From: Eric Anholt <eric@anholt.net>
Date: Wed, 9 Sep 2009 18:50:45 +0000 (-0700)
Subject: drm/i915: Zap mmaps of objects before unbinding them from the GTT.
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=5323fd042f89164927ee8c311f0a975e8c846412;p=linux-beck.git

drm/i915: Zap mmaps of objects before unbinding them from the GTT.

Otherwise, some other userland writing into its buffer may race to land
writes either after the CPU thinks it's got a coherent view, or after its
GTT entries have been redirected to point at the scratch page.  Either
result is unpleasant.

Signed-off-by: Eric Anholt <eric@anholt.net>
---

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 954fb699131b..f3758f9fc979 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1915,6 +1915,12 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
 		return -EINVAL;
 	}
 
+	/* blow away mappings if mapped through GTT */
+	i915_gem_release_mmap(obj);
+
+	if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
+		i915_gem_clear_fence_reg(obj);
+
 	/* Move the object to the CPU domain to ensure that
 	 * any possible CPU writes while it's not in the GTT
 	 * are flushed when we go to remap it. This will
@@ -1928,20 +1934,14 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
 		return ret;
 	}
 
+	BUG_ON(obj_priv->active);
+
 	if (obj_priv->agp_mem != NULL) {
 		drm_unbind_agp(obj_priv->agp_mem);
 		drm_free_agp(obj_priv->agp_mem, obj->size / PAGE_SIZE);
 		obj_priv->agp_mem = NULL;
 	}
 
-	BUG_ON(obj_priv->active);
-
-	/* blow away mappings if mapped through GTT */
-	i915_gem_release_mmap(obj);
-
-	if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
-		i915_gem_clear_fence_reg(obj);
-
 	i915_gem_object_put_pages(obj);
 
 	if (obj_priv->gtt_space) {