Linux Audio

Check our new training course

Linux BSP upgrade and security maintenance

Need help to get security updates for your Linux BSP?
Loading...
Note: File does not exist in v4.6.
   1/*
   2 * Copyright 2017 Red Hat
   3 * Parts ported from amdgpu (fence wait code).
   4 * Copyright 2016 Advanced Micro Devices, Inc.
   5 *
   6 * Permission is hereby granted, free of charge, to any person obtaining a
   7 * copy of this software and associated documentation files (the "Software"),
   8 * to deal in the Software without restriction, including without limitation
   9 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
  10 * and/or sell copies of the Software, and to permit persons to whom the
  11 * Software is furnished to do so, subject to the following conditions:
  12 *
  13 * The above copyright notice and this permission notice (including the next
  14 * paragraph) shall be included in all copies or substantial portions of the
  15 * Software.
  16 *
  17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
  20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
  22 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
  23 * IN THE SOFTWARE.
  24 *
  25 * Authors:
  26 *
  27 */
  28
  29/**
  30 * DOC: Overview
  31 *
  32 * DRM synchronisation objects (syncobj, see struct &drm_syncobj) provide a
  33 * container for a synchronization primitive which can be used by userspace
  34 * to explicitly synchronize GPU commands, can be shared between userspace
  35 * processes, and can be shared between different DRM drivers.
  36 * Their primary use-case is to implement Vulkan fences and semaphores.
  37 * The syncobj userspace API provides ioctls for several operations:
  38 *
  39 *  - Creation and destruction of syncobjs
  40 *  - Import and export of syncobjs to/from a syncobj file descriptor
  41 *  - Import and export a syncobj's underlying fence to/from a sync file
  42 *  - Reset a syncobj (set its fence to NULL)
  43 *  - Signal a syncobj (set a trivially signaled fence)
  44 *  - Wait for a syncobj's fence to appear and be signaled
  45 *
  46 * At it's core, a syncobj is simply a wrapper around a pointer to a struct
  47 * &dma_fence which may be NULL.
  48 * When a syncobj is first created, its pointer is either NULL or a pointer
  49 * to an already signaled fence depending on whether the
  50 * &DRM_SYNCOBJ_CREATE_SIGNALED flag is passed to
  51 * &DRM_IOCTL_SYNCOBJ_CREATE.
  52 * When GPU work which signals a syncobj is enqueued in a DRM driver,
  53 * the syncobj fence is replaced with a fence which will be signaled by the
  54 * completion of that work.
  55 * When GPU work which waits on a syncobj is enqueued in a DRM driver, the
  56 * driver retrieves syncobj's current fence at the time the work is enqueued
  57 * waits on that fence before submitting the work to hardware.
  58 * If the syncobj's fence is NULL, the enqueue operation is expected to fail.
  59 * All manipulation of the syncobjs's fence happens in terms of the current
  60 * fence at the time the ioctl is called by userspace regardless of whether
  61 * that operation is an immediate host-side operation (signal or reset) or
  62 * or an operation which is enqueued in some driver queue.
  63 * &DRM_IOCTL_SYNCOBJ_RESET and &DRM_IOCTL_SYNCOBJ_SIGNAL can be used to
  64 * manipulate a syncobj from the host by resetting its pointer to NULL or
  65 * setting its pointer to a fence which is already signaled.
  66 *
  67 *
  68 * Host-side wait on syncobjs
  69 * --------------------------
  70 *
  71 * &DRM_IOCTL_SYNCOBJ_WAIT takes an array of syncobj handles and does a
  72 * host-side wait on all of the syncobj fences simultaneously.
  73 * If &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL is set, the wait ioctl will wait on
  74 * all of the syncobj fences to be signaled before it returns.
  75 * Otherwise, it returns once at least one syncobj fence has been signaled
  76 * and the index of a signaled fence is written back to the client.
  77 *
  78 * Unlike the enqueued GPU work dependencies which fail if they see a NULL
  79 * fence in a syncobj, if &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT is set,
  80 * the host-side wait will first wait for the syncobj to receive a non-NULL
  81 * fence and then wait on that fence.
  82 * If &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT is not set and any one of the
  83 * syncobjs in the array has a NULL fence, -EINVAL will be returned.
  84 * Assuming the syncobj starts off with a NULL fence, this allows a client
  85 * to do a host wait in one thread (or process) which waits on GPU work
  86 * submitted in another thread (or process) without having to manually
  87 * synchronize between the two.
  88 * This requirement is inherited from the Vulkan fence API.
  89 *
  90 *
  91 * Import/export of syncobjs
  92 * -------------------------
  93 *
  94 * &DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE and &DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD
  95 * provide two mechanisms for import/export of syncobjs.
  96 *
  97 * The first lets the client import or export an entire syncobj to a file
  98 * descriptor.
  99 * These fd's are opaque and have no other use case, except passing the
 100 * syncobj between processes.
 101 * All exported file descriptors and any syncobj handles created as a
 102 * result of importing those file descriptors own a reference to the
 103 * same underlying struct &drm_syncobj and the syncobj can be used
 104 * persistently across all the processes with which it is shared.
 105 * The syncobj is freed only once the last reference is dropped.
 106 * Unlike dma-buf, importing a syncobj creates a new handle (with its own
 107 * reference) for every import instead of de-duplicating.
 108 * The primary use-case of this persistent import/export is for shared
 109 * Vulkan fences and semaphores.
 110 *
 111 * The second import/export mechanism, which is indicated by
 112 * &DRM_SYNCOBJ_FD_TO_HANDLE_FLAGS_IMPORT_SYNC_FILE or
 113 * &DRM_SYNCOBJ_HANDLE_TO_FD_FLAGS_EXPORT_SYNC_FILE lets the client
 114 * import/export the syncobj's current fence from/to a &sync_file.
 115 * When a syncobj is exported to a sync file, that sync file wraps the
 116 * sycnobj's fence at the time of export and any later signal or reset
 117 * operations on the syncobj will not affect the exported sync file.
 118 * When a sync file is imported into a syncobj, the syncobj's fence is set
 119 * to the fence wrapped by that sync file.
 120 * Because sync files are immutable, resetting or signaling the syncobj
 121 * will not affect any sync files whose fences have been imported into the
 122 * syncobj.
 123 */
 124
 125#include <linux/anon_inodes.h>
 126#include <linux/file.h>
 127#include <linux/fs.h>
 128#include <linux/sched/signal.h>
 129#include <linux/sync_file.h>
 130#include <linux/uaccess.h>
 131
 132#include <drm/drm.h>
 133#include <drm/drm_drv.h>
 134#include <drm/drm_file.h>
 135#include <drm/drm_gem.h>
 136#include <drm/drm_print.h>
 137#include <drm/drm_syncobj.h>
 138
 139#include "drm_internal.h"
 140
 141struct syncobj_wait_entry {
 142	struct list_head node;
 143	struct task_struct *task;
 144	struct dma_fence *fence;
 145	struct dma_fence_cb fence_cb;
 146	u64    point;
 147};
 148
 149static void syncobj_wait_syncobj_func(struct drm_syncobj *syncobj,
 150				      struct syncobj_wait_entry *wait);
 151
 152/**
 153 * drm_syncobj_find - lookup and reference a sync object.
 154 * @file_private: drm file private pointer
 155 * @handle: sync object handle to lookup.
 156 *
 157 * Returns a reference to the syncobj pointed to by handle or NULL. The
 158 * reference must be released by calling drm_syncobj_put().
 159 */
 160struct drm_syncobj *drm_syncobj_find(struct drm_file *file_private,
 161				     u32 handle)
 162{
 163	struct drm_syncobj *syncobj;
 164
 165	spin_lock(&file_private->syncobj_table_lock);
 166
 167	/* Check if we currently have a reference on the object */
 168	syncobj = idr_find(&file_private->syncobj_idr, handle);
 169	if (syncobj)
 170		drm_syncobj_get(syncobj);
 171
 172	spin_unlock(&file_private->syncobj_table_lock);
 173
 174	return syncobj;
 175}
 176EXPORT_SYMBOL(drm_syncobj_find);
 177
 178static void drm_syncobj_fence_add_wait(struct drm_syncobj *syncobj,
 179				       struct syncobj_wait_entry *wait)
 180{
 181	struct dma_fence *fence;
 182
 183	if (wait->fence)
 184		return;
 185
 186	spin_lock(&syncobj->lock);
 187	/* We've already tried once to get a fence and failed.  Now that we
 188	 * have the lock, try one more time just to be sure we don't add a
 189	 * callback when a fence has already been set.
 190	 */
 191	fence = dma_fence_get(rcu_dereference_protected(syncobj->fence, 1));
 192	if (!fence || dma_fence_chain_find_seqno(&fence, wait->point)) {
 193		dma_fence_put(fence);
 194		list_add_tail(&wait->node, &syncobj->cb_list);
 195	} else if (!fence) {
 196		wait->fence = dma_fence_get_stub();
 197	} else {
 198		wait->fence = fence;
 199	}
 200	spin_unlock(&syncobj->lock);
 201}
 202
 203static void drm_syncobj_remove_wait(struct drm_syncobj *syncobj,
 204				    struct syncobj_wait_entry *wait)
 205{
 206	if (!wait->node.next)
 207		return;
 208
 209	spin_lock(&syncobj->lock);
 210	list_del_init(&wait->node);
 211	spin_unlock(&syncobj->lock);
 212}
 213
 214/**
 215 * drm_syncobj_add_point - add new timeline point to the syncobj
 216 * @syncobj: sync object to add timeline point do
 217 * @chain: chain node to use to add the point
 218 * @fence: fence to encapsulate in the chain node
 219 * @point: sequence number to use for the point
 220 *
 221 * Add the chain node as new timeline point to the syncobj.
 222 */
 223void drm_syncobj_add_point(struct drm_syncobj *syncobj,
 224			   struct dma_fence_chain *chain,
 225			   struct dma_fence *fence,
 226			   uint64_t point)
 227{
 228	struct syncobj_wait_entry *cur, *tmp;
 229	struct dma_fence *prev;
 230
 231	dma_fence_get(fence);
 232
 233	spin_lock(&syncobj->lock);
 234
 235	prev = drm_syncobj_fence_get(syncobj);
 236	/* You are adding an unorder point to timeline, which could cause payload returned from query_ioctl is 0! */
 237	if (prev && prev->seqno >= point)
 238		DRM_ERROR("You are adding an unorder point to timeline!\n");
 239	dma_fence_chain_init(chain, prev, fence, point);
 240	rcu_assign_pointer(syncobj->fence, &chain->base);
 241
 242	list_for_each_entry_safe(cur, tmp, &syncobj->cb_list, node)
 243		syncobj_wait_syncobj_func(syncobj, cur);
 244	spin_unlock(&syncobj->lock);
 245
 246	/* Walk the chain once to trigger garbage collection */
 247	dma_fence_chain_for_each(fence, prev);
 248	dma_fence_put(prev);
 249}
 250EXPORT_SYMBOL(drm_syncobj_add_point);
 251
 252/**
 253 * drm_syncobj_replace_fence - replace fence in a sync object.
 254 * @syncobj: Sync object to replace fence in
 255 * @fence: fence to install in sync file.
 256 *
 257 * This replaces the fence on a sync object.
 258 */
 259void drm_syncobj_replace_fence(struct drm_syncobj *syncobj,
 260			       struct dma_fence *fence)
 261{
 262	struct dma_fence *old_fence;
 263	struct syncobj_wait_entry *cur, *tmp;
 264
 265	if (fence)
 266		dma_fence_get(fence);
 267
 268	spin_lock(&syncobj->lock);
 269
 270	old_fence = rcu_dereference_protected(syncobj->fence,
 271					      lockdep_is_held(&syncobj->lock));
 272	rcu_assign_pointer(syncobj->fence, fence);
 273
 274	if (fence != old_fence) {
 275		list_for_each_entry_safe(cur, tmp, &syncobj->cb_list, node)
 276			syncobj_wait_syncobj_func(syncobj, cur);
 277	}
 278
 279	spin_unlock(&syncobj->lock);
 280
 281	dma_fence_put(old_fence);
 282}
 283EXPORT_SYMBOL(drm_syncobj_replace_fence);
 284
 285/**
 286 * drm_syncobj_assign_null_handle - assign a stub fence to the sync object
 287 * @syncobj: sync object to assign the fence on
 288 *
 289 * Assign a already signaled stub fence to the sync object.
 290 */
 291static void drm_syncobj_assign_null_handle(struct drm_syncobj *syncobj)
 292{
 293	struct dma_fence *fence = dma_fence_get_stub();
 294
 295	drm_syncobj_replace_fence(syncobj, fence);
 296	dma_fence_put(fence);
 297}
 298
 299/* 5s default for wait submission */
 300#define DRM_SYNCOBJ_WAIT_FOR_SUBMIT_TIMEOUT 5000000000ULL
 301/**
 302 * drm_syncobj_find_fence - lookup and reference the fence in a sync object
 303 * @file_private: drm file private pointer
 304 * @handle: sync object handle to lookup.
 305 * @point: timeline point
 306 * @flags: DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT or not
 307 * @fence: out parameter for the fence
 308 *
 309 * This is just a convenience function that combines drm_syncobj_find() and
 310 * drm_syncobj_fence_get().
 311 *
 312 * Returns 0 on success or a negative error value on failure. On success @fence
 313 * contains a reference to the fence, which must be released by calling
 314 * dma_fence_put().
 315 */
 316int drm_syncobj_find_fence(struct drm_file *file_private,
 317			   u32 handle, u64 point, u64 flags,
 318			   struct dma_fence **fence)
 319{
 320	struct drm_syncobj *syncobj = drm_syncobj_find(file_private, handle);
 321	struct syncobj_wait_entry wait;
 322	u64 timeout = nsecs_to_jiffies64(DRM_SYNCOBJ_WAIT_FOR_SUBMIT_TIMEOUT);
 323	int ret;
 324
 325	if (!syncobj)
 326		return -ENOENT;
 327
 328	*fence = drm_syncobj_fence_get(syncobj);
 329	drm_syncobj_put(syncobj);
 330
 331	if (*fence) {
 332		ret = dma_fence_chain_find_seqno(fence, point);
 333		if (!ret)
 334			return 0;
 335		dma_fence_put(*fence);
 336	} else {
 337		ret = -EINVAL;
 338	}
 339
 340	if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT))
 341		return ret;
 342
 343	memset(&wait, 0, sizeof(wait));
 344	wait.task = current;
 345	wait.point = point;
 346	drm_syncobj_fence_add_wait(syncobj, &wait);
 347
 348	do {
 349		set_current_state(TASK_INTERRUPTIBLE);
 350		if (wait.fence) {
 351			ret = 0;
 352			break;
 353		}
 354                if (timeout == 0) {
 355                        ret = -ETIME;
 356                        break;
 357                }
 358
 359		if (signal_pending(current)) {
 360			ret = -ERESTARTSYS;
 361			break;
 362		}
 363
 364                timeout = schedule_timeout(timeout);
 365	} while (1);
 366
 367	__set_current_state(TASK_RUNNING);
 368	*fence = wait.fence;
 369
 370	if (wait.node.next)
 371		drm_syncobj_remove_wait(syncobj, &wait);
 372
 373	return ret;
 374}
 375EXPORT_SYMBOL(drm_syncobj_find_fence);
 376
 377/**
 378 * drm_syncobj_free - free a sync object.
 379 * @kref: kref to free.
 380 *
 381 * Only to be called from kref_put in drm_syncobj_put.
 382 */
 383void drm_syncobj_free(struct kref *kref)
 384{
 385	struct drm_syncobj *syncobj = container_of(kref,
 386						   struct drm_syncobj,
 387						   refcount);
 388	drm_syncobj_replace_fence(syncobj, NULL);
 389	kfree(syncobj);
 390}
 391EXPORT_SYMBOL(drm_syncobj_free);
 392
 393/**
 394 * drm_syncobj_create - create a new syncobj
 395 * @out_syncobj: returned syncobj
 396 * @flags: DRM_SYNCOBJ_* flags
 397 * @fence: if non-NULL, the syncobj will represent this fence
 398 *
 399 * This is the first function to create a sync object. After creating, drivers
 400 * probably want to make it available to userspace, either through
 401 * drm_syncobj_get_handle() or drm_syncobj_get_fd().
 402 *
 403 * Returns 0 on success or a negative error value on failure.
 404 */
 405int drm_syncobj_create(struct drm_syncobj **out_syncobj, uint32_t flags,
 406		       struct dma_fence *fence)
 407{
 408	struct drm_syncobj *syncobj;
 409
 410	syncobj = kzalloc(sizeof(struct drm_syncobj), GFP_KERNEL);
 411	if (!syncobj)
 412		return -ENOMEM;
 413
 414	kref_init(&syncobj->refcount);
 415	INIT_LIST_HEAD(&syncobj->cb_list);
 416	spin_lock_init(&syncobj->lock);
 417
 418	if (flags & DRM_SYNCOBJ_CREATE_SIGNALED)
 419		drm_syncobj_assign_null_handle(syncobj);
 420
 421	if (fence)
 422		drm_syncobj_replace_fence(syncobj, fence);
 423
 424	*out_syncobj = syncobj;
 425	return 0;
 426}
 427EXPORT_SYMBOL(drm_syncobj_create);
 428
 429/**
 430 * drm_syncobj_get_handle - get a handle from a syncobj
 431 * @file_private: drm file private pointer
 432 * @syncobj: Sync object to export
 433 * @handle: out parameter with the new handle
 434 *
 435 * Exports a sync object created with drm_syncobj_create() as a handle on
 436 * @file_private to userspace.
 437 *
 438 * Returns 0 on success or a negative error value on failure.
 439 */
 440int drm_syncobj_get_handle(struct drm_file *file_private,
 441			   struct drm_syncobj *syncobj, u32 *handle)
 442{
 443	int ret;
 444
 445	/* take a reference to put in the idr */
 446	drm_syncobj_get(syncobj);
 447
 448	idr_preload(GFP_KERNEL);
 449	spin_lock(&file_private->syncobj_table_lock);
 450	ret = idr_alloc(&file_private->syncobj_idr, syncobj, 1, 0, GFP_NOWAIT);
 451	spin_unlock(&file_private->syncobj_table_lock);
 452
 453	idr_preload_end();
 454
 455	if (ret < 0) {
 456		drm_syncobj_put(syncobj);
 457		return ret;
 458	}
 459
 460	*handle = ret;
 461	return 0;
 462}
 463EXPORT_SYMBOL(drm_syncobj_get_handle);
 464
 465static int drm_syncobj_create_as_handle(struct drm_file *file_private,
 466					u32 *handle, uint32_t flags)
 467{
 468	int ret;
 469	struct drm_syncobj *syncobj;
 470
 471	ret = drm_syncobj_create(&syncobj, flags, NULL);
 472	if (ret)
 473		return ret;
 474
 475	ret = drm_syncobj_get_handle(file_private, syncobj, handle);
 476	drm_syncobj_put(syncobj);
 477	return ret;
 478}
 479
 480static int drm_syncobj_destroy(struct drm_file *file_private,
 481			       u32 handle)
 482{
 483	struct drm_syncobj *syncobj;
 484
 485	spin_lock(&file_private->syncobj_table_lock);
 486	syncobj = idr_remove(&file_private->syncobj_idr, handle);
 487	spin_unlock(&file_private->syncobj_table_lock);
 488
 489	if (!syncobj)
 490		return -EINVAL;
 491
 492	drm_syncobj_put(syncobj);
 493	return 0;
 494}
 495
 496static int drm_syncobj_file_release(struct inode *inode, struct file *file)
 497{
 498	struct drm_syncobj *syncobj = file->private_data;
 499
 500	drm_syncobj_put(syncobj);
 501	return 0;
 502}
 503
 504static const struct file_operations drm_syncobj_file_fops = {
 505	.release = drm_syncobj_file_release,
 506};
 507
 508/**
 509 * drm_syncobj_get_fd - get a file descriptor from a syncobj
 510 * @syncobj: Sync object to export
 511 * @p_fd: out parameter with the new file descriptor
 512 *
 513 * Exports a sync object created with drm_syncobj_create() as a file descriptor.
 514 *
 515 * Returns 0 on success or a negative error value on failure.
 516 */
 517int drm_syncobj_get_fd(struct drm_syncobj *syncobj, int *p_fd)
 518{
 519	struct file *file;
 520	int fd;
 521
 522	fd = get_unused_fd_flags(O_CLOEXEC);
 523	if (fd < 0)
 524		return fd;
 525
 526	file = anon_inode_getfile("syncobj_file",
 527				  &drm_syncobj_file_fops,
 528				  syncobj, 0);
 529	if (IS_ERR(file)) {
 530		put_unused_fd(fd);
 531		return PTR_ERR(file);
 532	}
 533
 534	drm_syncobj_get(syncobj);
 535	fd_install(fd, file);
 536
 537	*p_fd = fd;
 538	return 0;
 539}
 540EXPORT_SYMBOL(drm_syncobj_get_fd);
 541
 542static int drm_syncobj_handle_to_fd(struct drm_file *file_private,
 543				    u32 handle, int *p_fd)
 544{
 545	struct drm_syncobj *syncobj = drm_syncobj_find(file_private, handle);
 546	int ret;
 547
 548	if (!syncobj)
 549		return -EINVAL;
 550
 551	ret = drm_syncobj_get_fd(syncobj, p_fd);
 552	drm_syncobj_put(syncobj);
 553	return ret;
 554}
 555
 556static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
 557				    int fd, u32 *handle)
 558{
 559	struct drm_syncobj *syncobj;
 560	struct fd f = fdget(fd);
 561	int ret;
 562
 563	if (!f.file)
 564		return -EINVAL;
 565
 566	if (f.file->f_op != &drm_syncobj_file_fops) {
 567		fdput(f);
 568		return -EINVAL;
 569	}
 570
 571	/* take a reference to put in the idr */
 572	syncobj = f.file->private_data;
 573	drm_syncobj_get(syncobj);
 574
 575	idr_preload(GFP_KERNEL);
 576	spin_lock(&file_private->syncobj_table_lock);
 577	ret = idr_alloc(&file_private->syncobj_idr, syncobj, 1, 0, GFP_NOWAIT);
 578	spin_unlock(&file_private->syncobj_table_lock);
 579	idr_preload_end();
 580
 581	if (ret > 0) {
 582		*handle = ret;
 583		ret = 0;
 584	} else
 585		drm_syncobj_put(syncobj);
 586
 587	fdput(f);
 588	return ret;
 589}
 590
 591static int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,
 592					      int fd, int handle)
 593{
 594	struct dma_fence *fence = sync_file_get_fence(fd);
 595	struct drm_syncobj *syncobj;
 596
 597	if (!fence)
 598		return -EINVAL;
 599
 600	syncobj = drm_syncobj_find(file_private, handle);
 601	if (!syncobj) {
 602		dma_fence_put(fence);
 603		return -ENOENT;
 604	}
 605
 606	drm_syncobj_replace_fence(syncobj, fence);
 607	dma_fence_put(fence);
 608	drm_syncobj_put(syncobj);
 609	return 0;
 610}
 611
 612static int drm_syncobj_export_sync_file(struct drm_file *file_private,
 613					int handle, int *p_fd)
 614{
 615	int ret;
 616	struct dma_fence *fence;
 617	struct sync_file *sync_file;
 618	int fd = get_unused_fd_flags(O_CLOEXEC);
 619
 620	if (fd < 0)
 621		return fd;
 622
 623	ret = drm_syncobj_find_fence(file_private, handle, 0, 0, &fence);
 624	if (ret)
 625		goto err_put_fd;
 626
 627	sync_file = sync_file_create(fence);
 628
 629	dma_fence_put(fence);
 630
 631	if (!sync_file) {
 632		ret = -EINVAL;
 633		goto err_put_fd;
 634	}
 635
 636	fd_install(fd, sync_file->file);
 637
 638	*p_fd = fd;
 639	return 0;
 640err_put_fd:
 641	put_unused_fd(fd);
 642	return ret;
 643}
 644/**
 645 * drm_syncobj_open - initalizes syncobj file-private structures at devnode open time
 646 * @file_private: drm file-private structure to set up
 647 *
 648 * Called at device open time, sets up the structure for handling refcounting
 649 * of sync objects.
 650 */
 651void
 652drm_syncobj_open(struct drm_file *file_private)
 653{
 654	idr_init_base(&file_private->syncobj_idr, 1);
 655	spin_lock_init(&file_private->syncobj_table_lock);
 656}
 657
 658static int
 659drm_syncobj_release_handle(int id, void *ptr, void *data)
 660{
 661	struct drm_syncobj *syncobj = ptr;
 662
 663	drm_syncobj_put(syncobj);
 664	return 0;
 665}
 666
 667/**
 668 * drm_syncobj_release - release file-private sync object resources
 669 * @file_private: drm file-private structure to clean up
 670 *
 671 * Called at close time when the filp is going away.
 672 *
 673 * Releases any remaining references on objects by this filp.
 674 */
 675void
 676drm_syncobj_release(struct drm_file *file_private)
 677{
 678	idr_for_each(&file_private->syncobj_idr,
 679		     &drm_syncobj_release_handle, file_private);
 680	idr_destroy(&file_private->syncobj_idr);
 681}
 682
 683int
 684drm_syncobj_create_ioctl(struct drm_device *dev, void *data,
 685			 struct drm_file *file_private)
 686{
 687	struct drm_syncobj_create *args = data;
 688
 689	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
 690		return -EOPNOTSUPP;
 691
 692	/* no valid flags yet */
 693	if (args->flags & ~DRM_SYNCOBJ_CREATE_SIGNALED)
 694		return -EINVAL;
 695
 696	return drm_syncobj_create_as_handle(file_private,
 697					    &args->handle, args->flags);
 698}
 699
 700int
 701drm_syncobj_destroy_ioctl(struct drm_device *dev, void *data,
 702			  struct drm_file *file_private)
 703{
 704	struct drm_syncobj_destroy *args = data;
 705
 706	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
 707		return -EOPNOTSUPP;
 708
 709	/* make sure padding is empty */
 710	if (args->pad)
 711		return -EINVAL;
 712	return drm_syncobj_destroy(file_private, args->handle);
 713}
 714
 715int
 716drm_syncobj_handle_to_fd_ioctl(struct drm_device *dev, void *data,
 717				   struct drm_file *file_private)
 718{
 719	struct drm_syncobj_handle *args = data;
 720
 721	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
 722		return -EOPNOTSUPP;
 723
 724	if (args->pad)
 725		return -EINVAL;
 726
 727	if (args->flags != 0 &&
 728	    args->flags != DRM_SYNCOBJ_HANDLE_TO_FD_FLAGS_EXPORT_SYNC_FILE)
 729		return -EINVAL;
 730
 731	if (args->flags & DRM_SYNCOBJ_HANDLE_TO_FD_FLAGS_EXPORT_SYNC_FILE)
 732		return drm_syncobj_export_sync_file(file_private, args->handle,
 733						    &args->fd);
 734
 735	return drm_syncobj_handle_to_fd(file_private, args->handle,
 736					&args->fd);
 737}
 738
 739int
 740drm_syncobj_fd_to_handle_ioctl(struct drm_device *dev, void *data,
 741				   struct drm_file *file_private)
 742{
 743	struct drm_syncobj_handle *args = data;
 744
 745	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
 746		return -EOPNOTSUPP;
 747
 748	if (args->pad)
 749		return -EINVAL;
 750
 751	if (args->flags != 0 &&
 752	    args->flags != DRM_SYNCOBJ_FD_TO_HANDLE_FLAGS_IMPORT_SYNC_FILE)
 753		return -EINVAL;
 754
 755	if (args->flags & DRM_SYNCOBJ_FD_TO_HANDLE_FLAGS_IMPORT_SYNC_FILE)
 756		return drm_syncobj_import_sync_file_fence(file_private,
 757							  args->fd,
 758							  args->handle);
 759
 760	return drm_syncobj_fd_to_handle(file_private, args->fd,
 761					&args->handle);
 762}
 763
 764static int drm_syncobj_transfer_to_timeline(struct drm_file *file_private,
 765					    struct drm_syncobj_transfer *args)
 766{
 767	struct drm_syncobj *timeline_syncobj = NULL;
 768	struct dma_fence *fence;
 769	struct dma_fence_chain *chain;
 770	int ret;
 771
 772	timeline_syncobj = drm_syncobj_find(file_private, args->dst_handle);
 773	if (!timeline_syncobj) {
 774		return -ENOENT;
 775	}
 776	ret = drm_syncobj_find_fence(file_private, args->src_handle,
 777				     args->src_point, args->flags,
 778				     &fence);
 779	if (ret)
 780		goto err;
 781	chain = kzalloc(sizeof(struct dma_fence_chain), GFP_KERNEL);
 782	if (!chain) {
 783		ret = -ENOMEM;
 784		goto err1;
 785	}
 786	drm_syncobj_add_point(timeline_syncobj, chain, fence, args->dst_point);
 787err1:
 788	dma_fence_put(fence);
 789err:
 790	drm_syncobj_put(timeline_syncobj);
 791
 792	return ret;
 793}
 794
 795static int
 796drm_syncobj_transfer_to_binary(struct drm_file *file_private,
 797			       struct drm_syncobj_transfer *args)
 798{
 799	struct drm_syncobj *binary_syncobj = NULL;
 800	struct dma_fence *fence;
 801	int ret;
 802
 803	binary_syncobj = drm_syncobj_find(file_private, args->dst_handle);
 804	if (!binary_syncobj)
 805		return -ENOENT;
 806	ret = drm_syncobj_find_fence(file_private, args->src_handle,
 807				     args->src_point, args->flags, &fence);
 808	if (ret)
 809		goto err;
 810	drm_syncobj_replace_fence(binary_syncobj, fence);
 811	dma_fence_put(fence);
 812err:
 813	drm_syncobj_put(binary_syncobj);
 814
 815	return ret;
 816}
 817int
 818drm_syncobj_transfer_ioctl(struct drm_device *dev, void *data,
 819			   struct drm_file *file_private)
 820{
 821	struct drm_syncobj_transfer *args = data;
 822	int ret;
 823
 824	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ_TIMELINE))
 825		return -EOPNOTSUPP;
 826
 827	if (args->pad)
 828		return -EINVAL;
 829
 830	if (args->dst_point)
 831		ret = drm_syncobj_transfer_to_timeline(file_private, args);
 832	else
 833		ret = drm_syncobj_transfer_to_binary(file_private, args);
 834
 835	return ret;
 836}
 837
 838static void syncobj_wait_fence_func(struct dma_fence *fence,
 839				    struct dma_fence_cb *cb)
 840{
 841	struct syncobj_wait_entry *wait =
 842		container_of(cb, struct syncobj_wait_entry, fence_cb);
 843
 844	wake_up_process(wait->task);
 845}
 846
 847static void syncobj_wait_syncobj_func(struct drm_syncobj *syncobj,
 848				      struct syncobj_wait_entry *wait)
 849{
 850	struct dma_fence *fence;
 851
 852	/* This happens inside the syncobj lock */
 853	fence = rcu_dereference_protected(syncobj->fence,
 854					  lockdep_is_held(&syncobj->lock));
 855	dma_fence_get(fence);
 856	if (!fence || dma_fence_chain_find_seqno(&fence, wait->point)) {
 857		dma_fence_put(fence);
 858		return;
 859	} else if (!fence) {
 860		wait->fence = dma_fence_get_stub();
 861	} else {
 862		wait->fence = fence;
 863	}
 864
 865	wake_up_process(wait->task);
 866	list_del_init(&wait->node);
 867}
 868
 869static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,
 870						  void __user *user_points,
 871						  uint32_t count,
 872						  uint32_t flags,
 873						  signed long timeout,
 874						  uint32_t *idx)
 875{
 876	struct syncobj_wait_entry *entries;
 877	struct dma_fence *fence;
 878	uint64_t *points;
 879	uint32_t signaled_count, i;
 880
 881	points = kmalloc_array(count, sizeof(*points), GFP_KERNEL);
 882	if (points == NULL)
 883		return -ENOMEM;
 884
 885	if (!user_points) {
 886		memset(points, 0, count * sizeof(uint64_t));
 887
 888	} else if (copy_from_user(points, user_points,
 889				  sizeof(uint64_t) * count)) {
 890		timeout = -EFAULT;
 891		goto err_free_points;
 892	}
 893
 894	entries = kcalloc(count, sizeof(*entries), GFP_KERNEL);
 895	if (!entries) {
 896		timeout = -ENOMEM;
 897		goto err_free_points;
 898	}
 899	/* Walk the list of sync objects and initialize entries.  We do
 900	 * this up-front so that we can properly return -EINVAL if there is
 901	 * a syncobj with a missing fence and then never have the chance of
 902	 * returning -EINVAL again.
 903	 */
 904	signaled_count = 0;
 905	for (i = 0; i < count; ++i) {
 906		struct dma_fence *fence;
 907
 908		entries[i].task = current;
 909		entries[i].point = points[i];
 910		fence = drm_syncobj_fence_get(syncobjs[i]);
 911		if (!fence || dma_fence_chain_find_seqno(&fence, points[i])) {
 912			dma_fence_put(fence);
 913			if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) {
 914				continue;
 915			} else {
 916				timeout = -EINVAL;
 917				goto cleanup_entries;
 918			}
 919		}
 920
 921		if (fence)
 922			entries[i].fence = fence;
 923		else
 924			entries[i].fence = dma_fence_get_stub();
 925
 926		if ((flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE) ||
 927		    dma_fence_is_signaled(entries[i].fence)) {
 928			if (signaled_count == 0 && idx)
 929				*idx = i;
 930			signaled_count++;
 931		}
 932	}
 933
 934	if (signaled_count == count ||
 935	    (signaled_count > 0 &&
 936	     !(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL)))
 937		goto cleanup_entries;
 938
 939	/* There's a very annoying laxness in the dma_fence API here, in
 940	 * that backends are not required to automatically report when a
 941	 * fence is signaled prior to fence->ops->enable_signaling() being
 942	 * called.  So here if we fail to match signaled_count, we need to
 943	 * fallthough and try a 0 timeout wait!
 944	 */
 945
 946	if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) {
 947		for (i = 0; i < count; ++i)
 948			drm_syncobj_fence_add_wait(syncobjs[i], &entries[i]);
 949	}
 950
 951	do {
 952		set_current_state(TASK_INTERRUPTIBLE);
 953
 954		signaled_count = 0;
 955		for (i = 0; i < count; ++i) {
 956			fence = entries[i].fence;
 957			if (!fence)
 958				continue;
 959
 960			if ((flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE) ||
 961			    dma_fence_is_signaled(fence) ||
 962			    (!entries[i].fence_cb.func &&
 963			     dma_fence_add_callback(fence,
 964						    &entries[i].fence_cb,
 965						    syncobj_wait_fence_func))) {
 966				/* The fence has been signaled */
 967				if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL) {
 968					signaled_count++;
 969				} else {
 970					if (idx)
 971						*idx = i;
 972					goto done_waiting;
 973				}
 974			}
 975		}
 976
 977		if (signaled_count == count)
 978			goto done_waiting;
 979
 980		if (timeout == 0) {
 981			timeout = -ETIME;
 982			goto done_waiting;
 983		}
 984
 985		if (signal_pending(current)) {
 986			timeout = -ERESTARTSYS;
 987			goto done_waiting;
 988		}
 989
 990		timeout = schedule_timeout(timeout);
 991	} while (1);
 992
 993done_waiting:
 994	__set_current_state(TASK_RUNNING);
 995
 996cleanup_entries:
 997	for (i = 0; i < count; ++i) {
 998		drm_syncobj_remove_wait(syncobjs[i], &entries[i]);
 999		if (entries[i].fence_cb.func)
1000			dma_fence_remove_callback(entries[i].fence,
1001						  &entries[i].fence_cb);
1002		dma_fence_put(entries[i].fence);
1003	}
1004	kfree(entries);
1005
1006err_free_points:
1007	kfree(points);
1008
1009	return timeout;
1010}
1011
1012/**
1013 * drm_timeout_abs_to_jiffies - calculate jiffies timeout from absolute value
1014 *
1015 * @timeout_nsec: timeout nsec component in ns, 0 for poll
1016 *
1017 * Calculate the timeout in jiffies from an absolute time in sec/nsec.
1018 */
1019signed long drm_timeout_abs_to_jiffies(int64_t timeout_nsec)
1020{
1021	ktime_t abs_timeout, now;
1022	u64 timeout_ns, timeout_jiffies64;
1023
1024	/* make 0 timeout means poll - absolute 0 doesn't seem valid */
1025	if (timeout_nsec == 0)
1026		return 0;
1027
1028	abs_timeout = ns_to_ktime(timeout_nsec);
1029	now = ktime_get();
1030
1031	if (!ktime_after(abs_timeout, now))
1032		return 0;
1033
1034	timeout_ns = ktime_to_ns(ktime_sub(abs_timeout, now));
1035
1036	timeout_jiffies64 = nsecs_to_jiffies64(timeout_ns);
1037	/*  clamp timeout to avoid infinite timeout */
1038	if (timeout_jiffies64 >= MAX_SCHEDULE_TIMEOUT - 1)
1039		return MAX_SCHEDULE_TIMEOUT - 1;
1040
1041	return timeout_jiffies64 + 1;
1042}
1043EXPORT_SYMBOL(drm_timeout_abs_to_jiffies);
1044
1045static int drm_syncobj_array_wait(struct drm_device *dev,
1046				  struct drm_file *file_private,
1047				  struct drm_syncobj_wait *wait,
1048				  struct drm_syncobj_timeline_wait *timeline_wait,
1049				  struct drm_syncobj **syncobjs, bool timeline)
1050{
1051	signed long timeout = 0;
1052	uint32_t first = ~0;
1053
1054	if (!timeline) {
1055		timeout = drm_timeout_abs_to_jiffies(wait->timeout_nsec);
1056		timeout = drm_syncobj_array_wait_timeout(syncobjs,
1057							 NULL,
1058							 wait->count_handles,
1059							 wait->flags,
1060							 timeout, &first);
1061		if (timeout < 0)
1062			return timeout;
1063		wait->first_signaled = first;
1064	} else {
1065		timeout = drm_timeout_abs_to_jiffies(timeline_wait->timeout_nsec);
1066		timeout = drm_syncobj_array_wait_timeout(syncobjs,
1067							 u64_to_user_ptr(timeline_wait->points),
1068							 timeline_wait->count_handles,
1069							 timeline_wait->flags,
1070							 timeout, &first);
1071		if (timeout < 0)
1072			return timeout;
1073		timeline_wait->first_signaled = first;
1074	}
1075	return 0;
1076}
1077
1078static int drm_syncobj_array_find(struct drm_file *file_private,
1079				  void __user *user_handles,
1080				  uint32_t count_handles,
1081				  struct drm_syncobj ***syncobjs_out)
1082{
1083	uint32_t i, *handles;
1084	struct drm_syncobj **syncobjs;
1085	int ret;
1086
1087	handles = kmalloc_array(count_handles, sizeof(*handles), GFP_KERNEL);
1088	if (handles == NULL)
1089		return -ENOMEM;
1090
1091	if (copy_from_user(handles, user_handles,
1092			   sizeof(uint32_t) * count_handles)) {
1093		ret = -EFAULT;
1094		goto err_free_handles;
1095	}
1096
1097	syncobjs = kmalloc_array(count_handles, sizeof(*syncobjs), GFP_KERNEL);
1098	if (syncobjs == NULL) {
1099		ret = -ENOMEM;
1100		goto err_free_handles;
1101	}
1102
1103	for (i = 0; i < count_handles; i++) {
1104		syncobjs[i] = drm_syncobj_find(file_private, handles[i]);
1105		if (!syncobjs[i]) {
1106			ret = -ENOENT;
1107			goto err_put_syncobjs;
1108		}
1109	}
1110
1111	kfree(handles);
1112	*syncobjs_out = syncobjs;
1113	return 0;
1114
1115err_put_syncobjs:
1116	while (i-- > 0)
1117		drm_syncobj_put(syncobjs[i]);
1118	kfree(syncobjs);
1119err_free_handles:
1120	kfree(handles);
1121
1122	return ret;
1123}
1124
1125static void drm_syncobj_array_free(struct drm_syncobj **syncobjs,
1126				   uint32_t count)
1127{
1128	uint32_t i;
1129	for (i = 0; i < count; i++)
1130		drm_syncobj_put(syncobjs[i]);
1131	kfree(syncobjs);
1132}
1133
1134int
1135drm_syncobj_wait_ioctl(struct drm_device *dev, void *data,
1136		       struct drm_file *file_private)
1137{
1138	struct drm_syncobj_wait *args = data;
1139	struct drm_syncobj **syncobjs;
1140	int ret = 0;
1141
1142	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
1143		return -EOPNOTSUPP;
1144
1145	if (args->flags & ~(DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL |
1146			    DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT))
1147		return -EINVAL;
1148
1149	if (args->count_handles == 0)
1150		return -EINVAL;
1151
1152	ret = drm_syncobj_array_find(file_private,
1153				     u64_to_user_ptr(args->handles),
1154				     args->count_handles,
1155				     &syncobjs);
1156	if (ret < 0)
1157		return ret;
1158
1159	ret = drm_syncobj_array_wait(dev, file_private,
1160				     args, NULL, syncobjs, false);
1161
1162	drm_syncobj_array_free(syncobjs, args->count_handles);
1163
1164	return ret;
1165}
1166
1167int
1168drm_syncobj_timeline_wait_ioctl(struct drm_device *dev, void *data,
1169				struct drm_file *file_private)
1170{
1171	struct drm_syncobj_timeline_wait *args = data;
1172	struct drm_syncobj **syncobjs;
1173	int ret = 0;
1174
1175	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ_TIMELINE))
1176		return -EOPNOTSUPP;
1177
1178	if (args->flags & ~(DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL |
1179			    DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
1180			    DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE))
1181		return -EINVAL;
1182
1183	if (args->count_handles == 0)
1184		return -EINVAL;
1185
1186	ret = drm_syncobj_array_find(file_private,
1187				     u64_to_user_ptr(args->handles),
1188				     args->count_handles,
1189				     &syncobjs);
1190	if (ret < 0)
1191		return ret;
1192
1193	ret = drm_syncobj_array_wait(dev, file_private,
1194				     NULL, args, syncobjs, true);
1195
1196	drm_syncobj_array_free(syncobjs, args->count_handles);
1197
1198	return ret;
1199}
1200
1201
1202int
1203drm_syncobj_reset_ioctl(struct drm_device *dev, void *data,
1204			struct drm_file *file_private)
1205{
1206	struct drm_syncobj_array *args = data;
1207	struct drm_syncobj **syncobjs;
1208	uint32_t i;
1209	int ret;
1210
1211	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
1212		return -EOPNOTSUPP;
1213
1214	if (args->pad != 0)
1215		return -EINVAL;
1216
1217	if (args->count_handles == 0)
1218		return -EINVAL;
1219
1220	ret = drm_syncobj_array_find(file_private,
1221				     u64_to_user_ptr(args->handles),
1222				     args->count_handles,
1223				     &syncobjs);
1224	if (ret < 0)
1225		return ret;
1226
1227	for (i = 0; i < args->count_handles; i++)
1228		drm_syncobj_replace_fence(syncobjs[i], NULL);
1229
1230	drm_syncobj_array_free(syncobjs, args->count_handles);
1231
1232	return 0;
1233}
1234
1235int
1236drm_syncobj_signal_ioctl(struct drm_device *dev, void *data,
1237			 struct drm_file *file_private)
1238{
1239	struct drm_syncobj_array *args = data;
1240	struct drm_syncobj **syncobjs;
1241	uint32_t i;
1242	int ret;
1243
1244	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
1245		return -EOPNOTSUPP;
1246
1247	if (args->pad != 0)
1248		return -EINVAL;
1249
1250	if (args->count_handles == 0)
1251		return -EINVAL;
1252
1253	ret = drm_syncobj_array_find(file_private,
1254				     u64_to_user_ptr(args->handles),
1255				     args->count_handles,
1256				     &syncobjs);
1257	if (ret < 0)
1258		return ret;
1259
1260	for (i = 0; i < args->count_handles; i++)
1261		drm_syncobj_assign_null_handle(syncobjs[i]);
1262
1263	drm_syncobj_array_free(syncobjs, args->count_handles);
1264
1265	return ret;
1266}
1267
1268int
1269drm_syncobj_timeline_signal_ioctl(struct drm_device *dev, void *data,
1270				  struct drm_file *file_private)
1271{
1272	struct drm_syncobj_timeline_array *args = data;
1273	struct drm_syncobj **syncobjs;
1274	struct dma_fence_chain **chains;
1275	uint64_t *points;
1276	uint32_t i, j;
1277	int ret;
1278
1279	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ_TIMELINE))
1280		return -EOPNOTSUPP;
1281
1282	if (args->pad != 0)
1283		return -EINVAL;
1284
1285	if (args->count_handles == 0)
1286		return -EINVAL;
1287
1288	ret = drm_syncobj_array_find(file_private,
1289				     u64_to_user_ptr(args->handles),
1290				     args->count_handles,
1291				     &syncobjs);
1292	if (ret < 0)
1293		return ret;
1294
1295	points = kmalloc_array(args->count_handles, sizeof(*points),
1296			       GFP_KERNEL);
1297	if (!points) {
1298		ret = -ENOMEM;
1299		goto out;
1300	}
1301	if (!u64_to_user_ptr(args->points)) {
1302		memset(points, 0, args->count_handles * sizeof(uint64_t));
1303	} else if (copy_from_user(points, u64_to_user_ptr(args->points),
1304				  sizeof(uint64_t) * args->count_handles)) {
1305		ret = -EFAULT;
1306		goto err_points;
1307	}
1308
1309	chains = kmalloc_array(args->count_handles, sizeof(void *), GFP_KERNEL);
1310	if (!chains) {
1311		ret = -ENOMEM;
1312		goto err_points;
1313	}
1314	for (i = 0; i < args->count_handles; i++) {
1315		chains[i] = kzalloc(sizeof(struct dma_fence_chain), GFP_KERNEL);
1316		if (!chains[i]) {
1317			for (j = 0; j < i; j++)
1318				kfree(chains[j]);
1319			ret = -ENOMEM;
1320			goto err_chains;
1321		}
1322	}
1323
1324	for (i = 0; i < args->count_handles; i++) {
1325		struct dma_fence *fence = dma_fence_get_stub();
1326
1327		drm_syncobj_add_point(syncobjs[i], chains[i],
1328				      fence, points[i]);
1329		dma_fence_put(fence);
1330	}
1331err_chains:
1332	kfree(chains);
1333err_points:
1334	kfree(points);
1335out:
1336	drm_syncobj_array_free(syncobjs, args->count_handles);
1337
1338	return ret;
1339}
1340
1341int drm_syncobj_query_ioctl(struct drm_device *dev, void *data,
1342			    struct drm_file *file_private)
1343{
1344	struct drm_syncobj_timeline_array *args = data;
1345	struct drm_syncobj **syncobjs;
1346	uint64_t __user *points = u64_to_user_ptr(args->points);
1347	uint32_t i;
1348	int ret;
1349
1350	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ_TIMELINE))
1351		return -EOPNOTSUPP;
1352
1353	if (args->pad != 0)
1354		return -EINVAL;
1355
1356	if (args->count_handles == 0)
1357		return -EINVAL;
1358
1359	ret = drm_syncobj_array_find(file_private,
1360				     u64_to_user_ptr(args->handles),
1361				     args->count_handles,
1362				     &syncobjs);
1363	if (ret < 0)
1364		return ret;
1365
1366	for (i = 0; i < args->count_handles; i++) {
1367		struct dma_fence_chain *chain;
1368		struct dma_fence *fence;
1369		uint64_t point;
1370
1371		fence = drm_syncobj_fence_get(syncobjs[i]);
1372		chain = to_dma_fence_chain(fence);
1373		if (chain) {
1374			struct dma_fence *iter, *last_signaled = NULL;
1375
1376			dma_fence_chain_for_each(iter, fence) {
1377				if (iter->context != fence->context) {
1378					dma_fence_put(iter);
1379					/* It is most likely that timeline has
1380					 * unorder points. */
1381					break;
1382				}
1383				dma_fence_put(last_signaled);
1384				last_signaled = dma_fence_get(iter);
1385			}
1386			point = dma_fence_is_signaled(last_signaled) ?
1387				last_signaled->seqno :
1388				to_dma_fence_chain(last_signaled)->prev_seqno;
1389			dma_fence_put(last_signaled);
1390		} else {
1391			point = 0;
1392		}
1393		ret = copy_to_user(&points[i], &point, sizeof(uint64_t));
1394		ret = ret ? -EFAULT : 0;
1395		if (ret)
1396			break;
1397	}
1398	drm_syncobj_array_free(syncobjs, args->count_handles);
1399
1400	return ret;
1401}