drm_atomic_helper_cleanup_planes(dev, old_state);
 
-       drm_atomic_state_free(old_state);
+       drm_atomic_state_put(old_state);
 
        /* Complete the commit, wake up any waiter. */
        spin_lock(&dc->commit.wait.lock);
        /* Swap the state, this is the point of no return. */
        drm_atomic_helper_swap_state(state, true);
 
+       drm_atomic_state_get(state);
        if (async)
                queue_work(dc->wq, &commit->work);
        else
 
 int
 drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state)
 {
+       kref_init(&state->ref);
+
        /* TODO legacy paths should maybe do a better job about
         * setting this appropriately?
         */
 EXPORT_SYMBOL(drm_atomic_state_clear);
 
 /**
- * drm_atomic_state_free - free all memory for an atomic state
- * @state: atomic state to deallocate
+ * __drm_atomic_state_free - free all memory for an atomic state
+ * @ref: This atomic state to deallocate
  *
  * This frees all memory associated with an atomic state, including all the
  * per-object state for planes, crtcs and connectors.
  */
-void drm_atomic_state_free(struct drm_atomic_state *state)
+void __drm_atomic_state_free(struct kref *ref)
 {
-       struct drm_device *dev;
-       struct drm_mode_config *config;
-
-       if (!state)
-               return;
-
-       dev = state->dev;
-       config = &dev->mode_config;
+       struct drm_atomic_state *state = container_of(ref, typeof(*state), ref);
+       struct drm_mode_config *config = &state->dev->mode_config;
 
        drm_atomic_state_clear(state);
 
                kfree(state);
        }
 }
-EXPORT_SYMBOL(drm_atomic_state_free);
+EXPORT_SYMBOL(__drm_atomic_state_free);
 
 /**
  * drm_atomic_get_crtc_state - get crtc state
        if (arg->flags & DRM_MODE_ATOMIC_TEST_ONLY) {
                /*
                 * Unlike commit, check_only does not clean up state.
-                * Below we call drm_atomic_state_free for it.
+                * Below we call drm_atomic_state_put for it.
                 */
                ret = drm_atomic_check_only(state);
        } else if (arg->flags & DRM_MODE_ATOMIC_NONBLOCK) {
                goto retry;
        }
 
-       if (ret || arg->flags & DRM_MODE_ATOMIC_TEST_ONLY)
-               drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
 
        drm_modeset_drop_locks(&ctx);
        drm_modeset_acquire_fini(&ctx);
 
 
        drm_atomic_helper_commit_cleanup_done(state);
 
-       drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
 }
 
 static void commit_work(struct work_struct *work)
         * make sure work items don't artifically stall on each another.
         */
 
+       drm_atomic_state_get(state);
        if (nonblock)
                queue_work(system_unbound_wq, &state->commit_work);
        else
  *
  * This signals completion of the atomic update @state, including any cleanup
  * work. If used, it must be called right before calling
- * drm_atomic_state_free().
+ * drm_atomic_state_put().
  *
  * This is part of the atomic helper support for nonblocking commits, see
  * drm_atomic_helper_setup_commit() for an overview.
                state->legacy_cursor_update = true;
 
        ret = drm_atomic_commit(state);
-       if (ret != 0)
-               goto fail;
-
-       /* Driver takes ownership of state on successful commit. */
-       return 0;
 fail:
        if (ret == -EDEADLK)
                goto backoff;
 
-       drm_atomic_state_free(state);
-
+       drm_atomic_state_put(state);
        return ret;
+
 backoff:
        drm_atomic_state_clear(state);
        drm_atomic_legacy_backoff(state);
                goto fail;
 
        ret = drm_atomic_commit(state);
-       if (ret != 0)
-               goto fail;
-
-       /* Driver takes ownership of state on successful commit. */
-       return 0;
 fail:
        if (ret == -EDEADLK)
                goto backoff;
 
-       drm_atomic_state_free(state);
-
+       drm_atomic_state_put(state);
        return ret;
+
 backoff:
        drm_atomic_state_clear(state);
        drm_atomic_legacy_backoff(state);
                goto fail;
 
        ret = drm_atomic_commit(state);
-       if (ret != 0)
-               goto fail;
-
-       /* Driver takes ownership of state on successful commit. */
-       return 0;
 fail:
        if (ret == -EDEADLK)
                goto backoff;
 
-       drm_atomic_state_free(state);
-
+       drm_atomic_state_put(state);
        return ret;
+
 backoff:
        drm_atomic_state_clear(state);
        drm_atomic_legacy_backoff(state);
        }
 
        err = drm_atomic_commit(state);
-
 free:
-       if (err < 0)
-               drm_atomic_state_free(state);
-
+       drm_atomic_state_put(state);
        return err;
 }
 EXPORT_SYMBOL(drm_atomic_helper_disable_all);
 
        err = drm_atomic_helper_disable_all(dev, &ctx);
        if (err < 0) {
-               drm_atomic_state_free(state);
+               drm_atomic_state_put(state);
                state = ERR_PTR(err);
                goto unlock;
        }
                goto fail;
 
        ret = drm_atomic_commit(state);
-       if (ret != 0)
-               goto fail;
-
-       /* Driver takes ownership of state on successful commit. */
-       return 0;
 fail:
        if (ret == -EDEADLK)
                goto backoff;
 
-       drm_atomic_state_free(state);
-
+       drm_atomic_state_put(state);
        return ret;
+
 backoff:
        drm_atomic_state_clear(state);
        drm_atomic_legacy_backoff(state);
                goto fail;
 
        ret = drm_atomic_commit(state);
-       if (ret != 0)
-               goto fail;
-
-       /* Driver takes ownership of state on successful commit. */
-       return 0;
 fail:
        if (ret == -EDEADLK)
                goto backoff;
 
-       drm_atomic_state_free(state);
-
+       drm_atomic_state_put(state);
        return ret;
+
 backoff:
        drm_atomic_state_clear(state);
        drm_atomic_legacy_backoff(state);
                goto fail;
 
        ret = drm_atomic_commit(state);
-       if (ret != 0)
-               goto fail;
-
-       /* Driver takes ownership of state on successful commit. */
-       return 0;
 fail:
        if (ret == -EDEADLK)
                goto backoff;
 
-       drm_atomic_state_free(state);
-
+       drm_atomic_state_put(state);
        return ret;
+
 backoff:
        drm_atomic_state_clear(state);
        drm_atomic_legacy_backoff(state);
        }
 
        ret = drm_atomic_nonblocking_commit(state);
-       if (ret != 0)
-               goto fail;
-
-       /* Driver takes ownership of state on successful commit. */
-       return 0;
 fail:
        if (ret == -EDEADLK)
                goto backoff;
 
-       drm_atomic_state_free(state);
-
+       drm_atomic_state_put(state);
        return ret;
+
 backoff:
        drm_atomic_state_clear(state);
        drm_atomic_legacy_backoff(state);
        crtc_state->active = active;
 
        ret = drm_atomic_commit(state);
-       if (ret != 0)
-               goto fail;
-
-       /* Driver takes ownership of state on successful commit. */
-       return 0;
 fail:
        if (ret == -EDEADLK)
                goto backoff;
 
        connector->dpms = old_mode;
-       drm_atomic_state_free(state);
-
+       drm_atomic_state_put(state);
        return ret;
+
 backoff:
        drm_atomic_state_clear(state);
        drm_atomic_legacy_backoff(state);
 
 free:
        if (err < 0) {
-               drm_atomic_state_free(state);
+               drm_atomic_state_put(state);
                state = ERR_PTR(err);
        }
 
                goto fail;
 
        ret = drm_atomic_commit(state);
-       if (ret)
-               goto fail;
-
-       /* Driver takes ownership of state on successful commit. */
-
-       drm_property_unreference_blob(blob);
-
-       return 0;
 fail:
        if (ret == -EDEADLK)
                goto backoff;
 
-       drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
        drm_property_unreference_blob(blob);
-
        return ret;
+
 backoff:
        drm_atomic_state_clear(state);
        drm_atomic_legacy_backoff(state);
 
        if (ret == -EDEADLK)
                goto backoff;
 
-       if (ret != 0)
-               drm_atomic_state_free(state);
-
+       drm_atomic_state_put(state);
        return ret;
 
 backoff:
        info->var.xoffset = var->xoffset;
        info->var.yoffset = var->yoffset;
 
-
 fail:
        drm_atomic_clean_old_fb(dev, plane_mask, ret);
 
        if (ret == -EDEADLK)
                goto backoff;
 
-       if (ret != 0)
-               drm_atomic_state_free(state);
-
+       drm_atomic_state_put(state);
        return ret;
 
 backoff:
 
 
        drm_atomic_helper_cleanup_planes(dev, state);
 
-       drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
 
        spin_lock(&priv->lock);
        priv->pending &= ~commit->crtcs;
 
        drm_atomic_helper_swap_state(state, true);
 
+       drm_atomic_state_get(state);
        if (nonblock)
                schedule_work(&commit->work);
        else
 
 
        ret = drm_atomic_commit(state);
 out:
-       drm_modeset_unlock_all(dev);
        WARN(ret, "Toggling workaround to %i returns %i\n", enable, ret);
-       if (ret)
-               drm_atomic_state_free(state);
+       drm_modeset_unlock_all(dev);
+       drm_atomic_state_put(state);
 }
 
 static int ivb_pipe_crc_ctl_reg(struct drm_i915_private *dev_priv,
 
        return;
 
 err:
-       drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
 }
 
 void intel_finish_reset(struct drm_i915_private *dev_priv)
                intel_hpd_init(dev_priv);
        }
 
+       if (state)
+               drm_atomic_state_put(state);
        drm_modeset_drop_locks(ctx);
        drm_modeset_acquire_fini(ctx);
        mutex_unlock(&dev->mode_config.mutex);
 
        dev_priv->display.crtc_disable(crtc_state, state);
 
-       drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
 
        DRM_DEBUG_KMS("[CRTC:%d:%s] hw state adjusted, was enabled, now disabled\n",
                      crtc->base.id, crtc->name);
        return true;
 
 fail:
-       drm_atomic_state_free(state);
-       drm_atomic_state_free(restore_state);
+       drm_atomic_state_put(state);
+       drm_atomic_state_put(restore_state);
        restore_state = state = NULL;
 
        if (ret == -EDEADLK) {
                return;
 
        ret = drm_atomic_commit(state);
-       if (ret) {
+       if (ret)
                DRM_DEBUG_KMS("Couldn't release load detect pipe: %i\n", ret);
-               drm_atomic_state_free(state);
-       }
+       drm_atomic_state_put(state);
 }
 
 static int i9xx_pll_refclk(struct drm_device *dev,
                        goto retry;
                }
 
-               if (ret)
-                       drm_atomic_state_free(state);
+               drm_atomic_state_put(state);
 
                if (ret == 0 && event) {
                        spin_lock_irq(&dev->event_lock);
 
        drm_atomic_helper_commit_cleanup_done(state);
 
-       drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
 
        /* As one of the primary mmio accessors, KMS has a high likelihood
         * of triggering bugs in unclaimed access. After we finish
        intel_shared_dpll_commit(state);
        intel_atomic_track_fbs(state);
 
+       drm_atomic_state_get(state);
        if (nonblock)
                queue_work(system_unbound_wq, &state->commit_work);
        else
                goto retry;
        }
 
-       if (ret)
 out:
-               drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
 }
 
 /*
                dev_priv->display.optimize_watermarks(cs);
        }
 
-       drm_atomic_state_free(state);
 fail:
+       drm_atomic_state_put(state);
        drm_modeset_drop_locks(&ctx);
        drm_modeset_acquire_fini(&ctx);
 }
        drm_modeset_acquire_fini(&ctx);
        mutex_unlock(&dev->mode_config.mutex);
 
-       if (ret) {
+       if (ret)
                DRM_ERROR("Restoring old state failed with %i\n", ret);
-               drm_atomic_state_free(state);
-       }
+       drm_atomic_state_put(state);
 }
 
 void intel_modeset_gem_init(struct drm_device *dev)
 
                drm_modeset_backoff(&ctx);
        }
 
-       if (ret)
-               drm_atomic_state_free(state);
-
+       drm_atomic_state_put(state);
 out:
        drm_modeset_drop_locks(&ctx);
        drm_modeset_acquire_fini(&ctx);
 
        drm_atomic_helper_wait_for_vblanks(drm, state);
 
        drm_atomic_helper_cleanup_planes(drm, state);
-       drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
 }
 
 static void mtk_atomic_work(struct work_struct *work)
 
        drm_atomic_helper_swap_state(state, true);
 
+       drm_atomic_state_get(state);
        if (async)
                mtk_atomic_schedule(private, state);
        else
 
 
        kms->funcs->complete_commit(kms, state);
 
-       drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
 
        commit_destroy(c);
 }
         * current layout.
         */
 
+       drm_atomic_state_get(state);
        if (nonblock) {
                queue_work(priv->atomic_wq, &c->work);
                return 0;
 
 
        dispc_runtime_put();
 
-       drm_atomic_state_free(old_state);
+       drm_atomic_state_put(old_state);
 
        /* Complete the commit, wake up any waiter. */
        spin_lock(&priv->commit.lock);
        /* Swap the state, this is the point of no return. */
        drm_atomic_helper_swap_state(state, true);
 
+       drm_atomic_state_get(state);
        if (nonblock)
                schedule_work(&commit->work);
        else
 
 
        drm_atomic_helper_cleanup_planes(dev, old_state);
 
-       drm_atomic_state_free(old_state);
+       drm_atomic_state_put(old_state);
 
        /* Complete the commit, wake up any waiter. */
        spin_lock(&rcdu->commit.wait.lock);
        /* Swap the state, this is the point of no return. */
        drm_atomic_helper_swap_state(state, true);
 
+       drm_atomic_state_get(state);
        if (nonblock)
                schedule_work(&commit->work);
        else
 
        drm_atomic_helper_wait_for_vblanks(drm, state);
 
        drm_atomic_helper_cleanup_planes(drm, state);
-       drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
 }
 
 static void sti_atomic_work(struct work_struct *work)
 
        drm_atomic_helper_swap_state(state, true);
 
+       drm_atomic_state_get(state);
        if (nonblock)
                sti_atomic_schedule(private, state);
        else
 
        drm_atomic_helper_wait_for_vblanks(drm, state);
 
        drm_atomic_helper_cleanup_planes(drm, state);
-       drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
 }
 
 static void tegra_atomic_work(struct work_struct *work)
 
        drm_atomic_helper_swap_state(state, true);
 
+       drm_atomic_state_get(state);
        if (nonblock)
                tegra_atomic_schedule(tegra, state);
        else
 
 
        drm_atomic_helper_cleanup_planes(dev, state);
 
-       drm_atomic_state_free(state);
-
        return 0;
 }
 
 
 
        drm_atomic_helper_cleanup_planes(dev, state);
 
-       drm_atomic_state_free(state);
+       drm_atomic_state_put(state);
 
        up(&vc4->async_modeset);
 
         * current layout.
         */
 
+       drm_atomic_state_get(state);
        if (nonblock) {
                vc4_queue_seqno_cb(dev, &c->cb, wait_seqno,
                                   vc4_atomic_complete_commit_seqno_cb);
 
 
 /**
  * struct drm_atomic_state - the global state object for atomic updates
+ * @ref: count of all references to this state (will not be freed until zero)
  * @dev: parent DRM device
  * @allow_modeset: allow full modeset
  * @legacy_cursor_update: hint to enforce legacy cursor IOCTL semantics
  * @acquire_ctx: acquire context for this atomic modeset state update
  */
 struct drm_atomic_state {
+       struct kref ref;
+
        struct drm_device *dev;
        bool allow_modeset : 1;
        bool legacy_cursor_update : 1;
 struct drm_atomic_state * __must_check
 drm_atomic_state_alloc(struct drm_device *dev);
 void drm_atomic_state_clear(struct drm_atomic_state *state);
-void drm_atomic_state_free(struct drm_atomic_state *state);
+
+/**
+ * drm_atomic_state_get - acquire a reference to the atomic state
+ * @state: The atomic state
+ *
+ * Returns a new reference to the @state
+ */
+static inline struct drm_atomic_state *
+drm_atomic_state_get(struct drm_atomic_state *state)
+{
+       kref_get(&state->ref);
+       return state;
+}
+
+void __drm_atomic_state_free(struct kref *ref);
+
+/**
+ * drm_atomic_state_put - release a reference to the atomic state
+ * @state: The atomic state
+ *
+ * This releases a reference to @state which is freed after removing the
+ * final reference. No locking required and callable from any context.
+ */
+static inline void drm_atomic_state_put(struct drm_atomic_state *state)
+{
+       kref_put(&state->ref, __drm_atomic_state_free);
+}
 
 int  __must_check
 drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state);
 
        struct drm_atomic_state *state;
 };
 
-
 /**
  * struct drm_plane_funcs - driver plane control functions
  */