From: Liu Ying <Ying.Liu@freescale.com>
To: <dri-devel@lists.freedesktop.org>
CC: <linux-kernel@vger.kernel.org>, <p.zabel@pengutronix.de>,
        <airlied@linux.ie>
Subject: [PATCH 2/2] drm/imx: Remove the primary plane created by create_primary_plane()
Date: Wed, 4 Nov 2015 18:15:58 +0800
Message-ID: <1446632158-19998-2-git-send-email-Ying.Liu@freescale.com>
In-Reply-To: <1446632158-19998-1-git-send-email-Ying.Liu@freescale.com>
References: <1446632158-19998-1-git-send-email-Ying.Liu@freescale.com>
MIME-Version: 1.0
Content-Type: text/plain
SpamDiagnosticOutput: 1:23
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Nov 2015 10:10:30.4642
 (UTC)
X-MS-Exchange-CrossTenant-Id: 710a03f5-10f6-4d38-9ff4-a80b81da590d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=710a03f5-10f6-4d38-9ff4-a80b81da590d;Ip=[192.88.168.50];Helo=[tx30smr01.am.freescale.net]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR03MB1462
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 2769
Lines: 69

Since we are using ipu_plane_init() to add one primary plane for each
IPU CRTC, it's unnecessary to create the safe one by using the helper
create_primary_plane().

Furthermore, the safe one is attached to crtc->primary, which actually
carries a framebuffer(crtc->primary->fb) created by the fbdev helper to
build up the fbcon.  Instead, the one created by ipu_plane_init() is
dangling, but it is the one actually does ipu_plane_mode_set() for the
fbcon.  This may causes the mismatch bewteen ipu_plane->enabled(true) and
ipu_plane->base.fb(NULL).  Thus, it brings a NULL pointer dereference
issue in ipu_plane_mode_set() when we try to additionally touch the
IDMAC channel of the ipu_plane.  This issue could be reproduced by
running the drm modetest with command line 'modetest -P 19:1024x768@XR24'
on the i.MX6Q SabreSD platform(single LVDS display).  This patch binds
the plane created by ipu_plane_init() with crtc->primary and removes the
safe one to address this issue.

Signed-off-by: Liu Ying <Ying.Liu@freescale.com>
---
 drivers/gpu/drm/imx/imx-drm-core.c | 3 ++-
 drivers/gpu/drm/imx/ipuv3-crtc.c   | 6 ++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c
index 6faa735..08eceeb 100644
--- a/drivers/gpu/drm/imx/imx-drm-core.c
+++ b/drivers/gpu/drm/imx/imx-drm-core.c
@@ -373,7 +373,8 @@ int imx_drm_add_crtc(struct drm_device *drm, struct drm_crtc *crtc,
 	drm_crtc_helper_add(crtc,
 			imx_drm_crtc->imx_drm_helper_funcs.crtc_helper_funcs);
 
-	drm_crtc_init(drm, crtc,
+	/* The related primary plane will be created in ipu_plane_init(). */
+	drm_crtc_init_with_planes(drm, crtc, NULL, NULL,
 			imx_drm_crtc->imx_drm_helper_funcs.crtc_funcs);
 
 	return 0;
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index 8d68697..d27143f 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -343,6 +343,11 @@ err_out:
 	return ret;
 }
 
+static inline void ipu_crtc_set_primary_plane(struct ipu_crtc *ipu_crtc)
+{
+	ipu_crtc->base.primary = &ipu_crtc->plane[0]->base;
+}
+
 static int ipu_crtc_init(struct ipu_crtc *ipu_crtc,
 	struct ipu_client_platformdata *pdata, struct drm_device *drm)
 {
@@ -380,6 +385,7 @@ static int ipu_crtc_init(struct ipu_crtc *ipu_crtc,
 			ret);
 		goto err_remove_crtc;
 	}
+	ipu_crtc_set_primary_plane(ipu_crtc);
 
 	/* If this crtc is using the DP, add an overlay plane */
 	if (pdata->dp >= 0 && pdata->dma[1] > 0) {
-- 
2.5.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/