Scheduling the output_poll_work before calling bind_all to create the crtcs can race the fbdev initialization with the components initialization (i.e. crtc initialization). One side effect is that we may call drm_fbdev_cma_init with a zeroed num_crtc value, crashing the fbdev allocation.
I found this while auditing the code to remove the crtc_count parameter from drm_fbdev_cma_init. I don't have the hardware to actually test this change, so it'd be better covered if someone can give a try. Although, every other driver I checked did this on a later phase of initialization.
Signed-off-by: Gabriel Krisman Bertazi krisman@collabora.co.uk Cc: Benjamin Gaignard benjamin.gaignard@linaro.org Cc: Vincent Abriou vincent.abriou@st.com --- drivers/gpu/drm/sti/sti_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/sti/sti_drv.c b/drivers/gpu/drm/sti/sti_drv.c index d3db22488f96..516296010735 100644 --- a/drivers/gpu/drm/sti/sti_drv.c +++ b/drivers/gpu/drm/sti/sti_drv.c @@ -323,8 +323,6 @@ static int sti_init(struct drm_device *ddev)
sti_mode_config_init(ddev);
- drm_kms_helper_poll_init(ddev); - return 0; }
@@ -362,6 +360,8 @@ static int sti_bind(struct device *dev) if (ret) goto err_cleanup;
+ drm_kms_helper_poll_init(ddev); + ret = drm_dev_register(ddev, 0); if (ret) goto err_register;
Instead of receiving the num_crts as a parameter, we can read it directly from the mode_config structure. I audited the drivers that invoke this helper and I believe all of them (but one, see below) initialize the mode_config struct accordingly, prior to calling the fb_helper.
The auditing was done by visual inspection, and the only potential issue I identified was in STI, which should be prevented by the first patch in the series.
I used the following coccinelle hack to make this transformation, except for the function headers and comment updates. The first and second rules are split because I couldn't find a way to remove the unused temporary variables at the same time I removed the parameter.
// <smpl> @r@ expression A,B,D,E; identifier C; @@ ( - drm_fb_helper_init(A,B,C,D) + drm_fb_helper_init(A,B,D) | - drm_fbdev_cma_init_with_funcs(A,B,C,D,E) + drm_fbdev_cma_init_with_funcs(A,B,D,E) | - drm_fbdev_cma_init(A,B,C,D) + drm_fbdev_cma_init(A,B,D) )
@@ expression A,B,C,D,E; @@ ( - drm_fb_helper_init(A,B,C,D) + drm_fb_helper_init(A,B,D) | - drm_fbdev_cma_init_with_funcs(A,B,C,D,E) + drm_fbdev_cma_init_with_funcs(A,B,D,E) | - drm_fbdev_cma_init(A,B,C,D) + drm_fbdev_cma_init(A,B,D) )
@@ identifier r.C; type T; expression V; @@ - T C; <... when != p - C = V; ...> // </smpl>
Suggested-by: Daniel Vetter daniel.vetter@intel.com Signed-off-by: Gabriel Krisman Bertazi krisman@collabora.co.uk --- drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 1 - drivers/gpu/drm/arc/arcpgu_drv.c | 3 +-- drivers/gpu/drm/arm/hdlcd_drv.c | 2 +- drivers/gpu/drm/arm/malidp_drv.c | 2 +- drivers/gpu/drm/armada/armada_fbdev.c | 2 +- drivers/gpu/drm/ast/ast_fb.c | 3 +-- drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c | 3 +-- drivers/gpu/drm/bochs/bochs_fbdev.c | 3 +-- drivers/gpu/drm/cirrus/cirrus_fbdev.c | 2 +- drivers/gpu/drm/drm_fb_cma_helper.c | 15 +++++++-------- drivers/gpu/drm/drm_fb_helper.c | 10 +++++----- drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 5 +---- drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 2 +- drivers/gpu/drm/gma500/framebuffer.c | 2 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 3 +-- drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c | 3 +-- drivers/gpu/drm/i915/intel_fbdev.c | 3 +-- drivers/gpu/drm/imx/imx-drm-core.c | 3 +-- drivers/gpu/drm/meson/meson_drv.c | 1 - drivers/gpu/drm/mgag200/mgag200_fb.c | 2 +- drivers/gpu/drm/msm/msm_fbdev.c | 3 +-- drivers/gpu/drm/mxsfb/mxsfb_drv.c | 2 +- drivers/gpu/drm/nouveau/nouveau_fbcon.c | 3 +-- drivers/gpu/drm/omapdrm/omap_fbdev.c | 3 +-- drivers/gpu/drm/qxl/qxl_fb.c | 1 - drivers/gpu/drm/radeon/radeon_fb.c | 1 - drivers/gpu/drm/rcar-du/rcar_du_kms.c | 2 +- drivers/gpu/drm/rockchip/rockchip_drm_fbdev.c | 5 +---- drivers/gpu/drm/sti/sti_drv.c | 1 - drivers/gpu/drm/sun4i/sun4i_framebuffer.c | 4 +--- drivers/gpu/drm/tegra/fb.c | 2 +- drivers/gpu/drm/tilcdc/tilcdc_drv.c | 3 +-- drivers/gpu/drm/udl/udl_fb.c | 3 +-- drivers/gpu/drm/vc4/vc4_kms.c | 1 - drivers/gpu/drm/virtio/virtgpu_fb.c | 1 - drivers/gpu/drm/zte/zx_drm_drv.c | 2 +- include/drm/drm_fb_cma_helper.h | 7 +++---- include/drm/drm_fb_helper.h | 3 +-- 38 files changed, 43 insertions(+), 74 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c index 838943d0962e..36ce3cac81ba 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c @@ -374,7 +374,6 @@ int amdgpu_fbdev_init(struct amdgpu_device *adev) &amdgpu_fb_helper_funcs);
ret = drm_fb_helper_init(adev->ddev, &rfbdev->helper, - adev->mode_info.num_crtc, AMDGPUFB_CONN_LIMIT); if (ret) { kfree(rfbdev); diff --git a/drivers/gpu/drm/arc/arcpgu_drv.c b/drivers/gpu/drm/arc/arcpgu_drv.c index 0b6eaa49a1db..8d8344ed655e 100644 --- a/drivers/gpu/drm/arc/arcpgu_drv.c +++ b/drivers/gpu/drm/arc/arcpgu_drv.c @@ -135,8 +135,7 @@ static int arcpgu_load(struct drm_device *drm) drm_kms_helper_poll_init(drm);
arcpgu->fbdev = drm_fbdev_cma_init(drm, 16, - drm->mode_config.num_crtc, - drm->mode_config.num_connector); + drm->mode_config.num_connector); if (IS_ERR(arcpgu->fbdev)) { ret = PTR_ERR(arcpgu->fbdev); arcpgu->fbdev = NULL; diff --git a/drivers/gpu/drm/arm/hdlcd_drv.c b/drivers/gpu/drm/arm/hdlcd_drv.c index a2e5b04cdee3..4ce4f970920b 100644 --- a/drivers/gpu/drm/arm/hdlcd_drv.c +++ b/drivers/gpu/drm/arm/hdlcd_drv.c @@ -349,7 +349,7 @@ static int hdlcd_drm_bind(struct device *dev) drm_mode_config_reset(drm); drm_kms_helper_poll_init(drm);
- hdlcd->fbdev = drm_fbdev_cma_init(drm, 32, drm->mode_config.num_crtc, + hdlcd->fbdev = drm_fbdev_cma_init(drm, 32, drm->mode_config.num_connector);
if (IS_ERR(hdlcd->fbdev)) { diff --git a/drivers/gpu/drm/arm/malidp_drv.c b/drivers/gpu/drm/arm/malidp_drv.c index 32f746e31379..b63682dd48e9 100644 --- a/drivers/gpu/drm/arm/malidp_drv.c +++ b/drivers/gpu/drm/arm/malidp_drv.c @@ -387,7 +387,7 @@ static int malidp_bind(struct device *dev)
drm_mode_config_reset(drm);
- malidp->fbdev = drm_fbdev_cma_init(drm, 32, drm->mode_config.num_crtc, + malidp->fbdev = drm_fbdev_cma_init(drm, 32, drm->mode_config.num_connector);
if (IS_ERR(malidp->fbdev)) { diff --git a/drivers/gpu/drm/armada/armada_fbdev.c b/drivers/gpu/drm/armada/armada_fbdev.c index 78335100cbc3..0233e1dc33e1 100644 --- a/drivers/gpu/drm/armada/armada_fbdev.c +++ b/drivers/gpu/drm/armada/armada_fbdev.c @@ -137,7 +137,7 @@ int armada_fbdev_init(struct drm_device *dev)
drm_fb_helper_prepare(dev, fbh, &armada_fb_helper_funcs);
- ret = drm_fb_helper_init(dev, fbh, 1, 1); + ret = drm_fb_helper_init(dev, fbh, 1); if (ret) { DRM_ERROR("failed to initialize drm fb helper\n"); goto err_fb_helper; diff --git a/drivers/gpu/drm/ast/ast_fb.c b/drivers/gpu/drm/ast/ast_fb.c index b085140fae95..5d0ffab411a8 100644 --- a/drivers/gpu/drm/ast/ast_fb.c +++ b/drivers/gpu/drm/ast/ast_fb.c @@ -315,8 +315,7 @@ int ast_fbdev_init(struct drm_device *dev)
drm_fb_helper_prepare(dev, &afbdev->helper, &ast_fb_helper_funcs);
- ret = drm_fb_helper_init(dev, &afbdev->helper, - 1, 1); + ret = drm_fb_helper_init(dev, &afbdev->helper, 1); if (ret) goto free;
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c index cbd0070265c9..35d44dbf9e06 100644 --- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c +++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c @@ -435,8 +435,7 @@ static void atmel_hlcdc_fb_output_poll_changed(struct drm_device *dev) drm_fbdev_cma_hotplug_event(dc->fbdev); } else { dc->fbdev = drm_fbdev_cma_init(dev, 24, - dev->mode_config.num_crtc, - dev->mode_config.num_connector); + dev->mode_config.num_connector); if (IS_ERR(dc->fbdev)) dc->fbdev = NULL; } diff --git a/drivers/gpu/drm/bochs/bochs_fbdev.c b/drivers/gpu/drm/bochs/bochs_fbdev.c index 0317c3df6a22..932a769637ef 100644 --- a/drivers/gpu/drm/bochs/bochs_fbdev.c +++ b/drivers/gpu/drm/bochs/bochs_fbdev.c @@ -169,8 +169,7 @@ int bochs_fbdev_init(struct bochs_device *bochs) drm_fb_helper_prepare(bochs->dev, &bochs->fb.helper, &bochs_fb_helper_funcs);
- ret = drm_fb_helper_init(bochs->dev, &bochs->fb.helper, - 1, 1); + ret = drm_fb_helper_init(bochs->dev, &bochs->fb.helper, 1); if (ret) return ret;
diff --git a/drivers/gpu/drm/cirrus/cirrus_fbdev.c b/drivers/gpu/drm/cirrus/cirrus_fbdev.c index 79a5cd108245..4cc679278182 100644 --- a/drivers/gpu/drm/cirrus/cirrus_fbdev.c +++ b/drivers/gpu/drm/cirrus/cirrus_fbdev.c @@ -289,7 +289,7 @@ int cirrus_fbdev_init(struct cirrus_device *cdev) &cirrus_fb_helper_funcs);
ret = drm_fb_helper_init(cdev->dev, &gfbdev->helper, - cdev->num_crtc, CIRRUSFB_CONN_LIMIT); + CIRRUSFB_CONN_LIMIT); if (ret) return ret;
diff --git a/drivers/gpu/drm/drm_fb_cma_helper.c b/drivers/gpu/drm/drm_fb_cma_helper.c index 0ef8b284a4b8..596fabf18c3e 100644 --- a/drivers/gpu/drm/drm_fb_cma_helper.c +++ b/drivers/gpu/drm/drm_fb_cma_helper.c @@ -489,15 +489,14 @@ static const struct drm_fb_helper_funcs drm_fb_cma_helper_funcs = { * drm_fbdev_cma_init_with_funcs() - Allocate and initializes a drm_fbdev_cma struct * @dev: DRM device * @preferred_bpp: Preferred bits per pixel for the device - * @num_crtc: Number of CRTCs * @max_conn_count: Maximum number of connectors * @funcs: fb helper functions, in particular a custom dirty() callback * * Returns a newly allocated drm_fbdev_cma struct or a ERR_PTR. */ struct drm_fbdev_cma *drm_fbdev_cma_init_with_funcs(struct drm_device *dev, - unsigned int preferred_bpp, unsigned int num_crtc, - unsigned int max_conn_count, const struct drm_framebuffer_funcs *funcs) + unsigned int preferred_bpp, unsigned int max_conn_count, + const struct drm_framebuffer_funcs *funcs) { struct drm_fbdev_cma *fbdev_cma; struct drm_fb_helper *helper; @@ -514,7 +513,7 @@ struct drm_fbdev_cma *drm_fbdev_cma_init_with_funcs(struct drm_device *dev,
drm_fb_helper_prepare(dev, helper, &drm_fb_cma_helper_funcs);
- ret = drm_fb_helper_init(dev, helper, num_crtc, max_conn_count); + ret = drm_fb_helper_init(dev, helper, max_conn_count); if (ret < 0) { dev_err(dev->dev, "Failed to initialize drm fb helper.\n"); goto err_free; @@ -554,11 +553,11 @@ EXPORT_SYMBOL_GPL(drm_fbdev_cma_init_with_funcs); * Returns a newly allocated drm_fbdev_cma struct or a ERR_PTR. */ struct drm_fbdev_cma *drm_fbdev_cma_init(struct drm_device *dev, - unsigned int preferred_bpp, unsigned int num_crtc, - unsigned int max_conn_count) + unsigned int preferred_bpp, unsigned int max_conn_count) { - return drm_fbdev_cma_init_with_funcs(dev, preferred_bpp, num_crtc, - max_conn_count, &drm_fb_cma_funcs); + return drm_fbdev_cma_init_with_funcs(dev, preferred_bpp, + max_conn_count, + &drm_fb_cma_funcs); } EXPORT_SYMBOL_GPL(drm_fbdev_cma_init);
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c index c7fafa175755..a30c645035de 100644 --- a/drivers/gpu/drm/drm_fb_helper.c +++ b/drivers/gpu/drm/drm_fb_helper.c @@ -712,7 +712,6 @@ EXPORT_SYMBOL(drm_fb_helper_prepare); * drm_fb_helper_init - initialize a drm_fb_helper structure * @dev: drm device * @fb_helper: driver-allocated fbdev helper structure to initialize - * @crtc_count: maximum number of crtcs to support in this fbdev emulation * @max_conn_count: max connector count * * This allocates the structures for the fbdev helper with the given limits. @@ -727,9 +726,10 @@ EXPORT_SYMBOL(drm_fb_helper_prepare); */ int drm_fb_helper_init(struct drm_device *dev, struct drm_fb_helper *fb_helper, - int crtc_count, int max_conn_count) + int max_conn_count) { struct drm_crtc *crtc; + struct drm_mode_config *config = &dev->mode_config; int i;
if (!drm_fbdev_emulation) @@ -738,11 +738,11 @@ int drm_fb_helper_init(struct drm_device *dev, if (!max_conn_count) return -EINVAL;
- fb_helper->crtc_info = kcalloc(crtc_count, sizeof(struct drm_fb_helper_crtc), GFP_KERNEL); + fb_helper->crtc_info = kcalloc(config->num_crtc, sizeof(struct drm_fb_helper_crtc), GFP_KERNEL); if (!fb_helper->crtc_info) return -ENOMEM;
- fb_helper->crtc_count = crtc_count; + fb_helper->crtc_count = config->num_crtc; fb_helper->connector_info = kcalloc(dev->mode_config.num_connector, sizeof(struct drm_fb_helper_connector *), GFP_KERNEL); if (!fb_helper->connector_info) { kfree(fb_helper->crtc_info); @@ -751,7 +751,7 @@ int drm_fb_helper_init(struct drm_device *dev, fb_helper->connector_info_alloc_count = dev->mode_config.num_connector; fb_helper->connector_count = 0;
- for (i = 0; i < crtc_count; i++) { + for (i = 0; i < fb_helper->crtc_count; i++) { fb_helper->crtc_info[i].mode_set.connectors = kcalloc(max_conn_count, sizeof(struct drm_connector *), diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c index d8808158d418..f33315c1d86d 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c +++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c @@ -208,7 +208,6 @@ int exynos_drm_fbdev_init(struct drm_device *dev) struct exynos_drm_fbdev *fbdev; struct exynos_drm_private *private = dev->dev_private; struct drm_fb_helper *helper; - unsigned int num_crtc; int ret;
if (!dev->mode_config.num_crtc || !dev->mode_config.num_connector) @@ -225,9 +224,7 @@ int exynos_drm_fbdev_init(struct drm_device *dev)
drm_fb_helper_prepare(dev, helper, &exynos_drm_fb_helper_funcs);
- num_crtc = dev->mode_config.num_crtc; - - ret = drm_fb_helper_init(dev, helper, num_crtc, MAX_CONNECTOR); + ret = drm_fb_helper_init(dev, helper, MAX_CONNECTOR); if (ret < 0) { DRM_ERROR("failed to initialize drm fb helper.\n"); goto err_init; diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c index 48705248f894..04173235f448 100644 --- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c @@ -94,7 +94,7 @@ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags) "Invalid legacyfb_depth. Defaulting to 24bpp\n"); legacyfb_depth = 24; } - fsl_dev->fbdev = drm_fbdev_cma_init(dev, legacyfb_depth, 1, 1); + fsl_dev->fbdev = drm_fbdev_cma_init(dev, legacyfb_depth, 1); if (IS_ERR(fsl_dev->fbdev)) { ret = PTR_ERR(fsl_dev->fbdev); fsl_dev->fbdev = NULL; diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c index fd1488bf5189..da42d2e1d397 100644 --- a/drivers/gpu/drm/gma500/framebuffer.c +++ b/drivers/gpu/drm/gma500/framebuffer.c @@ -564,7 +564,7 @@ int psb_fbdev_init(struct drm_device *dev) drm_fb_helper_prepare(dev, &fbdev->psb_fb_helper, &psb_fb_helper_funcs);
ret = drm_fb_helper_init(dev, &fbdev->psb_fb_helper, - dev_priv->ops->crtcs, INTELFB_CONN_LIMIT); + INTELFB_CONN_LIMIT); if (ret) goto free;
diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c index 16fe79053ee1..d7a4d9095b33 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c @@ -200,8 +200,7 @@ int hibmc_fbdev_init(struct hibmc_drm_private *priv) &hibmc_fbdev_helper_funcs);
/* Now just one crtc and one channel */ - ret = drm_fb_helper_init(priv->dev, - &hifbdev->helper, 1, 1); + ret = drm_fb_helper_init(priv->dev, &hifbdev->helper, 1); if (ret) { DRM_ERROR("failed to initialize fb helper: %d\n", ret); return ret; diff --git a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c index 7df0e8535e41..7ec93aec7e88 100644 --- a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c +++ b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c @@ -59,8 +59,7 @@ static void kirin_fbdev_output_poll_changed(struct drm_device *dev) drm_fbdev_cma_hotplug_event(priv->fbdev); } else { priv->fbdev = drm_fbdev_cma_init(dev, 32, - dev->mode_config.num_crtc, - dev->mode_config.num_connector); + dev->mode_config.num_connector); if (IS_ERR(priv->fbdev)) priv->fbdev = NULL; } diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c index bdefa61f2e60..ea9f5a02682a 100644 --- a/drivers/gpu/drm/i915/intel_fbdev.c +++ b/drivers/gpu/drm/i915/intel_fbdev.c @@ -713,8 +713,7 @@ int intel_fbdev_init(struct drm_device *dev) if (!intel_fbdev_init_bios(dev, ifbdev)) ifbdev->preferred_bpp = 32;
- ret = drm_fb_helper_init(dev, &ifbdev->helper, - INTEL_INFO(dev_priv)->num_pipes, 4); + ret = drm_fb_helper_init(dev, &ifbdev->helper, 4); if (ret) { kfree(ifbdev); return ret; diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c index 33404295b447..5ae48836652e 100644 --- a/drivers/gpu/drm/imx/imx-drm-core.c +++ b/drivers/gpu/drm/imx/imx-drm-core.c @@ -389,8 +389,7 @@ static int imx_drm_bind(struct device *dev) dev_warn(dev, "Invalid legacyfb_depth. Defaulting to 16bpp\n"); legacyfb_depth = 16; } - imxdrm->fbhelper = drm_fbdev_cma_init(drm, legacyfb_depth, - drm->mode_config.num_crtc, MAX_CRTC); + imxdrm->fbhelper = drm_fbdev_cma_init(drm, legacyfb_depth, MAX_CRTC); if (IS_ERR(imxdrm->fbhelper)) { ret = PTR_ERR(imxdrm->fbhelper); imxdrm->fbhelper = NULL; diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c index ff1f6019b97b..644d4c14dd40 100644 --- a/drivers/gpu/drm/meson/meson_drv.c +++ b/drivers/gpu/drm/meson/meson_drv.c @@ -279,7 +279,6 @@ static int meson_drv_probe(struct platform_device *pdev) drm->mode_config.funcs = &meson_mode_config_funcs;
priv->fbdev = drm_fbdev_cma_init(drm, 32, - drm->mode_config.num_crtc, drm->mode_config.num_connector); if (IS_ERR(priv->fbdev)) { ret = PTR_ERR(priv->fbdev); diff --git a/drivers/gpu/drm/mgag200/mgag200_fb.c b/drivers/gpu/drm/mgag200/mgag200_fb.c index 1a665e1671b8..a449bb91213a 100644 --- a/drivers/gpu/drm/mgag200/mgag200_fb.c +++ b/drivers/gpu/drm/mgag200/mgag200_fb.c @@ -286,7 +286,7 @@ int mgag200_fbdev_init(struct mga_device *mdev) drm_fb_helper_prepare(mdev->dev, &mfbdev->helper, &mga_fb_helper_funcs);
ret = drm_fb_helper_init(mdev->dev, &mfbdev->helper, - mdev->num_crtc, MGAG200FB_CONN_LIMIT); + MGAG200FB_CONN_LIMIT); if (ret) goto err_fb_helper;
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c index f8a587eac6b8..6b1b375653f7 100644 --- a/drivers/gpu/drm/msm/msm_fbdev.c +++ b/drivers/gpu/drm/msm/msm_fbdev.c @@ -201,8 +201,7 @@ struct drm_fb_helper *msm_fbdev_init(struct drm_device *dev)
drm_fb_helper_prepare(dev, helper, &msm_fb_helper_funcs);
- ret = drm_fb_helper_init(dev, helper, - priv->num_crtcs, priv->num_connectors); + ret = drm_fb_helper_init(dev, helper, priv->num_connectors); if (ret) { dev_err(dev->dev, "could not init fbdev: ret=%d\n", ret); goto fail; diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c index 955441f71500..cdfbe0284635 100644 --- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c +++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c @@ -218,7 +218,7 @@ static int mxsfb_load(struct drm_device *drm, unsigned long flags)
drm_kms_helper_poll_init(drm);
- mxsfb->fbdev = drm_fbdev_cma_init(drm, 32, drm->mode_config.num_crtc, + mxsfb->fbdev = drm_fbdev_cma_init(drm, 32, drm->mode_config.num_connector); if (IS_ERR(mxsfb->fbdev)) { mxsfb->fbdev = NULL; diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c index 9de6abb65781..971c147a3984 100644 --- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c +++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c @@ -507,8 +507,7 @@ nouveau_fbcon_init(struct drm_device *dev)
drm_fb_helper_prepare(dev, &fbcon->helper, &nouveau_fbcon_helper_funcs);
- ret = drm_fb_helper_init(dev, &fbcon->helper, - dev->mode_config.num_crtc, 4); + ret = drm_fb_helper_init(dev, &fbcon->helper, 4); if (ret) goto free;
diff --git a/drivers/gpu/drm/omapdrm/omap_fbdev.c b/drivers/gpu/drm/omapdrm/omap_fbdev.c index 2a839956dae6..942c4d483008 100644 --- a/drivers/gpu/drm/omapdrm/omap_fbdev.c +++ b/drivers/gpu/drm/omapdrm/omap_fbdev.c @@ -263,8 +263,7 @@ struct drm_fb_helper *omap_fbdev_init(struct drm_device *dev)
drm_fb_helper_prepare(dev, helper, &omap_fb_helper_funcs);
- ret = drm_fb_helper_init(dev, helper, - priv->num_crtcs, priv->num_connectors); + ret = drm_fb_helper_init(dev, helper, priv->num_connectors); if (ret) { dev_err(dev->dev, "could not init fbdev: ret=%d\n", ret); goto fail; diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c index 53edfa498af5..d479b7a7abe4 100644 --- a/drivers/gpu/drm/qxl/qxl_fb.c +++ b/drivers/gpu/drm/qxl/qxl_fb.c @@ -399,7 +399,6 @@ int qxl_fbdev_init(struct qxl_device *qdev) &qxl_fb_helper_funcs);
ret = drm_fb_helper_init(&qdev->ddev, &qfbdev->helper, - qxl_num_crtc, QXLFB_CONN_LIMIT); if (ret) goto free; diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c index 6c10a83f3362..2be4fe9c7217 100644 --- a/drivers/gpu/drm/radeon/radeon_fb.c +++ b/drivers/gpu/drm/radeon/radeon_fb.c @@ -366,7 +366,6 @@ int radeon_fbdev_init(struct radeon_device *rdev) &radeon_fb_helper_funcs);
ret = drm_fb_helper_init(rdev->ddev, &rfbdev->helper, - rdev->num_crtc, RADEONFB_CONN_LIMIT); if (ret) goto free; diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c index b5d3f16cfa12..ff61f6032f2c 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c +++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c @@ -662,7 +662,7 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu) drm_kms_helper_poll_init(dev);
if (dev->mode_config.num_connector) { - fbdev = drm_fbdev_cma_init(dev, 32, dev->mode_config.num_crtc, + fbdev = drm_fbdev_cma_init(dev, 32, dev->mode_config.num_connector); if (IS_ERR(fbdev)) return PTR_ERR(fbdev); diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_fbdev.c b/drivers/gpu/drm/rockchip/rockchip_drm_fbdev.c index 52d1fdf9f9da..70ad50dd594d 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_fbdev.c +++ b/drivers/gpu/drm/rockchip/rockchip_drm_fbdev.c @@ -129,19 +129,16 @@ int rockchip_drm_fbdev_init(struct drm_device *dev) { struct rockchip_drm_private *private = dev->dev_private; struct drm_fb_helper *helper; - unsigned int num_crtc; int ret;
if (!dev->mode_config.num_crtc || !dev->mode_config.num_connector) return -EINVAL;
- num_crtc = dev->mode_config.num_crtc; - helper = &private->fbdev_helper;
drm_fb_helper_prepare(dev, helper, &rockchip_drm_fb_helper_funcs);
- ret = drm_fb_helper_init(dev, helper, num_crtc, ROCKCHIP_MAX_CONNECTOR); + ret = drm_fb_helper_init(dev, helper, ROCKCHIP_MAX_CONNECTOR); if (ret < 0) { dev_err(dev->dev, "Failed to initialize drm fb helper - %d.\n", ret); diff --git a/drivers/gpu/drm/sti/sti_drv.c b/drivers/gpu/drm/sti/sti_drv.c index 516296010735..1cd5174a744f 100644 --- a/drivers/gpu/drm/sti/sti_drv.c +++ b/drivers/gpu/drm/sti/sti_drv.c @@ -226,7 +226,6 @@ static void sti_output_poll_changed(struct drm_device *ddev) }
private->fbdev = drm_fbdev_cma_init(ddev, 32, - ddev->mode_config.num_crtc, ddev->mode_config.num_connector); if (IS_ERR(private->fbdev)) private->fbdev = NULL; diff --git a/drivers/gpu/drm/sun4i/sun4i_framebuffer.c b/drivers/gpu/drm/sun4i/sun4i_framebuffer.c index 8b6ce619ad81..2c3beff8b53e 100644 --- a/drivers/gpu/drm/sun4i/sun4i_framebuffer.c +++ b/drivers/gpu/drm/sun4i/sun4i_framebuffer.c @@ -40,9 +40,7 @@ struct drm_fbdev_cma *sun4i_framebuffer_init(struct drm_device *drm)
drm->mode_config.funcs = &sun4i_de_mode_config_funcs;
- return drm_fbdev_cma_init(drm, 32, - drm->mode_config.num_crtc, - drm->mode_config.num_connector); + return drm_fbdev_cma_init(drm, 32, drm->mode_config.num_connector); }
void sun4i_framebuffer_free(struct drm_device *drm) diff --git a/drivers/gpu/drm/tegra/fb.c b/drivers/gpu/drm/tegra/fb.c index f896e2ff7d47..f142f6a4db25 100644 --- a/drivers/gpu/drm/tegra/fb.c +++ b/drivers/gpu/drm/tegra/fb.c @@ -309,7 +309,7 @@ static int tegra_fbdev_init(struct tegra_fbdev *fbdev, struct drm_device *drm = fbdev->base.dev; int err;
- err = drm_fb_helper_init(drm, &fbdev->base, num_crtc, max_connectors); + err = drm_fb_helper_init(drm, &fbdev->base, max_connectors); if (err < 0) { dev_err(drm->dev, "failed to initialize DRM FB helper: %d\n", err); diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c index 919294a735fe..372d86fbb093 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c @@ -403,8 +403,7 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev) drm_mode_config_reset(ddev);
priv->fbdev = drm_fbdev_cma_init(ddev, bpp, - ddev->mode_config.num_crtc, - ddev->mode_config.num_connector); + ddev->mode_config.num_connector); if (IS_ERR(priv->fbdev)) { ret = PTR_ERR(priv->fbdev); goto init_failed; diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c index b8dc06d68777..8e8d60e9a1a2 100644 --- a/drivers/gpu/drm/udl/udl_fb.c +++ b/drivers/gpu/drm/udl/udl_fb.c @@ -441,8 +441,7 @@ int udl_fbdev_init(struct drm_device *dev)
drm_fb_helper_prepare(dev, &ufbdev->helper, &udl_fb_helper_funcs);
- ret = drm_fb_helper_init(dev, &ufbdev->helper, - 1, 1); + ret = drm_fb_helper_init(dev, &ufbdev->helper, 1); if (ret) goto free;
diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c index be8dd8262f27..ad7925a9e0ea 100644 --- a/drivers/gpu/drm/vc4/vc4_kms.c +++ b/drivers/gpu/drm/vc4/vc4_kms.c @@ -231,7 +231,6 @@ int vc4_kms_load(struct drm_device *dev) drm_mode_config_reset(dev);
vc4->fbdev = drm_fbdev_cma_init(dev, 32, - dev->mode_config.num_crtc, dev->mode_config.num_connector); if (IS_ERR(vc4->fbdev)) vc4->fbdev = NULL; diff --git a/drivers/gpu/drm/virtio/virtgpu_fb.c b/drivers/gpu/drm/virtio/virtgpu_fb.c index 61254b991265..1c9065499845 100644 --- a/drivers/gpu/drm/virtio/virtgpu_fb.c +++ b/drivers/gpu/drm/virtio/virtgpu_fb.c @@ -387,7 +387,6 @@ int virtio_gpu_fbdev_init(struct virtio_gpu_device *vgdev) drm_fb_helper_prepare(vgdev->ddev, &vgfbdev->helper, &virtio_gpu_fb_helper_funcs); ret = drm_fb_helper_init(vgdev->ddev, &vgfbdev->helper, - vgdev->num_scanouts, VIRTIO_GPUFB_CONN_LIMIT); if (ret) { kfree(vgfbdev); diff --git a/drivers/gpu/drm/zte/zx_drm_drv.c b/drivers/gpu/drm/zte/zx_drm_drv.c index 3e76f72c92ff..e656a2c6d2ee 100644 --- a/drivers/gpu/drm/zte/zx_drm_drv.c +++ b/drivers/gpu/drm/zte/zx_drm_drv.c @@ -141,7 +141,7 @@ static int zx_drm_bind(struct device *dev) drm_mode_config_reset(drm); drm_kms_helper_poll_init(drm);
- priv->fbdev = drm_fbdev_cma_init(drm, 32, drm->mode_config.num_crtc, + priv->fbdev = drm_fbdev_cma_init(drm, 32, drm->mode_config.num_connector); if (IS_ERR(priv->fbdev)) { ret = PTR_ERR(priv->fbdev); diff --git a/include/drm/drm_fb_cma_helper.h b/include/drm/drm_fb_cma_helper.h index 8dd6e5585e51..a5ecc0a58260 100644 --- a/include/drm/drm_fb_cma_helper.h +++ b/include/drm/drm_fb_cma_helper.h @@ -16,11 +16,10 @@ struct drm_plane; struct drm_plane_state;
struct drm_fbdev_cma *drm_fbdev_cma_init_with_funcs(struct drm_device *dev, - unsigned int preferred_bpp, unsigned int num_crtc, - unsigned int max_conn_count, const struct drm_framebuffer_funcs *funcs); + unsigned int preferred_bpp, unsigned int max_conn_count, + const struct drm_framebuffer_funcs *funcs); struct drm_fbdev_cma *drm_fbdev_cma_init(struct drm_device *dev, - unsigned int preferred_bpp, unsigned int num_crtc, - unsigned int max_conn_count); + unsigned int preferred_bpp, unsigned int max_conn_count); void drm_fbdev_cma_fini(struct drm_fbdev_cma *fbdev_cma);
void drm_fbdev_cma_restore_mode(struct drm_fbdev_cma *fbdev_cma); diff --git a/include/drm/drm_fb_helper.h b/include/drm/drm_fb_helper.h index e62e1cf22678..278820ee17ad 100644 --- a/include/drm/drm_fb_helper.h +++ b/include/drm/drm_fb_helper.h @@ -236,8 +236,7 @@ struct drm_fb_helper { void drm_fb_helper_prepare(struct drm_device *dev, struct drm_fb_helper *helper, const struct drm_fb_helper_funcs *funcs); int drm_fb_helper_init(struct drm_device *dev, - struct drm_fb_helper *helper, int crtc_count, - int max_conn); + struct drm_fb_helper *helper, int max_conn); void drm_fb_helper_fini(struct drm_fb_helper *helper); int drm_fb_helper_blank(int blank, struct fb_info *info); int drm_fb_helper_pan_display(struct fb_var_screeninfo *var,
Gabriel Krisman Bertazi krisman@collabora.co.uk writes:
Instead of receiving the num_crts as a parameter, we can read it directly from the mode_config structure. I audited the drivers that invoke this helper and I believe all of them (but one, see below) initialize the mode_config struct accordingly, prior to calling the fb_helper.
This is a nice cleanup! It always felt silly to be passing in my mode_config's members to the fbdev setup. Could we do the same for num_connector?
I've verified that all the drivers either init their CRTCs or have already looked at mode_config.num_crtcs before the fbdev init call, so this is:
Reviewed-by: Eric Anholt eric@anholt.net
On Wed, Feb 01, 2017 at 12:50:48PM -0800, Eric Anholt wrote:
Gabriel Krisman Bertazi krisman@collabora.co.uk writes:
Instead of receiving the num_crts as a parameter, we can read it directly from the mode_config structure. I audited the drivers that invoke this helper and I believe all of them (but one, see below) initialize the mode_config struct accordingly, prior to calling the fb_helper.
This is a nice cleanup! It always felt silly to be passing in my mode_config's members to the fbdev setup. Could we do the same for num_connector?
I've verified that all the drivers either init their CRTCs or have already looked at mode_config.num_crtcs before the fbdev init call, so this is:
Reviewed-by: Eric Anholt eric@anholt.net
Yeah, nice patch but doesn't apply now that Dave has pulled in a bunch of driver pull requests :( Can you pls regen the cocci, but pls keep Eric's r-b so I don't have to go hunting for it.
Thanks, Daniel
Gabriel Krisman Bertazi krisman@collabora.co.uk writes:
Scheduling the output_poll_work before calling bind_all to create the crtcs can race the fbdev initialization with the components initialization (i.e. crtc initialization). One side effect is that we may call drm_fbdev_cma_init with a zeroed num_crtc value, crashing the fbdev allocation.
This is no longer true after
8953e9ee0ce5 ("drm/sti: create fbdev at binding") # drm-misc-next.
That commit moved the fbdev initialization out of the output_poll_work, forcing it to happen after creating crtcs, so this patch is no longer necessary. I'll resend a v2 of the series without it.
dri-devel@lists.freedesktop.org
-
Daniel Vetter -
Eric Anholt -
Gabriel Krisman Bertazi