[PATCH v3 1/2] drm/mediatek: Fix iommu fault by swapping FBs after updating plane state

[CK Hu (胡俊光)]

An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20230714/201423e5/attachment-0001.htm>
-------------- next part --------------
Hi, Jason:

On Mon, 2023-07-10 at 17:32 +0800, Jason-JH.Lin wrote:
> According to the comment in drm_atomic_helper_async_commit(),
> we should make sure FBs have been swapped, so that cleanups in the
> new_state performs a cleanup in the old FB.
> 
> So we should move swapping FBs after calling
> mtk_plane_update_new_state(),
> to avoid using the old FB which could be freed.

Reviewed-by: CK Hu <ck.hu at mediatek.com>

> 
> Fixes: 1a64a7aff8da ("drm/mediatek: Fix cursor plane no update")
> Signed-off-by: Jason-JH.Lin <jason-jh.lin at mediatek.com>
> Reviewed-by: AngeloGioacchino Del Regno <
> angelogioacchino.delregno at collabora.com>
> ---
>  drivers/gpu/drm/mediatek/mtk_drm_plane.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_plane.c
> b/drivers/gpu/drm/mediatek/mtk_drm_plane.c
> index 31f9420aff6f..b1a918ffe457 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_plane.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_plane.c
> @@ -210,9 +210,9 @@ static void mtk_plane_atomic_async_update(struct
> drm_plane *plane,
>  	plane->state->src_y = new_state->src_y;
>  	plane->state->src_h = new_state->src_h;
>  	plane->state->src_w = new_state->src_w;
> -	swap(plane->state->fb, new_state->fb);
>  
>  	mtk_plane_update_new_state(new_state, new_plane_state);
> +	swap(plane->state->fb, new_state->fb);
>  	wmb(); /* Make sure the above parameters are set before update
> */
>  	new_plane_state->pending.async_dirty = true;
>  	mtk_drm_crtc_async_update(new_state->crtc, plane, state);