125 	u32 cmdbuf, target;  in host1x_reloc_copy_from_user()  local
128 	err = get_user(cmdbuf, &src->cmdbuf.handle);  in host1x_reloc_copy_from_user()
132 	err = get_user(dest->cmdbuf.offset, &src->cmdbuf.offset);  in host1x_reloc_copy_from_user()
150 	dest->cmdbuf.bo = host1x_bo_lookup(file, cmdbuf);  in host1x_reloc_copy_from_user()
151 	if (!dest->cmdbuf.bo)  in host1x_reloc_copy_from_user()
217 		struct drm_tegra_cmdbuf cmdbuf;  in tegra_drm_submit()  local
222 		if (copy_from_user(&cmdbuf, user_cmdbufs, sizeof(cmdbuf))) {  in tegra_drm_submit()
231 		if (cmdbuf.words > CDMA_GATHER_FETCHES_MAX_NB) {  in tegra_drm_submit()
236 		bo = host1x_bo_lookup(file, cmdbuf.handle);  in tegra_drm_submit()
242 		offset = (u64)cmdbuf.offset + (u64)cmdbuf.words * sizeof(u32);  in tegra_drm_submit()
256 		host1x_job_add_gather(job, bo, cmdbuf.words, cmdbuf.offset);  in tegra_drm_submit()
273 		obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);  in tegra_drm_submit()
281 		if (reloc->cmdbuf.offset & 3 ||  in tegra_drm_submit()
282 		    reloc->cmdbuf.offset >= obj->gem.size) {  in tegra_drm_submit()