1 // SPDX-License-Identifier: GPL-2.0-only
3 * Sync File validation framework
5 * Copyright (C) 2012 Google, Inc.
8 #include <linux/file.h>
10 #include <linux/uaccess.h>
11 #include <linux/slab.h>
12 #include <linux/sync_file.h>
14 #include "sync_debug.h"
16 #define CREATE_TRACE_POINTS
17 #include "sync_trace.h"
20 * SW SYNC validation framework
22 * A sync object driver that uses a 32bit counter to coordinate
23 * synchronization. Useful when there is no hardware primitive backing
24 * the synchronization.
26 * To start the framework just open:
28 * <debugfs>/sync/sw_sync
30 * That will create a sync timeline, all fences created under this timeline
31 * file descriptor will belong to the this timeline.
33 * The 'sw_sync' file can be opened many times as to create different
36 * Fences can be created with SW_SYNC_IOC_CREATE_FENCE ioctl with struct
37 * sw_sync_create_fence_data as parameter.
39 * To increment the timeline counter, SW_SYNC_IOC_INC ioctl should be used
40 * with the increment as u32. This will update the last signaled value
41 * from the timeline and signal any fence that has a seqno smaller or equal
44 * struct sw_sync_create_fence_data
45 * @value: the seqno to initialise the fence with
46 * @name: the name of the new sync point
47 * @fence: return the fd of the new sync_file with the created fence
49 struct sw_sync_create_fence_data {
52 __s32 fence; /* fd of new fence */
55 #define SW_SYNC_IOC_MAGIC 'W'
57 #define SW_SYNC_IOC_CREATE_FENCE _IOWR(SW_SYNC_IOC_MAGIC, 0,\
58 struct sw_sync_create_fence_data)
60 #define SW_SYNC_IOC_INC _IOW(SW_SYNC_IOC_MAGIC, 1, __u32)
62 static const struct dma_fence_ops timeline_fence_ops;
64 static inline struct sync_pt *dma_fence_to_sync_pt(struct dma_fence *fence)
66 if (fence->ops != &timeline_fence_ops)
68 return container_of(fence, struct sync_pt, base);
72 * sync_timeline_create() - creates a sync object
73 * @name: sync_timeline name
75 * Creates a new sync_timeline. Returns the sync_timeline object or NULL in
78 static struct sync_timeline *sync_timeline_create(const char *name)
80 struct sync_timeline *obj;
82 obj = kzalloc(sizeof(*obj), GFP_KERNEL);
86 kref_init(&obj->kref);
87 obj->context = dma_fence_context_alloc(1);
88 strlcpy(obj->name, name, sizeof(obj->name));
90 obj->pt_tree = RB_ROOT;
91 INIT_LIST_HEAD(&obj->pt_list);
92 spin_lock_init(&obj->lock);
94 sync_timeline_debug_add(obj);
99 static void sync_timeline_free(struct kref *kref)
101 struct sync_timeline *obj =
102 container_of(kref, struct sync_timeline, kref);
104 sync_timeline_debug_remove(obj);
109 static void sync_timeline_get(struct sync_timeline *obj)
111 kref_get(&obj->kref);
114 static void sync_timeline_put(struct sync_timeline *obj)
116 kref_put(&obj->kref, sync_timeline_free);
119 static const char *timeline_fence_get_driver_name(struct dma_fence *fence)
124 static const char *timeline_fence_get_timeline_name(struct dma_fence *fence)
126 struct sync_timeline *parent = dma_fence_parent(fence);
131 static void timeline_fence_release(struct dma_fence *fence)
133 struct sync_pt *pt = dma_fence_to_sync_pt(fence);
134 struct sync_timeline *parent = dma_fence_parent(fence);
136 if (!list_empty(&pt->link)) {
139 spin_lock_irqsave(fence->lock, flags);
140 if (!list_empty(&pt->link)) {
142 rb_erase(&pt->node, &parent->pt_tree);
144 spin_unlock_irqrestore(fence->lock, flags);
147 sync_timeline_put(parent);
148 dma_fence_free(fence);
151 static bool timeline_fence_signaled(struct dma_fence *fence)
153 struct sync_timeline *parent = dma_fence_parent(fence);
155 return !__dma_fence_is_later(fence->seqno, parent->value, fence->ops);
158 static bool timeline_fence_enable_signaling(struct dma_fence *fence)
163 static void timeline_fence_value_str(struct dma_fence *fence,
166 snprintf(str, size, "%lld", fence->seqno);
169 static void timeline_fence_timeline_value_str(struct dma_fence *fence,
172 struct sync_timeline *parent = dma_fence_parent(fence);
174 snprintf(str, size, "%d", parent->value);
177 static const struct dma_fence_ops timeline_fence_ops = {
178 .get_driver_name = timeline_fence_get_driver_name,
179 .get_timeline_name = timeline_fence_get_timeline_name,
180 .enable_signaling = timeline_fence_enable_signaling,
181 .signaled = timeline_fence_signaled,
182 .release = timeline_fence_release,
183 .fence_value_str = timeline_fence_value_str,
184 .timeline_value_str = timeline_fence_timeline_value_str,
188 * sync_timeline_signal() - signal a status change on a sync_timeline
189 * @obj: sync_timeline to signal
190 * @inc: num to increment on timeline->value
192 * A sync implementation should call this any time one of it's fences
193 * has signaled or has an error condition.
195 static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
197 struct sync_pt *pt, *next;
199 trace_sync_timeline(obj);
201 spin_lock_irq(&obj->lock);
205 list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
206 if (!timeline_fence_signaled(&pt->base))
209 list_del_init(&pt->link);
210 rb_erase(&pt->node, &obj->pt_tree);
213 * A signal callback may release the last reference to this
214 * fence, causing it to be freed. That operation has to be
215 * last to avoid a use after free inside this loop, and must
216 * be after we remove the fence from the timeline in order to
217 * prevent deadlocking on timeline->lock inside
218 * timeline_fence_release().
220 dma_fence_signal_locked(&pt->base);
223 spin_unlock_irq(&obj->lock);
227 * sync_pt_create() - creates a sync pt
228 * @obj: parent sync_timeline
229 * @value: value of the fence
231 * Creates a new sync_pt (fence) as a child of @parent. @size bytes will be
232 * allocated allowing for implementation specific data to be kept after
233 * the generic sync_timeline struct. Returns the sync_pt object or
234 * NULL in case of error.
236 static struct sync_pt *sync_pt_create(struct sync_timeline *obj,
241 pt = kzalloc(sizeof(*pt), GFP_KERNEL);
245 sync_timeline_get(obj);
246 dma_fence_init(&pt->base, &timeline_fence_ops, &obj->lock,
247 obj->context, value);
248 INIT_LIST_HEAD(&pt->link);
250 spin_lock_irq(&obj->lock);
251 if (!dma_fence_is_signaled_locked(&pt->base)) {
252 struct rb_node **p = &obj->pt_tree.rb_node;
253 struct rb_node *parent = NULL;
256 struct sync_pt *other;
260 other = rb_entry(parent, typeof(*pt), node);
261 cmp = value - other->base.seqno;
263 p = &parent->rb_right;
264 } else if (cmp < 0) {
265 p = &parent->rb_left;
267 if (dma_fence_get_rcu(&other->base)) {
268 dma_fence_put(&pt->base);
272 p = &parent->rb_left;
275 rb_link_node(&pt->node, parent, p);
276 rb_insert_color(&pt->node, &obj->pt_tree);
278 parent = rb_next(&pt->node);
279 list_add_tail(&pt->link,
280 parent ? &rb_entry(parent, typeof(*pt), node)->link : &obj->pt_list);
283 spin_unlock_irq(&obj->lock);
291 * improper use of this can result in deadlocking kernel drivers from userspace.
294 /* opening sw_sync create a new sync obj */
295 static int sw_sync_debugfs_open(struct inode *inode, struct file *file)
297 struct sync_timeline *obj;
298 char task_comm[TASK_COMM_LEN];
300 get_task_comm(task_comm, current);
302 obj = sync_timeline_create(task_comm);
306 file->private_data = obj;
311 static int sw_sync_debugfs_release(struct inode *inode, struct file *file)
313 struct sync_timeline *obj = file->private_data;
314 struct sync_pt *pt, *next;
316 spin_lock_irq(&obj->lock);
318 list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
319 dma_fence_set_error(&pt->base, -ENOENT);
320 dma_fence_signal_locked(&pt->base);
323 spin_unlock_irq(&obj->lock);
325 sync_timeline_put(obj);
329 static long sw_sync_ioctl_create_fence(struct sync_timeline *obj,
332 int fd = get_unused_fd_flags(O_CLOEXEC);
335 struct sync_file *sync_file;
336 struct sw_sync_create_fence_data data;
341 if (copy_from_user(&data, (void __user *)arg, sizeof(data))) {
346 pt = sync_pt_create(obj, data.value);
352 sync_file = sync_file_create(&pt->base);
353 dma_fence_put(&pt->base);
360 if (copy_to_user((void __user *)arg, &data, sizeof(data))) {
361 fput(sync_file->file);
366 fd_install(fd, sync_file->file);
375 static long sw_sync_ioctl_inc(struct sync_timeline *obj, unsigned long arg)
379 if (copy_from_user(&value, (void __user *)arg, sizeof(value)))
382 while (value > INT_MAX) {
383 sync_timeline_signal(obj, INT_MAX);
387 sync_timeline_signal(obj, value);
392 static long sw_sync_ioctl(struct file *file, unsigned int cmd,
395 struct sync_timeline *obj = file->private_data;
398 case SW_SYNC_IOC_CREATE_FENCE:
399 return sw_sync_ioctl_create_fence(obj, arg);
401 case SW_SYNC_IOC_INC:
402 return sw_sync_ioctl_inc(obj, arg);
409 const struct file_operations sw_sync_debugfs_fops = {
410 .open = sw_sync_debugfs_open,
411 .release = sw_sync_debugfs_release,
412 .unlocked_ioctl = sw_sync_ioctl,
413 .compat_ioctl = sw_sync_ioctl,