From nobody Sat Sep 26 07:17:02 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85EF04B0C93 for ; Thu, 3 Sep 2026 13:23:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788441831; cv=none; b=J7sfLrgdGdhUlRal3PdVz1FNhcHfnBLnEv/k62RfPmntDxkSdplt4Dox3jwHBNKsPkNymcOyVofl4f3XIyQglzbr3P3KhP6aNfuFDElSasJroj9CInk3DqRUX2lLcll6v3biTNdqHWhUmTTHI4IzGPjkoMKml8V2wXWi+xShXfw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788441831; c=relaxed/simple; bh=NrFw7BXZVFZ9tRlXdJwvxA4tQOn9tdfDrYwT+OYyZR0=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=BqFCzdrMXbqWAu8qsp4hnspCtCQpPixudC4SyJ3sZZL+56MCFzHjSf+uHO4pHFA3amfMg7olwxMhN6v1IMNGzDscygTclOefZZhTL96rUws6+WF9tUDGI9FEKHrB3jRo2jjz+SZchxbpDrbEdJ7Q+IkW6InAm49mVdfAycwjf+M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=KOrC4MfC; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=YbijJysA; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="KOrC4MfC"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="YbijJysA" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 683DAh6w589130 for ; Thu, 3 Sep 2026 13:23:46 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= k+mI3GEI2CDfK3ssOBCMKAt4S/5fYocofrXGK1kFQNw=; b=KOrC4MfCUaYdZFPC Y9tDwRDQARL4Aiw24OjmAR+qlMYqhehogHwbkp6F+MlAhll0I9J7GtBSkajUVirq EvnJAbUV8wJny7+KTX5wJXr9xPQ2C1ZHy1zczyaZeUQyM1vC0dH3Yug8gWgqrNsk oypxpgX0BMp10ZcyeLJenIFm2cDX+5ojNp4rTNPH1bYV+yuwtv/CAey6QYU6sMol 9UIKPC/kbU4TMhHcdR3t0vKhK6q4fWAOESOOXU1GMx2LzcsBxu4NcCujc5P+XvGc RfcGHj1f28vKKQgYq800WKMGxUCF6y4cWOF2PWm1t9F0wkIGlEWsKyUJJowyiTFQ z9NUGA== Received: from mail-ua1-f70.google.com (mail-ua1-f70.google.com [209.85.222.70]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4gf1pyj37x-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 03 Sep 2026 13:23:46 +0000 (GMT) Received: by mail-ua1-f70.google.com with SMTP id a1e0cc1a2514c-97c176d45a2so139685241.3 for ; Thu, 03 Sep 2026 06:23:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1788441826; x=1789046626; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=k+mI3GEI2CDfK3ssOBCMKAt4S/5fYocofrXGK1kFQNw=; b=YbijJysABmFFtgeHW8wLpsVgoXWRyfMbrnF3Rxks+DTkOSUbjj6POUAgS4ehLnSJ59 VC4MuUtHJoJrYdC7I1LsEtj6FkW7MLOkP5C/s4+w28fm3znf+QsKMpzQO9qLo850rSz0 hLFoQku1cbDRH9ilg09/cUt9tRezcbLIHc23wtF71bJrQ9usSYieDVL6js2yWG/LDsEg jUXtr9KVM+ekwUjVboJUUsZucnMwcKqacExiXFfRS1ySAwQNX5jGZyKdteVDrccYDp21 XvFJH0ILtSSeVR9QfJQvogIefeNUmkf7Q2qfXPRqNVEVwfQ/9X8hOVbOmZWhhWTVWsr/ 37YQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788441826; x=1789046626; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=k+mI3GEI2CDfK3ssOBCMKAt4S/5fYocofrXGK1kFQNw=; b=Wxf62pHxYfXAa5QwiacbskV8ab9x5dyb8IsKpx3XKx15J/lxIxYGWO3ZgkORTiRAWN +qaeZhwKi5RmSnIrCcFFaJQEVO5SxWU0G9M9RXOKDpnhqRHmY5zIJcgAf1nP3bUQHFJh IAs/q/DYPEGHZqR+nmDz8fShXPE/hF3e/4ivIT5I4qqv7Xo7CNhsxX1A4vo8+J7H1f3N pdXHPdpdckvQ+/r8w0bJM27a485Wejrvtn9B7rsj1oUgcMAxTXGd/jG8jzvVS2fEU2UX GUFUc6K8K6IsW3Oy1edDk144Kt06WxA4cICaO0jPokDhqy1coEEGYEy9D1yy5tSJmSFW 7jdA== X-Forwarded-Encrypted: i=1; AKwUvBwzEKACc1//eNaRsNWVThRulzlHSulcIFxcm0ddPSo051YtNCCw4sFQJ9YQbiDT3h2XHF6B2nfz995f0+8=@vger.kernel.org X-Gm-Message-State: AFuF++nhZqwFjCA9tTwayNC9eEYipG5cQke05inPWR9FEy3uaBbrUOl7 Wt74GDlNuOXSWW1ZOFtiiIfqVsOf9eM2jwW5xEQUbxRb73N05r0/nwT72qFPoKN2MS/kaTszLCk +il0ZmX/ZoE32cZ4WUTbdvR7KX7seD7ikJsMQKAs2F56D/yOTq3fij/4b6Lpm6NfZBOLp7Uaw3B k= X-Gm-Gg: AYBFou0cmiUGufaM+phjTc7kBWwxPd5tGU/gPpknD5mX6p8Q1Sh2gZ0nlumpX6t7fx1 xgH3gI+OhLq68iOIwBgl8Th/BenJzCbi1Ph5F0NT0SPDU8aIYf/9TUdE/C2PGW6P6GSthWnhBIg mfilxmIvyp6Nh/EqHeDP6NxDtU5qI0vvBdqcgUYGNnMWLdN2ryxhrXEE7pA5eO1IoRpxRCvBT+Z qCohGTPl3lpi64T2HmGr/fEq//gJarDF0mBmpB5CU8vhJ9C6RWSvtLsp6No+5Ogy6WekvjDVd39 7HBYuMa60oRc20f3DXcx+P/kNBVVWbbwxv0aSPoxvlu7FaWHpgZQ7o6nK97kdzbMxgvEgtKvGqJ uYZZAnnGTl9kE2zT/bWIWTo/Ke6eFEULmp40lA1GOJ2BMhBGgCFDXLqWFARiNGDgAOv5IVxsN7q RLwtIVGPNcuvtN X-Received: by 2002:a05:6102:32cd:b0:779:5049:87b2 with SMTP id ada2fe7eead31-78a1eed1c93mr3585900137.0.1788441825645; Thu, 03 Sep 2026 06:23:45 -0700 (PDT) X-Received: by 2002:a05:6102:32cd:b0:779:5049:87b2 with SMTP id ada2fe7eead31-78a1eed1c93mr3585885137.0.1788441825273; Thu, 03 Sep 2026 06:23:45 -0700 (PDT) Received: from umbar.lan (2001-14ba-a073-af00-264b-feff-fe8b-be8a.rev.dnainternet.fi. [2001:14ba:a073:af00:264b:feff:fe8b:be8a]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5b606da57e9sm1296480e87.83.2026.09.03.06.23.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Sep 2026 06:23:44 -0700 (PDT) From: Dmitry Baryshkov Date: Thu, 03 Sep 2026 16:23:40 +0300 Subject: [PATCH 1/2] drm/msm: fix framebuffer pin refcount leak on prepare failure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260903-fd-kms-fix-smmu-v1-1-608d02491666@oss.qualcomm.com> References: <20260903-fd-kms-fix-smmu-v1-0-608d02491666@oss.qualcomm.com> In-Reply-To: <20260903-fd-kms-fix-smmu-v1-0-608d02491666@oss.qualcomm.com> To: Rob Clark , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , David Airlie , Simona Vetter , Antonino Maniscalco Cc: linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=2050; i=dmitry.baryshkov@oss.qualcomm.com; h=from:subject:message-id; bh=NrFw7BXZVFZ9tRlXdJwvxA4tQOn9tdfDrYwT+OYyZR0=; b=owEBbQGS/pANAwAKAYs8ij4CKSjVAcsmYgBqmXTebiKydvKEhAHkK7W6WCJ5/HHQYgcyZIGg/ LynZnPECGuJATMEAAEKAB0WIQRMcISVXLJjVvC4lX+LPIo+Aiko1QUCapl03gAKCRCLPIo+Aiko 1cgDB/9xO0XIZbbgdMWUPUY7xeo5AOfwIYi9GYgdd5Y/bmqF2smB915SaGJONfU9yvFHkpi0BHA /nSHNJF/3RWzF1LoPj5L0w/dvmxDkGYkTgIGdcJUF3/VMmFfmDQ9JNUU8h4/mFN+J4roGhHu6bA rf8eiv0liGzuBoxvgQK4yo9ddA0GtzctLM4C9FEJsIJryBx7r8/J3tcKsgFz7fobE3jg0C7VRvI ThPxJj5UPlSZljaLGPAYzmw9aLxf62lK+uy54CMohjqVdxYpZa1b9vxR0H29LTbwLIbxKK9J0WV My9HNDsc/AdAeXv5xvXYzX2QoPn5zUqST4CtENNEHHnvG0ov X-Developer-Key: i=dmitry.baryshkov@oss.qualcomm.com; a=openpgp; fpr=8F88381DD5C873E4AE487DA5199BF1243632046A X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTAzMDExNiBTYWx0ZWRfX9EDw26FoGW6i 4dEpoZ4aCTRWC48EFeLalzaJJZpSU7YBT3ly5OLz6cH/rmiBfxADy8lxmzo3+pmwBWtVRHB4IW4 YMXXykqVvXMjOJOYyWrUg5cD3Cmmw8WAdewLUb9Q8tA5ZYFt6bUt0dwoJNJ5XFro+5jnG68avFc wpB1DGqC9FohvLswJ0+64zcistFFBzaO9R4hu9JpSPy2UunxLXwBVSe25vtu6IEjEABSnIcbIh0 wGfIvQwJ98RFrTsdpya4pAenvErnc/cPY8ZKE05zolip/lw/45dOruy0LkErCoGPF1XqN6AWuKQ OHWjiEXr7/n1LMF26hrDeOO4MkkZQ0syxs1p+Tv4D/EtTLBkTtpzKCgPm/nKXz6IUO1bsxFyNg2 holvucZBmvxQkY5E8T5GYCch0ORZnszuuPZWFhsCcIORHe72wnG38wictDHfKOpVcs7eHk5sWW5 avvDGUlcVgi+YeTFoAQ== X-Proofpoint-ORIG-GUID: INp4ETzOs1l5jYsvMEubO64kDAM9NB1i X-Proofpoint-Spam-Info: AW1haW4tMjYwOTAzMDExNiBTYWx0ZWRfX9+39fr1kQ1l0 DOuw/2OBfKyCGHn9oxZPAg8YOfTAOcRNeF/aMApQtcwDZ08A82f1Qid0blVRWfSfvbeI0mr2+uE c2yqja7m3hTENQrHkw75OLpRoZVaorQ= X-Proofpoint-GUID: INp4ETzOs1l5jYsvMEubO64kDAM9NB1i X-Authority-Analysis: v=2.4 cv=DMO/JSNb c=1 sm=1 tr=0 ts=6a9974e2 cx=c_pps a=R6oCqFB+Yf/t2GF8e0/dFg==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yOCtJkima9RkubShWh1s:22 a=EUspDBNiAAAA:8 a=bAolQom50hykzV7YMrMA:9 a=QEXdDO2ut3YA:10 a=TD8TdBvy0hsOASGTdmB-:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-03_04,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 spamscore=0 bulkscore=0 priorityscore=1501 clxscore=1015 lowpriorityscore=0 suspectscore=0 adultscore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609030116 msm_framebuffer_prepare() bumps prepare_count before pinning, but returns straight out of the pin loop on error, leaking the count, the msm_gem_vma_get() reference and any planes already pinned. drm_atomic_helper_prepare_planes() does not call cleanup_fb() for the plane whose prepare_fb() failed, so nothing ever drops it. Since commit 8ac37c88f991 ("drm/msm: Refcount framebuffer pins") a prepare which finds the count already non-zero returns early, assuming iova[] is populated. With the count stuck, every later prepare of that framebuffer reports success while iova[] is still zero, and DPU scans out from a NULL base address: arm-smmu 15000000.iommu: Unhandled context fault: fsr=3D0x402, iova=3D0x00000100, fsynr=3D0x3e0023, cbfrsynra=3D0x1c00, cb=3D11 Unwind properly on failure instead. Fixes: 8ac37c88f991 ("drm/msm: Refcount framebuffer pins") Assisted-by: LLM Signed-off-by: Dmitry Baryshkov --- drivers/gpu/drm/msm/msm_fb.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_fb.c b/drivers/gpu/drm/msm/msm_fb.c index 60c108d35d2a..934337202afd 100644 --- a/drivers/gpu/drm/msm/msm_fb.c +++ b/drivers/gpu/drm/msm/msm_fb.c @@ -89,11 +89,27 @@ int msm_framebuffer_prepare(struct drm_framebuffer *fb,= bool needs_dirtyfb) ret =3D msm_gem_get_and_pin_iova(fb->obj[i], vm, &msm_fb->iova[i]); drm_dbg_state(fb->dev, "FB[%u]: iova[%d]: %08llx (%d)\n", fb->base.id, i, msm_fb->iova[i], ret); - if (ret) - return ret; + if (ret) { + msm_gem_vma_put(fb->obj[i]); + goto unwind; + } } =20 return 0; + +unwind: + while (i--) { + msm_gem_unpin_iova(fb->obj[i], vm); + msm_gem_vma_put(fb->obj[i]); + } + + memset(msm_fb->iova, 0, sizeof(msm_fb->iova)); + + atomic_dec(&msm_fb->prepare_count); + if (needs_dirtyfb) + refcount_dec(&msm_fb->dirtyfb); + + return ret; } =20 void msm_framebuffer_cleanup(struct drm_framebuffer *fb, bool needed_dirty= fb) --=20 2.47.3 From nobody Sat Sep 26 07:17:02 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AEB594AF9F3 for ; Thu, 3 Sep 2026 13:23:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788441844; cv=none; b=jPx7HZd7JP+5Sh3BsORAlLnUnP11Qs0sdanD9lTEI7OPFhjRaYrmOViBUmHymsb9CRh+FsuiGTOIW+2SGde2pIZD5d3VjTFFjp1mWkEvrywfsqNELCb+32IETvyht8kD5Ag99pskppBbtTpuOCioAT36chnxQsd2EP8jMyU+rMM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788441844; c=relaxed/simple; bh=nedhLPNAX4zaxCzJ0ErxJCYfQ9+VkBKgj+h/rOmABcs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=OiN8xxVpwj3y4y2FaRqIZ5piAk6IINxVniHFRrUUBSN8QM49b53/Osxm7bOvK4dzhuMMfQ+8G2Y5/tDdE1U9oG9YmB0fure/DKqDc6Dy+6BXnre1aK9hyUOWQbKa0wXPZ43GLeeGqdYDtxjoa2RnhLA9V07S03Om8PNickQnw94= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=DSeFF5xj; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=HEvPgoXe; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="DSeFF5xj"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="HEvPgoXe" Received: from pps.filterd (m0279867.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 683DAATi1704863 for ; Thu, 3 Sep 2026 13:23:49 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 2ODQalE8aYnls1DBAwuyEuvsSahcbelFuNFDbTbCw2s=; b=DSeFF5xjVITpd6KR qGla/M/M3mqIvocaCUK5LwRnF2u6+K+9Xoz4DpJrp8oR8yER86u0mkkh5C3cTywO vHrnJUotcfJPyWuJNDINLVzzWf/IJr/OaNpTUw1lV12r5QIJuP2NvesEtVzXrHG8 VkwGtVlJRfPX8E36/qdKOHNKWwTmWD271fuzUNz/ObRQd06MTIBCihv5hGgOrWy7 1ddHknDTuj+EoJUIcPrzKIkVDO8vpEs79gS1AERTotcR5iiKGUP050vfGoEaeozy sToUYmTGpdWVrK979+VlEwmD4PV+/oE9xyKfPSa8OABVZgMOctB0QakEUYaxw+HY YSIvhg== Received: from mail-ua1-f70.google.com (mail-ua1-f70.google.com [209.85.222.70]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4gf9b183xw-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 03 Sep 2026 13:23:48 +0000 (GMT) Received: by mail-ua1-f70.google.com with SMTP id a1e0cc1a2514c-97bf8f3a38bso174265241.0 for ; Thu, 03 Sep 2026 06:23:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1788441828; x=1789046628; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2ODQalE8aYnls1DBAwuyEuvsSahcbelFuNFDbTbCw2s=; b=HEvPgoXe9cv0eG1iyuOeJQsYKdXo6+b+lUJzGn2kO1Pbiyqu2OdSzouFJ8ImcDz038 kGTjJJQV25+FnuWiT68brKKvqoNcCoIH1NZq0JeURNDMJPTlKrKEchuUGLrmAsLawq2M WADyNJr1a59ayJLLp+YR8XGCWCEqwA0TDTMwn7X/kqaFHLHF+clYYhjOUEKaUh34tufW 7qo9Cab657qAeU47z0dp4C10BrtHSZgksbp4HkgR2fHa0pVGnw3dYAL1mnMZ45jmBmA4 gaZ2BhV3sffcZ1+l94gJRcXRTWjA407FABn3nnQt9f6M4B8Ulv4t9rRmMC5b6O/hM6nV p1VA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788441828; x=1789046628; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=2ODQalE8aYnls1DBAwuyEuvsSahcbelFuNFDbTbCw2s=; b=SDDkUIpd4Nvg5aeCH2wd9KKMgsdB5PxGhQAL0JWDQUBTBqlfBviQ0lS9i3epF8dnbu Kgh4gv75a+bAuXX65+TVYtiI6VJO2oaO+dcetFyxeiWsfbW8bTI9yRjkX/zg+WJBErh2 +pTOjNZ8CgQadJQAEZ7EuEiGkbeGVbZIOe4mSmjRN44r7OkIr8ynsovARYcCCCKAXaSH eB16Utv05d9TsLYULmbh/84loojonWid9jcA7nWIF4bm8zzDKQyk7KpBmvhgpIWLvojV /13cgK1m8kDzcSxgqciFNTcSx8vJrXGgqV8azsPyCMRSgm4g9yGi0tLnMpMZnhHCEMRg chBA== X-Forwarded-Encrypted: i=1; AKwUvBxtXVaFiCAyMsbvvkB79ScNxxUB2F8G+m7RltjyJMm4l97lVUUXYSGbOWq7+pAUGVpCC7jgmCjkDeIYX+w=@vger.kernel.org X-Gm-Message-State: AFuF++mT2BguRujxOzTP8blKyZc7jKyVipLviPS7ZG3stzPE4WZpakfl 1g/ElePsAUSU8e0UhUfMlrd1uTk4WlTZ3dn4lcP6Yj5SjYQvCyG9JaFcruU4hzKyzmOogwHcSTp 7OfWJAwIf16KjNErVI92MoLzqEMEfd19LfpZJezt15clsODPPjpB3X+h3yPlXpPhfe3o= X-Gm-Gg: AYBFou0bFfkLQDKzajWk6u187T+Y4c1Y99EmsYBHTqCWQqZbl/N8S/V07tnmQeBKwJy /9xJxz2ag9QQB/n3/csH8gumcOhrI3OP0oHvVD0RgXxA5sEEXPYBCyjlxVZHD/3CC+4mXKacwa3 EhCehT4PUzmwf/V+rT6wAtXfZZbNMPv/D6qwBRB+avBAIKPSRPfRbPwTDh0Xj0ym7poTxFWfMgB l7yx52XaUScSr9UWQ2xaJ1V4+AtOK4W+WezD0HtYllMOVJs3Gngwkbo/jIKFAiYkpy7mv8F6DPD pEdCJuFE7sE/Oj2G8pibtjlGEdGLSCQWCWMVKiiiJiTvlYYb18U/St62Q3WGBSsjBVlnZjngHSn mBtYTjAFMoLJyefb7rGx26RQR3VjemidkM4kr2RXvkUKmAMbn0FyuSZeW2aGPlSlTOkjrSC6GoZ BP5tIjRiy8cd5Z X-Received: by 2002:a05:6102:50ac:b0:785:c643:a415 with SMTP id ada2fe7eead31-78a1f3c8040mr3997208137.12.1788441827477; Thu, 03 Sep 2026 06:23:47 -0700 (PDT) X-Received: by 2002:a05:6102:50ac:b0:785:c643:a415 with SMTP id ada2fe7eead31-78a1f3c8040mr3997188137.12.1788441826959; Thu, 03 Sep 2026 06:23:46 -0700 (PDT) Received: from umbar.lan (2001-14ba-a073-af00-264b-feff-fe8b-be8a.rev.dnainternet.fi. [2001:14ba:a073:af00:264b:feff:fe8b:be8a]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5b606da57e9sm1296480e87.83.2026.09.03.06.23.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Sep 2026 06:23:45 -0700 (PDT) From: Dmitry Baryshkov Date: Thu, 03 Sep 2026 16:23:41 +0300 Subject: [PATCH 2/2] drm/msm: release scanout framebuffers only after a vblank Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260903-fd-kms-fix-smmu-v1-2-608d02491666@oss.qualcomm.com> References: <20260903-fd-kms-fix-smmu-v1-0-608d02491666@oss.qualcomm.com> In-Reply-To: <20260903-fd-kms-fix-smmu-v1-0-608d02491666@oss.qualcomm.com> To: Rob Clark , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , David Airlie , Simona Vetter , Antonino Maniscalco Cc: linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=13031; i=dmitry.baryshkov@oss.qualcomm.com; h=from:subject:message-id; bh=nedhLPNAX4zaxCzJ0ErxJCYfQ9+VkBKgj+h/rOmABcs=; b=owEBbQGS/pANAwAKAYs8ij4CKSjVAcsmYgBqmXTeI5I0tevhDqkaESaRxGEHzA2ppgupgBujd pPN7LWZ5pqJATMEAAEKAB0WIQRMcISVXLJjVvC4lX+LPIo+Aiko1QUCapl03gAKCRCLPIo+Aiko 1UGFB/9wse2uxkXco0AbEL0MaeYKRjevzAxkQw05LGfcQyhXbd/PJqlLikti/ZuqI3b3pNQIhgG A1WRs9akt6pniotgje/gav1J4DgbYCfPWblxh2WzrnhchNd8LOftYfpRGgDI9TDb95GlMomtV2n bO7sPuA7sk2VlNVJZYbiw4KxJ1h/+tG8/lA7MqTw9HmIcjcqjzkYkFOdSyZ2Owrv4pJ4VpLB/JL CXkwjk32Mkghy6BPsgqSKIKxmeirshaIkETiv59m69FHG75nMt1Xm2bvROQoiK4oUPi6kScqNjE kio+7fsfZA2+pWYID4OC+1lFiUY5Q9S7/td6YGvsZotjUFBT X-Developer-Key: i=dmitry.baryshkov@oss.qualcomm.com; a=openpgp; fpr=8F88381DD5C873E4AE487DA5199BF1243632046A X-Proofpoint-ORIG-GUID: -Z5QbjRjXGHbFlPcWsLOJavvVziMbm8v X-Proofpoint-Spam-Info: AW1haW4tMjYwOTAzMDExNiBTYWx0ZWRfX+eeHTVgl1IEk EIjRx4BJjag/ep7uLnK35ZcQLaG3ElUKkqBCtjtl6A+Xq6vmPXTKK0lcRw+wfKRxxHcVyaT4nBD sJ16+7qurCYyVq3nciZNz/hWSGxSUJI= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTAzMDExNiBTYWx0ZWRfXzPGwxv4tWSgS iNM1hEobstMCmY2JVw2l8qPGLRelrquDVzP3RHmh570W65sNgxkhIk8/M1HuJiY/7eYP3tKnMRw f+/HJsR3HLKIz57uY6n19qTelmR6wNjIVzHZW+pD250UtAvzrc/KCzqohmKEwq2kCcY3rpPcyV9 FslTAzHkgB0H2FE8r6efwAqa8SekJYCbdtlcvyU3GtOMMPM3NiVmdOc+5CC4RNg69eeiblriaO4 8WcQgy/3IorXk1il25PjJukcVxL6YFLMqxRfih1aw5G/GHjybUSxlA8af/3/AMPSTzBxzXHjv/5 3qFyo/uVoLqwpRTkH2yCge64fFWVN9KGYEEQE9opF7yB0nW8cwebfPM/e3LKHfe1h7J+w8hk6lw lzqNTXmxohPea91BC4OWIt1AJ9v/qicoUF5OG0rIVMtHQEZNQJuoEIDc+aOeLJRtbfK5qucgRV3 r2mof0yVL2irxd1gmzw== X-Authority-Analysis: v=2.4 cv=NNTlPU6g c=1 sm=1 tr=0 ts=6a9974e4 cx=c_pps a=R6oCqFB+Yf/t2GF8e0/dFg==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=eoimf2acIAo5FJnRuUoq:22 a=EUspDBNiAAAA:8 a=wGqaUCltirg6dY4VYU0A:9 a=QEXdDO2ut3YA:10 a=TD8TdBvy0hsOASGTdmB-:22 X-Proofpoint-GUID: -Z5QbjRjXGHbFlPcWsLOJavvVziMbm8v X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-03_04,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 lowpriorityscore=0 spamscore=0 bulkscore=0 adultscore=0 malwarescore=0 clxscore=1015 suspectscore=0 impostorscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609030116 msm_framebuffer_cleanup() releases a framebuffer as soon as drm_atomic_helper_cleanup_planes() runs. msm_atomic_commit_tail() waits only for ->wait_flush() before that, which for video mode waits for CTL_FLUSH to read back zero, ie. for the new configuration to be latched; the frame in flight with the old one is still being fetched. Since commit 111fdd2198e6 ("drm/msm: drm_gpuvm conversion") the unpin also detaches the vma, so the display is left reading unmapped memory: arm-smmu 15000000.iommu: Unhandled context fault: fsr=3D0x402, iova=3D0x007eb100, fsynr=3D0x3f0023, cbfrsynra=3D0xc20, cb=3D27 Defer the release: hand the retired framebuffer to the crtc and drop the pin and the vma reference from a drm_flip_work committed from the vblank irq, as mdp4 and mdp5 already do for their LM cursor buffers. A vblank reference is held while work is outstanding; a crtc with no vblank is not fetching, so it releases immediately. Fixes: 111fdd2198e6 ("drm/msm: drm_gpuvm conversion") Assisted-by: LLM Signed-off-by: Dmitry Baryshkov --- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 2 +- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 3 +- drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c | 2 +- drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 2 +- drivers/gpu/drm/msm/msm_drv.h | 3 +- drivers/gpu/drm/msm/msm_fb.c | 6 +- drivers/gpu/drm/msm/msm_kms.c | 88 ++++++++++++++++++= ++++ drivers/gpu/drm/msm/msm_kms.h | 29 +++++++ 11 files changed, 132 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm= /disp/dpu1/dpu_crtc.c index 42d0a529b4d5..bf593020e8e4 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c @@ -1213,7 +1213,7 @@ static void dpu_crtc_disable(struct drm_crtc *crtc, } =20 /* Disable/save vblank irq handling */ - drm_crtc_vblank_off(crtc); + msm_crtc_vblank_off(crtc); =20 drm_for_each_encoder_mask(encoder, crtc->dev, old_crtc_state->encoder_mask) { diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/= gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c index 22433bfbea1e..5db33e49c345 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c @@ -615,7 +615,7 @@ static void dpu_encoder_phys_wb_cleanup_wb_job(struct d= pu_encoder_phys *phys_enc if (!job->fb) return; =20 - msm_framebuffer_cleanup(job->fb, false); + msm_framebuffer_cleanup(job->fb, NULL, false); wb_enc->wb_job =3D NULL; wb_enc->wb_conn =3D NULL; } diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/ms= m/disp/dpu1/dpu_plane.c index 7b92082d35a6..0e986b533bf0 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c @@ -684,7 +684,8 @@ static void dpu_plane_cleanup_fb(struct drm_plane *plan= e, =20 DPU_DEBUG_PLANE(pdpu, "FB[%u]\n", old_state->fb->base.id); =20 - msm_framebuffer_cleanup(old_state->fb, old_pstate->needs_dirtyfb); + msm_framebuffer_cleanup(old_state->fb, old_state->crtc, + old_pstate->needs_dirtyfb); } =20 static int dpu_plane_check_inline_rotation(struct dpu_plane *pdpu, diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/ms= m/disp/mdp4/mdp4_crtc.c index 57dfce58450b..195ee6b4a0c6 100644 --- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c +++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c @@ -267,7 +267,7 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *c= rtc, return; =20 /* Disable/save vblank irq handling before power is disabled */ - drm_crtc_vblank_off(crtc); + msm_crtc_vblank_off(crtc); =20 mdp_irq_unregister(&mdp4_kms->base, &mdp4_crtc->err); mdp4_disable(mdp4_kms); diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c b/drivers/gpu/drm/m= sm/disp/mdp4/mdp4_plane.c index 9459f70ce0ba..5f669a02d798 100644 --- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c +++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c @@ -97,7 +97,7 @@ static void mdp4_plane_cleanup_fb(struct drm_plane *plane, return; =20 DBG("%s: cleanup: FB[%u]", mdp4_plane->name, fb->base.id); - msm_framebuffer_cleanup(fb, false); + msm_framebuffer_cleanup(fb, old_state->crtc, false); } =20 =20 diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/ms= m/disp/mdp5/mdp5_crtc.c index 4c4a897fc1ee..547f6fdb83d5 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c @@ -499,7 +499,7 @@ static void mdp5_crtc_atomic_disable(struct drm_crtc *c= rtc, return; =20 /* Disable/save vblank irq handling before power is disabled */ - drm_crtc_vblank_off(crtc); + msm_crtc_vblank_off(crtc); =20 if (mdp5_cstate->cmd_mode) mdp_irq_unregister(&mdp5_kms->base, &mdp5_crtc->pp_done); diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/m= sm/disp/mdp5/mdp5_plane.c index 841f444a8d68..dacb387d9bb6 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c @@ -155,7 +155,7 @@ static void mdp5_plane_cleanup_fb(struct drm_plane *pla= ne, return; =20 DBG("%s: cleanup: FB[%u]", plane->name, fb->base.id); - msm_framebuffer_cleanup(fb, needed_dirtyfb); + msm_framebuffer_cleanup(fb, old_state->crtc, needed_dirtyfb); } =20 static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_= state, diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h index eb4bbae8557b..18a9728838fd 100644 --- a/drivers/gpu/drm/msm/msm_drv.h +++ b/drivers/gpu/drm/msm/msm_drv.h @@ -254,7 +254,8 @@ int msm_gem_prime_pin(struct drm_gem_object *obj); void msm_gem_prime_unpin(struct drm_gem_object *obj); =20 int msm_framebuffer_prepare(struct drm_framebuffer *fb, bool needs_dirtyfb= ); -void msm_framebuffer_cleanup(struct drm_framebuffer *fb, bool needed_dirty= fb); +void msm_framebuffer_cleanup(struct drm_framebuffer *fb, struct drm_crtc *= crtc, + bool needed_dirtyfb); uint32_t msm_framebuffer_iova(struct drm_framebuffer *fb, int plane); struct drm_gem_object *msm_framebuffer_bo(struct drm_framebuffer *fb, int = plane); const struct msm_format *msm_framebuffer_format(struct drm_framebuffer *fb= ); diff --git a/drivers/gpu/drm/msm/msm_fb.c b/drivers/gpu/drm/msm/msm_fb.c index 934337202afd..0865ecce77de 100644 --- a/drivers/gpu/drm/msm/msm_fb.c +++ b/drivers/gpu/drm/msm/msm_fb.c @@ -112,7 +112,8 @@ int msm_framebuffer_prepare(struct drm_framebuffer *fb,= bool needs_dirtyfb) return ret; } =20 -void msm_framebuffer_cleanup(struct drm_framebuffer *fb, bool needed_dirty= fb) +void msm_framebuffer_cleanup(struct drm_framebuffer *fb, struct drm_crtc *= crtc, + bool needed_dirtyfb) { struct msm_drm_private *priv =3D fb->dev->dev_private; struct drm_gpuvm *vm =3D priv->kms->vm; @@ -127,6 +128,9 @@ void msm_framebuffer_cleanup(struct drm_framebuffer *fb= , bool needed_dirtyfb) =20 memset(msm_fb->iova, 0, sizeof(msm_fb->iova)); =20 + if (crtc && msm_crtc_queue_fb_unpin(crtc, fb)) + return; + for (i =3D 0; i < n; i++) { msm_gem_unpin_iova(fb->obj[i], vm); msm_gem_vma_put(fb->obj[i]); diff --git a/drivers/gpu/drm/msm/msm_kms.c b/drivers/gpu/drm/msm/msm_kms.c index e5d0ea629448..bf56fbe99a34 100644 --- a/drivers/gpu/drm/msm/msm_kms.c +++ b/drivers/gpu/drm/msm/msm_kms.c @@ -11,6 +11,7 @@ #include =20 #include +#include #include #include #include @@ -165,6 +166,89 @@ void msm_crtc_disable_vblank(struct drm_crtc *crtc) vblank_ctrl_queue_work(priv, crtc, false); } =20 +void msm_kms_fb_unpin_worker(struct drm_flip_work *work, void *val) +{ + struct drm_framebuffer *fb =3D val; + struct msm_drm_private *priv =3D fb->dev->dev_private; + struct drm_gpuvm *vm =3D priv->kms->vm; + int i, n =3D fb->format->num_planes; + + for (i =3D 0; i < n; i++) { + msm_gem_unpin_iova(fb->obj[i], vm); + msm_gem_vma_put(fb->obj[i]); + } + + drm_framebuffer_put(fb); +} + +static void msm_kms_fb_unpin_vblank(struct kthread_work *work) +{ + struct msm_kms_fb_unpin *fb_unpin =3D + container_of(to_drm_vblank_work(work), struct msm_kms_fb_unpin, + vblank_work); + + drm_flip_work_commit(&fb_unpin->work, fb_unpin->kms->wq); +} + +int msm_kms_init_fb_unpin(struct drm_device *dev) +{ + struct msm_drm_private *priv =3D dev->dev_private; + struct msm_kms *kms =3D priv->kms; + struct drm_crtc *crtc; + + drm_for_each_crtc(crtc, dev) { + unsigned int idx =3D drm_crtc_index(crtc); + + if (idx >=3D ARRAY_SIZE(kms->fb_unpin)) + return -EINVAL; + + drm_vblank_work_init(&kms->fb_unpin[idx].vblank_work, crtc, + msm_kms_fb_unpin_vblank); + } + + return 0; +} + +/* + * drm_crtc_vblank_off() drops pending vblank works without running them, = so + * flush the retired framebuffers first. The encoder is disabled before t= he + * crtc, so the hardware has already stopped fetching by this point. + */ +void msm_crtc_vblank_off(struct drm_crtc *crtc) +{ + struct msm_drm_private *priv =3D crtc->dev->dev_private; + struct msm_kms *kms =3D priv->kms; + unsigned int idx =3D drm_crtc_index(crtc); + + if (kms && idx < ARRAY_SIZE(kms->fb_unpin)) { + drm_vblank_work_cancel_sync(&kms->fb_unpin[idx].vblank_work); + drm_flip_work_commit(&kms->fb_unpin[idx].work, kms->wq); + } + + drm_crtc_vblank_off(crtc); +} + +/* Returns false if the caller should release @fb itself */ +bool msm_crtc_queue_fb_unpin(struct drm_crtc *crtc, struct drm_framebuffer= *fb) +{ + struct msm_drm_private *priv =3D crtc->dev->dev_private; + struct msm_kms *kms =3D priv->kms; + unsigned int idx =3D drm_crtc_index(crtc); + + if (!kms || idx >=3D ARRAY_SIZE(kms->fb_unpin)) + return false; + + drm_framebuffer_get(fb); + drm_flip_work_queue(&kms->fb_unpin[idx].work, fb); + + /* no vblank to wait for: the crtc is off, so it is not fetching */ + if (drm_vblank_work_schedule(&kms->fb_unpin[idx].vblank_work, + drm_crtc_vblank_count(crtc) + 1, true) < 0) + drm_flip_work_commit(&kms->fb_unpin[idx].work, kms->wq); + + return true; +} + static int msm_kms_fault_handler(void *arg, unsigned long iova, int flags,= void *data) { struct msm_kms *kms =3D arg; @@ -323,6 +407,10 @@ int msm_drm_kms_init(struct device *dev, const struct = drm_driver *drv) goto err_msm_uninit; } =20 + ret =3D msm_kms_init_fb_unpin(ddev); + if (ret) + goto err_msm_uninit; + pm_runtime_get_sync(dev); ret =3D msm_irq_install(ddev, kms->irq); pm_runtime_put_sync(dev); diff --git a/drivers/gpu/drm/msm/msm_kms.h b/drivers/gpu/drm/msm/msm_kms.h index f25b31e502d2..4b73132b5f6e 100644 --- a/drivers/gpu/drm/msm/msm_kms.h +++ b/drivers/gpu/drm/msm/msm_kms.h @@ -11,6 +11,9 @@ #include #include =20 +#include +#include + #include "msm_drv.h" =20 #ifdef CONFIG_DRM_MSM_KMS @@ -135,6 +138,16 @@ struct msm_drm_thread { struct kthread_worker *worker; }; =20 +/* Retired scanout framebuffers, released after the crtc's next vblank */ +struct msm_kms_fb_unpin { + struct drm_flip_work work; + struct drm_vblank_work vblank_work; + struct msm_kms *kms; +}; + +void msm_kms_fb_unpin_worker(struct drm_flip_work *work, void *val); +int msm_kms_init_fb_unpin(struct drm_device *dev); + struct msm_kms { const struct msm_kms_funcs *funcs; struct drm_device *dev; @@ -170,8 +183,13 @@ struct msm_kms { =20 struct workqueue_struct *wq; struct msm_drm_thread event_thread[MAX_CRTCS]; + + struct msm_kms_fb_unpin fb_unpin[MAX_CRTCS]; }; =20 +bool msm_crtc_queue_fb_unpin(struct drm_crtc *crtc, struct drm_framebuffer= *fb); +void msm_crtc_vblank_off(struct drm_crtc *crtc); + static inline int msm_kms_init(struct msm_kms *kms, const struct msm_kms_funcs *funcs) { @@ -193,6 +211,12 @@ static inline int msm_kms_init(struct msm_kms *kms, } } =20 + for (i =3D 0; i < ARRAY_SIZE(kms->fb_unpin); i++) { + kms->fb_unpin[i].kms =3D kms; + drm_flip_work_init(&kms->fb_unpin[i].work, "fb unpin", + msm_kms_fb_unpin_worker); + } + return 0; } =20 @@ -203,6 +227,11 @@ static inline void msm_kms_destroy(struct msm_kms *kms) for (i =3D 0; i < ARRAY_SIZE(kms->pending_timers); i++) msm_atomic_destroy_pending_timer(&kms->pending_timers[i]); =20 + for (i =3D 0; i < ARRAY_SIZE(kms->fb_unpin); i++) { + drm_vblank_work_cancel_sync(&kms->fb_unpin[i].vblank_work); + drm_flip_work_cleanup(&kms->fb_unpin[i].work); + } + destroy_workqueue(kms->wq); } =20 --=20 2.47.3