1 /* 2 * Copyright © 2008 Intel Corporation 3 * 4 * Permission is hereby granted, free of charge, to any person obtaining a 5 * copy of this software and associated documentation files (the "Software"), 6 * to deal in the Software without restriction, including without limitation 7 * the rights to use, copy, modify, merge, publish, distribute, sublicense, 8 * and/or sell copies of the Software, and to permit persons to whom the 9 * Software is furnished to do so, subject to the following conditions: 10 * 11 * The above copyright notice and this permission notice (including the next 12 * paragraph) shall be included in all copies or substantial portions of the 13 * Software. 14 * 15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS 21 * IN THE SOFTWARE. 22 * 23 * Authors: 24 * Eric Anholt <eric@anholt.net> 25 * 26 */ 27 /*- 28 * Copyright (c) 2011 The FreeBSD Foundation 29 * All rights reserved. 30 * 31 * This software was developed by Konstantin Belousov under sponsorship from 32 * the FreeBSD Foundation. 33 * 34 * Redistribution and use in source and binary forms, with or without 35 * modification, are permitted provided that the following conditions 36 * are met: 37 * 1. Redistributions of source code must retain the above copyright 38 * notice, this list of conditions and the following disclaimer. 39 * 2. Redistributions in binary form must reproduce the above copyright 40 * notice, this list of conditions and the following disclaimer in the 41 * documentation and/or other materials provided with the distribution. 42 * 43 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 44 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 45 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 46 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 47 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 48 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 49 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 50 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 51 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 52 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 53 * SUCH DAMAGE. 54 */ 55 56 #include "opt_vm.h" 57 58 #include <sys/param.h> 59 #include <sys/systm.h> 60 #include <sys/limits.h> 61 #include <sys/lock.h> 62 #include <sys/mutex.h> 63 #include <sys/conf.h> 64 65 #include <vm/vm.h> 66 #include <vm/vm_page.h> 67 68 #include <linux/types.h> 69 #include <linux/mm.h> 70 #include <linux/module.h> 71 #include <drm/drmP.h> 72 #include <drm/drm_vma_manager.h> 73 #include <drm/drm_gem.h> 74 #include "drm_internal.h" 75 76 /** @file drm_gem.c 77 * 78 * This file provides some of the base ioctls and library routines for 79 * the graphics memory manager implemented by each device driver. 80 * 81 * Because various devices have different requirements in terms of 82 * synchronization and migration strategies, implementing that is left up to 83 * the driver, and all that the general API provides should be generic -- 84 * allocating objects, reading/writing data with the cpu, freeing objects. 85 * Even there, platform-dependent optimizations for reading/writing data with 86 * the CPU mean we'll likely hook those out to driver-specific calls. However, 87 * the DRI2 implementation wants to have at least allocate/mmap be generic. 88 * 89 * The goal was to have swap-backed object allocation managed through 90 * struct file. However, file descriptors as handles to a struct file have 91 * two major failings: 92 * - Process limits prevent more than 1024 or so being used at a time by 93 * default. 94 * - Inability to allocate high fds will aggravate the X Server's select() 95 * handling, and likely that of many GL client applications as well. 96 * 97 * This led to a plan of using our own integer IDs (called handles, following 98 * DRM terminology) to mimic fds, and implement the fd syscalls we need as 99 * ioctls. The objects themselves will still include the struct file so 100 * that we can transition to fds if the required kernel infrastructure shows 101 * up at a later date, and as our interface with shmfs for memory allocation. 102 */ 103 104 /* 105 * We make up offsets for buffer objects so we can recognize them at 106 * mmap time. 107 */ 108 109 /* pgoff in mmap is an unsigned long, so we need to make sure that 110 * the faked up offset will fit 111 */ 112 113 #if BITS_PER_LONG == 64 114 #define DRM_FILE_PAGE_OFFSET_START ((0xFFFFFFFFUL >> PAGE_SHIFT) + 1) 115 #define DRM_FILE_PAGE_OFFSET_SIZE ((0xFFFFFFFFUL >> PAGE_SHIFT) * 16) 116 #else 117 #define DRM_FILE_PAGE_OFFSET_START ((0xFFFFFFFUL >> PAGE_SHIFT) + 1) 118 #define DRM_FILE_PAGE_OFFSET_SIZE ((0xFFFFFFFUL >> PAGE_SHIFT) * 16) 119 #endif 120 121 /** 122 * drm_gem_init - Initialize the GEM device fields 123 * @dev: drm_devic structure to initialize 124 */ 125 int 126 drm_gem_init(struct drm_device *dev) 127 { 128 struct drm_gem_mm *mm; 129 130 lockinit(&dev->object_name_lock, "objnam", 0, LK_CANRECURSE); 131 idr_init(&dev->object_name_idr); 132 133 mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL); 134 if (!mm) { 135 DRM_ERROR("out of memory\n"); 136 return -ENOMEM; 137 } 138 139 dev->mm_private = mm; 140 141 if (drm_ht_create(&mm->offset_hash, 12)) { 142 kfree(mm); 143 return -ENOMEM; 144 } 145 146 mm->idxunr = new_unrhdr(0, DRM_GEM_MAX_IDX, NULL); 147 drm_mm_init(&mm->offset_manager, DRM_FILE_PAGE_OFFSET_START, 148 DRM_FILE_PAGE_OFFSET_SIZE); 149 drm_vma_offset_manager_init(&mm->vma_manager, 150 DRM_FILE_PAGE_OFFSET_START, 151 DRM_FILE_PAGE_OFFSET_SIZE); 152 153 return 0; 154 } 155 156 void 157 drm_gem_destroy(struct drm_device *dev) 158 { 159 struct drm_gem_mm *mm = dev->mm_private; 160 161 drm_mm_takedown(&mm->offset_manager); 162 drm_ht_remove(&mm->offset_hash); 163 164 drm_vma_offset_manager_destroy(&mm->vma_manager); 165 delete_unrhdr(mm->idxunr); 166 kfree(mm); 167 dev->mm_private = NULL; 168 } 169 170 /** 171 * Initialize an already allocated GEM object of the specified size with 172 * shmfs backing store. 173 */ 174 int drm_gem_object_init(struct drm_device *dev, 175 struct drm_gem_object *obj, size_t size) 176 { 177 drm_gem_private_object_init(dev, obj, size); 178 179 obj->vm_obj = default_pager_alloc(NULL, size, 180 VM_PROT_READ | VM_PROT_WRITE, 0); 181 182 return 0; 183 } 184 EXPORT_SYMBOL(drm_gem_object_init); 185 186 /** 187 * drm_gem_object_init - initialize an allocated private GEM object 188 * @dev: drm_device the object should be initialized for 189 * @obj: drm_gem_object to initialize 190 * @size: object size 191 * 192 * Initialize an already allocated GEM object of the specified size with 193 * no GEM provided backing store. Instead the caller is responsible for 194 * backing the object and handling it. 195 */ 196 void drm_gem_private_object_init(struct drm_device *dev, 197 struct drm_gem_object *obj, size_t size) 198 { 199 BUG_ON((size & (PAGE_SIZE - 1)) != 0); 200 201 obj->dev = dev; 202 obj->vm_obj = NULL; 203 204 kref_init(&obj->refcount); 205 obj->handle_count = 0; 206 obj->size = size; 207 drm_vma_node_reset(&obj->vma_node); 208 } 209 EXPORT_SYMBOL(drm_gem_private_object_init); 210 211 static void 212 drm_gem_remove_prime_handles(struct drm_gem_object *obj, struct drm_file *filp) 213 { 214 #if 0 215 if (obj->import_attach) { 216 drm_prime_remove_buf_handle(&filp->prime, 217 obj->import_attach->dmabuf); 218 } 219 if (obj->export_dma_buf) { 220 drm_prime_remove_buf_handle(&filp->prime, 221 obj->export_dma_buf); 222 } 223 #endif 224 } 225 226 static void drm_gem_object_ref_bug(struct kref *list_kref) 227 { 228 BUG(); 229 } 230 231 /** 232 * drm_gem_object_free - release resources bound to userspace handles 233 * @obj: GEM object to clean up. 234 * 235 * Called after the last handle to the object has been closed 236 * 237 * Removes any name for the object. Note that this must be 238 * called before drm_gem_object_free or we'll be touching 239 * freed memory 240 */ 241 static void drm_gem_object_handle_free(struct drm_gem_object *obj) 242 { 243 struct drm_device *dev = obj->dev; 244 245 /* Remove any name for this object */ 246 if (obj->name) { 247 idr_remove(&dev->object_name_idr, obj->name); 248 obj->name = 0; 249 /* 250 * The object name held a reference to this object, drop 251 * that now. 252 * 253 * This cannot be the last reference, since the handle holds one too. 254 */ 255 kref_put(&obj->refcount, drm_gem_object_ref_bug); 256 } 257 } 258 259 #if 0 260 static void drm_gem_object_exported_dma_buf_free(struct drm_gem_object *obj) 261 { 262 /* Unbreak the reference cycle if we have an exported dma_buf. */ 263 if (obj->dma_buf) { 264 dma_buf_put(obj->dma_buf); 265 obj->dma_buf = NULL; 266 } 267 } 268 #endif 269 270 static void 271 drm_gem_object_handle_unreference_unlocked(struct drm_gem_object *obj) 272 { 273 if (WARN_ON(obj->handle_count == 0)) 274 return; 275 276 /* 277 * Must bump handle count first as this may be the last 278 * ref, in which case the object would disappear before we 279 * checked for a name 280 */ 281 282 mutex_lock(&obj->dev->object_name_lock); 283 if (--obj->handle_count == 0) 284 drm_gem_object_handle_free(obj); 285 mutex_unlock(&obj->dev->object_name_lock); 286 287 drm_gem_object_unreference_unlocked(obj); 288 } 289 290 /** 291 * drm_gem_handle_delete - deletes the given file-private handle 292 * @filp: drm file-private structure to use for the handle look up 293 * @handle: userspace handle to delete 294 * 295 * Removes the GEM handle from the @filp lookup table and if this is the last 296 * handle also cleans up linked resources like GEM names. 297 */ 298 int 299 drm_gem_handle_delete(struct drm_file *filp, u32 handle) 300 { 301 struct drm_device *dev; 302 struct drm_gem_object *obj; 303 304 /* This is gross. The idr system doesn't let us try a delete and 305 * return an error code. It just spews if you fail at deleting. 306 * So, we have to grab a lock around finding the object and then 307 * doing the delete on it and dropping the refcount, or the user 308 * could race us to double-decrement the refcount and cause a 309 * use-after-free later. Given the frequency of our handle lookups, 310 * we may want to use ida for number allocation and a hash table 311 * for the pointers, anyway. 312 */ 313 lockmgr(&filp->table_lock, LK_EXCLUSIVE); 314 315 /* Check if we currently have a reference on the object */ 316 obj = idr_find(&filp->object_idr, handle); 317 if (obj == NULL) { 318 lockmgr(&filp->table_lock, LK_RELEASE); 319 return -EINVAL; 320 } 321 dev = obj->dev; 322 323 /* Release reference and decrement refcount. */ 324 idr_remove(&filp->object_idr, handle); 325 lockmgr(&filp->table_lock, LK_RELEASE); 326 327 drm_gem_remove_prime_handles(obj, filp); 328 329 if (dev->driver->gem_close_object) 330 dev->driver->gem_close_object(obj, filp); 331 drm_gem_object_handle_unreference_unlocked(obj); 332 333 return 0; 334 } 335 EXPORT_SYMBOL(drm_gem_handle_delete); 336 337 /** 338 * drm_gem_dumb_destroy - dumb fb callback helper for gem based drivers 339 * @file: drm file-private structure to remove the dumb handle from 340 * @dev: corresponding drm_device 341 * @handle: the dumb handle to remove 342 * 343 * This implements the ->dumb_destroy kms driver callback for drivers which use 344 * gem to manage their backing storage. 345 */ 346 int drm_gem_dumb_destroy(struct drm_file *file, 347 struct drm_device *dev, 348 uint32_t handle) 349 { 350 return drm_gem_handle_delete(file, handle); 351 } 352 EXPORT_SYMBOL(drm_gem_dumb_destroy); 353 354 /** 355 * Create a handle for this object. This adds a handle reference 356 * to the object, which includes a regular reference count. Callers 357 * will likely want to dereference the object afterwards. 358 */ 359 int 360 drm_gem_handle_create(struct drm_file *file_priv, 361 struct drm_gem_object *obj, 362 u32 *handlep) 363 { 364 struct drm_device *dev = obj->dev; 365 int ret; 366 367 /* 368 * Get the user-visible handle using idr. 369 */ 370 idr_preload(GFP_KERNEL); 371 lockmgr(&dev->object_name_lock, LK_EXCLUSIVE); 372 lockmgr(&file_priv->table_lock, LK_EXCLUSIVE); 373 374 ret = idr_alloc(&file_priv->object_idr, obj, 1, 0, GFP_NOWAIT); 375 drm_gem_object_reference(obj); 376 obj->handle_count++; 377 lockmgr(&file_priv->table_lock, LK_RELEASE); 378 lockmgr(&dev->object_name_lock, LK_RELEASE); 379 idr_preload_end(); 380 if (ret < 0) { 381 drm_gem_object_handle_unreference_unlocked(obj); 382 return ret; 383 } 384 *handlep = ret; 385 386 387 if (dev->driver->gem_open_object) { 388 ret = dev->driver->gem_open_object(obj, file_priv); 389 if (ret) { 390 drm_gem_handle_delete(file_priv, *handlep); 391 return ret; 392 } 393 } 394 395 return 0; 396 } 397 EXPORT_SYMBOL(drm_gem_handle_create); 398 399 400 /** 401 * drm_gem_free_mmap_offset - release a fake mmap offset for an object 402 * @obj: obj in question 403 * 404 * This routine frees fake offsets allocated by drm_gem_create_mmap_offset(). 405 */ 406 void 407 drm_gem_free_mmap_offset(struct drm_gem_object *obj) 408 { 409 struct drm_device *dev = obj->dev; 410 struct drm_gem_mm *mm = dev->mm_private; 411 struct drm_hash_item *list; 412 413 if (!obj->on_map) 414 return; 415 list = &obj->map_list; 416 417 drm_ht_remove_item(&mm->offset_hash, list); 418 free_unr(mm->idxunr, list->key); 419 obj->on_map = false; 420 421 drm_vma_offset_remove(&mm->vma_manager, &obj->vma_node); 422 } 423 EXPORT_SYMBOL(drm_gem_free_mmap_offset); 424 425 /** 426 * drm_gem_create_mmap_offset_size - create a fake mmap offset for an object 427 * @obj: obj in question 428 * @size: the virtual size 429 * 430 * GEM memory mapping works by handing back to userspace a fake mmap offset 431 * it can use in a subsequent mmap(2) call. The DRM core code then looks 432 * up the object based on the offset and sets up the various memory mapping 433 * structures. 434 * 435 * This routine allocates and attaches a fake offset for @obj, in cases where 436 * the virtual size differs from the physical size (ie. obj->size). Otherwise 437 * just use drm_gem_create_mmap_offset(). 438 */ 439 int 440 drm_gem_create_mmap_offset_size(struct drm_gem_object *obj, size_t size) 441 { 442 struct drm_device *dev = obj->dev; 443 struct drm_gem_mm *mm = dev->mm_private; 444 int ret = 0; 445 446 if (obj->on_map) 447 return (0); 448 449 obj->map_list.key = alloc_unr(mm->idxunr); 450 ret = drm_ht_insert_item(&mm->offset_hash, &obj->map_list); 451 if (ret != 0) { 452 DRM_ERROR("failed to add to map hash\n"); 453 free_unr(mm->idxunr, obj->map_list.key); 454 return (ret); 455 } 456 obj->on_map = true; 457 return 0; 458 459 return drm_vma_offset_add(&mm->vma_manager, &obj->vma_node, 460 size / PAGE_SIZE); 461 } 462 EXPORT_SYMBOL(drm_gem_create_mmap_offset_size); 463 464 /** 465 * drm_gem_create_mmap_offset - create a fake mmap offset for an object 466 * @obj: obj in question 467 * 468 * GEM memory mapping works by handing back to userspace a fake mmap offset 469 * it can use in a subsequent mmap(2) call. The DRM core code then looks 470 * up the object based on the offset and sets up the various memory mapping 471 * structures. 472 * 473 * This routine allocates and attaches a fake offset for @obj. 474 */ 475 int drm_gem_create_mmap_offset(struct drm_gem_object *obj) 476 { 477 return drm_gem_create_mmap_offset_size(obj, obj->size); 478 } 479 EXPORT_SYMBOL(drm_gem_create_mmap_offset); 480 481 /** Returns a reference to the object named by the handle. */ 482 struct drm_gem_object * 483 drm_gem_object_lookup(struct drm_device *dev, struct drm_file *filp, 484 u32 handle) 485 { 486 struct drm_gem_object *obj; 487 488 lockmgr(&filp->table_lock, LK_EXCLUSIVE); 489 490 /* Check if we currently have a reference on the object */ 491 obj = idr_find(&filp->object_idr, handle); 492 if (obj == NULL) { 493 lockmgr(&filp->table_lock, LK_RELEASE); 494 return NULL; 495 } 496 497 drm_gem_object_reference(obj); 498 499 lockmgr(&filp->table_lock, LK_RELEASE); 500 501 return obj; 502 } 503 EXPORT_SYMBOL(drm_gem_object_lookup); 504 505 /** 506 * drm_gem_close_ioctl - implementation of the GEM_CLOSE ioctl 507 * @dev: drm_device 508 * @data: ioctl data 509 * @file_priv: drm file-private structure 510 * 511 * Releases the handle to an mm object. 512 */ 513 int 514 drm_gem_close_ioctl(struct drm_device *dev, void *data, 515 struct drm_file *file_priv) 516 { 517 struct drm_gem_close *args = data; 518 int ret; 519 520 if (!drm_core_check_feature(dev, DRIVER_GEM)) 521 return -ENODEV; 522 523 ret = drm_gem_handle_delete(file_priv, args->handle); 524 525 return ret; 526 } 527 528 /** 529 * Create a global name for an object, returning the name. 530 * 531 * Note that the name does not hold a reference; when the object 532 * is freed, the name goes away. 533 */ 534 int 535 drm_gem_flink_ioctl(struct drm_device *dev, void *data, 536 struct drm_file *file_priv) 537 { 538 struct drm_gem_flink *args = data; 539 struct drm_gem_object *obj; 540 int ret; 541 542 if (!drm_core_check_feature(dev, DRIVER_GEM)) 543 return -ENODEV; 544 545 obj = drm_gem_object_lookup(dev, file_priv, args->handle); 546 if (obj == NULL) 547 return -ENOENT; 548 549 idr_preload(GFP_KERNEL); 550 lockmgr(&dev->object_name_lock, LK_EXCLUSIVE); 551 /* prevent races with concurrent gem_close. */ 552 if (obj->handle_count == 0) { 553 ret = -ENOENT; 554 goto err; 555 } 556 557 if (!obj->name) { 558 ret = idr_alloc(&dev->object_name_idr, obj, 1, 0, GFP_NOWAIT); 559 if (ret < 0) 560 goto err; 561 562 obj->name = ret; 563 564 /* Allocate a reference for the name table. */ 565 drm_gem_object_reference(obj); 566 } 567 568 args->name = (uint64_t) obj->name; 569 ret = 0; 570 571 err: 572 lockmgr(&dev->object_name_lock, LK_RELEASE); 573 idr_preload_end(); 574 drm_gem_object_unreference_unlocked(obj); 575 return ret; 576 } 577 578 /** 579 * drm_gem_open - implementation of the GEM_OPEN ioctl 580 * @dev: drm_device 581 * @data: ioctl data 582 * @file_priv: drm file-private structure 583 * 584 * Open an object using the global name, returning a handle and the size. 585 * 586 * This handle (of course) holds a reference to the object, so the object 587 * will not go away until the handle is deleted. 588 */ 589 int 590 drm_gem_open_ioctl(struct drm_device *dev, void *data, 591 struct drm_file *file_priv) 592 { 593 struct drm_gem_open *args = data; 594 struct drm_gem_object *obj; 595 int ret; 596 u32 handle; 597 598 if (!drm_core_check_feature(dev, DRIVER_GEM)) 599 return -ENODEV; 600 601 lockmgr(&dev->object_name_lock, LK_EXCLUSIVE); 602 obj = idr_find(&dev->object_name_idr, (int) args->name); 603 if (obj) 604 drm_gem_object_reference(obj); 605 lockmgr(&dev->object_name_lock, LK_RELEASE); 606 if (!obj) 607 return -ENOENT; 608 609 ret = drm_gem_handle_create(file_priv, obj, &handle); 610 drm_gem_object_unreference_unlocked(obj); 611 if (ret) 612 return ret; 613 614 args->handle = handle; 615 args->size = obj->size; 616 617 return 0; 618 } 619 620 /** 621 * gem_gem_open - initalizes GEM file-private structures at devnode open time 622 * @dev: drm_device which is being opened by userspace 623 * @file_private: drm file-private structure to set up 624 * 625 * Called at device open time, sets up the structure for handling refcounting 626 * of mm objects. 627 */ 628 void 629 drm_gem_open(struct drm_device *dev, struct drm_file *file_private) 630 { 631 idr_init(&file_private->object_idr); 632 lockinit(&file_private->table_lock, "fptab", 0, LK_CANRECURSE); 633 } 634 635 /* 636 * Called at device close to release the file's 637 * handle references on objects. 638 */ 639 static int 640 drm_gem_object_release_handle(int id, void *ptr, void *data) 641 { 642 struct drm_file *file_priv = data; 643 struct drm_gem_object *obj = ptr; 644 struct drm_device *dev = obj->dev; 645 646 drm_gem_remove_prime_handles(obj, file_priv); 647 648 if (dev->driver->gem_close_object) 649 dev->driver->gem_close_object(obj, file_priv); 650 651 drm_gem_object_handle_unreference_unlocked(obj); 652 653 return 0; 654 } 655 656 /** 657 * drm_gem_release - release file-private GEM resources 658 * @dev: drm_device which is being closed by userspace 659 * @file_private: drm file-private structure to clean up 660 * 661 * Called at close time when the filp is going away. 662 * 663 * Releases any remaining references on objects by this filp. 664 */ 665 void 666 drm_gem_release(struct drm_device *dev, struct drm_file *file_private) 667 { 668 idr_for_each(&file_private->object_idr, 669 &drm_gem_object_release_handle, file_private); 670 idr_destroy(&file_private->object_idr); 671 } 672 673 void 674 drm_gem_object_release(struct drm_gem_object *obj) 675 { 676 677 /* 678 * obj->vm_obj can be NULL for private gem objects. 679 */ 680 vm_object_deallocate(obj->vm_obj); 681 } 682 EXPORT_SYMBOL(drm_gem_object_release); 683 684 /** 685 * drm_gem_object_free - free a GEM object 686 * @kref: kref of the object to free 687 * 688 * Called after the last reference to the object has been lost. 689 * Must be called holding struct_ mutex 690 * 691 * Frees the object 692 */ 693 void 694 drm_gem_object_free(struct kref *kref) 695 { 696 struct drm_gem_object *obj = (struct drm_gem_object *) kref; 697 struct drm_device *dev = obj->dev; 698 699 BUG_ON(!mutex_is_locked(&dev->struct_mutex)); 700 701 if (dev->driver->gem_free_object != NULL) 702 dev->driver->gem_free_object(obj); 703 } 704 EXPORT_SYMBOL(drm_gem_object_free); 705 706 static struct drm_gem_object * 707 drm_gem_object_from_offset(struct drm_device *dev, vm_ooffset_t offset) 708 { 709 struct drm_gem_object *obj; 710 struct drm_gem_mm *mm = dev->mm_private; 711 struct drm_hash_item *hash; 712 713 if ((offset & DRM_GEM_MAPPING_MASK) != DRM_GEM_MAPPING_KEY) 714 return (NULL); 715 offset &= ~DRM_GEM_MAPPING_KEY; 716 717 if (drm_ht_find_item(&mm->offset_hash, DRM_GEM_MAPPING_IDX(offset), 718 &hash) != 0) { 719 return (NULL); 720 } 721 obj = container_of(hash, struct drm_gem_object, map_list); 722 return (obj); 723 } 724 725 int 726 drm_gem_mmap_single(struct drm_device *dev, vm_ooffset_t *offset, vm_size_t size, 727 struct vm_object **obj_res, int nprot) 728 { 729 struct drm_gem_object *gem_obj; 730 struct vm_object *vm_obj; 731 732 DRM_LOCK(dev); 733 gem_obj = drm_gem_object_from_offset(dev, *offset); 734 if (gem_obj == NULL) { 735 DRM_UNLOCK(dev); 736 return (ENODEV); 737 } 738 739 drm_gem_object_reference(gem_obj); 740 DRM_UNLOCK(dev); 741 vm_obj = cdev_pager_allocate(gem_obj, OBJT_MGTDEVICE, 742 dev->driver->gem_pager_ops, size, nprot, 743 DRM_GEM_MAPPING_MAPOFF(*offset), curthread->td_ucred); 744 if (vm_obj == NULL) { 745 drm_gem_object_unreference_unlocked(gem_obj); 746 return (EINVAL); 747 } 748 *offset = DRM_GEM_MAPPING_MAPOFF(*offset); 749 *obj_res = vm_obj; 750 return (0); 751 } 752 753 void 754 drm_gem_pager_dtr(void *handle) 755 { 756 struct drm_gem_object *obj; 757 struct drm_device *dev; 758 759 obj = handle; 760 dev = obj->dev; 761 762 DRM_LOCK(dev); 763 drm_gem_free_mmap_offset(obj); 764 drm_gem_object_unreference(obj); 765 DRM_UNLOCK(dev); 766 } 767