drm/rockchip: vop: fix iommu crash with async atomic

On Async atomic_commit callback, drm_atomic_clean_old_fb will
clean all old fb, but because async, the old fb may be also on
the vop hardware, dma will access the old fb buffer, clean old
fb will cause iommu page fault.

Reference the fb and unreference it when the fb actuall swap out
from vop hardware.

Change-Id: I585786884295060efdaef0a00c3cbd75244399d7
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>

diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index edb483eda66b6905618f1b23a4391549b92e46b7..1a55b9ed15a804079933c84033b0c2277f3901e2 100644 (file)
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -593,6 +593,22 @@ static void vop_plane_destroy(struct drm_plane *plane)
        drm_plane_cleanup(plane);
 }
 
+static int vop_plane_prepare_fb(struct drm_plane *plane,
+                               const struct drm_plane_state *new_state)
+{
+       if (plane->state->fb)
+               drm_framebuffer_reference(plane->state->fb);
+
+       return 0;
+}
+
+static void vop_plane_cleanup_fb(struct drm_plane *plane,
+                                const struct drm_plane_state *old_state)
+{
+       if (old_state->fb)
+               drm_framebuffer_unreference(old_state->fb);
+}
+
 static int vop_plane_atomic_check(struct drm_plane *plane,
                           struct drm_plane_state *state)
 {
@@ -783,6 +799,8 @@ static void vop_plane_atomic_update(struct drm_plane *plane,
 }
 
 static const struct drm_plane_helper_funcs plane_helper_funcs = {
+       .prepare_fb = vop_plane_prepare_fb,
+       .cleanup_fb = vop_plane_cleanup_fb,
        .atomic_check = vop_plane_atomic_check,
        .atomic_update = vop_plane_atomic_update,
        .atomic_disable = vop_plane_atomic_disable,