blob: ea1c4b019ebf96290c0768202d7277cda47ba0f9 [file] [log] [blame]
Eric Anholt673a3942008-07-30 12:06:12 -07001/*
2 * Copyright © 2008 Intel Corporation
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining a
5 * copy of this software and associated documentation files (the "Software"),
6 * to deal in the Software without restriction, including without limitation
7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8 * and/or sell copies of the Software, and to permit persons to whom the
9 * Software is furnished to do so, subject to the following conditions:
10 *
11 * The above copyright notice and this permission notice (including the next
12 * paragraph) shall be included in all copies or substantial portions of the
13 * Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
21 * IN THE SOFTWARE.
22 *
23 * Authors:
24 * Eric Anholt <eric@anholt.net>
25 *
26 */
27
28#include <linux/types.h>
29#include <linux/slab.h>
30#include <linux/mm.h>
31#include <linux/uaccess.h>
32#include <linux/fs.h>
33#include <linux/file.h>
34#include <linux/module.h>
35#include <linux/mman.h>
36#include <linux/pagemap.h>
37#include "drmP.h"
38
39/** @file drm_gem.c
40 *
41 * This file provides some of the base ioctls and library routines for
42 * the graphics memory manager implemented by each device driver.
43 *
44 * Because various devices have different requirements in terms of
45 * synchronization and migration strategies, implementing that is left up to
46 * the driver, and all that the general API provides should be generic --
47 * allocating objects, reading/writing data with the cpu, freeing objects.
48 * Even there, platform-dependent optimizations for reading/writing data with
49 * the CPU mean we'll likely hook those out to driver-specific calls. However,
50 * the DRI2 implementation wants to have at least allocate/mmap be generic.
51 *
52 * The goal was to have swap-backed object allocation managed through
53 * struct file. However, file descriptors as handles to a struct file have
54 * two major failings:
55 * - Process limits prevent more than 1024 or so being used at a time by
56 * default.
57 * - Inability to allocate high fds will aggravate the X Server's select()
58 * handling, and likely that of many GL client applications as well.
59 *
60 * This led to a plan of using our own integer IDs (called handles, following
61 * DRM terminology) to mimic fds, and implement the fd syscalls we need as
62 * ioctls. The objects themselves will still include the struct file so
63 * that we can transition to fds if the required kernel infrastructure shows
64 * up at a later date, and as our interface with shmfs for memory allocation.
65 */
66
Jesse Barnesa2c0a972008-11-05 10:31:53 -080067/*
68 * We make up offsets for buffer objects so we can recognize them at
69 * mmap time.
70 */
Jordan Crouse05269a32010-05-27 13:40:27 -060071
72/* pgoff in mmap is an unsigned long, so we need to make sure that
73 * the faked up offset will fit
74 */
75
76#if BITS_PER_LONG == 64
Jesse Barnesa2c0a972008-11-05 10:31:53 -080077#define DRM_FILE_PAGE_OFFSET_START ((0xFFFFFFFFUL >> PAGE_SHIFT) + 1)
78#define DRM_FILE_PAGE_OFFSET_SIZE ((0xFFFFFFFFUL >> PAGE_SHIFT) * 16)
Jordan Crouse05269a32010-05-27 13:40:27 -060079#else
80#define DRM_FILE_PAGE_OFFSET_START ((0xFFFFFFFUL >> PAGE_SHIFT) + 1)
81#define DRM_FILE_PAGE_OFFSET_SIZE ((0xFFFFFFFUL >> PAGE_SHIFT) * 16)
82#endif
Jesse Barnesa2c0a972008-11-05 10:31:53 -080083
Eric Anholt673a3942008-07-30 12:06:12 -070084/**
85 * Initialize the GEM device fields
86 */
87
88int
89drm_gem_init(struct drm_device *dev)
90{
Jesse Barnesa2c0a972008-11-05 10:31:53 -080091 struct drm_gem_mm *mm;
92
Eric Anholt673a3942008-07-30 12:06:12 -070093 spin_lock_init(&dev->object_name_lock);
94 idr_init(&dev->object_name_idr);
Jesse Barnesa2c0a972008-11-05 10:31:53 -080095
Eric Anholt9a298b22009-03-24 12:23:04 -070096 mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL);
Jesse Barnesa2c0a972008-11-05 10:31:53 -080097 if (!mm) {
98 DRM_ERROR("out of memory\n");
99 return -ENOMEM;
100 }
101
102 dev->mm_private = mm;
103
104 if (drm_ht_create(&mm->offset_hash, 19)) {
Eric Anholt9a298b22009-03-24 12:23:04 -0700105 kfree(mm);
Jesse Barnesa2c0a972008-11-05 10:31:53 -0800106 return -ENOMEM;
107 }
108
109 if (drm_mm_init(&mm->offset_manager, DRM_FILE_PAGE_OFFSET_START,
110 DRM_FILE_PAGE_OFFSET_SIZE)) {
Jesse Barnesa2c0a972008-11-05 10:31:53 -0800111 drm_ht_remove(&mm->offset_hash);
Eric Anholt9a298b22009-03-24 12:23:04 -0700112 kfree(mm);
Jesse Barnesa2c0a972008-11-05 10:31:53 -0800113 return -ENOMEM;
114 }
115
Eric Anholt673a3942008-07-30 12:06:12 -0700116 return 0;
117}
118
Jesse Barnesa2c0a972008-11-05 10:31:53 -0800119void
120drm_gem_destroy(struct drm_device *dev)
121{
122 struct drm_gem_mm *mm = dev->mm_private;
123
124 drm_mm_takedown(&mm->offset_manager);
125 drm_ht_remove(&mm->offset_hash);
Eric Anholt9a298b22009-03-24 12:23:04 -0700126 kfree(mm);
Jesse Barnesa2c0a972008-11-05 10:31:53 -0800127 dev->mm_private = NULL;
128}
129
Eric Anholt673a3942008-07-30 12:06:12 -0700130/**
Daniel Vetter1d397042010-04-09 19:05:04 +0000131 * Initialize an already allocate GEM object of the specified size with
132 * shmfs backing store.
133 */
134int drm_gem_object_init(struct drm_device *dev,
135 struct drm_gem_object *obj, size_t size)
136{
137 BUG_ON((size & (PAGE_SIZE - 1)) != 0);
138
139 obj->dev = dev;
140 obj->filp = shmem_file_setup("drm mm object", size, VM_NORESERVE);
141 if (IS_ERR(obj->filp))
142 return -ENOMEM;
143
144 kref_init(&obj->refcount);
Dave Airlie29d08b32010-09-27 16:17:17 +1000145 atomic_set(&obj->handle_count, 0);
Daniel Vetter1d397042010-04-09 19:05:04 +0000146 obj->size = size;
147
Daniel Vetter1d397042010-04-09 19:05:04 +0000148 return 0;
149}
150EXPORT_SYMBOL(drm_gem_object_init);
151
152/**
Eric Anholt673a3942008-07-30 12:06:12 -0700153 * Allocate a GEM object of the specified size with shmfs backing store
154 */
155struct drm_gem_object *
156drm_gem_object_alloc(struct drm_device *dev, size_t size)
157{
158 struct drm_gem_object *obj;
159
Robert P. J. Dayb798b1f2009-06-10 12:43:49 -0700160 obj = kzalloc(sizeof(*obj), GFP_KERNEL);
Jiri Slaby845792d2009-07-13 23:20:21 +0200161 if (!obj)
162 goto free;
Eric Anholt673a3942008-07-30 12:06:12 -0700163
Daniel Vetter1d397042010-04-09 19:05:04 +0000164 if (drm_gem_object_init(dev, obj, size) != 0)
Jiri Slaby845792d2009-07-13 23:20:21 +0200165 goto free;
Eric Anholt673a3942008-07-30 12:06:12 -0700166
Eric Anholt673a3942008-07-30 12:06:12 -0700167 if (dev->driver->gem_init_object != NULL &&
168 dev->driver->gem_init_object(obj) != 0) {
Jiri Slaby845792d2009-07-13 23:20:21 +0200169 goto fput;
Eric Anholt673a3942008-07-30 12:06:12 -0700170 }
Eric Anholt673a3942008-07-30 12:06:12 -0700171 return obj;
Jiri Slaby845792d2009-07-13 23:20:21 +0200172fput:
Daniel Vetter1d397042010-04-09 19:05:04 +0000173 /* Object_init mangles the global counters - readjust them. */
Jiri Slaby845792d2009-07-13 23:20:21 +0200174 fput(obj->filp);
175free:
176 kfree(obj);
177 return NULL;
Eric Anholt673a3942008-07-30 12:06:12 -0700178}
179EXPORT_SYMBOL(drm_gem_object_alloc);
180
181/**
182 * Removes the mapping from handle to filp for this object.
183 */
184static int
Pekka Paalanena1a2d1d2009-08-23 12:40:55 +0300185drm_gem_handle_delete(struct drm_file *filp, u32 handle)
Eric Anholt673a3942008-07-30 12:06:12 -0700186{
187 struct drm_device *dev;
188 struct drm_gem_object *obj;
189
190 /* This is gross. The idr system doesn't let us try a delete and
191 * return an error code. It just spews if you fail at deleting.
192 * So, we have to grab a lock around finding the object and then
193 * doing the delete on it and dropping the refcount, or the user
194 * could race us to double-decrement the refcount and cause a
195 * use-after-free later. Given the frequency of our handle lookups,
196 * we may want to use ida for number allocation and a hash table
197 * for the pointers, anyway.
198 */
199 spin_lock(&filp->table_lock);
200
201 /* Check if we currently have a reference on the object */
202 obj = idr_find(&filp->object_idr, handle);
203 if (obj == NULL) {
204 spin_unlock(&filp->table_lock);
205 return -EINVAL;
206 }
207 dev = obj->dev;
208
209 /* Release reference and decrement refcount. */
210 idr_remove(&filp->object_idr, handle);
211 spin_unlock(&filp->table_lock);
212
Luca Barbieribc9025b2010-02-09 05:49:12 +0000213 drm_gem_object_handle_unreference_unlocked(obj);
Eric Anholt673a3942008-07-30 12:06:12 -0700214
215 return 0;
216}
217
218/**
219 * Create a handle for this object. This adds a handle reference
220 * to the object, which includes a regular reference count. Callers
221 * will likely want to dereference the object afterwards.
222 */
223int
224drm_gem_handle_create(struct drm_file *file_priv,
225 struct drm_gem_object *obj,
Pekka Paalanena1a2d1d2009-08-23 12:40:55 +0300226 u32 *handlep)
Eric Anholt673a3942008-07-30 12:06:12 -0700227{
228 int ret;
229
230 /*
231 * Get the user-visible handle using idr.
232 */
233again:
234 /* ensure there is space available to allocate a handle */
235 if (idr_pre_get(&file_priv->object_idr, GFP_KERNEL) == 0)
236 return -ENOMEM;
237
238 /* do the allocation under our spinlock */
239 spin_lock(&file_priv->table_lock);
Pekka Paalanena1a2d1d2009-08-23 12:40:55 +0300240 ret = idr_get_new_above(&file_priv->object_idr, obj, 1, (int *)handlep);
Eric Anholt673a3942008-07-30 12:06:12 -0700241 spin_unlock(&file_priv->table_lock);
242 if (ret == -EAGAIN)
243 goto again;
244
245 if (ret != 0)
246 return ret;
247
248 drm_gem_object_handle_reference(obj);
249 return 0;
250}
251EXPORT_SYMBOL(drm_gem_handle_create);
252
253/** Returns a reference to the object named by the handle. */
254struct drm_gem_object *
255drm_gem_object_lookup(struct drm_device *dev, struct drm_file *filp,
Pekka Paalanena1a2d1d2009-08-23 12:40:55 +0300256 u32 handle)
Eric Anholt673a3942008-07-30 12:06:12 -0700257{
258 struct drm_gem_object *obj;
259
260 spin_lock(&filp->table_lock);
261
262 /* Check if we currently have a reference on the object */
263 obj = idr_find(&filp->object_idr, handle);
264 if (obj == NULL) {
265 spin_unlock(&filp->table_lock);
266 return NULL;
267 }
268
269 drm_gem_object_reference(obj);
270
271 spin_unlock(&filp->table_lock);
272
273 return obj;
274}
275EXPORT_SYMBOL(drm_gem_object_lookup);
276
277/**
278 * Releases the handle to an mm object.
279 */
280int
281drm_gem_close_ioctl(struct drm_device *dev, void *data,
282 struct drm_file *file_priv)
283{
284 struct drm_gem_close *args = data;
285 int ret;
286
287 if (!(dev->driver->driver_features & DRIVER_GEM))
288 return -ENODEV;
289
290 ret = drm_gem_handle_delete(file_priv, args->handle);
291
292 return ret;
293}
294
295/**
296 * Create a global name for an object, returning the name.
297 *
298 * Note that the name does not hold a reference; when the object
299 * is freed, the name goes away.
300 */
301int
302drm_gem_flink_ioctl(struct drm_device *dev, void *data,
303 struct drm_file *file_priv)
304{
305 struct drm_gem_flink *args = data;
306 struct drm_gem_object *obj;
307 int ret;
308
309 if (!(dev->driver->driver_features & DRIVER_GEM))
310 return -ENODEV;
311
312 obj = drm_gem_object_lookup(dev, file_priv, args->handle);
313 if (obj == NULL)
Chris Wilsonbf79cb92010-08-04 14:19:46 +0100314 return -ENOENT;
Eric Anholt673a3942008-07-30 12:06:12 -0700315
316again:
Chris Wilson3e49c4f2009-02-09 11:31:41 +0000317 if (idr_pre_get(&dev->object_name_idr, GFP_KERNEL) == 0) {
318 ret = -ENOMEM;
319 goto err;
320 }
Eric Anholt673a3942008-07-30 12:06:12 -0700321
322 spin_lock(&dev->object_name_lock);
Chris Wilson8d59bae2009-02-11 14:26:28 +0000323 if (!obj->name) {
324 ret = idr_get_new_above(&dev->object_name_idr, obj, 1,
325 &obj->name);
326 args->name = (uint64_t) obj->name;
Eric Anholt673a3942008-07-30 12:06:12 -0700327 spin_unlock(&dev->object_name_lock);
Chris Wilson8d59bae2009-02-11 14:26:28 +0000328
329 if (ret == -EAGAIN)
330 goto again;
331
332 if (ret != 0)
333 goto err;
334
335 /* Allocate a reference for the name table. */
336 drm_gem_object_reference(obj);
337 } else {
338 args->name = (uint64_t) obj->name;
339 spin_unlock(&dev->object_name_lock);
340 ret = 0;
Eric Anholt673a3942008-07-30 12:06:12 -0700341 }
Chris Wilson3e49c4f2009-02-09 11:31:41 +0000342
343err:
Luca Barbieribc9025b2010-02-09 05:49:12 +0000344 drm_gem_object_unreference_unlocked(obj);
Chris Wilson3e49c4f2009-02-09 11:31:41 +0000345 return ret;
Eric Anholt673a3942008-07-30 12:06:12 -0700346}
347
348/**
349 * Open an object using the global name, returning a handle and the size.
350 *
351 * This handle (of course) holds a reference to the object, so the object
352 * will not go away until the handle is deleted.
353 */
354int
355drm_gem_open_ioctl(struct drm_device *dev, void *data,
356 struct drm_file *file_priv)
357{
358 struct drm_gem_open *args = data;
359 struct drm_gem_object *obj;
360 int ret;
Pekka Paalanena1a2d1d2009-08-23 12:40:55 +0300361 u32 handle;
Eric Anholt673a3942008-07-30 12:06:12 -0700362
363 if (!(dev->driver->driver_features & DRIVER_GEM))
364 return -ENODEV;
365
366 spin_lock(&dev->object_name_lock);
367 obj = idr_find(&dev->object_name_idr, (int) args->name);
368 if (obj)
369 drm_gem_object_reference(obj);
370 spin_unlock(&dev->object_name_lock);
371 if (!obj)
372 return -ENOENT;
373
374 ret = drm_gem_handle_create(file_priv, obj, &handle);
Luca Barbieribc9025b2010-02-09 05:49:12 +0000375 drm_gem_object_unreference_unlocked(obj);
Eric Anholt673a3942008-07-30 12:06:12 -0700376 if (ret)
377 return ret;
378
379 args->handle = handle;
380 args->size = obj->size;
381
382 return 0;
383}
384
385/**
386 * Called at device open time, sets up the structure for handling refcounting
387 * of mm objects.
388 */
389void
390drm_gem_open(struct drm_device *dev, struct drm_file *file_private)
391{
392 idr_init(&file_private->object_idr);
393 spin_lock_init(&file_private->table_lock);
394}
395
396/**
397 * Called at device close to release the file's
398 * handle references on objects.
399 */
400static int
401drm_gem_object_release_handle(int id, void *ptr, void *data)
402{
403 struct drm_gem_object *obj = ptr;
404
Luca Barbieribc9025b2010-02-09 05:49:12 +0000405 drm_gem_object_handle_unreference_unlocked(obj);
Eric Anholt673a3942008-07-30 12:06:12 -0700406
407 return 0;
408}
409
410/**
411 * Called at close time when the filp is going away.
412 *
413 * Releases any remaining references on objects by this filp.
414 */
415void
416drm_gem_release(struct drm_device *dev, struct drm_file *file_private)
417{
Eric Anholt673a3942008-07-30 12:06:12 -0700418 idr_for_each(&file_private->object_idr,
419 &drm_gem_object_release_handle, NULL);
420
Chris Wilsonddd3d062010-07-24 22:28:25 +0100421 idr_remove_all(&file_private->object_idr);
Eric Anholt673a3942008-07-30 12:06:12 -0700422 idr_destroy(&file_private->object_idr);
Eric Anholt673a3942008-07-30 12:06:12 -0700423}
424
Daniel Vetterfd632aa2010-04-09 19:05:05 +0000425void
426drm_gem_object_release(struct drm_gem_object *obj)
Luca Barbieric3ae90c2010-02-09 05:49:11 +0000427{
Luca Barbieric3ae90c2010-02-09 05:49:11 +0000428 fput(obj->filp);
Luca Barbieric3ae90c2010-02-09 05:49:11 +0000429}
Daniel Vetterfd632aa2010-04-09 19:05:05 +0000430EXPORT_SYMBOL(drm_gem_object_release);
Luca Barbieric3ae90c2010-02-09 05:49:11 +0000431
Eric Anholt673a3942008-07-30 12:06:12 -0700432/**
433 * Called after the last reference to the object has been lost.
Luca Barbieric3ae90c2010-02-09 05:49:11 +0000434 * Must be called holding struct_ mutex
Eric Anholt673a3942008-07-30 12:06:12 -0700435 *
436 * Frees the object
437 */
438void
439drm_gem_object_free(struct kref *kref)
440{
441 struct drm_gem_object *obj = (struct drm_gem_object *) kref;
442 struct drm_device *dev = obj->dev;
443
444 BUG_ON(!mutex_is_locked(&dev->struct_mutex));
445
446 if (dev->driver->gem_free_object != NULL)
447 dev->driver->gem_free_object(obj);
Eric Anholt673a3942008-07-30 12:06:12 -0700448}
449EXPORT_SYMBOL(drm_gem_object_free);
450
Luca Barbieric3ae90c2010-02-09 05:49:11 +0000451static void drm_gem_object_ref_bug(struct kref *list_kref)
452{
453 BUG();
454}
455
456/**
Eric Anholt673a3942008-07-30 12:06:12 -0700457 * Called after the last handle to the object has been closed
458 *
459 * Removes any name for the object. Note that this must be
460 * called before drm_gem_object_free or we'll be touching
461 * freed memory
462 */
Dave Airlie29d08b32010-09-27 16:17:17 +1000463void drm_gem_object_handle_free(struct drm_gem_object *obj)
Eric Anholt673a3942008-07-30 12:06:12 -0700464{
Eric Anholt673a3942008-07-30 12:06:12 -0700465 struct drm_device *dev = obj->dev;
466
467 /* Remove any name for this object */
468 spin_lock(&dev->object_name_lock);
469 if (obj->name) {
470 idr_remove(&dev->object_name_idr, obj->name);
Chris Wilson8d59bae2009-02-11 14:26:28 +0000471 obj->name = 0;
Eric Anholt673a3942008-07-30 12:06:12 -0700472 spin_unlock(&dev->object_name_lock);
473 /*
474 * The object name held a reference to this object, drop
475 * that now.
Luca Barbieric3ae90c2010-02-09 05:49:11 +0000476 *
477 * This cannot be the last reference, since the handle holds one too.
Eric Anholt673a3942008-07-30 12:06:12 -0700478 */
Luca Barbieric3ae90c2010-02-09 05:49:11 +0000479 kref_put(&obj->refcount, drm_gem_object_ref_bug);
Eric Anholt673a3942008-07-30 12:06:12 -0700480 } else
481 spin_unlock(&dev->object_name_lock);
482
483}
484EXPORT_SYMBOL(drm_gem_object_handle_free);
485
Jesse Barnesab00b3e2009-02-11 14:01:46 -0800486void drm_gem_vm_open(struct vm_area_struct *vma)
487{
488 struct drm_gem_object *obj = vma->vm_private_data;
489
490 drm_gem_object_reference(obj);
Chris Wilson31dfbc92010-09-27 21:28:30 +0100491
492 mutex_lock(&obj->dev->struct_mutex);
493 drm_vm_open_locked(vma);
494 mutex_unlock(&obj->dev->struct_mutex);
Jesse Barnesab00b3e2009-02-11 14:01:46 -0800495}
496EXPORT_SYMBOL(drm_gem_vm_open);
497
498void drm_gem_vm_close(struct vm_area_struct *vma)
499{
500 struct drm_gem_object *obj = vma->vm_private_data;
Jesse Barnesab00b3e2009-02-11 14:01:46 -0800501
Chris Wilson31dfbc92010-09-27 21:28:30 +0100502 mutex_lock(&obj->dev->struct_mutex);
503 drm_vm_close_locked(vma);
504 drm_gem_object_unreference(obj);
505 mutex_unlock(&obj->dev->struct_mutex);
Jesse Barnesab00b3e2009-02-11 14:01:46 -0800506}
507EXPORT_SYMBOL(drm_gem_vm_close);
508
509
Jesse Barnesa2c0a972008-11-05 10:31:53 -0800510/**
511 * drm_gem_mmap - memory map routine for GEM objects
512 * @filp: DRM file pointer
513 * @vma: VMA for the area to be mapped
514 *
515 * If a driver supports GEM object mapping, mmap calls on the DRM file
516 * descriptor will end up here.
517 *
518 * If we find the object based on the offset passed in (vma->vm_pgoff will
519 * contain the fake offset we created when the GTT map ioctl was called on
520 * the object), we set up the driver fault handler so that any accesses
521 * to the object can be trapped, to perform migration, GTT binding, surface
522 * register allocation, or performance monitoring.
523 */
524int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
525{
526 struct drm_file *priv = filp->private_data;
527 struct drm_device *dev = priv->minor->dev;
528 struct drm_gem_mm *mm = dev->mm_private;
Benjamin Herrenschmidtf77d3902009-02-02 16:55:46 +1100529 struct drm_local_map *map = NULL;
Jesse Barnesa2c0a972008-11-05 10:31:53 -0800530 struct drm_gem_object *obj;
531 struct drm_hash_item *hash;
Jesse Barnesa2c0a972008-11-05 10:31:53 -0800532 int ret = 0;
533
534 mutex_lock(&dev->struct_mutex);
535
536 if (drm_ht_find_item(&mm->offset_hash, vma->vm_pgoff, &hash)) {
537 mutex_unlock(&dev->struct_mutex);
538 return drm_mmap(filp, vma);
539 }
540
541 map = drm_hash_entry(hash, struct drm_map_list, hash)->map;
542 if (!map ||
543 ((map->flags & _DRM_RESTRICTED) && !capable(CAP_SYS_ADMIN))) {
544 ret = -EPERM;
545 goto out_unlock;
546 }
547
548 /* Check for valid size. */
549 if (map->size < vma->vm_end - vma->vm_start) {
550 ret = -EINVAL;
551 goto out_unlock;
552 }
553
554 obj = map->handle;
555 if (!obj->dev->driver->gem_vm_ops) {
556 ret = -EINVAL;
557 goto out_unlock;
558 }
559
560 vma->vm_flags |= VM_RESERVED | VM_IO | VM_PFNMAP | VM_DONTEXPAND;
561 vma->vm_ops = obj->dev->driver->gem_vm_ops;
562 vma->vm_private_data = map->handle;
Jeremy Fitzhardinge79cc3042009-11-17 14:08:54 -0800563 vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
Jesse Barnesa2c0a972008-11-05 10:31:53 -0800564
Jesse Barnesab00b3e2009-02-11 14:01:46 -0800565 /* Take a ref for this mapping of the object, so that the fault
566 * handler can dereference the mmap offset's pointer to the object.
567 * This reference is cleaned up by the corresponding vm_close
568 * (which should happen whether the vma was created by this call, or
569 * by a vm_open due to mremap or partial unmap or whatever).
570 */
571 drm_gem_object_reference(obj);
572
Jesse Barnesa2c0a972008-11-05 10:31:53 -0800573 vma->vm_file = filp; /* Needed for drm_vm_open() */
574 drm_vm_open_locked(vma);
575
576out_unlock:
577 mutex_unlock(&dev->struct_mutex);
578
579 return ret;
580}
581EXPORT_SYMBOL(drm_gem_mmap);