This simplifies drm fb lifetime, and if the crtc/plane needs to hold a ref to the fb when disabling a pipe until the next vblank, this avoids the need to make disabling an overlay synchronous. This is a problem that shows up when userspace is using a drm plane to implement a hw cursor.. making overlay disable synchronous causes a performance problem when x11 is rapidly enabling/disabling the hw cursor. But not making it synchronous opens up a race condition for crashing if userspace turns around and immediately deletes the fb. Refcnt'ing the fb makes it possible to solve this problem. v1: original v2: add drm_framebuffer_remove() which is called in all paths where fb->funcs->destroy() was directly called before. This cleans up the CRTCs/planes that the fb was attached to. You should only directly use drm_framebuffer_unreference() if you are also using drm_framebuffer_reference() to keep a ref to the fb. v3: add comment explaining the fb refcount v4: remove duplicate 'list_del(&fb->filp_head)' [airlied: v4.1: fix local rejection]
Showing the changes to include/drm (1 of 4 files). Show all
Unified · Split
| @@ -218,6 +218,7 @@ struct drm_display_info { · 217 unmodified lines | ||
| 218 | 218 | }; |
| 219 | 219 | |
| 220 | 220 | struct drm_framebuffer_funcs { |
| 221 | + /* note: use drm_framebuffer_remove() */ | |
| 221 | 222 | void (*destroy)(struct drm_framebuffer *framebuffer); |
| 222 | 223 | int (*create_handle)(struct drm_framebuffer *fb, |
| 223 | 224 | struct drm_file *file_priv, |
| @@ -242,6 +243,16 @@ struct drm_framebuffer_funcs { · 18 unmodified lines | ||
| 242 | 243 | |
| 243 | 244 | struct drm_framebuffer { |
| 244 | 245 | struct drm_device *dev; |
| 246 | + /* | |
| 247 | + * Note that the fb is refcounted for the benefit of driver internals, | |
| 248 | + * for example some hw, disabling a CRTC/plane is asynchronous, and | |
| 249 | + * scanout does not actually complete until the next vblank. So some | |
| 250 | + * cleanup (like releasing the reference(s) on the backing GEM bo(s)) | |
| 251 | + * should be deferred. In cases like this, the driver would like to | |
| 252 | + * hold a ref to the fb even though it has already been removed from | |
| 253 | + * userspace perspective. | |
| 254 | + */ | |
| 255 | + struct kref refcount; | |
| 245 | 256 | struct list_head head; |
| 246 | 257 | struct drm_mode_object base; |
| 247 | 258 | const struct drm_framebuffer_funcs *funcs; |
| @@ -919,6 +930,9 @@ extern void drm_framebuffer_set_object(struct drm_device *dev, · 671 unmodified lines | ||
| 919 | 930 | extern int drm_framebuffer_init(struct drm_device *dev, |
| 920 | 931 | struct drm_framebuffer *fb, |
| 921 | 932 | const struct drm_framebuffer_funcs *funcs); |
| 933 | +extern void drm_framebuffer_unreference(struct drm_framebuffer *fb); | |
| 934 | +extern void drm_framebuffer_reference(struct drm_framebuffer *fb); | |
| 935 | +extern void drm_framebuffer_remove(struct drm_framebuffer *fb); | |
| 922 | 936 | extern void drm_framebuffer_cleanup(struct drm_framebuffer *fb); |
| 923 | 937 | extern int drmfb_probe(struct drm_device *dev, struct drm_crtc *crtc); |
| 924 | 938 | extern int drmfb_remove(struct drm_device *dev, struct drm_framebuffer *fb); |