1/*
   2 * Copyright 2017 Red Hat
   3 * Parts ported from amdgpu (fence wait code).
   4 * Copyright 2016 Advanced Micro Devices, Inc.
   5 *
   6 * Permission is hereby granted, free of charge, to any person obtaining a
   7 * copy of this software and associated documentation files (the "Software"),
   8 * to deal in the Software without restriction, including without limitation
   9 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
  10 * and/or sell copies of the Software, and to permit persons to whom the
  11 * Software is furnished to do so, subject to the following conditions:
  12 *
  13 * The above copyright notice and this permission notice (including the next
  14 * paragraph) shall be included in all copies or substantial portions of the
  15 * Software.
  16 *
  17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
  20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
  22 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
  23 * IN THE SOFTWARE.
  24 *
  25 * Authors:
  26 *
  27 */
  28
  29/**
  30 * DOC: Overview
  31 *
  32 * DRM synchronisation objects (syncobj, see struct &drm_syncobj) provide a
  33 * container for a synchronization primitive which can be used by userspace
  34 * to explicitly synchronize GPU commands, can be shared between userspace
  35 * processes, and can be shared between different DRM drivers.
  36 * Their primary use-case is to implement Vulkan fences and semaphores.
  37 * The syncobj userspace API provides ioctls for several operations:
  38 *
  39 *  - Creation and destruction of syncobjs
  40 *  - Import and export of syncobjs to/from a syncobj file descriptor
  41 *  - Import and export a syncobj's underlying fence to/from a sync file
  42 *  - Reset a syncobj (set its fence to NULL)
  43 *  - Signal a syncobj (set a trivially signaled fence)
  44 *  - Wait for a syncobj's fence to appear and be signaled
  45 *
  46 * The syncobj userspace API also provides operations to manipulate a syncobj
  47 * in terms of a timeline of struct &dma_fence_chain rather than a single
  48 * struct &dma_fence, through the following operations:
  49 *
  50 *   - Signal a given point on the timeline
  51 *   - Wait for a given point to appear and/or be signaled
  52 *   - Import and export from/to a given point of a timeline
  53 *
  54 * At it's core, a syncobj is simply a wrapper around a pointer to a struct
  55 * &dma_fence which may be NULL.
  56 * When a syncobj is first created, its pointer is either NULL or a pointer
  57 * to an already signaled fence depending on whether the
  58 * &DRM_SYNCOBJ_CREATE_SIGNALED flag is passed to
  59 * &DRM_IOCTL_SYNCOBJ_CREATE.
  60 *
  61 * If the syncobj is considered as a binary (its state is either signaled or
  62 * unsignaled) primitive, when GPU work is enqueued in a DRM driver to signal
  63 * the syncobj, the syncobj's fence is replaced with a fence which will be
  64 * signaled by the completion of that work.
  65 * If the syncobj is considered as a timeline primitive, when GPU work is
  66 * enqueued in a DRM driver to signal the a given point of the syncobj, a new
  67 * struct &dma_fence_chain pointing to the DRM driver's fence and also
  68 * pointing to the previous fence that was in the syncobj. The new struct
  69 * &dma_fence_chain fence replace the syncobj's fence and will be signaled by
  70 * completion of the DRM driver's work and also any work associated with the
  71 * fence previously in the syncobj.
  72 *
  73 * When GPU work which waits on a syncobj is enqueued in a DRM driver, at the
  74 * time the work is enqueued, it waits on the syncobj's fence before
  75 * submitting the work to hardware. That fence is either :
  76 *
  77 *    - The syncobj's current fence if the syncobj is considered as a binary
  78 *      primitive.
  79 *    - The struct &dma_fence associated with a given point if the syncobj is
  80 *      considered as a timeline primitive.
  81 *
  82 * If the syncobj's fence is NULL or not present in the syncobj's timeline,
  83 * the enqueue operation is expected to fail.
  84 *
  85 * With binary syncobj, all manipulation of the syncobjs's fence happens in
  86 * terms of the current fence at the time the ioctl is called by userspace
  87 * regardless of whether that operation is an immediate host-side operation
  88 * (signal or reset) or or an operation which is enqueued in some driver
  89 * queue. &DRM_IOCTL_SYNCOBJ_RESET and &DRM_IOCTL_SYNCOBJ_SIGNAL can be used
  90 * to manipulate a syncobj from the host by resetting its pointer to NULL or
  91 * setting its pointer to a fence which is already signaled.
  92 *
  93 * With a timeline syncobj, all manipulation of the synobj's fence happens in
  94 * terms of a u64 value referring to point in the timeline. See
  95 * dma_fence_chain_find_seqno() to see how a given point is found in the
  96 * timeline.
  97 *
  98 * Note that applications should be careful to always use timeline set of
  99 * ioctl() when dealing with syncobj considered as timeline. Using a binary
 100 * set of ioctl() with a syncobj considered as timeline could result incorrect
 101 * synchronization. The use of binary syncobj is supported through the
 102 * timeline set of ioctl() by using a point value of 0, this will reproduce
 103 * the behavior of the binary set of ioctl() (for example replace the
 104 * syncobj's fence when signaling).
 105 *
 106 *
 107 * Host-side wait on syncobjs
 108 * --------------------------
 109 *
 110 * &DRM_IOCTL_SYNCOBJ_WAIT takes an array of syncobj handles and does a
 111 * host-side wait on all of the syncobj fences simultaneously.
 112 * If &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL is set, the wait ioctl will wait on
 113 * all of the syncobj fences to be signaled before it returns.
 114 * Otherwise, it returns once at least one syncobj fence has been signaled
 115 * and the index of a signaled fence is written back to the client.
 116 *
 117 * Unlike the enqueued GPU work dependencies which fail if they see a NULL
 118 * fence in a syncobj, if &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT is set,
 119 * the host-side wait will first wait for the syncobj to receive a non-NULL
 120 * fence and then wait on that fence.
 121 * If &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT is not set and any one of the
 122 * syncobjs in the array has a NULL fence, -EINVAL will be returned.
 123 * Assuming the syncobj starts off with a NULL fence, this allows a client
 124 * to do a host wait in one thread (or process) which waits on GPU work
 125 * submitted in another thread (or process) without having to manually
 126 * synchronize between the two.
 127 * This requirement is inherited from the Vulkan fence API.
 128 *
 129 * If &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_DEADLINE is set, the ioctl will also set
 130 * a fence deadline hint on the backing fences before waiting, to provide the
 131 * fence signaler with an appropriate sense of urgency.  The deadline is
 132 * specified as an absolute &CLOCK_MONOTONIC value in units of ns.
 133 *
 134 * Similarly, &DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT takes an array of syncobj
 135 * handles as well as an array of u64 points and does a host-side wait on all
 136 * of syncobj fences at the given points simultaneously.
 137 *
 138 * &DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT also adds the ability to wait for a given
 139 * fence to materialize on the timeline without waiting for the fence to be
 140 * signaled by using the &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE flag. This
 141 * requirement is inherited from the wait-before-signal behavior required by
 142 * the Vulkan timeline semaphore API.
 143 *
 144 * Alternatively, &DRM_IOCTL_SYNCOBJ_EVENTFD can be used to wait without
 145 * blocking: an eventfd will be signaled when the syncobj is. This is useful to
 146 * integrate the wait in an event loop.
 147 *
 148 *
 149 * Import/export of syncobjs
 150 * -------------------------
 151 *
 152 * &DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE and &DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD
 153 * provide two mechanisms for import/export of syncobjs.
 154 *
 155 * The first lets the client import or export an entire syncobj to a file
 156 * descriptor.
 157 * These fd's are opaque and have no other use case, except passing the
 158 * syncobj between processes.
 159 * All exported file descriptors and any syncobj handles created as a
 160 * result of importing those file descriptors own a reference to the
 161 * same underlying struct &drm_syncobj and the syncobj can be used
 162 * persistently across all the processes with which it is shared.
 163 * The syncobj is freed only once the last reference is dropped.
 164 * Unlike dma-buf, importing a syncobj creates a new handle (with its own
 165 * reference) for every import instead of de-duplicating.
 166 * The primary use-case of this persistent import/export is for shared
 167 * Vulkan fences and semaphores.
 168 *
 169 * The second import/export mechanism, which is indicated by
 170 * &DRM_SYNCOBJ_FD_TO_HANDLE_FLAGS_IMPORT_SYNC_FILE or
 171 * &DRM_SYNCOBJ_HANDLE_TO_FD_FLAGS_EXPORT_SYNC_FILE lets the client
 172 * import/export the syncobj's current fence from/to a &sync_file.
 173 * When a syncobj is exported to a sync file, that sync file wraps the
 174 * sycnobj's fence at the time of export and any later signal or reset
 175 * operations on the syncobj will not affect the exported sync file.
 176 * When a sync file is imported into a syncobj, the syncobj's fence is set
 177 * to the fence wrapped by that sync file.
 178 * Because sync files are immutable, resetting or signaling the syncobj
 179 * will not affect any sync files whose fences have been imported into the
 180 * syncobj.
 181 *
 182 *
 183 * Import/export of timeline points in timeline syncobjs
 184 * -----------------------------------------------------
 185 *
 186 * &DRM_IOCTL_SYNCOBJ_TRANSFER provides a mechanism to transfer a struct
 187 * &dma_fence_chain of a syncobj at a given u64 point to another u64 point
 188 * into another syncobj.
 189 *
 190 * Note that if you want to transfer a struct &dma_fence_chain from a given
 191 * point on a timeline syncobj from/into a binary syncobj, you can use the
 192 * point 0 to mean take/replace the fence in the syncobj.
 193 */
 194
 195#include <linux/anon_inodes.h>
 196#include <linux/dma-fence-unwrap.h>
 197#include <linux/eventfd.h>
 198#include <linux/file.h>
 199#include <linux/fs.h>
 200#include <linux/sched/signal.h>
 201#include <linux/sync_file.h>
 202#include <linux/uaccess.h>
 203
 204#include <drm/drm.h>
 205#include <drm/drm_drv.h>
 206#include <drm/drm_file.h>
 207#include <drm/drm_gem.h>
 208#include <drm/drm_print.h>
 209#include <drm/drm_syncobj.h>
 210#include <drm/drm_utils.h>
 211
 212#include "drm_internal.h"
 213
 214struct syncobj_wait_entry {
 215	struct list_head node;
 216	struct task_struct *task;
 217	struct dma_fence *fence;
 218	struct dma_fence_cb fence_cb;
 219	u64    point;
 220};
 221
 222static void syncobj_wait_syncobj_func(struct drm_syncobj *syncobj,
 223				      struct syncobj_wait_entry *wait);
 224
 225struct syncobj_eventfd_entry {
 226	struct list_head node;
 227	struct dma_fence *fence;
 228	struct dma_fence_cb fence_cb;
 229	struct drm_syncobj *syncobj;
 230	struct eventfd_ctx *ev_fd_ctx;
 231	u64 point;
 232	u32 flags;
 233};
 234
 235static void
 236syncobj_eventfd_entry_func(struct drm_syncobj *syncobj,
 237			   struct syncobj_eventfd_entry *entry);
 238
 239/**
 240 * drm_syncobj_find - lookup and reference a sync object.
 241 * @file_private: drm file private pointer
 242 * @handle: sync object handle to lookup.
 243 *
 244 * Returns a reference to the syncobj pointed to by handle or NULL. The
 245 * reference must be released by calling drm_syncobj_put().
 246 */
 247struct drm_syncobj *drm_syncobj_find(struct drm_file *file_private,
 248				     u32 handle)
 249{
 250	struct drm_syncobj *syncobj;
 251
 252	spin_lock(&file_private->syncobj_table_lock);
 253
 254	/* Check if we currently have a reference on the object */
 255	syncobj = idr_find(&file_private->syncobj_idr, handle);
 256	if (syncobj)
 257		drm_syncobj_get(syncobj);
 258
 259	spin_unlock(&file_private->syncobj_table_lock);
 260
 261	return syncobj;
 262}
 263EXPORT_SYMBOL(drm_syncobj_find);
 264
 265static void drm_syncobj_fence_add_wait(struct drm_syncobj *syncobj,
 266				       struct syncobj_wait_entry *wait)
 267{
 268	struct dma_fence *fence;
 269
 270	if (wait->fence)
 271		return;
 272
 273	spin_lock(&syncobj->lock);
 274	/* We've already tried once to get a fence and failed.  Now that we
 275	 * have the lock, try one more time just to be sure we don't add a
 276	 * callback when a fence has already been set.
 277	 */
 278	fence = dma_fence_get(rcu_dereference_protected(syncobj->fence, 1));
 279	if (!fence || dma_fence_chain_find_seqno(&fence, wait->point)) {
 280		dma_fence_put(fence);
 281		list_add_tail(&wait->node, &syncobj->cb_list);
 282	} else if (!fence) {
 283		wait->fence = dma_fence_get_stub();
 284	} else {
 285		wait->fence = fence;
 286	}
 287	spin_unlock(&syncobj->lock);
 288}
 289
 290static void drm_syncobj_remove_wait(struct drm_syncobj *syncobj,
 291				    struct syncobj_wait_entry *wait)
 292{
 293	if (!wait->node.next)
 294		return;
 295
 296	spin_lock(&syncobj->lock);
 297	list_del_init(&wait->node);
 298	spin_unlock(&syncobj->lock);
 299}
 300
 301static void
 302syncobj_eventfd_entry_free(struct syncobj_eventfd_entry *entry)
 303{
 304	eventfd_ctx_put(entry->ev_fd_ctx);
 305	dma_fence_put(entry->fence);
 306	/* This happens either inside the syncobj lock, or after the node has
 307	 * already been removed from the list.
 308	 */
 309	list_del(&entry->node);
 310	kfree(entry);
 311}
 312
 313static void
 314drm_syncobj_add_eventfd(struct drm_syncobj *syncobj,
 315			struct syncobj_eventfd_entry *entry)
 316{
 317	spin_lock(&syncobj->lock);
 318	list_add_tail(&entry->node, &syncobj->ev_fd_list);
 319	syncobj_eventfd_entry_func(syncobj, entry);
 320	spin_unlock(&syncobj->lock);
 321}
 322
 323/**
 324 * drm_syncobj_add_point - add new timeline point to the syncobj
 325 * @syncobj: sync object to add timeline point do
 326 * @chain: chain node to use to add the point
 327 * @fence: fence to encapsulate in the chain node
 328 * @point: sequence number to use for the point
 329 *
 330 * Add the chain node as new timeline point to the syncobj.
 331 */
 332void drm_syncobj_add_point(struct drm_syncobj *syncobj,
 333			   struct dma_fence_chain *chain,
 334			   struct dma_fence *fence,
 335			   uint64_t point)
 336{
 337	struct syncobj_wait_entry *wait_cur, *wait_tmp;
 338	struct syncobj_eventfd_entry *ev_fd_cur, *ev_fd_tmp;
 339	struct dma_fence *prev;
 340
 341	dma_fence_get(fence);
 342
 343	spin_lock(&syncobj->lock);
 344
 345	prev = drm_syncobj_fence_get(syncobj);
 346	/* You are adding an unorder point to timeline, which could cause payload returned from query_ioctl is 0! */
 347	if (prev && prev->seqno >= point)
 348		DRM_DEBUG("You are adding an unorder point to timeline!\n");
 349	dma_fence_chain_init(chain, prev, fence, point);
 350	rcu_assign_pointer(syncobj->fence, &chain->base);
 351
 352	list_for_each_entry_safe(wait_cur, wait_tmp, &syncobj->cb_list, node)
 353		syncobj_wait_syncobj_func(syncobj, wait_cur);
 354	list_for_each_entry_safe(ev_fd_cur, ev_fd_tmp, &syncobj->ev_fd_list, node)
 355		syncobj_eventfd_entry_func(syncobj, ev_fd_cur);
 356	spin_unlock(&syncobj->lock);
 357
 358	/* Walk the chain once to trigger garbage collection */
 359	dma_fence_chain_for_each(fence, prev);
 360	dma_fence_put(prev);
 361}
 362EXPORT_SYMBOL(drm_syncobj_add_point);
 363
 364/**
 365 * drm_syncobj_replace_fence - replace fence in a sync object.
 366 * @syncobj: Sync object to replace fence in
 367 * @fence: fence to install in sync file.
 368 *
 369 * This replaces the fence on a sync object.
 370 */
 371void drm_syncobj_replace_fence(struct drm_syncobj *syncobj,
 372			       struct dma_fence *fence)
 373{
 374	struct dma_fence *old_fence;
 375	struct syncobj_wait_entry *wait_cur, *wait_tmp;
 376	struct syncobj_eventfd_entry *ev_fd_cur, *ev_fd_tmp;
 377
 378	if (fence)
 379		dma_fence_get(fence);
 380
 381	spin_lock(&syncobj->lock);
 382
 383	old_fence = rcu_dereference_protected(syncobj->fence,
 384					      lockdep_is_held(&syncobj->lock));
 385	rcu_assign_pointer(syncobj->fence, fence);
 386
 387	if (fence != old_fence) {
 388		list_for_each_entry_safe(wait_cur, wait_tmp, &syncobj->cb_list, node)
 389			syncobj_wait_syncobj_func(syncobj, wait_cur);
 390		list_for_each_entry_safe(ev_fd_cur, ev_fd_tmp, &syncobj->ev_fd_list, node)
 391			syncobj_eventfd_entry_func(syncobj, ev_fd_cur);
 392	}
 393
 394	spin_unlock(&syncobj->lock);
 395
 396	dma_fence_put(old_fence);
 397}
 398EXPORT_SYMBOL(drm_syncobj_replace_fence);
 399
 400/**
 401 * drm_syncobj_assign_null_handle - assign a stub fence to the sync object
 402 * @syncobj: sync object to assign the fence on
 403 *
 404 * Assign a already signaled stub fence to the sync object.
 405 */
 406static int drm_syncobj_assign_null_handle(struct drm_syncobj *syncobj)
 407{
 408	struct dma_fence *fence = dma_fence_allocate_private_stub(ktime_get());
 409
 410	if (!fence)
 411		return -ENOMEM;
 412
 413	drm_syncobj_replace_fence(syncobj, fence);
 414	dma_fence_put(fence);
 415	return 0;
 416}
 417
 418/* 5s default for wait submission */
 419#define DRM_SYNCOBJ_WAIT_FOR_SUBMIT_TIMEOUT 5000000000ULL
 420/**
 421 * drm_syncobj_find_fence - lookup and reference the fence in a sync object
 422 * @file_private: drm file private pointer
 423 * @handle: sync object handle to lookup.
 424 * @point: timeline point
 425 * @flags: DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT or not
 426 * @fence: out parameter for the fence
 427 *
 428 * This is just a convenience function that combines drm_syncobj_find() and
 429 * drm_syncobj_fence_get().
 430 *
 431 * Returns 0 on success or a negative error value on failure. On success @fence
 432 * contains a reference to the fence, which must be released by calling
 433 * dma_fence_put().
 434 */
 435int drm_syncobj_find_fence(struct drm_file *file_private,
 436			   u32 handle, u64 point, u64 flags,
 437			   struct dma_fence **fence)
 438{
 439	struct drm_syncobj *syncobj = drm_syncobj_find(file_private, handle);
 440	struct syncobj_wait_entry wait;
 441	u64 timeout = nsecs_to_jiffies64(DRM_SYNCOBJ_WAIT_FOR_SUBMIT_TIMEOUT);
 442	int ret;
 443
 444	if (flags & ~DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)
 445		return -EINVAL;
 446
 447	if (!syncobj)
 448		return -ENOENT;
 449
 450	/* Waiting for userspace with locks help is illegal cause that can
 451	 * trivial deadlock with page faults for example. Make lockdep complain
 452	 * about it early on.
 453	 */
 454	if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) {
 455		might_sleep();
 456		lockdep_assert_none_held_once();
 457	}
 458
 459	*fence = drm_syncobj_fence_get(syncobj);
 460
 461	if (*fence) {
 462		ret = dma_fence_chain_find_seqno(fence, point);
 463		if (!ret) {
 464			/* If the requested seqno is already signaled
 465			 * drm_syncobj_find_fence may return a NULL
 466			 * fence. To make sure the recipient gets
 467			 * signalled, use a new fence instead.
 468			 */
 469			if (!*fence)
 470				*fence = dma_fence_get_stub();
 471
 472			goto out;
 473		}
 474		dma_fence_put(*fence);
 475	} else {
 476		ret = -EINVAL;
 477	}
 478
 479	if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT))
 480		goto out;
 481
 482	memset(&wait, 0, sizeof(wait));
 483	wait.task = current;
 484	wait.point = point;
 485	drm_syncobj_fence_add_wait(syncobj, &wait);
 486
 487	do {
 488		set_current_state(TASK_INTERRUPTIBLE);
 489		if (wait.fence) {
 490			ret = 0;
 491			break;
 492		}
 493                if (timeout == 0) {
 494                        ret = -ETIME;
 495                        break;
 496                }
 497
 498		if (signal_pending(current)) {
 499			ret = -ERESTARTSYS;
 500			break;
 501		}
 502
 503                timeout = schedule_timeout(timeout);
 504	} while (1);
 505
 506	__set_current_state(TASK_RUNNING);
 507	*fence = wait.fence;
 508
 509	if (wait.node.next)
 510		drm_syncobj_remove_wait(syncobj, &wait);
 511
 512out:
 513	drm_syncobj_put(syncobj);
 514
 515	return ret;
 516}
 517EXPORT_SYMBOL(drm_syncobj_find_fence);
 518
 519/**
 520 * drm_syncobj_free - free a sync object.
 521 * @kref: kref to free.
 522 *
 523 * Only to be called from kref_put in drm_syncobj_put.
 524 */
 525void drm_syncobj_free(struct kref *kref)
 526{
 527	struct drm_syncobj *syncobj = container_of(kref,
 528						   struct drm_syncobj,
 529						   refcount);
 530	struct syncobj_eventfd_entry *ev_fd_cur, *ev_fd_tmp;
 531
 532	drm_syncobj_replace_fence(syncobj, NULL);
 533
 534	list_for_each_entry_safe(ev_fd_cur, ev_fd_tmp, &syncobj->ev_fd_list, node)
 535		syncobj_eventfd_entry_free(ev_fd_cur);
 536
 537	kfree(syncobj);
 538}
 539EXPORT_SYMBOL(drm_syncobj_free);
 540
 541/**
 542 * drm_syncobj_create - create a new syncobj
 543 * @out_syncobj: returned syncobj
 544 * @flags: DRM_SYNCOBJ_* flags
 545 * @fence: if non-NULL, the syncobj will represent this fence
 546 *
 547 * This is the first function to create a sync object. After creating, drivers
 548 * probably want to make it available to userspace, either through
 549 * drm_syncobj_get_handle() or drm_syncobj_get_fd().
 550 *
 551 * Returns 0 on success or a negative error value on failure.
 552 */
 553int drm_syncobj_create(struct drm_syncobj **out_syncobj, uint32_t flags,
 554		       struct dma_fence *fence)
 555{
 556	int ret;
 557	struct drm_syncobj *syncobj;
 558
 559	syncobj = kzalloc(sizeof(struct drm_syncobj), GFP_KERNEL);
 560	if (!syncobj)
 561		return -ENOMEM;
 562
 563	kref_init(&syncobj->refcount);
 564	INIT_LIST_HEAD(&syncobj->cb_list);
 565	INIT_LIST_HEAD(&syncobj->ev_fd_list);
 566	spin_lock_init(&syncobj->lock);
 567
 568	if (flags & DRM_SYNCOBJ_CREATE_SIGNALED) {
 569		ret = drm_syncobj_assign_null_handle(syncobj);
 570		if (ret < 0) {
 571			drm_syncobj_put(syncobj);
 572			return ret;
 573		}
 574	}
 575
 576	if (fence)
 577		drm_syncobj_replace_fence(syncobj, fence);
 578
 579	*out_syncobj = syncobj;
 580	return 0;
 581}
 582EXPORT_SYMBOL(drm_syncobj_create);
 583
 584/**
 585 * drm_syncobj_get_handle - get a handle from a syncobj
 586 * @file_private: drm file private pointer
 587 * @syncobj: Sync object to export
 588 * @handle: out parameter with the new handle
 589 *
 590 * Exports a sync object created with drm_syncobj_create() as a handle on
 591 * @file_private to userspace.
 592 *
 593 * Returns 0 on success or a negative error value on failure.
 594 */
 595int drm_syncobj_get_handle(struct drm_file *file_private,
 596			   struct drm_syncobj *syncobj, u32 *handle)
 597{
 598	int ret;
 599
 600	/* take a reference to put in the idr */
 601	drm_syncobj_get(syncobj);
 602
 603	idr_preload(GFP_KERNEL);
 604	spin_lock(&file_private->syncobj_table_lock);
 605	ret = idr_alloc(&file_private->syncobj_idr, syncobj, 1, 0, GFP_NOWAIT);
 606	spin_unlock(&file_private->syncobj_table_lock);
 607
 608	idr_preload_end();
 609
 610	if (ret < 0) {
 611		drm_syncobj_put(syncobj);
 612		return ret;
 613	}
 614
 615	*handle = ret;
 616	return 0;
 617}
 618EXPORT_SYMBOL(drm_syncobj_get_handle);
 619
 620static int drm_syncobj_create_as_handle(struct drm_file *file_private,
 621					u32 *handle, uint32_t flags)
 622{
 623	int ret;
 624	struct drm_syncobj *syncobj;
 625
 626	ret = drm_syncobj_create(&syncobj, flags, NULL);
 627	if (ret)
 628		return ret;
 629
 630	ret = drm_syncobj_get_handle(file_private, syncobj, handle);
 631	drm_syncobj_put(syncobj);
 632	return ret;
 633}
 634
 635static int drm_syncobj_destroy(struct drm_file *file_private,
 636			       u32 handle)
 637{
 638	struct drm_syncobj *syncobj;
 639
 640	spin_lock(&file_private->syncobj_table_lock);
 641	syncobj = idr_remove(&file_private->syncobj_idr, handle);
 642	spin_unlock(&file_private->syncobj_table_lock);
 643
 644	if (!syncobj)
 645		return -EINVAL;
 646
 647	drm_syncobj_put(syncobj);
 648	return 0;
 649}
 650
 651static int drm_syncobj_file_release(struct inode *inode, struct file *file)
 652{
 653	struct drm_syncobj *syncobj = file->private_data;
 654
 655	drm_syncobj_put(syncobj);
 656	return 0;
 657}
 658
 659static const struct file_operations drm_syncobj_file_fops = {
 660	.release = drm_syncobj_file_release,
 661};
 662
 663/**
 664 * drm_syncobj_get_fd - get a file descriptor from a syncobj
 665 * @syncobj: Sync object to export
 666 * @p_fd: out parameter with the new file descriptor
 667 *
 668 * Exports a sync object created with drm_syncobj_create() as a file descriptor.
 669 *
 670 * Returns 0 on success or a negative error value on failure.
 671 */
 672int drm_syncobj_get_fd(struct drm_syncobj *syncobj, int *p_fd)
 673{
 674	struct file *file;
 675	int fd;
 676
 677	fd = get_unused_fd_flags(O_CLOEXEC);
 678	if (fd < 0)
 679		return fd;
 680
 681	file = anon_inode_getfile("syncobj_file",
 682				  &drm_syncobj_file_fops,
 683				  syncobj, 0);
 684	if (IS_ERR(file)) {
 685		put_unused_fd(fd);
 686		return PTR_ERR(file);
 687	}
 688
 689	drm_syncobj_get(syncobj);
 690	fd_install(fd, file);
 691
 692	*p_fd = fd;
 693	return 0;
 694}
 695EXPORT_SYMBOL(drm_syncobj_get_fd);
 696
 697static int drm_syncobj_handle_to_fd(struct drm_file *file_private,
 698				    u32 handle, int *p_fd)
 699{
 700	struct drm_syncobj *syncobj = drm_syncobj_find(file_private, handle);
 701	int ret;
 702
 703	if (!syncobj)
 704		return -EINVAL;
 705
 706	ret = drm_syncobj_get_fd(syncobj, p_fd);
 707	drm_syncobj_put(syncobj);
 708	return ret;
 709}
 710
 711static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
 712				    int fd, u32 *handle)
 713{
 714	struct drm_syncobj *syncobj;
 715	CLASS(fd, f)(fd);
 716	int ret;
 717
 718	if (fd_empty(f))
 719		return -EINVAL;
 720
 721	if (fd_file(f)->f_op != &drm_syncobj_file_fops)
 
 722		return -EINVAL;
 
 723
 724	/* take a reference to put in the idr */
 725	syncobj = fd_file(f)->private_data;
 726	drm_syncobj_get(syncobj);
 727
 728	idr_preload(GFP_KERNEL);
 729	spin_lock(&file_private->syncobj_table_lock);
 730	ret = idr_alloc(&file_private->syncobj_idr, syncobj, 1, 0, GFP_NOWAIT);
 731	spin_unlock(&file_private->syncobj_table_lock);
 732	idr_preload_end();
 733
 734	if (ret > 0) {
 735		*handle = ret;
 736		ret = 0;
 737	} else
 738		drm_syncobj_put(syncobj);
 739
 
 740	return ret;
 741}
 742
 743static int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,
 744					      int fd, int handle)
 745{
 746	struct dma_fence *fence = sync_file_get_fence(fd);
 747	struct drm_syncobj *syncobj;
 748
 749	if (!fence)
 750		return -EINVAL;
 751
 752	syncobj = drm_syncobj_find(file_private, handle);
 753	if (!syncobj) {
 754		dma_fence_put(fence);
 755		return -ENOENT;
 756	}
 757
 758	drm_syncobj_replace_fence(syncobj, fence);
 759	dma_fence_put(fence);
 760	drm_syncobj_put(syncobj);
 761	return 0;
 762}
 763
 764static int drm_syncobj_export_sync_file(struct drm_file *file_private,
 765					int handle, int *p_fd)
 766{
 767	int ret;
 768	struct dma_fence *fence;
 769	struct sync_file *sync_file;
 770	int fd = get_unused_fd_flags(O_CLOEXEC);
 771
 772	if (fd < 0)
 773		return fd;
 774
 775	ret = drm_syncobj_find_fence(file_private, handle, 0, 0, &fence);
 776	if (ret)
 777		goto err_put_fd;
 778
 779	sync_file = sync_file_create(fence);
 780
 781	dma_fence_put(fence);
 782
 783	if (!sync_file) {
 784		ret = -EINVAL;
 785		goto err_put_fd;
 786	}
 787
 788	fd_install(fd, sync_file->file);
 789
 790	*p_fd = fd;
 791	return 0;
 792err_put_fd:
 793	put_unused_fd(fd);
 794	return ret;
 795}
 796/**
 797 * drm_syncobj_open - initializes syncobj file-private structures at devnode open time
 798 * @file_private: drm file-private structure to set up
 799 *
 800 * Called at device open time, sets up the structure for handling refcounting
 801 * of sync objects.
 802 */
 803void
 804drm_syncobj_open(struct drm_file *file_private)
 805{
 806	idr_init_base(&file_private->syncobj_idr, 1);
 807	spin_lock_init(&file_private->syncobj_table_lock);
 808}
 809
 810static int
 811drm_syncobj_release_handle(int id, void *ptr, void *data)
 812{
 813	struct drm_syncobj *syncobj = ptr;
 814
 815	drm_syncobj_put(syncobj);
 816	return 0;
 817}
 818
 819/**
 820 * drm_syncobj_release - release file-private sync object resources
 821 * @file_private: drm file-private structure to clean up
 822 *
 823 * Called at close time when the filp is going away.
 824 *
 825 * Releases any remaining references on objects by this filp.
 826 */
 827void
 828drm_syncobj_release(struct drm_file *file_private)
 829{
 830	idr_for_each(&file_private->syncobj_idr,
 831		     &drm_syncobj_release_handle, file_private);
 832	idr_destroy(&file_private->syncobj_idr);
 833}
 834
 835int
 836drm_syncobj_create_ioctl(struct drm_device *dev, void *data,
 837			 struct drm_file *file_private)
 838{
 839	struct drm_syncobj_create *args = data;
 840
 841	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
 842		return -EOPNOTSUPP;
 843
 844	/* no valid flags yet */
 845	if (args->flags & ~DRM_SYNCOBJ_CREATE_SIGNALED)
 846		return -EINVAL;
 847
 848	return drm_syncobj_create_as_handle(file_private,
 849					    &args->handle, args->flags);
 850}
 851
 852int
 853drm_syncobj_destroy_ioctl(struct drm_device *dev, void *data,
 854			  struct drm_file *file_private)
 855{
 856	struct drm_syncobj_destroy *args = data;
 857
 858	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
 859		return -EOPNOTSUPP;
 860
 861	/* make sure padding is empty */
 862	if (args->pad)
 863		return -EINVAL;
 864	return drm_syncobj_destroy(file_private, args->handle);
 865}
 866
 867int
 868drm_syncobj_handle_to_fd_ioctl(struct drm_device *dev, void *data,
 869				   struct drm_file *file_private)
 870{
 871	struct drm_syncobj_handle *args = data;
 872
 873	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
 874		return -EOPNOTSUPP;
 875
 876	if (args->pad)
 877		return -EINVAL;
 878
 879	if (args->flags != 0 &&
 880	    args->flags != DRM_SYNCOBJ_HANDLE_TO_FD_FLAGS_EXPORT_SYNC_FILE)
 881		return -EINVAL;
 882
 883	if (args->flags & DRM_SYNCOBJ_HANDLE_TO_FD_FLAGS_EXPORT_SYNC_FILE)
 884		return drm_syncobj_export_sync_file(file_private, args->handle,
 885						    &args->fd);
 886
 887	return drm_syncobj_handle_to_fd(file_private, args->handle,
 888					&args->fd);
 889}
 890
 891int
 892drm_syncobj_fd_to_handle_ioctl(struct drm_device *dev, void *data,
 893				   struct drm_file *file_private)
 894{
 895	struct drm_syncobj_handle *args = data;
 896
 897	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
 898		return -EOPNOTSUPP;
 899
 900	if (args->pad)
 901		return -EINVAL;
 902
 903	if (args->flags != 0 &&
 904	    args->flags != DRM_SYNCOBJ_FD_TO_HANDLE_FLAGS_IMPORT_SYNC_FILE)
 905		return -EINVAL;
 906
 907	if (args->flags & DRM_SYNCOBJ_FD_TO_HANDLE_FLAGS_IMPORT_SYNC_FILE)
 908		return drm_syncobj_import_sync_file_fence(file_private,
 909							  args->fd,
 910							  args->handle);
 911
 912	return drm_syncobj_fd_to_handle(file_private, args->fd,
 913					&args->handle);
 914}
 915
 916static int drm_syncobj_transfer_to_timeline(struct drm_file *file_private,
 917					    struct drm_syncobj_transfer *args)
 918{
 919	struct drm_syncobj *timeline_syncobj = NULL;
 920	struct dma_fence *fence, *tmp;
 921	struct dma_fence_chain *chain;
 922	int ret;
 923
 924	timeline_syncobj = drm_syncobj_find(file_private, args->dst_handle);
 925	if (!timeline_syncobj) {
 926		return -ENOENT;
 927	}
 928	ret = drm_syncobj_find_fence(file_private, args->src_handle,
 929				     args->src_point, args->flags,
 930				     &tmp);
 931	if (ret)
 932		goto err_put_timeline;
 933
 934	fence = dma_fence_unwrap_merge(tmp);
 935	dma_fence_put(tmp);
 936	if (!fence) {
 937		ret = -ENOMEM;
 938		goto err_put_timeline;
 939	}
 940
 941	chain = dma_fence_chain_alloc();
 942	if (!chain) {
 943		ret = -ENOMEM;
 944		goto err_free_fence;
 945	}
 946
 947	drm_syncobj_add_point(timeline_syncobj, chain, fence, args->dst_point);
 948err_free_fence:
 949	dma_fence_put(fence);
 950err_put_timeline:
 951	drm_syncobj_put(timeline_syncobj);
 952
 953	return ret;
 954}
 955
 956static int
 957drm_syncobj_transfer_to_binary(struct drm_file *file_private,
 958			       struct drm_syncobj_transfer *args)
 959{
 960	struct drm_syncobj *binary_syncobj = NULL;
 961	struct dma_fence *fence;
 962	int ret;
 963
 964	binary_syncobj = drm_syncobj_find(file_private, args->dst_handle);
 965	if (!binary_syncobj)
 966		return -ENOENT;
 967	ret = drm_syncobj_find_fence(file_private, args->src_handle,
 968				     args->src_point, args->flags, &fence);
 969	if (ret)
 970		goto err;
 971	drm_syncobj_replace_fence(binary_syncobj, fence);
 972	dma_fence_put(fence);
 973err:
 974	drm_syncobj_put(binary_syncobj);
 975
 976	return ret;
 977}
 978int
 979drm_syncobj_transfer_ioctl(struct drm_device *dev, void *data,
 980			   struct drm_file *file_private)
 981{
 982	struct drm_syncobj_transfer *args = data;
 983	int ret;
 984
 985	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ_TIMELINE))
 986		return -EOPNOTSUPP;
 987
 988	if (args->pad)
 989		return -EINVAL;
 990
 991	if (args->dst_point)
 992		ret = drm_syncobj_transfer_to_timeline(file_private, args);
 993	else
 994		ret = drm_syncobj_transfer_to_binary(file_private, args);
 995
 996	return ret;
 997}
 998
 999static void syncobj_wait_fence_func(struct dma_fence *fence,
1000				    struct dma_fence_cb *cb)
1001{
1002	struct syncobj_wait_entry *wait =
1003		container_of(cb, struct syncobj_wait_entry, fence_cb);
1004
1005	wake_up_process(wait->task);
1006}
1007
1008static void syncobj_wait_syncobj_func(struct drm_syncobj *syncobj,
1009				      struct syncobj_wait_entry *wait)
1010{
1011	struct dma_fence *fence;
1012
1013	/* This happens inside the syncobj lock */
1014	fence = rcu_dereference_protected(syncobj->fence,
1015					  lockdep_is_held(&syncobj->lock));
1016	dma_fence_get(fence);
1017	if (!fence || dma_fence_chain_find_seqno(&fence, wait->point)) {
1018		dma_fence_put(fence);
1019		return;
1020	} else if (!fence) {
1021		wait->fence = dma_fence_get_stub();
1022	} else {
1023		wait->fence = fence;
1024	}
1025
1026	wake_up_process(wait->task);
1027	list_del_init(&wait->node);
1028}
1029
1030static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,
1031						  void __user *user_points,
1032						  uint32_t count,
1033						  uint32_t flags,
1034						  signed long timeout,
1035						  uint32_t *idx,
1036						  ktime_t *deadline)
1037{
1038	struct syncobj_wait_entry *entries;
1039	struct dma_fence *fence;
1040	uint64_t *points;
1041	uint32_t signaled_count, i;
1042
1043	if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
1044		     DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)) {
1045		might_sleep();
1046		lockdep_assert_none_held_once();
1047	}
1048
1049	points = kmalloc_array(count, sizeof(*points), GFP_KERNEL);
1050	if (points == NULL)
1051		return -ENOMEM;
1052
1053	if (!user_points) {
1054		memset(points, 0, count * sizeof(uint64_t));
1055
1056	} else if (copy_from_user(points, user_points,
1057				  sizeof(uint64_t) * count)) {
1058		timeout = -EFAULT;
1059		goto err_free_points;
1060	}
1061
1062	entries = kcalloc(count, sizeof(*entries), GFP_KERNEL);
1063	if (!entries) {
1064		timeout = -ENOMEM;
1065		goto err_free_points;
1066	}
1067	/* Walk the list of sync objects and initialize entries.  We do
1068	 * this up-front so that we can properly return -EINVAL if there is
1069	 * a syncobj with a missing fence and then never have the chance of
1070	 * returning -EINVAL again.
1071	 */
1072	signaled_count = 0;
1073	for (i = 0; i < count; ++i) {
1074		struct dma_fence *fence;
1075
1076		entries[i].task = current;
1077		entries[i].point = points[i];
1078		fence = drm_syncobj_fence_get(syncobjs[i]);
1079		if (!fence || dma_fence_chain_find_seqno(&fence, points[i])) {
1080			dma_fence_put(fence);
1081			if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
1082				     DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)) {
1083				continue;
1084			} else {
1085				timeout = -EINVAL;
1086				goto cleanup_entries;
1087			}
1088		}
1089
1090		if (fence)
1091			entries[i].fence = fence;
1092		else
1093			entries[i].fence = dma_fence_get_stub();
1094
1095		if ((flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE) ||
1096		    dma_fence_is_signaled(entries[i].fence)) {
1097			if (signaled_count == 0 && idx)
1098				*idx = i;
1099			signaled_count++;
1100		}
1101	}
1102
1103	if (signaled_count == count ||
1104	    (signaled_count > 0 &&
1105	     !(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL)))
1106		goto cleanup_entries;
1107
1108	/* There's a very annoying laxness in the dma_fence API here, in
1109	 * that backends are not required to automatically report when a
1110	 * fence is signaled prior to fence->ops->enable_signaling() being
1111	 * called.  So here if we fail to match signaled_count, we need to
1112	 * fallthough and try a 0 timeout wait!
1113	 */
1114
1115	if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
1116		     DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)) {
1117		for (i = 0; i < count; ++i)
1118			drm_syncobj_fence_add_wait(syncobjs[i], &entries[i]);
1119	}
1120
1121	if (deadline) {
1122		for (i = 0; i < count; ++i) {
1123			fence = entries[i].fence;
1124			if (!fence)
1125				continue;
1126			dma_fence_set_deadline(fence, *deadline);
1127		}
1128	}
1129
1130	do {
1131		set_current_state(TASK_INTERRUPTIBLE);
1132
1133		signaled_count = 0;
1134		for (i = 0; i < count; ++i) {
1135			fence = entries[i].fence;
1136			if (!fence)
1137				continue;
1138
1139			if ((flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE) ||
1140			    dma_fence_is_signaled(fence) ||
1141			    (!entries[i].fence_cb.func &&
1142			     dma_fence_add_callback(fence,
1143						    &entries[i].fence_cb,
1144						    syncobj_wait_fence_func))) {
1145				/* The fence has been signaled */
1146				if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL) {
1147					signaled_count++;
1148				} else {
1149					if (idx)
1150						*idx = i;
1151					goto done_waiting;
1152				}
1153			}
1154		}
1155
1156		if (signaled_count == count)
1157			goto done_waiting;
1158
1159		if (timeout == 0) {
1160			timeout = -ETIME;
1161			goto done_waiting;
1162		}
1163
1164		if (signal_pending(current)) {
1165			timeout = -ERESTARTSYS;
1166			goto done_waiting;
1167		}
1168
1169		timeout = schedule_timeout(timeout);
1170	} while (1);
1171
1172done_waiting:
1173	__set_current_state(TASK_RUNNING);
1174
1175cleanup_entries:
1176	for (i = 0; i < count; ++i) {
1177		drm_syncobj_remove_wait(syncobjs[i], &entries[i]);
1178		if (entries[i].fence_cb.func)
1179			dma_fence_remove_callback(entries[i].fence,
1180						  &entries[i].fence_cb);
1181		dma_fence_put(entries[i].fence);
1182	}
1183	kfree(entries);
1184
1185err_free_points:
1186	kfree(points);
1187
1188	return timeout;
1189}
1190
1191/**
1192 * drm_timeout_abs_to_jiffies - calculate jiffies timeout from absolute value
1193 *
1194 * @timeout_nsec: timeout nsec component in ns, 0 for poll
1195 *
1196 * Calculate the timeout in jiffies from an absolute time in sec/nsec.
1197 */
1198signed long drm_timeout_abs_to_jiffies(int64_t timeout_nsec)
1199{
1200	ktime_t abs_timeout, now;
1201	u64 timeout_ns, timeout_jiffies64;
1202
1203	/* make 0 timeout means poll - absolute 0 doesn't seem valid */
1204	if (timeout_nsec == 0)
1205		return 0;
1206
1207	abs_timeout = ns_to_ktime(timeout_nsec);
1208	now = ktime_get();
1209
1210	if (!ktime_after(abs_timeout, now))
1211		return 0;
1212
1213	timeout_ns = ktime_to_ns(ktime_sub(abs_timeout, now));
1214
1215	timeout_jiffies64 = nsecs_to_jiffies64(timeout_ns);
1216	/*  clamp timeout to avoid infinite timeout */
1217	if (timeout_jiffies64 >= MAX_SCHEDULE_TIMEOUT - 1)
1218		return MAX_SCHEDULE_TIMEOUT - 1;
1219
1220	return timeout_jiffies64 + 1;
1221}
1222EXPORT_SYMBOL(drm_timeout_abs_to_jiffies);
1223
1224static int drm_syncobj_array_wait(struct drm_device *dev,
1225				  struct drm_file *file_private,
1226				  struct drm_syncobj_wait *wait,
1227				  struct drm_syncobj_timeline_wait *timeline_wait,
1228				  struct drm_syncobj **syncobjs, bool timeline,
1229				  ktime_t *deadline)
1230{
1231	signed long timeout = 0;
1232	uint32_t first = ~0;
1233
1234	if (!timeline) {
1235		timeout = drm_timeout_abs_to_jiffies(wait->timeout_nsec);
1236		timeout = drm_syncobj_array_wait_timeout(syncobjs,
1237							 NULL,
1238							 wait->count_handles,
1239							 wait->flags,
1240							 timeout, &first,
1241							 deadline);
1242		if (timeout < 0)
1243			return timeout;
1244		wait->first_signaled = first;
1245	} else {
1246		timeout = drm_timeout_abs_to_jiffies(timeline_wait->timeout_nsec);
1247		timeout = drm_syncobj_array_wait_timeout(syncobjs,
1248							 u64_to_user_ptr(timeline_wait->points),
1249							 timeline_wait->count_handles,
1250							 timeline_wait->flags,
1251							 timeout, &first,
1252							 deadline);
1253		if (timeout < 0)
1254			return timeout;
1255		timeline_wait->first_signaled = first;
1256	}
1257	return 0;
1258}
1259
1260static int drm_syncobj_array_find(struct drm_file *file_private,
1261				  void __user *user_handles,
1262				  uint32_t count_handles,
1263				  struct drm_syncobj ***syncobjs_out)
1264{
1265	uint32_t i, *handles;
1266	struct drm_syncobj **syncobjs;
1267	int ret;
1268
1269	handles = kmalloc_array(count_handles, sizeof(*handles), GFP_KERNEL);
1270	if (handles == NULL)
1271		return -ENOMEM;
1272
1273	if (copy_from_user(handles, user_handles,
1274			   sizeof(uint32_t) * count_handles)) {
1275		ret = -EFAULT;
1276		goto err_free_handles;
1277	}
1278
1279	syncobjs = kmalloc_array(count_handles, sizeof(*syncobjs), GFP_KERNEL);
1280	if (syncobjs == NULL) {
1281		ret = -ENOMEM;
1282		goto err_free_handles;
1283	}
1284
1285	for (i = 0; i < count_handles; i++) {
1286		syncobjs[i] = drm_syncobj_find(file_private, handles[i]);
1287		if (!syncobjs[i]) {
1288			ret = -ENOENT;
1289			goto err_put_syncobjs;
1290		}
1291	}
1292
1293	kfree(handles);
1294	*syncobjs_out = syncobjs;
1295	return 0;
1296
1297err_put_syncobjs:
1298	while (i-- > 0)
1299		drm_syncobj_put(syncobjs[i]);
1300	kfree(syncobjs);
1301err_free_handles:
1302	kfree(handles);
1303
1304	return ret;
1305}
1306
1307static void drm_syncobj_array_free(struct drm_syncobj **syncobjs,
1308				   uint32_t count)
1309{
1310	uint32_t i;
1311
1312	for (i = 0; i < count; i++)
1313		drm_syncobj_put(syncobjs[i]);
1314	kfree(syncobjs);
1315}
1316
1317int
1318drm_syncobj_wait_ioctl(struct drm_device *dev, void *data,
1319		       struct drm_file *file_private)
1320{
1321	struct drm_syncobj_wait *args = data;
1322	struct drm_syncobj **syncobjs;
1323	unsigned int possible_flags;
1324	ktime_t t, *tp = NULL;
1325	int ret = 0;
1326
1327	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
1328		return -EOPNOTSUPP;
1329
1330	possible_flags = DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL |
1331			 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
1332			 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_DEADLINE;
1333
1334	if (args->flags & ~possible_flags)
1335		return -EINVAL;
1336
1337	if (args->count_handles == 0)
1338		return 0;
1339
1340	ret = drm_syncobj_array_find(file_private,
1341				     u64_to_user_ptr(args->handles),
1342				     args->count_handles,
1343				     &syncobjs);
1344	if (ret < 0)
1345		return ret;
1346
1347	if (args->flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_DEADLINE) {
1348		t = ns_to_ktime(args->deadline_nsec);
1349		tp = &t;
1350	}
1351
1352	ret = drm_syncobj_array_wait(dev, file_private,
1353				     args, NULL, syncobjs, false, tp);
1354
1355	drm_syncobj_array_free(syncobjs, args->count_handles);
1356
1357	return ret;
1358}
1359
1360int
1361drm_syncobj_timeline_wait_ioctl(struct drm_device *dev, void *data,
1362				struct drm_file *file_private)
1363{
1364	struct drm_syncobj_timeline_wait *args = data;
1365	struct drm_syncobj **syncobjs;
1366	unsigned int possible_flags;
1367	ktime_t t, *tp = NULL;
1368	int ret = 0;
1369
1370	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ_TIMELINE))
1371		return -EOPNOTSUPP;
1372
1373	possible_flags = DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL |
1374			 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
1375			 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE |
1376			 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_DEADLINE;
1377
1378	if (args->flags & ~possible_flags)
1379		return -EINVAL;
1380
1381	if (args->count_handles == 0)
1382		return 0;
1383
1384	ret = drm_syncobj_array_find(file_private,
1385				     u64_to_user_ptr(args->handles),
1386				     args->count_handles,
1387				     &syncobjs);
1388	if (ret < 0)
1389		return ret;
1390
1391	if (args->flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_DEADLINE) {
1392		t = ns_to_ktime(args->deadline_nsec);
1393		tp = &t;
1394	}
1395
1396	ret = drm_syncobj_array_wait(dev, file_private,
1397				     NULL, args, syncobjs, true, tp);
1398
1399	drm_syncobj_array_free(syncobjs, args->count_handles);
1400
1401	return ret;
1402}
1403
1404static void syncobj_eventfd_entry_fence_func(struct dma_fence *fence,
1405					     struct dma_fence_cb *cb)
1406{
1407	struct syncobj_eventfd_entry *entry =
1408		container_of(cb, struct syncobj_eventfd_entry, fence_cb);
1409
1410	eventfd_signal(entry->ev_fd_ctx);
1411	syncobj_eventfd_entry_free(entry);
1412}
1413
1414static void
1415syncobj_eventfd_entry_func(struct drm_syncobj *syncobj,
1416			   struct syncobj_eventfd_entry *entry)
1417{
1418	int ret;
1419	struct dma_fence *fence;
1420
1421	/* This happens inside the syncobj lock */
1422	fence = dma_fence_get(rcu_dereference_protected(syncobj->fence, 1));
1423	if (!fence)
1424		return;
1425
1426	ret = dma_fence_chain_find_seqno(&fence, entry->point);
1427	if (ret != 0) {
1428		/* The given seqno has not been submitted yet. */
1429		dma_fence_put(fence);
1430		return;
1431	} else if (!fence) {
1432		/* If dma_fence_chain_find_seqno returns 0 but sets the fence
1433		 * to NULL, it implies that the given seqno is signaled and a
1434		 * later seqno has already been submitted. Assign a stub fence
1435		 * so that the eventfd still gets signaled below.
1436		 */
1437		fence = dma_fence_get_stub();
1438	}
1439
1440	list_del_init(&entry->node);
1441	entry->fence = fence;
1442
1443	if (entry->flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE) {
1444		eventfd_signal(entry->ev_fd_ctx);
1445		syncobj_eventfd_entry_free(entry);
1446	} else {
1447		ret = dma_fence_add_callback(fence, &entry->fence_cb,
1448					     syncobj_eventfd_entry_fence_func);
1449		if (ret == -ENOENT) {
1450			eventfd_signal(entry->ev_fd_ctx);
1451			syncobj_eventfd_entry_free(entry);
1452		}
1453	}
1454}
1455
1456int
1457drm_syncobj_eventfd_ioctl(struct drm_device *dev, void *data,
1458			  struct drm_file *file_private)
1459{
1460	struct drm_syncobj_eventfd *args = data;
1461	struct drm_syncobj *syncobj;
1462	struct eventfd_ctx *ev_fd_ctx;
1463	struct syncobj_eventfd_entry *entry;
1464	int ret;
1465
1466	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ_TIMELINE))
1467		return -EOPNOTSUPP;
1468
1469	if (args->flags & ~DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)
1470		return -EINVAL;
1471
1472	if (args->pad)
1473		return -EINVAL;
1474
1475	syncobj = drm_syncobj_find(file_private, args->handle);
1476	if (!syncobj)
1477		return -ENOENT;
1478
1479	ev_fd_ctx = eventfd_ctx_fdget(args->fd);
1480	if (IS_ERR(ev_fd_ctx)) {
1481		ret = PTR_ERR(ev_fd_ctx);
1482		goto err_fdget;
1483	}
1484
1485	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1486	if (!entry) {
1487		ret = -ENOMEM;
1488		goto err_kzalloc;
1489	}
1490	entry->syncobj = syncobj;
1491	entry->ev_fd_ctx = ev_fd_ctx;
1492	entry->point = args->point;
1493	entry->flags = args->flags;
1494
1495	drm_syncobj_add_eventfd(syncobj, entry);
1496	drm_syncobj_put(syncobj);
1497
1498	return 0;
1499
1500err_kzalloc:
1501	eventfd_ctx_put(ev_fd_ctx);
1502err_fdget:
1503	drm_syncobj_put(syncobj);
1504	return ret;
1505}
1506
1507int
1508drm_syncobj_reset_ioctl(struct drm_device *dev, void *data,
1509			struct drm_file *file_private)
1510{
1511	struct drm_syncobj_array *args = data;
1512	struct drm_syncobj **syncobjs;
1513	uint32_t i;
1514	int ret;
1515
1516	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
1517		return -EOPNOTSUPP;
1518
1519	if (args->pad != 0)
1520		return -EINVAL;
1521
1522	if (args->count_handles == 0)
1523		return -EINVAL;
1524
1525	ret = drm_syncobj_array_find(file_private,
1526				     u64_to_user_ptr(args->handles),
1527				     args->count_handles,
1528				     &syncobjs);
1529	if (ret < 0)
1530		return ret;
1531
1532	for (i = 0; i < args->count_handles; i++)
1533		drm_syncobj_replace_fence(syncobjs[i], NULL);
1534
1535	drm_syncobj_array_free(syncobjs, args->count_handles);
1536
1537	return 0;
1538}
1539
1540int
1541drm_syncobj_signal_ioctl(struct drm_device *dev, void *data,
1542			 struct drm_file *file_private)
1543{
1544	struct drm_syncobj_array *args = data;
1545	struct drm_syncobj **syncobjs;
1546	uint32_t i;
1547	int ret;
1548
1549	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ))
1550		return -EOPNOTSUPP;
1551
1552	if (args->pad != 0)
1553		return -EINVAL;
1554
1555	if (args->count_handles == 0)
1556		return -EINVAL;
1557
1558	ret = drm_syncobj_array_find(file_private,
1559				     u64_to_user_ptr(args->handles),
1560				     args->count_handles,
1561				     &syncobjs);
1562	if (ret < 0)
1563		return ret;
1564
1565	for (i = 0; i < args->count_handles; i++) {
1566		ret = drm_syncobj_assign_null_handle(syncobjs[i]);
1567		if (ret < 0)
1568			break;
1569	}
1570
1571	drm_syncobj_array_free(syncobjs, args->count_handles);
1572
1573	return ret;
1574}
1575
1576int
1577drm_syncobj_timeline_signal_ioctl(struct drm_device *dev, void *data,
1578				  struct drm_file *file_private)
1579{
1580	struct drm_syncobj_timeline_array *args = data;
1581	struct drm_syncobj **syncobjs;
1582	struct dma_fence_chain **chains;
1583	uint64_t *points;
1584	uint32_t i, j;
1585	int ret;
1586
1587	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ_TIMELINE))
1588		return -EOPNOTSUPP;
1589
1590	if (args->flags != 0)
1591		return -EINVAL;
1592
1593	if (args->count_handles == 0)
1594		return -EINVAL;
1595
1596	ret = drm_syncobj_array_find(file_private,
1597				     u64_to_user_ptr(args->handles),
1598				     args->count_handles,
1599				     &syncobjs);
1600	if (ret < 0)
1601		return ret;
1602
1603	points = kmalloc_array(args->count_handles, sizeof(*points),
1604			       GFP_KERNEL);
1605	if (!points) {
1606		ret = -ENOMEM;
1607		goto out;
1608	}
1609	if (!u64_to_user_ptr(args->points)) {
1610		memset(points, 0, args->count_handles * sizeof(uint64_t));
1611	} else if (copy_from_user(points, u64_to_user_ptr(args->points),
1612				  sizeof(uint64_t) * args->count_handles)) {
1613		ret = -EFAULT;
1614		goto err_points;
1615	}
1616
1617	chains = kmalloc_array(args->count_handles, sizeof(void *), GFP_KERNEL);
1618	if (!chains) {
1619		ret = -ENOMEM;
1620		goto err_points;
1621	}
1622	for (i = 0; i < args->count_handles; i++) {
1623		chains[i] = dma_fence_chain_alloc();
1624		if (!chains[i]) {
1625			for (j = 0; j < i; j++)
1626				dma_fence_chain_free(chains[j]);
1627			ret = -ENOMEM;
1628			goto err_chains;
1629		}
1630	}
1631
1632	for (i = 0; i < args->count_handles; i++) {
1633		struct dma_fence *fence = dma_fence_get_stub();
1634
1635		drm_syncobj_add_point(syncobjs[i], chains[i],
1636				      fence, points[i]);
1637		dma_fence_put(fence);
1638	}
1639err_chains:
1640	kfree(chains);
1641err_points:
1642	kfree(points);
1643out:
1644	drm_syncobj_array_free(syncobjs, args->count_handles);
1645
1646	return ret;
1647}
1648
1649int drm_syncobj_query_ioctl(struct drm_device *dev, void *data,
1650			    struct drm_file *file_private)
1651{
1652	struct drm_syncobj_timeline_array *args = data;
1653	struct drm_syncobj **syncobjs;
1654	uint64_t __user *points = u64_to_user_ptr(args->points);
1655	uint32_t i;
1656	int ret;
1657
1658	if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ_TIMELINE))
1659		return -EOPNOTSUPP;
1660
1661	if (args->flags & ~DRM_SYNCOBJ_QUERY_FLAGS_LAST_SUBMITTED)
1662		return -EINVAL;
1663
1664	if (args->count_handles == 0)
1665		return -EINVAL;
1666
1667	ret = drm_syncobj_array_find(file_private,
1668				     u64_to_user_ptr(args->handles),
1669				     args->count_handles,
1670				     &syncobjs);
1671	if (ret < 0)
1672		return ret;
1673
1674	for (i = 0; i < args->count_handles; i++) {
1675		struct dma_fence_chain *chain;
1676		struct dma_fence *fence;
1677		uint64_t point;
1678
1679		fence = drm_syncobj_fence_get(syncobjs[i]);
1680		chain = to_dma_fence_chain(fence);
1681		if (chain) {
1682			struct dma_fence *iter, *last_signaled =
1683				dma_fence_get(fence);
1684
1685			if (args->flags &
1686			    DRM_SYNCOBJ_QUERY_FLAGS_LAST_SUBMITTED) {
1687				point = fence->seqno;
1688			} else {
1689				dma_fence_chain_for_each(iter, fence) {
1690					if (iter->context != fence->context) {
1691						dma_fence_put(iter);
1692						/* It is most likely that timeline has
1693						* unorder points. */
1694						break;
1695					}
1696					dma_fence_put(last_signaled);
1697					last_signaled = dma_fence_get(iter);
1698				}
1699				point = dma_fence_is_signaled(last_signaled) ?
1700					last_signaled->seqno :
1701					to_dma_fence_chain(last_signaled)->prev_seqno;
1702			}
1703			dma_fence_put(last_signaled);
1704		} else {
1705			point = 0;
1706		}
1707		dma_fence_put(fence);
1708		ret = copy_to_user(&points[i], &point, sizeof(uint64_t));
1709		ret = ret ? -EFAULT : 0;
1710		if (ret)
1711			break;
1712	}
1713	drm_syncobj_array_free(syncobjs, args->count_handles);
1714
1715	return ret;
1716}