sw_sync.c 9.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Sync File validation framework
  4. *
  5. * Copyright (C) 2012 Google, Inc.
  6. */
  7. #include <linux/file.h>
  8. #include <linux/fs.h>
  9. #include <linux/uaccess.h>
  10. #include <linux/slab.h>
  11. #include <linux/sync_file.h>
  12. #include "sync_debug.h"
  13. #define CREATE_TRACE_POINTS
  14. #include "sync_trace.h"
  15. /*
  16. * SW SYNC validation framework
  17. *
  18. * A sync object driver that uses a 32bit counter to coordinate
  19. * synchronization. Useful when there is no hardware primitive backing
  20. * the synchronization.
  21. *
  22. * To start the framework just open:
  23. *
  24. * <debugfs>/sync/sw_sync
  25. *
  26. * That will create a sync timeline, all fences created under this timeline
  27. * file descriptor will belong to the this timeline.
  28. *
  29. * The 'sw_sync' file can be opened many times as to create different
  30. * timelines.
  31. *
  32. * Fences can be created with SW_SYNC_IOC_CREATE_FENCE ioctl with struct
  33. * sw_sync_create_fence_data as parameter.
  34. *
  35. * To increment the timeline counter, SW_SYNC_IOC_INC ioctl should be used
  36. * with the increment as u32. This will update the last signaled value
  37. * from the timeline and signal any fence that has a seqno smaller or equal
  38. * to it.
  39. *
  40. * struct sw_sync_create_fence_data
  41. * @value: the seqno to initialise the fence with
  42. * @name: the name of the new sync point
  43. * @fence: return the fd of the new sync_file with the created fence
  44. */
  45. struct sw_sync_create_fence_data {
  46. __u32 value;
  47. char name[32];
  48. __s32 fence; /* fd of new fence */
  49. };
  50. #define SW_SYNC_IOC_MAGIC 'W'
  51. #define SW_SYNC_IOC_CREATE_FENCE _IOWR(SW_SYNC_IOC_MAGIC, 0,\
  52. struct sw_sync_create_fence_data)
  53. #define SW_SYNC_IOC_INC _IOW(SW_SYNC_IOC_MAGIC, 1, __u32)
  54. static const struct dma_fence_ops timeline_fence_ops;
  55. static inline struct sync_pt *dma_fence_to_sync_pt(struct dma_fence *fence)
  56. {
  57. if (fence->ops != &timeline_fence_ops)
  58. return NULL;
  59. return container_of(fence, struct sync_pt, base);
  60. }
  61. /**
  62. * sync_timeline_create() - creates a sync object
  63. * @name: sync_timeline name
  64. *
  65. * Creates a new sync_timeline. Returns the sync_timeline object or NULL in
  66. * case of error.
  67. */
  68. static struct sync_timeline *sync_timeline_create(const char *name)
  69. {
  70. struct sync_timeline *obj;
  71. obj = kzalloc(sizeof(*obj), GFP_KERNEL);
  72. if (!obj)
  73. return NULL;
  74. kref_init(&obj->kref);
  75. obj->context = dma_fence_context_alloc(1);
  76. strlcpy(obj->name, name, sizeof(obj->name));
  77. obj->pt_tree = RB_ROOT;
  78. INIT_LIST_HEAD(&obj->pt_list);
  79. spin_lock_init(&obj->lock);
  80. sync_timeline_debug_add(obj);
  81. return obj;
  82. }
  83. static void sync_timeline_free(struct kref *kref)
  84. {
  85. struct sync_timeline *obj =
  86. container_of(kref, struct sync_timeline, kref);
  87. sync_timeline_debug_remove(obj);
  88. kfree(obj);
  89. }
  90. static void sync_timeline_get(struct sync_timeline *obj)
  91. {
  92. kref_get(&obj->kref);
  93. }
  94. static void sync_timeline_put(struct sync_timeline *obj)
  95. {
  96. kref_put(&obj->kref, sync_timeline_free);
  97. }
  98. static const char *timeline_fence_get_driver_name(struct dma_fence *fence)
  99. {
  100. return "sw_sync";
  101. }
  102. static const char *timeline_fence_get_timeline_name(struct dma_fence *fence)
  103. {
  104. struct sync_timeline *parent = dma_fence_parent(fence);
  105. return parent->name;
  106. }
  107. static void timeline_fence_release(struct dma_fence *fence)
  108. {
  109. struct sync_pt *pt = dma_fence_to_sync_pt(fence);
  110. struct sync_timeline *parent = dma_fence_parent(fence);
  111. unsigned long flags;
  112. spin_lock_irqsave(fence->lock, flags);
  113. if (!list_empty(&pt->link)) {
  114. list_del(&pt->link);
  115. rb_erase(&pt->node, &parent->pt_tree);
  116. }
  117. spin_unlock_irqrestore(fence->lock, flags);
  118. sync_timeline_put(parent);
  119. dma_fence_free(fence);
  120. }
  121. static bool timeline_fence_signaled(struct dma_fence *fence)
  122. {
  123. struct sync_timeline *parent = dma_fence_parent(fence);
  124. return !__dma_fence_is_later(fence->seqno, parent->value, fence->ops);
  125. }
  126. static bool timeline_fence_enable_signaling(struct dma_fence *fence)
  127. {
  128. return true;
  129. }
  130. static void timeline_fence_value_str(struct dma_fence *fence,
  131. char *str, int size)
  132. {
  133. snprintf(str, size, "%lld", fence->seqno);
  134. }
  135. static void timeline_fence_timeline_value_str(struct dma_fence *fence,
  136. char *str, int size)
  137. {
  138. struct sync_timeline *parent = dma_fence_parent(fence);
  139. snprintf(str, size, "%d", parent->value);
  140. }
  141. static const struct dma_fence_ops timeline_fence_ops = {
  142. .get_driver_name = timeline_fence_get_driver_name,
  143. .get_timeline_name = timeline_fence_get_timeline_name,
  144. .enable_signaling = timeline_fence_enable_signaling,
  145. .signaled = timeline_fence_signaled,
  146. .release = timeline_fence_release,
  147. .fence_value_str = timeline_fence_value_str,
  148. .timeline_value_str = timeline_fence_timeline_value_str,
  149. };
  150. /**
  151. * sync_timeline_signal() - signal a status change on a sync_timeline
  152. * @obj: sync_timeline to signal
  153. * @inc: num to increment on timeline->value
  154. *
  155. * A sync implementation should call this any time one of it's fences
  156. * has signaled or has an error condition.
  157. */
  158. static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
  159. {
  160. struct sync_pt *pt, *next;
  161. trace_sync_timeline(obj);
  162. spin_lock_irq(&obj->lock);
  163. obj->value += inc;
  164. list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
  165. if (!timeline_fence_signaled(&pt->base))
  166. break;
  167. list_del_init(&pt->link);
  168. rb_erase(&pt->node, &obj->pt_tree);
  169. /*
  170. * A signal callback may release the last reference to this
  171. * fence, causing it to be freed. That operation has to be
  172. * last to avoid a use after free inside this loop, and must
  173. * be after we remove the fence from the timeline in order to
  174. * prevent deadlocking on timeline->lock inside
  175. * timeline_fence_release().
  176. */
  177. dma_fence_signal_locked(&pt->base);
  178. }
  179. spin_unlock_irq(&obj->lock);
  180. }
  181. /**
  182. * sync_pt_create() - creates a sync pt
  183. * @obj: parent sync_timeline
  184. * @value: value of the fence
  185. *
  186. * Creates a new sync_pt (fence) as a child of @parent. @size bytes will be
  187. * allocated allowing for implementation specific data to be kept after
  188. * the generic sync_timeline struct. Returns the sync_pt object or
  189. * NULL in case of error.
  190. */
  191. static struct sync_pt *sync_pt_create(struct sync_timeline *obj,
  192. unsigned int value)
  193. {
  194. struct sync_pt *pt;
  195. pt = kzalloc(sizeof(*pt), GFP_KERNEL);
  196. if (!pt)
  197. return NULL;
  198. sync_timeline_get(obj);
  199. dma_fence_init(&pt->base, &timeline_fence_ops, &obj->lock,
  200. obj->context, value);
  201. INIT_LIST_HEAD(&pt->link);
  202. spin_lock_irq(&obj->lock);
  203. if (!dma_fence_is_signaled_locked(&pt->base)) {
  204. struct rb_node **p = &obj->pt_tree.rb_node;
  205. struct rb_node *parent = NULL;
  206. while (*p) {
  207. struct sync_pt *other;
  208. int cmp;
  209. parent = *p;
  210. other = rb_entry(parent, typeof(*pt), node);
  211. cmp = value - other->base.seqno;
  212. if (cmp > 0) {
  213. p = &parent->rb_right;
  214. } else if (cmp < 0) {
  215. p = &parent->rb_left;
  216. } else {
  217. if (dma_fence_get_rcu(&other->base)) {
  218. sync_timeline_put(obj);
  219. kfree(pt);
  220. pt = other;
  221. goto unlock;
  222. }
  223. p = &parent->rb_left;
  224. }
  225. }
  226. rb_link_node(&pt->node, parent, p);
  227. rb_insert_color(&pt->node, &obj->pt_tree);
  228. parent = rb_next(&pt->node);
  229. list_add_tail(&pt->link,
  230. parent ? &rb_entry(parent, typeof(*pt), node)->link : &obj->pt_list);
  231. }
  232. unlock:
  233. spin_unlock_irq(&obj->lock);
  234. return pt;
  235. }
  236. /*
  237. * *WARNING*
  238. *
  239. * improper use of this can result in deadlocking kernel drivers from userspace.
  240. */
  241. /* opening sw_sync create a new sync obj */
  242. static int sw_sync_debugfs_open(struct inode *inode, struct file *file)
  243. {
  244. struct sync_timeline *obj;
  245. char task_comm[TASK_COMM_LEN];
  246. get_task_comm(task_comm, current);
  247. obj = sync_timeline_create(task_comm);
  248. if (!obj)
  249. return -ENOMEM;
  250. file->private_data = obj;
  251. return 0;
  252. }
  253. static int sw_sync_debugfs_release(struct inode *inode, struct file *file)
  254. {
  255. struct sync_timeline *obj = file->private_data;
  256. struct sync_pt *pt, *next;
  257. spin_lock_irq(&obj->lock);
  258. list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
  259. dma_fence_set_error(&pt->base, -ENOENT);
  260. dma_fence_signal_locked(&pt->base);
  261. }
  262. spin_unlock_irq(&obj->lock);
  263. sync_timeline_put(obj);
  264. return 0;
  265. }
  266. static long sw_sync_ioctl_create_fence(struct sync_timeline *obj,
  267. unsigned long arg)
  268. {
  269. int fd = get_unused_fd_flags(O_CLOEXEC);
  270. int err;
  271. struct sync_pt *pt;
  272. struct sync_file *sync_file;
  273. struct sw_sync_create_fence_data data;
  274. if (fd < 0)
  275. return fd;
  276. if (copy_from_user(&data, (void __user *)arg, sizeof(data))) {
  277. err = -EFAULT;
  278. goto err;
  279. }
  280. pt = sync_pt_create(obj, data.value);
  281. if (!pt) {
  282. err = -ENOMEM;
  283. goto err;
  284. }
  285. sync_file = sync_file_create(&pt->base);
  286. dma_fence_put(&pt->base);
  287. if (!sync_file) {
  288. err = -ENOMEM;
  289. goto err;
  290. }
  291. data.fence = fd;
  292. if (copy_to_user((void __user *)arg, &data, sizeof(data))) {
  293. fput(sync_file->file);
  294. err = -EFAULT;
  295. goto err;
  296. }
  297. fd_install(fd, sync_file->file);
  298. return 0;
  299. err:
  300. put_unused_fd(fd);
  301. return err;
  302. }
  303. static long sw_sync_ioctl_inc(struct sync_timeline *obj, unsigned long arg)
  304. {
  305. u32 value;
  306. if (copy_from_user(&value, (void __user *)arg, sizeof(value)))
  307. return -EFAULT;
  308. while (value > INT_MAX) {
  309. sync_timeline_signal(obj, INT_MAX);
  310. value -= INT_MAX;
  311. }
  312. sync_timeline_signal(obj, value);
  313. return 0;
  314. }
  315. static long sw_sync_ioctl(struct file *file, unsigned int cmd,
  316. unsigned long arg)
  317. {
  318. struct sync_timeline *obj = file->private_data;
  319. switch (cmd) {
  320. case SW_SYNC_IOC_CREATE_FENCE:
  321. return sw_sync_ioctl_create_fence(obj, arg);
  322. case SW_SYNC_IOC_INC:
  323. return sw_sync_ioctl_inc(obj, arg);
  324. default:
  325. return -ENOTTY;
  326. }
  327. }
  328. const struct file_operations sw_sync_debugfs_fops = {
  329. .open = sw_sync_debugfs_open,
  330. .release = sw_sync_debugfs_release,
  331. .unlocked_ioctl = sw_sync_ioctl,
  332. .compat_ioctl = compat_ptr_ioctl,
  333. };