diff mbox

drm: refcnt drm_framebuffer

Message ID 1343751621-1868-1-git-send-email-rob.clark@linaro.org (mailing list archive)
State New, archived
Headers show

Commit Message

Rob Clark July 31, 2012, 4:20 p.m. UTC
From: Rob Clark <rob@ti.com>

This simplifies drm fb lifetime, and if the crtc/plane needs to hold
a ref to the fb when disabling a pipe until the next vblank, this
avoids the need to make disabling an overlay synchronous.  This is a
problem that shows up when userspace is using a drm plane to
implement a hw cursor.. making overlay disable synchronous causes
a performance problem when x11 is rapidly enabling/disabling the
hw cursor.  But not making it synchronous opens up a race condition
for crashing if userspace turns around and immediately deletes the
fb.  Refcnt'ing the fb makes it possible to solve this problem.

Signed-off-by: Rob Clark <rob@ti.com>
---
 drivers/gpu/drm/drm_crtc.c                |   38 ++++++++++++++++++++++++++---
 drivers/gpu/drm/exynos/exynos_drm_fbdev.c |    4 +--
 drivers/gpu/drm/i915/intel_display.c      |    4 +--
 include/drm/drm_crtc.h                    |    4 +++
 4 files changed, 43 insertions(+), 7 deletions(-)

Comments

Chris Wilson July 31, 2012, 5 p.m. UTC | #1
On Tue, 31 Jul 2012 11:20:21 -0500, Rob Clark <rob.clark@linaro.org> wrote:
> From: Rob Clark <rob@ti.com>
> 
> This simplifies drm fb lifetime, and if the crtc/plane needs to hold
> a ref to the fb when disabling a pipe until the next vblank, this
> avoids the need to make disabling an overlay synchronous.  This is a
> problem that shows up when userspace is using a drm plane to
> implement a hw cursor.. making overlay disable synchronous causes
> a performance problem when x11 is rapidly enabling/disabling the
> hw cursor.  But not making it synchronous opens up a race condition
> for crashing if userspace turns around and immediately deletes the
> fb.  Refcnt'ing the fb makes it possible to solve this problem.

Presumably you have a follow-on patch putting the new refcnt to use so
that we can judge whether you truly need refcnting on the fb itself in
addition to the refcnted object and the various hw bookkeeping that
needs to be performed?
-Chris
Rob Clark July 31, 2012, 5:41 p.m. UTC | #2
On Tue, Jul 31, 2012 at 12:00 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
> On Tue, 31 Jul 2012 11:20:21 -0500, Rob Clark <rob.clark@linaro.org> wrote:
>> From: Rob Clark <rob@ti.com>
>>
>> This simplifies drm fb lifetime, and if the crtc/plane needs to hold
>> a ref to the fb when disabling a pipe until the next vblank, this
>> avoids the need to make disabling an overlay synchronous.  This is a
>> problem that shows up when userspace is using a drm plane to
>> implement a hw cursor.. making overlay disable synchronous causes
>> a performance problem when x11 is rapidly enabling/disabling the
>> hw cursor.  But not making it synchronous opens up a race condition
>> for crashing if userspace turns around and immediately deletes the
>> fb.  Refcnt'ing the fb makes it possible to solve this problem.
>
> Presumably you have a follow-on patch putting the new refcnt to use so
> that we can judge whether you truly need refcnting on the fb itself in
> addition to the refcnted object and the various hw bookkeeping that
> needs to be performed?

Yes, I do.. although it is a bit experimental at this point, so not
really ready to be submitted as anything other than an RFC.. it is
part of omapdrm kms re-write to use dispc directly rather than go thru
omapdss.  (With omapdss we don't hit this issue because disabling
overlays is forced to be synchronous.. so instead we have the
performance problem I mentioned.)

I *could* just rely on the GEM refcnt, but that gets messier when you
take into account multi-planar formats.  I suppose I also could have
my own internal refcnt'd object to hold the set of GEM objects
associated w/ the fb, but, well, that seems a bit silly.  And
refcnt'ing the fb had been mentioned previously as a good thing to do
(I think it was danvet?)

BR,
-R

> -Chris
>
> --
> Chris Wilson, Intel Open Source Technology Centre
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel
Chris Wilson July 31, 2012, 5:47 p.m. UTC | #3
On Tue, 31 Jul 2012 12:41:28 -0500, Rob Clark <rob.clark@linaro.org> wrote:
> On Tue, Jul 31, 2012 at 12:00 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
> > On Tue, 31 Jul 2012 11:20:21 -0500, Rob Clark <rob.clark@linaro.org> wrote:
> >> From: Rob Clark <rob@ti.com>
> >>
> >> This simplifies drm fb lifetime, and if the crtc/plane needs to hold
> >> a ref to the fb when disabling a pipe until the next vblank, this
> >> avoids the need to make disabling an overlay synchronous.  This is a
> >> problem that shows up when userspace is using a drm plane to
> >> implement a hw cursor.. making overlay disable synchronous causes
> >> a performance problem when x11 is rapidly enabling/disabling the
> >> hw cursor.  But not making it synchronous opens up a race condition
> >> for crashing if userspace turns around and immediately deletes the
> >> fb.  Refcnt'ing the fb makes it possible to solve this problem.
> >
> > Presumably you have a follow-on patch putting the new refcnt to use so
> > that we can judge whether you truly need refcnting on the fb itself in
> > addition to the refcnted object and the various hw bookkeeping that
> > needs to be performed?
> 
> Yes, I do.. although it is a bit experimental at this point, so not
> really ready to be submitted as anything other than an RFC.. it is
> part of omapdrm kms re-write to use dispc directly rather than go thru
> omapdss.  (With omapdss we don't hit this issue because disabling
> overlays is forced to be synchronous.. so instead we have the
> performance problem I mentioned.)
> 
> I *could* just rely on the GEM refcnt, but that gets messier when you
> take into account multi-planar formats.  I suppose I also could have
> my own internal refcnt'd object to hold the set of GEM objects
> associated w/ the fb, but, well, that seems a bit silly.  And
> refcnt'ing the fb had been mentioned previously as a good thing to do
> (I think it was danvet?)

Sure, there are a few places in the code that have caused ordering
issues in the past due to lack of refcnting the fb... But since you
haven't fixed up those cases, I'm looking for justification for adding
that extra bit of complexity. Adding a new interface and no users is
just asking for trouble.
-Chris
Rob Clark July 31, 2012, 5:59 p.m. UTC | #4
On Tue, Jul 31, 2012 at 12:47 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
> On Tue, 31 Jul 2012 12:41:28 -0500, Rob Clark <rob.clark@linaro.org> wrote:
>> On Tue, Jul 31, 2012 at 12:00 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
>> > On Tue, 31 Jul 2012 11:20:21 -0500, Rob Clark <rob.clark@linaro.org> wrote:
>> >> From: Rob Clark <rob@ti.com>
>> >>
>> >> This simplifies drm fb lifetime, and if the crtc/plane needs to hold
>> >> a ref to the fb when disabling a pipe until the next vblank, this
>> >> avoids the need to make disabling an overlay synchronous.  This is a
>> >> problem that shows up when userspace is using a drm plane to
>> >> implement a hw cursor.. making overlay disable synchronous causes
>> >> a performance problem when x11 is rapidly enabling/disabling the
>> >> hw cursor.  But not making it synchronous opens up a race condition
>> >> for crashing if userspace turns around and immediately deletes the
>> >> fb.  Refcnt'ing the fb makes it possible to solve this problem.
>> >
>> > Presumably you have a follow-on patch putting the new refcnt to use so
>> > that we can judge whether you truly need refcnting on the fb itself in
>> > addition to the refcnted object and the various hw bookkeeping that
>> > needs to be performed?
>>
>> Yes, I do.. although it is a bit experimental at this point, so not
>> really ready to be submitted as anything other than an RFC.. it is
>> part of omapdrm kms re-write to use dispc directly rather than go thru
>> omapdss.  (With omapdss we don't hit this issue because disabling
>> overlays is forced to be synchronous.. so instead we have the
>> performance problem I mentioned.)
>>
>> I *could* just rely on the GEM refcnt, but that gets messier when you
>> take into account multi-planar formats.  I suppose I also could have
>> my own internal refcnt'd object to hold the set of GEM objects
>> associated w/ the fb, but, well, that seems a bit silly.  And
>> refcnt'ing the fb had been mentioned previously as a good thing to do
>> (I think it was danvet?)
>
> Sure, there are a few places in the code that have caused ordering
> issues in the past due to lack of refcnting the fb... But since you
> haven't fixed up those cases, I'm looking for justification for adding
> that extra bit of complexity. Adding a new interface and no users is
> just asking for trouble.

fwiw, my line of reasoning was: from userspace perspective, once you
do drm_mode_rmfb(), the fb is gone, so I didn't change where it gets
removed from the list of fb's or anything like that.  Instead I just
left it so that a driver could, if it wants, take an extra ref
temporarily to the fb to keep it around for a bit.  I didn't change
any of the existing drivers, other than update the to call
drm_framebuffer_unreference() instead of fb->funcs->delete() directly,
because I didn't want to break anything in existing drivers, and I
figured the new behavior was better as an opt-in by individual drivers
when they want to take advantage of refcnt'ing.  But if you have
suggestions about related cleanups that should be made, I'm willing to
take that on.

Anyways, like I mentioned, I'm still a little ways from being ready to
submit anything other than RFC patches in omapdrm to use fb
refcnt'ing, so this isn't something that needs to be merged
immediately.  But it seemed like low risk and like it would be
something that other drivers could take advantage of, so I figured it
was worth sending this patch now.

BR,
-R

> -Chris
>
> --
> Chris Wilson, Intel Open Source Technology Centre
> --
> To unsubscribe from this list: send the line "unsubscribe linux-omap" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
Rob Clark July 31, 2012, 7:28 p.m. UTC | #5
On Tue, Jul 31, 2012 at 12:47 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
> On Tue, 31 Jul 2012 12:41:28 -0500, Rob Clark <rob.clark@linaro.org> wrote:
>> On Tue, Jul 31, 2012 at 12:00 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
>> > On Tue, 31 Jul 2012 11:20:21 -0500, Rob Clark <rob.clark@linaro.org> wrote:
>> >> From: Rob Clark <rob@ti.com>
>> >>
>> >> This simplifies drm fb lifetime, and if the crtc/plane needs to hold
>> >> a ref to the fb when disabling a pipe until the next vblank, this
>> >> avoids the need to make disabling an overlay synchronous.  This is a
>> >> problem that shows up when userspace is using a drm plane to
>> >> implement a hw cursor.. making overlay disable synchronous causes
>> >> a performance problem when x11 is rapidly enabling/disabling the
>> >> hw cursor.  But not making it synchronous opens up a race condition
>> >> for crashing if userspace turns around and immediately deletes the
>> >> fb.  Refcnt'ing the fb makes it possible to solve this problem.
>> >
>> > Presumably you have a follow-on patch putting the new refcnt to use so
>> > that we can judge whether you truly need refcnting on the fb itself in
>> > addition to the refcnted object and the various hw bookkeeping that
>> > needs to be performed?
>>
>> Yes, I do.. although it is a bit experimental at this point, so not
>> really ready to be submitted as anything other than an RFC.. it is
>> part of omapdrm kms re-write to use dispc directly rather than go thru
>> omapdss.  (With omapdss we don't hit this issue because disabling
>> overlays is forced to be synchronous.. so instead we have the
>> performance problem I mentioned.)
>>
>> I *could* just rely on the GEM refcnt, but that gets messier when you
>> take into account multi-planar formats.  I suppose I also could have
>> my own internal refcnt'd object to hold the set of GEM objects
>> associated w/ the fb, but, well, that seems a bit silly.  And
>> refcnt'ing the fb had been mentioned previously as a good thing to do
>> (I think it was danvet?)
>
> Sure, there are a few places in the code that have caused ordering
> issues in the past due to lack of refcnting the fb... But since you
> haven't fixed up those cases, I'm looking for justification for adding
> that extra bit of complexity. Adding a new interface and no users is
> just asking for trouble.

hmm, I did realize that drm_plane cleanup only happens as a result of
drm_framebuffer_cleanup().. which doesn't work too well if the driver
is holding a ref to the fb :-/

so I guess at a minimum I need to fix plane cleanup to be part of
drm_fb_helper_restore_fbdev_mode()

BR,
-R

> -Chris
>
> --
> Chris Wilson, Intel Open Source Technology Centre
> --
> To unsubscribe from this list: send the line "unsubscribe linux-omap" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
Ville Syrjälä Aug. 1, 2012, 11:36 a.m. UTC | #6
On Tue, Jul 31, 2012 at 02:28:29PM -0500, Rob Clark wrote:
> On Tue, Jul 31, 2012 at 12:47 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
> > On Tue, 31 Jul 2012 12:41:28 -0500, Rob Clark <rob.clark@linaro.org> wrote:
> >> On Tue, Jul 31, 2012 at 12:00 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
> >> > On Tue, 31 Jul 2012 11:20:21 -0500, Rob Clark <rob.clark@linaro.org> wrote:
> >> >> From: Rob Clark <rob@ti.com>
> >> >>
> >> >> This simplifies drm fb lifetime, and if the crtc/plane needs to hold
> >> >> a ref to the fb when disabling a pipe until the next vblank, this
> >> >> avoids the need to make disabling an overlay synchronous.  This is a
> >> >> problem that shows up when userspace is using a drm plane to
> >> >> implement a hw cursor.. making overlay disable synchronous causes
> >> >> a performance problem when x11 is rapidly enabling/disabling the
> >> >> hw cursor.  But not making it synchronous opens up a race condition
> >> >> for crashing if userspace turns around and immediately deletes the
> >> >> fb.  Refcnt'ing the fb makes it possible to solve this problem.
> >> >
> >> > Presumably you have a follow-on patch putting the new refcnt to use so
> >> > that we can judge whether you truly need refcnting on the fb itself in
> >> > addition to the refcnted object and the various hw bookkeeping that
> >> > needs to be performed?
> >>
> >> Yes, I do.. although it is a bit experimental at this point, so not
> >> really ready to be submitted as anything other than an RFC.. it is
> >> part of omapdrm kms re-write to use dispc directly rather than go thru
> >> omapdss.  (With omapdss we don't hit this issue because disabling
> >> overlays is forced to be synchronous.. so instead we have the
> >> performance problem I mentioned.)
> >>
> >> I *could* just rely on the GEM refcnt, but that gets messier when you
> >> take into account multi-planar formats.  I suppose I also could have
> >> my own internal refcnt'd object to hold the set of GEM objects
> >> associated w/ the fb, but, well, that seems a bit silly.  And
> >> refcnt'ing the fb had been mentioned previously as a good thing to do
> >> (I think it was danvet?)
> >
> > Sure, there are a few places in the code that have caused ordering
> > issues in the past due to lack of refcnting the fb... But since you
> > haven't fixed up those cases, I'm looking for justification for adding
> > that extra bit of complexity. Adding a new interface and no users is
> > just asking for trouble.
> 
> hmm, I did realize that drm_plane cleanup only happens as a result of
> drm_framebuffer_cleanup().. which doesn't work too well if the driver
> is holding a ref to the fb :-/
> 
> so I guess at a minimum I need to fix plane cleanup to be part of
> drm_fb_helper_restore_fbdev_mode()

Your patch would still significantly change the behavior of
drm_mode_rmfb(). Currently it disables all planes and crtcs which
currently use the fb, and it removes the fb id from the idr so that
no new users of the fb can appear afterwards.

Not that I really like the current behaviour of drm_mode_rmfb(), but
it's been like that always, so changing it doesn't seem acceptable.
Rob Clark Aug. 1, 2012, 12:55 p.m. UTC | #7
On Wed, Aug 1, 2012 at 6:36 AM, Ville Syrjälä
<ville.syrjala@linux.intel.com> wrote:
> On Tue, Jul 31, 2012 at 02:28:29PM -0500, Rob Clark wrote:
>> On Tue, Jul 31, 2012 at 12:47 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
>> > On Tue, 31 Jul 2012 12:41:28 -0500, Rob Clark <rob.clark@linaro.org> wrote:
>> >> On Tue, Jul 31, 2012 at 12:00 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
>> >> > On Tue, 31 Jul 2012 11:20:21 -0500, Rob Clark <rob.clark@linaro.org> wrote:
>> >> >> From: Rob Clark <rob@ti.com>
>> >> >>
>> >> >> This simplifies drm fb lifetime, and if the crtc/plane needs to hold
>> >> >> a ref to the fb when disabling a pipe until the next vblank, this
>> >> >> avoids the need to make disabling an overlay synchronous.  This is a
>> >> >> problem that shows up when userspace is using a drm plane to
>> >> >> implement a hw cursor.. making overlay disable synchronous causes
>> >> >> a performance problem when x11 is rapidly enabling/disabling the
>> >> >> hw cursor.  But not making it synchronous opens up a race condition
>> >> >> for crashing if userspace turns around and immediately deletes the
>> >> >> fb.  Refcnt'ing the fb makes it possible to solve this problem.
>> >> >
>> >> > Presumably you have a follow-on patch putting the new refcnt to use so
>> >> > that we can judge whether you truly need refcnting on the fb itself in
>> >> > addition to the refcnted object and the various hw bookkeeping that
>> >> > needs to be performed?
>> >>
>> >> Yes, I do.. although it is a bit experimental at this point, so not
>> >> really ready to be submitted as anything other than an RFC.. it is
>> >> part of omapdrm kms re-write to use dispc directly rather than go thru
>> >> omapdss.  (With omapdss we don't hit this issue because disabling
>> >> overlays is forced to be synchronous.. so instead we have the
>> >> performance problem I mentioned.)
>> >>
>> >> I *could* just rely on the GEM refcnt, but that gets messier when you
>> >> take into account multi-planar formats.  I suppose I also could have
>> >> my own internal refcnt'd object to hold the set of GEM objects
>> >> associated w/ the fb, but, well, that seems a bit silly.  And
>> >> refcnt'ing the fb had been mentioned previously as a good thing to do
>> >> (I think it was danvet?)
>> >
>> > Sure, there are a few places in the code that have caused ordering
>> > issues in the past due to lack of refcnting the fb... But since you
>> > haven't fixed up those cases, I'm looking for justification for adding
>> > that extra bit of complexity. Adding a new interface and no users is
>> > just asking for trouble.
>>
>> hmm, I did realize that drm_plane cleanup only happens as a result of
>> drm_framebuffer_cleanup().. which doesn't work too well if the driver
>> is holding a ref to the fb :-/
>>
>> so I guess at a minimum I need to fix plane cleanup to be part of
>> drm_fb_helper_restore_fbdev_mode()
>
> Your patch would still significantly change the behavior of
> drm_mode_rmfb(). Currently it disables all planes and crtcs which
> currently use the fb, and it removes the fb id from the idr so that
> no new users of the fb can appear afterwards.
>
> Not that I really like the current behaviour of drm_mode_rmfb(), but
> it's been like that always, so changing it doesn't seem acceptable.

yeah, I'm working on an update that decouples the crtc/plane shutdown
from deleting the fb, which should address these issues

BR,
-R

> --
> Ville Syrjälä
> Intel OTC
> --
> To unsubscribe from this list: send the line "unsubscribe linux-omap" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 08a7aa7..2f928a3 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -294,6 +294,8 @@  int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 {
 	int ret;
 
+	kref_init(&fb->refcount);
+
 	ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
 	if (ret)
 		return ret;
@@ -307,6 +309,36 @@  int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 }
 EXPORT_SYMBOL(drm_framebuffer_init);
 
+static void drm_framebuffer_free(struct kref *kref)
+{
+	struct drm_framebuffer *fb =
+			container_of(kref, struct drm_framebuffer, refcount);
+	fb->funcs->destroy(fb);
+}
+
+/**
+ * drm_framebuffer_unreference - unref a framebuffer
+ *
+ * LOCKING:
+ * Caller must hold mode config lock.
+ */
+void drm_framebuffer_unreference(struct drm_framebuffer *fb)
+{
+	struct drm_device *dev = fb->dev;
+	WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
+	kref_put(&fb->refcount, drm_framebuffer_free);
+}
+EXPORT_SYMBOL(drm_framebuffer_unreference);
+
+/**
+ * drm_framebuffer_reference - incr the fb refcnt
+ */
+void drm_framebuffer_reference(struct drm_framebuffer *fb)
+{
+	kref_get(&fb->refcount);
+}
+EXPORT_SYMBOL(drm_framebuffer_reference);
+
 /**
  * drm_framebuffer_cleanup - remove a framebuffer object
  * @fb: framebuffer to remove
@@ -1031,7 +1063,7 @@  void drm_mode_config_cleanup(struct drm_device *dev)
 	}
 
 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
-		fb->funcs->destroy(fb);
+		drm_framebuffer_unreference(fb);
 	}
 
 	list_for_each_entry_safe(crtc, ct, &dev->mode_config.crtc_list, head) {
@@ -2339,7 +2371,7 @@  int drm_mode_rmfb(struct drm_device *dev,
 	/* TODO unhock the destructor from the buffer object */
 
 	list_del(&fb->filp_head);
-	fb->funcs->destroy(fb);
+	drm_framebuffer_unreference(fb);
 
 out:
 	mutex_unlock(&dev->mode_config.mutex);
@@ -2490,7 +2522,7 @@  void drm_fb_release(struct drm_file *priv)
 	mutex_lock(&dev->mode_config.mutex);
 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
 		list_del(&fb->filp_head);
-		fb->funcs->destroy(fb);
+		drm_framebuffer_unreference(fb);
 	}
 	mutex_unlock(&dev->mode_config.mutex);
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index d5586cc..05695d6 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -266,8 +266,8 @@  static void exynos_drm_fbdev_destroy(struct drm_device *dev,
 	/* release drm framebuffer and real buffer */
 	if (fb_helper->fb && fb_helper->fb->funcs) {
 		fb = fb_helper->fb;
-		if (fb && fb->funcs->destroy)
-			fb->funcs->destroy(fb);
+		if (fb)
+			drm_framebuffer_unreference(fb);
 	}
 
 	/* release linux framebuffer */
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index a8538ac..a9d2328 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5467,7 +5467,7 @@  bool intel_get_load_detect_pipe(struct intel_encoder *intel_encoder,
 	if (!drm_crtc_helper_set_mode(crtc, mode, 0, 0, old_fb)) {
 		DRM_DEBUG_KMS("failed to set mode on load-detect pipe\n");
 		if (old->release_fb)
-			old->release_fb->funcs->destroy(old->release_fb);
+			drm_framebuffer_unreference(old->release_fb);
 		crtc->fb = old_fb;
 		return false;
 	}
@@ -5497,7 +5497,7 @@  void intel_release_load_detect_pipe(struct intel_encoder *intel_encoder,
 		drm_helper_disable_unused_functions(dev);
 
 		if (old->release_fb)
-			old->release_fb->funcs->destroy(old->release_fb);
+			drm_framebuffer_unreference(old->release_fb);
 
 		return;
 	}
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index bac55c2..8a5b16d 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -221,6 +221,7 @@  struct drm_display_info {
 };
 
 struct drm_framebuffer_funcs {
+	/* note: use drm_framebuffer_unreference() */
 	void (*destroy)(struct drm_framebuffer *framebuffer);
 	int (*create_handle)(struct drm_framebuffer *fb,
 			     struct drm_file *file_priv,
@@ -245,6 +246,7 @@  struct drm_framebuffer_funcs {
 
 struct drm_framebuffer {
 	struct drm_device *dev;
+	struct kref refcount;
 	struct list_head head;
 	struct drm_mode_object base;
 	const struct drm_framebuffer_funcs *funcs;
@@ -923,6 +925,8 @@  extern void drm_framebuffer_set_object(struct drm_device *dev,
 extern int drm_framebuffer_init(struct drm_device *dev,
 				struct drm_framebuffer *fb,
 				const struct drm_framebuffer_funcs *funcs);
+void drm_framebuffer_unreference(struct drm_framebuffer *fb);
+void drm_framebuffer_reference(struct drm_framebuffer *fb);
 extern void drm_framebuffer_cleanup(struct drm_framebuffer *fb);
 extern int drmfb_probe(struct drm_device *dev, struct drm_crtc *crtc);
 extern int drmfb_remove(struct drm_device *dev, struct drm_framebuffer *fb);