xref: /openbmc/linux/drivers/gpu/drm/msm/msm_gem.c (revision 2638d90a)
1 /*
2  * Copyright (C) 2013 Red Hat
3  * Author: Rob Clark <robdclark@gmail.com>
4  *
5  * This program is free software; you can redistribute it and/or modify it
6  * under the terms of the GNU General Public License version 2 as published by
7  * the Free Software Foundation.
8  *
9  * This program is distributed in the hope that it will be useful, but WITHOUT
10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
12  * more details.
13  *
14  * You should have received a copy of the GNU General Public License along with
15  * this program.  If not, see <http://www.gnu.org/licenses/>.
16  */
17 
18 #include <linux/spinlock.h>
19 #include <linux/shmem_fs.h>
20 #include <linux/dma-buf.h>
21 
22 #include "msm_drv.h"
23 #include "msm_gem.h"
24 #include "msm_gpu.h"
25 #include "msm_mmu.h"
26 
27 static dma_addr_t physaddr(struct drm_gem_object *obj)
28 {
29 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
30 	struct msm_drm_private *priv = obj->dev->dev_private;
31 	return (((dma_addr_t)msm_obj->vram_node->start) << PAGE_SHIFT) +
32 			priv->vram.paddr;
33 }
34 
35 /* allocate pages from VRAM carveout, used when no IOMMU: */
36 static struct page **get_pages_vram(struct drm_gem_object *obj,
37 		int npages)
38 {
39 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
40 	struct msm_drm_private *priv = obj->dev->dev_private;
41 	dma_addr_t paddr;
42 	struct page **p;
43 	int ret, i;
44 
45 	p = drm_malloc_ab(npages, sizeof(struct page *));
46 	if (!p)
47 		return ERR_PTR(-ENOMEM);
48 
49 	ret = drm_mm_insert_node(&priv->vram.mm, msm_obj->vram_node,
50 			npages, 0, DRM_MM_SEARCH_DEFAULT);
51 	if (ret) {
52 		drm_free_large(p);
53 		return ERR_PTR(ret);
54 	}
55 
56 	paddr = physaddr(obj);
57 	for (i = 0; i < npages; i++) {
58 		p[i] = phys_to_page(paddr);
59 		paddr += PAGE_SIZE;
60 	}
61 
62 	return p;
63 }
64 
65 /* called with dev->struct_mutex held */
66 static struct page **get_pages(struct drm_gem_object *obj)
67 {
68 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
69 
70 	if (!msm_obj->pages) {
71 		struct drm_device *dev = obj->dev;
72 		struct page **p;
73 		int npages = obj->size >> PAGE_SHIFT;
74 
75 		if (iommu_present(&platform_bus_type))
76 			p = drm_gem_get_pages(obj);
77 		else
78 			p = get_pages_vram(obj, npages);
79 
80 		if (IS_ERR(p)) {
81 			dev_err(dev->dev, "could not get pages: %ld\n",
82 					PTR_ERR(p));
83 			return p;
84 		}
85 
86 		msm_obj->sgt = drm_prime_pages_to_sg(p, npages);
87 		if (IS_ERR(msm_obj->sgt)) {
88 			dev_err(dev->dev, "failed to allocate sgt\n");
89 			return ERR_CAST(msm_obj->sgt);
90 		}
91 
92 		msm_obj->pages = p;
93 
94 		/* For non-cached buffers, ensure the new pages are clean
95 		 * because display controller, GPU, etc. are not coherent:
96 		 */
97 		if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
98 			dma_map_sg(dev->dev, msm_obj->sgt->sgl,
99 					msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
100 	}
101 
102 	return msm_obj->pages;
103 }
104 
105 static void put_pages(struct drm_gem_object *obj)
106 {
107 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
108 
109 	if (msm_obj->pages) {
110 		/* For non-cached buffers, ensure the new pages are clean
111 		 * because display controller, GPU, etc. are not coherent:
112 		 */
113 		if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
114 			dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl,
115 					msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
116 		sg_free_table(msm_obj->sgt);
117 		kfree(msm_obj->sgt);
118 
119 		if (iommu_present(&platform_bus_type))
120 			drm_gem_put_pages(obj, msm_obj->pages, true, false);
121 		else {
122 			drm_mm_remove_node(msm_obj->vram_node);
123 			drm_free_large(msm_obj->pages);
124 		}
125 
126 		msm_obj->pages = NULL;
127 	}
128 }
129 
130 struct page **msm_gem_get_pages(struct drm_gem_object *obj)
131 {
132 	struct drm_device *dev = obj->dev;
133 	struct page **p;
134 	mutex_lock(&dev->struct_mutex);
135 	p = get_pages(obj);
136 	mutex_unlock(&dev->struct_mutex);
137 	return p;
138 }
139 
140 void msm_gem_put_pages(struct drm_gem_object *obj)
141 {
142 	/* when we start tracking the pin count, then do something here */
143 }
144 
145 int msm_gem_mmap_obj(struct drm_gem_object *obj,
146 		struct vm_area_struct *vma)
147 {
148 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
149 
150 	vma->vm_flags &= ~VM_PFNMAP;
151 	vma->vm_flags |= VM_MIXEDMAP;
152 
153 	if (msm_obj->flags & MSM_BO_WC) {
154 		vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
155 	} else if (msm_obj->flags & MSM_BO_UNCACHED) {
156 		vma->vm_page_prot = pgprot_noncached(vm_get_page_prot(vma->vm_flags));
157 	} else {
158 		/*
159 		 * Shunt off cached objs to shmem file so they have their own
160 		 * address_space (so unmap_mapping_range does what we want,
161 		 * in particular in the case of mmap'd dmabufs)
162 		 */
163 		fput(vma->vm_file);
164 		get_file(obj->filp);
165 		vma->vm_pgoff = 0;
166 		vma->vm_file  = obj->filp;
167 
168 		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
169 	}
170 
171 	return 0;
172 }
173 
174 int msm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
175 {
176 	int ret;
177 
178 	ret = drm_gem_mmap(filp, vma);
179 	if (ret) {
180 		DBG("mmap failed: %d", ret);
181 		return ret;
182 	}
183 
184 	return msm_gem_mmap_obj(vma->vm_private_data, vma);
185 }
186 
187 int msm_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
188 {
189 	struct drm_gem_object *obj = vma->vm_private_data;
190 	struct drm_device *dev = obj->dev;
191 	struct page **pages;
192 	unsigned long pfn;
193 	pgoff_t pgoff;
194 	int ret;
195 
196 	/* Make sure we don't parallel update on a fault, nor move or remove
197 	 * something from beneath our feet
198 	 */
199 	ret = mutex_lock_interruptible(&dev->struct_mutex);
200 	if (ret)
201 		goto out;
202 
203 	/* make sure we have pages attached now */
204 	pages = get_pages(obj);
205 	if (IS_ERR(pages)) {
206 		ret = PTR_ERR(pages);
207 		goto out_unlock;
208 	}
209 
210 	/* We don't use vmf->pgoff since that has the fake offset: */
211 	pgoff = ((unsigned long)vmf->virtual_address -
212 			vma->vm_start) >> PAGE_SHIFT;
213 
214 	pfn = page_to_pfn(pages[pgoff]);
215 
216 	VERB("Inserting %p pfn %lx, pa %lx", vmf->virtual_address,
217 			pfn, pfn << PAGE_SHIFT);
218 
219 	ret = vm_insert_mixed(vma, (unsigned long)vmf->virtual_address, pfn);
220 
221 out_unlock:
222 	mutex_unlock(&dev->struct_mutex);
223 out:
224 	switch (ret) {
225 	case -EAGAIN:
226 	case 0:
227 	case -ERESTARTSYS:
228 	case -EINTR:
229 	case -EBUSY:
230 		/*
231 		 * EBUSY is ok: this just means that another thread
232 		 * already did the job.
233 		 */
234 		return VM_FAULT_NOPAGE;
235 	case -ENOMEM:
236 		return VM_FAULT_OOM;
237 	default:
238 		return VM_FAULT_SIGBUS;
239 	}
240 }
241 
242 /** get mmap offset */
243 static uint64_t mmap_offset(struct drm_gem_object *obj)
244 {
245 	struct drm_device *dev = obj->dev;
246 	int ret;
247 
248 	WARN_ON(!mutex_is_locked(&dev->struct_mutex));
249 
250 	/* Make it mmapable */
251 	ret = drm_gem_create_mmap_offset(obj);
252 
253 	if (ret) {
254 		dev_err(dev->dev, "could not allocate mmap offset\n");
255 		return 0;
256 	}
257 
258 	return drm_vma_node_offset_addr(&obj->vma_node);
259 }
260 
261 uint64_t msm_gem_mmap_offset(struct drm_gem_object *obj)
262 {
263 	uint64_t offset;
264 	mutex_lock(&obj->dev->struct_mutex);
265 	offset = mmap_offset(obj);
266 	mutex_unlock(&obj->dev->struct_mutex);
267 	return offset;
268 }
269 
270 /* should be called under struct_mutex.. although it can be called
271  * from atomic context without struct_mutex to acquire an extra
272  * iova ref if you know one is already held.
273  *
274  * That means when I do eventually need to add support for unpinning
275  * the refcnt counter needs to be atomic_t.
276  */
277 int msm_gem_get_iova_locked(struct drm_gem_object *obj, int id,
278 		uint32_t *iova)
279 {
280 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
281 	int ret = 0;
282 
283 	if (!msm_obj->domain[id].iova) {
284 		struct msm_drm_private *priv = obj->dev->dev_private;
285 		struct page **pages = get_pages(obj);
286 
287 		if (IS_ERR(pages))
288 			return PTR_ERR(pages);
289 
290 		if (iommu_present(&platform_bus_type)) {
291 			struct msm_mmu *mmu = priv->mmus[id];
292 			uint32_t offset;
293 
294 			if (WARN_ON(!mmu))
295 				return -EINVAL;
296 
297 			offset = (uint32_t)mmap_offset(obj);
298 			ret = mmu->funcs->map(mmu, offset, msm_obj->sgt,
299 					obj->size, IOMMU_READ | IOMMU_WRITE);
300 			msm_obj->domain[id].iova = offset;
301 		} else {
302 			msm_obj->domain[id].iova = physaddr(obj);
303 		}
304 	}
305 
306 	if (!ret)
307 		*iova = msm_obj->domain[id].iova;
308 
309 	return ret;
310 }
311 
312 /* get iova, taking a reference.  Should have a matching put */
313 int msm_gem_get_iova(struct drm_gem_object *obj, int id, uint32_t *iova)
314 {
315 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
316 	int ret;
317 
318 	/* this is safe right now because we don't unmap until the
319 	 * bo is deleted:
320 	 */
321 	if (msm_obj->domain[id].iova) {
322 		*iova = msm_obj->domain[id].iova;
323 		return 0;
324 	}
325 
326 	mutex_lock(&obj->dev->struct_mutex);
327 	ret = msm_gem_get_iova_locked(obj, id, iova);
328 	mutex_unlock(&obj->dev->struct_mutex);
329 	return ret;
330 }
331 
332 /* get iova without taking a reference, used in places where you have
333  * already done a 'msm_gem_get_iova()'.
334  */
335 uint32_t msm_gem_iova(struct drm_gem_object *obj, int id)
336 {
337 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
338 	WARN_ON(!msm_obj->domain[id].iova);
339 	return msm_obj->domain[id].iova;
340 }
341 
342 void msm_gem_put_iova(struct drm_gem_object *obj, int id)
343 {
344 	// XXX TODO ..
345 	// NOTE: probably don't need a _locked() version.. we wouldn't
346 	// normally unmap here, but instead just mark that it could be
347 	// unmapped (if the iova refcnt drops to zero), but then later
348 	// if another _get_iova_locked() fails we can start unmapping
349 	// things that are no longer needed..
350 }
351 
352 int msm_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
353 		struct drm_mode_create_dumb *args)
354 {
355 	args->pitch = align_pitch(args->width, args->bpp);
356 	args->size  = PAGE_ALIGN(args->pitch * args->height);
357 	return msm_gem_new_handle(dev, file, args->size,
358 			MSM_BO_SCANOUT | MSM_BO_WC, &args->handle);
359 }
360 
361 int msm_gem_dumb_map_offset(struct drm_file *file, struct drm_device *dev,
362 		uint32_t handle, uint64_t *offset)
363 {
364 	struct drm_gem_object *obj;
365 	int ret = 0;
366 
367 	/* GEM does all our handle to object mapping */
368 	obj = drm_gem_object_lookup(dev, file, handle);
369 	if (obj == NULL) {
370 		ret = -ENOENT;
371 		goto fail;
372 	}
373 
374 	*offset = msm_gem_mmap_offset(obj);
375 
376 	drm_gem_object_unreference_unlocked(obj);
377 
378 fail:
379 	return ret;
380 }
381 
382 void *msm_gem_vaddr_locked(struct drm_gem_object *obj)
383 {
384 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
385 	WARN_ON(!mutex_is_locked(&obj->dev->struct_mutex));
386 	if (!msm_obj->vaddr) {
387 		struct page **pages = get_pages(obj);
388 		if (IS_ERR(pages))
389 			return ERR_CAST(pages);
390 		msm_obj->vaddr = vmap(pages, obj->size >> PAGE_SHIFT,
391 				VM_MAP, pgprot_writecombine(PAGE_KERNEL));
392 	}
393 	return msm_obj->vaddr;
394 }
395 
396 void *msm_gem_vaddr(struct drm_gem_object *obj)
397 {
398 	void *ret;
399 	mutex_lock(&obj->dev->struct_mutex);
400 	ret = msm_gem_vaddr_locked(obj);
401 	mutex_unlock(&obj->dev->struct_mutex);
402 	return ret;
403 }
404 
405 /* setup callback for when bo is no longer busy..
406  * TODO probably want to differentiate read vs write..
407  */
408 int msm_gem_queue_inactive_cb(struct drm_gem_object *obj,
409 		struct msm_fence_cb *cb)
410 {
411 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
412 	uint32_t fence = msm_gem_fence(msm_obj,
413 			MSM_PREP_READ | MSM_PREP_WRITE);
414 	return msm_queue_fence_cb(obj->dev, cb, fence);
415 }
416 
417 void msm_gem_move_to_active(struct drm_gem_object *obj,
418 		struct msm_gpu *gpu, bool write, uint32_t fence)
419 {
420 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
421 	msm_obj->gpu = gpu;
422 	if (write)
423 		msm_obj->write_fence = fence;
424 	else
425 		msm_obj->read_fence = fence;
426 	list_del_init(&msm_obj->mm_list);
427 	list_add_tail(&msm_obj->mm_list, &gpu->active_list);
428 }
429 
430 void msm_gem_move_to_inactive(struct drm_gem_object *obj)
431 {
432 	struct drm_device *dev = obj->dev;
433 	struct msm_drm_private *priv = dev->dev_private;
434 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
435 
436 	WARN_ON(!mutex_is_locked(&dev->struct_mutex));
437 
438 	msm_obj->gpu = NULL;
439 	msm_obj->read_fence = 0;
440 	msm_obj->write_fence = 0;
441 	list_del_init(&msm_obj->mm_list);
442 	list_add_tail(&msm_obj->mm_list, &priv->inactive_list);
443 }
444 
445 int msm_gem_cpu_prep(struct drm_gem_object *obj, uint32_t op,
446 		struct timespec *timeout)
447 {
448 	struct drm_device *dev = obj->dev;
449 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
450 	int ret = 0;
451 
452 	if (is_active(msm_obj)) {
453 		uint32_t fence = msm_gem_fence(msm_obj, op);
454 
455 		if (op & MSM_PREP_NOSYNC)
456 			timeout = NULL;
457 
458 		ret = msm_wait_fence_interruptable(dev, fence, timeout);
459 	}
460 
461 	/* TODO cache maintenance */
462 
463 	return ret;
464 }
465 
466 int msm_gem_cpu_fini(struct drm_gem_object *obj)
467 {
468 	/* TODO cache maintenance */
469 	return 0;
470 }
471 
472 #ifdef CONFIG_DEBUG_FS
473 void msm_gem_describe(struct drm_gem_object *obj, struct seq_file *m)
474 {
475 	struct drm_device *dev = obj->dev;
476 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
477 	uint64_t off = drm_vma_node_start(&obj->vma_node);
478 
479 	WARN_ON(!mutex_is_locked(&dev->struct_mutex));
480 	seq_printf(m, "%08x: %c(r=%u,w=%u) %2d (%2d) %08llx %p %d\n",
481 			msm_obj->flags, is_active(msm_obj) ? 'A' : 'I',
482 			msm_obj->read_fence, msm_obj->write_fence,
483 			obj->name, obj->refcount.refcount.counter,
484 			off, msm_obj->vaddr, obj->size);
485 }
486 
487 void msm_gem_describe_objects(struct list_head *list, struct seq_file *m)
488 {
489 	struct msm_gem_object *msm_obj;
490 	int count = 0;
491 	size_t size = 0;
492 
493 	list_for_each_entry(msm_obj, list, mm_list) {
494 		struct drm_gem_object *obj = &msm_obj->base;
495 		seq_printf(m, "   ");
496 		msm_gem_describe(obj, m);
497 		count++;
498 		size += obj->size;
499 	}
500 
501 	seq_printf(m, "Total %d objects, %zu bytes\n", count, size);
502 }
503 #endif
504 
505 void msm_gem_free_object(struct drm_gem_object *obj)
506 {
507 	struct drm_device *dev = obj->dev;
508 	struct msm_drm_private *priv = obj->dev->dev_private;
509 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
510 	int id;
511 
512 	WARN_ON(!mutex_is_locked(&dev->struct_mutex));
513 
514 	/* object should not be on active list: */
515 	WARN_ON(is_active(msm_obj));
516 
517 	list_del(&msm_obj->mm_list);
518 
519 	for (id = 0; id < ARRAY_SIZE(msm_obj->domain); id++) {
520 		struct msm_mmu *mmu = priv->mmus[id];
521 		if (mmu && msm_obj->domain[id].iova) {
522 			uint32_t offset = (uint32_t)mmap_offset(obj);
523 			mmu->funcs->unmap(mmu, offset, msm_obj->sgt, obj->size);
524 		}
525 	}
526 
527 	drm_gem_free_mmap_offset(obj);
528 
529 	if (obj->import_attach) {
530 		if (msm_obj->vaddr)
531 			dma_buf_vunmap(obj->import_attach->dmabuf, msm_obj->vaddr);
532 
533 		/* Don't drop the pages for imported dmabuf, as they are not
534 		 * ours, just free the array we allocated:
535 		 */
536 		if (msm_obj->pages)
537 			drm_free_large(msm_obj->pages);
538 
539 	} else {
540 		if (msm_obj->vaddr)
541 			vunmap(msm_obj->vaddr);
542 		put_pages(obj);
543 	}
544 
545 	if (msm_obj->resv == &msm_obj->_resv)
546 		reservation_object_fini(msm_obj->resv);
547 
548 	drm_gem_object_release(obj);
549 
550 	kfree(msm_obj);
551 }
552 
553 /* convenience method to construct a GEM buffer object, and userspace handle */
554 int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file,
555 		uint32_t size, uint32_t flags, uint32_t *handle)
556 {
557 	struct drm_gem_object *obj;
558 	int ret;
559 
560 	ret = mutex_lock_interruptible(&dev->struct_mutex);
561 	if (ret)
562 		return ret;
563 
564 	obj = msm_gem_new(dev, size, flags);
565 
566 	mutex_unlock(&dev->struct_mutex);
567 
568 	if (IS_ERR(obj))
569 		return PTR_ERR(obj);
570 
571 	ret = drm_gem_handle_create(file, obj, handle);
572 
573 	/* drop reference from allocate - handle holds it now */
574 	drm_gem_object_unreference_unlocked(obj);
575 
576 	return ret;
577 }
578 
579 static int msm_gem_new_impl(struct drm_device *dev,
580 		uint32_t size, uint32_t flags,
581 		struct drm_gem_object **obj)
582 {
583 	struct msm_drm_private *priv = dev->dev_private;
584 	struct msm_gem_object *msm_obj;
585 	unsigned sz;
586 
587 	switch (flags & MSM_BO_CACHE_MASK) {
588 	case MSM_BO_UNCACHED:
589 	case MSM_BO_CACHED:
590 	case MSM_BO_WC:
591 		break;
592 	default:
593 		dev_err(dev->dev, "invalid cache flag: %x\n",
594 				(flags & MSM_BO_CACHE_MASK));
595 		return -EINVAL;
596 	}
597 
598 	sz = sizeof(*msm_obj);
599 	if (!iommu_present(&platform_bus_type))
600 		sz += sizeof(struct drm_mm_node);
601 
602 	msm_obj = kzalloc(sz, GFP_KERNEL);
603 	if (!msm_obj)
604 		return -ENOMEM;
605 
606 	if (!iommu_present(&platform_bus_type))
607 		msm_obj->vram_node = (void *)&msm_obj[1];
608 
609 	msm_obj->flags = flags;
610 
611 	msm_obj->resv = &msm_obj->_resv;
612 	reservation_object_init(msm_obj->resv);
613 
614 	INIT_LIST_HEAD(&msm_obj->submit_entry);
615 	list_add_tail(&msm_obj->mm_list, &priv->inactive_list);
616 
617 	*obj = &msm_obj->base;
618 
619 	return 0;
620 }
621 
622 struct drm_gem_object *msm_gem_new(struct drm_device *dev,
623 		uint32_t size, uint32_t flags)
624 {
625 	struct drm_gem_object *obj = NULL;
626 	int ret;
627 
628 	WARN_ON(!mutex_is_locked(&dev->struct_mutex));
629 
630 	size = PAGE_ALIGN(size);
631 
632 	ret = msm_gem_new_impl(dev, size, flags, &obj);
633 	if (ret)
634 		goto fail;
635 
636 	if (iommu_present(&platform_bus_type)) {
637 		ret = drm_gem_object_init(dev, obj, size);
638 		if (ret)
639 			goto fail;
640 	} else {
641 		drm_gem_private_object_init(dev, obj, size);
642 	}
643 
644 	return obj;
645 
646 fail:
647 	if (obj)
648 		drm_gem_object_unreference(obj);
649 
650 	return ERR_PTR(ret);
651 }
652 
653 struct drm_gem_object *msm_gem_import(struct drm_device *dev,
654 		uint32_t size, struct sg_table *sgt)
655 {
656 	struct msm_gem_object *msm_obj;
657 	struct drm_gem_object *obj;
658 	int ret, npages;
659 
660 	/* if we don't have IOMMU, don't bother pretending we can import: */
661 	if (!iommu_present(&platform_bus_type)) {
662 		dev_err(dev->dev, "cannot import without IOMMU\n");
663 		return ERR_PTR(-EINVAL);
664 	}
665 
666 	size = PAGE_ALIGN(size);
667 
668 	ret = msm_gem_new_impl(dev, size, MSM_BO_WC, &obj);
669 	if (ret)
670 		goto fail;
671 
672 	drm_gem_private_object_init(dev, obj, size);
673 
674 	npages = size / PAGE_SIZE;
675 
676 	msm_obj = to_msm_bo(obj);
677 	msm_obj->sgt = sgt;
678 	msm_obj->pages = drm_malloc_ab(npages, sizeof(struct page *));
679 	if (!msm_obj->pages) {
680 		ret = -ENOMEM;
681 		goto fail;
682 	}
683 
684 	ret = drm_prime_sg_to_page_addr_arrays(sgt, msm_obj->pages, NULL, npages);
685 	if (ret)
686 		goto fail;
687 
688 	return obj;
689 
690 fail:
691 	if (obj)
692 		drm_gem_object_unreference_unlocked(obj);
693 
694 	return ERR_PTR(ret);
695 }
696