Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'drm-misc-fixes-2023-01-05' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes
Several fixes to fix the error path of dma_buf_export, add a missing
structure declaration resulting in a compiler warning, fix the GEM
handle refcounting in panfrost, fix a corrupted image with AFBC on
meson, a memleak in virtio, improper plane width for imx, and a lockup
in drm_sched_entity_kill()
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
From: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20230105074909.qd2h23hpxac4lxi7@houat
+77
-90
+2
-5
drivers/dma-buf/dma-buf-sysfs-stats.c
+2
-5
drivers/dma-buf/dma-buf-sysfs-stats.c
···
168
168
kset_unregister(dma_buf_stats_kset);
169
169
}
170
170
171
-
int dma_buf_stats_setup(struct dma_buf *dmabuf)
171
+
int dma_buf_stats_setup(struct dma_buf *dmabuf, struct file *file)
172
172
{
173
173
struct dma_buf_sysfs_entry *sysfs_entry;
174
174
int ret;
175
-
176
-
if (!dmabuf || !dmabuf->file)
177
-
return -EINVAL;
178
175
179
176
if (!dmabuf->exp_name) {
180
177
pr_err("exporter name must not be empty if stats needed\n");
···
189
192
190
193
/* create the directory for buffer stats */
191
194
ret = kobject_init_and_add(&sysfs_entry->kobj, &dma_buf_ktype, NULL,
192
-
"%lu", file_inode(dmabuf->file)->i_ino);
195
+
"%lu", file_inode(file)->i_ino);
193
196
if (ret)
194
197
goto err_sysfs_dmabuf;
195
198
+2
-2
drivers/dma-buf/dma-buf-sysfs-stats.h
+2
-2
drivers/dma-buf/dma-buf-sysfs-stats.h
···
13
13
int dma_buf_init_sysfs_statistics(void);
14
14
void dma_buf_uninit_sysfs_statistics(void);
15
15
16
-
int dma_buf_stats_setup(struct dma_buf *dmabuf);
16
+
int dma_buf_stats_setup(struct dma_buf *dmabuf, struct file *file);
17
17
18
18
void dma_buf_stats_teardown(struct dma_buf *dmabuf);
19
19
#else
···
25
25
26
26
static inline void dma_buf_uninit_sysfs_statistics(void) {}
27
27
28
-
static inline int dma_buf_stats_setup(struct dma_buf *dmabuf)
28
+
static inline int dma_buf_stats_setup(struct dma_buf *dmabuf, struct file *file)
29
29
{
30
30
return 0;
31
31
}
+38
-44
drivers/dma-buf/dma-buf.c
+38
-44
drivers/dma-buf/dma-buf.c
···
95
95
return -EINVAL;
96
96
97
97
dmabuf = file->private_data;
98
-
99
-
mutex_lock(&db_list.lock);
100
-
list_del(&dmabuf->list_node);
101
-
mutex_unlock(&db_list.lock);
98
+
if (dmabuf) {
99
+
mutex_lock(&db_list.lock);
100
+
list_del(&dmabuf->list_node);
101
+
mutex_unlock(&db_list.lock);
102
+
}
102
103
103
104
return 0;
104
105
}
···
529
528
return file->f_op == &dma_buf_fops;
530
529
}
531
530
532
-
static struct file *dma_buf_getfile(struct dma_buf *dmabuf, int flags)
531
+
static struct file *dma_buf_getfile(size_t size, int flags)
533
532
{
534
533
static atomic64_t dmabuf_inode = ATOMIC64_INIT(0);
535
-
struct file *file;
536
534
struct inode *inode = alloc_anon_inode(dma_buf_mnt->mnt_sb);
535
+
struct file *file;
537
536
538
537
if (IS_ERR(inode))
539
538
return ERR_CAST(inode);
540
539
541
-
inode->i_size = dmabuf->size;
542
-
inode_set_bytes(inode, dmabuf->size);
540
+
inode->i_size = size;
541
+
inode_set_bytes(inode, size);
543
542
544
543
/*
545
544
* The ->i_ino acquired from get_next_ino() is not unique thus
···
553
552
flags, &dma_buf_fops);
554
553
if (IS_ERR(file))
555
554
goto err_alloc_file;
556
-
file->private_data = dmabuf;
557
-
file->f_path.dentry->d_fsdata = dmabuf;
558
555
559
556
return file;
560
557
···
618
619
size_t alloc_size = sizeof(struct dma_buf);
619
620
int ret;
620
621
621
-
if (!exp_info->resv)
622
-
alloc_size += sizeof(struct dma_resv);
623
-
else
624
-
/* prevent &dma_buf[1] == dma_buf->resv */
625
-
alloc_size += 1;
626
-
627
-
if (WARN_ON(!exp_info->priv
628
-
|| !exp_info->ops
629
-
|| !exp_info->ops->map_dma_buf
630
-
|| !exp_info->ops->unmap_dma_buf
631
-
|| !exp_info->ops->release)) {
622
+
if (WARN_ON(!exp_info->priv || !exp_info->ops
623
+
|| !exp_info->ops->map_dma_buf
624
+
|| !exp_info->ops->unmap_dma_buf
625
+
|| !exp_info->ops->release))
632
626
return ERR_PTR(-EINVAL);
633
-
}
634
627
635
628
if (WARN_ON(exp_info->ops->cache_sgt_mapping &&
636
629
(exp_info->ops->pin || exp_info->ops->unpin)))
···
634
643
if (!try_module_get(exp_info->owner))
635
644
return ERR_PTR(-ENOENT);
636
645
646
+
file = dma_buf_getfile(exp_info->size, exp_info->flags);
647
+
if (IS_ERR(file)) {
648
+
ret = PTR_ERR(file);
649
+
goto err_module;
650
+
}
651
+
652
+
if (!exp_info->resv)
653
+
alloc_size += sizeof(struct dma_resv);
654
+
else
655
+
/* prevent &dma_buf[1] == dma_buf->resv */
656
+
alloc_size += 1;
637
657
dmabuf = kzalloc(alloc_size, GFP_KERNEL);
638
658
if (!dmabuf) {
639
659
ret = -ENOMEM;
640
-
goto err_module;
660
+
goto err_file;
641
661
}
642
662
643
663
dmabuf->priv = exp_info->priv;
···
660
658
init_waitqueue_head(&dmabuf->poll);
661
659
dmabuf->cb_in.poll = dmabuf->cb_out.poll = &dmabuf->poll;
662
660
dmabuf->cb_in.active = dmabuf->cb_out.active = 0;
661
+
INIT_LIST_HEAD(&dmabuf->attachments);
663
662
664
663
if (!resv) {
665
-
resv = (struct dma_resv *)&dmabuf[1];
666
-
dma_resv_init(resv);
664
+
dmabuf->resv = (struct dma_resv *)&dmabuf[1];
665
+
dma_resv_init(dmabuf->resv);
666
+
} else {
667
+
dmabuf->resv = resv;
667
668
}
668
-
dmabuf->resv = resv;
669
669
670
-
file = dma_buf_getfile(dmabuf, exp_info->flags);
671
-
if (IS_ERR(file)) {
672
-
ret = PTR_ERR(file);
670
+
ret = dma_buf_stats_setup(dmabuf, file);
671
+
if (ret)
673
672
goto err_dmabuf;
674
-
}
675
673
674
+
file->private_data = dmabuf;
675
+
file->f_path.dentry->d_fsdata = dmabuf;
676
676
dmabuf->file = file;
677
-
678
-
INIT_LIST_HEAD(&dmabuf->attachments);
679
677
680
678
mutex_lock(&db_list.lock);
681
679
list_add(&dmabuf->list_node, &db_list.head);
682
680
mutex_unlock(&db_list.lock);
683
681
684
-
ret = dma_buf_stats_setup(dmabuf);
685
-
if (ret)
686
-
goto err_sysfs;
687
-
688
682
return dmabuf;
689
683
690
-
err_sysfs:
691
-
/*
692
-
* Set file->f_path.dentry->d_fsdata to NULL so that when
693
-
* dma_buf_release() gets invoked by dentry_ops, it exits
694
-
* early before calling the release() dma_buf op.
695
-
*/
696
-
file->f_path.dentry->d_fsdata = NULL;
697
-
fput(file);
698
684
err_dmabuf:
685
+
if (!resv)
686
+
dma_resv_fini(dmabuf->resv);
699
687
kfree(dmabuf);
688
+
err_file:
689
+
fput(file);
700
690
err_module:
701
691
module_put(exp_info->owner);
702
692
return ERR_PTR(ret);
+8
-6
drivers/gpu/drm/imx/ipuv3-plane.c
+8
-6
drivers/gpu/drm/imx/ipuv3-plane.c
···
614
614
break;
615
615
}
616
616
617
+
if (ipu_plane->dp_flow == IPU_DP_FLOW_SYNC_BG)
618
+
width = ipu_src_rect_width(new_state);
619
+
else
620
+
width = drm_rect_width(&new_state->src) >> 16;
621
+
617
622
eba = drm_plane_state_to_eba(new_state, 0);
618
623
619
624
/*
···
627
622
*/
628
623
if (ipu_state->use_pre) {
629
624
axi_id = ipu_chan_assign_axi_id(ipu_plane->dma);
630
-
ipu_prg_channel_configure(ipu_plane->ipu_ch, axi_id,
631
-
ipu_src_rect_width(new_state),
625
+
ipu_prg_channel_configure(ipu_plane->ipu_ch, axi_id, width,
632
626
drm_rect_height(&new_state->src) >> 16,
633
627
fb->pitches[0], fb->format->format,
634
628
fb->modifier, &eba);
···
682
678
break;
683
679
}
684
680
685
-
ipu_dmfc_config_wait4eot(ipu_plane->dmfc, ALIGN(drm_rect_width(dst), 8));
681
+
ipu_dmfc_config_wait4eot(ipu_plane->dmfc, width);
686
682
687
-
width = ipu_src_rect_width(new_state);
688
683
height = drm_rect_height(&new_state->src) >> 16;
689
684
info = drm_format_info(fb->format->format);
690
685
ipu_calculate_bursts(width, info->cpp[0], fb->pitches[0],
···
747
744
ipu_cpmem_set_burstsize(ipu_plane->ipu_ch, 16);
748
745
749
746
ipu_cpmem_zero(ipu_plane->alpha_ch);
750
-
ipu_cpmem_set_resolution(ipu_plane->alpha_ch,
751
-
ipu_src_rect_width(new_state),
747
+
ipu_cpmem_set_resolution(ipu_plane->alpha_ch, width,
752
748
drm_rect_height(&new_state->src) >> 16);
753
749
ipu_cpmem_set_format_passthrough(ipu_plane->alpha_ch, 8);
754
750
ipu_cpmem_set_high_priority(ipu_plane->alpha_ch);
+2
-3
drivers/gpu/drm/meson/meson_viu.c
+2
-3
drivers/gpu/drm/meson/meson_viu.c
···
436
436
437
437
/* Initialize OSD1 fifo control register */
438
438
reg = VIU_OSD_DDR_PRIORITY_URGENT |
439
-
VIU_OSD_HOLD_FIFO_LINES(31) |
440
439
VIU_OSD_FIFO_DEPTH_VAL(32) | /* fifo_depth_val: 32*8=256 */
441
440
VIU_OSD_WORDS_PER_BURST(4) | /* 4 words in 1 burst */
442
441
VIU_OSD_FIFO_LIMITS(2); /* fifo_lim: 2*16=32 */
443
442
444
443
if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A))
445
-
reg |= VIU_OSD_BURST_LENGTH_32;
444
+
reg |= (VIU_OSD_BURST_LENGTH_32 | VIU_OSD_HOLD_FIFO_LINES(31));
446
445
else
447
-
reg |= VIU_OSD_BURST_LENGTH_64;
446
+
reg |= (VIU_OSD_BURST_LENGTH_64 | VIU_OSD_HOLD_FIFO_LINES(4));
448
447
449
448
writel_relaxed(reg, priv->io_base + _REG(VIU_OSD1_FIFO_CTRL_STAT));
450
449
writel_relaxed(reg, priv->io_base + _REG(VIU_OSD2_FIFO_CTRL_STAT));
+18
-9
drivers/gpu/drm/panfrost/panfrost_drv.c
+18
-9
drivers/gpu/drm/panfrost/panfrost_drv.c
···
82
82
struct panfrost_gem_object *bo;
83
83
struct drm_panfrost_create_bo *args = data;
84
84
struct panfrost_gem_mapping *mapping;
85
+
int ret;
85
86
86
87
if (!args->size || args->pad ||
87
88
(args->flags & ~(PANFROST_BO_NOEXEC | PANFROST_BO_HEAP)))
···
93
92
!(args->flags & PANFROST_BO_NOEXEC))
94
93
return -EINVAL;
95
94
96
-
bo = panfrost_gem_create_with_handle(file, dev, args->size, args->flags,
97
-
&args->handle);
95
+
bo = panfrost_gem_create(dev, args->size, args->flags);
98
96
if (IS_ERR(bo))
99
97
return PTR_ERR(bo);
100
98
99
+
ret = drm_gem_handle_create(file, &bo->base.base, &args->handle);
100
+
if (ret)
101
+
goto out;
102
+
101
103
mapping = panfrost_gem_mapping_get(bo, priv);
102
-
if (!mapping) {
103
-
drm_gem_object_put(&bo->base.base);
104
-
return -EINVAL;
104
+
if (mapping) {
105
+
args->offset = mapping->mmnode.start << PAGE_SHIFT;
106
+
panfrost_gem_mapping_put(mapping);
107
+
} else {
108
+
/* This can only happen if the handle from
109
+
* drm_gem_handle_create() has already been guessed and freed
110
+
* by user space
111
+
*/
112
+
ret = -EINVAL;
105
113
}
106
114
107
-
args->offset = mapping->mmnode.start << PAGE_SHIFT;
108
-
panfrost_gem_mapping_put(mapping);
109
-
110
-
return 0;
115
+
out:
116
+
drm_gem_object_put(&bo->base.base);
117
+
return ret;
111
118
}
112
119
113
120
/**
+1
-15
drivers/gpu/drm/panfrost/panfrost_gem.c
+1
-15
drivers/gpu/drm/panfrost/panfrost_gem.c
···
235
235
}
236
236
237
237
struct panfrost_gem_object *
238
-
panfrost_gem_create_with_handle(struct drm_file *file_priv,
239
-
struct drm_device *dev, size_t size,
240
-
u32 flags,
241
-
uint32_t *handle)
238
+
panfrost_gem_create(struct drm_device *dev, size_t size, u32 flags)
242
239
{
243
-
int ret;
244
240
struct drm_gem_shmem_object *shmem;
245
241
struct panfrost_gem_object *bo;
246
242
···
251
255
bo = to_panfrost_bo(&shmem->base);
252
256
bo->noexec = !!(flags & PANFROST_BO_NOEXEC);
253
257
bo->is_heap = !!(flags & PANFROST_BO_HEAP);
254
-
255
-
/*
256
-
* Allocate an id of idr table where the obj is registered
257
-
* and handle has the id what user can see.
258
-
*/
259
-
ret = drm_gem_handle_create(file_priv, &shmem->base, handle);
260
-
/* drop reference from allocate - handle holds it now. */
261
-
drm_gem_object_put(&shmem->base);
262
-
if (ret)
263
-
return ERR_PTR(ret);
264
258
265
259
return bo;
266
260
}
+1
-4
drivers/gpu/drm/panfrost/panfrost_gem.h
+1
-4
drivers/gpu/drm/panfrost/panfrost_gem.h
···
69
69
struct sg_table *sgt);
70
70
71
71
struct panfrost_gem_object *
72
-
panfrost_gem_create_with_handle(struct drm_file *file_priv,
73
-
struct drm_device *dev, size_t size,
74
-
u32 flags,
75
-
uint32_t *handle);
72
+
panfrost_gem_create(struct drm_device *dev, size_t size, u32 flags);
76
73
77
74
int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv);
78
75
void panfrost_gem_close(struct drm_gem_object *obj,
+4
-2
drivers/gpu/drm/virtio/virtgpu_object.c
+4
-2
drivers/gpu/drm/virtio/virtgpu_object.c
···
184
184
struct virtio_gpu_object_array *objs = NULL;
185
185
struct drm_gem_shmem_object *shmem_obj;
186
186
struct virtio_gpu_object *bo;
187
-
struct virtio_gpu_mem_entry *ents;
187
+
struct virtio_gpu_mem_entry *ents = NULL;
188
188
unsigned int nents;
189
189
int ret;
190
190
···
210
210
ret = -ENOMEM;
211
211
objs = virtio_gpu_array_alloc(1);
212
212
if (!objs)
213
-
goto err_put_id;
213
+
goto err_free_entry;
214
214
virtio_gpu_array_add_obj(objs, &bo->base.base);
215
215
216
216
ret = virtio_gpu_array_lock_resv(objs);
···
239
239
240
240
err_put_objs:
241
241
virtio_gpu_array_put_free(objs);
242
+
err_free_entry:
243
+
kvfree(ents);
242
244
err_put_id:
243
245
virtio_gpu_resource_id_put(vgdev, bo->hw_res_handle);
244
246
err_free_gem: