Commit ab00b3e5 authored by Jesse Barnes's avatar Jesse Barnes Committed by Dave Airlie

drm/i915: Keep refs on the object over the lifetime of vmas for GTT mmap.

This fixes potential fault at fault time if the object was unreferenced
while the mapping still existed.  Now, while the mmap_offset only lives
for the lifetime of the object, the object also stays alive while a vma
exists that needs it.
Signed-off-by: default avatarJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: default avatarEric Anholt <eric@anholt.net>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent 496818f0
...@@ -463,6 +463,26 @@ drm_gem_object_handle_free(struct kref *kref) ...@@ -463,6 +463,26 @@ drm_gem_object_handle_free(struct kref *kref)
} }
EXPORT_SYMBOL(drm_gem_object_handle_free); EXPORT_SYMBOL(drm_gem_object_handle_free);
void drm_gem_vm_open(struct vm_area_struct *vma)
{
struct drm_gem_object *obj = vma->vm_private_data;
drm_gem_object_reference(obj);
}
EXPORT_SYMBOL(drm_gem_vm_open);
void drm_gem_vm_close(struct vm_area_struct *vma)
{
struct drm_gem_object *obj = vma->vm_private_data;
struct drm_device *dev = obj->dev;
mutex_lock(&dev->struct_mutex);
drm_gem_object_unreference(obj);
mutex_unlock(&dev->struct_mutex);
}
EXPORT_SYMBOL(drm_gem_vm_close);
/** /**
* drm_gem_mmap - memory map routine for GEM objects * drm_gem_mmap - memory map routine for GEM objects
* @filp: DRM file pointer * @filp: DRM file pointer
...@@ -524,6 +544,14 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma) ...@@ -524,6 +544,14 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
#endif #endif
vma->vm_page_prot = __pgprot(prot); vma->vm_page_prot = __pgprot(prot);
/* Take a ref for this mapping of the object, so that the fault
* handler can dereference the mmap offset's pointer to the object.
* This reference is cleaned up by the corresponding vm_close
* (which should happen whether the vma was created by this call, or
* by a vm_open due to mremap or partial unmap or whatever).
*/
drm_gem_object_reference(obj);
vma->vm_file = filp; /* Needed for drm_vm_open() */ vma->vm_file = filp; /* Needed for drm_vm_open() */
drm_vm_open_locked(vma); drm_vm_open_locked(vma);
......
...@@ -94,6 +94,8 @@ static int i915_resume(struct drm_device *dev) ...@@ -94,6 +94,8 @@ static int i915_resume(struct drm_device *dev)
static struct vm_operations_struct i915_gem_vm_ops = { static struct vm_operations_struct i915_gem_vm_ops = {
.fault = i915_gem_fault, .fault = i915_gem_fault,
.open = drm_gem_vm_open,
.close = drm_gem_vm_close,
}; };
static struct drm_driver driver = { static struct drm_driver driver = {
......
...@@ -607,8 +607,6 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf) ...@@ -607,8 +607,6 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
case -EAGAIN: case -EAGAIN:
return VM_FAULT_OOM; return VM_FAULT_OOM;
case -EFAULT: case -EFAULT:
case -EBUSY:
DRM_ERROR("can't insert pfn?? fault or busy...\n");
return VM_FAULT_SIGBUS; return VM_FAULT_SIGBUS;
default: default:
return VM_FAULT_NOPAGE; return VM_FAULT_NOPAGE;
...@@ -684,6 +682,30 @@ i915_gem_create_mmap_offset(struct drm_gem_object *obj) ...@@ -684,6 +682,30 @@ i915_gem_create_mmap_offset(struct drm_gem_object *obj)
return ret; return ret;
} }
static void
i915_gem_free_mmap_offset(struct drm_gem_object *obj)
{
struct drm_device *dev = obj->dev;
struct drm_i915_gem_object *obj_priv = obj->driver_private;
struct drm_gem_mm *mm = dev->mm_private;
struct drm_map_list *list;
list = &obj->map_list;
drm_ht_remove_item(&mm->offset_hash, &list->hash);
if (list->file_offset_node) {
drm_mm_put_block(list->file_offset_node);
list->file_offset_node = NULL;
}
if (list->map) {
drm_free(list->map, sizeof(struct drm_map), DRM_MEM_DRIVER);
list->map = NULL;
}
obj_priv->mmap_offset = 0;
}
/** /**
* i915_gem_get_gtt_alignment - return required GTT alignment for an object * i915_gem_get_gtt_alignment - return required GTT alignment for an object
* @obj: object to check * @obj: object to check
...@@ -2896,9 +2918,6 @@ int i915_gem_init_object(struct drm_gem_object *obj) ...@@ -2896,9 +2918,6 @@ int i915_gem_init_object(struct drm_gem_object *obj)
void i915_gem_free_object(struct drm_gem_object *obj) void i915_gem_free_object(struct drm_gem_object *obj)
{ {
struct drm_device *dev = obj->dev; struct drm_device *dev = obj->dev;
struct drm_gem_mm *mm = dev->mm_private;
struct drm_map_list *list;
struct drm_map *map;
struct drm_i915_gem_object *obj_priv = obj->driver_private; struct drm_i915_gem_object *obj_priv = obj->driver_private;
while (obj_priv->pin_count > 0) while (obj_priv->pin_count > 0)
...@@ -2909,19 +2928,7 @@ void i915_gem_free_object(struct drm_gem_object *obj) ...@@ -2909,19 +2928,7 @@ void i915_gem_free_object(struct drm_gem_object *obj)
i915_gem_object_unbind(obj); i915_gem_object_unbind(obj);
list = &obj->map_list; i915_gem_free_mmap_offset(obj);
drm_ht_remove_item(&mm->offset_hash, &list->hash);
if (list->file_offset_node) {
drm_mm_put_block(list->file_offset_node);
list->file_offset_node = NULL;
}
map = list->map;
if (map) {
drm_free(map, sizeof(*map), DRM_MEM_DRIVER);
list->map = NULL;
}
drm_free(obj_priv->page_cpu_valid, 1, DRM_MEM_DRIVER); drm_free(obj_priv->page_cpu_valid, 1, DRM_MEM_DRIVER);
drm_free(obj->driver_private, 1, DRM_MEM_DRIVER); drm_free(obj->driver_private, 1, DRM_MEM_DRIVER);
......
...@@ -1321,6 +1321,8 @@ void drm_gem_object_free(struct kref *kref); ...@@ -1321,6 +1321,8 @@ void drm_gem_object_free(struct kref *kref);
struct drm_gem_object *drm_gem_object_alloc(struct drm_device *dev, struct drm_gem_object *drm_gem_object_alloc(struct drm_device *dev,
size_t size); size_t size);
void drm_gem_object_handle_free(struct kref *kref); void drm_gem_object_handle_free(struct kref *kref);
void drm_gem_vm_open(struct vm_area_struct *vma);
void drm_gem_vm_close(struct vm_area_struct *vma);
int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma); int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma);
static inline void static inline void
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment