Re: [PATCH 1/2] drm: Simplify fb refcounting rules around ->update_plane

[Matt Roper <matthew.d.roper@intel.com>]

On Wed, Apr 23, 2014 at 10:30:04AM +0200, Daniel Vetter wrote:
> The introduction of primary planes has apparently caused a bit of fb
> refcounting fun for people. That makes it a good time to clean up the
> arcane rules and slight differences between ->update_plane and
> ->set_config. The new rules are:
> 
> - The core holds a reference for both the new and the old fb (if
>   they're non-NULL of course) while calling into the driver through
>   either ->update_plane or ->set_config.
> 
> - Drivers may not clobber plane->fb if their callback fails. If they
>   do that, they need to store a pointer to the old fb in it again.
>   When calling into the driver plane->fb still points at the current
>   (old) framebuffer.
> 
> - The core will update the plane->fb pointer on success. Drivers can
>   do that themselves too, but aren't required to any more for the
>   primary plane.
> 
> - The core will update fb refcounts for the plane->fb pointer,
>   presuming the drivers hold up their end of the bargain.
> 
> v2: Remove now unused tmpfb (Thierry)
> 
> v3: Drop broken changes from drm_mode_setplane (Ville). Also polish
> the commit message a bit.
> 
> v4: Also fix up the handling of ->disable_plane in
> drm_plane_force_disable. The issue was that we didn't save plane->fb
> over the ->disable_plane call. Just paranoia, nothing relies on this.
> 
> Cc: Thierry Reding <treding@nvidia.com>
> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
> Cc: Matt Roper <matthew.d.roper@intel.com>
> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> ---
>  drivers/gpu/drm/drm_crtc.c         | 13 +++++++------
>  drivers/gpu/drm/drm_plane_helper.c | 16 ----------------
>  2 files changed, 7 insertions(+), 22 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
> index d8b7099abece..f6633cb927bc 100644
> --- a/drivers/gpu/drm/drm_crtc.c
> +++ b/drivers/gpu/drm/drm_crtc.c
> @@ -1145,16 +1145,17 @@ EXPORT_SYMBOL(drm_plane_cleanup);
>   */
>  void drm_plane_force_disable(struct drm_plane *plane)
>  {
> +	struct drm_framebuffer *old_fb = plane->fb;
>  	int ret;
>  
> -	if (!plane->fb)
> +	if (!old_fb)
>  		return;
>  
>  	ret = plane->funcs->disable_plane(plane);
>  	if (ret)
>  		DRM_ERROR("failed to disable plane with busy fb\n");
>  	/* disconnect the plane from the fb and crtc: */
> -	__drm_framebuffer_unreference(plane->fb);
> +	__drm_framebuffer_unreference(old_fb);
>  	plane->fb = NULL;
>  	plane->crtc = NULL;
>  }

So if disable_plane() fails here, we'd still be scanning out of old_fb,
yet we deref it...that doesn't seem quite right.

As you mention, the changes here are just for paranoia since we can't
hit failure here as far as I know; force_disable() is only called in
drm_framebuffer_remove() (where a CRTC loop has already taken care of
removing the framebuffer from the primary plane) and
drm_fb_helper_restore_fbdev_mode() (where we explicitly skip primary
planes).  Since only primary planes can fail to be disabled, I'd be
inclined to just add a BUG_ON(plane->type == DRM_PLANE_TYPE_PRIMARY) at
the start of this function with a comment update explaining that it
can't be called on primary planes, and a BUG_ON(ret) since
non-primary planes should never fail to be disabled.


...
> @@ -177,22 +176,7 @@ int drm_primary_helper_update(struct drm_plane *plane, struct drm_crtc *crtc,
>  	set.connectors = connector_list;
>  	set.num_connectors = num_connectors;
>  
> -	/*
> -	 * set_config() adjusts crtc->primary->fb; however the DRM setplane
> -	 * code that called us expects to handle the framebuffer update and
> -	 * reference counting; save and restore the current fb before
> -	 * calling it.
> -	 *
> -	 * N.B., we call set_config() directly here rather than using
> -	 * drm_mode_set_config_internal.  We're reprogramming the same
> -	 * connectors that were already in use, so we shouldn't need the extra
> -	 * cross-CRTC fb refcounting to accomodate stealing connectors.
> -	 * drm_mode_setplane() already handles the basic refcounting for the
> -	 * framebuffers involved in this operation.
> -	 */

I think the second half of this comment (explaining why we call
set_config() directly rather than calling
drm_mode_set_config_internal()) still has some value.


Matt

> -	tmpfb = plane->fb;
>  	ret = crtc->funcs->set_config(&set);
> -	plane->fb = tmpfb;
>  
>  	kfree(connector_list);
>  	return ret;
> -- 
> 1.9.2
> 

-- 
Matt Roper
Graphics Software Engineer
IoTG Platform Enabling & Development
Intel Corporation
(916) 356-2795