Commit 20a4c814 authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2025-05-08' of... 

Merge tag 'drm-misc-fixes-2025-05-08' of https://gitlab.freedesktop.org/drm/misc/kernel

 into drm-fixes

Short summary of fixes pull:

drm:
- Fix overflow when generating wedged event

ivpu:
- Increate timeouts
- Fix deadlock in cmdq ioctl
- Unlock mutices in correct order

panel:
- simple: Fix timings for AUO G101EVN010

ttm:
- Fix documentation
- Remove struct ttm_backup

v3d:
- Avoid memory leak in job handling

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://lore.kernel.org/r/20250508104939.GA76697@2a02-2454-fd5e-fd00-c110-cbf2-6528-c5be.dyn6.pyur.net
parents 92a09c47 7c6fa179

drivers/accel/ivpu/ivpu_hw.c

+1 −1
Original line number Diff line number Diff line
@@ -119,7 +119,7 @@ static void timeouts_init(struct ivpu_device *vdev) 
		else

			vdev->timeout.autosuspend = 100;

		vdev->timeout.d0i3_entry_msg = 5;

		vdev->timeout.state_dump_msg = 10;

		vdev->timeout.state_dump_msg = 100;

	}

}

drivers/accel/ivpu/ivpu_job.c

+25 −10
Original line number Diff line number Diff line
@@ -681,8 +681,8 @@ static int ivpu_job_submit(struct ivpu_job *job, u8 priority, u32 cmdq_id) 
err_erase_xa:

	xa_erase(&vdev->submitted_jobs_xa, job->job_id);

err_unlock:

	mutex_unlock(&vdev->submitted_jobs_lock);

	mutex_unlock(&file_priv->lock);

	mutex_unlock(&vdev->submitted_jobs_lock);

	ivpu_rpm_put(vdev);

	return ret;

}
@@ -874,15 +874,21 @@ int ivpu_cmdq_submit_ioctl(struct drm_device *dev, void *data, struct drm_file * 
int ivpu_cmdq_create_ioctl(struct drm_device *dev, void *data, struct drm_file *file)

{

	struct ivpu_file_priv *file_priv = file->driver_priv;

	struct ivpu_device *vdev = file_priv->vdev;

	struct drm_ivpu_cmdq_create *args = data;

	struct ivpu_cmdq *cmdq;

	int ret;



	if (!ivpu_is_capable(file_priv->vdev, DRM_IVPU_CAP_MANAGE_CMDQ))

	if (!ivpu_is_capable(vdev, DRM_IVPU_CAP_MANAGE_CMDQ))

		return -ENODEV;



	if (args->priority > DRM_IVPU_JOB_PRIORITY_REALTIME)

		return -EINVAL;



	ret = ivpu_rpm_get(vdev);

	if (ret < 0)

		return ret;



	mutex_lock(&file_priv->lock);



	cmdq = ivpu_cmdq_create(file_priv, ivpu_job_to_jsm_priority(args->priority), false);
@@ -891,6 +897,8 @@ int ivpu_cmdq_create_ioctl(struct drm_device *dev, void *data, struct drm_file * 


	mutex_unlock(&file_priv->lock);



	ivpu_rpm_put(vdev);



	return cmdq ? 0 : -ENOMEM;

}
@@ -900,28 +908,35 @@ int ivpu_cmdq_destroy_ioctl(struct drm_device *dev, void *data, struct drm_file 
	struct ivpu_device *vdev = file_priv->vdev;

	struct drm_ivpu_cmdq_destroy *args = data;

	struct ivpu_cmdq *cmdq;

	u32 cmdq_id;

	u32 cmdq_id = 0;

	int ret;



	if (!ivpu_is_capable(vdev, DRM_IVPU_CAP_MANAGE_CMDQ))

		return -ENODEV;



	ret = ivpu_rpm_get(vdev);

	if (ret < 0)

		return ret;



	mutex_lock(&file_priv->lock);



	cmdq = xa_load(&file_priv->cmdq_xa, args->cmdq_id);

	if (!cmdq || cmdq->is_legacy) {

		ret = -ENOENT;

		goto err_unlock;

	}



	} else {

		cmdq_id = cmdq->id;

		ivpu_cmdq_destroy(file_priv, cmdq);

		ret = 0;

	}



	mutex_unlock(&file_priv->lock);



	/* Abort any pending jobs only if cmdq was destroyed */

	if (!ret)

		ivpu_cmdq_abort_all_jobs(vdev, file_priv->ctx.id, cmdq_id);

	return 0;



err_unlock:

	mutex_unlock(&file_priv->lock);

	ivpu_rpm_put(vdev);



	return ret;

}

drivers/gpu/drm/drm_drv.c

+1 −1
Original line number Diff line number Diff line
@@ -549,7 +549,7 @@ int drm_dev_wedged_event(struct drm_device *dev, unsigned long method) 
		if (drm_WARN_ONCE(dev, !recovery, "invalid recovery method %u\n", opt))

			break;



		len += scnprintf(event_string + len, sizeof(event_string), "%s,", recovery);

		len += scnprintf(event_string + len, sizeof(event_string) - len, "%s,", recovery);

	}



	if (recovery)

drivers/gpu/drm/panel/panel-simple.c

+13 −12
Original line number Diff line number Diff line
@@ -1027,27 +1027,28 @@ static const struct panel_desc auo_g070vvn01 = { 
	},

};



static const struct drm_display_mode auo_g101evn010_mode = {

	.clock = 68930,

	.hdisplay = 1280,

	.hsync_start = 1280 + 82,

	.hsync_end = 1280 + 82 + 2,

	.htotal = 1280 + 82 + 2 + 84,

	.vdisplay = 800,

	.vsync_start = 800 + 8,

	.vsync_end = 800 + 8 + 2,

	.vtotal = 800 + 8 + 2 + 6,

static const struct display_timing auo_g101evn010_timing = {

	.pixelclock = { 64000000, 68930000, 85000000 },

	.hactive = { 1280, 1280, 1280 },

	.hfront_porch = { 8, 64, 256 },

	.hback_porch = { 8, 64, 256 },

	.hsync_len = { 40, 168, 767 },

	.vactive = { 800, 800, 800 },

	.vfront_porch = { 4, 8, 100 },

	.vback_porch = { 4, 8, 100 },

	.vsync_len = { 8, 16, 223 },

};



static const struct panel_desc auo_g101evn010 = {

	.modes = &auo_g101evn010_mode,

	.num_modes = 1,

	.timings = &auo_g101evn010_timing,

	.num_timings = 1,

	.bpc = 6,

	.size = {

		.width = 216,

		.height = 135,

	},

	.bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG,

	.bus_flags = DRM_BUS_FLAG_DE_HIGH,

	.connector_type = DRM_MODE_CONNECTOR_LVDS,

};

drivers/gpu/drm/ttm/ttm_backup.c

+12 −32
Original line number Diff line number Diff line
@@ -7,20 +7,6 @@ 
#include <linux/page-flags.h>

#include <linux/swap.h>



/*

 * Casting from randomized struct file * to struct ttm_backup * is fine since

 * struct ttm_backup is never defined nor dereferenced.

 */

static struct file *ttm_backup_to_file(struct ttm_backup *backup)

{

	return (void *)backup;

}



static struct ttm_backup *ttm_file_to_backup(struct file *file)

{

	return (void *)file;

}



/*

 * Need to map shmem indices to handle since a handle value

 * of 0 means error, following the swp_entry_t convention.
@@ -40,12 +26,12 @@ static pgoff_t ttm_backup_handle_to_shmem_idx(pgoff_t handle) 
 * @backup: The struct backup pointer used to obtain the handle

 * @handle: The handle obtained from the @backup_page function.

 */

void ttm_backup_drop(struct ttm_backup *backup, pgoff_t handle)

void ttm_backup_drop(struct file *backup, pgoff_t handle)

{

	loff_t start = ttm_backup_handle_to_shmem_idx(handle);



	start <<= PAGE_SHIFT;

	shmem_truncate_range(file_inode(ttm_backup_to_file(backup)), start,

	shmem_truncate_range(file_inode(backup), start,

			     start + PAGE_SIZE - 1);

}
@@ -55,16 +41,15 @@ void ttm_backup_drop(struct ttm_backup *backup, pgoff_t handle) 
 * @backup: The struct backup pointer used to back up the page.

 * @dst: The struct page to copy into.

 * @handle: The handle returned when the page was backed up.

 * @intr: Try to perform waits interruptable or at least killable.

 * @intr: Try to perform waits interruptible or at least killable.

 *

 * Return: 0 on success, Negative error code on failure, notably

 * -EINTR if @intr was set to true and a signal is pending.

 */

int ttm_backup_copy_page(struct ttm_backup *backup, struct page *dst,

int ttm_backup_copy_page(struct file *backup, struct page *dst,

			 pgoff_t handle, bool intr)

{

	struct file *filp = ttm_backup_to_file(backup);

	struct address_space *mapping = filp->f_mapping;

	struct address_space *mapping = backup->f_mapping;

	struct folio *from_folio;

	pgoff_t idx = ttm_backup_handle_to_shmem_idx(handle);
@@ -106,12 +91,11 @@ int ttm_backup_copy_page(struct ttm_backup *backup, struct page *dst, 
 * the folio size- and usage.

 */

s64

ttm_backup_backup_page(struct ttm_backup *backup, struct page *page,

ttm_backup_backup_page(struct file *backup, struct page *page,

		       bool writeback, pgoff_t idx, gfp_t page_gfp,

		       gfp_t alloc_gfp)

{

	struct file *filp = ttm_backup_to_file(backup);

	struct address_space *mapping = filp->f_mapping;

	struct address_space *mapping = backup->f_mapping;

	unsigned long handle = 0;

	struct folio *to_folio;

	int ret;
@@ -161,9 +145,9 @@ ttm_backup_backup_page(struct ttm_backup *backup, struct page *page, 
 *

 * After a call to this function, it's illegal to use the @backup pointer.

 */

void ttm_backup_fini(struct ttm_backup *backup)

void ttm_backup_fini(struct file *backup)

{

	fput(ttm_backup_to_file(backup));

	fput(backup);

}



/**
@@ -194,14 +178,10 @@ EXPORT_SYMBOL_GPL(ttm_backup_bytes_avail); 
 *

 * Create a backup utilizing shmem objects.

 *

 * Return: A pointer to a struct ttm_backup on success,

 * Return: A pointer to a struct file on success,

 * an error pointer on error.

 */

struct ttm_backup *ttm_backup_shmem_create(loff_t size)

struct file *ttm_backup_shmem_create(loff_t size)

{

	struct file *filp;



	filp = shmem_file_setup("ttm shmem backup", size, 0);



	return ttm_file_to_backup(filp);

	return shmem_file_setup("ttm shmem backup", size, 0);

}