From owner-svn-src-all@FreeBSD.ORG Tue Jun 18 20:02:52 2013 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 8F979D4; Tue, 18 Jun 2013 20:02:52 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id 81BD01088; Tue, 18 Jun 2013 20:02:52 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r5IK2q7Y093360; Tue, 18 Jun 2013 20:02:52 GMT (envelope-from kib@svn.freebsd.org) Received: (from kib@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id r5IK2qCI093359; Tue, 18 Jun 2013 20:02:52 GMT (envelope-from kib@svn.freebsd.org) Message-Id: <201306182002.r5IK2qCI093359@svn.freebsd.org> From: Konstantin Belousov Date: Tue, 18 Jun 2013 20:02:52 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r251960 - head/sys/dev/drm2/i915 X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jun 2013 20:02:52 -0000 Author: kib Date: Tue Jun 18 20:02:52 2013 New Revision: 251960 URL: http://svnweb.freebsd.org/changeset/base/251960 Log: Since the gem pagefault handler relocks the vm object lock, other thread might fault on the same GTT offset meantime and instantiate the mapping. Recheck that the mgt device object still does not have a page at the current offset after relocking, and return a possibly installed page. Reported by: Oleg Sidorkin Sponsored by: The FreeBSD Foundation MFC after: 2 weeks Modified: head/sys/dev/drm2/i915/i915_gem.c Modified: head/sys/dev/drm2/i915/i915_gem.c ============================================================================== --- head/sys/dev/drm2/i915/i915_gem.c Tue Jun 18 19:56:52 2013 (r251959) +++ head/sys/dev/drm2/i915/i915_gem.c Tue Jun 18 20:02:52 2013 (r251960) @@ -1371,6 +1371,23 @@ unlocked_vmobj: } else DRM_LOCK(dev); + /* + * Since the object lock was dropped, other thread might have + * faulted on the same GTT address and instantiated the + * mapping for the page. Recheck. + */ + VM_OBJECT_WLOCK(vm_obj); + m = vm_page_lookup(vm_obj, OFF_TO_IDX(offset)); + if (m != NULL) { + if ((m->flags & VPO_BUSY) != 0) { + DRM_UNLOCK(dev); + vm_page_sleep(m, "915pee"); + goto retry; + } + goto have_page; + } else + VM_OBJECT_WUNLOCK(vm_obj); + /* Now bind it into the GTT if needed */ if (!obj->map_and_fenceable) { ret = i915_gem_object_unbind(obj); @@ -1424,8 +1441,9 @@ unlocked_vmobj: goto retry; } m->valid = VM_PAGE_BITS_ALL; - *mres = m; vm_page_insert(m, vm_obj, OFF_TO_IDX(offset)); +have_page: + *mres = m; vm_page_busy(m); CTR4(KTR_DRM, "fault %p %jx %x phys %x", gem_obj, offset, prot,