xref: /openbmc/linux/drivers/gpu/drm/msm/msm_gem.c (revision 9999f105)
1 /*
2  * Copyright (C) 2013 Red Hat
3  * Author: Rob Clark <robdclark@gmail.com>
4  *
5  * This program is free software; you can redistribute it and/or modify it
6  * under the terms of the GNU General Public License version 2 as published by
7  * the Free Software Foundation.
8  *
9  * This program is distributed in the hope that it will be useful, but WITHOUT
10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
12  * more details.
13  *
14  * You should have received a copy of the GNU General Public License along with
15  * this program.  If not, see <http://www.gnu.org/licenses/>.
16  */
17 
18 #include <linux/spinlock.h>
19 #include <linux/shmem_fs.h>
20 #include <linux/dma-buf.h>
21 
22 #include "msm_drv.h"
23 #include "msm_gem.h"
24 #include "msm_gpu.h"
25 #include "msm_mmu.h"
26 
27 static dma_addr_t physaddr(struct drm_gem_object *obj)
28 {
29 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
30 	struct msm_drm_private *priv = obj->dev->dev_private;
31 	return (((dma_addr_t)msm_obj->vram_node->start) << PAGE_SHIFT) +
32 			priv->vram.paddr;
33 }
34 
35 /* allocate pages from VRAM carveout, used when no IOMMU: */
36 static struct page **get_pages_vram(struct drm_gem_object *obj,
37 		int npages)
38 {
39 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
40 	struct msm_drm_private *priv = obj->dev->dev_private;
41 	dma_addr_t paddr;
42 	struct page **p;
43 	int ret, i;
44 
45 	p = drm_malloc_ab(npages, sizeof(struct page *));
46 	if (!p)
47 		return ERR_PTR(-ENOMEM);
48 
49 	ret = drm_mm_insert_node(&priv->vram.mm, msm_obj->vram_node,
50 			npages, 0, DRM_MM_SEARCH_DEFAULT);
51 	if (ret) {
52 		drm_free_large(p);
53 		return ERR_PTR(ret);
54 	}
55 
56 	paddr = physaddr(obj);
57 	for (i = 0; i < npages; i++) {
58 		p[i] = phys_to_page(paddr);
59 		paddr += PAGE_SIZE;
60 	}
61 
62 	return p;
63 }
64 
65 /* called with dev->struct_mutex held */
66 static struct page **get_pages(struct drm_gem_object *obj)
67 {
68 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
69 
70 	if (!msm_obj->pages) {
71 		struct drm_device *dev = obj->dev;
72 		struct page **p;
73 		int npages = obj->size >> PAGE_SHIFT;
74 
75 		if (iommu_present(&platform_bus_type))
76 			p = drm_gem_get_pages(obj, 0);
77 		else
78 			p = get_pages_vram(obj, npages);
79 
80 		if (IS_ERR(p)) {
81 			dev_err(dev->dev, "could not get pages: %ld\n",
82 					PTR_ERR(p));
83 			return p;
84 		}
85 
86 		msm_obj->sgt = drm_prime_pages_to_sg(p, npages);
87 		if (IS_ERR(msm_obj->sgt)) {
88 			dev_err(dev->dev, "failed to allocate sgt\n");
89 			return ERR_CAST(msm_obj->sgt);
90 		}
91 
92 		msm_obj->pages = p;
93 
94 		/* For non-cached buffers, ensure the new pages are clean
95 		 * because display controller, GPU, etc. are not coherent:
96 		 */
97 		if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
98 			dma_map_sg(dev->dev, msm_obj->sgt->sgl,
99 					msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
100 	}
101 
102 	return msm_obj->pages;
103 }
104 
105 static void put_pages(struct drm_gem_object *obj)
106 {
107 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
108 
109 	if (msm_obj->pages) {
110 		/* For non-cached buffers, ensure the new pages are clean
111 		 * because display controller, GPU, etc. are not coherent:
112 		 */
113 		if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
114 			dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl,
115 					msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
116 		sg_free_table(msm_obj->sgt);
117 		kfree(msm_obj->sgt);
118 
119 		if (iommu_present(&platform_bus_type))
120 			drm_gem_put_pages(obj, msm_obj->pages, true, false);
121 		else
122 			drm_mm_remove_node(msm_obj->vram_node);
123 
124 		msm_obj->pages = NULL;
125 	}
126 }
127 
128 struct page **msm_gem_get_pages(struct drm_gem_object *obj)
129 {
130 	struct drm_device *dev = obj->dev;
131 	struct page **p;
132 	mutex_lock(&dev->struct_mutex);
133 	p = get_pages(obj);
134 	mutex_unlock(&dev->struct_mutex);
135 	return p;
136 }
137 
138 void msm_gem_put_pages(struct drm_gem_object *obj)
139 {
140 	/* when we start tracking the pin count, then do something here */
141 }
142 
143 int msm_gem_mmap_obj(struct drm_gem_object *obj,
144 		struct vm_area_struct *vma)
145 {
146 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
147 
148 	vma->vm_flags &= ~VM_PFNMAP;
149 	vma->vm_flags |= VM_MIXEDMAP;
150 
151 	if (msm_obj->flags & MSM_BO_WC) {
152 		vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
153 	} else if (msm_obj->flags & MSM_BO_UNCACHED) {
154 		vma->vm_page_prot = pgprot_noncached(vm_get_page_prot(vma->vm_flags));
155 	} else {
156 		/*
157 		 * Shunt off cached objs to shmem file so they have their own
158 		 * address_space (so unmap_mapping_range does what we want,
159 		 * in particular in the case of mmap'd dmabufs)
160 		 */
161 		fput(vma->vm_file);
162 		get_file(obj->filp);
163 		vma->vm_pgoff = 0;
164 		vma->vm_file  = obj->filp;
165 
166 		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
167 	}
168 
169 	return 0;
170 }
171 
172 int msm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
173 {
174 	int ret;
175 
176 	ret = drm_gem_mmap(filp, vma);
177 	if (ret) {
178 		DBG("mmap failed: %d", ret);
179 		return ret;
180 	}
181 
182 	return msm_gem_mmap_obj(vma->vm_private_data, vma);
183 }
184 
185 int msm_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
186 {
187 	struct drm_gem_object *obj = vma->vm_private_data;
188 	struct drm_device *dev = obj->dev;
189 	struct page **pages;
190 	unsigned long pfn;
191 	pgoff_t pgoff;
192 	int ret;
193 
194 	/* Make sure we don't parallel update on a fault, nor move or remove
195 	 * something from beneath our feet
196 	 */
197 	ret = mutex_lock_interruptible(&dev->struct_mutex);
198 	if (ret)
199 		goto out;
200 
201 	/* make sure we have pages attached now */
202 	pages = get_pages(obj);
203 	if (IS_ERR(pages)) {
204 		ret = PTR_ERR(pages);
205 		goto out_unlock;
206 	}
207 
208 	/* We don't use vmf->pgoff since that has the fake offset: */
209 	pgoff = ((unsigned long)vmf->virtual_address -
210 			vma->vm_start) >> PAGE_SHIFT;
211 
212 	pfn = page_to_pfn(pages[pgoff]);
213 
214 	VERB("Inserting %p pfn %lx, pa %lx", vmf->virtual_address,
215 			pfn, pfn << PAGE_SHIFT);
216 
217 	ret = vm_insert_mixed(vma, (unsigned long)vmf->virtual_address, pfn);
218 
219 out_unlock:
220 	mutex_unlock(&dev->struct_mutex);
221 out:
222 	switch (ret) {
223 	case -EAGAIN:
224 	case 0:
225 	case -ERESTARTSYS:
226 	case -EINTR:
227 	case -EBUSY:
228 		/*
229 		 * EBUSY is ok: this just means that another thread
230 		 * already did the job.
231 		 */
232 		return VM_FAULT_NOPAGE;
233 	case -ENOMEM:
234 		return VM_FAULT_OOM;
235 	default:
236 		return VM_FAULT_SIGBUS;
237 	}
238 }
239 
240 /** get mmap offset */
241 static uint64_t mmap_offset(struct drm_gem_object *obj)
242 {
243 	struct drm_device *dev = obj->dev;
244 	int ret;
245 
246 	WARN_ON(!mutex_is_locked(&dev->struct_mutex));
247 
248 	/* Make it mmapable */
249 	ret = drm_gem_create_mmap_offset(obj);
250 
251 	if (ret) {
252 		dev_err(dev->dev, "could not allocate mmap offset\n");
253 		return 0;
254 	}
255 
256 	return drm_vma_node_offset_addr(&obj->vma_node);
257 }
258 
259 uint64_t msm_gem_mmap_offset(struct drm_gem_object *obj)
260 {
261 	uint64_t offset;
262 	mutex_lock(&obj->dev->struct_mutex);
263 	offset = mmap_offset(obj);
264 	mutex_unlock(&obj->dev->struct_mutex);
265 	return offset;
266 }
267 
268 /* should be called under struct_mutex.. although it can be called
269  * from atomic context without struct_mutex to acquire an extra
270  * iova ref if you know one is already held.
271  *
272  * That means when I do eventually need to add support for unpinning
273  * the refcnt counter needs to be atomic_t.
274  */
275 int msm_gem_get_iova_locked(struct drm_gem_object *obj, int id,
276 		uint32_t *iova)
277 {
278 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
279 	int ret = 0;
280 
281 	if (!msm_obj->domain[id].iova) {
282 		struct msm_drm_private *priv = obj->dev->dev_private;
283 		struct msm_mmu *mmu = priv->mmus[id];
284 		struct page **pages = get_pages(obj);
285 
286 		if (IS_ERR(pages))
287 			return PTR_ERR(pages);
288 
289 		if (iommu_present(&platform_bus_type)) {
290 			uint32_t offset = (uint32_t)mmap_offset(obj);
291 			ret = mmu->funcs->map(mmu, offset, msm_obj->sgt,
292 					obj->size, IOMMU_READ | IOMMU_WRITE);
293 			msm_obj->domain[id].iova = offset;
294 		} else {
295 			msm_obj->domain[id].iova = physaddr(obj);
296 		}
297 	}
298 
299 	if (!ret)
300 		*iova = msm_obj->domain[id].iova;
301 
302 	return ret;
303 }
304 
305 int msm_gem_get_iova(struct drm_gem_object *obj, int id, uint32_t *iova)
306 {
307 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
308 	int ret;
309 
310 	/* this is safe right now because we don't unmap until the
311 	 * bo is deleted:
312 	 */
313 	if (msm_obj->domain[id].iova) {
314 		*iova = msm_obj->domain[id].iova;
315 		return 0;
316 	}
317 
318 	mutex_lock(&obj->dev->struct_mutex);
319 	ret = msm_gem_get_iova_locked(obj, id, iova);
320 	mutex_unlock(&obj->dev->struct_mutex);
321 	return ret;
322 }
323 
324 void msm_gem_put_iova(struct drm_gem_object *obj, int id)
325 {
326 	// XXX TODO ..
327 	// NOTE: probably don't need a _locked() version.. we wouldn't
328 	// normally unmap here, but instead just mark that it could be
329 	// unmapped (if the iova refcnt drops to zero), but then later
330 	// if another _get_iova_locked() fails we can start unmapping
331 	// things that are no longer needed..
332 }
333 
334 int msm_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
335 		struct drm_mode_create_dumb *args)
336 {
337 	args->pitch = align_pitch(args->width, args->bpp);
338 	args->size  = PAGE_ALIGN(args->pitch * args->height);
339 	return msm_gem_new_handle(dev, file, args->size,
340 			MSM_BO_SCANOUT | MSM_BO_WC, &args->handle);
341 }
342 
343 int msm_gem_dumb_map_offset(struct drm_file *file, struct drm_device *dev,
344 		uint32_t handle, uint64_t *offset)
345 {
346 	struct drm_gem_object *obj;
347 	int ret = 0;
348 
349 	/* GEM does all our handle to object mapping */
350 	obj = drm_gem_object_lookup(dev, file, handle);
351 	if (obj == NULL) {
352 		ret = -ENOENT;
353 		goto fail;
354 	}
355 
356 	*offset = msm_gem_mmap_offset(obj);
357 
358 	drm_gem_object_unreference_unlocked(obj);
359 
360 fail:
361 	return ret;
362 }
363 
364 void *msm_gem_vaddr_locked(struct drm_gem_object *obj)
365 {
366 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
367 	WARN_ON(!mutex_is_locked(&obj->dev->struct_mutex));
368 	if (!msm_obj->vaddr) {
369 		struct page **pages = get_pages(obj);
370 		if (IS_ERR(pages))
371 			return ERR_CAST(pages);
372 		msm_obj->vaddr = vmap(pages, obj->size >> PAGE_SHIFT,
373 				VM_MAP, pgprot_writecombine(PAGE_KERNEL));
374 	}
375 	return msm_obj->vaddr;
376 }
377 
378 void *msm_gem_vaddr(struct drm_gem_object *obj)
379 {
380 	void *ret;
381 	mutex_lock(&obj->dev->struct_mutex);
382 	ret = msm_gem_vaddr_locked(obj);
383 	mutex_unlock(&obj->dev->struct_mutex);
384 	return ret;
385 }
386 
387 /* setup callback for when bo is no longer busy..
388  * TODO probably want to differentiate read vs write..
389  */
390 int msm_gem_queue_inactive_cb(struct drm_gem_object *obj,
391 		struct msm_fence_cb *cb)
392 {
393 	struct drm_device *dev = obj->dev;
394 	struct msm_drm_private *priv = dev->dev_private;
395 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
396 	int ret = 0;
397 
398 	mutex_lock(&dev->struct_mutex);
399 	if (!list_empty(&cb->work.entry)) {
400 		ret = -EINVAL;
401 	} else if (is_active(msm_obj)) {
402 		cb->fence = max(msm_obj->read_fence, msm_obj->write_fence);
403 		list_add_tail(&cb->work.entry, &priv->fence_cbs);
404 	} else {
405 		queue_work(priv->wq, &cb->work);
406 	}
407 	mutex_unlock(&dev->struct_mutex);
408 
409 	return ret;
410 }
411 
412 void msm_gem_move_to_active(struct drm_gem_object *obj,
413 		struct msm_gpu *gpu, bool write, uint32_t fence)
414 {
415 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
416 	msm_obj->gpu = gpu;
417 	if (write)
418 		msm_obj->write_fence = fence;
419 	else
420 		msm_obj->read_fence = fence;
421 	list_del_init(&msm_obj->mm_list);
422 	list_add_tail(&msm_obj->mm_list, &gpu->active_list);
423 }
424 
425 void msm_gem_move_to_inactive(struct drm_gem_object *obj)
426 {
427 	struct drm_device *dev = obj->dev;
428 	struct msm_drm_private *priv = dev->dev_private;
429 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
430 
431 	WARN_ON(!mutex_is_locked(&dev->struct_mutex));
432 
433 	msm_obj->gpu = NULL;
434 	msm_obj->read_fence = 0;
435 	msm_obj->write_fence = 0;
436 	list_del_init(&msm_obj->mm_list);
437 	list_add_tail(&msm_obj->mm_list, &priv->inactive_list);
438 }
439 
440 int msm_gem_cpu_prep(struct drm_gem_object *obj, uint32_t op,
441 		struct timespec *timeout)
442 {
443 	struct drm_device *dev = obj->dev;
444 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
445 	int ret = 0;
446 
447 	if (is_active(msm_obj)) {
448 		uint32_t fence = 0;
449 
450 		if (op & MSM_PREP_READ)
451 			fence = msm_obj->write_fence;
452 		if (op & MSM_PREP_WRITE)
453 			fence = max(fence, msm_obj->read_fence);
454 		if (op & MSM_PREP_NOSYNC)
455 			timeout = NULL;
456 
457 		ret = msm_wait_fence_interruptable(dev, fence, timeout);
458 	}
459 
460 	/* TODO cache maintenance */
461 
462 	return ret;
463 }
464 
465 int msm_gem_cpu_fini(struct drm_gem_object *obj)
466 {
467 	/* TODO cache maintenance */
468 	return 0;
469 }
470 
471 #ifdef CONFIG_DEBUG_FS
472 void msm_gem_describe(struct drm_gem_object *obj, struct seq_file *m)
473 {
474 	struct drm_device *dev = obj->dev;
475 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
476 	uint64_t off = drm_vma_node_start(&obj->vma_node);
477 
478 	WARN_ON(!mutex_is_locked(&dev->struct_mutex));
479 	seq_printf(m, "%08x: %c(r=%u,w=%u) %2d (%2d) %08llx %p %d\n",
480 			msm_obj->flags, is_active(msm_obj) ? 'A' : 'I',
481 			msm_obj->read_fence, msm_obj->write_fence,
482 			obj->name, obj->refcount.refcount.counter,
483 			off, msm_obj->vaddr, obj->size);
484 }
485 
486 void msm_gem_describe_objects(struct list_head *list, struct seq_file *m)
487 {
488 	struct msm_gem_object *msm_obj;
489 	int count = 0;
490 	size_t size = 0;
491 
492 	list_for_each_entry(msm_obj, list, mm_list) {
493 		struct drm_gem_object *obj = &msm_obj->base;
494 		seq_printf(m, "   ");
495 		msm_gem_describe(obj, m);
496 		count++;
497 		size += obj->size;
498 	}
499 
500 	seq_printf(m, "Total %d objects, %zu bytes\n", count, size);
501 }
502 #endif
503 
504 void msm_gem_free_object(struct drm_gem_object *obj)
505 {
506 	struct drm_device *dev = obj->dev;
507 	struct msm_drm_private *priv = obj->dev->dev_private;
508 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
509 	int id;
510 
511 	WARN_ON(!mutex_is_locked(&dev->struct_mutex));
512 
513 	/* object should not be on active list: */
514 	WARN_ON(is_active(msm_obj));
515 
516 	list_del(&msm_obj->mm_list);
517 
518 	for (id = 0; id < ARRAY_SIZE(msm_obj->domain); id++) {
519 		struct msm_mmu *mmu = priv->mmus[id];
520 		if (mmu && msm_obj->domain[id].iova) {
521 			uint32_t offset = (uint32_t)mmap_offset(obj);
522 			mmu->funcs->unmap(mmu, offset, msm_obj->sgt, obj->size);
523 		}
524 	}
525 
526 	drm_gem_free_mmap_offset(obj);
527 
528 	if (obj->import_attach) {
529 		if (msm_obj->vaddr)
530 			dma_buf_vunmap(obj->import_attach->dmabuf, msm_obj->vaddr);
531 
532 		/* Don't drop the pages for imported dmabuf, as they are not
533 		 * ours, just free the array we allocated:
534 		 */
535 		if (msm_obj->pages)
536 			drm_free_large(msm_obj->pages);
537 
538 	} else {
539 		if (msm_obj->vaddr)
540 			vunmap(msm_obj->vaddr);
541 		put_pages(obj);
542 	}
543 
544 	if (msm_obj->resv == &msm_obj->_resv)
545 		reservation_object_fini(msm_obj->resv);
546 
547 	drm_gem_object_release(obj);
548 
549 	kfree(msm_obj);
550 }
551 
552 /* convenience method to construct a GEM buffer object, and userspace handle */
553 int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file,
554 		uint32_t size, uint32_t flags, uint32_t *handle)
555 {
556 	struct drm_gem_object *obj;
557 	int ret;
558 
559 	ret = mutex_lock_interruptible(&dev->struct_mutex);
560 	if (ret)
561 		return ret;
562 
563 	obj = msm_gem_new(dev, size, flags);
564 
565 	mutex_unlock(&dev->struct_mutex);
566 
567 	if (IS_ERR(obj))
568 		return PTR_ERR(obj);
569 
570 	ret = drm_gem_handle_create(file, obj, handle);
571 
572 	/* drop reference from allocate - handle holds it now */
573 	drm_gem_object_unreference_unlocked(obj);
574 
575 	return ret;
576 }
577 
578 static int msm_gem_new_impl(struct drm_device *dev,
579 		uint32_t size, uint32_t flags,
580 		struct drm_gem_object **obj)
581 {
582 	struct msm_drm_private *priv = dev->dev_private;
583 	struct msm_gem_object *msm_obj;
584 	unsigned sz;
585 
586 	switch (flags & MSM_BO_CACHE_MASK) {
587 	case MSM_BO_UNCACHED:
588 	case MSM_BO_CACHED:
589 	case MSM_BO_WC:
590 		break;
591 	default:
592 		dev_err(dev->dev, "invalid cache flag: %x\n",
593 				(flags & MSM_BO_CACHE_MASK));
594 		return -EINVAL;
595 	}
596 
597 	sz = sizeof(*msm_obj);
598 	if (!iommu_present(&platform_bus_type))
599 		sz += sizeof(struct drm_mm_node);
600 
601 	msm_obj = kzalloc(sz, GFP_KERNEL);
602 	if (!msm_obj)
603 		return -ENOMEM;
604 
605 	if (!iommu_present(&platform_bus_type))
606 		msm_obj->vram_node = (void *)&msm_obj[1];
607 
608 	msm_obj->flags = flags;
609 
610 	msm_obj->resv = &msm_obj->_resv;
611 	reservation_object_init(msm_obj->resv);
612 
613 	INIT_LIST_HEAD(&msm_obj->submit_entry);
614 	list_add_tail(&msm_obj->mm_list, &priv->inactive_list);
615 
616 	*obj = &msm_obj->base;
617 
618 	return 0;
619 }
620 
621 struct drm_gem_object *msm_gem_new(struct drm_device *dev,
622 		uint32_t size, uint32_t flags)
623 {
624 	struct drm_gem_object *obj = NULL;
625 	int ret;
626 
627 	WARN_ON(!mutex_is_locked(&dev->struct_mutex));
628 
629 	size = PAGE_ALIGN(size);
630 
631 	ret = msm_gem_new_impl(dev, size, flags, &obj);
632 	if (ret)
633 		goto fail;
634 
635 	if (iommu_present(&platform_bus_type)) {
636 		ret = drm_gem_object_init(dev, obj, size);
637 		if (ret)
638 			goto fail;
639 	} else {
640 		drm_gem_private_object_init(dev, obj, size);
641 	}
642 
643 	return obj;
644 
645 fail:
646 	if (obj)
647 		drm_gem_object_unreference(obj);
648 
649 	return ERR_PTR(ret);
650 }
651 
652 struct drm_gem_object *msm_gem_import(struct drm_device *dev,
653 		uint32_t size, struct sg_table *sgt)
654 {
655 	struct msm_gem_object *msm_obj;
656 	struct drm_gem_object *obj;
657 	int ret, npages;
658 
659 	/* if we don't have IOMMU, don't bother pretending we can import: */
660 	if (!iommu_present(&platform_bus_type)) {
661 		dev_err(dev->dev, "cannot import without IOMMU\n");
662 		return ERR_PTR(-EINVAL);
663 	}
664 
665 	size = PAGE_ALIGN(size);
666 
667 	ret = msm_gem_new_impl(dev, size, MSM_BO_WC, &obj);
668 	if (ret)
669 		goto fail;
670 
671 	drm_gem_private_object_init(dev, obj, size);
672 
673 	npages = size / PAGE_SIZE;
674 
675 	msm_obj = to_msm_bo(obj);
676 	msm_obj->sgt = sgt;
677 	msm_obj->pages = drm_malloc_ab(npages, sizeof(struct page *));
678 	if (!msm_obj->pages) {
679 		ret = -ENOMEM;
680 		goto fail;
681 	}
682 
683 	ret = drm_prime_sg_to_page_addr_arrays(sgt, msm_obj->pages, NULL, npages);
684 	if (ret)
685 		goto fail;
686 
687 	return obj;
688 
689 fail:
690 	if (obj)
691 		drm_gem_object_unreference_unlocked(obj);
692 
693 	return ERR_PTR(ret);
694 }
695