We have lots of these. And the cleanup code tends to be of dubious quality. The biggest wrong pattern is that developers use devm_, which ties the release action to the underlying struct device, whereas all the userspace visible stuff attached to a drm_device can long outlive that one (e.g. after a hotunplug while userspace has open files and mmap'ed buffers). Give people what they want, but with more correctness.

Mostly copied from devres.c, with types adjusted to fit drm_device and a few simplifications - I didn't (yet) copy over everything. Since the types don't match code sharing looked like a hopeless endeavour.

For now it's only super simplified, no groups, you can't remove actions (but kfree exists, we'll need that soon). Plus all specific to drm_device ofc, including the logging. Which I didn't bother to make compile-time optional, since none of the other drm logging is compile time optional either.

One tricky bit here is the chicken&egg between allocating your drm_device structure and initiliazing it with drm_dev_init. For perfect onion unwinding we'd need to have the action to kfree the allocation registered before drm_dev_init registers any of its own release handlers. But drm_dev_init doesn't know where exactly the drm_device is emebedded into the overall structure, and by the time it returns it'll all be too late. And forcing drivers to be able clean up everything except the one kzalloc is silly.

Work around this by having a very special final_kfree pointer. This also avoids troubles with the list head possibly disappearing from underneath us when we release all resources attached to the drm_device.

v2: Do all the kerneldoc at the end, to avoid lots of fairly pointless shuffling while getting everything into shape.

v3: Add static to add/del_dr (Neil) Move typo fix to the right patch (Neil)

v4: Enforce contract for drmm_add_final_kfree:

Use ksize() to check that the drm_device is indeed contained somewhere in the final kfree(). Because we need that or the entire managed release logic blows up in a pile of use-after-frees. Motivated by a discussion with Laurent.

v5: Review from Laurent: - %zu instead of casting size_t - header guards - sorting of includes - guarding of data assignment if we didn't allocate it for a NULL pointer - delete spurious newline - cast void* data parameter correctly in ->release call, no idea how this even worked before

v3: Review from Sam - Add the kerneldoc for the managed sub-struct back in, even if it doesn't show up in the generated html somehow. - Explain why __always_inline. - Fix bisectability around the final kfree() in drm_dev_relase(). This is just interim code which will disappear again. - Some whitespace polish. - Add debug output when drmm_add_action or drmm_kmalloc fail.

v4: My bisectability fix wasn't up to par as noticed by smatch.

v5: Remove unecessary {} around if else

v6: Use kstrdup_const, which requires kfree_const and introducing a free_dr() helper (Thomas).

Cc: Thomas Zimmermann tzimmermann@suse.de Cc: Dan Carpenter dan.carpenter@oracle.com Cc: Sam Ravnborg sam@ravnborg.org Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Cc: Neil Armstrong <narmstrong@baylibre.com Cc: Greg Kroah-Hartman gregkh@linuxfoundation.org Cc: "Rafael J. Wysocki" rafael@kernel.org Signed-off-by: Daniel Vetter daniel.vetter@intel.com --- Documentation/gpu/drm-internals.rst | 6 + drivers/gpu/drm/Makefile | 3 +- drivers/gpu/drm/drm_drv.c | 15 ++- drivers/gpu/drm/drm_internal.h | 3 + drivers/gpu/drm/drm_managed.c | 193 ++++++++++++++++++++++++++++ include/drm/drm_device.h | 15 +++ include/drm/drm_managed.h | 30 +++++ include/drm/drm_print.h | 6 + 8 files changed, 267 insertions(+), 4 deletions(-) create mode 100644 drivers/gpu/drm/drm_managed.c create mode 100644 include/drm/drm_managed.h

diff --git a/Documentation/gpu/drm-internals.rst b/Documentation/gpu/drm-internals.rst index a73320576ca9..a6b6145fda78 100644 --- a/Documentation/gpu/drm-internals.rst +++ b/Documentation/gpu/drm-internals.rst @@ -132,6 +132,12 @@ be unmapped; on many devices, the ROM address decoder is shared with other BARs, so leaving it mapped could cause undesired behaviour like hangs or memory corruption.

+Managed Resources +----------------- + +.. kernel-doc:: drivers/gpu/drm/drm_managed.c + :doc: managed resources + Bus-specific Device Registration and PCI Support ------------------------------------------------

diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile index 7f72ef5e7811..183c60048307 100644 --- a/drivers/gpu/drm/Makefile +++ b/drivers/gpu/drm/Makefile @@ -17,7 +17,8 @@ drm-y := drm_auth.o drm_cache.o \ drm_plane.o drm_color_mgmt.o drm_print.o \ drm_dumb_buffers.o drm_mode_config.o drm_vblank.o \ drm_syncobj.o drm_lease.o drm_writeback.o drm_client.o \ - drm_client_modeset.o drm_atomic_uapi.o drm_hdcp.o + drm_client_modeset.o drm_atomic_uapi.o drm_hdcp.o \ + drm_managed.o

drm-$(CONFIG_DRM_LEGACY) += drm_legacy_misc.o drm_bufs.o drm_context.o drm_dma.o drm_scatter.o drm_lock.o drm-$(CONFIG_DRM_LIB_RANDOM) += lib/drm_random.o diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index b9fa8c67ee7d..1b9be23b93b0 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -629,6 +629,9 @@ int drm_dev_init(struct drm_device *dev, dev->dev = get_device(parent); dev->driver = driver;

+ INIT_LIST_HEAD(&dev->managed.resources); + spin_lock_init(&dev->managed.lock); + /* no per-device feature limits by default */ dev->driver_features = ~0u;

@@ -824,12 +827,18 @@ static void drm_dev_release(struct kref *ref) { struct drm_device *dev = container_of(ref, struct drm_device, ref);

- if (dev->driver->release) { + if (dev->driver->release) dev->driver->release(dev); - } else { + else drm_dev_fini(dev); + + drm_managed_release(dev); + + if (!dev->driver->release && !dev->managed.final_kfree) { + WARN_ON(!list_empty(&dev->managed.resources)); kfree(dev); - } + } else if (dev->managed.final_kfree) + kfree(dev->managed.final_kfree); }

/** diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h index 8b9e8bbca9b1..23ba15773097 100644 --- a/drivers/gpu/drm/drm_internal.h +++ b/drivers/gpu/drm/drm_internal.h @@ -89,6 +89,9 @@ void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *prime_fpr struct drm_minor *drm_minor_acquire(unsigned int minor_id); void drm_minor_release(struct drm_minor *minor);

+/* drm_managed.c */ +void drm_managed_release(struct drm_device *dev); + /* drm_vblank.c */ void drm_vblank_disable_and_save(struct drm_device *dev, unsigned int pipe); void drm_vblank_cleanup(struct drm_device *dev); diff --git a/drivers/gpu/drm/drm_managed.c b/drivers/gpu/drm/drm_managed.c new file mode 100644 index 000000000000..4a69771a4d93 --- /dev/null +++ b/drivers/gpu/drm/drm_managed.c @@ -0,0 +1,193 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2020 Intel + * + * Based on drivers/base/devres.c + */ + +#include <drm/drm_managed.h> + +#include <linux/list.h> +#include <linux/slab.h> +#include <linux/spinlock.h> + +#include <drm/drm_device.h> +#include <drm/drm_print.h> + +/** + * DOC: managed resources + * + * Inspired by struct &device managed resources, but tied to the lifetime of + * struct &drm_device, which can outlive the underlying physical device, usually + * when userspace has some open files and other handles to resources still open. + */ +struct drmres_node { + struct list_head entry; + drmres_release_t release; + const char *name; + size_t size; +}; + +struct drmres { + struct drmres_node node; + /* + * Some archs want to perform DMA into kmalloc caches + * and need a guaranteed alignment larger than + * the alignment of a 64-bit integer. + * Thus we use ARCH_KMALLOC_MINALIGN here and get exactly the same + * buffer alignment as if it was allocated by plain kmalloc(). + */ + u8 __aligned(ARCH_KMALLOC_MINALIGN) data[]; +}; + +static void free_dr(struct drmres *dr) +{ + kfree_const(dr->node.name); + kfree(dr); +} + +void drm_managed_release(struct drm_device *dev) +{ + struct drmres *dr, *tmp; + + drm_dbg_drmres(dev, "drmres release begin\n"); + list_for_each_entry_safe(dr, tmp, &dev->managed.resources, node.entry) { + drm_dbg_drmres(dev, "REL %p %s (%zu bytes)\n", + dr, dr->node.name, dr->node.size); + + if (dr->node.release) + dr->node.release(dev, dr->node.size ? *(void **)&dr->data : NULL); + + list_del(&dr->node.entry); + free_dr(dr); + } + drm_dbg_drmres(dev, "drmres release end\n"); +} + +/* + * Always inline so that kmalloc_track_caller tracks the actual interesting + * caller outside of drm_managed.c. + */ +static __always_inline struct drmres * alloc_dr(drmres_release_t release, + size_t size, gfp_t gfp, int nid) +{ + size_t tot_size; + struct drmres *dr; + + /* We must catch any near-SIZE_MAX cases that could overflow. */ + if (unlikely(check_add_overflow(sizeof(*dr), size, &tot_size))) + return NULL; + + dr = kmalloc_node_track_caller(tot_size, gfp, nid); + if (unlikely(!dr)) + return NULL; + + memset(dr, 0, offsetof(struct drmres, data)); + + INIT_LIST_HEAD(&dr->node.entry); + dr->node.release = release; + dr->node.size = size; + + return dr; +} + +static void del_dr(struct drm_device *dev, struct drmres *dr) +{ + list_del_init(&dr->node.entry); + + drm_dbg_drmres(dev, "DEL %p %s (%lu bytes)\n", + dr, dr->node.name, (unsigned long) dr->node.size); +} + +static void add_dr(struct drm_device *dev, struct drmres *dr) +{ + unsigned long flags; + + spin_lock_irqsave(&dev->managed.lock, flags); + list_add(&dr->node.entry, &dev->managed.resources); + spin_unlock_irqrestore(&dev->managed.lock, flags); + + drm_dbg_drmres(dev, "ADD %p %s (%lu bytes)\n", + dr, dr->node.name, (unsigned long) dr->node.size); +} + +void drmm_add_final_kfree(struct drm_device *dev, void *container) +{ + WARN_ON(dev->managed.final_kfree); + WARN_ON(dev < (struct drm_device *) container); + WARN_ON(dev + 1 >= + (struct drm_device *) (container + ksize(container))); + dev->managed.final_kfree = container; +} +EXPORT_SYMBOL(drmm_add_final_kfree); + +int __drmm_add_action(struct drm_device *dev, + drmres_release_t action, + void *data, const char *name) +{ + struct drmres *dr; + void **void_ptr; + + dr = alloc_dr(action, data ? sizeof(void*) : 0, + GFP_KERNEL | __GFP_ZERO, + dev_to_node(dev->dev)); + if (!dr) { + drm_dbg_drmres(dev, "failed to add action %s for %p\n", + name, data); + return -ENOMEM; + } + + dr->node.name = kstrdup_const(name, GFP_KERNEL); + if (data) { + void_ptr = (void **)&dr->data; + *void_ptr = data; + } + + add_dr(dev, dr); + + return 0; +} +EXPORT_SYMBOL(__drmm_add_action); + +void *drmm_kmalloc(struct drm_device *dev, size_t size, gfp_t gfp) +{ + struct drmres *dr; + + dr = alloc_dr(NULL, size, gfp, dev_to_node(dev->dev)); + if (!dr) { + drm_dbg_drmres(dev, "failed to allocate %zu bytes, %u flags\n", + size, gfp); + return NULL; + } + dr->node.name = "kmalloc"; + + add_dr(dev, dr); + + return dr->data; +} +EXPORT_SYMBOL(drmm_kmalloc); + +void drmm_kfree(struct drm_device *dev, void *data) +{ + struct drmres *dr_match = NULL, *dr; + unsigned long flags; + + if (!data) + return; + + spin_lock_irqsave(&dev->managed.lock, flags); + list_for_each_entry(dr, &dev->managed.resources, node.entry) { + if (dr->data == data) { + dr_match = dr; + del_dr(dev, dr_match); + break; + } + } + spin_unlock_irqrestore(&dev->managed.lock, flags); + + if (WARN_ON(!dr_match)) + return; + + free_dr(dr_match); +} +EXPORT_SYMBOL(drmm_kfree); diff --git a/include/drm/drm_device.h b/include/drm/drm_device.h index bb60a949f416..d39132b477dd 100644 --- a/include/drm/drm_device.h +++ b/include/drm/drm_device.h @@ -67,6 +67,21 @@ struct drm_device { /** @dev: Device structure of bus-device */ struct device *dev;

+ /** + * @managed: + * + * Managed resources linked to the lifetime of this &drm_device as + * tracked by @ref. + */ + struct { + /** @managed.resources: managed resources list */ + struct list_head resources; + /** @managed.final_kfree: pointer for final kfree() call */ + void *final_kfree; + /** @managed.lock: protects @managed.resources */ + spinlock_t lock; + } managed; + /** @driver: DRM driver managing the device */ struct drm_driver *driver;

diff --git a/include/drm/drm_managed.h b/include/drm/drm_managed.h new file mode 100644 index 000000000000..7b5df7d09b19 --- /dev/null +++ b/include/drm/drm_managed.h @@ -0,0 +1,30 @@ +// SPDX-License-Identifier: GPL-2.0 + +#ifndef _DRM_MANAGED_H_ +#define _DRM_MANAGED_H_ + +#include <linux/gfp.h> +#include <linux/types.h> + +struct drm_device; + +typedef void (*drmres_release_t)(struct drm_device *dev, void *res); + +#define drmm_add_action(dev, action, data) \ + __drmm_add_action(dev, action, data, #action) + +int __must_check __drmm_add_action(struct drm_device *dev, + drmres_release_t action, + void *data, const char *name); + +void drmm_add_final_kfree(struct drm_device *dev, void *parent); + +void *drmm_kmalloc(struct drm_device *dev, size_t size, gfp_t gfp) __malloc; +static inline void *drmm_kzalloc(struct drm_device *dev, size_t size, gfp_t gfp) +{ + return drmm_kmalloc(dev, size, gfp | __GFP_ZERO); +} + +void drmm_kfree(struct drm_device *dev, void *data); + +#endif diff --git a/include/drm/drm_print.h b/include/drm/drm_print.h index ca7cee8e728a..1c9417430d08 100644 --- a/include/drm/drm_print.h +++ b/include/drm/drm_print.h @@ -313,6 +313,10 @@ enum drm_debug_category { * @DRM_UT_DP: Used in the DP code. */ DRM_UT_DP = 0x100, + /** + * @DRM_UT_DRMRES: Used in the drm managed resources code. + */ + DRM_UT_DRMRES = 0x200, };

static inline bool drm_debug_enabled(enum drm_debug_category category) @@ -442,6 +446,8 @@ void drm_dev_dbg(const struct device *dev, enum drm_debug_category category, drm_dev_dbg((drm)->dev, DRM_UT_LEASE, fmt, ##__VA_ARGS__) #define drm_dbg_dp(drm, fmt, ...) \ drm_dev_dbg((drm)->dev, DRM_UT_DP, fmt, ##__VA_ARGS__) +#define drm_dbg_drmres(drm, fmt, ...) \ + drm_dev_dbg((drm)->dev, DRM_UT_DRMRES, fmt, ##__VA_ARGS__)

/*

They all share mipi_dbi_release so we need to switch them all together. With this we can drop the final kfree from the release function.

Aside, I think we could perhaps have a tiny additional helper for these mipi_dbi drivers, the first few lines around devm_drm_dev_init are all the same (except for the drm_driver pointer).

Acked-by: Sam Ravnborg sam@ravnborg.org Reviewed-by: Noralf Trønnes noralf@tronnes.org Tested-by: Noralf Trønnes noralf@tronnes.org Cc: Maarten Lankhorst maarten.lankhorst@linux.intel.com Cc: Maxime Ripard mripard@kernel.org Cc: Thomas Zimmermann tzimmermann@suse.de Cc: David Airlie airlied@linux.ie Cc: Daniel Vetter daniel@ffwll.ch Cc: Eric Anholt eric@anholt.net Cc: David Lechner david@lechnology.com Cc: Kamlesh Gurudasani kamlesh.gurudasani@gmail.com Cc: "Noralf Trønnes" noralf@tronnes.org Cc: Sam Ravnborg sam@ravnborg.org Signed-off-by: Daniel Vetter daniel.vetter@intel.com --- drivers/gpu/drm/drm_mipi_dbi.c | 3 --- drivers/gpu/drm/tiny/hx8357d.c | 2 ++ drivers/gpu/drm/tiny/ili9225.c | 2 ++ drivers/gpu/drm/tiny/ili9341.c | 2 ++ drivers/gpu/drm/tiny/ili9486.c | 2 ++ drivers/gpu/drm/tiny/mi0283qt.c | 2 ++ drivers/gpu/drm/tiny/st7586.c | 2 ++ drivers/gpu/drm/tiny/st7735r.c | 2 ++ 8 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/drm_mipi_dbi.c b/drivers/gpu/drm/drm_mipi_dbi.c index ea929bc1e663..98d0af8376fd 100644 --- a/drivers/gpu/drm/drm_mipi_dbi.c +++ b/drivers/gpu/drm/drm_mipi_dbi.c @@ -589,13 +589,10 @@ EXPORT_SYMBOL(mipi_dbi_dev_init); */ void mipi_dbi_release(struct drm_device *drm) { - struct mipi_dbi_dev *dbidev = drm_to_mipi_dbi_dev(drm); - DRM_DEBUG_DRIVER("\n");

drm_mode_config_cleanup(drm); drm_dev_fini(drm); - kfree(dbidev); } EXPORT_SYMBOL(mipi_dbi_release);

diff --git a/drivers/gpu/drm/tiny/hx8357d.c b/drivers/gpu/drm/tiny/hx8357d.c index 9af8ff84974f..42bc5dadcb1c 100644 --- a/drivers/gpu/drm/tiny/hx8357d.c +++ b/drivers/gpu/drm/tiny/hx8357d.c @@ -21,6 +21,7 @@ #include <drm/drm_fb_helper.h> #include <drm/drm_gem_cma_helper.h> #include <drm/drm_gem_framebuffer_helper.h> +#include <drm/drm_managed.h> #include <drm/drm_mipi_dbi.h> #include <drm/drm_modeset_helper.h> #include <video/mipi_display.h> @@ -236,6 +237,7 @@ static int hx8357d_probe(struct spi_device *spi) kfree(dbidev); return ret; } + drmm_add_final_kfree(drm, dbidev);

drm_mode_config_init(drm);

diff --git a/drivers/gpu/drm/tiny/ili9225.c b/drivers/gpu/drm/tiny/ili9225.c index 802fb8dde1b6..aae88dc5b3f7 100644 --- a/drivers/gpu/drm/tiny/ili9225.c +++ b/drivers/gpu/drm/tiny/ili9225.c @@ -24,6 +24,7 @@ #include <drm/drm_fourcc.h> #include <drm/drm_gem_cma_helper.h> #include <drm/drm_gem_framebuffer_helper.h> +#include <drm/drm_managed.h> #include <drm/drm_mipi_dbi.h> #include <drm/drm_rect.h>

@@ -387,6 +388,7 @@ static int ili9225_probe(struct spi_device *spi) kfree(dbidev); return ret; } + drmm_add_final_kfree(drm, dbidev);

drm_mode_config_init(drm);

diff --git a/drivers/gpu/drm/tiny/ili9341.c b/drivers/gpu/drm/tiny/ili9341.c index 33b51dc7faa8..7d40cb4ff72b 100644 --- a/drivers/gpu/drm/tiny/ili9341.c +++ b/drivers/gpu/drm/tiny/ili9341.c @@ -20,6 +20,7 @@ #include <drm/drm_fb_helper.h> #include <drm/drm_gem_cma_helper.h> #include <drm/drm_gem_framebuffer_helper.h> +#include <drm/drm_managed.h> #include <drm/drm_mipi_dbi.h> #include <drm/drm_modeset_helper.h> #include <video/mipi_display.h> @@ -194,6 +195,7 @@ static int ili9341_probe(struct spi_device *spi) kfree(dbidev); return ret; } + drmm_add_final_kfree(drm, dbidev);

drm_mode_config_init(drm);

diff --git a/drivers/gpu/drm/tiny/ili9486.c b/drivers/gpu/drm/tiny/ili9486.c index 532560aebb1e..9515eed2625c 100644 --- a/drivers/gpu/drm/tiny/ili9486.c +++ b/drivers/gpu/drm/tiny/ili9486.c @@ -19,6 +19,7 @@ #include <drm/drm_fb_helper.h> #include <drm/drm_gem_cma_helper.h> #include <drm/drm_gem_framebuffer_helper.h> +#include <drm/drm_managed.h> #include <drm/drm_mipi_dbi.h> #include <drm/drm_modeset_helper.h>

@@ -208,6 +209,7 @@ static int ili9486_probe(struct spi_device *spi) kfree(dbidev); return ret; } + drmm_add_final_kfree(drm, dbidev);

drm_mode_config_init(drm);

diff --git a/drivers/gpu/drm/tiny/mi0283qt.c b/drivers/gpu/drm/tiny/mi0283qt.c index e2cfd9a17143..8555a56bce8c 100644 --- a/drivers/gpu/drm/tiny/mi0283qt.c +++ b/drivers/gpu/drm/tiny/mi0283qt.c @@ -18,6 +18,7 @@ #include <drm/drm_fb_helper.h> #include <drm/drm_gem_cma_helper.h> #include <drm/drm_gem_framebuffer_helper.h> +#include <drm/drm_managed.h> #include <drm/drm_mipi_dbi.h> #include <drm/drm_modeset_helper.h> #include <video/mipi_display.h> @@ -198,6 +199,7 @@ static int mi0283qt_probe(struct spi_device *spi) kfree(dbidev); return ret; } + drmm_add_final_kfree(drm, dbidev);

drm_mode_config_init(drm);

diff --git a/drivers/gpu/drm/tiny/st7586.c b/drivers/gpu/drm/tiny/st7586.c index 9ef559dd3191..427c2561f5f4 100644 --- a/drivers/gpu/drm/tiny/st7586.c +++ b/drivers/gpu/drm/tiny/st7586.c @@ -21,6 +21,7 @@ #include <drm/drm_format_helper.h> #include <drm/drm_gem_cma_helper.h> #include <drm/drm_gem_framebuffer_helper.h> +#include <drm/drm_managed.h> #include <drm/drm_mipi_dbi.h> #include <drm/drm_rect.h>

@@ -328,6 +329,7 @@ static int st7586_probe(struct spi_device *spi) kfree(dbidev); return ret; } + drmm_add_final_kfree(drm, dbidev);

drm_mode_config_init(drm);

diff --git a/drivers/gpu/drm/tiny/st7735r.c b/drivers/gpu/drm/tiny/st7735r.c index 18b925df6e51..b447235c3d47 100644 --- a/drivers/gpu/drm/tiny/st7735r.c +++ b/drivers/gpu/drm/tiny/st7735r.c @@ -21,6 +21,7 @@ #include <drm/drm_fb_helper.h> #include <drm/drm_gem_cma_helper.h> #include <drm/drm_gem_framebuffer_helper.h> +#include <drm/drm_managed.h> #include <drm/drm_mipi_dbi.h>

#define ST7735R_FRMCTR1 0xb1 @@ -209,6 +210,7 @@ static int st7735r_probe(struct spi_device *spi) kfree(dbidev); return ret; } + drmm_add_final_kfree(drm, dbidev);

drm_mode_config_init(drm);

With this we can drop the final kfree from the release function.

Acked-by: Gerd Hoffmann kraxel@redhat.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Dave Airlie airlied@redhat.com Cc: Gerd Hoffmann kraxel@redhat.com Cc: virtualization@lists.linux-foundation.org Cc: spice-devel@lists.freedesktop.org --- drivers/gpu/drm/qxl/qxl_drv.c | 2 -- drivers/gpu/drm/qxl/qxl_kms.c | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c index 4fda3f9b29f4..09102e2efabc 100644 --- a/drivers/gpu/drm/qxl/qxl_drv.c +++ b/drivers/gpu/drm/qxl/qxl_drv.c @@ -144,8 +144,6 @@ static void qxl_drm_release(struct drm_device *dev) */ qxl_modeset_fini(qdev); qxl_device_fini(qdev); - dev->dev_private = NULL; - kfree(qdev); }

static void diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c index 70b20ee4741a..09d7b5f6d172 100644 --- a/drivers/gpu/drm/qxl/qxl_kms.c +++ b/drivers/gpu/drm/qxl/qxl_kms.c @@ -27,6 +27,7 @@ #include <linux/pci.h>

#include <drm/drm_drv.h> +#include <drm/drm_managed.h> #include <drm/drm_probe_helper.h>

#include "qxl_drv.h" @@ -121,6 +122,7 @@ int qxl_device_init(struct qxl_device *qdev, qdev->ddev.pdev = pdev; pci_set_drvdata(pdev, &qdev->ddev); qdev->ddev.dev_private = qdev; + drmm_add_final_kfree(&qdev->ddev, qdev);

mutex_init(&qdev->gem.mutex); mutex_init(&qdev->update_area_mutex);

With this we can drop the final kfree from the release function.

I also noticed that cirrus forgot to call drm_dev_fini().

v2: Don't call kfree(cirrus) after we've handed overship of that to drm_device and the drmm_ stuff.

Acked-by: Gerd Hoffmann kraxel@redhat.com Acked-by: Sam Ravnborg sam@ravnborg.org Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Dave Airlie airlied@redhat.com Cc: Gerd Hoffmann kraxel@redhat.com Cc: Daniel Vetter daniel.vetter@ffwll.ch Cc: "Noralf Trønnes" noralf@tronnes.org Cc: Linus Walleij linus.walleij@linaro.org Cc: Sam Ravnborg sam@ravnborg.org Cc: Thomas Zimmermann tzimmermann@suse.de Cc: virtualization@lists.linux-foundation.org --- drivers/gpu/drm/cirrus/cirrus.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/cirrus/cirrus.c b/drivers/gpu/drm/cirrus/cirrus.c index d2ff63ce8eaf..2232556ce34c 100644 --- a/drivers/gpu/drm/cirrus/cirrus.c +++ b/drivers/gpu/drm/cirrus/cirrus.c @@ -35,6 +35,7 @@ #include <drm/drm_gem_shmem_helper.h> #include <drm/drm_gem_framebuffer_helper.h> #include <drm/drm_ioctl.h> +#include <drm/drm_managed.h> #include <drm/drm_modeset_helper_vtables.h> #include <drm/drm_probe_helper.h> #include <drm/drm_simple_kms_helper.h> @@ -527,10 +528,8 @@ static void cirrus_mode_config_init(struct cirrus_device *cirrus)

static void cirrus_release(struct drm_device *dev) { - struct cirrus_device *cirrus = dev->dev_private; - drm_mode_config_cleanup(dev); - kfree(cirrus); + drm_dev_fini(dev); }

DEFINE_DRM_GEM_FOPS(cirrus_fops); @@ -575,9 +574,12 @@ static int cirrus_pci_probe(struct pci_dev *pdev,

dev = &cirrus->dev; ret = drm_dev_init(dev, &cirrus_driver, &pdev->dev); - if (ret) - goto err_free_cirrus; + if (ret) { + kfree(cirrus); + goto err_pci_release; + } dev->dev_private = cirrus; + drmm_add_final_kfree(dev, cirrus);

ret = -ENOMEM; cirrus->vram = ioremap(pci_resource_start(pdev, 0), @@ -618,8 +620,6 @@ static int cirrus_pci_probe(struct pci_dev *pdev, iounmap(cirrus->vram); err_dev_put: drm_dev_put(dev); -err_free_cirrus: - kfree(cirrus); err_pci_release: pci_release_regions(pdev); return ret;

With this we can drop the final kfree from the release function.

Acked-by: Jyri Sarha jsarha@ti.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Jyri Sarha jsarha@ti.com Cc: Tomi Valkeinen tomi.valkeinen@ti.com --- drivers/gpu/drm/tidss/tidss_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/tidss/tidss_drv.c b/drivers/gpu/drm/tidss/tidss_drv.c index d95e4be2c7b9..32a85628dbec 100644 --- a/drivers/gpu/drm/tidss/tidss_drv.c +++ b/drivers/gpu/drm/tidss/tidss_drv.c @@ -17,6 +17,7 @@ #include <drm/drm_fb_helper.h> #include <drm/drm_gem_cma_helper.h> #include <drm/drm_irq.h> +#include <drm/drm_managed.h> #include <drm/drm_probe_helper.h>

#include "tidss_dispc.h" @@ -109,8 +110,6 @@ static void tidss_release(struct drm_device *ddev) tidss_modeset_cleanup(tidss);

drm_dev_fini(ddev); - - kfree(tidss); }

DEFINE_DRM_GEM_CMA_FOPS(tidss_fops); @@ -154,6 +153,7 @@ static int tidss_probe(struct platform_device *pdev) kfree(ddev); return ret; } + drmm_add_final_kfree(ddev, tidss);

tidss->dev = dev; tidss->feat = of_device_get_match_data(dev);

With this we can drop the final kfree from the release function.

v2: After drm_dev_init/drmm_add_final_kfree we need to clean up everything through a drm_dev_put. Rework the unwind code to match that.

Acked-by: Sam Ravnborg sam@ravnborg.org Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Daniel Vetter daniel.vetter@ffwll.ch Cc: Emil Velikov emil.velikov@collabora.com Cc: Chris Wilson chris@chris-wilson.co.uk Cc: Sean Paul seanpaul@chromium.org Cc: Eric Anholt eric@anholt.net Cc: Rob Clark robdclark@chromium.org Cc: Sam Ravnborg sam@ravnborg.org --- drivers/gpu/drm/vgem/vgem_drv.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c index 909eba43664a..7486014e9149 100644 --- a/drivers/gpu/drm/vgem/vgem_drv.c +++ b/drivers/gpu/drm/vgem/vgem_drv.c @@ -39,6 +39,7 @@ #include <drm/drm_drv.h> #include <drm/drm_file.h> #include <drm/drm_ioctl.h> +#include <drm/drm_managed.h> #include <drm/drm_prime.h>

#include "vgem_drv.h" @@ -432,8 +433,6 @@ static void vgem_release(struct drm_device *dev)

platform_device_unregister(vgem->platform); drm_dev_fini(&vgem->drm); - - kfree(vgem); }

static struct drm_driver vgem_driver = { @@ -489,16 +488,19 @@ static int __init vgem_init(void) &vgem_device->platform->dev); if (ret) goto out_unregister; + drmm_add_final_kfree(&vgem_device->drm, vgem_device);

/* Final step: expose the device/driver to userspace */ - ret = drm_dev_register(&vgem_device->drm, 0); + ret = drm_dev_register(&vgem_device->drm, 0); if (ret) - goto out_fini; + goto out_put;

return 0;

-out_fini: - drm_dev_fini(&vgem_device->drm); +out_put: + drm_dev_put(&vgem_device->drm); + return ret; + out_unregister: platform_device_unregister(vgem_device->platform); out_free:

With this we can drop the final kfree from the release function.

Acked-by: Sam Ravnborg sam@ravnborg.org Reviewed-by: Noralf Trønnes noralf@tronnes.org Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: "Noralf Trønnes" noralf@tronnes.org --- drivers/gpu/drm/tiny/repaper.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/tiny/repaper.c b/drivers/gpu/drm/tiny/repaper.c index f5ebcaf7ee3a..df5654ef53ee 100644 --- a/drivers/gpu/drm/tiny/repaper.c +++ b/drivers/gpu/drm/tiny/repaper.c @@ -31,6 +31,7 @@ #include <drm/drm_format_helper.h> #include <drm/drm_gem_cma_helper.h> #include <drm/drm_gem_framebuffer_helper.h> +#include <drm/drm_managed.h> #include <drm/drm_modes.h> #include <drm/drm_rect.h> #include <drm/drm_probe_helper.h> @@ -910,13 +911,10 @@ static const struct drm_mode_config_funcs repaper_mode_config_funcs = {

static void repaper_release(struct drm_device *drm) { - struct repaper_epd *epd = drm_to_epd(drm); - DRM_DEBUG_DRIVER("\n");

drm_mode_config_cleanup(drm); drm_dev_fini(drm); - kfree(epd); }

static const uint32_t repaper_formats[] = { @@ -1024,6 +1022,7 @@ static int repaper_probe(struct spi_device *spi) kfree(epd); return ret; } + drmm_add_final_kfree(drm, epd);

drm_mode_config_init(drm); drm->mode_config.funcs = &repaper_mode_config_funcs;

With this we can drop the final kfree from the release function.

Acked-by: Sam Ravnborg sam@ravnborg.org Reviewed-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Hans de Goede hdegoede@redhat.com --- drivers/gpu/drm/tiny/gm12u320.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/tiny/gm12u320.c b/drivers/gpu/drm/tiny/gm12u320.c index a48173441ae0..524ca0941cf9 100644 --- a/drivers/gpu/drm/tiny/gm12u320.c +++ b/drivers/gpu/drm/tiny/gm12u320.c @@ -19,6 +19,7 @@ #include <drm/drm_gem_shmem_helper.h> #include <drm/drm_gem_framebuffer_helper.h> #include <drm/drm_ioctl.h> +#include <drm/drm_managed.h> #include <drm/drm_modeset_helper_vtables.h> #include <drm/drm_probe_helper.h> #include <drm/drm_simple_kms_helper.h> @@ -637,7 +638,6 @@ static void gm12u320_driver_release(struct drm_device *dev) gm12u320_usb_free(gm12u320); drm_mode_config_cleanup(dev); drm_dev_fini(dev); - kfree(gm12u320); }

DEFINE_DRM_GEM_FOPS(gm12u320_fops); @@ -692,6 +692,7 @@ static int gm12u320_usb_probe(struct usb_interface *interface, return ret; } dev->dev_private = gm12u320; + drmm_add_final_kfree(dev, gm12u320);

drm_mode_config_init(dev); dev->mode_config.min_width = GM12U320_USER_WIDTH;

A few things: - Update the example driver in the documentation. - We can drop the old kfree in drm_dev_release. - Add a WARN_ON check in drm_dev_register to make sure everyone calls drmm_add_final_kfree and there's no leaks.

v2: Restore the full cleanup, I accidentally left some moved code behind when fixing the bisectability of the series.

Acked-by: Sam Ravnborg sam@ravnborg.org Acked-by: Thomas Zimmermann tzimmermann@suse.de Cc: Sam Ravnborg sam@ravnborg.org Cc: Dan Carpenter dan.carpenter@oracle.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com --- drivers/gpu/drm/drm_drv.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index 877ded348b6e..7f9d7ea543a0 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -297,8 +297,6 @@ void drm_minor_release(struct drm_minor *minor) * * drm_mode_config_cleanup(drm); * drm_dev_fini(drm); - * kfree(priv->userspace_facing); - * kfree(priv); * } * * static struct drm_driver driver_drm_driver = { @@ -326,10 +324,11 @@ void drm_minor_release(struct drm_minor *minor) * kfree(drm); * return ret; * } + * drmm_add_final_kfree(drm, priv); * * drm_mode_config_init(drm); * - * priv->userspace_facing = kzalloc(..., GFP_KERNEL); + * priv->userspace_facing = drmm_kzalloc(..., GFP_KERNEL); * if (!priv->userspace_facing) * return -ENOMEM; * @@ -837,10 +836,7 @@ static void drm_dev_release(struct kref *ref)

drm_managed_release(dev);

- if (!dev->driver->release && !dev->managed.final_kfree) { - WARN_ON(!list_empty(&dev->managed.resources)); - kfree(dev); - } else if (dev->managed.final_kfree) + if (dev->managed.final_kfree) kfree(dev->managed.final_kfree); }

@@ -961,6 +957,8 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags) if (!driver->load) drm_mode_config_validate(dev);

+ WARN_ON(!dev->managed.final_kfree); + if (drm_dev_needs_global_mutex(dev)) mutex_lock(&drm_global_mutex);

Well for the simple stuff at least, vblank, gem and minor cleanup I want to further split up as a demonstration.

v2: We need to clear drm_device->dev otherwise the debug drm printing after our cleanup hook (e.g. in drm_manged_release) will chase released memory and result in a use-after-free. Not really pretty, but oh well.

Signed-off-by: Daniel Vetter daniel.vetter@intel.com --- drivers/gpu/drm/drm_drv.c | 48 ++++++++++++++++++++------------------- 1 file changed, 25 insertions(+), 23 deletions(-)

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index c80ebc6811b1..a710c53d13a8 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -580,6 +580,23 @@ static void drm_fs_inode_free(struct inode *inode) * used. */

+static void drm_dev_init_release(struct drm_device *dev, void *res) +{ + drm_legacy_ctxbitmap_cleanup(dev); + drm_legacy_remove_map_hash(dev); + drm_fs_inode_free(dev->anon_inode); + + put_device(dev->dev); + /* Prevent use-after-free in drm_managed_release when debugging is + * enabled. Slightly awkward, but can't really be helped. */ + dev->dev = NULL; + mutex_destroy(&dev->master_mutex); + mutex_destroy(&dev->clientlist_mutex); + mutex_destroy(&dev->filelist_mutex); + mutex_destroy(&dev->struct_mutex); + drm_legacy_destroy_members(dev); +} + /** * drm_dev_init - Initialise new DRM device * @dev: DRM device @@ -647,11 +664,15 @@ int drm_dev_init(struct drm_device *dev, mutex_init(&dev->clientlist_mutex); mutex_init(&dev->master_mutex);

+ ret = drmm_add_action(dev, drm_dev_init_release, NULL); + if (ret) + return ret; + dev->anon_inode = drm_fs_inode_new(); if (IS_ERR(dev->anon_inode)) { ret = PTR_ERR(dev->anon_inode); DRM_ERROR("Cannot allocate anonymous inode: %d\n", ret); - goto err_free; + goto err; }

if (drm_core_check_feature(dev, DRIVER_RENDER)) { @@ -688,19 +709,12 @@ int drm_dev_init(struct drm_device *dev, if (drm_core_check_feature(dev, DRIVER_GEM)) drm_gem_destroy(dev); err_ctxbitmap: - drm_legacy_ctxbitmap_cleanup(dev); - drm_legacy_remove_map_hash(dev); err_minors: drm_minor_free(dev, DRM_MINOR_PRIMARY); drm_minor_free(dev, DRM_MINOR_RENDER); - drm_fs_inode_free(dev->anon_inode); -err_free: - put_device(dev->dev); - mutex_destroy(&dev->master_mutex); - mutex_destroy(&dev->clientlist_mutex); - mutex_destroy(&dev->filelist_mutex); - mutex_destroy(&dev->struct_mutex); - drm_legacy_destroy_members(dev); +err: + drm_managed_release(dev); + return ret; } EXPORT_SYMBOL(drm_dev_init); @@ -763,20 +777,8 @@ void drm_dev_fini(struct drm_device *dev) if (drm_core_check_feature(dev, DRIVER_GEM)) drm_gem_destroy(dev);

- drm_legacy_ctxbitmap_cleanup(dev); - drm_legacy_remove_map_hash(dev); - drm_fs_inode_free(dev->anon_inode); - drm_minor_free(dev, DRM_MINOR_PRIMARY); drm_minor_free(dev, DRM_MINOR_RENDER); - - put_device(dev->dev); - - mutex_destroy(&dev->master_mutex); - mutex_destroy(&dev->clientlist_mutex); - mutex_destroy(&dev->filelist_mutex); - mutex_destroy(&dev->struct_mutex); - drm_legacy_destroy_members(dev); } EXPORT_SYMBOL(drm_dev_fini);

The cleanup here is somewhat tricky, since we can't tell apart the allocated minor index from 0. So register a cleanup action first, and if the index allocation fails, unregister that cleanup action again to avoid bad mistakes.

The kdev for the minor already handles NULL, so no problem there.

Hence add drmm_remove_action() to the drm_managed library.

v2: Make pointer math around void ** consistent with what Laurent suggested.

v3: Use drmm_add_action_or_reset and remove drmm_remove_action. Noticed because of some questions from Thomas. This also means we need to move the drmm_add_action_or_reset helper earlier in the series.

Cc: Thomas Zimmermann tzimmermann@suse.de Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com --- drivers/gpu/drm/drm_drv.c | 70 ++++++++++++----------------------- drivers/gpu/drm/drm_managed.c | 14 +++++++ include/drm/drm_managed.h | 9 ++++- 3 files changed, 46 insertions(+), 47 deletions(-)

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index a710c53d13a8..25fc2107057c 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -93,13 +93,25 @@ static struct drm_minor **drm_minor_get_slot(struct drm_device *dev, } }

+static void drm_minor_alloc_release(struct drm_device *dev, void *data) +{ + struct drm_minor *minor = data; + unsigned long flags; + + put_device(minor->kdev); + + spin_lock_irqsave(&drm_minor_lock, flags); + idr_remove(&drm_minors_idr, minor->index); + spin_unlock_irqrestore(&drm_minor_lock, flags); +} + static int drm_minor_alloc(struct drm_device *dev, unsigned int type) { struct drm_minor *minor; unsigned long flags; int r;

- minor = kzalloc(sizeof(*minor), GFP_KERNEL); + minor = drmm_kzalloc(dev, sizeof(*minor), GFP_KERNEL); if (!minor) return -ENOMEM;

@@ -117,46 +129,19 @@ static int drm_minor_alloc(struct drm_device *dev, unsigned int type) idr_preload_end();

if (r < 0) - goto err_free; + return r;

- minor->index = r; + r = drmm_add_action_or_reset(dev, drm_minor_alloc_release, minor); + if (r) + return r;

+ minor->index = r; minor->kdev = drm_sysfs_minor_alloc(minor); - if (IS_ERR(minor->kdev)) { - r = PTR_ERR(minor->kdev); - goto err_index; - } + if (IS_ERR(minor->kdev)) + return PTR_ERR(minor->kdev);

*drm_minor_get_slot(dev, type) = minor; return 0; - -err_index: - spin_lock_irqsave(&drm_minor_lock, flags); - idr_remove(&drm_minors_idr, minor->index); - spin_unlock_irqrestore(&drm_minor_lock, flags); -err_free: - kfree(minor); - return r; -} - -static void drm_minor_free(struct drm_device *dev, unsigned int type) -{ - struct drm_minor **slot, *minor; - unsigned long flags; - - slot = drm_minor_get_slot(dev, type); - minor = *slot; - if (!minor) - return; - - put_device(minor->kdev); - - spin_lock_irqsave(&drm_minor_lock, flags); - idr_remove(&drm_minors_idr, minor->index); - spin_unlock_irqrestore(&drm_minor_lock, flags); - - kfree(minor); - *slot = NULL; }

static int drm_minor_register(struct drm_device *dev, unsigned int type) @@ -678,16 +663,16 @@ int drm_dev_init(struct drm_device *dev, if (drm_core_check_feature(dev, DRIVER_RENDER)) { ret = drm_minor_alloc(dev, DRM_MINOR_RENDER); if (ret) - goto err_minors; + goto err; }

ret = drm_minor_alloc(dev, DRM_MINOR_PRIMARY); if (ret) - goto err_minors; + goto err;

ret = drm_legacy_create_map_hash(dev); if (ret) - goto err_minors; + goto err;

drm_legacy_ctxbitmap_init(dev);

@@ -695,7 +680,7 @@ int drm_dev_init(struct drm_device *dev, ret = drm_gem_init(dev); if (ret) { DRM_ERROR("Cannot initialize graphics execution manager (GEM)\n"); - goto err_ctxbitmap; + goto err; } }

@@ -708,10 +693,6 @@ int drm_dev_init(struct drm_device *dev, err_setunique: if (drm_core_check_feature(dev, DRIVER_GEM)) drm_gem_destroy(dev); -err_ctxbitmap: -err_minors: - drm_minor_free(dev, DRM_MINOR_PRIMARY); - drm_minor_free(dev, DRM_MINOR_RENDER); err: drm_managed_release(dev);

@@ -776,9 +757,6 @@ void drm_dev_fini(struct drm_device *dev)

if (drm_core_check_feature(dev, DRIVER_GEM)) drm_gem_destroy(dev); - - drm_minor_free(dev, DRM_MINOR_PRIMARY); - drm_minor_free(dev, DRM_MINOR_RENDER); } EXPORT_SYMBOL(drm_dev_fini);

diff --git a/drivers/gpu/drm/drm_managed.c b/drivers/gpu/drm/drm_managed.c index c633c2ef5269..8abf3a53aeb5 100644 --- a/drivers/gpu/drm/drm_managed.c +++ b/drivers/gpu/drm/drm_managed.c @@ -149,6 +149,20 @@ int __drmm_add_action(struct drm_device *dev, } EXPORT_SYMBOL(__drmm_add_action);

+int __drmm_add_action_or_reset(struct drm_device *dev, + drmres_release_t action, + void *data, const char *name) +{ + int ret; + + ret = __drmm_add_action(dev, action, data, name); + if (ret) + action(dev, data); + + return ret; +} +EXPORT_SYMBOL(__drmm_add_action_or_reset); + void *drmm_kmalloc(struct drm_device *dev, size_t size, gfp_t gfp) { struct drmres *dr; diff --git a/include/drm/drm_managed.h b/include/drm/drm_managed.h index 89e6fce9f689..2d1e29a2200c 100644 --- a/include/drm/drm_managed.h +++ b/include/drm/drm_managed.h @@ -17,7 +17,14 @@ int __must_check __drmm_add_action(struct drm_device *dev, drmres_release_t action, void *data, const char *name);

-void drmm_add_final_kfree(struct drm_device *dev, void *parent); +#define drmm_add_action_or_reset(dev, action, data) \ + __drmm_add_action_or_reset(dev, action, data, #action) + +int __must_check __drmm_add_action_or_reset(struct drm_device *dev, + drmres_release_t action, + void *data, const char *name); + +void drmm_add_final_kfree(struct drm_device *dev, void *container);

void *drmm_kmalloc(struct drm_device *dev, size_t size, gfp_t gfp) __malloc; static inline void *drmm_kzalloc(struct drm_device *dev, size_t size, gfp_t gfp)

Nothing special here, except that this is the first time that we automatically clean up something that's initialized with an explicit driver call. But the cleanup was done at the very end of the release sequence for all drivers, and that's still the case. At least without more uses of drmm_ through explicit driver calls.

Also for this one we need drmm_kcalloc, so lets add those.

The motivation here is to allow us to remove the explicit calls to drm_dev_fini() from all drivers.

v2: Sort includes (Laurent)

v3: Motivate the change in the commit message better (Sam)

Acked-by: Sam Ravnborg sam@ravnborg.org Signed-off-by: Daniel Vetter daniel.vetter@intel.com --- drivers/gpu/drm/drm_drv.c | 1 - drivers/gpu/drm/drm_internal.h | 1 - drivers/gpu/drm/drm_vblank.c | 31 ++++++++++++------------------- include/drm/drm_managed.h | 16 ++++++++++++++++ 4 files changed, 28 insertions(+), 21 deletions(-)

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index 18e7f7389897..3516b16cd33d 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -750,7 +750,6 @@ EXPORT_SYMBOL(devm_drm_dev_init); */ void drm_dev_fini(struct drm_device *dev) { - drm_vblank_cleanup(dev); } EXPORT_SYMBOL(drm_dev_fini);

diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h index a40a0222419e..2470a352730b 100644 --- a/drivers/gpu/drm/drm_internal.h +++ b/drivers/gpu/drm/drm_internal.h @@ -94,7 +94,6 @@ void drm_managed_release(struct drm_device *dev);

/* drm_vblank.c */ void drm_vblank_disable_and_save(struct drm_device *dev, unsigned int pipe); -void drm_vblank_cleanup(struct drm_device *dev);

/* IOCTLS */ int drm_wait_vblank_ioctl(struct drm_device *dev, void *data, diff --git a/drivers/gpu/drm/drm_vblank.c b/drivers/gpu/drm/drm_vblank.c index da7b0b0c1090..bcf346b3e486 100644 --- a/drivers/gpu/drm/drm_vblank.c +++ b/drivers/gpu/drm/drm_vblank.c @@ -30,6 +30,7 @@ #include <drm/drm_crtc.h> #include <drm/drm_drv.h> #include <drm/drm_framebuffer.h> +#include <drm/drm_managed.h> #include <drm/drm_modeset_helper_vtables.h> #include <drm/drm_print.h> #include <drm/drm_vblank.h> @@ -425,14 +426,10 @@ static void vblank_disable_fn(struct timer_list *t) spin_unlock_irqrestore(&dev->vbl_lock, irqflags); }

-void drm_vblank_cleanup(struct drm_device *dev) +static void drm_vblank_init_release(struct drm_device *dev, void *ptr) { unsigned int pipe;

- /* Bail if the driver didn't call drm_vblank_init() */ - if (dev->num_crtcs == 0) - return; - for (pipe = 0; pipe < dev->num_crtcs; pipe++) { struct drm_vblank_crtc *vblank = &dev->vblank[pipe];

@@ -441,10 +438,6 @@ void drm_vblank_cleanup(struct drm_device *dev)

del_timer_sync(&vblank->disable_timer); } - - kfree(dev->vblank); - - dev->num_crtcs = 0; }

/** @@ -453,25 +446,29 @@ void drm_vblank_cleanup(struct drm_device *dev) * @num_crtcs: number of CRTCs supported by @dev * * This function initializes vblank support for @num_crtcs display pipelines. - * Cleanup is handled by the DRM core, or through calling drm_dev_fini() for - * drivers with a &drm_driver.release callback. + * Cleanup is handled automatically through a cleanup function added with + * drmm_add_action(). * * Returns: * Zero on success or a negative error code on failure. */ int drm_vblank_init(struct drm_device *dev, unsigned int num_crtcs) { - int ret = -ENOMEM; + int ret; unsigned int i;

spin_lock_init(&dev->vbl_lock); spin_lock_init(&dev->vblank_time_lock);

+ dev->vblank = drmm_kcalloc(dev, num_crtcs, sizeof(*dev->vblank), GFP_KERNEL); + if (!dev->vblank) + return -ENOMEM; + dev->num_crtcs = num_crtcs;

- dev->vblank = kcalloc(num_crtcs, sizeof(*dev->vblank), GFP_KERNEL); - if (!dev->vblank) - goto err; + ret = drmm_add_action(dev, drm_vblank_init_release, NULL); + if (ret) + return ret;

for (i = 0; i < num_crtcs; i++) { struct drm_vblank_crtc *vblank = &dev->vblank[i]; @@ -486,10 +483,6 @@ int drm_vblank_init(struct drm_device *dev, unsigned int num_crtcs) DRM_INFO("Supports vblank timestamp caching Rev 2 (21.10.2013).\n");

return 0; - -err: - dev->num_crtcs = 0; - return ret; } EXPORT_SYMBOL(drm_vblank_init);

diff --git a/include/drm/drm_managed.h b/include/drm/drm_managed.h index 2d1e29a2200c..191d8d206ff4 100644 --- a/include/drm/drm_managed.h +++ b/include/drm/drm_managed.h @@ -4,6 +4,7 @@ #define _DRM_MANAGED_H_

#include <linux/gfp.h> +#include <linux/overflow.h> #include <linux/types.h>

struct drm_device; @@ -31,6 +32,21 @@ static inline void *drmm_kzalloc(struct drm_device *dev, size_t size, gfp_t gfp) { return drmm_kmalloc(dev, size, gfp | __GFP_ZERO); } +static inline void *drmm_kmalloc_array(struct drm_device *dev, + size_t n, size_t size, gfp_t flags) +{ + size_t bytes; + + if (unlikely(check_mul_overflow(n, size, &bytes))) + return NULL; + + return drmm_kmalloc(dev, bytes, flags); +} +static inline void *drmm_kcalloc(struct drm_device *dev, + size_t n, size_t size, gfp_t flags) +{ + return drmm_kmalloc_array(dev, n, size, flags | __GFP_ZERO); +} char *drmm_kstrdup(struct drm_device *dev, const char *s, gfp_t gfp);

void drmm_kfree(struct drm_device *dev, void *data);

drm_mode_config_cleanup is idempotent, so no harm in calling this twice. This allows us to gradually switch drivers over by removing explicit drm_mode_config_cleanup calls.

With this step it's now also possible that (at least for simple drivers) automatic resource cleanup can be done correctly without a drm_driver->release hook. Therefore allow this now in devm_drm_dev_init().

Also with drmm_ explicit drm_driver->release hooks are kinda not the best option: Drivers can always just register their current release hook with drmm_add_action, but even better they could split them up to simplify the unwinding for the driver load failure case. So deprecate that hook to discourage future users.

v2: Fixup the example in the kerneldoc too.

v3: - For paranoia, double check that minor->dev == dev in the release hook, because I botched the pointer math in the drmm library. - Call drm_mode_config_cleanup when drmm_add_action fails, we'd be missing some mutex_destroy and ida_cleanup otherwise (Laurent)

v4: Add a drmm_add_action_or_reset (like devm_ has) to encapsulate this pattern (Noralf).

v5: Fix oversight in the new drmm_add_action_or_reset macro (Noralf)

v4: Review from Sam: - drmm_mode_config_init wrapper (also suggested by Thomas) - improve commit message, explain better why ->relase is deprecated

v5: - Make drmm_ the main function, with the old one as compat wrapper (Sam) - Add FIXME comments to drm_mode_config_cleanup/init() that drivers shouldn't use these anymore. - Move drmm_add_action_or_reset helper to an earlier patch.

Reviewed-by: Sam Ravnborg sam@ravnborg.org Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Cc: "Noralf Trønnes" noralf@tronnes.org Cc: Sam Ravnborg sam@ravnborg.org Cc: Thomas Zimmermann tzimmermann@suse.de Acked-by: Noralf Trønnes noralf@tronnes.org Signed-off-by: Daniel Vetter daniel.vetter@intel.com --- Documentation/gpu/drm-kms.rst | 2 +- drivers/gpu/drm/drm_drv.c | 23 +++++++---------------- drivers/gpu/drm/drm_mode_config.c | 23 ++++++++++++++++++++--- include/drm/drm_mode_config.h | 18 +++++++++++++++++- 4 files changed, 45 insertions(+), 21 deletions(-)

diff --git a/Documentation/gpu/drm-kms.rst b/Documentation/gpu/drm-kms.rst index 906771e03103..e1f685015807 100644 --- a/Documentation/gpu/drm-kms.rst +++ b/Documentation/gpu/drm-kms.rst @@ -3,7 +3,7 @@ Kernel Mode Setting (KMS) =========================

Drivers must initialize the mode setting core by calling -drm_mode_config_init() on the DRM device. The function +drmm_mode_config_init() on the DRM device. The function initializes the :c:type:`struct drm_device <drm_device>` mode_config field and never fails. Once done, mode configuration must be setup by initializing the following fields. diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index 03f5cb829957..ea687c5ead15 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -98,6 +98,8 @@ static void drm_minor_alloc_release(struct drm_device *dev, void *data) struct drm_minor *minor = data; unsigned long flags;

+ WARN_ON(dev != minor->dev); + put_device(minor->kdev);

spin_lock_irqsave(&drm_minor_lock, flags); @@ -265,8 +267,7 @@ void drm_minor_release(struct drm_minor *minor) * * The following example shows a typical structure of a DRM display driver. * The example focus on the probe() function and the other functions that is - * almost always present and serves as a demonstration of devm_drm_dev_init() - * usage with its accompanying drm_driver->release callback. + * almost always present and serves as a demonstration of devm_drm_dev_init(). * * .. code-block:: c * @@ -276,16 +277,8 @@ void drm_minor_release(struct drm_minor *minor) * struct clk *pclk; * }; * - * static void driver_drm_release(struct drm_device *drm) - * { - * struct driver_device *priv = container_of(...); - * - * drm_mode_config_cleanup(drm); - * } - * * static struct drm_driver driver_drm_driver = { * [...] - * .release = driver_drm_release, * }; * * static int driver_probe(struct platform_device *pdev) @@ -310,7 +303,9 @@ void drm_minor_release(struct drm_minor *minor) * } * drmm_add_final_kfree(drm, priv); * - * drm_mode_config_init(drm); + * ret = drmm_mode_config_init(drm); + * if (ret) + * return ret; * * priv->userspace_facing = drmm_kzalloc(..., GFP_KERNEL); * if (!priv->userspace_facing) @@ -708,8 +703,7 @@ static void devm_drm_dev_init_release(void *data) * @driver: DRM driver * * Managed drm_dev_init(). The DRM device initialized with this function is - * automatically put on driver detach using drm_dev_put(). You must supply a - * &drm_driver.release callback to control the finalization explicitly. + * automatically put on driver detach using drm_dev_put(). * * RETURNS: * 0 on success, or error code on failure. @@ -720,9 +714,6 @@ int devm_drm_dev_init(struct device *parent, { int ret;

- if (WARN_ON(!driver->release)) - return -EINVAL; - ret = drm_dev_init(dev, driver, parent); if (ret) return ret; diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c index e1ec1bb7068d..5761f838a057 100644 --- a/drivers/gpu/drm/drm_mode_config.c +++ b/drivers/gpu/drm/drm_mode_config.c @@ -25,6 +25,7 @@ #include <drm/drm_drv.h> #include <drm/drm_encoder.h> #include <drm/drm_file.h> +#include <drm/drm_managed.h> #include <drm/drm_mode_config.h> #include <drm/drm_print.h> #include <linux/dma-resv.h> @@ -373,8 +374,14 @@ static int drm_mode_create_standard_properties(struct drm_device *dev) return 0; }

+static void drm_mode_config_init_release(struct drm_device *dev, void *ptr) +{ + drm_mode_config_cleanup(dev); +} + /** - * drm_mode_config_init - initialize DRM mode_configuration structure + * drmm_mode_config_init - managed DRM mode_configuration structure + * initialization * @dev: DRM device * * Initialize @dev's mode_config structure, used for tracking the graphics @@ -384,8 +391,12 @@ static int drm_mode_create_standard_properties(struct drm_device *dev) * problem, since this should happen single threaded at init time. It is the * driver's problem to ensure this guarantee. * + * Cleanup is automatically handled through registering drm_mode_config_cleanup + * with drmm_add_action(). + * + * Returns: 0 on success, negative error value on failure. */ -void drm_mode_config_init(struct drm_device *dev) +int drmm_mode_config_init(struct drm_device *dev) { mutex_init(&dev->mode_config.mutex); drm_modeset_lock_init(&dev->mode_config.connection_mutex); @@ -443,8 +454,11 @@ void drm_mode_config_init(struct drm_device *dev) drm_modeset_acquire_fini(&modeset_ctx); dma_resv_fini(&resv); } + + return drmm_add_action_or_reset(dev, drm_mode_config_init_release, + NULL); } -EXPORT_SYMBOL(drm_mode_config_init); +EXPORT_SYMBOL(drmm_mode_config_init);

/** * drm_mode_config_cleanup - free up DRM mode_config info @@ -456,6 +470,9 @@ EXPORT_SYMBOL(drm_mode_config_init); * Note that since this /should/ happen single-threaded at driver/device * teardown time, no locking is required. It's the driver's job to ensure that * this guarantee actually holds true. + * + * FIXME: With the managed drmm_mode_config_init() it is no longer necessary for + * drivers to explicitly call this function. */ void drm_mode_config_cleanup(struct drm_device *dev) { diff --git a/include/drm/drm_mode_config.h b/include/drm/drm_mode_config.h index 3bcbe30339f0..6c3ef49b46b3 100644 --- a/include/drm/drm_mode_config.h +++ b/include/drm/drm_mode_config.h @@ -929,7 +929,23 @@ struct drm_mode_config { const struct drm_mode_config_helper_funcs *helper_private; };

-void drm_mode_config_init(struct drm_device *dev); +int __must_check drmm_mode_config_init(struct drm_device *dev); + +/** + * drm_mode_config_init - DRM mode_configuration structure initialization + * @dev: DRM device + * + * This is the unmanaged version of drmm_mode_config_init() for drivers which + * still explicitly call drm_mode_config_cleanup(). + * + * FIXME: This function is deprecated and drivers should be converted over to + * drmm_mode_config_init(). + */ +static inline int drm_mode_config_init(struct drm_device *dev) +{ + return drmm_mode_config_init(dev); +} + void drm_mode_config_reset(struct drm_device *dev); void drm_mode_config_cleanup(struct drm_device *dev);

Instead rely on the automatic clean, for which we just need to check that drm_mode_config_init succeeded. To avoid an inversion in the cleanup we also have to move the dev_private allocation over to drmm_kzalloc.

This is made possible by a preceeding patch which added a drmm_ cleanup action to drm_mode_config_init(), hence all we need to do to ensure that drm_mode_config_cleanup() is run on final drm_device cleanup is check the new error code for _init().

v2: Explain why this cleanup is possible (Laurent).

v3: Use drmm_mode_config_init() for more clarity (Sam, Thomas)

Acked-by: Gerd Hoffmann kraxel@redhat.com Acked-by: Sam Ravnborg sam@ravnborg.org Cc: Sam Ravnborg sam@ravnborg.org Cc: Thomas Zimmermann tzimmermann@suse.de Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Gerd Hoffmann kraxel@redhat.com Cc: virtualization@lists.linux-foundation.org --- drivers/gpu/drm/bochs/bochs.h | 1 - drivers/gpu/drm/bochs/bochs_drv.c | 6 ++---- drivers/gpu/drm/bochs/bochs_kms.c | 14 +++++--------- 3 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/bochs/bochs.h b/drivers/gpu/drm/bochs/bochs.h index 917767173ee6..e5bd1d517a18 100644 --- a/drivers/gpu/drm/bochs/bochs.h +++ b/drivers/gpu/drm/bochs/bochs.h @@ -92,7 +92,6 @@ void bochs_mm_fini(struct bochs_device *bochs);

/* bochs_kms.c */ int bochs_kms_init(struct bochs_device *bochs); -void bochs_kms_fini(struct bochs_device *bochs);

/* bochs_fbdev.c */ extern const struct drm_mode_config_funcs bochs_mode_funcs; diff --git a/drivers/gpu/drm/bochs/bochs_drv.c b/drivers/gpu/drm/bochs/bochs_drv.c index addb0568c1af..e18c51de1196 100644 --- a/drivers/gpu/drm/bochs/bochs_drv.c +++ b/drivers/gpu/drm/bochs/bochs_drv.c @@ -7,6 +7,7 @@

#include <drm/drm_drv.h> #include <drm/drm_atomic_helper.h> +#include <drm/drm_managed.h>

#include "bochs.h"

@@ -21,10 +22,7 @@ static void bochs_unload(struct drm_device *dev) { struct bochs_device *bochs = dev->dev_private;

- bochs_kms_fini(bochs); bochs_mm_fini(bochs); - kfree(bochs); - dev->dev_private = NULL; }

static int bochs_load(struct drm_device *dev) @@ -32,7 +30,7 @@ static int bochs_load(struct drm_device *dev) struct bochs_device *bochs; int ret;

- bochs = kzalloc(sizeof(*bochs), GFP_KERNEL); + bochs = drmm_kzalloc(dev, sizeof(*bochs), GFP_KERNEL); if (bochs == NULL) return -ENOMEM; dev->dev_private = bochs; diff --git a/drivers/gpu/drm/bochs/bochs_kms.c b/drivers/gpu/drm/bochs/bochs_kms.c index e8cc8156d773..7f4bcfad87e9 100644 --- a/drivers/gpu/drm/bochs/bochs_kms.c +++ b/drivers/gpu/drm/bochs/bochs_kms.c @@ -134,7 +134,11 @@ const struct drm_mode_config_funcs bochs_mode_funcs = {

int bochs_kms_init(struct bochs_device *bochs) { - drm_mode_config_init(bochs->dev); + int ret; + + ret = drmm_mode_config_init(bochs->dev); + if (ret) + return ret;

bochs->dev->mode_config.max_width = 8192; bochs->dev->mode_config.max_height = 8192; @@ -160,11 +164,3 @@ int bochs_kms_init(struct bochs_device *bochs)

return 0; } - -void bochs_kms_fini(struct bochs_device *bochs) -{ - if (!bochs->dev->mode_config.num_connector) - return; - - drm_mode_config_cleanup(bochs->dev); -}

With the drm_device lifetime fun cleaned up there's nothing in the way anymore to use devm_ for everything hw releated. Do it, and in the process, throw out the entire onion unwinding.

Acked-by: Gerd Hoffmann kraxel@redhat.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Dave Airlie airlied@redhat.com Cc: Gerd Hoffmann kraxel@redhat.com Cc: Daniel Vetter daniel.vetter@ffwll.ch Cc: "Noralf Trønnes" noralf@tronnes.org Cc: Emil Velikov emil.velikov@collabora.com Cc: Thomas Zimmermann tzimmermann@suse.de Cc: virtualization@lists.linux-foundation.org --- drivers/gpu/drm/cirrus/cirrus.c | 44 +++++++++++---------------------- 1 file changed, 14 insertions(+), 30 deletions(-)

diff --git a/drivers/gpu/drm/cirrus/cirrus.c b/drivers/gpu/drm/cirrus/cirrus.c index bd8784ea9d64..a36269717c3b 100644 --- a/drivers/gpu/drm/cirrus/cirrus.c +++ b/drivers/gpu/drm/cirrus/cirrus.c @@ -558,7 +558,7 @@ static int cirrus_pci_probe(struct pci_dev *pdev, if (ret) return ret;

- ret = pci_enable_device(pdev); + ret = pcim_enable_device(pdev); if (ret) return ret;

@@ -569,39 +569,38 @@ static int cirrus_pci_probe(struct pci_dev *pdev, ret = -ENOMEM; cirrus = kzalloc(sizeof(*cirrus), GFP_KERNEL); if (cirrus == NULL) - goto err_pci_release; + return ret;

dev = &cirrus->dev; - ret = drm_dev_init(dev, &cirrus_driver, &pdev->dev); + ret = devm_drm_dev_init(&pdev->dev, dev, &cirrus_driver); if (ret) { kfree(cirrus); - goto err_pci_release; + return ret; } dev->dev_private = cirrus; drmm_add_final_kfree(dev, cirrus);

- ret = -ENOMEM; - cirrus->vram = ioremap(pci_resource_start(pdev, 0), - pci_resource_len(pdev, 0)); + cirrus->vram = devm_ioremap(&pdev->dev, pci_resource_start(pdev, 0), + pci_resource_len(pdev, 0)); if (cirrus->vram == NULL) - goto err_dev_put; + return -ENOMEM;

- cirrus->mmio = ioremap(pci_resource_start(pdev, 1), - pci_resource_len(pdev, 1)); + cirrus->mmio = devm_ioremap(&pdev->dev, pci_resource_start(pdev, 1), + pci_resource_len(pdev, 1)); if (cirrus->mmio == NULL) - goto err_unmap_vram; + return -ENOMEM;

ret = cirrus_mode_config_init(cirrus); if (ret) - goto err_cleanup; + return ret;

ret = cirrus_conn_init(cirrus); if (ret < 0) - goto err_cleanup; + return ret;

ret = cirrus_pipe_init(cirrus); if (ret < 0) - goto err_cleanup; + return ret;

drm_mode_config_reset(dev);

@@ -609,33 +608,18 @@ static int cirrus_pci_probe(struct pci_dev *pdev, pci_set_drvdata(pdev, dev); ret = drm_dev_register(dev, 0); if (ret) - goto err_cleanup; + return ret;

drm_fbdev_generic_setup(dev, dev->mode_config.preferred_depth); return 0; - -err_cleanup: - iounmap(cirrus->mmio); -err_unmap_vram: - iounmap(cirrus->vram); -err_dev_put: - drm_dev_put(dev); -err_pci_release: - pci_release_regions(pdev); - return ret; }

static void cirrus_pci_remove(struct pci_dev *pdev) { struct drm_device *dev = pci_get_drvdata(pdev); - struct cirrus_device *cirrus = dev->dev_private;

drm_dev_unplug(dev); drm_atomic_helper_shutdown(dev); - iounmap(cirrus->mmio); - iounmap(cirrus->vram); - drm_dev_put(dev); - pci_release_regions(pdev); }

static const struct pci_device_id pciidlist[] = {

Allows us to drop the drm_driver.release callback.

This is made possible by a preceeding patch which added a drmm_ cleanup action to drm_mode_config_init(), hence all we need to do to ensure that drm_mode_config_cleanup() is run on final drm_device cleanup is check the new error code for _init().

v2: Explain why this cleanup is possible (Laurent).

v3: Use drmm_mode_config_init() for more clarity (Sam, Thomas)

Acked-by: Sam Ravnborg sam@ravnborg.org Cc: Sam Ravnborg sam@ravnborg.org Cc: Thomas Zimmermann tzimmermann@suse.de Reviewed-by: Linus Walleij linus.walleij@linaro.org (v2) Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Linus Walleij linus.walleij@linaro.org --- drivers/gpu/drm/mcde/mcde_drv.c | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-)

diff --git a/drivers/gpu/drm/mcde/mcde_drv.c b/drivers/gpu/drm/mcde/mcde_drv.c index a543ebf3d541..03d2e1a00810 100644 --- a/drivers/gpu/drm/mcde/mcde_drv.c +++ b/drivers/gpu/drm/mcde/mcde_drv.c @@ -184,13 +184,13 @@ static int mcde_modeset_init(struct drm_device *drm) ret = drm_vblank_init(drm, 1); if (ret) { dev_err(drm->dev, "failed to init vblank\n"); - goto out_config; + return ret; }

ret = mcde_display_init(drm); if (ret) { dev_err(drm->dev, "failed to init display\n"); - goto out_config; + return ret; }

/* @@ -204,7 +204,7 @@ static int mcde_modeset_init(struct drm_device *drm) mcde->bridge); if (ret) { dev_err(drm->dev, "failed to attach display output bridge\n"); - goto out_config; + return ret; }

drm_mode_config_reset(drm); @@ -212,17 +212,6 @@ static int mcde_modeset_init(struct drm_device *drm) drm_fbdev_generic_setup(drm, 32);

return 0; - -out_config: - drm_mode_config_cleanup(drm); - return ret; -} - -static void mcde_release(struct drm_device *drm) -{ - struct mcde *mcde = drm->dev_private; - - drm_mode_config_cleanup(drm); }

DEFINE_DRM_GEM_CMA_FOPS(drm_fops); @@ -230,7 +219,6 @@ DEFINE_DRM_GEM_CMA_FOPS(drm_fops); static struct drm_driver mcde_drm_driver = { .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_ATOMIC, - .release = mcde_release, .lastclose = drm_fb_helper_lastclose, .ioctls = NULL, .fops = &drm_fops, @@ -258,7 +246,9 @@ static int mcde_drm_bind(struct device *dev) struct drm_device *drm = dev_get_drvdata(dev); int ret;

- drm_mode_config_init(drm); + ret = drmm_mode_config_init(drm); + if (ret) + return ret;

ret = component_bind_all(drm->dev, drm); if (ret) {

It's right above the drm_dev_put().

This is made possible by a preceeding patch which added a drmm_ cleanup action to drm_mode_config_init(), hence all we need to do to ensure that drm_mode_config_cleanup() is run on final drm_device cleanup is check the new error code for _init().

Aside: This driver gets its devm_ stuff all wrong wrt drm_device and anything hanging off that. Not the only one unfortunately.

v2: Explain why this cleanup is possible (Laurent).

v3: Use drmm_mode_config_init() for more clarity (Sam, Thomas)

Cc: Sam Ravnborg sam@ravnborg.org Cc: Thomas Zimmermann tzimmermann@suse.de Reviewed-by: Neil Armstrong narmstrong@baylibre.com (v2) Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Neil Armstrong narmstrong@baylibre.com Cc: Kevin Hilman khilman@baylibre.com Cc: linux-amlogic@lists.infradead.org Cc: linux-arm-kernel@lists.infradead.org --- drivers/gpu/drm/meson/meson_drv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c index b5f5eb7b4bb9..6f29fab79952 100644 --- a/drivers/gpu/drm/meson/meson_drv.c +++ b/drivers/gpu/drm/meson/meson_drv.c @@ -284,7 +284,9 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) /* Remove early framebuffers (ie. simplefb) */ meson_remove_framebuffers();

- drm_mode_config_init(drm); + ret = drmm_mode_config_init(drm); + if (ret) + goto free_drm; drm->mode_config.max_width = 3840; drm->mode_config.max_height = 2160; drm->mode_config.funcs = &meson_mode_config_funcs; @@ -379,7 +381,6 @@ static void meson_drv_unbind(struct device *dev) drm_dev_unregister(drm); drm_irq_uninstall(drm); drm_kms_helper_poll_fini(drm); - drm_mode_config_cleanup(drm); drm_dev_put(drm); }

It's right above the drm_dev_put().

This is made possible by a preceeding patch which added a drmm_ cleanup action to drm_mode_config_init(), hence all we need to do to ensure that drm_mode_config_cleanup() is run on final drm_device cleanup is check the new error code for _init().

Aside: Another driver with a bit much devm_kzalloc, which should probably use drmm_kzalloc instead ...

v2: Explain why this cleanup is possible (Laurent).

v3: Use drmm_mode_config_init() for more clarity (Sam, Thomas)

Cc: Sam Ravnborg sam@ravnborg.org Cc: Thomas Zimmermann tzimmermann@suse.de Reviewed-by: Laurent Pinchart laurent.pinchart@ideasonboard.com (v2) Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Cc: Kieran Bingham kieran.bingham+renesas@ideasonboard.com Cc: linux-renesas-soc@vger.kernel.org --- drivers/gpu/drm/rcar-du/rcar_du_drv.c | 1 - drivers/gpu/drm/rcar-du/rcar_du_kms.c | 4 +++- 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c index 654e2dd08146..3e67cf70f040 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c +++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c @@ -530,7 +530,6 @@ static int rcar_du_remove(struct platform_device *pdev) drm_dev_unregister(ddev);

drm_kms_helper_poll_fini(ddev); - drm_mode_config_cleanup(ddev);

drm_dev_put(ddev);

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c index fcfd916227d1..482329102f19 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c +++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c @@ -712,7 +712,9 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu) unsigned int i; int ret;

- drm_mode_config_init(dev); + ret = drmm_mode_config_init(dev); + if (ret) + return ret;

dev->mode_config.min_width = 0; dev->mode_config.min_height = 0;

It's right above the drm_dev_put().

This is made possible by a preceeding patch which added a drmm_ cleanup action to drm_mode_config_init(), hence all we need to do to ensure that drm_mode_config_cleanup() is run on final drm_device cleanup is check the new error code for _init().

Aside: Another driver with a bit much devm_kzalloc, which should probably use drmm_kzalloc instead ...

v2: Explain why this cleanup is possible (Laurent).

v3: Use drmm_mode_config_init() for more clarity (Sam, Thomas)

Cc: Sam Ravnborg sam@ravnborg.org Cc: Thomas Zimmermann tzimmermann@suse.de Acked-by: Sam Ravnborg sam@ravnborg.org Acked-by: Philippe Cornu philippe.cornu@st.com Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Yannick Fertre yannick.fertre@st.com Cc: Philippe Cornu philippe.cornu@st.com Cc: Benjamin Gaignard benjamin.gaignard@linaro.org Cc: Vincent Abriou vincent.abriou@st.com Cc: Maxime Coquelin mcoquelin.stm32@gmail.com Cc: Alexandre Torgue alexandre.torgue@st.com Cc: linux-stm32@st-md-mailman.stormreply.com Cc: linux-arm-kernel@lists.infradead.org --- drivers/gpu/drm/stm/drv.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/stm/drv.c b/drivers/gpu/drm/stm/drv.c index ea9fcbdc68b3..0f85dd86cafa 100644 --- a/drivers/gpu/drm/stm/drv.c +++ b/drivers/gpu/drm/stm/drv.c @@ -88,7 +88,9 @@ static int drv_load(struct drm_device *ddev)

ddev->dev_private = (void *)ldev;

- drm_mode_config_init(ddev); + ret = drmm_mode_config_init(ddev); + if (ret) + return ret;

/* * set max width and height as default value. @@ -103,7 +105,7 @@ static int drv_load(struct drm_device *ddev)

ret = ltdc_load(ddev); if (ret) - goto err; + return ret;

drm_mode_config_reset(ddev); drm_kms_helper_poll_init(ddev); @@ -111,9 +113,6 @@ static int drv_load(struct drm_device *ddev) platform_set_drvdata(pdev, ddev);

return 0; -err: - drm_mode_config_cleanup(ddev); - return ret; }

static void drv_unload(struct drm_device *ddev) @@ -122,7 +121,6 @@ static void drv_unload(struct drm_device *ddev)

drm_kms_helper_poll_fini(ddev); ltdc_unload(ddev); - drm_mode_config_cleanup(ddev); }

static __maybe_unused int drv_suspend(struct device *dev)

It's right above the drm_dev_put().

This is made possible by a preceeding patch which added a drmm_ cleanup action to drm_mode_config_init(), hence all we need to do to ensure that drm_mode_config_cleanup() is run on final drm_device cleanup is check the new error code for _init().

Aside: Another driver with a bit much devm_kzalloc, which should probably use drmm_kzalloc instead ...

v2: Explain why this cleanup is possible (Laurent).

v3: Use drmm_mode_config_init() for more clarity (Sam, Thomas)

Acked-by: Sam Ravnborg sam@ravnborg.org Cc: Sam Ravnborg sam@ravnborg.org Cc: Thomas Zimmermann tzimmermann@suse.de Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com --- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c index 0563c6813333..2eaa9080d250 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c @@ -162,7 +162,9 @@ static int mtk_drm_kms_init(struct drm_device *drm) } private->mutex_dev = &pdev->dev;

- drm_mode_config_init(drm); + ret = drmm_mode_config_init(drm); + if (ret) + return ret;

drm->mode_config.min_width = 64; drm->mode_config.min_height = 64; @@ -179,7 +181,7 @@ static int mtk_drm_kms_init(struct drm_device *drm)

ret = component_bind_all(drm->dev, drm); if (ret) - goto err_config_cleanup; + return ret;

/* * We currently support two fixed data streams, each optional, @@ -255,8 +257,6 @@ static int mtk_drm_kms_init(struct drm_device *drm) dma_dev->dma_parms = NULL; err_component_unbind: component_unbind_all(drm->dev, drm); -err_config_cleanup: - drm_mode_config_cleanup(drm);

return ret; } @@ -272,7 +272,6 @@ static void mtk_drm_kms_deinit(struct drm_device *drm) private->dma_dev->dma_parms = NULL;

component_unbind_all(drm->dev, drm); - drm_mode_config_cleanup(drm); }

static const struct file_operations mtk_drm_fops = {

It's right above the drm_dev_put().

This is made possible by a preceeding patch which added a drmm_ cleanup action to drm_mode_config_init(), hence all we need to do to ensure that drm_mode_config_cleanup() is run on final drm_device cleanup is check the new error code for _init().

Aside: Another driver with a bit much devm_kzalloc, which should probably use drmm_kzalloc instead ...

I'm pretty sure this one blows up already under KASAN because it's using devm_drm_dev_init, and later on devm_kzalloc. Hence the memory will get freed before the final drm_dev_put (all from the devres code), but the cleanup in that final drm_dev_put will access the just freed memory.

Unfortunately fixing this properly needs slightly more work, namely drmm_ versions for all the drm objects (planes, crtc, ...), so that the cleanup actually happens before even drmm_kzalloc would release the underlying memory. Not quite there yet.

v2: Explain why this cleanup is possible (Laurent).

v3: Use drmm_mode_config_init() for more clarity (Sam, Thomas)

Cc: Sam Ravnborg sam@ravnborg.org Cc: Thomas Zimmermann tzimmermann@suse.de Acked-by: Jyri Sarha jsarha@ti.com Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Jyri Sarha jsarha@ti.com Cc: Tomi Valkeinen tomi.valkeinen@ti.com --- drivers/gpu/drm/tidss/tidss_drv.c | 4 ---- drivers/gpu/drm/tidss/tidss_kms.c | 19 +++++-------------- drivers/gpu/drm/tidss/tidss_kms.h | 1 - 3 files changed, 5 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/tidss/tidss_drv.c b/drivers/gpu/drm/tidss/tidss_drv.c index 460d5e9d0cf4..ad449d104306 100644 --- a/drivers/gpu/drm/tidss/tidss_drv.c +++ b/drivers/gpu/drm/tidss/tidss_drv.c @@ -103,11 +103,7 @@ static const struct dev_pm_ops tidss_pm_ops = {

static void tidss_release(struct drm_device *ddev) { - struct tidss_device *tidss = ddev->dev_private; - drm_kms_helper_poll_fini(ddev); - - tidss_modeset_cleanup(tidss); }

DEFINE_DRM_GEM_CMA_FOPS(tidss_fops); diff --git a/drivers/gpu/drm/tidss/tidss_kms.c b/drivers/gpu/drm/tidss/tidss_kms.c index 7d419960b030..4bd339a467a4 100644 --- a/drivers/gpu/drm/tidss/tidss_kms.c +++ b/drivers/gpu/drm/tidss/tidss_kms.c @@ -258,7 +258,9 @@ int tidss_modeset_init(struct tidss_device *tidss)

dev_dbg(tidss->dev, "%s\n", __func__);

- drm_mode_config_init(ddev); + ret = drmm_mode_config_init(ddev); + if (ret) + return ret;

ddev->mode_config.min_width = 8; ddev->mode_config.min_height = 8; @@ -270,11 +272,11 @@ int tidss_modeset_init(struct tidss_device *tidss)

ret = tidss_dispc_modeset_init(tidss); if (ret) - goto err_mode_config_cleanup; + return ret;

ret = drm_vblank_init(ddev, tidss->num_crtcs); if (ret) - goto err_mode_config_cleanup; + return ret;

/* Start with vertical blanking interrupt reporting disabled. */ for (i = 0; i < tidss->num_crtcs; ++i) @@ -285,15 +287,4 @@ int tidss_modeset_init(struct tidss_device *tidss) dev_dbg(tidss->dev, "%s done\n", __func__);

return 0; - -err_mode_config_cleanup: - drm_mode_config_cleanup(ddev); - return ret; -} - -void tidss_modeset_cleanup(struct tidss_device *tidss) -{ - struct drm_device *ddev = &tidss->ddev; - - drm_mode_config_cleanup(ddev); } diff --git a/drivers/gpu/drm/tidss/tidss_kms.h b/drivers/gpu/drm/tidss/tidss_kms.h index dda5625d0128..99aaff099f22 100644 --- a/drivers/gpu/drm/tidss/tidss_kms.h +++ b/drivers/gpu/drm/tidss/tidss_kms.h @@ -10,6 +10,5 @@ struct tidss_device;

int tidss_modeset_init(struct tidss_device *tidss); -void tidss_modeset_cleanup(struct tidss_device *tidss);

#endif

Only drops the drm_dev_put, but hey a few lines!

Reviewed-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Hans de Goede hdegoede@redhat.com Cc: "Noralf Trønnes" noralf@tronnes.org --- drivers/gpu/drm/tiny/gm12u320.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/tiny/gm12u320.c b/drivers/gpu/drm/tiny/gm12u320.c index 3349f3c2a765..9fb579fc3412 100644 --- a/drivers/gpu/drm/tiny/gm12u320.c +++ b/drivers/gpu/drm/tiny/gm12u320.c @@ -678,7 +678,7 @@ static int gm12u320_usb_probe(struct usb_interface *interface, init_waitqueue_head(&gm12u320->fb_update.waitq);

dev = &gm12u320->dev; - ret = drm_dev_init(dev, &gm12u320_drm_driver, &interface->dev); + ret = devm_drm_dev_init(&interface->dev, dev, &gm12u320_drm_driver); if (ret) { kfree(gm12u320); return ret; @@ -688,7 +688,7 @@ static int gm12u320_usb_probe(struct usb_interface *interface,

ret = drmm_mode_config_init(dev); if (ret) - goto err_put; + return ret;

dev->mode_config.min_width = GM12U320_USER_WIDTH; dev->mode_config.max_width = GM12U320_USER_WIDTH; @@ -698,15 +698,15 @@ static int gm12u320_usb_probe(struct usb_interface *interface,

ret = gm12u320_usb_alloc(gm12u320); if (ret) - goto err_put; + return ret;

ret = gm12u320_set_ecomode(gm12u320); if (ret) - goto err_put; + return ret;

ret = gm12u320_conn_init(gm12u320); if (ret) - goto err_put; + return ret;

ret = drm_simple_display_pipe_init(&gm12u320->dev, &gm12u320->pipe, @@ -716,22 +716,18 @@ static int gm12u320_usb_probe(struct usb_interface *interface, gm12u320_pipe_modifiers, &gm12u320->conn); if (ret) - goto err_put; + return ret;

drm_mode_config_reset(dev);

usb_set_intfdata(interface, dev); ret = drm_dev_register(dev, 0); if (ret) - goto err_put; + return ret;

drm_fbdev_generic_setup(dev, 0);

return 0; - -err_put: - drm_dev_put(dev); - return ret; }

static void gm12u320_usb_disconnect(struct usb_interface *interface) @@ -741,7 +737,6 @@ static void gm12u320_usb_disconnect(struct usb_interface *interface)

gm12u320_stop_fb_update(gm12u320); drm_dev_unplug(dev); - drm_dev_put(dev); }

static __maybe_unused int gm12u320_suspend(struct usb_interface *interface,

Instead of having a work item that never stops (which really should be a kthread), with a dedicated workqueue to not upset anyone else, use a delayed work. A bunch of changes:

- We can throw out all the custom wakeup and requeue logic and state tracking. If we schedule the work with a 0 delay it'll get scheduled immediately.

- Persistent state (frame & draw_status_timeout) need to be moved out of the work.

- diff is bigger than the changes, biggest chunk is reindenting the work fn because it lost its while loop.

Lots of code deleting as consequence all over. Specifically we can delete the drm_driver.release code now!

v2: Review from Hans: - Use mod_delayed_work in the plane update path to make sure we do actually schedule immediately). In the worker we still want queue_delayed_work, which won't modify the timeout when the work is already scheduled. Which is exactly what we want if the work races with a plane update. - Switch to system_long_wq, Hans says on usb2 a plane upload can take 80 ms.

Reviewed-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Hans de Goede hdegoede@redhat.com Cc: "Noralf Trønnes" noralf@tronnes.org --- drivers/gpu/drm/tiny/gm12u320.c | 171 +++++++++++++------------------- 1 file changed, 68 insertions(+), 103 deletions(-)

diff --git a/drivers/gpu/drm/tiny/gm12u320.c b/drivers/gpu/drm/tiny/gm12u320.c index 9627cbc3ec64..6f0ea2827d62 100644 --- a/drivers/gpu/drm/tiny/gm12u320.c +++ b/drivers/gpu/drm/tiny/gm12u320.c @@ -89,13 +89,12 @@ struct gm12u320_device { unsigned char *cmd_buf; unsigned char *data_buf[GM12U320_BLOCK_COUNT]; struct { - bool run; - struct workqueue_struct *workq; - struct work_struct work; - wait_queue_head_t waitq; + struct delayed_work work; struct mutex lock; struct drm_framebuffer *fb; struct drm_rect rect; + int frame; + int draw_status_timeout; } fb_update; };

@@ -183,19 +182,9 @@ static int gm12u320_usb_alloc(struct gm12u320_device *gm12u320) data_block_footer, DATA_BLOCK_FOOTER_SIZE); }

- gm12u320->fb_update.workq = create_singlethread_workqueue(DRIVER_NAME); - if (!gm12u320->fb_update.workq) - return -ENOMEM; - return 0; }

-static void gm12u320_usb_free(struct gm12u320_device *gm12u320) -{ - if (gm12u320->fb_update.workq) - destroy_workqueue(gm12u320->fb_update.workq); -} - static int gm12u320_misc_request(struct gm12u320_device *gm12u320, u8 req_a, u8 req_b, u8 arg_a, u8 arg_b, u8 arg_c, u8 arg_d) @@ -338,80 +327,77 @@ static void gm12u320_copy_fb_to_blocks(struct gm12u320_device *gm12u320) static void gm12u320_fb_update_work(struct work_struct *work) { struct gm12u320_device *gm12u320 = - container_of(work, struct gm12u320_device, fb_update.work); - int draw_status_timeout = FIRST_FRAME_TIMEOUT; + container_of(to_delayed_work(work), struct gm12u320_device, + fb_update.work); int block, block_size, len; - int frame = 0; int ret = 0;

- while (gm12u320->fb_update.run) { - gm12u320_copy_fb_to_blocks(gm12u320); - - for (block = 0; block < GM12U320_BLOCK_COUNT; block++) { - if (block == GM12U320_BLOCK_COUNT - 1) - block_size = DATA_LAST_BLOCK_SIZE; - else - block_size = DATA_BLOCK_SIZE; - - /* Send data command to device */ - memcpy(gm12u320->cmd_buf, cmd_data, CMD_SIZE); - gm12u320->cmd_buf[8] = block_size & 0xff; - gm12u320->cmd_buf[9] = block_size >> 8; - gm12u320->cmd_buf[20] = 0xfc - block * 4; - gm12u320->cmd_buf[21] = block | (frame << 7); - - ret = usb_bulk_msg(gm12u320->udev, - usb_sndbulkpipe(gm12u320->udev, DATA_SND_EPT), - gm12u320->cmd_buf, CMD_SIZE, &len, - CMD_TIMEOUT); - if (ret || len != CMD_SIZE) - goto err; - - /* Send data block to device */ - ret = usb_bulk_msg(gm12u320->udev, - usb_sndbulkpipe(gm12u320->udev, DATA_SND_EPT), - gm12u320->data_buf[block], block_size, - &len, DATA_TIMEOUT); - if (ret || len != block_size) - goto err; - - /* Read status */ - ret = usb_bulk_msg(gm12u320->udev, - usb_rcvbulkpipe(gm12u320->udev, DATA_RCV_EPT), - gm12u320->cmd_buf, READ_STATUS_SIZE, &len, - CMD_TIMEOUT); - if (ret || len != READ_STATUS_SIZE) - goto err; - } + gm12u320_copy_fb_to_blocks(gm12u320); + + for (block = 0; block < GM12U320_BLOCK_COUNT; block++) { + if (block == GM12U320_BLOCK_COUNT - 1) + block_size = DATA_LAST_BLOCK_SIZE; + else + block_size = DATA_BLOCK_SIZE; + + /* Send data command to device */ + memcpy(gm12u320->cmd_buf, cmd_data, CMD_SIZE); + gm12u320->cmd_buf[8] = block_size & 0xff; + gm12u320->cmd_buf[9] = block_size >> 8; + gm12u320->cmd_buf[20] = 0xfc - block * 4; + gm12u320->cmd_buf[21] = + block | (gm12u320->fb_update.frame << 7);

- /* Send draw command to device */ - memcpy(gm12u320->cmd_buf, cmd_draw, CMD_SIZE); ret = usb_bulk_msg(gm12u320->udev, usb_sndbulkpipe(gm12u320->udev, DATA_SND_EPT), - gm12u320->cmd_buf, CMD_SIZE, &len, CMD_TIMEOUT); + gm12u320->cmd_buf, CMD_SIZE, &len, + CMD_TIMEOUT); if (ret || len != CMD_SIZE) goto err;

+ /* Send data block to device */ + ret = usb_bulk_msg(gm12u320->udev, + usb_sndbulkpipe(gm12u320->udev, DATA_SND_EPT), + gm12u320->data_buf[block], block_size, + &len, DATA_TIMEOUT); + if (ret || len != block_size) + goto err; + /* Read status */ ret = usb_bulk_msg(gm12u320->udev, usb_rcvbulkpipe(gm12u320->udev, DATA_RCV_EPT), gm12u320->cmd_buf, READ_STATUS_SIZE, &len, - draw_status_timeout); + CMD_TIMEOUT); if (ret || len != READ_STATUS_SIZE) goto err; - - draw_status_timeout = CMD_TIMEOUT; - frame = !frame; - - /* - * We must draw a frame every 2s otherwise the projector - * switches back to showing its logo. - */ - wait_event_timeout(gm12u320->fb_update.waitq, - !gm12u320->fb_update.run || - gm12u320->fb_update.fb != NULL, - IDLE_TIMEOUT); } + + /* Send draw command to device */ + memcpy(gm12u320->cmd_buf, cmd_draw, CMD_SIZE); + ret = usb_bulk_msg(gm12u320->udev, + usb_sndbulkpipe(gm12u320->udev, DATA_SND_EPT), + gm12u320->cmd_buf, CMD_SIZE, &len, CMD_TIMEOUT); + if (ret || len != CMD_SIZE) + goto err; + + /* Read status */ + ret = usb_bulk_msg(gm12u320->udev, + usb_rcvbulkpipe(gm12u320->udev, DATA_RCV_EPT), + gm12u320->cmd_buf, READ_STATUS_SIZE, &len, + gm12u320->fb_update.draw_status_timeout); + if (ret || len != READ_STATUS_SIZE) + goto err; + + gm12u320->fb_update.draw_status_timeout = CMD_TIMEOUT; + gm12u320->fb_update.frame = !gm12u320->fb_update.frame; + + /* + * We must draw a frame every 2s otherwise the projector + * switches back to showing its logo. + */ + queue_delayed_work(system_long_wq, &gm12u320->fb_update.work, + IDLE_TIMEOUT); + return; err: /* Do not log errors caused by module unload or device unplug */ @@ -446,36 +432,24 @@ static void gm12u320_fb_mark_dirty(struct drm_framebuffer *fb, mutex_unlock(&gm12u320->fb_update.lock);

if (wakeup) - wake_up(&gm12u320->fb_update.waitq); + mod_delayed_work(system_long_wq, &gm12u320->fb_update.work, 0);

if (old_fb) drm_framebuffer_put(old_fb); }

-static void gm12u320_start_fb_update(struct gm12u320_device *gm12u320) -{ - mutex_lock(&gm12u320->fb_update.lock); - gm12u320->fb_update.run = true; - mutex_unlock(&gm12u320->fb_update.lock); - - queue_work(gm12u320->fb_update.workq, &gm12u320->fb_update.work); -} - static void gm12u320_stop_fb_update(struct gm12u320_device *gm12u320) { - mutex_lock(&gm12u320->fb_update.lock); - gm12u320->fb_update.run = false; - mutex_unlock(&gm12u320->fb_update.lock); + struct drm_framebuffer *old_fb;

- wake_up(&gm12u320->fb_update.waitq); - cancel_work_sync(&gm12u320->fb_update.work); + cancel_delayed_work_sync(&gm12u320->fb_update.work);

mutex_lock(&gm12u320->fb_update.lock); - if (gm12u320->fb_update.fb) { - drm_framebuffer_put(gm12u320->fb_update.fb); - gm12u320->fb_update.fb = NULL; - } + old_fb = gm12u320->fb_update.fb; + gm12u320->fb_update.fb = NULL; mutex_unlock(&gm12u320->fb_update.lock); + + drm_framebuffer_put(old_fb); }

static int gm12u320_set_ecomode(struct gm12u320_device *gm12u320) @@ -583,11 +557,11 @@ static void gm12u320_pipe_enable(struct drm_simple_display_pipe *pipe, struct drm_crtc_state *crtc_state, struct drm_plane_state *plane_state) { - struct gm12u320_device *gm12u320 = pipe->crtc.dev->dev_private; struct drm_rect rect = { 0, 0, GM12U320_USER_WIDTH, GM12U320_HEIGHT }; + struct gm12u320_device *gm12u320 = pipe->crtc.dev->dev_private;

+ gm12u320->fb_update.draw_status_timeout = FIRST_FRAME_TIMEOUT; gm12u320_fb_mark_dirty(plane_state->fb, &rect); - gm12u320_start_fb_update(gm12u320); }

static void gm12u320_pipe_disable(struct drm_simple_display_pipe *pipe) @@ -622,13 +596,6 @@ static const uint64_t gm12u320_pipe_modifiers[] = { DRM_FORMAT_MOD_INVALID };

-static void gm12u320_driver_release(struct drm_device *dev) -{ - struct gm12u320_device *gm12u320 = dev->dev_private; - - gm12u320_usb_free(gm12u320); -} - DEFINE_DRM_GEM_FOPS(gm12u320_fops);

static struct drm_driver gm12u320_drm_driver = { @@ -640,7 +607,6 @@ static struct drm_driver gm12u320_drm_driver = { .major = DRIVER_MAJOR, .minor = DRIVER_MINOR,

- .release = gm12u320_driver_release, .fops = &gm12u320_fops, DRM_GEM_SHMEM_DRIVER_OPS, }; @@ -670,9 +636,8 @@ static int gm12u320_usb_probe(struct usb_interface *interface, return -ENOMEM;

gm12u320->udev = interface_to_usbdev(interface); - INIT_WORK(&gm12u320->fb_update.work, gm12u320_fb_update_work); + INIT_DELAYED_WORK(&gm12u320->fb_update.work, gm12u320_fb_update_work); mutex_init(&gm12u320->fb_update.lock); - init_waitqueue_head(&gm12u320->fb_update.waitq);

dev = &gm12u320->dev; ret = devm_drm_dev_init(&interface->dev, dev, &gm12u320_drm_driver);

7/7 drivers agree that's the right choice, let's do this.

This avoids duplicating the same old error checking code over all 7 drivers, which is the motivation here.

Acked-by: Sam Ravnborg sam@ravnborg.org Reviewed-by: Noralf Trønnes noralf@tronnes.org Tested-by: Noralf Trønnes noralf@tronnes.org Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Maarten Lankhorst maarten.lankhorst@linux.intel.com Cc: Maxime Ripard mripard@kernel.org Cc: Thomas Zimmermann tzimmermann@suse.de Cc: David Airlie airlied@linux.ie Cc: Daniel Vetter daniel@ffwll.ch Cc: Eric Anholt eric@anholt.net Cc: David Lechner david@lechnology.com Cc: Kamlesh Gurudasani kamlesh.gurudasani@gmail.com Cc: "Noralf Trønnes" noralf@tronnes.org Cc: Sam Ravnborg sam@ravnborg.org --- drivers/gpu/drm/drm_mipi_dbi.c | 4 ++++ drivers/gpu/drm/tiny/hx8357d.c | 2 -- drivers/gpu/drm/tiny/ili9225.c | 2 -- drivers/gpu/drm/tiny/ili9341.c | 2 -- drivers/gpu/drm/tiny/ili9486.c | 2 -- drivers/gpu/drm/tiny/mi0283qt.c | 2 -- drivers/gpu/drm/tiny/st7586.c | 2 -- drivers/gpu/drm/tiny/st7735r.c | 2 -- 8 files changed, 4 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/drm_mipi_dbi.c b/drivers/gpu/drm/drm_mipi_dbi.c index 44de8502a472..bef93191882c 100644 --- a/drivers/gpu/drm/drm_mipi_dbi.c +++ b/drivers/gpu/drm/drm_mipi_dbi.c @@ -511,6 +511,10 @@ int mipi_dbi_dev_init_with_formats(struct mipi_dbi_dev *dbidev, if (!dbidev->dbi.command) return -EINVAL;

+ ret = drm_mode_config_init(drm); + if (ret) + return ret; + dbidev->tx_buf = devm_kmalloc(drm->dev, tx_buf_size, GFP_KERNEL); if (!dbidev->tx_buf) return -ENOMEM; diff --git a/drivers/gpu/drm/tiny/hx8357d.c b/drivers/gpu/drm/tiny/hx8357d.c index 42bc5dadcb1c..c88b84366dc5 100644 --- a/drivers/gpu/drm/tiny/hx8357d.c +++ b/drivers/gpu/drm/tiny/hx8357d.c @@ -239,8 +239,6 @@ static int hx8357d_probe(struct spi_device *spi) } drmm_add_final_kfree(drm, dbidev);

- drm_mode_config_init(drm); - dc = devm_gpiod_get(dev, "dc", GPIOD_OUT_LOW); if (IS_ERR(dc)) { DRM_DEV_ERROR(dev, "Failed to get gpio 'dc'\n"); diff --git a/drivers/gpu/drm/tiny/ili9225.c b/drivers/gpu/drm/tiny/ili9225.c index aae88dc5b3f7..fa998a16026c 100644 --- a/drivers/gpu/drm/tiny/ili9225.c +++ b/drivers/gpu/drm/tiny/ili9225.c @@ -390,8 +390,6 @@ static int ili9225_probe(struct spi_device *spi) } drmm_add_final_kfree(drm, dbidev);

- drm_mode_config_init(drm); - dbi->reset = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH); if (IS_ERR(dbi->reset)) { DRM_DEV_ERROR(dev, "Failed to get gpio 'reset'\n"); diff --git a/drivers/gpu/drm/tiny/ili9341.c b/drivers/gpu/drm/tiny/ili9341.c index 7d40cb4ff72b..945e15169866 100644 --- a/drivers/gpu/drm/tiny/ili9341.c +++ b/drivers/gpu/drm/tiny/ili9341.c @@ -197,8 +197,6 @@ static int ili9341_probe(struct spi_device *spi) } drmm_add_final_kfree(drm, dbidev);

- drm_mode_config_init(drm); - dbi->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH); if (IS_ERR(dbi->reset)) { DRM_DEV_ERROR(dev, "Failed to get gpio 'reset'\n"); diff --git a/drivers/gpu/drm/tiny/ili9486.c b/drivers/gpu/drm/tiny/ili9486.c index 9515eed2625c..bf29b225d23a 100644 --- a/drivers/gpu/drm/tiny/ili9486.c +++ b/drivers/gpu/drm/tiny/ili9486.c @@ -211,8 +211,6 @@ static int ili9486_probe(struct spi_device *spi) } drmm_add_final_kfree(drm, dbidev);

- drm_mode_config_init(drm); - dbi->reset = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH); if (IS_ERR(dbi->reset)) { DRM_DEV_ERROR(dev, "Failed to get gpio 'reset'\n"); diff --git a/drivers/gpu/drm/tiny/mi0283qt.c b/drivers/gpu/drm/tiny/mi0283qt.c index 8555a56bce8c..b8c973bc2347 100644 --- a/drivers/gpu/drm/tiny/mi0283qt.c +++ b/drivers/gpu/drm/tiny/mi0283qt.c @@ -201,8 +201,6 @@ static int mi0283qt_probe(struct spi_device *spi) } drmm_add_final_kfree(drm, dbidev);

- drm_mode_config_init(drm); - dbi->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH); if (IS_ERR(dbi->reset)) { DRM_DEV_ERROR(dev, "Failed to get gpio 'reset'\n"); diff --git a/drivers/gpu/drm/tiny/st7586.c b/drivers/gpu/drm/tiny/st7586.c index 427c2561f5f4..1f1a576be93c 100644 --- a/drivers/gpu/drm/tiny/st7586.c +++ b/drivers/gpu/drm/tiny/st7586.c @@ -331,8 +331,6 @@ static int st7586_probe(struct spi_device *spi) } drmm_add_final_kfree(drm, dbidev);

- drm_mode_config_init(drm); - bufsize = (st7586_mode.vdisplay + 2) / 3 * st7586_mode.hdisplay;

dbi->reset = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH); diff --git a/drivers/gpu/drm/tiny/st7735r.c b/drivers/gpu/drm/tiny/st7735r.c index b447235c3d47..0f48a5a2d3d7 100644 --- a/drivers/gpu/drm/tiny/st7735r.c +++ b/drivers/gpu/drm/tiny/st7735r.c @@ -212,8 +212,6 @@ static int st7735r_probe(struct spi_device *spi) } drmm_add_final_kfree(drm, dbidev);

- drm_mode_config_init(drm); - dbi->reset = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH); if (IS_ERR(dbi->reset)) { DRM_DEV_ERROR(dev, "Failed to get gpio 'reset'\n");

It's right above the drm_dev_put().

This allows us to delete a bit of onion unwinding in udl_modeset_init().

This is made possible by a preceeding patch which added a drmm_ cleanup action to drm_mode_config_init(), hence all we need to do to ensure that drm_mode_config_cleanup() is run on final drm_device cleanup is check the new error code for _init().

v2: Explain why this cleanup is possible (Laurent).

v3: Use drmm_mode_config_init() for more clarity (Sam, Thomas)

Cc: Sam Ravnborg sam@ravnborg.org Cc: Thomas Zimmermann tzimmermann@suse.de Acked-by: Sam Ravnborg sam@ravnborg.org Cc: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Dave Airlie airlied@redhat.com Cc: Sean Paul sean@poorly.run Cc: Daniel Vetter daniel.vetter@ffwll.ch Cc: Thomas Zimmermann tzimmermann@suse.de Cc: Emil Velikov emil.l.velikov@gmail.com Cc: Gerd Hoffmann kraxel@redhat.com Cc: "Noralf Trønnes" noralf@tronnes.org Cc: Thomas Gleixner tglx@linutronix.de Cc: Sam Ravnborg sam@ravnborg.org --- drivers/gpu/drm/udl/udl_drv.c | 1 - drivers/gpu/drm/udl/udl_drv.h | 1 - drivers/gpu/drm/udl/udl_modeset.c | 21 ++++++--------------- 3 files changed, 6 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c index 8b78c356beb5..b447fb053e78 100644 --- a/drivers/gpu/drm/udl/udl_drv.c +++ b/drivers/gpu/drm/udl/udl_drv.c @@ -37,7 +37,6 @@ DEFINE_DRM_GEM_FOPS(udl_driver_fops); static void udl_driver_release(struct drm_device *dev) { udl_fini(dev); - udl_modeset_cleanup(dev); }

static struct drm_driver driver = { diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h index e67227c44cc4..1de7eb1b6aac 100644 --- a/drivers/gpu/drm/udl/udl_drv.h +++ b/drivers/gpu/drm/udl/udl_drv.h @@ -68,7 +68,6 @@ struct udl_device {

/* modeset */ int udl_modeset_init(struct drm_device *dev); -void udl_modeset_cleanup(struct drm_device *dev); struct drm_connector *udl_connector_init(struct drm_device *dev);

struct urb *udl_get_urb(struct drm_device *dev); diff --git a/drivers/gpu/drm/udl/udl_modeset.c b/drivers/gpu/drm/udl/udl_modeset.c index d59ebac70b15..8cad01f3d163 100644 --- a/drivers/gpu/drm/udl/udl_modeset.c +++ b/drivers/gpu/drm/udl/udl_modeset.c @@ -468,7 +468,9 @@ int udl_modeset_init(struct drm_device *dev) struct drm_connector *connector; int ret;

- drm_mode_config_init(dev); + ret = drmm_mode_config_init(dev); + if (ret) + return ret;

dev->mode_config.min_width = 640; dev->mode_config.min_height = 480; @@ -482,10 +484,8 @@ int udl_modeset_init(struct drm_device *dev) dev->mode_config.funcs = &udl_mode_funcs;

connector = udl_connector_init(dev); - if (IS_ERR(connector)) { - ret = PTR_ERR(connector); - goto err_drm_mode_config_cleanup; - } + if (IS_ERR(connector)) + return PTR_ERR(connector);

format_count = ARRAY_SIZE(udl_simple_display_pipe_formats);

@@ -494,18 +494,9 @@ int udl_modeset_init(struct drm_device *dev) udl_simple_display_pipe_formats, format_count, NULL, connector); if (ret) - goto err_drm_mode_config_cleanup; + return ret;

drm_mode_config_reset(dev);

return 0; - -err_drm_mode_config_cleanup: - drm_mode_config_cleanup(dev); - return ret; -} - -void udl_modeset_cleanup(struct drm_device *dev) -{ - drm_mode_config_cleanup(dev); }

There's only two functions called from that: drm_kms_helper_poll_fini() and udl_free_urb_list(). Both of these are also called from the ubs_driver->disconnect hook, so entirely pointless to do the same again in the ->release hook.

Furthermore by the time we clean up the drm_driver we really shouldn't be touching hardware anymore, so stopping the poll worker and freeing the urb allocations in ->disconnect is the right thing to do.

Now disconnect still cleans things up before unregistering the driver, but that's a different issue.

v2: Use _fini, not _disable in unplug, motivated by discussions with Thomas. _disable/_enable are for suspend/resume.

Acked-by: Thomas Zimmermann tzimmermann@suse.de Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Dave Airlie airlied@redhat.com Cc: Sean Paul sean@poorly.run Cc: Daniel Vetter daniel.vetter@ffwll.ch Cc: Thomas Zimmermann tzimmermann@suse.de Cc: Emil Velikov emil.l.velikov@gmail.com Cc: Gerd Hoffmann kraxel@redhat.com Cc: "Noralf Trønnes" noralf@tronnes.org Cc: Sam Ravnborg sam@ravnborg.org Cc: Thomas Gleixner tglx@linutronix.de Cc: Alex Deucher alexander.deucher@amd.com --- drivers/gpu/drm/udl/udl_drv.c | 8 +------- drivers/gpu/drm/udl/udl_drv.h | 1 - drivers/gpu/drm/udl/udl_main.c | 10 ---------- 3 files changed, 1 insertion(+), 18 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c index b447fb053e78..1ce2d865c36d 100644 --- a/drivers/gpu/drm/udl/udl_drv.c +++ b/drivers/gpu/drm/udl/udl_drv.c @@ -34,14 +34,8 @@ static int udl_usb_resume(struct usb_interface *interface)

DEFINE_DRM_GEM_FOPS(udl_driver_fops);

-static void udl_driver_release(struct drm_device *dev) -{ - udl_fini(dev); -} - static struct drm_driver driver = { .driver_features = DRIVER_ATOMIC | DRIVER_GEM | DRIVER_MODESET, - .release = udl_driver_release,

/* gem hooks */ .gem_create_object = udl_driver_gem_create_object, @@ -120,7 +114,7 @@ static void udl_usb_disconnect(struct usb_interface *interface) { struct drm_device *dev = usb_get_intfdata(interface);

- drm_kms_helper_poll_disable(dev); + drm_kms_helper_poll_fini(dev); udl_drop_usb(dev); drm_dev_unplug(dev); drm_dev_put(dev); diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h index 1de7eb1b6aac..2642f94a63fc 100644 --- a/drivers/gpu/drm/udl/udl_drv.h +++ b/drivers/gpu/drm/udl/udl_drv.h @@ -76,7 +76,6 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len); void udl_urb_completion(struct urb *urb);

int udl_init(struct udl_device *udl); -void udl_fini(struct drm_device *dev);

int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr, const char *front, char **urb_buf_ptr, diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c index 538718919916..f5d27f2a5654 100644 --- a/drivers/gpu/drm/udl/udl_main.c +++ b/drivers/gpu/drm/udl/udl_main.c @@ -351,13 +351,3 @@ int udl_drop_usb(struct drm_device *dev) udl_free_urb_list(dev); return 0; } - -void udl_fini(struct drm_device *dev) -{ - struct udl_device *udl = to_udl(dev); - - drm_kms_helper_poll_fini(dev); - - if (udl->urbs.count) - udl_free_urb_list(dev); -}