[PATCH] drm: Simplify fb refcounting rules around ->update_plane

[Ville Syrjälä]

On Tue, Apr 22, 2014 at 04:09:09PM +0200, Daniel Vetter wrote:
> On Tue, Apr 22, 2014 at 01:06:22PM +0300, Ville Syrjälä wrote:
> > On Tue, Apr 22, 2014 at 11:07:13AM +0200, Daniel Vetter wrote:
> > > The introduction of primary planes has apparently caused a bit of fb
> > > refcounting fun for people. That makes it a good time to clean up the
> > > arcane rules and slight differences between ->update_plane and
> > > ->set_config. The new rules are:
> > > 
> > > - The core holds a reference for both the new and the old fb (if their
> > >   non-NULL of course) while calling into the driver through either
> > >   ->update_plane or ->set_config.
> > > 
> > > - Drivers may not clobber plane->fb if their callback fails. If they
> > >   do that, they need to store a pointer to the old fb in it again.
> > >   When calling into the driver plane->fb still points at the current
> > >   (old) framebuffer.
> > > 
> > > - The core will update the plane->fb pointer on success. Drivers can
> > >   do that themselves too.
> > > 
> > > - The core will update fb refcounts for the plane->fb pointer,
> > >   presuming the drivers hold up their end of the bargain.
> > > 
> > > Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
> > > ---
> > >  drivers/gpu/drm/drm_crtc.c         | 12 +++++-------
> > >  drivers/gpu/drm/drm_plane_helper.c | 15 ---------------
> > >  2 files changed, 5 insertions(+), 22 deletions(-)
> > > 
> > > diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
> > > index d8b7099abece..966b480ed543 100644
> > > --- a/drivers/gpu/drm/drm_crtc.c
> > > +++ b/drivers/gpu/drm/drm_crtc.c
> > > @@ -2187,24 +2187,24 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
> > >  	}
> > >  
> > >  	drm_modeset_lock_all(dev);
> > > +	old_fb = plane->fb;
> > >  	ret = plane->funcs->update_plane(plane, crtc, fb,
> > >  					 plane_req->crtc_x, plane_req->crtc_y,
> > >  					 plane_req->crtc_w, plane_req->crtc_h,
> > >  					 plane_req->src_x, plane_req->src_y,
> > >  					 plane_req->src_w, plane_req->src_h);
> > >  	if (!ret) {
> > > -		old_fb = plane->fb;
> > >  		plane->crtc = crtc;
> > >  		plane->fb = fb;
> > > -		fb = NULL;
> > >  	}
> > >  	drm_modeset_unlock_all(dev);
> > >  
> > >  out:
> > > -	if (fb)
> > > -		drm_framebuffer_unreference(fb);
> > > +	if (plane->fb)
> > > +		drm_framebuffer_reference(old_fb);
> >                                           ^^^^^^
> > 
> > That doesn't look right.
> > 
> > Also you're now dereferencing plane->fb after you drop the locks.
> 
> Oops, will fix.
> 
> > Also i915 fb destruction seems buggy as we do
> > intel_fb->obj->framebuffer_references-- w/o holding struct_mutex.
> 
> Hm, this indeed looks fishy. And the offending patch was actually r-b:
> you.

Dang. I suck.

> Not sure what to do here really.

Just s/drm_gem_object_unreference_unlocked/drm_gem_object_unreference/
and grab struct_mutex by hand around both operations?

> -Daniel
> 
> > 
> > >  	if (old_fb)
> > >  		drm_framebuffer_unreference(old_fb);
> > > +	drm_framebuffer_unreference(fb);
> > >  
> > >  	return ret;
> > >  }
> > > @@ -2239,9 +2239,7 @@ int drm_mode_set_config_internal(struct drm_mode_set *set)
> > >  	ret = crtc->funcs->set_config(set);
> > >  	if (ret == 0) {
> > >  		crtc->primary->crtc = crtc;
> > > -
> > > -		/* crtc->fb must be updated by ->set_config, enforces this. */
> > > -		WARN_ON(fb != crtc->primary->fb);
> > > +		crtc->primary->fb = fb;
> > >  	}
> > >  
> > >  	list_for_each_entry(tmp, &crtc->dev->mode_config.crtc_list, head) {
> > > diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c
> > > index e768d35ff22e..8db129c44fea 100644
> > > --- a/drivers/gpu/drm/drm_plane_helper.c
> > > +++ b/drivers/gpu/drm/drm_plane_helper.c
> > > @@ -175,22 +175,7 @@ int drm_primary_helper_update(struct drm_plane *plane, struct drm_crtc *crtc,
> > >  	set.connectors = connector_list;
> > >  	set.num_connectors = num_connectors;
> > >  
> > > -	/*
> > > -	 * set_config() adjusts crtc->primary->fb; however the DRM setplane
> > > -	 * code that called us expects to handle the framebuffer update and
> > > -	 * reference counting; save and restore the current fb before
> > > -	 * calling it.
> > > -	 *
> > > -	 * N.B., we call set_config() directly here rather than using
> > > -	 * drm_mode_set_config_internal.  We're reprogramming the same
> > > -	 * connectors that were already in use, so we shouldn't need the extra
> > > -	 * cross-CRTC fb refcounting to accomodate stealing connectors.
> > > -	 * drm_mode_setplane() already handles the basic refcounting for the
> > > -	 * framebuffers involved in this operation.
> > > -	 */
> > > -	tmpfb = plane->fb;
> > >  	ret = crtc->funcs->set_config(&set);
> > > -	plane->fb = tmpfb;
> > >  
> > >  	kfree(connector_list);
> > >  	return ret;
> > > -- 
> > > 1.9.2
> > > 
> > > _______________________________________________
> > > dri-devel mailing list
> > > dri-devel at lists.freedesktop.org
> > > http://lists.freedesktop.org/mailman/listinfo/dri-devel
> > 
> > -- 
> > Ville Syrjälä
> > Intel OTC
> 
> -- 
> Daniel Vetter
> Software Engineer, Intel Corporation
> +41 (0) 79 365 57 48 - http://blog.ffwll.ch

-- 
Ville Syrjälä
Intel OTC