rb_erase(&pt->node, &obj->pt_tree);
221
222		/*
223		 * A signal callback may release the last reference to this
224		 * fence, causing it to be freed. That operation has to be
225		 * last to avoid a use after free inside this loop, and must
226		 * be after we remove the fence from the timeline in order to
227		 * prevent deadlocking on timeline->lock inside
228		 * timeline_fence_release().
229		 */
230		dma_fence_signal_locked(&pt->base);
231	}
232
233	spin_unlock_irq(&obj->lock);
234}
235
236/**
237 * sync_pt_create() - creates a sync pt
238 * @obj:	parent sync_timeline
239 * @value:	value of the fence
240 *
241 * Creates a new sync_pt (fence) as a child of @parent.  @size bytes will be
242 * allocated allowing for implementation specific data to be kept after
243 * the generic sync_timeline struct. Returns the sync_pt object or
244 * NULL in case of error.
245 */
246static struct sync_pt *sync_pt_create(struct sync_timeline *obj,
247				      unsigned int value)
248{
249	struct sync_pt *pt;
250
251	pt = kzalloc(sizeof(*pt), GFP_KERNEL);
252	if (!pt)
253		return NULL;
254
255	sync_timeline_get(obj);
256	dma_fence_init(&pt->base, &timeline_fence_ops, &obj->lock,
257		       obj->context, value);
258	INIT_LIST_HEAD(&pt->link);
259
260	spin_lock_irq(&obj->lock);
261	if (!dma_fence_is_signaled_locked(&pt->base)) {
262		struct rb_node **p = &obj->pt_tree.rb_node;
263		struct rb_node *parent = NULL;
264
265		while (*p) {
266			struct sync_pt *other;
267			int cmp;
268
269			parent = *p;
270			other = rb_entry(parent, typeof(*pt), node);
271			cmp = value - other->base.seqno;
272			if (cmp > 0) {
273				p = &parent->rb_right;
274			} else if (cmp < 0) {
275				p = &parent->rb_left;
276			} else {
277				if (dma_fence_get_rcu(&other->base)) {
278					dma_fence_put(&pt->base);
 
279					pt = other;
280					goto unlock;
281				}
282				p = &parent->rb_left;
283			}
284		}
285		rb_link_node(&pt->node, parent, p);
286		rb_insert_color(&pt->node, &obj->pt_tree);
287
288		parent = rb_next(&pt->node);
289		list_add_tail(&pt->link,
290			      parent ? &rb_entry(parent, typeof(*pt), node)->link : &obj->pt_list);
291	}
292unlock:
293	spin_unlock_irq(&obj->lock);
294
295	return pt;
296}
297
298/*
299 * *WARNING*
300 *
301 * improper use of this can result in deadlocking kernel drivers from userspace.
302 */
303
304/* opening sw_sync create a new sync obj */
305static int sw_sync_debugfs_open(struct inode *inode, struct file *file)
306{
307	struct sync_timeline *obj;
308	char task_comm[TASK_COMM_LEN];
309
310	get_task_comm(task_comm, current);
311
312	obj = sync_timeline_create(task_comm);
313	if (!obj)
314		return -ENOMEM;
315
316	file->private_data = obj;
317
318	return 0;
319}
320
321static int sw_sync_debugfs_release(struct inode *inode, struct file *file)
322{
323	struct sync_timeline *obj = file->private_data;
324	struct sync_pt *pt, *next;
325
326	spin_lock_irq(&obj->lock);
327
328	list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
329		dma_fence_set_error(&pt->base, -ENOENT);
330		dma_fence_signal_locked(&pt->base);
331	}
332
333	spin_unlock_irq(&obj->lock);
334
335	sync_timeline_put(obj);
336	return 0;
337}
338
339static long sw_sync_ioctl_create_fence(struct sync_timeline *obj,
340				       unsigned long arg)
341{
342	int fd = get_unused_fd_flags(O_CLOEXEC);
343	int err;
344	struct sync_pt *pt;
345	struct sync_file *sync_file;
346	struct sw_sync_create_fence_data data;
347
348	if (fd < 0)
349		return fd;
350
351	if (copy_from_user(&data, (void __user *)arg, sizeof(data))) {
352		err = -EFAULT;
353		goto err;
354	}
355
356	pt = sync_pt_create(obj, data.value);
357	if (!pt) {
358		err = -ENOMEM;
359		goto err;
360	}
361
362	sync_file = sync_file_create(&pt->base);
363	dma_fence_put(&pt->base);
364	if (!sync_file) {
365		err = -ENOMEM;
366		goto err;
367	}
368
369	data.fence = fd;
370	if (copy_to_user((void __user *)arg, &data, sizeof(data))) {
371		fput(sync_file->file);
372		err = -EFAULT;
373		goto err;
374	}
375
376	fd_install(fd, sync_file->file);
377
378	return 0;
379
380err:
381	put_unused_fd(fd);
382	return err;
383}
384
385static long sw_sync_ioctl_inc(struct sync_timeline *obj, unsigned long arg)
386{
387	u32 value;
388
389	if (copy_from_user(&value, (void __user *)arg, sizeof(value)))
390		return -EFAULT;
391
392	while (value > INT_MAX)  {
393		sync_timeline_signal(obj, INT_MAX);
394		value -= INT_MAX;
395	}
396
397	sync_timeline_signal(obj, value);
398
399	return 0;
400}
401
402static long sw_sync_ioctl(struct file *file, unsigned int cmd,
403			  unsigned long arg)
404{
405	struct sync_timeline *obj = file->private_data;
406
407	switch (cmd) {
408	case SW_SYNC_IOC_CREATE_FENCE:
409		return sw_sync_ioctl_create_fence(obj, arg);
410
411	case SW_SYNC_IOC_INC:
412		return sw_sync_ioctl_inc(obj, arg);
413
414	default:
415		return -ENOTTY;
416	}
417}
418
419const struct file_operations sw_sync_debugfs_fops = {
420	.open           = sw_sync_debugfs_open,
421	.release        = sw_sync_debugfs_release,
422	.unlocked_ioctl = sw_sync_ioctl,
423	.compat_ioctl	= sw_sync_ioctl,
424};