Hi,
This patch series converts the driver to use drm managed resources to prevent
potential use-after-free issues on driver unbind/rebind and to get rid of the
usage of deprecated APIs.
Changes in v2:
- While protecting critical sections with drm_dev_{enter,exit} I forgot to
handle alternate return paths within the read-side critical sections, hence
fix them.
- Add a patch to remove explicit calls to drm_mode_config_cleanup() and switch
to drmm_mode_config_init() explicitly.
Danilo Krummrich (9):
drm/fsl-dcu: use drmm_* to allocate driver structures
drm/fsl-dcu: replace drm->dev_private with drm_to_fsl_dcu_drm_dev()
drm/fsl-dcu: crtc: use drmm_crtc_init_with_planes()
drm/fsl-dcu: plane: use drm managed resources
drm/fsl-dcu: use drm_dev_unplug()
drm/fsl-dcu: plane: protect device resources after removal
drm/fsl-dcu: crtc: protect device resources after removal
drm/fsl-dcu: remove trailing return statements
drm/fsl-dcu: remove calls to drm_mode_config_cleanup()
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c | 64 ++++++++++++++++-----
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 47 ++++++---------
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 4 +-
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_kms.c | 20 ++++---
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c | 58 ++++++++++---------
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c | 8 +--
6 files changed, 116 insertions(+), 85 deletions(-)
base-commit: 08fb97de03aa2205c6791301bd83a095abc1949c
--
2.37.3
Using drm_device->dev_private is deprecated. Since we've switched to
devm_drm_dev_alloc(), struct drm_device is now embedded in struct
malidp_drm, hence we can use container_of() to get the struct drm_device
instance instead.
Signed-off-by: Danilo Krummrich <[email protected]>
---
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c | 12 ++++++------
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 13 ++++---------
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 2 ++
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c | 8 ++++----
4 files changed, 16 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
index a1b8ce70928a..e05311e2b0e0 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
@@ -24,7 +24,7 @@ static void fsl_dcu_drm_crtc_atomic_flush(struct drm_crtc *crtc,
struct drm_atomic_state *state)
{
struct drm_device *dev = crtc->dev;
- struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
struct drm_pending_vblank_event *event = crtc->state->event;
regmap_write(fsl_dev->regmap,
@@ -48,7 +48,7 @@ static void fsl_dcu_drm_crtc_atomic_disable(struct drm_crtc *crtc,
struct drm_crtc_state *old_crtc_state = drm_atomic_get_old_crtc_state(state,
crtc);
struct drm_device *dev = crtc->dev;
- struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
/* always disable planes on the CRTC */
drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, true);
@@ -67,7 +67,7 @@ static void fsl_dcu_drm_crtc_atomic_enable(struct drm_crtc *crtc,
struct drm_atomic_state *state)
{
struct drm_device *dev = crtc->dev;
- struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
clk_prepare_enable(fsl_dev->pix_clk);
regmap_update_bits(fsl_dev->regmap, DCU_DCU_MODE,
@@ -82,7 +82,7 @@ static void fsl_dcu_drm_crtc_atomic_enable(struct drm_crtc *crtc,
static void fsl_dcu_drm_crtc_mode_set_nofb(struct drm_crtc *crtc)
{
struct drm_device *dev = crtc->dev;
- struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
struct drm_connector *con = &fsl_dev->connector.base;
struct drm_display_mode *mode = &crtc->state->mode;
unsigned int pol = 0;
@@ -135,7 +135,7 @@ static const struct drm_crtc_helper_funcs fsl_dcu_drm_crtc_helper_funcs = {
static int fsl_dcu_drm_crtc_enable_vblank(struct drm_crtc *crtc)
{
struct drm_device *dev = crtc->dev;
- struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
unsigned int value;
regmap_read(fsl_dev->regmap, DCU_INT_MASK, &value);
@@ -148,7 +148,7 @@ static int fsl_dcu_drm_crtc_enable_vblank(struct drm_crtc *crtc)
static void fsl_dcu_drm_crtc_disable_vblank(struct drm_crtc *crtc)
{
struct drm_device *dev = crtc->dev;
- struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
unsigned int value;
regmap_read(fsl_dev->regmap, DCU_INT_MASK, &value);
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
index a47b72995fcf..4139f674c5de 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
@@ -52,7 +52,7 @@ static const struct regmap_config fsl_dcu_regmap_config = {
static void fsl_dcu_irq_reset(struct drm_device *dev)
{
- struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
regmap_write(fsl_dev->regmap, DCU_INT_STATUS, ~0);
regmap_write(fsl_dev->regmap, DCU_INT_MASK, ~0);
@@ -61,7 +61,7 @@ static void fsl_dcu_irq_reset(struct drm_device *dev)
static irqreturn_t fsl_dcu_drm_irq(int irq, void *arg)
{
struct drm_device *dev = arg;
- struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
unsigned int int_status;
int ret;
@@ -91,7 +91,7 @@ static int fsl_dcu_irq_install(struct drm_device *dev, unsigned int irq)
static void fsl_dcu_irq_uninstall(struct drm_device *dev)
{
- struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
fsl_dcu_irq_reset(dev);
free_irq(fsl_dev->irq, dev);
@@ -99,7 +99,7 @@ static void fsl_dcu_irq_uninstall(struct drm_device *dev)
static int fsl_dcu_load(struct drm_device *dev, unsigned long flags)
{
- struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
int ret;
ret = fsl_dcu_drm_modeset_init(fsl_dev);
@@ -133,8 +133,6 @@ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags)
drm_mode_config_cleanup(dev);
done_vblank:
- dev->dev_private = NULL;
-
return ret;
}
@@ -145,8 +143,6 @@ static void fsl_dcu_unload(struct drm_device *dev)
drm_mode_config_cleanup(dev);
fsl_dcu_irq_uninstall(dev);
-
- dev->dev_private = NULL;
}
DEFINE_DRM_GEM_DMA_FOPS(fsl_dcu_drm_fops);
@@ -322,7 +318,6 @@ static int fsl_dcu_drm_probe(struct platform_device *pdev)
fsl_dev->dev = dev;
fsl_dev->np = dev->of_node;
- drm->dev_private = fsl_dev;
dev_set_drvdata(dev, fsl_dev);
ret = drm_dev_register(drm, 0);
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h
index 20ca13ff618a..5b61d443da96 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h
@@ -193,6 +193,8 @@ struct fsl_dcu_drm_device {
const struct fsl_dcu_soc_data *soc;
};
+#define drm_to_fsl_dcu_drm_dev(x) container_of(x, struct fsl_dcu_drm_device, base)
+
int fsl_dcu_drm_modeset_init(struct fsl_dcu_drm_device *fsl_dev);
#endif /* __FSL_DCU_DRM_DRV_H__ */
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
index 794a87d16f88..91865956da02 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
@@ -22,7 +22,7 @@
static int fsl_dcu_drm_plane_index(struct drm_plane *plane)
{
- struct fsl_dcu_drm_device *fsl_dev = plane->dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(plane->dev);
unsigned int total_layer = fsl_dev->soc->total_layer;
unsigned int index;
@@ -63,7 +63,7 @@ static int fsl_dcu_drm_plane_atomic_check(struct drm_plane *plane,
static void fsl_dcu_drm_plane_atomic_disable(struct drm_plane *plane,
struct drm_atomic_state *state)
{
- struct fsl_dcu_drm_device *fsl_dev = plane->dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(plane->dev);
unsigned int value;
int index;
@@ -80,7 +80,7 @@ static void fsl_dcu_drm_plane_atomic_update(struct drm_plane *plane,
struct drm_atomic_state *state)
{
- struct fsl_dcu_drm_device *fsl_dev = plane->dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(plane->dev);
struct drm_plane_state *new_state = drm_atomic_get_new_plane_state(state,
plane);
struct drm_framebuffer *fb = plane->state->fb;
@@ -194,7 +194,7 @@ static const u32 fsl_dcu_drm_plane_formats[] = {
void fsl_dcu_drm_init_planes(struct drm_device *dev)
{
- struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+ struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
int i, j;
for (i = 0; i < fsl_dev->soc->total_layer; i++) {
--
2.37.3
drm_mode_config_init() simply calls drmm_mode_config_init(), hence
cleanup is automatically handled through registering
drm_mode_config_cleanup() with drmm_add_action_or_reset().
While at it, get rid of the deprecated drm_mode_config_init() and
replace it with drmm_mode_config_init() directly.
Signed-off-by: Danilo Krummrich <[email protected]>
---
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 4 +---
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_kms.c | 5 +++--
2 files changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
index 3ac57516c3fe..cb74ae663f25 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
@@ -128,10 +128,9 @@ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags)
}
return 0;
+
done_irq:
drm_kms_helper_poll_fini(dev);
-
- drm_mode_config_cleanup(dev);
done_vblank:
return ret;
}
@@ -141,7 +140,6 @@ static void fsl_dcu_unload(struct drm_device *dev)
drm_atomic_helper_shutdown(dev);
drm_kms_helper_poll_fini(dev);
- drm_mode_config_cleanup(dev);
fsl_dcu_irq_uninstall(dev);
}
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_kms.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_kms.c
index c3d55c0aca9f..219ca539dedd 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_kms.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_kms.c
@@ -23,7 +23,9 @@ int fsl_dcu_drm_modeset_init(struct fsl_dcu_drm_device *fsl_dev)
struct drm_device *drm = &fsl_dev->base;
int ret;
- drm_mode_config_init(drm);
+ ret = drmm_mode_config_init(drm);
+ if (ret)
+ goto err;
drm->mode_config.min_width = 0;
drm->mode_config.min_height = 0;
@@ -49,6 +51,5 @@ int fsl_dcu_drm_modeset_init(struct fsl_dcu_drm_device *fsl_dev)
return 0;
err:
- drm_mode_config_cleanup(drm);
return ret;
}
--
2.37.3
When the driver is unbound, there might still be users in userspace
having an open fd and are calling into the driver.
While this is fine for drm managed resources, it is not for resources
bound to the device/driver lifecycle, e.g. clocks or MMIO mappings.
To prevent use-after-free issues we need to protect those resources with
drm_dev_enter() and drm_dev_exit(). This does only work if we indicate
that the drm device was unplugged, hence use drm_dev_unplug() instead of
drm_dev_unregister().
Protecting the particular resources with drm_dev_enter()/drm_dev_exit()
is handled by subsequent patches.
Signed-off-by: Danilo Krummrich <[email protected]>
---
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
index 4139f674c5de..3ac57516c3fe 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
@@ -340,7 +340,7 @@ static int fsl_dcu_drm_remove(struct platform_device *pdev)
struct fsl_dcu_drm_device *fsl_dev = platform_get_drvdata(pdev);
struct drm_device *drm = &fsl_dev->base;
- drm_dev_unregister(drm);
+ drm_dev_unplug(drm);
clk_disable_unprepare(fsl_dev->clk);
clk_unregister(fsl_dev->pix_clk);
--
2.37.3
Remove the trailing return statements at the end of void functions.
Signed-off-by: Danilo Krummrich <[email protected]>
---
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c | 1 -
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c | 1 -
2 files changed, 2 deletions(-)
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
index c77df9b7893f..23687551c831 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
@@ -147,7 +147,6 @@ static void fsl_dcu_drm_crtc_mode_set_nofb(struct drm_crtc *crtc)
DCU_THRESHOLD_OUT_BUF_LOW(BUF_MIN_VAL));
drm_dev_exit(idx);
- return;
}
static const struct drm_crtc_helper_funcs fsl_dcu_drm_crtc_helper_funcs = {
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
index b1305f0af9d5..b95dca47de3e 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
@@ -174,7 +174,6 @@ static void fsl_dcu_drm_plane_atomic_update(struct drm_plane *plane,
out:
drm_dev_exit(idx);
- return;
}
static const struct drm_plane_helper_funcs fsl_dcu_drm_plane_helper_funcs = {
--
2.37.3
(Hardware) resources which are bound to the driver and device lifecycle
must not be accessed after the device and driver are unbound.
However, the DRM device isn't freed as long as the last user didn't
close it, hence userspace can still call into the driver.
Therefore protect the critical sections which are accessing those
resources with drm_dev_enter() and drm_dev_exit().
Signed-off-by: Danilo Krummrich <[email protected]>
---
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c | 24 +++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
index 23ff285da477..b1305f0af9d5 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
@@ -10,6 +10,7 @@
#include <drm/drm_atomic.h>
#include <drm/drm_atomic_helper.h>
#include <drm/drm_crtc.h>
+#include <drm/drm_drv.h>
#include <drm/drm_fb_dma_helper.h>
#include <drm/drm_fourcc.h>
#include <drm/drm_framebuffer.h>
@@ -65,15 +66,21 @@ static void fsl_dcu_drm_plane_atomic_disable(struct drm_plane *plane,
{
struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(plane->dev);
unsigned int value;
- int index;
+ int index, idx;
+
+ if (!drm_dev_enter(plane->dev, &idx))
+ return;
index = fsl_dcu_drm_plane_index(plane);
if (index < 0)
- return;
+ goto out;
regmap_read(fsl_dev->regmap, DCU_CTRLDESCLN(index, 4), &value);
value &= ~DCU_LAYER_EN;
regmap_write(fsl_dev->regmap, DCU_CTRLDESCLN(index, 4), value);
+
+out:
+ drm_dev_exit(idx);
}
static void fsl_dcu_drm_plane_atomic_update(struct drm_plane *plane,
@@ -86,14 +93,17 @@ static void fsl_dcu_drm_plane_atomic_update(struct drm_plane *plane,
struct drm_framebuffer *fb = plane->state->fb;
struct drm_gem_dma_object *gem;
unsigned int alpha = DCU_LAYER_AB_NONE, bpp;
- int index;
+ int index, idx;
- if (!fb)
+ if (!drm_dev_enter(plane->dev, &idx))
return;
+ if (!fb)
+ goto out;
+
index = fsl_dcu_drm_plane_index(plane);
if (index < 0)
- return;
+ goto out;
gem = drm_fb_dma_get_gem_obj(fb, 0);
@@ -126,7 +136,7 @@ static void fsl_dcu_drm_plane_atomic_update(struct drm_plane *plane,
bpp = FSL_DCU_YUV422;
break;
default:
- return;
+ goto out;
}
regmap_write(fsl_dev->regmap, DCU_CTRLDESCLN(index, 1),
@@ -162,6 +172,8 @@ static void fsl_dcu_drm_plane_atomic_update(struct drm_plane *plane,
DCU_LAYER_PRE_SKIP(0));
}
+out:
+ drm_dev_exit(idx);
return;
}
--
2.37.3
Use drm managed resource allocation (drmm_universal_plane_alloc()) in
order to get rid of the explicit destroy hook in struct drm_plane_funcs.
Signed-off-by: Danilo Krummrich <[email protected]>
---
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c | 4 ++--
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c | 25 ++++++++-------------
2 files changed, 11 insertions(+), 18 deletions(-)
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
index 0b70624260fc..1dad90f701c8 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
@@ -176,8 +176,8 @@ int fsl_dcu_drm_crtc_create(struct fsl_dcu_drm_device *fsl_dev)
fsl_dcu_drm_init_planes(drm);
primary = fsl_dcu_drm_primary_create_plane(drm);
- if (!primary)
- return -ENOMEM;
+ if (IS_ERR(primary))
+ return PTR_ERR(primary);
ret = drmm_crtc_init_with_planes(drm, crtc, primary, NULL,
&fsl_dcu_drm_crtc_funcs, NULL);
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
index 91865956da02..23ff285da477 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
@@ -174,7 +174,6 @@ static const struct drm_plane_helper_funcs fsl_dcu_drm_plane_helper_funcs = {
static const struct drm_plane_funcs fsl_dcu_drm_plane_funcs = {
.atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state,
.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
- .destroy = drm_plane_helper_destroy,
.disable_plane = drm_atomic_helper_disable_plane,
.reset = drm_atomic_helper_plane_reset,
.update_plane = drm_atomic_helper_update_plane,
@@ -206,24 +205,18 @@ void fsl_dcu_drm_init_planes(struct drm_device *dev)
struct drm_plane *fsl_dcu_drm_primary_create_plane(struct drm_device *dev)
{
struct drm_plane *primary;
- int ret;
-
- primary = kzalloc(sizeof(*primary), GFP_KERNEL);
- if (!primary) {
- DRM_DEBUG_KMS("Failed to allocate primary plane\n");
- return NULL;
- }
/* possible_crtc's will be filled in later by crtc_init */
- ret = drm_universal_plane_init(dev, primary, 0,
- &fsl_dcu_drm_plane_funcs,
- fsl_dcu_drm_plane_formats,
- ARRAY_SIZE(fsl_dcu_drm_plane_formats),
- NULL, DRM_PLANE_TYPE_PRIMARY, NULL);
- if (ret) {
- kfree(primary);
- primary = NULL;
+ primary = drmm_universal_plane_alloc(dev, struct drm_plane, dev, 0,
+ &fsl_dcu_drm_plane_funcs,
+ fsl_dcu_drm_plane_formats,
+ ARRAY_SIZE(fsl_dcu_drm_plane_formats),
+ NULL, DRM_PLANE_TYPE_PRIMARY, NULL);
+ if (IS_ERR(primary)) {
+ DRM_DEBUG_KMS("Failed to create primary plane\n");
+ return primary;
}
+
drm_plane_helper_add(primary, &fsl_dcu_drm_plane_helper_funcs);
return primary;
--
2.37.3
(Hardware) resources which are bound to the driver and device lifecycle
must not be accessed after the device and driver are unbound.
However, the DRM device isn't freed as long as the last user didn't
close it, hence userspace can still call into the driver.
Therefore protect the critical sections which are accessing those
resources with drm_dev_enter() and drm_dev_exit().
Signed-off-by: Danilo Krummrich <[email protected]>
---
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c | 37 ++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
index 1dad90f701c8..c77df9b7893f 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
@@ -13,6 +13,7 @@
#include <drm/drm_atomic.h>
#include <drm/drm_atomic_helper.h>
#include <drm/drm_crtc.h>
+#include <drm/drm_drv.h>
#include <drm/drm_probe_helper.h>
#include <drm/drm_vblank.h>
@@ -26,6 +27,10 @@ static void fsl_dcu_drm_crtc_atomic_flush(struct drm_crtc *crtc,
struct drm_device *dev = crtc->dev;
struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
struct drm_pending_vblank_event *event = crtc->state->event;
+ int idx;
+
+ if (!drm_dev_enter(dev, &idx))
+ return;
regmap_write(fsl_dev->regmap,
DCU_UPDATE_MODE, DCU_UPDATE_MODE_READREG);
@@ -40,6 +45,8 @@ static void fsl_dcu_drm_crtc_atomic_flush(struct drm_crtc *crtc,
drm_crtc_send_vblank_event(crtc, event);
spin_unlock_irq(&crtc->dev->event_lock);
}
+
+ drm_dev_exit(idx);
}
static void fsl_dcu_drm_crtc_atomic_disable(struct drm_crtc *crtc,
@@ -49,6 +56,10 @@ static void fsl_dcu_drm_crtc_atomic_disable(struct drm_crtc *crtc,
crtc);
struct drm_device *dev = crtc->dev;
struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
+ int idx;
+
+ if (!drm_dev_enter(dev, &idx))
+ return;
/* always disable planes on the CRTC */
drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, true);
@@ -61,6 +72,8 @@ static void fsl_dcu_drm_crtc_atomic_disable(struct drm_crtc *crtc,
regmap_write(fsl_dev->regmap, DCU_UPDATE_MODE,
DCU_UPDATE_MODE_READREG);
clk_disable_unprepare(fsl_dev->pix_clk);
+
+ drm_dev_exit(idx);
}
static void fsl_dcu_drm_crtc_atomic_enable(struct drm_crtc *crtc,
@@ -68,6 +81,10 @@ static void fsl_dcu_drm_crtc_atomic_enable(struct drm_crtc *crtc,
{
struct drm_device *dev = crtc->dev;
struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
+ int idx;
+
+ if (!drm_dev_enter(dev, &idx))
+ return;
clk_prepare_enable(fsl_dev->pix_clk);
regmap_update_bits(fsl_dev->regmap, DCU_DCU_MODE,
@@ -77,6 +94,8 @@ static void fsl_dcu_drm_crtc_atomic_enable(struct drm_crtc *crtc,
DCU_UPDATE_MODE_READREG);
drm_crtc_vblank_on(crtc);
+
+ drm_dev_exit(idx);
}
static void fsl_dcu_drm_crtc_mode_set_nofb(struct drm_crtc *crtc)
@@ -87,6 +106,10 @@ static void fsl_dcu_drm_crtc_mode_set_nofb(struct drm_crtc *crtc)
struct drm_display_mode *mode = &crtc->state->mode;
unsigned int pol = 0;
struct videomode vm;
+ int idx;
+
+ if (!drm_dev_enter(dev, &idx))
+ return;
clk_set_rate(fsl_dev->pix_clk, mode->clock * 1000);
@@ -122,6 +145,8 @@ static void fsl_dcu_drm_crtc_mode_set_nofb(struct drm_crtc *crtc)
DCU_THRESHOLD_LS_BF_VS(BF_VS_VAL) |
DCU_THRESHOLD_OUT_BUF_HIGH(BUF_MAX_VAL) |
DCU_THRESHOLD_OUT_BUF_LOW(BUF_MIN_VAL));
+
+ drm_dev_exit(idx);
return;
}
@@ -137,11 +162,17 @@ static int fsl_dcu_drm_crtc_enable_vblank(struct drm_crtc *crtc)
struct drm_device *dev = crtc->dev;
struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
unsigned int value;
+ int idx;
+
+ if (!drm_dev_enter(dev, &idx))
+ return -ENODEV;
regmap_read(fsl_dev->regmap, DCU_INT_MASK, &value);
value &= ~DCU_INT_MASK_VBLANK;
regmap_write(fsl_dev->regmap, DCU_INT_MASK, value);
+ drm_dev_exit(idx);
+
return 0;
}
@@ -150,10 +181,16 @@ static void fsl_dcu_drm_crtc_disable_vblank(struct drm_crtc *crtc)
struct drm_device *dev = crtc->dev;
struct fsl_dcu_drm_device *fsl_dev = drm_to_fsl_dcu_drm_dev(dev);
unsigned int value;
+ int idx;
+
+ if (!drm_dev_enter(dev, &idx))
+ return;
regmap_read(fsl_dev->regmap, DCU_INT_MASK, &value);
value |= DCU_INT_MASK_VBLANK;
regmap_write(fsl_dev->regmap, DCU_INT_MASK, value);
+
+ drm_dev_exit(idx);
}
static const struct drm_crtc_funcs fsl_dcu_drm_crtc_funcs = {
--
2.37.3
Use drmm_crtc_init_with_planes() instead of drm_crtc_init_with_planes()
to get rid of the explicit destroy hook in struct drm_plane_funcs.
Signed-off-by: Danilo Krummrich <[email protected]>
---
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
index e05311e2b0e0..0b70624260fc 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
@@ -159,7 +159,6 @@ static void fsl_dcu_drm_crtc_disable_vblank(struct drm_crtc *crtc)
static const struct drm_crtc_funcs fsl_dcu_drm_crtc_funcs = {
.atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state,
.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
- .destroy = drm_crtc_cleanup,
.page_flip = drm_atomic_helper_page_flip,
.reset = drm_atomic_helper_crtc_reset,
.set_config = drm_atomic_helper_set_config,
@@ -180,8 +179,8 @@ int fsl_dcu_drm_crtc_create(struct fsl_dcu_drm_device *fsl_dev)
if (!primary)
return -ENOMEM;
- ret = drm_crtc_init_with_planes(drm, crtc, primary, NULL,
- &fsl_dcu_drm_crtc_funcs, NULL);
+ ret = drmm_crtc_init_with_planes(drm, crtc, primary, NULL,
+ &fsl_dcu_drm_crtc_funcs, NULL);
if (ret) {
primary->funcs->destroy(primary);
return ret;
--
2.37.3