36  * Their primary use-case is to implement Vulkan fences and semaphores.
39  *  - Creation and destruction of syncobjs
40  *  - Import and export of syncobjs to/from a syncobj file descriptor
41  *  - Import and export a syncobj's underlying fence to/from a sync file
42  *  - Reset a syncobj (set its fence to NULL)
43  *  - Signal a syncobj (set a trivially signaled fence)
44  *  - Wait for a syncobj's fence to appear and be signaled
50  *   - Signal a given point on the timeline
51  *   - Wait for a given point to appear and/or be signaled
52  *   - Import and export from/to a given point of a timeline
77  *    - The syncobj's current fence if the syncobj is considered as a binary
79  *    - The struct &dma_fence associated with a given point if the syncobj is
87  * regardless of whether that operation is an immediate host-side operation
107  * Host-side wait on syncobjs
108  * --------------------------
111  * host-side wait on all of the syncobj fences simultaneously.
119  * the host-side wait will first wait for the syncobj to receive a non-NULL
122  * syncobjs in the array has a NULL fence, -EINVAL will be returned.
135  * handles as well as an array of u64 points and does a host-side wait on all
141  * requirement is inherited from the wait-before-signal behavior required by
150  * -------------------------
160  * result of importing those file descriptors own a reference to the
163  * The syncobj is freed only once the last reference is dropped.
164  * Unlike dma-buf, importing a syncobj creates a new handle (with its own
165  * reference) for every import instead of de-duplicating.
166  * The primary use-case of this persistent import/export is for shared
173  * When a syncobj is exported to a sync file, that sync file wraps the
175  * operations on the syncobj will not affect the exported sync file.
176  * When a sync file is imported into a syncobj, the syncobj's fence is set
177  * to the fence wrapped by that sync file.
178  * Because sync files are immutable, resetting or signaling the syncobj
179  * will not affect any sync files whose fences have been imported into the
184  * -----------------------------------------------------
196 #include <linux/dma-fence-unwrap.h>
241  * drm_syncobj_find - lookup and reference a sync object.
243  * @handle: sync object handle to lookup.
245  * Returns a reference to the syncobj pointed to by handle or NULL. The
246  * reference must be released by calling drm_syncobj_put().
253 	xa_lock(&file_private->syncobj_xa);  in drm_syncobj_find()
255 	/* Check if we currently have a reference on the object */  in drm_syncobj_find()
256 	syncobj = xa_load(&file_private->syncobj_xa, handle);  in drm_syncobj_find()
260 	xa_unlock(&file_private->syncobj_xa);  in drm_syncobj_find()
271 	if (wait->fence)  in drm_syncobj_fence_add_wait()
274 	spin_lock(&syncobj->lock);  in drm_syncobj_fence_add_wait()
279 	fence = dma_fence_get(rcu_dereference_protected(syncobj->fence, 1));  in drm_syncobj_fence_add_wait()
280 	if (!fence || dma_fence_chain_find_seqno(&fence, wait->point)) {  in drm_syncobj_fence_add_wait()
282 		list_add_tail(&wait->node, &syncobj->cb_list);  in drm_syncobj_fence_add_wait()
284 		wait->fence = dma_fence_get_stub();  in drm_syncobj_fence_add_wait()
286 		wait->fence = fence;  in drm_syncobj_fence_add_wait()
288 	spin_unlock(&syncobj->lock);  in drm_syncobj_fence_add_wait()
294 	if (!wait->node.next)  in drm_syncobj_remove_wait()
297 	spin_lock(&syncobj->lock);  in drm_syncobj_remove_wait()
298 	list_del_init(&wait->node);  in drm_syncobj_remove_wait()
299 	spin_unlock(&syncobj->lock);  in drm_syncobj_remove_wait()
305 	eventfd_ctx_put(entry->ev_fd_ctx);  in syncobj_eventfd_entry_free()
306 	dma_fence_put(entry->fence);  in syncobj_eventfd_entry_free()
310 	list_del(&entry->node);  in syncobj_eventfd_entry_free()
318 	spin_lock(&syncobj->lock);  in drm_syncobj_add_eventfd()
319 	list_add_tail(&entry->node, &syncobj->ev_fd_list);  in drm_syncobj_add_eventfd()
321 	spin_unlock(&syncobj->lock);  in drm_syncobj_add_eventfd()
325  * drm_syncobj_add_point - add new timeline point to the syncobj
326  * @syncobj: sync object to add timeline point do
344 	spin_lock(&syncobj->lock);  in drm_syncobj_add_point()
348 	if (prev && prev->seqno >= point)  in drm_syncobj_add_point()
351 	rcu_assign_pointer(syncobj->fence, &chain->base);  in drm_syncobj_add_point()
353 	list_for_each_entry_safe(wait_cur, wait_tmp, &syncobj->cb_list, node)  in drm_syncobj_add_point()
355 	list_for_each_entry_safe(ev_fd_cur, ev_fd_tmp, &syncobj->ev_fd_list, node)  in drm_syncobj_add_point()
357 	spin_unlock(&syncobj->lock);  in drm_syncobj_add_point()
366  * drm_syncobj_replace_fence - replace fence in a sync object.
367  * @syncobj: Sync object to replace fence in
368  * @fence: fence to install in sync file.
370  * This replaces the fence on a sync object.
382 	spin_lock(&syncobj->lock);  in drm_syncobj_replace_fence()
384 	old_fence = rcu_dereference_protected(syncobj->fence,  in drm_syncobj_replace_fence()
385 					      lockdep_is_held(&syncobj->lock));  in drm_syncobj_replace_fence()
386 	rcu_assign_pointer(syncobj->fence, fence);  in drm_syncobj_replace_fence()
389 		list_for_each_entry_safe(wait_cur, wait_tmp, &syncobj->cb_list, node)  in drm_syncobj_replace_fence()
391 		list_for_each_entry_safe(ev_fd_cur, ev_fd_tmp, &syncobj->ev_fd_list, node)  in drm_syncobj_replace_fence()
395 	spin_unlock(&syncobj->lock);  in drm_syncobj_replace_fence()
402  * drm_syncobj_assign_null_handle - assign a stub fence to the sync object
403  * @syncobj: sync object to assign the fence on
405  * Assign a already signaled stub fence to the sync object.
412 		return -ENOMEM;  in drm_syncobj_assign_null_handle()
422  * drm_syncobj_find_fence - lookup and reference the fence in a sync object
424  * @handle: sync object handle to lookup.
433  * contains a reference to the fence, which must be released by calling
446 		return -EINVAL;  in drm_syncobj_find_fence()
449 		return -ENOENT;  in drm_syncobj_find_fence()
477 		ret = -EINVAL;  in drm_syncobj_find_fence()
495                         ret = -ETIME;  in drm_syncobj_find_fence()
500 			ret = -ERESTARTSYS;  in drm_syncobj_find_fence()
521  * drm_syncobj_free - free a sync object.
535 	list_for_each_entry_safe(ev_fd_cur, ev_fd_tmp, &syncobj->ev_fd_list, node)  in drm_syncobj_free()
543  * drm_syncobj_create - create a new syncobj
546  * @fence: if non-NULL, the syncobj will represent this fence
548  * This is the first function to create a sync object. After creating, drivers
562 		return -ENOMEM;  in drm_syncobj_create()
564 	kref_init(&syncobj->refcount);  in drm_syncobj_create()
565 	INIT_LIST_HEAD(&syncobj->cb_list);  in drm_syncobj_create()
566 	INIT_LIST_HEAD(&syncobj->ev_fd_list);  in drm_syncobj_create()
567 	spin_lock_init(&syncobj->lock);  in drm_syncobj_create()
586  * drm_syncobj_get_handle - get a handle from a syncobj
588  * @syncobj: Sync object to export
591  * Exports a sync object created with drm_syncobj_create() as a handle on
601 	/* take a reference to put in the xarray */  in drm_syncobj_get_handle()
604 	ret = xa_alloc(&file_private->syncobj_xa, handle, syncobj, xa_limit_32b,  in drm_syncobj_get_handle()
633 	syncobj = xa_erase(&file_private->syncobj_xa, handle);  in drm_syncobj_destroy()
635 		return -EINVAL;  in drm_syncobj_destroy()
643 	struct drm_syncobj *syncobj = file->private_data;  in drm_syncobj_file_release()
654  * drm_syncobj_get_fd - get a file descriptor from a syncobj
655  * @syncobj: Sync object to export
658  * Exports a sync object created with drm_syncobj_create() as a file descriptor.
694 		return -EINVAL;  in drm_syncobj_handle_to_fd()
709 		return -EINVAL;  in drm_syncobj_fd_to_handle()
711 	if (fd_file(f)->f_op != &drm_syncobj_file_fops)  in drm_syncobj_fd_to_handle()
712 		return -EINVAL;  in drm_syncobj_fd_to_handle()
714 	/* take a reference to put in the xarray */  in drm_syncobj_fd_to_handle()
715 	syncobj = fd_file(f)->private_data;  in drm_syncobj_fd_to_handle()
718 	ret = xa_alloc(&file_private->syncobj_xa, handle, syncobj, xa_limit_32b,  in drm_syncobj_fd_to_handle()
733 		return -EINVAL;  in drm_syncobj_import_sync_file_fence()
738 		return -ENOENT;  in drm_syncobj_import_sync_file_fence()
745 			return -ENOMEM;  in drm_syncobj_import_sync_file_fence()
777 		ret = -EINVAL;  in drm_syncobj_export_sync_file()
781 	fd_install(fd, sync_file->file);  in drm_syncobj_export_sync_file()
790  * drm_syncobj_open - initializes syncobj file-private structures at devnode open time
791  * @file_private: drm file-private structure to set up
794  * of sync objects.
799 	xa_init_flags(&file_private->syncobj_xa, XA_FLAGS_ALLOC1);  in drm_syncobj_open()
803  * drm_syncobj_release - release file-private sync object resources
804  * @file_private: drm file-private structure to clean up
816 	xa_for_each(&file_private->syncobj_xa, handle, syncobj)  in drm_syncobj_release()
818 	xa_destroy(&file_private->syncobj_xa);  in drm_syncobj_release()
828 		return -EOPNOTSUPP;  in drm_syncobj_create_ioctl()
831 	if (args->flags & ~DRM_SYNCOBJ_CREATE_SIGNALED)  in drm_syncobj_create_ioctl()
832 		return -EINVAL;  in drm_syncobj_create_ioctl()
835 					    &args->handle, args->flags);  in drm_syncobj_create_ioctl()
845 		return -EOPNOTSUPP;  in drm_syncobj_destroy_ioctl()
848 	if (args->pad)  in drm_syncobj_destroy_ioctl()
849 		return -EINVAL;  in drm_syncobj_destroy_ioctl()
850 	return drm_syncobj_destroy(file_private, args->handle);  in drm_syncobj_destroy_ioctl()
863 		return -EOPNOTSUPP;  in drm_syncobj_handle_to_fd_ioctl()
865 	if (args->pad)  in drm_syncobj_handle_to_fd_ioctl()
866 		return -EINVAL;  in drm_syncobj_handle_to_fd_ioctl()
868 	if (args->flags & ~valid_flags)  in drm_syncobj_handle_to_fd_ioctl()
869 		return -EINVAL;  in drm_syncobj_handle_to_fd_ioctl()
871 	if (args->flags & DRM_SYNCOBJ_HANDLE_TO_FD_FLAGS_TIMELINE)  in drm_syncobj_handle_to_fd_ioctl()
872 		point = args->point;  in drm_syncobj_handle_to_fd_ioctl()
874 	if (args->flags & DRM_SYNCOBJ_HANDLE_TO_FD_FLAGS_EXPORT_SYNC_FILE)  in drm_syncobj_handle_to_fd_ioctl()
875 		return drm_syncobj_export_sync_file(file_private, args->handle,  in drm_syncobj_handle_to_fd_ioctl()
876 						    point, &args->fd);  in drm_syncobj_handle_to_fd_ioctl()
878 	if (args->point)  in drm_syncobj_handle_to_fd_ioctl()
879 		return -EINVAL;  in drm_syncobj_handle_to_fd_ioctl()
881 	return drm_syncobj_handle_to_fd(file_private, args->handle,  in drm_syncobj_handle_to_fd_ioctl()
882 					&args->fd);  in drm_syncobj_handle_to_fd_ioctl()
895 		return -EOPNOTSUPP;  in drm_syncobj_fd_to_handle_ioctl()
897 	if (args->pad)  in drm_syncobj_fd_to_handle_ioctl()
898 		return -EINVAL;  in drm_syncobj_fd_to_handle_ioctl()
900 	if (args->flags & ~valid_flags)  in drm_syncobj_fd_to_handle_ioctl()
901 		return -EINVAL;  in drm_syncobj_fd_to_handle_ioctl()
903 	if (args->flags & DRM_SYNCOBJ_FD_TO_HANDLE_FLAGS_TIMELINE)  in drm_syncobj_fd_to_handle_ioctl()
904 		point = args->point;  in drm_syncobj_fd_to_handle_ioctl()
906 	if (args->flags & DRM_SYNCOBJ_FD_TO_HANDLE_FLAGS_IMPORT_SYNC_FILE)  in drm_syncobj_fd_to_handle_ioctl()
908 							  args->fd,  in drm_syncobj_fd_to_handle_ioctl()
909 							  args->handle,  in drm_syncobj_fd_to_handle_ioctl()
912 	if (args->point)  in drm_syncobj_fd_to_handle_ioctl()
913 		return -EINVAL;  in drm_syncobj_fd_to_handle_ioctl()
915 	return drm_syncobj_fd_to_handle(file_private, args->fd,  in drm_syncobj_fd_to_handle_ioctl()
916 					&args->handle);  in drm_syncobj_fd_to_handle_ioctl()
927 	timeline_syncobj = drm_syncobj_find(file_private, args->dst_handle);  in drm_syncobj_transfer_to_timeline()
929 		return -ENOENT;  in drm_syncobj_transfer_to_timeline()
931 	ret = drm_syncobj_find_fence(file_private, args->src_handle,  in drm_syncobj_transfer_to_timeline()
932 				     args->src_point, args->flags,  in drm_syncobj_transfer_to_timeline()
940 		ret = -ENOMEM;  in drm_syncobj_transfer_to_timeline()
946 		ret = -ENOMEM;  in drm_syncobj_transfer_to_timeline()
950 	drm_syncobj_add_point(timeline_syncobj, chain, fence, args->dst_point);  in drm_syncobj_transfer_to_timeline()
967 	binary_syncobj = drm_syncobj_find(file_private, args->dst_handle);  in drm_syncobj_transfer_to_binary()
969 		return -ENOENT;  in drm_syncobj_transfer_to_binary()
970 	ret = drm_syncobj_find_fence(file_private, args->src_handle,  in drm_syncobj_transfer_to_binary()
971 				     args->src_point, args->flags, &fence);  in drm_syncobj_transfer_to_binary()
989 		return -EOPNOTSUPP;  in drm_syncobj_transfer_ioctl()
991 	if (args->pad)  in drm_syncobj_transfer_ioctl()
992 		return -EINVAL;  in drm_syncobj_transfer_ioctl()
994 	if (args->dst_point)  in drm_syncobj_transfer_ioctl()
1008 	wake_up_process(wait->task);  in syncobj_wait_fence_func()
1017 	fence = rcu_dereference_protected(syncobj->fence,  in syncobj_wait_syncobj_func()
1018 					  lockdep_is_held(&syncobj->lock));  in syncobj_wait_syncobj_func()
1020 	if (!fence || dma_fence_chain_find_seqno(&fence, wait->point)) {  in syncobj_wait_syncobj_func()
1024 		wait->fence = dma_fence_get_stub();  in syncobj_wait_syncobj_func()
1026 		wait->fence = fence;  in syncobj_wait_syncobj_func()
1029 	wake_up_process(wait->task);  in syncobj_wait_syncobj_func()
1030 	list_del_init(&wait->node);  in syncobj_wait_syncobj_func()
1054 		return -ENOMEM;  in drm_syncobj_array_wait_timeout()
1061 		timeout = -EFAULT;  in drm_syncobj_array_wait_timeout()
1067 		timeout = -ENOMEM;  in drm_syncobj_array_wait_timeout()
1070 	/* Walk the list of sync objects and initialize entries.  We do  in drm_syncobj_array_wait_timeout()
1071 	 * this up-front so that we can properly return -EINVAL if there is  in drm_syncobj_array_wait_timeout()
1073 	 * returning -EINVAL again.  in drm_syncobj_array_wait_timeout()
1088 				timeout = -EINVAL;  in drm_syncobj_array_wait_timeout()
1113 	 * fence is signaled prior to fence->ops->enable_signaling() being  in drm_syncobj_array_wait_timeout()
1163 			timeout = -ETIME;  in drm_syncobj_array_wait_timeout()
1168 			timeout = -ERESTARTSYS;  in drm_syncobj_array_wait_timeout()
1195  * drm_timeout_abs_to_jiffies - calculate jiffies timeout from absolute value
1206 	/* make 0 timeout means poll - absolute 0 doesn't seem valid */  in drm_timeout_abs_to_jiffies()
1220 	if (timeout_jiffies64 >= MAX_SCHEDULE_TIMEOUT - 1)  in drm_timeout_abs_to_jiffies()
1221 		return MAX_SCHEDULE_TIMEOUT - 1;  in drm_timeout_abs_to_jiffies()
1238 		timeout = drm_timeout_abs_to_jiffies(wait->timeout_nsec);  in drm_syncobj_array_wait()
1241 							 wait->count_handles,  in drm_syncobj_array_wait()
1242 							 wait->flags,  in drm_syncobj_array_wait()
1247 		wait->first_signaled = first;  in drm_syncobj_array_wait()
1249 		timeout = drm_timeout_abs_to_jiffies(timeline_wait->timeout_nsec);  in drm_syncobj_array_wait()
1251 							 u64_to_user_ptr(timeline_wait->points),  in drm_syncobj_array_wait()
1252 							 timeline_wait->count_handles,  in drm_syncobj_array_wait()
1253 							 timeline_wait->flags,  in drm_syncobj_array_wait()
1258 		timeline_wait->first_signaled = first;  in drm_syncobj_array_wait()
1274 		return -ENOMEM;  in drm_syncobj_array_find()
1278 		ret = -EFAULT;  in drm_syncobj_array_find()
1284 		ret = -ENOMEM;  in drm_syncobj_array_find()
1291 			ret = -ENOENT;  in drm_syncobj_array_find()
1301 	while (i-- > 0)  in drm_syncobj_array_find()
1331 		return -EOPNOTSUPP;  in drm_syncobj_wait_ioctl()
1337 	if (args->flags & ~possible_flags)  in drm_syncobj_wait_ioctl()
1338 		return -EINVAL;  in drm_syncobj_wait_ioctl()
1340 	if (args->count_handles == 0)  in drm_syncobj_wait_ioctl()
1344 				     u64_to_user_ptr(args->handles),  in drm_syncobj_wait_ioctl()
1345 				     args->count_handles,  in drm_syncobj_wait_ioctl()
1350 	if (args->flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_DEADLINE) {  in drm_syncobj_wait_ioctl()
1351 		t = ns_to_ktime(args->deadline_nsec);  in drm_syncobj_wait_ioctl()
1358 	drm_syncobj_array_free(syncobjs, args->count_handles);  in drm_syncobj_wait_ioctl()
1374 		return -EOPNOTSUPP;  in drm_syncobj_timeline_wait_ioctl()
1381 	if (args->flags & ~possible_flags)  in drm_syncobj_timeline_wait_ioctl()
1382 		return -EINVAL;  in drm_syncobj_timeline_wait_ioctl()
1384 	if (args->count_handles == 0)  in drm_syncobj_timeline_wait_ioctl()
1388 				     u64_to_user_ptr(args->handles),  in drm_syncobj_timeline_wait_ioctl()
1389 				     args->count_handles,  in drm_syncobj_timeline_wait_ioctl()
1394 	if (args->flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_DEADLINE) {  in drm_syncobj_timeline_wait_ioctl()
1395 		t = ns_to_ktime(args->deadline_nsec);  in drm_syncobj_timeline_wait_ioctl()
1402 	drm_syncobj_array_free(syncobjs, args->count_handles);  in drm_syncobj_timeline_wait_ioctl()
1413 	eventfd_signal(entry->ev_fd_ctx);  in syncobj_eventfd_entry_fence_func()
1425 	fence = dma_fence_get(rcu_dereference_protected(syncobj->fence, 1));  in syncobj_eventfd_entry_func()
1429 	ret = dma_fence_chain_find_seqno(&fence, entry->point);  in syncobj_eventfd_entry_func()
1443 	list_del_init(&entry->node);  in syncobj_eventfd_entry_func()
1444 	entry->fence = fence;  in syncobj_eventfd_entry_func()
1446 	if (entry->flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE) {  in syncobj_eventfd_entry_func()
1447 		eventfd_signal(entry->ev_fd_ctx);  in syncobj_eventfd_entry_func()
1450 		ret = dma_fence_add_callback(fence, &entry->fence_cb,  in syncobj_eventfd_entry_func()
1452 		if (ret == -ENOENT) {  in syncobj_eventfd_entry_func()
1453 			eventfd_signal(entry->ev_fd_ctx);  in syncobj_eventfd_entry_func()
1470 		return -EOPNOTSUPP;  in drm_syncobj_eventfd_ioctl()
1472 	if (args->flags & ~DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)  in drm_syncobj_eventfd_ioctl()
1473 		return -EINVAL;  in drm_syncobj_eventfd_ioctl()
1475 	if (args->pad)  in drm_syncobj_eventfd_ioctl()
1476 		return -EINVAL;  in drm_syncobj_eventfd_ioctl()
1478 	syncobj = drm_syncobj_find(file_private, args->handle);  in drm_syncobj_eventfd_ioctl()
1480 		return -ENOENT;  in drm_syncobj_eventfd_ioctl()
1482 	ev_fd_ctx = eventfd_ctx_fdget(args->fd);  in drm_syncobj_eventfd_ioctl()
1490 		ret = -ENOMEM;  in drm_syncobj_eventfd_ioctl()
1493 	entry->syncobj = syncobj;  in drm_syncobj_eventfd_ioctl()
1494 	entry->ev_fd_ctx = ev_fd_ctx;  in drm_syncobj_eventfd_ioctl()
1495 	entry->point = args->point;  in drm_syncobj_eventfd_ioctl()
1496 	entry->flags = args->flags;  in drm_syncobj_eventfd_ioctl()
1520 		return -EOPNOTSUPP;  in drm_syncobj_reset_ioctl()
1522 	if (args->pad != 0)  in drm_syncobj_reset_ioctl()
1523 		return -EINVAL;  in drm_syncobj_reset_ioctl()
1525 	if (args->count_handles == 0)  in drm_syncobj_reset_ioctl()
1526 		return -EINVAL;  in drm_syncobj_reset_ioctl()
1529 				     u64_to_user_ptr(args->handles),  in drm_syncobj_reset_ioctl()
1530 				     args->count_handles,  in drm_syncobj_reset_ioctl()
1535 	for (i = 0; i < args->count_handles; i++)  in drm_syncobj_reset_ioctl()
1538 	drm_syncobj_array_free(syncobjs, args->count_handles);  in drm_syncobj_reset_ioctl()
1553 		return -EOPNOTSUPP;  in drm_syncobj_signal_ioctl()
1555 	if (args->pad != 0)  in drm_syncobj_signal_ioctl()
1556 		return -EINVAL;  in drm_syncobj_signal_ioctl()
1558 	if (args->count_handles == 0)  in drm_syncobj_signal_ioctl()
1559 		return -EINVAL;  in drm_syncobj_signal_ioctl()
1562 				     u64_to_user_ptr(args->handles),  in drm_syncobj_signal_ioctl()
1563 				     args->count_handles,  in drm_syncobj_signal_ioctl()
1568 	for (i = 0; i < args->count_handles; i++) {  in drm_syncobj_signal_ioctl()
1574 	drm_syncobj_array_free(syncobjs, args->count_handles);  in drm_syncobj_signal_ioctl()
1591 		return -EOPNOTSUPP;  in drm_syncobj_timeline_signal_ioctl()
1593 	if (args->flags != 0)  in drm_syncobj_timeline_signal_ioctl()
1594 		return -EINVAL;  in drm_syncobj_timeline_signal_ioctl()
1596 	if (args->count_handles == 0)  in drm_syncobj_timeline_signal_ioctl()
1597 		return -EINVAL;  in drm_syncobj_timeline_signal_ioctl()
1600 				     u64_to_user_ptr(args->handles),  in drm_syncobj_timeline_signal_ioctl()
1601 				     args->count_handles,  in drm_syncobj_timeline_signal_ioctl()
1606 	points = kmalloc_array(args->count_handles, sizeof(*points),  in drm_syncobj_timeline_signal_ioctl()
1609 		ret = -ENOMEM;  in drm_syncobj_timeline_signal_ioctl()
1612 	if (!u64_to_user_ptr(args->points)) {  in drm_syncobj_timeline_signal_ioctl()
1613 		memset(points, 0, args->count_handles * sizeof(uint64_t));  in drm_syncobj_timeline_signal_ioctl()
1614 	} else if (copy_from_user(points, u64_to_user_ptr(args->points),  in drm_syncobj_timeline_signal_ioctl()
1615 				  sizeof(uint64_t) * args->count_handles)) {  in drm_syncobj_timeline_signal_ioctl()
1616 		ret = -EFAULT;  in drm_syncobj_timeline_signal_ioctl()
1620 	chains = kmalloc_array(args->count_handles, sizeof(void *), GFP_KERNEL);  in drm_syncobj_timeline_signal_ioctl()
1622 		ret = -ENOMEM;  in drm_syncobj_timeline_signal_ioctl()
1625 	for (i = 0; i < args->count_handles; i++) {  in drm_syncobj_timeline_signal_ioctl()
1630 			ret = -ENOMEM;  in drm_syncobj_timeline_signal_ioctl()
1635 	for (i = 0; i < args->count_handles; i++) {  in drm_syncobj_timeline_signal_ioctl()
1647 	drm_syncobj_array_free(syncobjs, args->count_handles);  in drm_syncobj_timeline_signal_ioctl()
1657 	uint64_t __user *points = u64_to_user_ptr(args->points);  in drm_syncobj_query_ioctl()
1662 		return -EOPNOTSUPP;  in drm_syncobj_query_ioctl()
1664 	if (args->flags & ~DRM_SYNCOBJ_QUERY_FLAGS_LAST_SUBMITTED)  in drm_syncobj_query_ioctl()
1665 		return -EINVAL;  in drm_syncobj_query_ioctl()
1667 	if (args->count_handles == 0)  in drm_syncobj_query_ioctl()
1668 		return -EINVAL;  in drm_syncobj_query_ioctl()
1671 				     u64_to_user_ptr(args->handles),  in drm_syncobj_query_ioctl()
1672 				     args->count_handles,  in drm_syncobj_query_ioctl()
1677 	for (i = 0; i < args->count_handles; i++) {  in drm_syncobj_query_ioctl()
1688 			if (args->flags &  in drm_syncobj_query_ioctl()
1690 				point = fence->seqno;  in drm_syncobj_query_ioctl()
1693 					if (iter->context != fence->context) {  in drm_syncobj_query_ioctl()
1703 					last_signaled->seqno :  in drm_syncobj_query_ioctl()
1704 					to_dma_fence_chain(last_signaled)->prev_seqno;  in drm_syncobj_query_ioctl()
1712 		ret = ret ? -EFAULT : 0;  in drm_syncobj_query_ioctl()
1716 	drm_syncobj_array_free(syncobjs, args->count_handles);  in drm_syncobj_query_ioctl()