Jesse,

I have some concerns about the GEM GTT mmap functionality.

First, a gem object pointer is copied to map->offset and then to the 
vma->vm_private_data without proper reference counting. This pointer is 
used in i915_gem_fault() to access the gem object. However if the gem 
object is destroyed and a process then tries to access data in a vma 
mapping the (now destroyed) object, it would dereference a stale pointer 
into kernel space? Shouldn't those pointers be reference counted, and to 
account for fork(), a vm open and close would be needed to  reference 
count corresponding pointers of newly created and destroyed vmas?

Second, the i915_gem_fault method  returns VM_FAULT_SIGBUS if 
vm_insert_pfn() fails with an -EBUSY. I think that's an error, since 
that would indicate that the pte was already populated by a racing thread.

/Thomas





------------------------------------------------------------------------------
Create and Deploy Rich Internet Apps outside the browser with Adobe(R)AIR(TM)
software. With Adobe AIR, Ajax developers can use existing skills and code to
build responsive, highly engaging applications that combine the power of local
resources and data with the reach of the web. Download the Adobe AIR SDK and
Ajax docs to start building applications today-http://p.sf.net/sfu/adobe-com
--
_______________________________________________
Dri-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/dri-devel

Reply via email to