On Wednesday, February 4, 2009 2:32 pm Thomas Hellström wrote: > Jesse, > > I have some concerns about the GEM GTT mmap functionality.
Thanks for looking it over again; you would know since some of this code came from you in the first place. :) > First, a gem object pointer is copied to map->offset and then to the > vma->vm_private_data without proper reference counting. This pointer is > used in i915_gem_fault() to access the gem object. However if the gem > object is destroyed and a process then tries to access data in a vma > mapping the (now destroyed) object, it would dereference a stale pointer > into kernel space? Shouldn't those pointers be reference counted, and to > account for fork(), a vm open and close would be needed to reference > count corresponding pointers of newly created and destroyed vmas? Yeah looks like we don't protect against vm_private_data pointing at a freed or other object. But rather than refcounting the pointers I wonder if we could make the private data use the GEM object name instead, then do the lookup in the fault handler? > Second, the i915_gem_fault method returns VM_FAULT_SIGBUS if > vm_insert_pfn() fails with an -EBUSY. I think that's an error, since > that would indicate that the pte was already populated by a racing thread. Ah ok that's easy enough to fix up; I didn't see that EBUSY meant "pte already valid". -- Jesse Barnes, Intel Open Source Technology Center ------------------------------------------------------------------------------ Create and Deploy Rich Internet Apps outside the browser with Adobe(R)AIR(TM) software. With Adobe AIR, Ajax developers can use existing skills and code to build responsive, highly engaging applications that combine the power of local resources and data with the reach of the web. Download the Adobe AIR SDK and Ajax docs to start building applications today-http://p.sf.net/sfu/adobe-com -- _______________________________________________ Dri-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/dri-devel
