On Tue, Apr 22, 2014 at 11:07:13AM +0200, Daniel Vetter wrote:
> The introduction of primary planes has apparently caused a bit of fb
> refcounting fun for people. That makes it a good time to clean up the
> arcane rules and slight differences between ->update_plane and
> ->set_config. The new rules are:
>
> - The core holds a reference for both the new and the old fb (if their
> non-NULL of course) while calling into the driver through either
> ->update_plane or ->set_config.
>
> - Drivers may not clobber plane->fb if their callback fails. If they
> do that, they need to store a pointer to the old fb in it again.
> When calling into the driver plane->fb still points at the current
> (old) framebuffer.
>
> - The core will update the plane->fb pointer on success. Drivers can
> do that themselves too.
>
> - The core will update fb refcounts for the plane->fb pointer,
> presuming the drivers hold up their end of the bargain.
>
> Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
> ---
> drivers/gpu/drm/drm_crtc.c | 12 +++++-------
> drivers/gpu/drm/drm_plane_helper.c | 15 ---------------
> 2 files changed, 5 insertions(+), 22 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
> index d8b7099abece..966b480ed543 100644
> --- a/drivers/gpu/drm/drm_crtc.c
> +++ b/drivers/gpu/drm/drm_crtc.c
> @@ -2187,24 +2187,24 @@ int drm_mode_setplane(struct drm_device *dev, void
> *data,
> }
>
> drm_modeset_lock_all(dev);
> + old_fb = plane->fb;
> ret = plane->funcs->update_plane(plane, crtc, fb,
> plane_req->crtc_x, plane_req->crtc_y,
> plane_req->crtc_w, plane_req->crtc_h,
> plane_req->src_x, plane_req->src_y,
> plane_req->src_w, plane_req->src_h);
> if (!ret) {
> - old_fb = plane->fb;
> plane->crtc = crtc;
> plane->fb = fb;
> - fb = NULL;
> }
> drm_modeset_unlock_all(dev);
>
> out:
> - if (fb)
> - drm_framebuffer_unreference(fb);
> + if (plane->fb)
> + drm_framebuffer_reference(old_fb);
^^^^^^
That doesn't look right.
Also you're now dereferencing plane->fb after you drop the locks.
Also i915 fb destruction seems buggy as we do
intel_fb->obj->framebuffer_references-- w/o holding struct_mutex.
> if (old_fb)
> drm_framebuffer_unreference(old_fb);
> + drm_framebuffer_unreference(fb);
>
> return ret;
> }
> @@ -2239,9 +2239,7 @@ int drm_mode_set_config_internal(struct drm_mode_set
> *set)
> ret = crtc->funcs->set_config(set);
> if (ret == 0) {
> crtc->primary->crtc = crtc;
> -
> - /* crtc->fb must be updated by ->set_config, enforces this. */
> - WARN_ON(fb != crtc->primary->fb);
> + crtc->primary->fb = fb;
> }
>
> list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) {
> diff --git a/drivers/gpu/drm/drm_plane_helper.c
> b/drivers/gpu/drm/drm_plane_helper.c
> index e768d35ff22e..8db129c44fea 100644
> --- a/drivers/gpu/drm/drm_plane_helper.c
> +++ b/drivers/gpu/drm/drm_plane_helper.c
> @@ -175,22 +175,7 @@ int drm_primary_helper_update(struct drm_plane *plane,
> struct drm_crtc *crtc,
> set.connectors = connector_list;
> set.num_connectors = num_connectors;
>
> - /*
> - * set_config() adjusts crtc->primary->fb; however the DRM setplane
> - * code that called us expects to handle the framebuffer update and
> - * reference counting; save and restore the current fb before
> - * calling it.
> - *
> - * N.B., we call set_config() directly here rather than using
> - * drm_mode_set_config_internal. We're reprogramming the same
> - * connectors that were already in use, so we shouldn't need the extra
> - * cross-CRTC fb refcounting to accomodate stealing connectors.
> - * drm_mode_setplane() already handles the basic refcounting for the
> - * framebuffers involved in this operation.
> - */
> - tmpfb = plane->fb;
> ret = crtc->funcs->set_config(&set);
> - plane->fb = tmpfb;
>
> kfree(connector_list);
> return ret;
> --
> 1.9.2
>
> _______________________________________________
> dri-devel mailing list
> dri-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel
--
Ville Syrj?l?
Intel OTC
