1/*
2 * Copyright (C) 2013 Google, Inc.
3 *
4 * This software is licensed under the terms of the GNU General Public
5 * License version 2, as published by the Free Software Foundation, and
6 * may be copied, distributed, and modified under those terms.
7 *
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
11 * GNU General Public License for more details.
12 *
13 */
14
15#include <linux/bitops.h>
16#include <linux/circ_buf.h>
17#include <linux/fs.h>
18#include <linux/module.h>
19#include <linux/poll.h>
20#include <linux/slab.h>
21#include <linux/uaccess.h>
22
23#include <video/adf_client.h>
24#include <video/adf_format.h>
25
26#include "sw_sync.h"
27#include "sync.h"
28
29#include "adf.h"
30#include "adf_fops.h"
31#include "adf_sysfs.h"
32
33#ifdef CONFIG_COMPAT
34#include "adf_fops32.h"
35#endif
36
37static int adf_obj_set_event(struct adf_obj *obj, struct adf_file *file,
38		struct adf_set_event __user *arg)
39{
40	struct adf_set_event data;
41	bool enabled;
42	unsigned long flags;
43	int err;
44
45	if (copy_from_user(&data, arg, sizeof(data)))
46		return -EFAULT;
47
48	err = adf_obj_check_supports_event(obj, data.type);
49	if (err < 0)
50		return err;
51
52	spin_lock_irqsave(&obj->file_lock, flags);
53	if (data.enabled)
54		enabled = test_and_set_bit(data.type,
55				file->event_subscriptions);
56	else
57		enabled = test_and_clear_bit(data.type,
58				file->event_subscriptions);
59	spin_unlock_irqrestore(&obj->file_lock, flags);
60
61	if (data.enabled == enabled)
62		return -EALREADY;
63
64	if (data.enabled)
65		adf_event_get(obj, data.type);
66	else
67		adf_event_put(obj, data.type);
68
69	return 0;
70}
71
72static int adf_obj_copy_custom_data_to_user(struct adf_obj *obj,
73		void __user *dst, size_t *dst_size)
74{
75	void *custom_data;
76	size_t custom_data_size;
77	int ret;
78
79	if (!obj->ops || !obj->ops->custom_data) {
80		dev_dbg(&obj->dev, "%s: no custom_data op\n", __func__);
81		return 0;
82	}
83
84	custom_data = kzalloc(ADF_MAX_CUSTOM_DATA_SIZE, GFP_KERNEL);
85	if (!custom_data)
86		return -ENOMEM;
87
88	ret = obj->ops->custom_data(obj, custom_data, &custom_data_size);
89	if (ret < 0)
90		goto done;
91
92	if (copy_to_user(dst, custom_data, min(*dst_size, custom_data_size))) {
93		ret = -EFAULT;
94		goto done;
95	}
96	*dst_size = custom_data_size;
97
98done:
99	kfree(custom_data);
100	return ret;
101}
102
103static int adf_eng_get_data(struct adf_overlay_engine *eng,
104		struct adf_overlay_engine_data __user *arg)
105{
106	struct adf_device *dev = adf_overlay_engine_parent(eng);
107	struct adf_overlay_engine_data data;
108	size_t n_supported_formats;
109	u32 *supported_formats = NULL;
110	int ret = 0;
111
112	if (copy_from_user(&data, arg, sizeof(data)))
113		return -EFAULT;
114
115	strlcpy(data.name, eng->base.name, sizeof(data.name));
116
117	if (data.n_supported_formats > ADF_MAX_SUPPORTED_FORMATS)
118		return -EINVAL;
119
120	n_supported_formats = data.n_supported_formats;
121	data.n_supported_formats = eng->ops->n_supported_formats;
122
123	if (n_supported_formats) {
124		supported_formats = kzalloc(n_supported_formats *
125				sizeof(supported_formats[0]), GFP_KERNEL);
126		if (!supported_formats)
127			return -ENOMEM;
128	}
129
130	memcpy(supported_formats, eng->ops->supported_formats,
131			sizeof(u32) * min(n_supported_formats,
132					eng->ops->n_supported_formats));
133
134	mutex_lock(&dev->client_lock);
135	ret = adf_obj_copy_custom_data_to_user(&eng->base, arg->custom_data,
136			&data.custom_data_size);
137	mutex_unlock(&dev->client_lock);
138
139	if (ret < 0)
140		goto done;
141
142	if (copy_to_user(arg, &data, sizeof(data))) {
143		ret = -EFAULT;
144		goto done;
145	}
146
147	if (supported_formats && copy_to_user(arg->supported_formats,
148			supported_formats,
149			n_supported_formats * sizeof(supported_formats[0])))
150		ret = -EFAULT;
151
152done:
153	kfree(supported_formats);
154	return ret;
155}
156
157static int adf_buffer_import(struct adf_device *dev,
158		struct adf_buffer_config __user *cfg, struct adf_buffer *buf)
159{
160	struct adf_buffer_config user_buf;
161	size_t i;
162	int ret = 0;
163
164	if (copy_from_user(&user_buf, cfg, sizeof(user_buf)))
165		return -EFAULT;
166
167	memset(buf, 0, sizeof(*buf));
168
169	if (user_buf.n_planes > ADF_MAX_PLANES) {
170		dev_err(&dev->base.dev, "invalid plane count %u\n",
171				user_buf.n_planes);
172		return -EINVAL;
173	}
174
175	buf->overlay_engine = idr_find(&dev->overlay_engines,
176			user_buf.overlay_engine);
177	if (!buf->overlay_engine) {
178		dev_err(&dev->base.dev, "invalid overlay engine id %u\n",
179				user_buf.overlay_engine);
180		return -ENOENT;
181	}
182
183	buf->w = user_buf.w;
184	buf->h = user_buf.h;
185	buf->format = user_buf.format;
186	for (i = 0; i < user_buf.n_planes; i++) {
187		buf->dma_bufs[i] = dma_buf_get(user_buf.fd[i]);
188		if (IS_ERR(buf->dma_bufs[i])) {
189			ret = PTR_ERR(buf->dma_bufs[i]);
190			dev_err(&dev->base.dev, "importing dma_buf fd %d failed: %d\n",
191					user_buf.fd[i], ret);
192			buf->dma_bufs[i] = NULL;
193			goto done;
194		}
195		buf->offset[i] = user_buf.offset[i];
196		buf->pitch[i] = user_buf.pitch[i];
197	}
198	buf->n_planes = user_buf.n_planes;
199
200	if (user_buf.acquire_fence >= 0) {
201		buf->acquire_fence = sync_fence_fdget(user_buf.acquire_fence);
202		if (!buf->acquire_fence) {
203			dev_err(&dev->base.dev, "getting fence fd %d failed\n",
204					user_buf.acquire_fence);
205			ret = -EINVAL;
206			goto done;
207		}
208	}
209
210done:
211	if (ret < 0)
212		adf_buffer_cleanup(buf);
213	return ret;
214}
215
216static int adf_device_post_config(struct adf_device *dev,
217		struct adf_post_config __user *arg)
218{
219	struct sync_fence *complete_fence;
220	int complete_fence_fd;
221	struct adf_buffer *bufs = NULL;
222	struct adf_interface **intfs = NULL;
223	size_t n_intfs, n_bufs, i;
224	void *custom_data = NULL;
225	size_t custom_data_size;
226	int ret = 0;
227
228	complete_fence_fd = get_unused_fd();
229	if (complete_fence_fd < 0)
230		return complete_fence_fd;
231
232	if (get_user(n_intfs, &arg->n_interfaces)) {
233		ret = -EFAULT;
234		goto err_get_user;
235	}
236
237	if (n_intfs > ADF_MAX_INTERFACES) {
238		ret = -EINVAL;
239		goto err_get_user;
240	}
241
242	if (get_user(n_bufs, &arg->n_bufs)) {
243		ret = -EFAULT;
244		goto err_get_user;
245	}
246
247	if (n_bufs > ADF_MAX_BUFFERS) {
248		ret = -EINVAL;
249		goto err_get_user;
250	}
251
252	if (get_user(custom_data_size, &arg->custom_data_size)) {
253		ret = -EFAULT;
254		goto err_get_user;
255	}
256
257	if (custom_data_size > ADF_MAX_CUSTOM_DATA_SIZE) {
258		ret = -EINVAL;
259		goto err_get_user;
260	}
261
262	if (n_intfs) {
263		intfs = kmalloc(sizeof(intfs[0]) * n_intfs, GFP_KERNEL);
264		if (!intfs) {
265			ret = -ENOMEM;
266			goto err_get_user;
267		}
268	}
269
270	for (i = 0; i < n_intfs; i++) {
271		u32 intf_id;
272		if (get_user(intf_id, &arg->interfaces[i])) {
273			ret = -EFAULT;
274			goto err_get_user;
275		}
276
277		intfs[i] = idr_find(&dev->interfaces, intf_id);
278		if (!intfs[i]) {
279			ret = -EINVAL;
280			goto err_get_user;
281		}
282	}
283
284	if (n_bufs) {
285		bufs = kzalloc(sizeof(bufs[0]) * n_bufs, GFP_KERNEL);
286		if (!bufs) {
287			ret = -ENOMEM;
288			goto err_get_user;
289		}
290	}
291
292	for (i = 0; i < n_bufs; i++) {
293		ret = adf_buffer_import(dev, &arg->bufs[i], &bufs[i]);
294		if (ret < 0) {
295			memset(&bufs[i], 0, sizeof(bufs[i]));
296			goto err_import;
297		}
298	}
299
300	if (custom_data_size) {
301		custom_data = kzalloc(custom_data_size, GFP_KERNEL);
302		if (!custom_data) {
303			ret = -ENOMEM;
304			goto err_import;
305		}
306
307		if (copy_from_user(custom_data, arg->custom_data,
308				custom_data_size)) {
309			ret = -EFAULT;
310			goto err_import;
311		}
312	}
313
314	if (put_user(complete_fence_fd, &arg->complete_fence)) {
315		ret = -EFAULT;
316		goto err_import;
317	}
318
319	complete_fence = adf_device_post_nocopy(dev, intfs, n_intfs, bufs,
320			n_bufs, custom_data, custom_data_size);
321	if (IS_ERR(complete_fence)) {
322		ret = PTR_ERR(complete_fence);
323		goto err_import;
324	}
325
326	sync_fence_install(complete_fence, complete_fence_fd);
327	return 0;
328
329err_import:
330	for (i = 0; i < n_bufs; i++)
331		adf_buffer_cleanup(&bufs[i]);
332
333err_get_user:
334	kfree(custom_data);
335	kfree(bufs);
336	kfree(intfs);
337	put_unused_fd(complete_fence_fd);
338	return ret;
339}
340
341static int adf_intf_simple_post_config(struct adf_interface *intf,
342		struct adf_simple_post_config __user *arg)
343{
344	struct adf_device *dev = intf->base.parent;
345	struct sync_fence *complete_fence;
346	int complete_fence_fd;
347	struct adf_buffer buf;
348	int ret = 0;
349
350	complete_fence_fd = get_unused_fd();
351	if (complete_fence_fd < 0)
352		return complete_fence_fd;
353
354	ret = adf_buffer_import(dev, &arg->buf, &buf);
355	if (ret < 0)
356		goto err_import;
357
358	if (put_user(complete_fence_fd, &arg->complete_fence)) {
359		ret = -EFAULT;
360		goto err_put_user;
361	}
362
363	complete_fence = adf_interface_simple_post(intf, &buf);
364	if (IS_ERR(complete_fence)) {
365		ret = PTR_ERR(complete_fence);
366		goto err_put_user;
367	}
368
369	sync_fence_install(complete_fence, complete_fence_fd);
370	return 0;
371
372err_put_user:
373	adf_buffer_cleanup(&buf);
374err_import:
375	put_unused_fd(complete_fence_fd);
376	return ret;
377}
378
379static int adf_intf_simple_buffer_alloc(struct adf_interface *intf,
380		struct adf_simple_buffer_alloc __user *arg)
381{
382	struct adf_simple_buffer_alloc data;
383	struct dma_buf *dma_buf;
384	int ret = 0;
385
386	if (copy_from_user(&data, arg, sizeof(data)))
387		return -EFAULT;
388
389	data.fd = get_unused_fd_flags(O_CLOEXEC);
390	if (data.fd < 0)
391		return data.fd;
392
393	ret = adf_interface_simple_buffer_alloc(intf, data.w, data.h,
394			data.format, &dma_buf, &data.offset, &data.pitch);
395	if (ret < 0)
396		goto err_alloc;
397
398	if (copy_to_user(arg, &data, sizeof(*arg))) {
399		ret = -EFAULT;
400		goto err_copy;
401	}
402
403	fd_install(data.fd, dma_buf->file);
404	return 0;
405
406err_copy:
407	dma_buf_put(dma_buf);
408
409err_alloc:
410	put_unused_fd(data.fd);
411	return ret;
412}
413
414static int adf_copy_attachment_list_to_user(
415		struct adf_attachment_config __user *to, size_t n_to,
416		struct adf_attachment *from, size_t n_from)
417{
418	struct adf_attachment_config *temp;
419	size_t n = min(n_to, n_from);
420	size_t i;
421	int ret = 0;
422
423	if (!n)
424		return 0;
425
426	temp = kzalloc(n * sizeof(temp[0]), GFP_KERNEL);
427	if (!temp)
428		return -ENOMEM;
429
430	for (i = 0; i < n; i++) {
431		temp[i].interface = from[i].interface->base.id;
432		temp[i].overlay_engine = from[i].overlay_engine->base.id;
433	}
434
435	if (copy_to_user(to, temp, n * sizeof(to[0]))) {
436		ret = -EFAULT;
437		goto done;
438	}
439
440done:
441	kfree(temp);
442	return ret;
443}
444
445static int adf_device_get_data(struct adf_device *dev,
446		struct adf_device_data __user *arg)
447{
448	struct adf_device_data data;
449	size_t n_attach;
450	struct adf_attachment *attach = NULL;
451	size_t n_allowed_attach;
452	struct adf_attachment *allowed_attach = NULL;
453	int ret = 0;
454
455	if (copy_from_user(&data, arg, sizeof(data)))
456		return -EFAULT;
457
458	if (data.n_attachments > ADF_MAX_ATTACHMENTS ||
459			data.n_allowed_attachments > ADF_MAX_ATTACHMENTS)
460		return -EINVAL;
461
462	strlcpy(data.name, dev->base.name, sizeof(data.name));
463
464	if (data.n_attachments) {
465		attach = kzalloc(data.n_attachments * sizeof(attach[0]),
466				GFP_KERNEL);
467		if (!attach)
468			return -ENOMEM;
469	}
470	n_attach = adf_device_attachments(dev, attach, data.n_attachments);
471
472	if (data.n_allowed_attachments) {
473		allowed_attach = kzalloc(data.n_allowed_attachments *
474				sizeof(allowed_attach[0]), GFP_KERNEL);
475		if (!allowed_attach) {
476			ret = -ENOMEM;
477			goto done;
478		}
479	}
480	n_allowed_attach = adf_device_attachments_allowed(dev, allowed_attach,
481			data.n_allowed_attachments);
482
483	mutex_lock(&dev->client_lock);
484	ret = adf_obj_copy_custom_data_to_user(&dev->base, arg->custom_data,
485			&data.custom_data_size);
486	mutex_unlock(&dev->client_lock);
487
488	if (ret < 0)
489		goto done;
490
491	ret = adf_copy_attachment_list_to_user(arg->attachments,
492			data.n_attachments, attach, n_attach);
493	if (ret < 0)
494		goto done;
495
496	ret = adf_copy_attachment_list_to_user(arg->allowed_attachments,
497			data.n_allowed_attachments, allowed_attach,
498			n_allowed_attach);
499	if (ret < 0)
500		goto done;
501
502	data.n_attachments = n_attach;
503	data.n_allowed_attachments = n_allowed_attach;
504
505	if (copy_to_user(arg, &data, sizeof(data)))
506		ret = -EFAULT;
507
508done:
509	kfree(allowed_attach);
510	kfree(attach);
511	return ret;
512}
513
514static int adf_device_handle_attachment(struct adf_device *dev,
515		struct adf_attachment_config __user *arg, bool attach)
516{
517	struct adf_attachment_config data;
518	struct adf_overlay_engine *eng;
519	struct adf_interface *intf;
520
521	if (copy_from_user(&data, arg, sizeof(data)))
522		return -EFAULT;
523
524	eng = idr_find(&dev->overlay_engines, data.overlay_engine);
525	if (!eng) {
526		dev_err(&dev->base.dev, "invalid overlay engine id %u\n",
527				data.overlay_engine);
528		return -EINVAL;
529	}
530
531	intf = idr_find(&dev->interfaces, data.interface);
532	if (!intf) {
533		dev_err(&dev->base.dev, "invalid interface id %u\n",
534				data.interface);
535		return -EINVAL;
536	}
537
538	if (attach)
539		return adf_device_attach(dev, eng, intf);
540	else
541		return adf_device_detach(dev, eng, intf);
542}
543
544static int adf_intf_set_mode(struct adf_interface *intf,
545		struct drm_mode_modeinfo __user *arg)
546{
547	struct drm_mode_modeinfo mode;
548
549	if (copy_from_user(&mode, arg, sizeof(mode)))
550		return -EFAULT;
551
552	return adf_interface_set_mode(intf, &mode);
553}
554
555static int adf_intf_get_data(struct adf_interface *intf,
556		struct adf_interface_data __user *arg)
557{
558	struct adf_device *dev = adf_interface_parent(intf);
559	struct adf_interface_data data;
560	struct drm_mode_modeinfo *modelist;
561	size_t modelist_size;
562	int err;
563	int ret = 0;
564	unsigned long flags;
565
566	if (copy_from_user(&data, arg, sizeof(data)))
567		return -EFAULT;
568
569	strlcpy(data.name, intf->base.name, sizeof(data.name));
570
571	data.type = intf->type;
572	data.id = intf->idx;
573	data.flags = intf->flags;
574
575	err = adf_interface_get_screen_size(intf, &data.width_mm,
576			&data.height_mm);
577	if (err < 0) {
578		data.width_mm = 0;
579		data.height_mm = 0;
580	}
581
582	modelist = kmalloc(sizeof(modelist[0]) * ADF_MAX_MODES, GFP_KERNEL);
583	if (!modelist)
584		return -ENOMEM;
585
586	mutex_lock(&dev->client_lock);
587	read_lock_irqsave(&intf->hotplug_modelist_lock, flags);
588	data.hotplug_detect = intf->hotplug_detect;
589	modelist_size = min(data.n_available_modes, intf->n_modes) *
590			sizeof(intf->modelist[0]);
591	memcpy(modelist, intf->modelist, modelist_size);
592	data.n_available_modes = intf->n_modes;
593	read_unlock_irqrestore(&intf->hotplug_modelist_lock, flags);
594
595	if (copy_to_user(arg->available_modes, modelist, modelist_size)) {
596		ret = -EFAULT;
597		goto done;
598	}
599
600	data.dpms_state = intf->dpms_state;
601	memcpy(&data.current_mode, &intf->current_mode,
602			sizeof(intf->current_mode));
603
604	ret = adf_obj_copy_custom_data_to_user(&intf->base, arg->custom_data,
605			&data.custom_data_size);
606done:
607	mutex_unlock(&dev->client_lock);
608	kfree(modelist);
609
610	if (ret < 0)
611		return ret;
612
613	if (copy_to_user(arg, &data, sizeof(data)))
614		ret = -EFAULT;
615
616	return ret;
617}
618
619static inline long adf_obj_custom_ioctl(struct adf_obj *obj, unsigned int cmd,
620		unsigned long arg)
621{
622	if (obj->ops && obj->ops->ioctl)
623		return obj->ops->ioctl(obj, cmd, arg);
624	return -ENOTTY;
625}
626
627static long adf_overlay_engine_ioctl(struct adf_overlay_engine *eng,
628		struct adf_file *file, unsigned int cmd, unsigned long arg)
629{
630	switch (cmd) {
631	case ADF_SET_EVENT:
632		return adf_obj_set_event(&eng->base, file,
633				(struct adf_set_event __user *)arg);
634
635	case ADF_GET_OVERLAY_ENGINE_DATA:
636		return adf_eng_get_data(eng,
637			(struct adf_overlay_engine_data __user *)arg);
638
639	case ADF_BLANK:
640	case ADF_POST_CONFIG:
641	case ADF_SET_MODE:
642	case ADF_GET_DEVICE_DATA:
643	case ADF_GET_INTERFACE_DATA:
644	case ADF_SIMPLE_POST_CONFIG:
645	case ADF_SIMPLE_BUFFER_ALLOC:
646	case ADF_ATTACH:
647	case ADF_DETACH:
648		return -EINVAL;
649
650	default:
651		return adf_obj_custom_ioctl(&eng->base, cmd, arg);
652	}
653}
654
655static long adf_interface_ioctl(struct adf_interface *intf,
656		struct adf_file *file, unsigned int cmd, unsigned long arg)
657{
658	switch (cmd) {
659	case ADF_SET_EVENT:
660		return adf_obj_set_event(&intf->base, file,
661				(struct adf_set_event __user *)arg);
662
663	case ADF_BLANK:
664		return adf_interface_blank(intf, arg);
665
666	case ADF_SET_MODE:
667		return adf_intf_set_mode(intf,
668				(struct drm_mode_modeinfo __user *)arg);
669
670	case ADF_GET_INTERFACE_DATA:
671		return adf_intf_get_data(intf,
672				(struct adf_interface_data __user *)arg);
673
674	case ADF_SIMPLE_POST_CONFIG:
675		return adf_intf_simple_post_config(intf,
676				(struct adf_simple_post_config __user *)arg);
677
678	case ADF_SIMPLE_BUFFER_ALLOC:
679		return adf_intf_simple_buffer_alloc(intf,
680				(struct adf_simple_buffer_alloc __user *)arg);
681
682	case ADF_POST_CONFIG:
683	case ADF_GET_DEVICE_DATA:
684	case ADF_GET_OVERLAY_ENGINE_DATA:
685	case ADF_ATTACH:
686	case ADF_DETACH:
687		return -EINVAL;
688
689	default:
690		return adf_obj_custom_ioctl(&intf->base, cmd, arg);
691	}
692}
693
694static long adf_device_ioctl(struct adf_device *dev, struct adf_file *file,
695		unsigned int cmd, unsigned long arg)
696{
697	switch (cmd) {
698	case ADF_SET_EVENT:
699		return adf_obj_set_event(&dev->base, file,
700				(struct adf_set_event __user *)arg);
701
702	case ADF_POST_CONFIG:
703		return adf_device_post_config(dev,
704				(struct adf_post_config __user *)arg);
705
706	case ADF_GET_DEVICE_DATA:
707		return adf_device_get_data(dev,
708				(struct adf_device_data __user *)arg);
709
710	case ADF_ATTACH:
711		return adf_device_handle_attachment(dev,
712				(struct adf_attachment_config __user *)arg,
713				true);
714
715	case ADF_DETACH:
716		return adf_device_handle_attachment(dev,
717				(struct adf_attachment_config __user *)arg,
718				false);
719
720	case ADF_BLANK:
721	case ADF_SET_MODE:
722	case ADF_GET_INTERFACE_DATA:
723	case ADF_GET_OVERLAY_ENGINE_DATA:
724	case ADF_SIMPLE_POST_CONFIG:
725	case ADF_SIMPLE_BUFFER_ALLOC:
726		return -EINVAL;
727
728	default:
729		return adf_obj_custom_ioctl(&dev->base, cmd, arg);
730	}
731}
732
733static int adf_file_open(struct inode *inode, struct file *file)
734{
735	struct adf_obj *obj;
736	struct adf_file *fpriv = NULL;
737	unsigned long flags;
738	int ret = 0;
739
740	obj = adf_obj_sysfs_find(iminor(inode));
741	if (!obj)
742		return -ENODEV;
743
744	dev_dbg(&obj->dev, "opening %s\n", dev_name(&obj->dev));
745
746	if (!try_module_get(obj->parent->ops->owner)) {
747		dev_err(&obj->dev, "getting owner module failed\n");
748		return -ENODEV;
749	}
750
751	fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
752	if (!fpriv) {
753		ret = -ENOMEM;
754		goto done;
755	}
756
757	INIT_LIST_HEAD(&fpriv->head);
758	fpriv->obj = obj;
759	init_waitqueue_head(&fpriv->event_wait);
760
761	file->private_data = fpriv;
762
763	if (obj->ops && obj->ops->open) {
764		ret = obj->ops->open(obj, inode, file);
765		if (ret < 0)
766			goto done;
767	}
768
769	spin_lock_irqsave(&obj->file_lock, flags);
770	list_add_tail(&fpriv->head, &obj->file_list);
771	spin_unlock_irqrestore(&obj->file_lock, flags);
772
773done:
774	if (ret < 0) {
775		kfree(fpriv);
776		module_put(obj->parent->ops->owner);
777	}
778	return ret;
779}
780
781static int adf_file_release(struct inode *inode, struct file *file)
782{
783	struct adf_file *fpriv = file->private_data;
784	struct adf_obj *obj = fpriv->obj;
785	enum adf_event_type event_type;
786	unsigned long flags;
787
788	if (obj->ops && obj->ops->release)
789		obj->ops->release(obj, inode, file);
790
791	spin_lock_irqsave(&obj->file_lock, flags);
792	list_del(&fpriv->head);
793	spin_unlock_irqrestore(&obj->file_lock, flags);
794
795	for_each_set_bit(event_type, fpriv->event_subscriptions,
796			ADF_EVENT_TYPE_MAX) {
797		adf_event_put(obj, event_type);
798	}
799
800	kfree(fpriv);
801	module_put(obj->parent->ops->owner);
802
803	dev_dbg(&obj->dev, "released %s\n", dev_name(&obj->dev));
804	return 0;
805}
806
807long adf_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
808{
809	struct adf_file *fpriv = file->private_data;
810	struct adf_obj *obj = fpriv->obj;
811	long ret = -EINVAL;
812
813	dev_dbg(&obj->dev, "%s ioctl %u\n", dev_name(&obj->dev), _IOC_NR(cmd));
814
815	switch (obj->type) {
816	case ADF_OBJ_OVERLAY_ENGINE:
817		ret = adf_overlay_engine_ioctl(adf_obj_to_overlay_engine(obj),
818				fpriv, cmd, arg);
819		break;
820
821	case ADF_OBJ_INTERFACE:
822		ret = adf_interface_ioctl(adf_obj_to_interface(obj), fpriv, cmd,
823				arg);
824		break;
825
826	case ADF_OBJ_DEVICE:
827		ret = adf_device_ioctl(adf_obj_to_device(obj), fpriv, cmd, arg);
828		break;
829	}
830
831	return ret;
832}
833
834static inline bool adf_file_event_available(struct adf_file *fpriv)
835{
836	int head = fpriv->event_head;
837	int tail = fpriv->event_tail;
838	return CIRC_CNT(head, tail, sizeof(fpriv->event_buf)) != 0;
839}
840
841void adf_file_queue_event(struct adf_file *fpriv, struct adf_event *event)
842{
843	int head = fpriv->event_head;
844	int tail = fpriv->event_tail;
845	size_t space = CIRC_SPACE(head, tail, sizeof(fpriv->event_buf));
846	size_t space_to_end =
847			CIRC_SPACE_TO_END(head, tail, sizeof(fpriv->event_buf));
848
849	if (space < event->length) {
850		dev_dbg(&fpriv->obj->dev,
851				"insufficient buffer space for event %u\n",
852				event->type);
853		return;
854	}
855
856	if (space_to_end >= event->length) {
857		memcpy(fpriv->event_buf + head, event, event->length);
858	} else {
859		memcpy(fpriv->event_buf + head, event, space_to_end);
860		memcpy(fpriv->event_buf, (u8 *)event + space_to_end,
861				event->length - space_to_end);
862	}
863
864	smp_wmb();
865	fpriv->event_head = (fpriv->event_head + event->length) &
866			(sizeof(fpriv->event_buf) - 1);
867	wake_up_interruptible_all(&fpriv->event_wait);
868}
869
870static ssize_t adf_file_copy_to_user(struct adf_file *fpriv,
871		char __user *buffer, size_t buffer_size)
872{
873	int head, tail;
874	u8 *event_buf;
875	size_t cnt, cnt_to_end, copy_size = 0;
876	ssize_t ret = 0;
877	unsigned long flags;
878
879	event_buf = kmalloc(min(buffer_size, sizeof(fpriv->event_buf)),
880			GFP_KERNEL);
881	if (!event_buf)
882		return -ENOMEM;
883
884	spin_lock_irqsave(&fpriv->obj->file_lock, flags);
885
886	if (!adf_file_event_available(fpriv))
887		goto out;
888
889	head = fpriv->event_head;
890	tail = fpriv->event_tail;
891
892	cnt = CIRC_CNT(head, tail, sizeof(fpriv->event_buf));
893	cnt_to_end = CIRC_CNT_TO_END(head, tail, sizeof(fpriv->event_buf));
894	copy_size = min(buffer_size, cnt);
895
896	if (cnt_to_end >= copy_size) {
897		memcpy(event_buf, fpriv->event_buf + tail, copy_size);
898	} else {
899		memcpy(event_buf, fpriv->event_buf + tail, cnt_to_end);
900		memcpy(event_buf + cnt_to_end, fpriv->event_buf,
901				copy_size - cnt_to_end);
902	}
903
904	fpriv->event_tail = (fpriv->event_tail + copy_size) &
905			(sizeof(fpriv->event_buf) - 1);
906
907out:
908	spin_unlock_irqrestore(&fpriv->obj->file_lock, flags);
909	if (copy_size) {
910		if (copy_to_user(buffer, event_buf, copy_size))
911			ret = -EFAULT;
912		else
913			ret = copy_size;
914	}
915	kfree(event_buf);
916	return ret;
917}
918
919ssize_t adf_file_read(struct file *filp, char __user *buffer,
920		 size_t count, loff_t *offset)
921{
922	struct adf_file *fpriv = filp->private_data;
923	int err;
924
925	err = wait_event_interruptible(fpriv->event_wait,
926			adf_file_event_available(fpriv));
927	if (err < 0)
928		return err;
929
930	return adf_file_copy_to_user(fpriv, buffer, count);
931}
932
933unsigned int adf_file_poll(struct file *filp, struct poll_table_struct *wait)
934{
935	struct adf_file *fpriv = filp->private_data;
936	unsigned int mask = 0;
937
938	poll_wait(filp, &fpriv->event_wait, wait);
939
940	if (adf_file_event_available(fpriv))
941		mask |= POLLIN | POLLRDNORM;
942
943	return mask;
944}
945
946const struct file_operations adf_fops = {
947	.owner = THIS_MODULE,
948	.unlocked_ioctl = adf_file_ioctl,
949#ifdef CONFIG_COMPAT
950	.compat_ioctl = adf_file_compat_ioctl,
951#endif
952	.open = adf_file_open,
953	.release = adf_file_release,
954	.llseek = default_llseek,
955	.read = adf_file_read,
956	.poll = adf_file_poll,
957};
958