* [PATCH v8 1/8] drm/managed: implement managed versions of kzalloc_obj/objs()
2026-07-23 0:31 [PATCH v8 0/8] drm: writeback: clean up writeback connector initialization John Harrison
@ 2026-07-23 0:31 ` John Harrison
2026-07-23 0:31 ` [PATCH v8 2/8] drm/amd/display: use drmm allocation for writeback connector John Harrison
` (6 subsequent siblings)
7 siblings, 0 replies; 13+ messages in thread
From: John Harrison @ 2026-07-23 0:31 UTC (permalink / raw)
To: dri-devel; +Cc: kernel-dev, Dmitry Baryshkov
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
The kzalloc_obj() and kzalloc_objs() functions have proven to be
useful and are widely used by the reset of the kernel. Implement
drm_device-managed versions of those macros to mix the nice interface
with the automatic freeing of the pointers.
Note: the original macros accept optional GFP_foo arguments. They are
skipped for now, making all allocations use GFP_KERNEL. If necessary,
support for overriding the GFP type can be introduced later.
v2: Made use of 'p' vs 'P' consistent, add typecast of returned pointer.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: John Harrison <John.Harrison@Igalia.com>
Reviewed-by: John Harrison <John.Harrison@Igalia.com>
---
include/drm/drm_managed.h | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/include/drm/drm_managed.h b/include/drm/drm_managed.h
index 72d0d68be226..4614d49748cf 100644
--- a/include/drm/drm_managed.h
+++ b/include/drm/drm_managed.h
@@ -105,6 +105,29 @@ static inline void *drmm_kcalloc(struct drm_device *dev,
return drmm_kmalloc_array(dev, n, size, flags | __GFP_ZERO);
}
+/**
+ * drmm_kzalloc_objs - &drm_device-managed kzalloc_objs()
+ * @dev: DRM device
+ * @P: Variable or type to allocate an array of
+ * @count: How many elements in the array
+ *
+ * Returns: newly allocated pointer to the zeroed array of @P on success, or
+ * NULL on failure.
+ */
+#define drmm_kzalloc_objs(dev, P, count) \
+ ((typeof(P) *) drmm_kcalloc(dev, count, sizeof(typeof(P)), GFP_KERNEL))
+
+/**
+ * drmm_kzalloc_obj - &drm_device-managed kzalloc_obj()
+ * @dev: DRM device
+ * @P: Variable or type to allocate
+ *
+ * Returns: newly allocated pointer to zeroed instance of @P on success,
+ * or NULL on failure.
+ */
+#define drmm_kzalloc_obj(dev, P) \
+ drmm_kzalloc_objs(dev, P, 1)
+
char *drmm_kstrdup(struct drm_device *dev, const char *s, gfp_t gfp);
void drmm_kfree(struct drm_device *dev, void *data);
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH v8 2/8] drm/amd/display: use drmm allocation for writeback connector
2026-07-23 0:31 [PATCH v8 0/8] drm: writeback: clean up writeback connector initialization John Harrison
2026-07-23 0:31 ` [PATCH v8 1/8] drm/managed: implement managed versions of kzalloc_obj/objs() John Harrison
@ 2026-07-23 0:31 ` John Harrison
2026-07-23 0:54 ` sashiko-bot
2026-07-23 0:31 ` [PATCH v8 3/8] drm/amd/display: use drmm_writeback_connector_init() John Harrison
` (5 subsequent siblings)
7 siblings, 1 reply; 13+ messages in thread
From: John Harrison @ 2026-07-23 0:31 UTC (permalink / raw)
To: dri-devel; +Cc: kernel-dev, Dmitry Baryshkov, Christophe JAILLET, Alex Hung
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Currently memory used for writeback connectors isn't freed on driver
unbinding, leaking the memory. Use drm_device-memory allocation
function for the writeback connector, making sure that the memory is
freed on the driver unbinding.
v2: Fix missing parameter.
v3: Drop drmm_kfree in error path as unnecessary and causes problems
with dangling clean up code.
Reported-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Suggested-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: John Harrison <John.Harrison@Igalia.com>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index e7080880b221..9c49374a2cbb 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -96,6 +96,7 @@
#include <drm/drm_fourcc.h>
#include <drm/drm_edid.h>
#include <drm/drm_eld.h>
+#include <drm/drm_managed.h>
#include <drm/drm_mode.h>
#include <drm/drm_utils.h>
#include <drm/drm_vblank.h>
@@ -2621,7 +2622,7 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev)
link = dc_get_link_at_index(dm->dc, i);
if (link->connector_signal == SIGNAL_TYPE_VIRTUAL) {
- struct amdgpu_dm_wb_connector *wbcon = kzalloc_obj(*wbcon);
+ struct amdgpu_dm_wb_connector *wbcon = drmm_kzalloc_obj(adev_to_drm(adev), *wbcon);
if (!wbcon) {
drm_err(adev_to_drm(adev), "KMS: Failed to allocate writeback connector\n");
@@ -2630,7 +2631,6 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev)
if (amdgpu_dm_wb_connector_init(dm, wbcon, i)) {
drm_err(adev_to_drm(adev), "KMS: Failed to initialize writeback connector\n");
- kfree(wbcon);
continue;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH v8 2/8] drm/amd/display: use drmm allocation for writeback connector
2026-07-23 0:31 ` [PATCH v8 2/8] drm/amd/display: use drmm allocation for writeback connector John Harrison
@ 2026-07-23 0:54 ` sashiko-bot
0 siblings, 0 replies; 13+ messages in thread
From: sashiko-bot @ 2026-07-23 0:54 UTC (permalink / raw)
To: John Harrison; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] Double-free and Use-After-Free of `aencoder` and `aconnector` objects in the error path of `amdgpu_dm_initialize_drm_device`.
--
--- Patch [2]: [PATCH v8 2/8] drm/amd/display: use drmm allocation for writeback connector ---
commit eb7f6e488f88ce78a34b3146c10bca2e0792ad3e
Author: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
drm/amd/display: use drmm allocation for writeback connector
Currently memory used for writeback connectors isn't freed on driver
unbinding, leaking the memory. Use drm_device-memory allocation
function for the writeback connector, making sure that the memory is
freed on the driver unbinding.
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> index f8d8132ea50ed..289da9d00b056 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
[ ... ]
> @@ -2621,7 +2622,7 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev)
> link = dc_get_link_at_index(dm->dc, i);
>
> if (link->connector_signal == SIGNAL_TYPE_VIRTUAL) {
> - struct amdgpu_dm_wb_connector *wbcon = kzalloc_obj(*wbcon);
> + struct amdgpu_dm_wb_connector *wbcon = drmm_kzalloc_obj(adev_to_drm(adev), *wbcon);
>
> if (!wbcon) {
> drm_err(adev_to_drm(adev), "KMS: Failed to allocate writeback connector\n");
> @@ -2630,7 +2631,6 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev)
>
> if (amdgpu_dm_wb_connector_init(dm, wbcon, i)) {
> drm_err(adev_to_drm(adev), "KMS: Failed to initialize writeback connector\n");
> - kfree(wbcon);
> continue;
> }
[ ... ]
> return 0;
> fail:
> kfree(aencoder);
> kfree(aconnector);
[Severity: High]
This isn't a bug introduced by this patch, but could this error path lead to a
use-after-free and double-free?
If amdgpu_dm_encoder_init() succeeds, it registers aencoder into the
device's encoder list. If a failure occurs later (for example, in
amdgpu_dm_connector_init() or when registering IRQ handlers), the code jumps
to the fail label and unconditionally calls kfree(aencoder) without
unregistering it.
Additionally, if an allocation fails in a subsequent loop iteration:
aconnector = kzalloc_obj(*aconnector);
if (!aconnector)
goto fail;
The aencoder pointer still holds the successfully registered object from
the previous iteration, which is then erroneously freed again.
When the device initialization fails, the DRM subsystem tears down the device
via drm_mode_config_cleanup(), which iterates over the encoder and connector
lists and calls their destroy callbacks. These callbacks will dereference the
previously freed memory (use-after-free) and call kfree() on it again
(double-free).
Would it be safer to update this error path to clean up properly, or perhaps
use drmm_ managed allocations for these objects as well?
>
> return -EINVAL;
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260723003205.330362-1-John.Harrison@Igalia.com?part=2
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH v8 3/8] drm/amd/display: use drmm_writeback_connector_init()
2026-07-23 0:31 [PATCH v8 0/8] drm: writeback: clean up writeback connector initialization John Harrison
2026-07-23 0:31 ` [PATCH v8 1/8] drm/managed: implement managed versions of kzalloc_obj/objs() John Harrison
2026-07-23 0:31 ` [PATCH v8 2/8] drm/amd/display: use drmm allocation for writeback connector John Harrison
@ 2026-07-23 0:31 ` John Harrison
2026-07-23 0:53 ` sashiko-bot
2026-07-23 0:31 ` [PATCH v8 4/8] drm/komeda: " John Harrison
` (4 subsequent siblings)
7 siblings, 1 reply; 13+ messages in thread
From: John Harrison @ 2026-07-23 0:31 UTC (permalink / raw)
To: dri-devel; +Cc: kernel-dev, Dmitry Baryshkov, Louis Chauvet, Suraj Kandpal
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
The driver uses drm_writeback_connector_init() instead of its drmm
counterpart, but it doesn't perform the job queue cleanup (neither
manually nor by calling drm_writeback_connector_cleanup()). On the
contrary, the drmm_writeback_connector_init() function ensures the
proper cleanup of the job queue.
Use drmm_plain_encoder_alloc() to allocate simple encoder and
drmm_writeback_connector_init() in order to initialize writeback
connector instance.
v2: Update KUnit selftest to match
Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: John Harrison <John.Harrison@Igalia.com>
---
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
.../drm/amd/display/amdgpu_dm/amdgpu_dm_wb.c | 18 +++++++++++++-----
.../amdgpu_dm/tests/amdgpu_dm_wb_test.c | 2 --
3 files changed, 14 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 9c49374a2cbb..0e79374937ea 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5048,7 +5048,7 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm,
return;
}
- acrtc = to_amdgpu_crtc(wb_conn->encoder.crtc);
+ acrtc = to_amdgpu_crtc(crtc_state->base.crtc);
if (!acrtc) {
drm_err(adev_to_drm(adev), "no amdgpu_crtc found\n");
kfree(wb_info);
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_wb.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_wb.c
index 9e7bad4d6ed0..2bb86218e80b 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_wb.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_wb.c
@@ -178,7 +178,6 @@ static const struct drm_encoder_helper_funcs amdgpu_dm_wb_encoder_helper_funcs =
static const struct drm_connector_funcs amdgpu_dm_wb_connector_funcs = {
.fill_modes = drm_helper_probe_single_connector_modes,
- .destroy = drm_connector_cleanup,
.reset = amdgpu_dm_connector_funcs_reset,
.atomic_duplicate_state = amdgpu_dm_connector_atomic_duplicate_state,
.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
@@ -197,17 +196,26 @@ int amdgpu_dm_wb_connector_init(struct amdgpu_display_manager *dm,
struct dc *dc = dm->dc;
struct dc_link *link = dc_get_link_at_index(dc, link_index);
int res;
+ struct drm_encoder *encoder;
+
+ encoder = drmm_plain_encoder_alloc(&dm->adev->ddev, NULL,
+ DRM_MODE_ENCODER_VIRTUAL, NULL);
+ if (IS_ERR(encoder))
+ return PTR_ERR(encoder);
+
+ drm_encoder_helper_add(encoder, &amdgpu_dm_wb_encoder_helper_funcs);
+
+ encoder->possible_crtcs = amdgpu_dm_get_encoder_crtc_mask(dm->adev);
wbcon->link = link;
drm_connector_helper_add(&wbcon->base.base, &amdgpu_dm_wb_conn_helper_funcs);
- res = drm_writeback_connector_init(&dm->adev->ddev, &wbcon->base,
+ res = drmm_writeback_connector_init(&dm->adev->ddev, &wbcon->base,
&amdgpu_dm_wb_connector_funcs,
- &amdgpu_dm_wb_encoder_helper_funcs,
+ encoder,
amdgpu_dm_wb_formats,
- ARRAY_SIZE(amdgpu_dm_wb_formats),
- amdgpu_dm_get_encoder_crtc_mask(dm->adev));
+ ARRAY_SIZE(amdgpu_dm_wb_formats));
if (res)
return res;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/tests/amdgpu_dm_wb_test.c b/drivers/gpu/drm/amd/display/amdgpu_dm/tests/amdgpu_dm_wb_test.c
index b43bc244487e..9879cd12e7ac 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/tests/amdgpu_dm_wb_test.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/tests/amdgpu_dm_wb_test.c
@@ -360,8 +360,6 @@ static void dm_test_wb_connector_init_success(struct kunit *test)
KUNIT_EXPECT_TRUE(test, wbcon->base.base.funcs != NULL);
KUNIT_EXPECT_TRUE(test, wbcon->base.base.helper_private != NULL);
KUNIT_EXPECT_TRUE(test, wbcon->base.base.state != NULL);
- KUNIT_EXPECT_TRUE(test, wbcon->base.encoder.funcs != NULL);
- KUNIT_EXPECT_EQ(test, wbcon->base.encoder.possible_crtcs, 0x1);
}
/* Tests for amdgpu_dm_wb_prepare_job / amdgpu_dm_wb_cleanup_job */
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH v8 3/8] drm/amd/display: use drmm_writeback_connector_init()
2026-07-23 0:31 ` [PATCH v8 3/8] drm/amd/display: use drmm_writeback_connector_init() John Harrison
@ 2026-07-23 0:53 ` sashiko-bot
0 siblings, 0 replies; 13+ messages in thread
From: sashiko-bot @ 2026-07-23 0:53 UTC (permalink / raw)
To: John Harrison; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
New issues:
- [Medium] Mismatched object lifetimes in KUnit test causes Use-After-Free when DRM device is torn down.
Pre-existing issues:
- [High] The struct dc_writeback_info allocated dynamically in dm_set_writeback() is leaked on every successful writeback job setup.
--
--- Patch [3]: [PATCH v8 3/8] drm/amd/display: use drmm_writeback_connector_init() ---
commit 4cc9223584993bb5748e535854c7b5fb0eba8f0d
Author: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
drm/amd/display: use drmm_writeback_connector_init()
The driver uses drmm_writeback_connector_init() to ensure proper job queue
cleanup. It also allocates a simple encoder using drmm_plain_encoder_alloc()
for the writeback connector.
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> index 289da9d00b056..ff7b21830fce9 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> @@ -5048,7 +5048,7 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm,
> return;
> }
>
> - acrtc = to_amdgpu_crtc(wb_conn->encoder.crtc);
> + acrtc = to_amdgpu_crtc(crtc_state->base.crtc);
> if (!acrtc) {
> drm_err(adev_to_drm(adev), "no amdgpu_crtc found\n");
> kfree(wb_info);
[Severity: High]
This isn't a bug introduced by this patch, but does dm_set_writeback() leak
the dynamically allocated wb_info struct on success?
When userspace configures a writeback job, wb_info is allocated dynamically
using kzalloc_obj(). It is then passed to dc_stream_add_writeback():
dc_stream_add_writeback(dm->dc, crtc_state->stream, wb_info);
acrtc->wb_conn = wb_conn;
drm_writeback_queue_job(wb_conn, new_con_state);
However, dc_stream_add_writeback() copies the contents by value into an array
(stream->writeback_info[...] = *wb_info) but does not take ownership of the
pointer.
The function then returns without ever calling kfree(wb_info) on the success
path, which seems to result in a memory leak on every successful writeback
job setup.
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_wb.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_wb.c
> index 9e7bad4d6ed0c..2bb86218e80b0 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_wb.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_wb.c
[ ... ]
> @@ -197,17 +196,26 @@ int amdgpu_dm_wb_connector_init(struct amdgpu_display_manager *dm,
> struct dc *dc = dm->dc;
> struct dc_link *link = dc_get_link_at_index(dc, link_index);
> int res;
> + struct drm_encoder *encoder;
> +
> + encoder = drmm_plain_encoder_alloc(&dm->adev->ddev, NULL,
> + DRM_MODE_ENCODER_VIRTUAL, NULL);
> + if (IS_ERR(encoder))
> + return PTR_ERR(encoder);
> +
> + drm_encoder_helper_add(encoder, &amdgpu_dm_wb_encoder_helper_funcs);
> +
> + encoder->possible_crtcs = amdgpu_dm_get_encoder_crtc_mask(dm->adev);
>
> wbcon->link = link;
>
> drm_connector_helper_add(&wbcon->base.base, &amdgpu_dm_wb_conn_helper_funcs);
>
> - res = drm_writeback_connector_init(&dm->adev->ddev, &wbcon->base,
> + res = drmm_writeback_connector_init(&dm->adev->ddev, &wbcon->base,
> &amdgpu_dm_wb_connector_funcs,
> - &amdgpu_dm_wb_encoder_helper_funcs,
> + encoder,
> amdgpu_dm_wb_formats,
> - ARRAY_SIZE(amdgpu_dm_wb_formats),
> - amdgpu_dm_get_encoder_crtc_mask(dm->adev));
> + ARRAY_SIZE(amdgpu_dm_wb_formats));
[Severity: Medium]
Can this conversion to drmm_writeback_connector_init() cause a use-after-free
in the KUnit tests during DRM device teardown?
In the KUnit test dm_test_wb_connector_init_success(), the mock DRM device is
allocated via dm_kunit_alloc_adev() (which registers a KUnit cleanup action).
The test object wbcon is then allocated using kunit_kzalloc():
wbcon = kunit_kzalloc(test, sizeof(*wbcon), GFP_KERNEL);
KUNIT_ASSERT_NOT_NULL(test, wbcon);
ret = amdgpu_dm_wb_connector_init(dm, wbcon, 0);
Because KUnit cleanup actions run in LIFO order, when the test completes, it
first frees wbcon via kfree(), and then tears down the mock DRM device.
The device teardown triggers the drmm cleanup action registered by this patch
(drm_writeback_connector_cleanup), which will dereference the already-freed
wbcon to lock job_lock and iterate job_queue.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260723003205.330362-1-John.Harrison@Igalia.com?part=3
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH v8 4/8] drm/komeda: use drmm_writeback_connector_init()
2026-07-23 0:31 [PATCH v8 0/8] drm: writeback: clean up writeback connector initialization John Harrison
` (2 preceding siblings ...)
2026-07-23 0:31 ` [PATCH v8 3/8] drm/amd/display: use drmm_writeback_connector_init() John Harrison
@ 2026-07-23 0:31 ` John Harrison
2026-07-23 1:02 ` sashiko-bot
2026-07-23 0:32 ` [PATCH v8 5/8] drm/mali: " John Harrison
` (3 subsequent siblings)
7 siblings, 1 reply; 13+ messages in thread
From: John Harrison @ 2026-07-23 0:31 UTC (permalink / raw)
To: dri-devel
Cc: kernel-dev, Dmitry Baryshkov, Suraj Kandpal, Louis Chauvet,
Liviu Dudau
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
The driver uses drm_writeback_connector_init() instead of its drmm
counterpart, but it doesn't perform the job queue cleanup (neither
manually nor by calling drm_writeback_connector_cleanup()). On the
contrary, the drmm_writeback_connector_init() function ensures the
proper cleanup of the job queue.
Use drmm_plain_encoder_alloc() to allocate simple encoder and
drmm_writeback_connector_init() in order to initialize writeback
connector instance.
v2: Fix error paths (as complained by Sashiko).
v3: Drop drmm_kfree on error after handing the connector over to the
DRM layer to prevent dangling clean up problems.
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: John Harrison <John.Harrison@Igalia.com>
---
.../arm/display/komeda/komeda_wb_connector.c | 39 +++++++++++--------
1 file changed, 22 insertions(+), 17 deletions(-)
diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
index 41cc3e080dc9..65f072cfe42f 100644
--- a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
+++ b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
@@ -5,6 +5,7 @@
*
*/
#include <drm/drm_framebuffer.h>
+#include <drm/drm_managed.h>
#include "komeda_dev.h"
#include "komeda_kms.h"
@@ -121,17 +122,10 @@ komeda_wb_connector_fill_modes(struct drm_connector *connector,
return 0;
}
-static void komeda_wb_connector_destroy(struct drm_connector *connector)
-{
- drm_connector_cleanup(connector);
- kfree(to_kconn(to_wb_conn(connector)));
-}
-
static const struct drm_connector_funcs komeda_wb_connector_funcs = {
.reset = drm_atomic_helper_connector_reset,
.detect = komeda_wb_connector_detect,
.fill_modes = komeda_wb_connector_fill_modes,
- .destroy = komeda_wb_connector_destroy,
.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
};
@@ -143,13 +137,15 @@ static int komeda_wb_connector_add(struct komeda_kms_dev *kms,
struct komeda_wb_connector *kwb_conn;
struct drm_writeback_connector *wb_conn;
struct drm_display_info *info;
+ struct drm_encoder *encoder;
+
u32 *formats, n_formats = 0;
int err;
if (!kcrtc->master->wb_layer)
return 0;
- kwb_conn = kzalloc_obj(*kwb_conn);
+ kwb_conn = drmm_kzalloc(&kms->base, sizeof(*kwb_conn), GFP_KERNEL);
if (!kwb_conn)
return -ENOMEM;
@@ -161,20 +157,29 @@ static int komeda_wb_connector_add(struct komeda_kms_dev *kms,
kwb_conn->wb_layer->layer_type,
&n_formats);
if (!formats) {
- kfree(kwb_conn);
+ drmm_kfree(&kms->base, kwb_conn);
return -ENOMEM;
}
- err = drm_writeback_connector_init(&kms->base, wb_conn,
- &komeda_wb_connector_funcs,
- &komeda_wb_encoder_helper_funcs,
- formats, n_formats,
- BIT(drm_crtc_index(&kcrtc->base)));
+ encoder = drmm_plain_encoder_alloc(&kms->base, NULL,
+ DRM_MODE_ENCODER_VIRTUAL, NULL);
+ if (IS_ERR(encoder)) {
+ komeda_put_fourcc_list(formats);
+ drmm_kfree(&kms->base, kwb_conn);
+ return PTR_ERR(encoder);
+ }
+
+ drm_encoder_helper_add(encoder, &komeda_wb_encoder_helper_funcs);
+
+ encoder->possible_crtcs = drm_crtc_mask(&kcrtc->base);
+
+ err = drmm_writeback_connector_init(&kms->base, wb_conn,
+ &komeda_wb_connector_funcs,
+ encoder,
+ formats, n_formats);
komeda_put_fourcc_list(formats);
- if (err) {
- kfree(kwb_conn);
+ if (err)
return err;
- }
drm_connector_helper_add(&wb_conn->base, &komeda_wb_conn_helper_funcs);
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH v8 4/8] drm/komeda: use drmm_writeback_connector_init()
2026-07-23 0:31 ` [PATCH v8 4/8] drm/komeda: " John Harrison
@ 2026-07-23 1:02 ` sashiko-bot
0 siblings, 0 replies; 13+ messages in thread
From: sashiko-bot @ 2026-07-23 1:02 UTC (permalink / raw)
To: John Harrison; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Manual call to `drm_mode_config_cleanup()` during driver teardown causes NULL pointer dereferences on drmm-managed encoder and connector.
--
--- Patch [4]: [PATCH v8 4/8] drm/komeda: use drmm_writeback_connector_init() ---
commit 252267d60505e182c9ac4aa8fed48741764eeb23
Author: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
drm/komeda: use drmm_writeback_connector_init()
The driver uses drm_writeback_connector_init() instead of its drmm
counterpart, but it doesn't perform the job queue cleanup (neither
manually nor by calling drm_writeback_connector_cleanup()). On the
contrary, the drmm_writeback_connector_init() function ensures the
proper cleanup of the job queue.
Use drmm_plain_encoder_alloc() to allocate simple encoder and
drmm_writeback_connector_init() in order to initialize writeback
connector instance.
> diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
> index 41cc3e080dc9c..65f072cfe42f9 100644
> --- a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
> +++ b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
[ ... ]
> @@ -121,17 +122,10 @@ komeda_wb_connector_fill_modes(struct drm_connector *connector,
> return 0;
> }
>
> -static void komeda_wb_connector_destroy(struct drm_connector *connector)
> -{
> - drm_connector_cleanup(connector);
> - kfree(to_kconn(to_wb_conn(connector)));
> -}
> -
> static const struct drm_connector_funcs komeda_wb_connector_funcs = {
> .reset = drm_atomic_helper_connector_reset,
> .detect = komeda_wb_connector_detect,
> .fill_modes = komeda_wb_connector_fill_modes,
> - .destroy = komeda_wb_connector_destroy,
> .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
> .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
> };
[ ... ]
> @@ -161,20 +157,29 @@ static int komeda_wb_connector_add(struct komeda_kms_dev *kms,
> kwb_conn->wb_layer->layer_type,
> &n_formats);
> if (!formats) {
> - kfree(kwb_conn);
> + drmm_kfree(&kms->base, kwb_conn);
> return -ENOMEM;
> }
>
> - err = drm_writeback_connector_init(&kms->base, wb_conn,
> - &komeda_wb_connector_funcs,
> - &komeda_wb_encoder_helper_funcs,
> - formats, n_formats,
> - BIT(drm_crtc_index(&kcrtc->base)));
> + encoder = drmm_plain_encoder_alloc(&kms->base, NULL,
> + DRM_MODE_ENCODER_VIRTUAL, NULL);
[Severity: High]
Will this crash during driver teardown or initialization failure?
The komeda driver still explicitly calls drm_mode_config_cleanup() during its
teardown in komeda_kms_detach() and in the error path of komeda_kms_attach():
komeda_kms_attach() {
...
cleanup_mode_config:
drm_mode_config_cleanup(drm);
...
}
Because drm_mode_config_cleanup() unconditionally invokes the .destroy hook
for all encoders and connectors, and drmm_plain_encoder_alloc() is called
here with a NULL funcs pointer, will the cleanup attempt to dereference a
NULL funcs pointer (encoder->funcs->destroy)?
Similarly, the .destroy hook has been removed from komeda_wb_connector_funcs
above, so will drm_mode_config_cleanup() also crash when attempting to call
connector->funcs->destroy()?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260723003205.330362-1-John.Harrison@Igalia.com?part=4
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH v8 5/8] drm/mali: use drmm_writeback_connector_init()
2026-07-23 0:31 [PATCH v8 0/8] drm: writeback: clean up writeback connector initialization John Harrison
` (3 preceding siblings ...)
2026-07-23 0:31 ` [PATCH v8 4/8] drm/komeda: " John Harrison
@ 2026-07-23 0:32 ` John Harrison
2026-07-23 0:32 ` [PATCH v8 6/8] drm: renesas: rcar-du: " John Harrison
` (2 subsequent siblings)
7 siblings, 0 replies; 13+ messages in thread
From: John Harrison @ 2026-07-23 0:32 UTC (permalink / raw)
To: dri-devel
Cc: kernel-dev, Dmitry Baryshkov, Suraj Kandpal, Louis Chauvet,
Liviu Dudau
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
The driver uses drm_writeback_connector_init() instead of its drmm
counterpart, but it doesn't perform the job queue cleanup (neither
manually nor by calling drm_writeback_connector_cleanup()). On the
contrary, the drmm_writeback_connector_init() function ensures the
proper cleanup of the job queue.
Use drmm_plain_encoder_alloc() to allocate simple encoder and
drmm_writeback_connector_init() in order to initialize writeback
connector instance.
v2: Fix error path (as complained by Sashiko).
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: John Harrison <John.Harrison@Igalia.com>
---
drivers/gpu/drm/arm/malidp_mw.c | 26 +++++++++++++++-----------
1 file changed, 15 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/arm/malidp_mw.c b/drivers/gpu/drm/arm/malidp_mw.c
index f8be65119e3b..a4c6a00c0941 100644
--- a/drivers/gpu/drm/arm/malidp_mw.c
+++ b/drivers/gpu/drm/arm/malidp_mw.c
@@ -84,11 +84,6 @@ malidp_mw_connector_detect(struct drm_connector *connector, bool force)
return connector_status_connected;
}
-static void malidp_mw_connector_destroy(struct drm_connector *connector)
-{
- drm_connector_cleanup(connector);
-}
-
static struct drm_connector_state *
malidp_mw_connector_duplicate_state(struct drm_connector *connector)
{
@@ -114,7 +109,6 @@ static const struct drm_connector_funcs malidp_mw_connector_funcs = {
.reset = malidp_mw_connector_reset,
.detect = malidp_mw_connector_detect,
.fill_modes = drm_helper_probe_single_connector_modes,
- .destroy = malidp_mw_connector_destroy,
.atomic_duplicate_state = malidp_mw_connector_duplicate_state,
.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
};
@@ -211,6 +205,7 @@ static u32 *get_writeback_formats(struct malidp_drm *malidp, int *n_formats)
int malidp_mw_connector_init(struct drm_device *drm)
{
struct malidp_drm *malidp = drm_to_malidp(drm);
+ struct drm_encoder *encoder;
u32 *formats;
int ret, n_formats;
@@ -224,11 +219,20 @@ int malidp_mw_connector_init(struct drm_device *drm)
if (!formats)
return -ENOMEM;
- ret = drm_writeback_connector_init(drm, &malidp->mw_connector,
- &malidp_mw_connector_funcs,
- &malidp_mw_encoder_helper_funcs,
- formats, n_formats,
- 1 << drm_crtc_index(&malidp->crtc));
+ encoder = drmm_plain_encoder_alloc(drm, NULL, DRM_MODE_ENCODER_VIRTUAL, NULL);
+ if (IS_ERR(encoder)) {
+ kfree(formats);
+ return PTR_ERR(encoder);
+ }
+
+ drm_encoder_helper_add(encoder, &malidp_mw_encoder_helper_funcs);
+
+ encoder->possible_crtcs = drm_crtc_mask(&malidp->crtc);
+
+ ret = drmm_writeback_connector_init(drm, &malidp->mw_connector,
+ &malidp_mw_connector_funcs,
+ encoder,
+ formats, n_formats);
kfree(formats);
if (ret)
return ret;
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH v8 6/8] drm: renesas: rcar-du: use drmm_writeback_connector_init()
2026-07-23 0:31 [PATCH v8 0/8] drm: writeback: clean up writeback connector initialization John Harrison
` (4 preceding siblings ...)
2026-07-23 0:32 ` [PATCH v8 5/8] drm/mali: " John Harrison
@ 2026-07-23 0:32 ` John Harrison
2026-07-23 0:32 ` [PATCH v8 7/8] drm/vc4: " John Harrison
2026-07-23 0:32 ` [PATCH v8 8/8] drm: writeback: drop excess connector initialization functions John Harrison
7 siblings, 0 replies; 13+ messages in thread
From: John Harrison @ 2026-07-23 0:32 UTC (permalink / raw)
To: dri-devel; +Cc: kernel-dev, Dmitry Baryshkov, Suraj Kandpal, Louis Chauvet
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
The driver uses drm_writeback_connector_init() instead of its drmm
counterpart, but it doesn't perform the job queue cleanup (neither
manually nor by calling drm_writeback_connector_cleanup()). On the
contrary, the drmm_writeback_connector_init() function ensures the
proper cleanup of the job queue.
Use drmm_plain_encoder_alloc() to allocate simple encoder and
drmm_writeback_connector_init() in order to initialize writeback
connector instance.
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
.../drm/renesas/rcar-du/rcar_du_writeback.c | 22 +++++++++++++------
1 file changed, 15 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_du_writeback.c b/drivers/gpu/drm/renesas/rcar-du/rcar_du_writeback.c
index e5e6e6a156aa..ecfd4fc1f210 100644
--- a/drivers/gpu/drm/renesas/rcar-du/rcar_du_writeback.c
+++ b/drivers/gpu/drm/renesas/rcar-du/rcar_du_writeback.c
@@ -134,7 +134,6 @@ static void rcar_du_wb_conn_reset(struct drm_connector *connector)
static const struct drm_connector_funcs rcar_du_wb_conn_funcs = {
.reset = rcar_du_wb_conn_reset,
.fill_modes = drm_helper_probe_single_connector_modes,
- .destroy = drm_connector_cleanup,
.atomic_duplicate_state = rcar_du_wb_conn_duplicate_state,
.atomic_destroy_state = rcar_du_wb_conn_destroy_state,
};
@@ -201,16 +200,25 @@ int rcar_du_writeback_init(struct rcar_du_device *rcdu,
struct rcar_du_crtc *rcrtc)
{
struct drm_writeback_connector *wb_conn = &rcrtc->writeback;
+ struct drm_encoder *encoder;
+
+ encoder = drmm_plain_encoder_alloc(&rcdu->ddev, NULL,
+ DRM_MODE_ENCODER_VIRTUAL, NULL);
+ if (IS_ERR(encoder))
+ return PTR_ERR(encoder);
+
+ drm_encoder_helper_add(encoder, &rcar_du_wb_enc_helper_funcs);
+
+ encoder->possible_crtcs = drm_crtc_mask(&rcrtc->crtc);
drm_connector_helper_add(&wb_conn->base,
&rcar_du_wb_conn_helper_funcs);
- return drm_writeback_connector_init(&rcdu->ddev, wb_conn,
- &rcar_du_wb_conn_funcs,
- &rcar_du_wb_enc_helper_funcs,
- writeback_formats,
- ARRAY_SIZE(writeback_formats),
- 1 << drm_crtc_index(&rcrtc->crtc));
+ return drmm_writeback_connector_init(&rcdu->ddev, wb_conn,
+ &rcar_du_wb_conn_funcs,
+ encoder,
+ writeback_formats,
+ ARRAY_SIZE(writeback_formats));
}
void rcar_du_writeback_setup(struct rcar_du_crtc *rcrtc,
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH v8 7/8] drm/vc4: use drmm_writeback_connector_init()
2026-07-23 0:31 [PATCH v8 0/8] drm: writeback: clean up writeback connector initialization John Harrison
` (5 preceding siblings ...)
2026-07-23 0:32 ` [PATCH v8 6/8] drm: renesas: rcar-du: " John Harrison
@ 2026-07-23 0:32 ` John Harrison
2026-07-23 0:53 ` sashiko-bot
2026-07-23 0:32 ` [PATCH v8 8/8] drm: writeback: drop excess connector initialization functions John Harrison
7 siblings, 1 reply; 13+ messages in thread
From: John Harrison @ 2026-07-23 0:32 UTC (permalink / raw)
To: dri-devel; +Cc: kernel-dev, Dmitry Baryshkov, Louis Chauvet, Suraj Kandpal
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
The driver uses drm_writeback_connector_init() instead of its drmm
counterpart, but it doesn't perform the job queue cleanup (neither
manually nor by calling drm_writeback_connector_cleanup()). On the
contrary, the drmm_writeback_connector_init() function ensures the
proper cleanup of the job queue.
Use drmm_writeback_connector_init() in order to initialize writeback
connector instance.
v2: Drop unbind call as no longer necessary (complained by Sashiko).
Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: John Harrison <John.Harrison@Igalia.com>
---
drivers/gpu/drm/vc4/vc4_txp.c | 18 ++++--------------
1 file changed, 4 insertions(+), 14 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_txp.c b/drivers/gpu/drm/vc4/vc4_txp.c
index bc3f366fc3e6..322cc65dc787 100644
--- a/drivers/gpu/drm/vc4/vc4_txp.c
+++ b/drivers/gpu/drm/vc4/vc4_txp.c
@@ -377,7 +377,6 @@ vc4_txp_connector_detect(struct drm_connector *connector, bool force)
static const struct drm_connector_funcs vc4_txp_connector_funcs = {
.detect = vc4_txp_connector_detect,
.fill_modes = drm_helper_probe_single_connector_modes,
- .destroy = drm_connector_cleanup,
.reset = drm_atomic_helper_connector_reset,
.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
@@ -601,10 +600,10 @@ static int vc4_txp_bind(struct device *dev, struct device *master, void *data)
drm_connector_helper_add(&txp->connector.base,
&vc4_txp_connector_helper_funcs);
- ret = drm_writeback_connector_init_with_encoder(drm, &txp->connector,
- encoder,
- &vc4_txp_connector_funcs,
- drm_fmts, ARRAY_SIZE(drm_fmts));
+ ret = drmm_writeback_connector_init(drm, &txp->connector,
+ &vc4_txp_connector_funcs,
+ encoder,
+ drm_fmts, ARRAY_SIZE(drm_fmts));
if (ret)
return ret;
@@ -618,17 +617,8 @@ static int vc4_txp_bind(struct device *dev, struct device *master, void *data)
return 0;
}
-static void vc4_txp_unbind(struct device *dev, struct device *master,
- void *data)
-{
- struct vc4_txp *txp = dev_get_drvdata(dev);
-
- drm_connector_cleanup(&txp->connector.base);
-}
-
static const struct component_ops vc4_txp_ops = {
.bind = vc4_txp_bind,
- .unbind = vc4_txp_unbind,
};
static int vc4_txp_probe(struct platform_device *pdev)
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH v8 7/8] drm/vc4: use drmm_writeback_connector_init()
2026-07-23 0:32 ` [PATCH v8 7/8] drm/vc4: " John Harrison
@ 2026-07-23 0:53 ` sashiko-bot
0 siblings, 0 replies; 13+ messages in thread
From: sashiko-bot @ 2026-07-23 0:53 UTC (permalink / raw)
To: John Harrison; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the `vc4_txp_interrupt` handler can trigger a use-after-free on the `txp` structure if the component is unbound.
--
--- Patch [7]: [PATCH v8 7/8] drm/vc4: use drmm_writeback_connector_init() ---
Note: The format of this review has been altered to provide a free-form
summary of the findings due to recitation restrictions. The original patch
code is not directly quoted.
commit d2ba7084f0c0f5d055693e1cdaf9ce77bc6aa242
Author: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
drm/vc4: use drmm_writeback_connector_init()
This commit changes the VC4 driver to use drmm_writeback_connector_init()
instead of drm_writeback_connector_init() to ensure proper cleanup of the
job queue. It also removes the vc4_txp_unbind function.
[Severity: High]
This isn't a bug introduced by this patch, but does the component unbind flow
leave a dangling interrupt handler that can cause a use-after-free?
In vc4_txp_bind(), the txp structure is allocated using drmm_kzalloc(), tying
its lifecycle to the DRM master aggregate device.
However, the interrupt handler vc4_txp_interrupt() is registered using
devm_request_irq() on the component platform device.
If the DRM master is unbound via sysfs, the drmm-managed txp structure is
freed. Because the component platform device driver is not necessarily unbound,
the devm-managed IRQ handler remains active.
If an interrupt fires after the DRM device teardown, won't vc4_txp_interrupt()
dereference the freed txp structure?
Should the IRQ registration be tied to the DRM lifecycle, or should the IRQ
be explicitly disabled when the component unbinds?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260723003205.330362-1-John.Harrison@Igalia.com?part=7
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH v8 8/8] drm: writeback: drop excess connector initialization functions
2026-07-23 0:31 [PATCH v8 0/8] drm: writeback: clean up writeback connector initialization John Harrison
` (6 preceding siblings ...)
2026-07-23 0:32 ` [PATCH v8 7/8] drm/vc4: " John Harrison
@ 2026-07-23 0:32 ` John Harrison
7 siblings, 0 replies; 13+ messages in thread
From: John Harrison @ 2026-07-23 0:32 UTC (permalink / raw)
To: dri-devel; +Cc: kernel-dev, Dmitry Baryshkov, Suraj Kandpal, Louis Chauvet
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Now as all drivers have been converted to
drmm_writeback_connector_init(), drop drm_writeback_connector_init() and
drm_writeback_connector::encoder field, they are unused now.
v2: Also drop drm_writeback_connector_init_with_encoder as it too is
no longer in use. Update a bunch of documentation comments to refer to
the new interface name.
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: John Harrison <John.Harrison@Igalia.com>
---
drivers/gpu/drm/drm_writeback.c | 107 --------------------------------
include/drm/drm_mode_config.h | 6 +-
include/drm/drm_writeback.h | 26 +-------
3 files changed, 4 insertions(+), 135 deletions(-)
diff --git a/drivers/gpu/drm/drm_writeback.c b/drivers/gpu/drm/drm_writeback.c
index b4a002e6d043..ae4b74db6ed3 100644
--- a/drivers/gpu/drm/drm_writeback.c
+++ b/drivers/gpu/drm/drm_writeback.c
@@ -148,61 +148,6 @@ static int create_writeback_properties(struct drm_device *dev)
return 0;
}
-static const struct drm_encoder_funcs drm_writeback_encoder_funcs = {
- .destroy = drm_encoder_cleanup,
-};
-
-/**
- * drm_writeback_connector_init - Initialize a writeback connector and its properties
- * @dev: DRM device
- * @wb_connector: Writeback connector to initialize
- * @con_funcs: Connector funcs vtable
- * @enc_helper_funcs: Encoder helper funcs vtable to be used by the internal encoder
- * @formats: Array of supported pixel formats for the writeback engine
- * @n_formats: Length of the formats array
- * @possible_crtcs: possible crtcs for the internal writeback encoder
- *
- * This function creates the writeback-connector-specific properties if they
- * have not been already created, initializes the connector as
- * type DRM_MODE_CONNECTOR_WRITEBACK, and correctly initializes the property
- * values. It will also create an internal encoder associated with the
- * drm_writeback_connector and set it to use the @enc_helper_funcs vtable for
- * the encoder helper.
- *
- * Drivers should always use this function instead of drm_connector_init() to
- * set up writeback connectors.
- *
- * Returns: 0 on success, or a negative error code
- */
-int drm_writeback_connector_init(struct drm_device *dev,
- struct drm_writeback_connector *wb_connector,
- const struct drm_connector_funcs *con_funcs,
- const struct drm_encoder_helper_funcs *enc_helper_funcs,
- const u32 *formats, int n_formats,
- u32 possible_crtcs)
-{
- int ret = 0;
-
- drm_encoder_helper_add(&wb_connector->encoder, enc_helper_funcs);
-
- wb_connector->encoder.possible_crtcs = possible_crtcs;
-
- ret = drm_encoder_init(dev, &wb_connector->encoder,
- &drm_writeback_encoder_funcs,
- DRM_MODE_ENCODER_VIRTUAL, NULL);
- if (ret)
- return ret;
-
- ret = drm_writeback_connector_init_with_encoder(dev, wb_connector, &wb_connector->encoder,
- con_funcs, formats, n_formats);
-
- if (ret)
- drm_encoder_cleanup(&wb_connector->encoder);
-
- return ret;
-}
-EXPORT_SYMBOL(drm_writeback_connector_init);
-
static void delete_writeback_properties(struct drm_device *dev)
{
if (dev->mode_config.writeback_pixel_formats_property) {
@@ -295,58 +240,6 @@ static int __drm_writeback_connector_init(struct drm_device *dev,
return ret;
}
-/**
- * drm_writeback_connector_init_with_encoder - Initialize a writeback connector with
- * a custom encoder
- *
- * @dev: DRM device
- * @wb_connector: Writeback connector to initialize
- * @enc: handle to the already initialized drm encoder
- * @con_funcs: Connector funcs vtable
- * @formats: Array of supported pixel formats for the writeback engine
- * @n_formats: Length of the formats array
- *
- * This function creates the writeback-connector-specific properties if they
- * have not been already created, initializes the connector as
- * type DRM_MODE_CONNECTOR_WRITEBACK, and correctly initializes the property
- * values.
- *
- * This function assumes that the drm_writeback_connector's encoder has already been
- * created and initialized before invoking this function.
- *
- * In addition, this function also assumes that callers of this API will manage
- * assigning the encoder helper functions, possible_crtcs and any other encoder
- * specific operation.
- *
- * Drivers should always use this function instead of drm_connector_init() to
- * set up writeback connectors if they want to manage themselves the lifetime of the
- * associated encoder.
- *
- * Returns: 0 on success, or a negative error code
- */
-int drm_writeback_connector_init_with_encoder(struct drm_device *dev,
- struct drm_writeback_connector *wb_connector,
- struct drm_encoder *enc,
- const struct drm_connector_funcs *con_funcs,
- const u32 *formats, int n_formats)
-{
- struct drm_connector *connector = &wb_connector->base;
- int ret;
-
- ret = drm_connector_init(dev, connector, con_funcs,
- DRM_MODE_CONNECTOR_WRITEBACK);
- if (ret)
- return ret;
-
- ret = __drm_writeback_connector_init(dev, wb_connector, enc, formats,
- n_formats);
- if (ret)
- drm_connector_cleanup(connector);
-
- return ret;
-}
-EXPORT_SYMBOL(drm_writeback_connector_init_with_encoder);
-
/**
* drm_writeback_connector_cleanup - Cleanup the writeback connector
* @dev: DRM device
diff --git a/include/drm/drm_mode_config.h b/include/drm/drm_mode_config.h
index d8f5b7e9673e..d7e88753624d 100644
--- a/include/drm/drm_mode_config.h
+++ b/include/drm/drm_mode_config.h
@@ -870,7 +870,7 @@ struct drm_mode_config {
/**
* @writeback_fb_id_property: Property for writeback connectors, storing
* the ID of the output framebuffer.
- * See also: drm_writeback_connector_init()
+ * See also: drmm_writeback_connector_init()
*/
struct drm_property *writeback_fb_id_property;
@@ -878,7 +878,7 @@ struct drm_mode_config {
* @writeback_pixel_formats_property: Property for writeback connectors,
* storing an array of the supported pixel formats for the writeback
* engine (read-only).
- * See also: drm_writeback_connector_init()
+ * See also: drmm_writeback_connector_init()
*/
struct drm_property *writeback_pixel_formats_property;
/**
@@ -886,7 +886,7 @@ struct drm_mode_config {
* fd pointer representing the outgoing fences for a writeback
* connector. Userspace should provide a pointer to a value of type s32,
* and then cast that pointer to u64.
- * See also: drm_writeback_connector_init()
+ * See also: drmm_writeback_connector_init()
*/
struct drm_property *writeback_out_fence_ptr_property;
diff --git a/include/drm/drm_writeback.h b/include/drm/drm_writeback.h
index c380a7b8f55a..0dda8dbd0118 100644
--- a/include/drm/drm_writeback.h
+++ b/include/drm/drm_writeback.h
@@ -24,23 +24,12 @@ struct drm_writeback_connector {
*/
struct drm_connector base;
- /**
- * @encoder: Internal encoder used by the connector to fulfill
- * the DRM framework requirements. The users of the
- * @drm_writeback_connector control the behaviour of the @encoder
- * by passing the @enc_funcs parameter to drm_writeback_connector_init()
- * function.
- * For users of drm_writeback_connector_init_with_encoder(), this field
- * is not valid as the encoder is managed within their drivers.
- */
- struct drm_encoder encoder;
-
/**
* @pixel_formats_blob_ptr:
*
* DRM blob property data for the pixel formats list on writeback
* connectors
- * See also drm_writeback_connector_init()
+ * See also drmm_writeback_connector_init()
*/
struct drm_property_blob *pixel_formats_blob_ptr;
@@ -148,19 +137,6 @@ drm_connector_to_writeback(struct drm_connector *connector)
return container_of(connector, struct drm_writeback_connector, base);
}
-int drm_writeback_connector_init(struct drm_device *dev,
- struct drm_writeback_connector *wb_connector,
- const struct drm_connector_funcs *con_funcs,
- const struct drm_encoder_helper_funcs *enc_helper_funcs,
- const u32 *formats, int n_formats,
- u32 possible_crtcs);
-
-int drm_writeback_connector_init_with_encoder(struct drm_device *dev,
- struct drm_writeback_connector *wb_connector,
- struct drm_encoder *enc,
- const struct drm_connector_funcs *con_funcs, const u32 *formats,
- int n_formats);
-
int drmm_writeback_connector_init(struct drm_device *dev,
struct drm_writeback_connector *wb_connector,
const struct drm_connector_funcs *con_funcs,
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread