endlessm/linux — pull request #7 by dsd (2014-09-15 18:09:23+00:00)
Title: drm/exynos: fix plane-framebuffer linkage

Pageflipping currently causes some inconsistencies that lead to
crashes. Just run an app that causes a CRTC pageflip in a raw X session
and check that it exits cleanly and can be restarted - you'll see
crashes like:
Unable to handle kernel NULL pointer dereference at virtual address 00000334
PC is at exynos_drm_crtc_plane_commit+0x20/0x40
LR is at exynos_drm_crtc_plane_commit+0x20/0x40
[] (exynos_drm_crtc_plane_commit) from [] (exynos_drm_crtc_commit+0x44/0x70)
[] (exynos_drm_crtc_commit) from [] (exynos_drm_crtc_mode_set_commit.isra.2+0xb4/0xc4)
[] (exynos_drm_crtc_mode_set_commit.isra.2) from [] (exynos_drm_crtc_page_flip+0x140/0x1a8)
[] (exynos_drm_crtc_page_flip) from [] (drm_mode_page_flip_ioctl+0x224/0x2dc)
[] (drm_mode_page_flip_ioctl) from [] (drm_ioctl+0x338/0x4fc)

These crashes happen because drm_plane_force_disable has previously set
plane->crtc to NULL.

When drm_mode_page_flip_ioctl() is used to flip another framebuffer
onto the primary plane, crtc->primary->fb is correctly updated (this is
a virtual plane created by plane_helper), but plane->fb is not (this
plane is the real one, created by exynos_drm_crtc_create).

We then come to handle rmfb of the backbuffer, which the "real" primary
plane is incorrectly pointing at. So drm_framebuffer_remove() decides that
the buffer is actually active on a plane and force-disables the plane.

Ensuring that plane->fb is kept up-to-date solves that issue, but
exposes a reference counting problem. Now we see crashes when rmfb is
called on the front-buffer, because the rmfb code expects to drop 3
references here, and there are only 2.

That can be fixed by adopting the reference management found in omapdrm:
Framebuffer references are not taken directly in crtc mode_set context,
but rather in the context of updating the plane, which also covers
flips. Like omapdrm we also unreference the old framebuffer here.

Signed-off-by: Daniel Drake

https://github.com/endlessm/eos-shell/issues/3449