[Intel-gfx] [PATCH] drm/i915: Zap mmaps of objects before unbinding them from the GTT.

[Eric Anholt]

Otherwise, some other userland writing into its buffer may race to land
writes either after the CPU thinks it's got a coherent view, or after its
GTT entries have been redirected to point at the scratch page.  Either
result is unpleasant.

Signed-off-by: Eric Anholt <eric at anholt.net>
---
 drivers/gpu/drm/i915/i915_gem.c |   12 ++++++------
 1 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 954fb69..c6fcc16 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1928,12 +1928,6 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
 		return ret;
 	}
 
-	if (obj_priv->agp_mem != NULL) {
-		drm_unbind_agp(obj_priv->agp_mem);
-		drm_free_agp(obj_priv->agp_mem, obj->size / PAGE_SIZE);
-		obj_priv->agp_mem = NULL;
-	}
-
 	BUG_ON(obj_priv->active);
 
 	/* blow away mappings if mapped through GTT */
@@ -1942,6 +1936,12 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
 	if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
 		i915_gem_clear_fence_reg(obj);
 
+	if (obj_priv->agp_mem != NULL) {
+		drm_unbind_agp(obj_priv->agp_mem);
+		drm_free_agp(obj_priv->agp_mem, obj->size / PAGE_SIZE);
+		obj_priv->agp_mem = NULL;
+	}
+
 	i915_gem_object_put_pages(obj);
 
 	if (obj_priv->gtt_space) {
-- 
1.6.3.3