1 /* 2 * Copyright © 2008 Intel Corporation 3 * 4 * Permission is hereby granted, free of charge, to any person obtaining a 5 * copy of this software and associated documentation files (the "Software"), 6 * to deal in the Software without restriction, including without limitation 7 * the rights to use, copy, modify, merge, publish, distribute, sublicense, 8 * and/or sell copies of the Software, and to permit persons to whom the 9 * Software is furnished to do so, subject to the following conditions: 10 * 11 * The above copyright notice and this permission notice (including the next 12 * paragraph) shall be included in all copies or substantial portions of the 13 * Software. 14 * 15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS 21 * IN THE SOFTWARE. 22 * 23 * Authors: 24 * Eric Anholt <eric@anholt.net> 25 * 26 */ 27 /*- 28 * Copyright (c) 2011 The FreeBSD Foundation 29 * All rights reserved. 30 * 31 * This software was developed by Konstantin Belousov under sponsorship from 32 * the FreeBSD Foundation. 33 * 34 * Redistribution and use in source and binary forms, with or without 35 * modification, are permitted provided that the following conditions 36 * are met: 37 * 1. Redistributions of source code must retain the above copyright 38 * notice, this list of conditions and the following disclaimer. 39 * 2. Redistributions in binary form must reproduce the above copyright 40 * notice, this list of conditions and the following disclaimer in the 41 * documentation and/or other materials provided with the distribution. 42 * 43 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 44 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 45 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 46 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 47 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 48 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 49 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 50 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 51 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 52 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 53 * SUCH DAMAGE. 54 */ 55 56 #include "opt_vm.h" 57 58 #include <sys/param.h> 59 #include <sys/systm.h> 60 #include <sys/limits.h> 61 #include <sys/lock.h> 62 #include <sys/mutex.h> 63 #include <sys/conf.h> 64 65 #include <vm/vm.h> 66 #include <vm/vm_page.h> 67 68 #include <linux/types.h> 69 #include <linux/mm.h> 70 #include <linux/module.h> 71 #include <drm/drmP.h> 72 #include <drm/drm_vma_manager.h> 73 74 /** @file drm_gem.c 75 * 76 * This file provides some of the base ioctls and library routines for 77 * the graphics memory manager implemented by each device driver. 78 * 79 * Because various devices have different requirements in terms of 80 * synchronization and migration strategies, implementing that is left up to 81 * the driver, and all that the general API provides should be generic -- 82 * allocating objects, reading/writing data with the cpu, freeing objects. 83 * Even there, platform-dependent optimizations for reading/writing data with 84 * the CPU mean we'll likely hook those out to driver-specific calls. However, 85 * the DRI2 implementation wants to have at least allocate/mmap be generic. 86 * 87 * The goal was to have swap-backed object allocation managed through 88 * struct file. However, file descriptors as handles to a struct file have 89 * two major failings: 90 * - Process limits prevent more than 1024 or so being used at a time by 91 * default. 92 * - Inability to allocate high fds will aggravate the X Server's select() 93 * handling, and likely that of many GL client applications as well. 94 * 95 * This led to a plan of using our own integer IDs (called handles, following 96 * DRM terminology) to mimic fds, and implement the fd syscalls we need as 97 * ioctls. The objects themselves will still include the struct file so 98 * that we can transition to fds if the required kernel infrastructure shows 99 * up at a later date, and as our interface with shmfs for memory allocation. 100 */ 101 102 /* 103 * We make up offsets for buffer objects so we can recognize them at 104 * mmap time. 105 */ 106 107 /* pgoff in mmap is an unsigned long, so we need to make sure that 108 * the faked up offset will fit 109 */ 110 111 #if BITS_PER_LONG == 64 112 #define DRM_FILE_PAGE_OFFSET_START ((0xFFFFFFFFUL >> PAGE_SHIFT) + 1) 113 #define DRM_FILE_PAGE_OFFSET_SIZE ((0xFFFFFFFFUL >> PAGE_SHIFT) * 16) 114 #else 115 #define DRM_FILE_PAGE_OFFSET_START ((0xFFFFFFFUL >> PAGE_SHIFT) + 1) 116 #define DRM_FILE_PAGE_OFFSET_SIZE ((0xFFFFFFFUL >> PAGE_SHIFT) * 16) 117 #endif 118 119 /** 120 * drm_gem_init - Initialize the GEM device fields 121 * @dev: drm_devic structure to initialize 122 */ 123 int 124 drm_gem_init(struct drm_device *dev) 125 { 126 struct drm_gem_mm *mm; 127 128 lockinit(&dev->object_name_lock, "objnam", 0, LK_CANRECURSE); 129 idr_init(&dev->object_name_idr); 130 131 mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL); 132 if (!mm) { 133 DRM_ERROR("out of memory\n"); 134 return -ENOMEM; 135 } 136 137 dev->mm_private = mm; 138 139 if (drm_ht_create(&mm->offset_hash, 12)) { 140 kfree(mm); 141 return -ENOMEM; 142 } 143 144 mm->idxunr = new_unrhdr(0, DRM_GEM_MAX_IDX, NULL); 145 drm_mm_init(&mm->offset_manager, DRM_FILE_PAGE_OFFSET_START, 146 DRM_FILE_PAGE_OFFSET_SIZE); 147 drm_vma_offset_manager_init(&mm->vma_manager, 148 DRM_FILE_PAGE_OFFSET_START, 149 DRM_FILE_PAGE_OFFSET_SIZE); 150 151 return 0; 152 } 153 154 void 155 drm_gem_destroy(struct drm_device *dev) 156 { 157 struct drm_gem_mm *mm = dev->mm_private; 158 159 drm_mm_takedown(&mm->offset_manager); 160 drm_ht_remove(&mm->offset_hash); 161 162 drm_vma_offset_manager_destroy(&mm->vma_manager); 163 delete_unrhdr(mm->idxunr); 164 kfree(mm); 165 dev->mm_private = NULL; 166 } 167 168 /** 169 * Initialize an already allocated GEM object of the specified size with 170 * shmfs backing store. 171 */ 172 int drm_gem_object_init(struct drm_device *dev, 173 struct drm_gem_object *obj, size_t size) 174 { 175 drm_gem_private_object_init(dev, obj, size); 176 177 obj->vm_obj = default_pager_alloc(NULL, size, 178 VM_PROT_READ | VM_PROT_WRITE, 0); 179 180 return 0; 181 } 182 EXPORT_SYMBOL(drm_gem_object_init); 183 184 /** 185 * drm_gem_object_init - initialize an allocated private GEM object 186 * @dev: drm_device the object should be initialized for 187 * @obj: drm_gem_object to initialize 188 * @size: object size 189 * 190 * Initialize an already allocated GEM object of the specified size with 191 * no GEM provided backing store. Instead the caller is responsible for 192 * backing the object and handling it. 193 */ 194 void drm_gem_private_object_init(struct drm_device *dev, 195 struct drm_gem_object *obj, size_t size) 196 { 197 BUG_ON((size & (PAGE_SIZE - 1)) != 0); 198 199 obj->dev = dev; 200 obj->vm_obj = NULL; 201 202 kref_init(&obj->refcount); 203 obj->handle_count = 0; 204 obj->size = size; 205 drm_vma_node_reset(&obj->vma_node); 206 } 207 EXPORT_SYMBOL(drm_gem_private_object_init); 208 209 static void 210 drm_gem_remove_prime_handles(struct drm_gem_object *obj, struct drm_file *filp) 211 { 212 #if 0 213 if (obj->import_attach) { 214 drm_prime_remove_buf_handle(&filp->prime, 215 obj->import_attach->dmabuf); 216 } 217 if (obj->export_dma_buf) { 218 drm_prime_remove_buf_handle(&filp->prime, 219 obj->export_dma_buf); 220 } 221 #endif 222 } 223 224 static void drm_gem_object_ref_bug(struct kref *list_kref) 225 { 226 BUG(); 227 } 228 229 /** 230 * drm_gem_object_free - release resources bound to userspace handles 231 * @obj: GEM object to clean up. 232 * 233 * Called after the last handle to the object has been closed 234 * 235 * Removes any name for the object. Note that this must be 236 * called before drm_gem_object_free or we'll be touching 237 * freed memory 238 */ 239 static void drm_gem_object_handle_free(struct drm_gem_object *obj) 240 { 241 struct drm_device *dev = obj->dev; 242 243 /* Remove any name for this object */ 244 if (obj->name) { 245 idr_remove(&dev->object_name_idr, obj->name); 246 obj->name = 0; 247 /* 248 * The object name held a reference to this object, drop 249 * that now. 250 * 251 * This cannot be the last reference, since the handle holds one too. 252 */ 253 kref_put(&obj->refcount, drm_gem_object_ref_bug); 254 } 255 } 256 257 #if 0 258 static void drm_gem_object_exported_dma_buf_free(struct drm_gem_object *obj) 259 { 260 /* Unbreak the reference cycle if we have an exported dma_buf. */ 261 if (obj->dma_buf) { 262 dma_buf_put(obj->dma_buf); 263 obj->dma_buf = NULL; 264 } 265 } 266 #endif 267 268 static void 269 drm_gem_object_handle_unreference_unlocked(struct drm_gem_object *obj) 270 { 271 if (WARN_ON(obj->handle_count == 0)) 272 return; 273 274 /* 275 * Must bump handle count first as this may be the last 276 * ref, in which case the object would disappear before we 277 * checked for a name 278 */ 279 280 mutex_lock(&obj->dev->object_name_lock); 281 if (--obj->handle_count == 0) 282 drm_gem_object_handle_free(obj); 283 mutex_unlock(&obj->dev->object_name_lock); 284 285 drm_gem_object_unreference_unlocked(obj); 286 } 287 288 /** 289 * drm_gem_handle_delete - deletes the given file-private handle 290 * @filp: drm file-private structure to use for the handle look up 291 * @handle: userspace handle to delete 292 * 293 * Removes the GEM handle from the @filp lookup table and if this is the last 294 * handle also cleans up linked resources like GEM names. 295 */ 296 int 297 drm_gem_handle_delete(struct drm_file *filp, u32 handle) 298 { 299 struct drm_device *dev; 300 struct drm_gem_object *obj; 301 302 /* This is gross. The idr system doesn't let us try a delete and 303 * return an error code. It just spews if you fail at deleting. 304 * So, we have to grab a lock around finding the object and then 305 * doing the delete on it and dropping the refcount, or the user 306 * could race us to double-decrement the refcount and cause a 307 * use-after-free later. Given the frequency of our handle lookups, 308 * we may want to use ida for number allocation and a hash table 309 * for the pointers, anyway. 310 */ 311 lockmgr(&filp->table_lock, LK_EXCLUSIVE); 312 313 /* Check if we currently have a reference on the object */ 314 obj = idr_find(&filp->object_idr, handle); 315 if (obj == NULL) { 316 lockmgr(&filp->table_lock, LK_RELEASE); 317 return -EINVAL; 318 } 319 dev = obj->dev; 320 321 /* Release reference and decrement refcount. */ 322 idr_remove(&filp->object_idr, handle); 323 lockmgr(&filp->table_lock, LK_RELEASE); 324 325 drm_gem_remove_prime_handles(obj, filp); 326 327 if (dev->driver->gem_close_object) 328 dev->driver->gem_close_object(obj, filp); 329 drm_gem_object_handle_unreference_unlocked(obj); 330 331 return 0; 332 } 333 EXPORT_SYMBOL(drm_gem_handle_delete); 334 335 /** 336 * drm_gem_dumb_destroy - dumb fb callback helper for gem based drivers 337 * @file: drm file-private structure to remove the dumb handle from 338 * @dev: corresponding drm_device 339 * @handle: the dumb handle to remove 340 * 341 * This implements the ->dumb_destroy kms driver callback for drivers which use 342 * gem to manage their backing storage. 343 */ 344 int drm_gem_dumb_destroy(struct drm_file *file, 345 struct drm_device *dev, 346 uint32_t handle) 347 { 348 return drm_gem_handle_delete(file, handle); 349 } 350 EXPORT_SYMBOL(drm_gem_dumb_destroy); 351 352 /** 353 * Create a handle for this object. This adds a handle reference 354 * to the object, which includes a regular reference count. Callers 355 * will likely want to dereference the object afterwards. 356 */ 357 int 358 drm_gem_handle_create(struct drm_file *file_priv, 359 struct drm_gem_object *obj, 360 u32 *handlep) 361 { 362 struct drm_device *dev = obj->dev; 363 int ret; 364 365 /* 366 * Get the user-visible handle using idr. 367 */ 368 idr_preload(GFP_KERNEL); 369 lockmgr(&dev->object_name_lock, LK_EXCLUSIVE); 370 lockmgr(&file_priv->table_lock, LK_EXCLUSIVE); 371 372 ret = idr_alloc(&file_priv->object_idr, obj, 1, 0, GFP_NOWAIT); 373 drm_gem_object_reference(obj); 374 obj->handle_count++; 375 lockmgr(&file_priv->table_lock, LK_RELEASE); 376 lockmgr(&dev->object_name_lock, LK_RELEASE); 377 idr_preload_end(); 378 if (ret < 0) { 379 drm_gem_object_handle_unreference_unlocked(obj); 380 return ret; 381 } 382 *handlep = ret; 383 384 385 if (dev->driver->gem_open_object) { 386 ret = dev->driver->gem_open_object(obj, file_priv); 387 if (ret) { 388 drm_gem_handle_delete(file_priv, *handlep); 389 return ret; 390 } 391 } 392 393 return 0; 394 } 395 EXPORT_SYMBOL(drm_gem_handle_create); 396 397 398 /** 399 * drm_gem_free_mmap_offset - release a fake mmap offset for an object 400 * @obj: obj in question 401 * 402 * This routine frees fake offsets allocated by drm_gem_create_mmap_offset(). 403 */ 404 void 405 drm_gem_free_mmap_offset(struct drm_gem_object *obj) 406 { 407 struct drm_device *dev = obj->dev; 408 struct drm_gem_mm *mm = dev->mm_private; 409 struct drm_hash_item *list; 410 411 if (!obj->on_map) 412 return; 413 list = &obj->map_list; 414 415 drm_ht_remove_item(&mm->offset_hash, list); 416 free_unr(mm->idxunr, list->key); 417 obj->on_map = false; 418 419 drm_vma_offset_remove(&mm->vma_manager, &obj->vma_node); 420 } 421 EXPORT_SYMBOL(drm_gem_free_mmap_offset); 422 423 /** 424 * drm_gem_create_mmap_offset_size - create a fake mmap offset for an object 425 * @obj: obj in question 426 * @size: the virtual size 427 * 428 * GEM memory mapping works by handing back to userspace a fake mmap offset 429 * it can use in a subsequent mmap(2) call. The DRM core code then looks 430 * up the object based on the offset and sets up the various memory mapping 431 * structures. 432 * 433 * This routine allocates and attaches a fake offset for @obj, in cases where 434 * the virtual size differs from the physical size (ie. obj->size). Otherwise 435 * just use drm_gem_create_mmap_offset(). 436 */ 437 int 438 drm_gem_create_mmap_offset_size(struct drm_gem_object *obj, size_t size) 439 { 440 struct drm_device *dev = obj->dev; 441 struct drm_gem_mm *mm = dev->mm_private; 442 int ret = 0; 443 444 if (obj->on_map) 445 return (0); 446 447 obj->map_list.key = alloc_unr(mm->idxunr); 448 ret = drm_ht_insert_item(&mm->offset_hash, &obj->map_list); 449 if (ret != 0) { 450 DRM_ERROR("failed to add to map hash\n"); 451 free_unr(mm->idxunr, obj->map_list.key); 452 return (ret); 453 } 454 obj->on_map = true; 455 return 0; 456 457 return drm_vma_offset_add(&mm->vma_manager, &obj->vma_node, 458 size / PAGE_SIZE); 459 } 460 EXPORT_SYMBOL(drm_gem_create_mmap_offset_size); 461 462 /** 463 * drm_gem_create_mmap_offset - create a fake mmap offset for an object 464 * @obj: obj in question 465 * 466 * GEM memory mapping works by handing back to userspace a fake mmap offset 467 * it can use in a subsequent mmap(2) call. The DRM core code then looks 468 * up the object based on the offset and sets up the various memory mapping 469 * structures. 470 * 471 * This routine allocates and attaches a fake offset for @obj. 472 */ 473 int drm_gem_create_mmap_offset(struct drm_gem_object *obj) 474 { 475 return drm_gem_create_mmap_offset_size(obj, obj->size); 476 } 477 EXPORT_SYMBOL(drm_gem_create_mmap_offset); 478 479 /** Returns a reference to the object named by the handle. */ 480 struct drm_gem_object * 481 drm_gem_object_lookup(struct drm_device *dev, struct drm_file *filp, 482 u32 handle) 483 { 484 struct drm_gem_object *obj; 485 486 lockmgr(&filp->table_lock, LK_EXCLUSIVE); 487 488 /* Check if we currently have a reference on the object */ 489 obj = idr_find(&filp->object_idr, handle); 490 if (obj == NULL) { 491 lockmgr(&filp->table_lock, LK_RELEASE); 492 return NULL; 493 } 494 495 drm_gem_object_reference(obj); 496 497 lockmgr(&filp->table_lock, LK_RELEASE); 498 499 return obj; 500 } 501 EXPORT_SYMBOL(drm_gem_object_lookup); 502 503 /** 504 * drm_gem_close_ioctl - implementation of the GEM_CLOSE ioctl 505 * @dev: drm_device 506 * @data: ioctl data 507 * @file_priv: drm file-private structure 508 * 509 * Releases the handle to an mm object. 510 */ 511 int 512 drm_gem_close_ioctl(struct drm_device *dev, void *data, 513 struct drm_file *file_priv) 514 { 515 struct drm_gem_close *args = data; 516 int ret; 517 518 if (!(dev->driver->driver_features & DRIVER_GEM)) 519 return -ENODEV; 520 521 ret = drm_gem_handle_delete(file_priv, args->handle); 522 523 return ret; 524 } 525 526 /** 527 * Create a global name for an object, returning the name. 528 * 529 * Note that the name does not hold a reference; when the object 530 * is freed, the name goes away. 531 */ 532 int 533 drm_gem_flink_ioctl(struct drm_device *dev, void *data, 534 struct drm_file *file_priv) 535 { 536 struct drm_gem_flink *args = data; 537 struct drm_gem_object *obj; 538 int ret; 539 540 if (!(dev->driver->driver_features & DRIVER_GEM)) 541 return -ENODEV; 542 543 obj = drm_gem_object_lookup(dev, file_priv, args->handle); 544 if (obj == NULL) 545 return -ENOENT; 546 547 idr_preload(GFP_KERNEL); 548 lockmgr(&dev->object_name_lock, LK_EXCLUSIVE); 549 /* prevent races with concurrent gem_close. */ 550 if (obj->handle_count == 0) { 551 ret = -ENOENT; 552 goto err; 553 } 554 555 if (!obj->name) { 556 ret = idr_alloc(&dev->object_name_idr, obj, 1, 0, GFP_NOWAIT); 557 if (ret < 0) 558 goto err; 559 560 obj->name = ret; 561 562 /* Allocate a reference for the name table. */ 563 drm_gem_object_reference(obj); 564 } 565 566 args->name = (uint64_t) obj->name; 567 ret = 0; 568 569 err: 570 lockmgr(&dev->object_name_lock, LK_RELEASE); 571 idr_preload_end(); 572 drm_gem_object_unreference_unlocked(obj); 573 return ret; 574 } 575 576 /** 577 * drm_gem_open - implementation of the GEM_OPEN ioctl 578 * @dev: drm_device 579 * @data: ioctl data 580 * @file_priv: drm file-private structure 581 * 582 * Open an object using the global name, returning a handle and the size. 583 * 584 * This handle (of course) holds a reference to the object, so the object 585 * will not go away until the handle is deleted. 586 */ 587 int 588 drm_gem_open_ioctl(struct drm_device *dev, void *data, 589 struct drm_file *file_priv) 590 { 591 struct drm_gem_open *args = data; 592 struct drm_gem_object *obj; 593 int ret; 594 u32 handle; 595 596 if (!(dev->driver->driver_features & DRIVER_GEM)) 597 return -ENODEV; 598 599 lockmgr(&dev->object_name_lock, LK_EXCLUSIVE); 600 obj = idr_find(&dev->object_name_idr, (int) args->name); 601 if (obj) 602 drm_gem_object_reference(obj); 603 lockmgr(&dev->object_name_lock, LK_RELEASE); 604 if (!obj) 605 return -ENOENT; 606 607 ret = drm_gem_handle_create(file_priv, obj, &handle); 608 drm_gem_object_unreference_unlocked(obj); 609 if (ret) 610 return ret; 611 612 args->handle = handle; 613 args->size = obj->size; 614 615 return 0; 616 } 617 618 /** 619 * gem_gem_open - initalizes GEM file-private structures at devnode open time 620 * @dev: drm_device which is being opened by userspace 621 * @file_private: drm file-private structure to set up 622 * 623 * Called at device open time, sets up the structure for handling refcounting 624 * of mm objects. 625 */ 626 void 627 drm_gem_open(struct drm_device *dev, struct drm_file *file_private) 628 { 629 idr_init(&file_private->object_idr); 630 lockinit(&file_private->table_lock, "fptab", 0, LK_CANRECURSE); 631 } 632 633 /* 634 * Called at device close to release the file's 635 * handle references on objects. 636 */ 637 static int 638 drm_gem_object_release_handle(int id, void *ptr, void *data) 639 { 640 struct drm_file *file_priv = data; 641 struct drm_gem_object *obj = ptr; 642 struct drm_device *dev = obj->dev; 643 644 drm_gem_remove_prime_handles(obj, file_priv); 645 646 if (dev->driver->gem_close_object) 647 dev->driver->gem_close_object(obj, file_priv); 648 649 drm_gem_object_handle_unreference_unlocked(obj); 650 651 return 0; 652 } 653 654 /** 655 * drm_gem_release - release file-private GEM resources 656 * @dev: drm_device which is being closed by userspace 657 * @file_private: drm file-private structure to clean up 658 * 659 * Called at close time when the filp is going away. 660 * 661 * Releases any remaining references on objects by this filp. 662 */ 663 void 664 drm_gem_release(struct drm_device *dev, struct drm_file *file_private) 665 { 666 idr_for_each(&file_private->object_idr, 667 &drm_gem_object_release_handle, file_private); 668 idr_destroy(&file_private->object_idr); 669 } 670 671 void 672 drm_gem_object_release(struct drm_gem_object *obj) 673 { 674 675 /* 676 * obj->vm_obj can be NULL for private gem objects. 677 */ 678 vm_object_deallocate(obj->vm_obj); 679 } 680 EXPORT_SYMBOL(drm_gem_object_release); 681 682 /** 683 * drm_gem_object_free - free a GEM object 684 * @kref: kref of the object to free 685 * 686 * Called after the last reference to the object has been lost. 687 * Must be called holding struct_ mutex 688 * 689 * Frees the object 690 */ 691 void 692 drm_gem_object_free(struct kref *kref) 693 { 694 struct drm_gem_object *obj = (struct drm_gem_object *) kref; 695 struct drm_device *dev = obj->dev; 696 697 BUG_ON(!mutex_is_locked(&dev->struct_mutex)); 698 699 if (dev->driver->gem_free_object != NULL) 700 dev->driver->gem_free_object(obj); 701 } 702 EXPORT_SYMBOL(drm_gem_object_free); 703 704 static struct drm_gem_object * 705 drm_gem_object_from_offset(struct drm_device *dev, vm_ooffset_t offset) 706 { 707 struct drm_gem_object *obj; 708 struct drm_gem_mm *mm = dev->mm_private; 709 struct drm_hash_item *hash; 710 711 if ((offset & DRM_GEM_MAPPING_MASK) != DRM_GEM_MAPPING_KEY) 712 return (NULL); 713 offset &= ~DRM_GEM_MAPPING_KEY; 714 715 if (drm_ht_find_item(&mm->offset_hash, DRM_GEM_MAPPING_IDX(offset), 716 &hash) != 0) { 717 return (NULL); 718 } 719 obj = container_of(hash, struct drm_gem_object, map_list); 720 return (obj); 721 } 722 723 int 724 drm_gem_mmap_single(struct drm_device *dev, vm_ooffset_t *offset, vm_size_t size, 725 struct vm_object **obj_res, int nprot) 726 { 727 struct drm_gem_object *gem_obj; 728 struct vm_object *vm_obj; 729 730 DRM_LOCK(dev); 731 gem_obj = drm_gem_object_from_offset(dev, *offset); 732 if (gem_obj == NULL) { 733 DRM_UNLOCK(dev); 734 return (ENODEV); 735 } 736 737 drm_gem_object_reference(gem_obj); 738 DRM_UNLOCK(dev); 739 vm_obj = cdev_pager_allocate(gem_obj, OBJT_MGTDEVICE, 740 dev->driver->gem_pager_ops, size, nprot, 741 DRM_GEM_MAPPING_MAPOFF(*offset), curthread->td_ucred); 742 if (vm_obj == NULL) { 743 drm_gem_object_unreference_unlocked(gem_obj); 744 return (EINVAL); 745 } 746 *offset = DRM_GEM_MAPPING_MAPOFF(*offset); 747 *obj_res = vm_obj; 748 return (0); 749 } 750 751 void 752 drm_gem_pager_dtr(void *handle) 753 { 754 struct drm_gem_object *obj; 755 struct drm_device *dev; 756 757 obj = handle; 758 dev = obj->dev; 759 760 DRM_LOCK(dev); 761 drm_gem_free_mmap_offset(obj); 762 drm_gem_object_unreference(obj); 763 DRM_UNLOCK(dev); 764 } 765