^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) =================================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) (How to avoid) Botching up ioctls
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) =================================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) From: https://blog.ffwll.ch/2013/11/botching-up-ioctls.html
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) By: Daniel Vetter, Copyright © 2013 Intel Corporation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) One clear insight kernel graphics hackers gained in the past few years is that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) trying to come up with a unified interface to manage the execution units and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) memory on completely different GPUs is a futile effort. So nowadays every
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) driver has its own set of ioctls to allocate memory and submit work to the GPU.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) Which is nice, since there's no more insanity in the form of fake-generic, but
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) actually only used once interfaces. But the clear downside is that there's much
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) more potential to screw things up.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) To avoid repeating all the same mistakes again I've written up some of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) lessons learned while botching the job for the drm/i915 driver. Most of these
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) only cover technicalities and not the big-picture issues like what the command
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) submission ioctl exactly should look like. Learning these lessons is probably
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) something every GPU driver has to do on its own.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) Prerequisites
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) -------------
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) First the prerequisites. Without these you have already failed, because you
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) will need to add a 32-bit compat layer:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) * Only use fixed sized integers. To avoid conflicts with typedefs in userspace
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) the kernel has special types like __u32, __s64. Use them.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) * Align everything to the natural size and use explicit padding. 32-bit
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) platforms don't necessarily align 64-bit values to 64-bit boundaries, but
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) 64-bit platforms do. So we always need padding to the natural size to get
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) this right.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) * Pad the entire struct to a multiple of 64-bits if the structure contains
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) 64-bit types - the structure size will otherwise differ on 32-bit versus
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) 64-bit. Having a different structure size hurts when passing arrays of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) structures to the kernel, or if the kernel checks the structure size, which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) e.g. the drm core does.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) * Pointers are __u64, cast from/to a uintprt_t on the userspace side and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) from/to a void __user * in the kernel. Try really hard not to delay this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) conversion or worse, fiddle the raw __u64 through your code since that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) diminishes the checking tools like sparse can provide. The macro
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) u64_to_user_ptr can be used in the kernel to avoid warnings about integers
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) and pointers of different sizes.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) Basics
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) ------
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) With the joys of writing a compat layer avoided we can take a look at the basic
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) fumbles. Neglecting these will make backward and forward compatibility a real
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) pain. And since getting things wrong on the first attempt is guaranteed you
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) will have a second iteration or at least an extension for any given interface.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) * Have a clear way for userspace to figure out whether your new ioctl or ioctl
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) extension is supported on a given kernel. If you can't rely on old kernels
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) rejecting the new flags/modes or ioctls (since doing that was botched in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) past) then you need a driver feature flag or revision number somewhere.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) * Have a plan for extending ioctls with new flags or new fields at the end of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) the structure. The drm core checks the passed-in size for each ioctl call
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) and zero-extends any mismatches between kernel and userspace. That helps,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) but isn't a complete solution since newer userspace on older kernels won't
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) notice that the newly added fields at the end get ignored. So this still
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) needs a new driver feature flags.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) * Check all unused fields and flags and all the padding for whether it's 0,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) and reject the ioctl if that's not the case. Otherwise your nice plan for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) future extensions is going right down the gutters since someone will submit
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) an ioctl struct with random stack garbage in the yet unused parts. Which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) then bakes in the ABI that those fields can never be used for anything else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) but garbage. This is also the reason why you must explicitly pad all
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) structures, even if you never use them in an array - the padding the compiler
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) might insert could contain garbage.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) * Have simple testcases for all of the above.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) Fun with Error Paths
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) --------------------
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) Nowadays we don't have any excuse left any more for drm drivers being neat
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) little root exploits. This means we both need full input validation and solid
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) error handling paths - GPUs will die eventually in the oddmost corner cases
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) anyway:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) * The ioctl must check for array overflows. Also it needs to check for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) over/underflows and clamping issues of integer values in general. The usual
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) example is sprite positioning values fed directly into the hardware with the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) hardware just having 12 bits or so. Works nicely until some odd display
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) server doesn't bother with clamping itself and the cursor wraps around the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) screen.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) * Have simple testcases for every input validation failure case in your ioctl.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) Check that the error code matches your expectations. And finally make sure
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) that you only test for one single error path in each subtest by submitting
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) otherwise perfectly valid data. Without this an earlier check might reject
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) the ioctl already and shadow the codepath you actually want to test, hiding
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) bugs and regressions.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) * Make all your ioctls restartable. First X really loves signals and second
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) this will allow you to test 90% of all error handling paths by just
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) interrupting your main test suite constantly with signals. Thanks to X's
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) love for signal you'll get an excellent base coverage of all your error
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) paths pretty much for free for graphics drivers. Also, be consistent with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) how you handle ioctl restarting - e.g. drm has a tiny drmIoctl helper in its
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) userspace library. The i915 driver botched this with the set_tiling ioctl,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) now we're stuck forever with some arcane semantics in both the kernel and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) userspace.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) * If you can't make a given codepath restartable make a stuck task at least
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) killable. GPUs just die and your users won't like you more if you hang their
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) entire box (by means of an unkillable X process). If the state recovery is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) still too tricky have a timeout or hangcheck safety net as a last-ditch
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) effort in case the hardware has gone bananas.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) * Have testcases for the really tricky corner cases in your error recovery code
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) - it's way too easy to create a deadlock between your hangcheck code and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) waiters.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) Time, Waiting and Missing it
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) ----------------------------
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) GPUs do most everything asynchronously, so we have a need to time operations and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) wait for outstanding ones. This is really tricky business; at the moment none of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) the ioctls supported by the drm/i915 get this fully right, which means there's
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) still tons more lessons to learn here.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) * Use CLOCK_MONOTONIC as your reference time, always. It's what alsa, drm and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) v4l use by default nowadays. But let userspace know which timestamps are
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) derived from different clock domains like your main system clock (provided
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) by the kernel) or some independent hardware counter somewhere else. Clocks
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) will mismatch if you look close enough, but if performance measuring tools
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) have this information they can at least compensate. If your userspace can
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) get at the raw values of some clocks (e.g. through in-command-stream
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) performance counter sampling instructions) consider exposing those also.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) * Use __s64 seconds plus __u64 nanoseconds to specify time. It's not the most
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) convenient time specification, but it's mostly the standard.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) * Check that input time values are normalized and reject them if not. Note
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) that the kernel native struct ktime has a signed integer for both seconds
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) and nanoseconds, so beware here.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) * For timeouts, use absolute times. If you're a good fellow and made your
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) ioctl restartable relative timeouts tend to be too coarse and can
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) indefinitely extend your wait time due to rounding on each restart.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) Especially if your reference clock is something really slow like the display
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) frame counter. With a spec lawyer hat on this isn't a bug since timeouts can
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) always be extended - but users will surely hate you if their neat animations
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) starts to stutter due to this.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) * Consider ditching any synchronous wait ioctls with timeouts and just deliver
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) an asynchronous event on a pollable file descriptor. It fits much better
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) into event driven applications' main loop.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) * Have testcases for corner-cases, especially whether the return values for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) already-completed events, successful waits and timed-out waits are all sane
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) and suiting to your needs.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) Leaking Resources, Not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) ----------------------
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) A full-blown drm driver essentially implements a little OS, but specialized to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) the given GPU platforms. This means a driver needs to expose tons of handles
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) for different objects and other resources to userspace. Doing that right
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) entails its own little set of pitfalls:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) * Always attach the lifetime of your dynamically created resources to the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) lifetime of a file descriptor. Consider using a 1:1 mapping if your resource
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) needs to be shared across processes - fd-passing over unix domain sockets
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) also simplifies lifetime management for userspace.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) * Always have O_CLOEXEC support.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) * Ensure that you have sufficient insulation between different clients. By
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) default pick a private per-fd namespace which forces any sharing to be done
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) explicitly. Only go with a more global per-device namespace if the objects
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) are truly device-unique. One counterexample in the drm modeset interfaces is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) that the per-device modeset objects like connectors share a namespace with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) framebuffer objects, which mostly are not shared at all. A separate
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) namespace, private by default, for framebuffers would have been more
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) suitable.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) * Think about uniqueness requirements for userspace handles. E.g. for most drm
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) drivers it's a userspace bug to submit the same object twice in the same
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) command submission ioctl. But then if objects are shareable userspace needs
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) to know whether it has seen an imported object from a different process
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) already or not. I haven't tried this myself yet due to lack of a new class
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) of objects, but consider using inode numbers on your shared file descriptors
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) as unique identifiers - it's how real files are told apart, too.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) Unfortunately this requires a full-blown virtual filesystem in the kernel.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) Last, but not Least
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) -------------------
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) Not every problem needs a new ioctl:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) * Think hard whether you really want a driver-private interface. Of course
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) it's much quicker to push a driver-private interface than engaging in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) lengthy discussions for a more generic solution. And occasionally doing a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) private interface to spearhead a new concept is what's required. But in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) end, once the generic interface comes around you'll end up maintainer two
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) interfaces. Indefinitely.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) * Consider other interfaces than ioctls. A sysfs attribute is much better for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) per-device settings, or for child objects with fairly static lifetimes (like
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) output connectors in drm with all the detection override attributes). Or
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) maybe only your testsuite needs this interface, and then debugfs with its
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) disclaimer of not having a stable ABI would be better.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) Finally, the name of the game is to get it right on the first attempt, since if
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) your driver proves popular and your hardware platforms long-lived then you'll
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) be stuck with a given ioctl essentially forever. You can try to deprecate
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) horrible ioctls on newer iterations of your hardware, but generally it takes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) years to accomplish this. And then again years until the last user able to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) complain about regressions disappears, too.
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags