[deliverable/linux.git] / drivers / dma-buf / sync_file.c

/*
 * drivers/dma-buf/sync_file.c
 *
 * Copyright (C) 2012 Google, Inc.
 *
 * This software is licensed under the terms of the GNU General Public
 * License version 2, as published by the Free Software Foundation, and
 * may be copied, distributed, and modified under those terms.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 */

#include <linux/export.h>
#include <linux/file.h>
#include <linux/fs.h>
#include <linux/kernel.h>
#include <linux/poll.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
#include <linux/anon_inodes.h>
#include <linux/sync_file.h>
#include <uapi/linux/sync_file.h>

static const struct file_operations sync_file_fops;

static struct sync_file *sync_file_alloc(void)
{
	struct sync_file *sync_file;

	sync_file = kzalloc(sizeof(*sync_file), GFP_KERNEL);
	if (!sync_file)
		return NULL;

	sync_file->file = anon_inode_getfile("sync_file", &sync_file_fops,
					     sync_file, 0);
	if (IS_ERR(sync_file->file))
		goto err;

	kref_init(&sync_file->kref);

	init_waitqueue_head(&sync_file->wq);

	INIT_LIST_HEAD(&sync_file->cb.node);

	return sync_file;

err:
	kfree(sync_file);
	return NULL;
}

static void fence_check_cb_func(struct fence *f, struct fence_cb *cb)
{
	struct sync_file *sync_file;

	sync_file = container_of(cb, struct sync_file, cb);

	wake_up_all(&sync_file->wq);
}

/**
 * sync_file_create() - creates a sync file
 * @fence:	fence to add to the sync_fence
 *
 * Creates a sync_file containg @fence. Once this is called, the sync_file
 * takes ownership of @fence. The sync_file can be released with
 * fput(sync_file->file). Returns the sync_file or NULL in case of error.
 */
struct sync_file *sync_file_create(struct fence *fence)
{
	struct sync_file *sync_file;

	sync_file = sync_file_alloc();
	if (!sync_file)
		return NULL;

	sync_file->fence = fence;

	snprintf(sync_file->name, sizeof(sync_file->name), "%s-%s%llu-%d",
		 fence->ops->get_driver_name(fence),
		 fence->ops->get_timeline_name(fence), fence->context,
		 fence->seqno);

	return sync_file;
}
EXPORT_SYMBOL(sync_file_create);

/**
 * sync_file_fdget() - get a sync_file from an fd
 * @fd:		fd referencing a fence
 *
 * Ensures @fd references a valid sync_file, increments the refcount of the
 * backing file. Returns the sync_file or NULL in case of error.
 */
static struct sync_file *sync_file_fdget(int fd)
{
	struct file *file = fget(fd);

	if (!file)
		return NULL;

	if (file->f_op != &sync_file_fops)
		goto err;

	return file->private_data;

err:
	fput(file);
	return NULL;
}

/**
 * sync_file_get_fence - get the fence related to the sync_file fd
 * @fd:		sync_file fd to get the fence from
 *
 * Ensures @fd references a valid sync_file and returns a fence that
 * represents all fence in the sync_file. On error NULL is returned.
 */
struct fence *sync_file_get_fence(int fd)
{
	struct sync_file *sync_file;
	struct fence *fence;

	sync_file = sync_file_fdget(fd);
	if (!sync_file)
		return NULL;

	fence = fence_get(sync_file->fence);
	fput(sync_file->file);

	return fence;
}
EXPORT_SYMBOL(sync_file_get_fence);

static int sync_file_set_fence(struct sync_file *sync_file,
			       struct fence **fences, int num_fences)
{
	struct fence_array *array;

	/*
	 * The reference for the fences in the new sync_file and held
	 * in add_fence() during the merge procedure, so for num_fences == 1
	 * we already own a new reference to the fence. For num_fence > 1
	 * we own the reference of the fence_array creation.
	 */
	if (num_fences == 1) {
		sync_file->fence = fences[0];
	} else {
		array = fence_array_create(num_fences, fences,
					   fence_context_alloc(1), 1, false);
		if (!array)
			return -ENOMEM;

		sync_file->fence = &array->base;
	}

	return 0;
}

static struct fence **get_fences(struct sync_file *sync_file, int *num_fences)
{
	if (fence_is_array(sync_file->fence)) {
		struct fence_array *array = to_fence_array(sync_file->fence);

		*num_fences = array->num_fences;
		return array->fences;
	}

	*num_fences = 1;
	return &sync_file->fence;
}

static void add_fence(struct fence **fences, int *i, struct fence *fence)
{
	fences[*i] = fence;

	if (!fence_is_signaled(fence)) {
		fence_get(fence);
		(*i)++;
	}
}

/**
 * sync_file_merge() - merge two sync_files
 * @name:	name of new fence
 * @a:		sync_file a
 * @b:		sync_file b
 *
 * Creates a new sync_file which contains copies of all the fences in both
 * @a and @b.  @a and @b remain valid, independent sync_file. Returns the
 * new merged sync_file or NULL in case of error.
 */
static struct sync_file *sync_file_merge(const char *name, struct sync_file *a,
					 struct sync_file *b)
{
	struct sync_file *sync_file;
	struct fence **fences, **nfences, **a_fences, **b_fences;
	int i, i_a, i_b, num_fences, a_num_fences, b_num_fences;

	sync_file = sync_file_alloc();
	if (!sync_file)
		return NULL;

	a_fences = get_fences(a, &a_num_fences);
	b_fences = get_fences(b, &b_num_fences);
	if (a_num_fences > INT_MAX - b_num_fences)
		return NULL;

	num_fences = a_num_fences + b_num_fences;

	fences = kcalloc(num_fences, sizeof(*fences), GFP_KERNEL);
	if (!fences)
		goto err;

	/*
	 * Assume sync_file a and b are both ordered and have no
	 * duplicates with the same context.
	 *
	 * If a sync_file can only be created with sync_file_merge
	 * and sync_file_create, this is a reasonable assumption.
	 */
	for (i = i_a = i_b = 0; i_a < a_num_fences && i_b < b_num_fences; ) {
		struct fence *pt_a = a_fences[i_a];
		struct fence *pt_b = b_fences[i_b];

		if (pt_a->context < pt_b->context) {
			add_fence(fences, &i, pt_a);

			i_a++;
		} else if (pt_a->context > pt_b->context) {
			add_fence(fences, &i, pt_b);

			i_b++;
		} else {
			if (pt_a->seqno - pt_b->seqno <= INT_MAX)
				add_fence(fences, &i, pt_a);
			else
				add_fence(fences, &i, pt_b);

			i_a++;
			i_b++;
		}
	}

	for (; i_a < a_num_fences; i_a++)
		add_fence(fences, &i, a_fences[i_a]);

	for (; i_b < b_num_fences; i_b++)
		add_fence(fences, &i, b_fences[i_b]);

	if (i == 0) {
		add_fence(fences, &i, a_fences[0]);
		i++;
	}

	if (num_fences > i) {
		nfences = krealloc(fences, i * sizeof(*fences),
				  GFP_KERNEL);
		if (!nfences)
			goto err;

		fences = nfences;
	}

	if (sync_file_set_fence(sync_file, fences, i) < 0) {
		kfree(fences);
		goto err;
	}

	strlcpy(sync_file->name, name, sizeof(sync_file->name));
	return sync_file;

err:
	fput(sync_file->file);
	return NULL;

}

static void sync_file_free(struct kref *kref)
{
	struct sync_file *sync_file = container_of(kref, struct sync_file,
						     kref);

	if (test_bit(POLL_ENABLED, &sync_file->fence->flags))
		fence_remove_callback(sync_file->fence, &sync_file->cb);
	fence_put(sync_file->fence);
	kfree(sync_file);
}

static int sync_file_release(struct inode *inode, struct file *file)
{
	struct sync_file *sync_file = file->private_data;

	kref_put(&sync_file->kref, sync_file_free);
	return 0;
}

static unsigned int sync_file_poll(struct file *file, poll_table *wait)
{
	struct sync_file *sync_file = file->private_data;

	poll_wait(file, &sync_file->wq, wait);

	if (!test_and_set_bit(POLL_ENABLED, &sync_file->fence->flags)) {
		if (fence_add_callback(sync_file->fence, &sync_file->cb,
				       fence_check_cb_func) < 0)
			wake_up_all(&sync_file->wq);
	}

	return fence_is_signaled(sync_file->fence) ? POLLIN : 0;
}

static long sync_file_ioctl_merge(struct sync_file *sync_file,
				  unsigned long arg)
{
	int fd = get_unused_fd_flags(O_CLOEXEC);
	int err;
	struct sync_file *fence2, *fence3;
	struct sync_merge_data data;

	if (fd < 0)
		return fd;

	if (copy_from_user(&data, (void __user *)arg, sizeof(data))) {
		err = -EFAULT;
		goto err_put_fd;
	}

	if (data.flags || data.pad) {
		err = -EINVAL;
		goto err_put_fd;
	}

	fence2 = sync_file_fdget(data.fd2);
	if (!fence2) {
		err = -ENOENT;
		goto err_put_fd;
	}

	data.name[sizeof(data.name) - 1] = '\0';
	fence3 = sync_file_merge(data.name, sync_file, fence2);
	if (!fence3) {
		err = -ENOMEM;
		goto err_put_fence2;
	}

	data.fence = fd;
	if (copy_to_user((void __user *)arg, &data, sizeof(data))) {
		err = -EFAULT;
		goto err_put_fence3;
	}

	fd_install(fd, fence3->file);
	fput(fence2->file);
	return 0;

err_put_fence3:
	fput(fence3->file);

err_put_fence2:
	fput(fence2->file);

err_put_fd:
	put_unused_fd(fd);
	return err;
}

static void sync_fill_fence_info(struct fence *fence,
				 struct sync_fence_info *info)
{
	strlcpy(info->obj_name, fence->ops->get_timeline_name(fence),
		sizeof(info->obj_name));
	strlcpy(info->driver_name, fence->ops->get_driver_name(fence),
		sizeof(info->driver_name));
	if (fence_is_signaled(fence))
		info->status = fence->status >= 0 ? 1 : fence->status;
	else
		info->status = 0;
	info->timestamp_ns = ktime_to_ns(fence->timestamp);
}

static long sync_file_ioctl_fence_info(struct sync_file *sync_file,
				       unsigned long arg)
{
	struct sync_file_info info;
	struct sync_fence_info *fence_info = NULL;
	struct fence **fences;
	__u32 size;
	int num_fences, ret, i;

	if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
		return -EFAULT;

	if (info.flags || info.pad)
		return -EINVAL;

	fences = get_fences(sync_file, &num_fences);

	/*
	 * Passing num_fences = 0 means that userspace doesn't want to
	 * retrieve any sync_fence_info. If num_fences = 0 we skip filling
	 * sync_fence_info and return the actual number of fences on
	 * info->num_fences.
	 */
	if (!info.num_fences)
		goto no_fences;

	if (info.num_fences < num_fences)
		return -EINVAL;

	size = num_fences * sizeof(*fence_info);
	fence_info = kzalloc(size, GFP_KERNEL);
	if (!fence_info)
		return -ENOMEM;

	for (i = 0; i < num_fences; i++)
		sync_fill_fence_info(fences[i], &fence_info[i]);

	if (copy_to_user(u64_to_user_ptr(info.sync_fence_info), fence_info,
			 size)) {
		ret = -EFAULT;
		goto out;
	}

no_fences:
	strlcpy(info.name, sync_file->name, sizeof(info.name));
	info.status = fence_is_signaled(sync_file->fence);
	info.num_fences = num_fences;

	if (copy_to_user((void __user *)arg, &info, sizeof(info)))
		ret = -EFAULT;
	else
		ret = 0;

out:
	kfree(fence_info);

	return ret;
}

static long sync_file_ioctl(struct file *file, unsigned int cmd,
			    unsigned long arg)
{
	struct sync_file *sync_file = file->private_data;

	switch (cmd) {
	case SYNC_IOC_MERGE:
		return sync_file_ioctl_merge(sync_file, arg);

	case SYNC_IOC_FILE_INFO:
		return sync_file_ioctl_fence_info(sync_file, arg);

	default:
		return -ENOTTY;
	}
}

static const struct file_operations sync_file_fops = {
	.release = sync_file_release,
	.poll = sync_file_poll,
	.unlocked_ioctl = sync_file_ioctl,
	.compat_ioctl = sync_file_ioctl,
};
Commit	Line	Data
d4cab38e GP	1	/*
	2	* drivers/dma-buf/sync_file.c
	3	*
	4	* Copyright (C) 2012 Google, Inc.
	5	*
	6	* This software is licensed under the terms of the GNU General Public
	7	* License version 2, as published by the Free Software Foundation, and
	8	* may be copied, distributed, and modified under those terms.
	9	*
	10	* This program is distributed in the hope that it will be useful,
	11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	13	* GNU General Public License for more details.
	14	*
	15	*/
	16
	17	#include <linux/export.h>
	18	#include <linux/file.h>
	19	#include <linux/fs.h>
	20	#include <linux/kernel.h>
	21	#include <linux/poll.h>
	22	#include <linux/sched.h>
	23	#include <linux/slab.h>
	24	#include <linux/uaccess.h>
	25	#include <linux/anon_inodes.h>
460bfc41 GP	26	#include <linux/sync_file.h>
460bfc41 GP	27	#include <uapi/linux/sync_file.h>
d4cab38e GP	28
	29	static const struct file_operations sync_file_fops;
	30
a02b9dc9	31	static struct sync_file *sync_file_alloc(void)
d4cab38e GP	32	{
	33	struct sync_file *sync_file;
	34
a02b9dc9	35	sync_file = kzalloc(sizeof(*sync_file), GFP_KERNEL);
d4cab38e GP	36	if (!sync_file)
	37	return NULL;
	38
	39	sync_file->file = anon_inode_getfile("sync_file", &sync_file_fops,
	40	sync_file, 0);
	41	if (IS_ERR(sync_file->file))
	42	goto err;
	43
	44	kref_init(&sync_file->kref);
	45
	46	init_waitqueue_head(&sync_file->wq);
	47
a02b9dc9 GP	48	INIT_LIST_HEAD(&sync_file->cb.node);
a02b9dc9 GP	49
d4cab38e GP	50	return sync_file;
	51
	52	err:
	53	kfree(sync_file);
	54	return NULL;
	55	}
	56
	57	static void fence_check_cb_func(struct fence f, struct fence_cb cb)
	58	{
d4cab38e GP	59	struct sync_file *sync_file;
d4cab38e GP	60
a02b9dc9	61	sync_file = container_of(cb, struct sync_file, cb);
d4cab38e	62
a02b9dc9	63	wake_up_all(&sync_file->wq);
d4cab38e GP	64	}
	65
	66	/**
c240a714	67	* sync_file_create() - creates a sync file
d4cab38e GP	68	* @fence: fence to add to the sync_fence
	69	*
	70	* Creates a sync_file containg @fence. Once this is called, the sync_file
c240a714 GP	71	* takes ownership of @fence. The sync_file can be released with
c240a714 GP	72	* fput(sync_file->file). Returns the sync_file or NULL in case of error.
d4cab38e GP	73	*/
	74	struct sync_file sync_file_create(struct fence fence)
	75	{
	76	struct sync_file *sync_file;
	77
a02b9dc9	78	sync_file = sync_file_alloc();
d4cab38e GP	79	if (!sync_file)
	80	return NULL;
	81
a02b9dc9 GP	82	sync_file->fence = fence;
a02b9dc9 GP	83
041916a7	84	snprintf(sync_file->name, sizeof(sync_file->name), "%s-%s%llu-%d",
d4cab38e GP	85	fence->ops->get_driver_name(fence),
	86	fence->ops->get_timeline_name(fence), fence->context,
	87	fence->seqno);
	88
d4cab38e GP	89	return sync_file;
	90	}
	91	EXPORT_SYMBOL(sync_file_create);
	92
	93	/**
	94	* sync_file_fdget() - get a sync_file from an fd
	95	* @fd: fd referencing a fence
	96	*
	97	* Ensures @fd references a valid sync_file, increments the refcount of the
	98	* backing file. Returns the sync_file or NULL in case of error.
	99	*/
	100	static struct sync_file *sync_file_fdget(int fd)
	101	{
	102	struct file *file = fget(fd);
	103
	104	if (!file)
	105	return NULL;
	106
	107	if (file->f_op != &sync_file_fops)
	108	goto err;
	109
	110	return file->private_data;
	111
	112	err:
	113	fput(file);
	114	return NULL;
	115	}
	116
972526a4 GP	117	/**
	118	* sync_file_get_fence - get the fence related to the sync_file fd
	119	* @fd: sync_file fd to get the fence from
	120	*
	121	* Ensures @fd references a valid sync_file and returns a fence that
	122	* represents all fence in the sync_file. On error NULL is returned.
	123	*/
	124	struct fence *sync_file_get_fence(int fd)
	125	{
	126	struct sync_file *sync_file;
	127	struct fence *fence;
	128
	129	sync_file = sync_file_fdget(fd);
	130	if (!sync_file)
	131	return NULL;
	132
	133	fence = fence_get(sync_file->fence);
	134	fput(sync_file->file);
	135
	136	return fence;
	137	}
	138	EXPORT_SYMBOL(sync_file_get_fence);
	139
a02b9dc9 GP	140	static int sync_file_set_fence(struct sync_file *sync_file,
a02b9dc9 GP	141	struct fence **fences, int num_fences)
d4cab38e	142	{
a02b9dc9 GP	143	struct fence_array *array;
	144
	145	/*
	146	* The reference for the fences in the new sync_file and held
	147	* in add_fence() during the merge procedure, so for num_fences == 1
	148	* we already own a new reference to the fence. For num_fence > 1
	149	* we own the reference of the fence_array creation.
	150	*/
	151	if (num_fences == 1) {
	152	sync_file->fence = fences[0];
	153	} else {
	154	array = fence_array_create(num_fences, fences,
	155	fence_context_alloc(1), 1, false);
	156	if (!array)
	157	return -ENOMEM;
	158
	159	sync_file->fence = &array->base;
	160	}
d4cab38e	161
a02b9dc9 GP	162	return 0;
	163	}
	164
	165	static struct fence *get_fences(struct sync_file sync_file, int *num_fences)
	166	{
	167	if (fence_is_array(sync_file->fence)) {
	168	struct fence_array *array = to_fence_array(sync_file->fence);
	169
	170	*num_fences = array->num_fences;
	171	return array->fences;
	172	}
	173
	174	*num_fences = 1;
	175	return &sync_file->fence;
	176	}
	177
	178	static void add_fence(struct fence *fences, int i, struct fence *fence)
	179	{
	180	fences[*i] = fence;
	181
	182	if (!fence_is_signaled(fence)) {
d4cab38e GP	183	fence_get(fence);
	184	(*i)++;
	185	}
	186	}
	187
	188	/**
	189	* sync_file_merge() - merge two sync_files
	190	* @name: name of new fence
	191	* @a: sync_file a
	192	* @b: sync_file b
	193	*
	194	* Creates a new sync_file which contains copies of all the fences in both
	195	* @a and @b. @a and @b remain valid, independent sync_file. Returns the
	196	* new merged sync_file or NULL in case of error.
	197	*/
	198	static struct sync_file sync_file_merge(const char name, struct sync_file *a,
	199	struct sync_file *b)
	200	{
d4cab38e	201	struct sync_file *sync_file;
a02b9dc9 GP	202	struct fence fences, nfences, a_fences, b_fences;
a02b9dc9 GP	203	int i, i_a, i_b, num_fences, a_num_fences, b_num_fences;
d4cab38e	204
a02b9dc9	205	sync_file = sync_file_alloc();
d4cab38e GP	206	if (!sync_file)
	207	return NULL;
	208
a02b9dc9 GP	209	a_fences = get_fences(a, &a_num_fences);
	210	b_fences = get_fences(b, &b_num_fences);
	211	if (a_num_fences > INT_MAX - b_num_fences)
	212	return NULL;
	213
	214	num_fences = a_num_fences + b_num_fences;
	215
	216	fences = kcalloc(num_fences, sizeof(*fences), GFP_KERNEL);
	217	if (!fences)
	218	goto err;
d4cab38e GP	219
	220	/*
	221	* Assume sync_file a and b are both ordered and have no
	222	* duplicates with the same context.
	223	*
	224	* If a sync_file can only be created with sync_file_merge
	225	* and sync_file_create, this is a reasonable assumption.
	226	*/
a02b9dc9 GP	227	for (i = i_a = i_b = 0; i_a < a_num_fences && i_b < b_num_fences; ) {
	228	struct fence *pt_a = a_fences[i_a];
	229	struct fence *pt_b = b_fences[i_b];
d4cab38e GP	230
d4cab38e GP	231	if (pt_a->context < pt_b->context) {
a02b9dc9	232	add_fence(fences, &i, pt_a);
d4cab38e GP	233
	234	i_a++;
	235	} else if (pt_a->context > pt_b->context) {
a02b9dc9	236	add_fence(fences, &i, pt_b);
d4cab38e GP	237
	238	i_b++;
	239	} else {
	240	if (pt_a->seqno - pt_b->seqno <= INT_MAX)
a02b9dc9	241	add_fence(fences, &i, pt_a);
d4cab38e	242	else
a02b9dc9	243	add_fence(fences, &i, pt_b);
d4cab38e GP	244
	245	i_a++;
	246	i_b++;
	247	}
	248	}
	249
a02b9dc9 GP	250	for (; i_a < a_num_fences; i_a++)
	251	add_fence(fences, &i, a_fences[i_a]);
	252
	253	for (; i_b < b_num_fences; i_b++)
	254	add_fence(fences, &i, b_fences[i_b]);
	255
	256	if (i == 0) {
	257	add_fence(fences, &i, a_fences[0]);
	258	i++;
	259	}
d4cab38e	260
a02b9dc9 GP	261	if (num_fences > i) {
	262	nfences = krealloc(fences, i * sizeof(*fences),
	263	GFP_KERNEL);
	264	if (!nfences)
	265	goto err;
	266
	267	fences = nfences;
	268	}
	269
	270	if (sync_file_set_fence(sync_file, fences, i) < 0) {
	271	kfree(fences);
	272	goto err;
	273	}
d4cab38e	274
d4cab38e GP	275	strlcpy(sync_file->name, name, sizeof(sync_file->name));
d4cab38e GP	276	return sync_file;
a02b9dc9 GP	277
	278	err:
	279	fput(sync_file->file);
	280	return NULL;
	281
d4cab38e GP	282	}
	283
	284	static void sync_file_free(struct kref *kref)
	285	{
	286	struct sync_file *sync_file = container_of(kref, struct sync_file,
	287	kref);
d4cab38e	288
e2416553 GP	289	if (test_bit(POLL_ENABLED, &sync_file->fence->flags))
e2416553 GP	290	fence_remove_callback(sync_file->fence, &sync_file->cb);
a02b9dc9	291	fence_put(sync_file->fence);
d4cab38e GP	292	kfree(sync_file);
	293	}
	294
	295	static int sync_file_release(struct inode inode, struct file file)
	296	{
	297	struct sync_file *sync_file = file->private_data;
	298
	299	kref_put(&sync_file->kref, sync_file_free);
	300	return 0;
	301	}
	302
	303	static unsigned int sync_file_poll(struct file file, poll_table wait)
	304	{
	305	struct sync_file *sync_file = file->private_data;
d4cab38e GP	306
	307	poll_wait(file, &sync_file->wq, wait);
	308
e2416553 GP	309	if (!test_and_set_bit(POLL_ENABLED, &sync_file->fence->flags)) {
	310	if (fence_add_callback(sync_file->fence, &sync_file->cb,
	311	fence_check_cb_func) < 0)
	312	wake_up_all(&sync_file->wq);
	313	}
d4cab38e	314
e2416553	315	return fence_is_signaled(sync_file->fence) ? POLLIN : 0;
d4cab38e GP	316	}
	317
	318	static long sync_file_ioctl_merge(struct sync_file *sync_file,
92e06213	319	unsigned long arg)
d4cab38e GP	320	{
	321	int fd = get_unused_fd_flags(O_CLOEXEC);
	322	int err;
	323	struct sync_file fence2, fence3;
	324	struct sync_merge_data data;
	325
	326	if (fd < 0)
	327	return fd;
	328
	329	if (copy_from_user(&data, (void __user *)arg, sizeof(data))) {
	330	err = -EFAULT;
	331	goto err_put_fd;
	332	}
	333
	334	if (data.flags \|\| data.pad) {
	335	err = -EINVAL;
	336	goto err_put_fd;
	337	}
	338
	339	fence2 = sync_file_fdget(data.fd2);
	340	if (!fence2) {
	341	err = -ENOENT;
	342	goto err_put_fd;
	343	}
	344
	345	data.name[sizeof(data.name) - 1] = '\0';
	346	fence3 = sync_file_merge(data.name, sync_file, fence2);
	347	if (!fence3) {
	348	err = -ENOMEM;
	349	goto err_put_fence2;
	350	}
	351
	352	data.fence = fd;
	353	if (copy_to_user((void __user *)arg, &data, sizeof(data))) {
	354	err = -EFAULT;
	355	goto err_put_fence3;
	356	}
	357
	358	fd_install(fd, fence3->file);
	359	fput(fence2->file);
	360	return 0;
	361
	362	err_put_fence3:
	363	fput(fence3->file);
	364
	365	err_put_fence2:
	366	fput(fence2->file);
	367
	368	err_put_fd:
	369	put_unused_fd(fd);
	370	return err;
	371	}
	372
	373	static void sync_fill_fence_info(struct fence *fence,
92e06213	374	struct sync_fence_info *info)
d4cab38e GP	375	{
	376	strlcpy(info->obj_name, fence->ops->get_timeline_name(fence),
	377	sizeof(info->obj_name));
	378	strlcpy(info->driver_name, fence->ops->get_driver_name(fence),
	379	sizeof(info->driver_name));
	380	if (fence_is_signaled(fence))
	381	info->status = fence->status >= 0 ? 1 : fence->status;
	382	else
	383	info->status = 0;
	384	info->timestamp_ns = ktime_to_ns(fence->timestamp);
	385	}
	386
	387	static long sync_file_ioctl_fence_info(struct sync_file *sync_file,
92e06213	388	unsigned long arg)
d4cab38e GP	389	{
	390	struct sync_file_info info;
	391	struct sync_fence_info *fence_info = NULL;
a02b9dc9	392	struct fence **fences;
d4cab38e	393	__u32 size;
a02b9dc9	394	int num_fences, ret, i;
d4cab38e GP	395
	396	if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
	397	return -EFAULT;
	398
	399	if (info.flags \|\| info.pad)
	400	return -EINVAL;
	401
a02b9dc9 GP	402	fences = get_fences(sync_file, &num_fences);
a02b9dc9 GP	403
d4cab38e GP	404	/*
	405	* Passing num_fences = 0 means that userspace doesn't want to
	406	* retrieve any sync_fence_info. If num_fences = 0 we skip filling
	407	* sync_fence_info and return the actual number of fences on
	408	* info->num_fences.
	409	*/
	410	if (!info.num_fences)
	411	goto no_fences;
	412
a02b9dc9	413	if (info.num_fences < num_fences)
d4cab38e GP	414	return -EINVAL;
d4cab38e GP	415
a02b9dc9	416	size = num_fences * sizeof(*fence_info);
d4cab38e GP	417	fence_info = kzalloc(size, GFP_KERNEL);
	418	if (!fence_info)
	419	return -ENOMEM;
	420
a02b9dc9 GP	421	for (i = 0; i < num_fences; i++)
a02b9dc9 GP	422	sync_fill_fence_info(fences[i], &fence_info[i]);
d4cab38e GP	423
	424	if (copy_to_user(u64_to_user_ptr(info.sync_fence_info), fence_info,
	425	size)) {
	426	ret = -EFAULT;
	427	goto out;
	428	}
	429
	430	no_fences:
	431	strlcpy(info.name, sync_file->name, sizeof(info.name));
a02b9dc9 GP	432	info.status = fence_is_signaled(sync_file->fence);
a02b9dc9 GP	433	info.num_fences = num_fences;
d4cab38e GP	434
	435	if (copy_to_user((void __user *)arg, &info, sizeof(info)))
	436	ret = -EFAULT;
	437	else
	438	ret = 0;
	439
	440	out:
	441	kfree(fence_info);
	442
	443	return ret;
	444	}
	445
	446	static long sync_file_ioctl(struct file *file, unsigned int cmd,
92e06213	447	unsigned long arg)
d4cab38e GP	448	{
	449	struct sync_file *sync_file = file->private_data;
	450
	451	switch (cmd) {
	452	case SYNC_IOC_MERGE:
	453	return sync_file_ioctl_merge(sync_file, arg);
	454
	455	case SYNC_IOC_FILE_INFO:
	456	return sync_file_ioctl_fence_info(sync_file, arg);
	457
	458	default:
	459	return -ENOTTY;
	460	}
	461	}
	462
	463	static const struct file_operations sync_file_fops = {
	464	.release = sync_file_release,
	465	.poll = sync_file_poll,
	466	.unlocked_ioctl = sync_file_ioctl,
	467	.compat_ioctl = sync_file_ioctl,
	468	};
	469