Commit 94284037 authored by Matt Roper's avatar Matt Roper Committed by Daniel Vetter

drm/fbdev: Update legacy plane->fb refcounting for atomic restore

Starting with commit

        commit 28cc504e
        Author: Rob Clark <robdclark@gmail.com>
        Date:   Tue Aug 25 15:36:00 2015 -0400

            drm/i915: enable atomic fb-helper

I've been seeing some panics on i915 when the DRM master shuts down that appear
to be caused by using an already-freed framebuffer (i.e., we're unexpectedly
dropping our initial FB's reference count to 0 and freeing it, which causes a
crash when we try to restore it later).  Digging deeper, the state FB
refcounting is working as expected, but we seem to be missing proper
refcounting on the legacy plane->fb pointers in the new atomic fbdev code.

Tracking plane->old_fb and then doing a ref/unref at the end of the
fbdev restore like we do in the legacy ioctl's ensures we don't miscount
references on plane->fb and avoids the panics.

v2 from Daniel:

Really do what the atomic ioctl does:
- Also update plane->fb and plane->crtc.
- Clear out plane->old_fb on failures too.

v3: git add everything. Oops.

v4: Also clear old_fb in all other failure paths, spotted by David.

Cc: Rob Clark <robdclark@gmail.com>
Cc: intel-gfx@lists.freedesktop.org
Cc: David Herrmann <dh.herrmann@gmail.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (v1)
Reviewd-by: default avatarDavid Herrmann <dh.herrmann@gmail.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
parent 5e7d4944
...@@ -352,6 +352,8 @@ static int restore_fbdev_mode_atomic(struct drm_fb_helper *fb_helper) ...@@ -352,6 +352,8 @@ static int restore_fbdev_mode_atomic(struct drm_fb_helper *fb_helper)
drm_for_each_plane(plane, dev) { drm_for_each_plane(plane, dev) {
struct drm_plane_state *plane_state; struct drm_plane_state *plane_state;
plane->old_fb = plane->fb;
plane_state = drm_atomic_get_plane_state(state, plane); plane_state = drm_atomic_get_plane_state(state, plane);
if (IS_ERR(plane_state)) { if (IS_ERR(plane_state)) {
ret = PTR_ERR(plane_state); ret = PTR_ERR(plane_state);
...@@ -382,16 +384,27 @@ static int restore_fbdev_mode_atomic(struct drm_fb_helper *fb_helper) ...@@ -382,16 +384,27 @@ static int restore_fbdev_mode_atomic(struct drm_fb_helper *fb_helper)
} }
ret = drm_atomic_commit(state); ret = drm_atomic_commit(state);
if (ret != 0)
goto fail;
return 0;
fail: fail:
drm_for_each_plane(plane, dev) {
if (ret == 0) {
struct drm_framebuffer *new_fb = plane->state->fb;
if (new_fb)
drm_framebuffer_reference(new_fb);
plane->fb = new_fb;
plane->crtc = plane->state->crtc;
if (plane->old_fb)
drm_framebuffer_unreference(plane->old_fb);
}
plane->old_fb = NULL;
}
if (ret == -EDEADLK) if (ret == -EDEADLK)
goto backoff; goto backoff;
drm_atomic_state_free(state); if (ret != 0)
drm_atomic_state_free(state);
return ret; return ret;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment