From: Sasha Levin Date: Wed, 15 Feb 2023 17:33:08 +0000 (-0500) Subject: Drop drm-client-fix-circular-reference-counting-issue.patch from 6.1 X-Git-Tag: v4.14.306~61 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ff0b326de57878415f5e1d8ede021bdd3ad077ec;p=thirdparty%2Fkernel%2Fstable-queue.git Drop drm-client-fix-circular-reference-counting-issue.patch from 6.1 --- diff --git a/queue-6.1/dma-buf-add-unlocked-variant-of-vmapping-functions.patch b/queue-6.1/dma-buf-add-unlocked-variant-of-vmapping-functions.patch deleted file mode 100644 index c126985328c..00000000000 --- a/queue-6.1/dma-buf-add-unlocked-variant-of-vmapping-functions.patch +++ /dev/null @@ -1,101 +0,0 @@ -From a5b01b5f0c0e769850cb21d1a94f53e63a837b22 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 17 Oct 2022 20:22:09 +0300 -Subject: dma-buf: Add unlocked variant of vmapping functions -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Dmitry Osipenko - -[ Upstream commit 56e5abba8c3ec5c6098007693f9cefafaa2aa010 ] - -Add unlocked variant of dma_buf_vmap/vunmap() that will be utilized -by drivers that don't take the reservation lock explicitly. - -Acked-by: Sumit Semwal -Acked-by: Christian König -Signed-off-by: Dmitry Osipenko -Link: https://patchwork.freedesktop.org/patch/msgid/20221017172229.42269-2-dmitry.osipenko@collabora.com -Stable-dep-of: 85e26dd5100a ("drm/client: fix circular reference counting issue") -Signed-off-by: Sasha Levin ---- - drivers/dma-buf/dma-buf.c | 43 +++++++++++++++++++++++++++++++++++++++ - include/linux/dma-buf.h | 2 ++ - 2 files changed, 45 insertions(+) - -diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c -index eb6b59363c4f5..7f8d45ed6b843 100644 ---- a/drivers/dma-buf/dma-buf.c -+++ b/drivers/dma-buf/dma-buf.c -@@ -1430,6 +1430,33 @@ int dma_buf_vmap(struct dma_buf *dmabuf, struct iosys_map *map) - } - EXPORT_SYMBOL_NS_GPL(dma_buf_vmap, DMA_BUF); - -+/** -+ * dma_buf_vmap_unlocked - Create virtual mapping for the buffer object into kernel -+ * address space. Same restrictions as for vmap and friends apply. -+ * @dmabuf: [in] buffer to vmap -+ * @map: [out] returns the vmap pointer -+ * -+ * Unlocked version of dma_buf_vmap() -+ * -+ * Returns 0 on success, or a negative errno code otherwise. -+ */ -+int dma_buf_vmap_unlocked(struct dma_buf *dmabuf, struct iosys_map *map) -+{ -+ int ret; -+ -+ iosys_map_clear(map); -+ -+ if (WARN_ON(!dmabuf)) -+ return -EINVAL; -+ -+ dma_resv_lock(dmabuf->resv, NULL); -+ ret = dma_buf_vmap(dmabuf, map); -+ dma_resv_unlock(dmabuf->resv); -+ -+ return ret; -+} -+EXPORT_SYMBOL_NS_GPL(dma_buf_vmap_unlocked, DMA_BUF); -+ - /** - * dma_buf_vunmap - Unmap a vmap obtained by dma_buf_vmap. - * @dmabuf: [in] buffer to vunmap -@@ -1454,6 +1481,22 @@ void dma_buf_vunmap(struct dma_buf *dmabuf, struct iosys_map *map) - } - EXPORT_SYMBOL_NS_GPL(dma_buf_vunmap, DMA_BUF); - -+/** -+ * dma_buf_vunmap_unlocked - Unmap a vmap obtained by dma_buf_vmap. -+ * @dmabuf: [in] buffer to vunmap -+ * @map: [in] vmap pointer to vunmap -+ */ -+void dma_buf_vunmap_unlocked(struct dma_buf *dmabuf, struct iosys_map *map) -+{ -+ if (WARN_ON(!dmabuf)) -+ return; -+ -+ dma_resv_lock(dmabuf->resv, NULL); -+ dma_buf_vunmap(dmabuf, map); -+ dma_resv_unlock(dmabuf->resv); -+} -+EXPORT_SYMBOL_NS_GPL(dma_buf_vunmap_unlocked, DMA_BUF); -+ - #ifdef CONFIG_DEBUG_FS - static int dma_buf_debug_show(struct seq_file *s, void *unused) - { -diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h -index 71731796c8c3a..8daa054dd7fed 100644 ---- a/include/linux/dma-buf.h -+++ b/include/linux/dma-buf.h -@@ -632,4 +632,6 @@ int dma_buf_mmap(struct dma_buf *, struct vm_area_struct *, - unsigned long); - int dma_buf_vmap(struct dma_buf *dmabuf, struct iosys_map *map); - void dma_buf_vunmap(struct dma_buf *dmabuf, struct iosys_map *map); -+int dma_buf_vmap_unlocked(struct dma_buf *dmabuf, struct iosys_map *map); -+void dma_buf_vunmap_unlocked(struct dma_buf *dmabuf, struct iosys_map *map); - #endif /* __DMA_BUF_H__ */ --- -2.39.0 - diff --git a/queue-6.1/drm-client-fix-circular-reference-counting-issue.patch b/queue-6.1/drm-client-fix-circular-reference-counting-issue.patch deleted file mode 100644 index a58e09a79dd..00000000000 --- a/queue-6.1/drm-client-fix-circular-reference-counting-issue.patch +++ /dev/null @@ -1,151 +0,0 @@ -From db92a4cf57796e08928a386287b7112ba810a7ab Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 26 Jan 2023 10:24:26 +0100 -Subject: drm/client: fix circular reference counting issue -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Christian König - -[ Upstream commit 85e26dd5100a182bf8448050427539c0a66ab793 ] - -We reference dump buffers both by their handle as well as their -object. The problem is now that when anybody iterates over the DRM -framebuffers and exports the underlying GEM objects through DMA-buf -we run into a circular reference count situation. - -The result is that the fbdev handling holds the GEM handle preventing -the DMA-buf in the GEM object to be released. This DMA-buf in turn -holds a reference to the driver module which on unload would release -the fbdev. - -Break that loop by releasing the handle as soon as the DRM -framebuffer object is created. The DRM framebuffer and the DRM client -buffer structure still hold a reference to the underlying GEM object -preventing its destruction. - -Signed-off-by: Christian König -Fixes: c76f0f7cb546 ("drm: Begin an API for in-kernel clients") -Cc: -Reviewed-by: Thomas Zimmermann -Tested-by: Thomas Zimmermann -Link: https://patchwork.freedesktop.org/patch/msgid/20230126102814.8722-1-christian.koenig@amd.com -Signed-off-by: Sasha Levin ---- - drivers/gpu/drm/drm_client.c | 33 ++++++++++++++++++++------------- - include/drm/drm_client.h | 5 ----- - 2 files changed, 20 insertions(+), 18 deletions(-) - -diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c -index fd67efe37c636..056ab9d5f313b 100644 ---- a/drivers/gpu/drm/drm_client.c -+++ b/drivers/gpu/drm/drm_client.c -@@ -233,21 +233,17 @@ void drm_client_dev_restore(struct drm_device *dev) - - static void drm_client_buffer_delete(struct drm_client_buffer *buffer) - { -- struct drm_device *dev = buffer->client->dev; -- - if (buffer->gem) { - drm_gem_vunmap_unlocked(buffer->gem, &buffer->map); - drm_gem_object_put(buffer->gem); - } - -- if (buffer->handle) -- drm_mode_destroy_dumb(dev, buffer->handle, buffer->client->file); -- - kfree(buffer); - } - - static struct drm_client_buffer * --drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, u32 format) -+drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, -+ u32 format, u32 *handle) - { - const struct drm_format_info *info = drm_format_info(format); - struct drm_mode_create_dumb dumb_args = { }; -@@ -269,16 +265,15 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, u - if (ret) - goto err_delete; - -- buffer->handle = dumb_args.handle; -- buffer->pitch = dumb_args.pitch; -- - obj = drm_gem_object_lookup(client->file, dumb_args.handle); - if (!obj) { - ret = -ENOENT; - goto err_delete; - } - -+ buffer->pitch = dumb_args.pitch; - buffer->gem = obj; -+ *handle = dumb_args.handle; - - return buffer; - -@@ -365,7 +360,8 @@ static void drm_client_buffer_rmfb(struct drm_client_buffer *buffer) - } - - static int drm_client_buffer_addfb(struct drm_client_buffer *buffer, -- u32 width, u32 height, u32 format) -+ u32 width, u32 height, u32 format, -+ u32 handle) - { - struct drm_client_dev *client = buffer->client; - struct drm_mode_fb_cmd fb_req = { }; -@@ -377,7 +373,7 @@ static int drm_client_buffer_addfb(struct drm_client_buffer *buffer, - fb_req.depth = info->depth; - fb_req.width = width; - fb_req.height = height; -- fb_req.handle = buffer->handle; -+ fb_req.handle = handle; - fb_req.pitch = buffer->pitch; - - ret = drm_mode_addfb(client->dev, &fb_req, client->file); -@@ -414,13 +410,24 @@ struct drm_client_buffer * - drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 height, u32 format) - { - struct drm_client_buffer *buffer; -+ u32 handle; - int ret; - -- buffer = drm_client_buffer_create(client, width, height, format); -+ buffer = drm_client_buffer_create(client, width, height, format, -+ &handle); - if (IS_ERR(buffer)) - return buffer; - -- ret = drm_client_buffer_addfb(buffer, width, height, format); -+ ret = drm_client_buffer_addfb(buffer, width, height, format, handle); -+ -+ /* -+ * The handle is only needed for creating the framebuffer, destroy it -+ * again to solve a circular dependency should anybody export the GEM -+ * object as DMA-buf. The framebuffer and our buffer structure are still -+ * holding references to the GEM object to prevent its destruction. -+ */ -+ drm_mode_destroy_dumb(client->dev, handle, client->file); -+ - if (ret) { - drm_client_buffer_delete(buffer); - return ERR_PTR(ret); -diff --git a/include/drm/drm_client.h b/include/drm/drm_client.h -index 4fc8018edddad..1220d185c776b 100644 ---- a/include/drm/drm_client.h -+++ b/include/drm/drm_client.h -@@ -126,11 +126,6 @@ struct drm_client_buffer { - */ - struct drm_client_dev *client; - -- /** -- * @handle: Buffer handle -- */ -- u32 handle; -- - /** - * @pitch: Buffer pitch - */ --- -2.39.0 - diff --git a/queue-6.1/drm-client-prevent-null-dereference-in-drm_client_bu.patch b/queue-6.1/drm-client-prevent-null-dereference-in-drm_client_bu.patch deleted file mode 100644 index 5ddfd54a9d7..00000000000 --- a/queue-6.1/drm-client-prevent-null-dereference-in-drm_client_bu.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 90648d86814df13b130b722c653bc4913b8b4d7f Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 30 Oct 2022 18:44:12 +0300 -Subject: drm/client: Prevent NULL dereference in drm_client_buffer_delete() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Dmitry Osipenko - -[ Upstream commit 444bbba708e804c13ad757068d1cb31ed6460754 ] - -The drm_gem_vunmap() will crash with a NULL dereference if the passed -object pointer is NULL. It wasn't a problem before we added the locking -support to drm_gem_vunmap function because the mapping argument was always -NULL together with the object. Make drm_client_buffer_delete() to check -whether GEM is NULL before trying to unmap the GEM, it will happen on -framebuffer creation error. - -Reported-by: Dan Carpenter -Reviewed-by: Christian König -Link: https://lore.kernel.org/dri-devel/Y1kFEGxT8MVlf32V@kili/ -Fixes: 79e2cf2e7a19 ("drm/gem: Take reservation lock for vmap/vunmap operations") -Signed-off-by: Dmitry Osipenko -Link: https://patchwork.freedesktop.org/patch/msgid/20221030154412.8320-3-dmitry.osipenko@collabora.com -Stable-dep-of: 85e26dd5100a ("drm/client: fix circular reference counting issue") -Signed-off-by: Sasha Levin ---- - drivers/gpu/drm/drm_client.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c -index 38e1be991caa5..fd67efe37c636 100644 ---- a/drivers/gpu/drm/drm_client.c -+++ b/drivers/gpu/drm/drm_client.c -@@ -235,10 +235,10 @@ static void drm_client_buffer_delete(struct drm_client_buffer *buffer) - { - struct drm_device *dev = buffer->client->dev; - -- drm_gem_vunmap_unlocked(buffer->gem, &buffer->map); -- -- if (buffer->gem) -+ if (buffer->gem) { -+ drm_gem_vunmap_unlocked(buffer->gem, &buffer->map); - drm_gem_object_put(buffer->gem); -+ } - - if (buffer->handle) - drm_mode_destroy_dumb(dev, buffer->handle, buffer->client->file); --- -2.39.0 - diff --git a/queue-6.1/drm-client-switch-drm_client_buffer_delete-to-unlock.patch b/queue-6.1/drm-client-switch-drm_client_buffer_delete-to-unlock.patch deleted file mode 100644 index aaeca220b4c..00000000000 --- a/queue-6.1/drm-client-switch-drm_client_buffer_delete-to-unlock.patch +++ /dev/null @@ -1,47 +0,0 @@ -From b58f7e943a7894851a260d56ec72acb51374517a Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 21 Oct 2022 00:33:35 +0300 -Subject: drm/client: Switch drm_client_buffer_delete() to unlocked - drm_gem_vunmap -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Dmitry Osipenko - -[ Upstream commit 27b2ae654370e1a8e446b0e48c4e406abed12ca1 ] - -The drm_client_buffer_delete() wasn't switched to unlocked GEM vunmapping -by accident when rest of drm_client code transitioned to the unlocked -variants of the vmapping functions. Make drm_client_buffer_delete() use -the unlocked variant. This fixes lockdep warning splat about missing -reservation lock when framebuffer is released. - -Reported-by: kernel test robot -Link: https://lore.kernel.org/dri-devel/890f70db-68b0-8456-ca3c-c5496ef90517@collabora.com/T/ -Fixes: 79e2cf2e7a19 ("drm/gem: Take reservation lock for vmap/vunmap operations") -Signed-off-by: Dmitry Osipenko -Acked-by: Christian König -Link: https://patchwork.freedesktop.org/patch/msgid/20221020213335.309092-1-dmitry.osipenko@collabora.com -Stable-dep-of: 85e26dd5100a ("drm/client: fix circular reference counting issue") -Signed-off-by: Sasha Levin ---- - drivers/gpu/drm/drm_client.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c -index fbcb1e995384a..38e1be991caa5 100644 ---- a/drivers/gpu/drm/drm_client.c -+++ b/drivers/gpu/drm/drm_client.c -@@ -235,7 +235,7 @@ static void drm_client_buffer_delete(struct drm_client_buffer *buffer) - { - struct drm_device *dev = buffer->client->dev; - -- drm_gem_vunmap(buffer->gem, &buffer->map); -+ drm_gem_vunmap_unlocked(buffer->gem, &buffer->map); - - if (buffer->gem) - drm_gem_object_put(buffer->gem); --- -2.39.0 - diff --git a/queue-6.1/drm-gem-take-reservation-lock-for-vmap-vunmap-operat.patch b/queue-6.1/drm-gem-take-reservation-lock-for-vmap-vunmap-operat.patch deleted file mode 100644 index 4700eda71a8..00000000000 --- a/queue-6.1/drm-gem-take-reservation-lock-for-vmap-vunmap-operat.patch +++ /dev/null @@ -1,363 +0,0 @@ -From 5aba85285dfd0791457a02ef31250dc78b6c521e Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 17 Oct 2022 20:22:11 +0300 -Subject: drm/gem: Take reservation lock for vmap/vunmap operations -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Dmitry Osipenko - -[ Upstream commit 79e2cf2e7a193473dfb0da3b9b869682b43dc60f ] - -The new common dma-buf locking convention will require buffer importers -to hold the reservation lock around mapping operations. Make DRM GEM core -to take the lock around the vmapping operations and update DRM drivers to -use the locked functions for the case where DRM core now holds the lock. -This patch prepares DRM core and drivers to the common dynamic dma-buf -locking convention. - -Acked-by: Christian König -Signed-off-by: Dmitry Osipenko -Link: https://patchwork.freedesktop.org/patch/msgid/20221017172229.42269-4-dmitry.osipenko@collabora.com -Stable-dep-of: 85e26dd5100a ("drm/client: fix circular reference counting issue") -Signed-off-by: Sasha Levin ---- - drivers/gpu/drm/drm_client.c | 4 ++-- - drivers/gpu/drm/drm_gem.c | 24 ++++++++++++++++++++ - drivers/gpu/drm/drm_gem_dma_helper.c | 6 ++--- - drivers/gpu/drm/drm_gem_framebuffer_helper.c | 6 ++--- - drivers/gpu/drm/drm_gem_ttm_helper.c | 9 +------- - drivers/gpu/drm/lima/lima_sched.c | 4 ++-- - drivers/gpu/drm/panfrost/panfrost_dump.c | 4 ++-- - drivers/gpu/drm/panfrost/panfrost_perfcnt.c | 6 ++--- - drivers/gpu/drm/qxl/qxl_object.c | 17 +++++++------- - drivers/gpu/drm/qxl/qxl_prime.c | 4 ++-- - include/drm/drm_gem.h | 3 +++ - 11 files changed, 54 insertions(+), 33 deletions(-) - -diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c -index 2b230b4d69423..fbcb1e995384a 100644 ---- a/drivers/gpu/drm/drm_client.c -+++ b/drivers/gpu/drm/drm_client.c -@@ -323,7 +323,7 @@ drm_client_buffer_vmap(struct drm_client_buffer *buffer, - * fd_install step out of the driver backend hooks, to make that - * final step optional for internal users. - */ -- ret = drm_gem_vmap(buffer->gem, map); -+ ret = drm_gem_vmap_unlocked(buffer->gem, map); - if (ret) - return ret; - -@@ -345,7 +345,7 @@ void drm_client_buffer_vunmap(struct drm_client_buffer *buffer) - { - struct iosys_map *map = &buffer->map; - -- drm_gem_vunmap(buffer->gem, map); -+ drm_gem_vunmap_unlocked(buffer->gem, map); - } - EXPORT_SYMBOL(drm_client_buffer_vunmap); - -diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c -index 8b68a3c1e6ab6..b8db675e7fb5e 100644 ---- a/drivers/gpu/drm/drm_gem.c -+++ b/drivers/gpu/drm/drm_gem.c -@@ -1158,6 +1158,8 @@ int drm_gem_vmap(struct drm_gem_object *obj, struct iosys_map *map) - { - int ret; - -+ dma_resv_assert_held(obj->resv); -+ - if (!obj->funcs->vmap) - return -EOPNOTSUPP; - -@@ -1173,6 +1175,8 @@ EXPORT_SYMBOL(drm_gem_vmap); - - void drm_gem_vunmap(struct drm_gem_object *obj, struct iosys_map *map) - { -+ dma_resv_assert_held(obj->resv); -+ - if (iosys_map_is_null(map)) - return; - -@@ -1184,6 +1188,26 @@ void drm_gem_vunmap(struct drm_gem_object *obj, struct iosys_map *map) - } - EXPORT_SYMBOL(drm_gem_vunmap); - -+int drm_gem_vmap_unlocked(struct drm_gem_object *obj, struct iosys_map *map) -+{ -+ int ret; -+ -+ dma_resv_lock(obj->resv, NULL); -+ ret = drm_gem_vmap(obj, map); -+ dma_resv_unlock(obj->resv); -+ -+ return ret; -+} -+EXPORT_SYMBOL(drm_gem_vmap_unlocked); -+ -+void drm_gem_vunmap_unlocked(struct drm_gem_object *obj, struct iosys_map *map) -+{ -+ dma_resv_lock(obj->resv, NULL); -+ drm_gem_vunmap(obj, map); -+ dma_resv_unlock(obj->resv); -+} -+EXPORT_SYMBOL(drm_gem_vunmap_unlocked); -+ - /** - * drm_gem_lock_reservations - Sets up the ww context and acquires - * the lock on an array of GEM objects. -diff --git a/drivers/gpu/drm/drm_gem_dma_helper.c b/drivers/gpu/drm/drm_gem_dma_helper.c -index f6901ff97bbb5..1e658c4483668 100644 ---- a/drivers/gpu/drm/drm_gem_dma_helper.c -+++ b/drivers/gpu/drm/drm_gem_dma_helper.c -@@ -230,7 +230,7 @@ void drm_gem_dma_free(struct drm_gem_dma_object *dma_obj) - - if (gem_obj->import_attach) { - if (dma_obj->vaddr) -- dma_buf_vunmap(gem_obj->import_attach->dmabuf, &map); -+ dma_buf_vunmap_unlocked(gem_obj->import_attach->dmabuf, &map); - drm_prime_gem_destroy(gem_obj, dma_obj->sgt); - } else if (dma_obj->vaddr) { - if (dma_obj->map_noncoherent) -@@ -581,7 +581,7 @@ drm_gem_dma_prime_import_sg_table_vmap(struct drm_device *dev, - struct iosys_map map; - int ret; - -- ret = dma_buf_vmap(attach->dmabuf, &map); -+ ret = dma_buf_vmap_unlocked(attach->dmabuf, &map); - if (ret) { - DRM_ERROR("Failed to vmap PRIME buffer\n"); - return ERR_PTR(ret); -@@ -589,7 +589,7 @@ drm_gem_dma_prime_import_sg_table_vmap(struct drm_device *dev, - - obj = drm_gem_dma_prime_import_sg_table(dev, attach, sgt); - if (IS_ERR(obj)) { -- dma_buf_vunmap(attach->dmabuf, &map); -+ dma_buf_vunmap_unlocked(attach->dmabuf, &map); - return obj; - } - -diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c -index 880a4975507fc..e35e224e6303a 100644 ---- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c -+++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c -@@ -354,7 +354,7 @@ int drm_gem_fb_vmap(struct drm_framebuffer *fb, struct iosys_map *map, - ret = -EINVAL; - goto err_drm_gem_vunmap; - } -- ret = drm_gem_vmap(obj, &map[i]); -+ ret = drm_gem_vmap_unlocked(obj, &map[i]); - if (ret) - goto err_drm_gem_vunmap; - } -@@ -376,7 +376,7 @@ int drm_gem_fb_vmap(struct drm_framebuffer *fb, struct iosys_map *map, - obj = drm_gem_fb_get_obj(fb, i); - if (!obj) - continue; -- drm_gem_vunmap(obj, &map[i]); -+ drm_gem_vunmap_unlocked(obj, &map[i]); - } - return ret; - } -@@ -403,7 +403,7 @@ void drm_gem_fb_vunmap(struct drm_framebuffer *fb, struct iosys_map *map) - continue; - if (iosys_map_is_null(&map[i])) - continue; -- drm_gem_vunmap(obj, &map[i]); -+ drm_gem_vunmap_unlocked(obj, &map[i]); - } - } - EXPORT_SYMBOL(drm_gem_fb_vunmap); -diff --git a/drivers/gpu/drm/drm_gem_ttm_helper.c b/drivers/gpu/drm/drm_gem_ttm_helper.c -index e5fc875990c4f..d5962a34c01d5 100644 ---- a/drivers/gpu/drm/drm_gem_ttm_helper.c -+++ b/drivers/gpu/drm/drm_gem_ttm_helper.c -@@ -64,13 +64,8 @@ int drm_gem_ttm_vmap(struct drm_gem_object *gem, - struct iosys_map *map) - { - struct ttm_buffer_object *bo = drm_gem_ttm_of_gem(gem); -- int ret; -- -- dma_resv_lock(gem->resv, NULL); -- ret = ttm_bo_vmap(bo, map); -- dma_resv_unlock(gem->resv); - -- return ret; -+ return ttm_bo_vmap(bo, map); - } - EXPORT_SYMBOL(drm_gem_ttm_vmap); - -@@ -87,9 +82,7 @@ void drm_gem_ttm_vunmap(struct drm_gem_object *gem, - { - struct ttm_buffer_object *bo = drm_gem_ttm_of_gem(gem); - -- dma_resv_lock(gem->resv, NULL); - ttm_bo_vunmap(bo, map); -- dma_resv_unlock(gem->resv); - } - EXPORT_SYMBOL(drm_gem_ttm_vunmap); - -diff --git a/drivers/gpu/drm/lima/lima_sched.c b/drivers/gpu/drm/lima/lima_sched.c -index e82931712d8a2..ff003403fbbc7 100644 ---- a/drivers/gpu/drm/lima/lima_sched.c -+++ b/drivers/gpu/drm/lima/lima_sched.c -@@ -371,7 +371,7 @@ static void lima_sched_build_error_task_list(struct lima_sched_task *task) - } else { - buffer_chunk->size = lima_bo_size(bo); - -- ret = drm_gem_shmem_vmap(&bo->base, &map); -+ ret = drm_gem_vmap_unlocked(&bo->base.base, &map); - if (ret) { - kvfree(et); - goto out; -@@ -379,7 +379,7 @@ static void lima_sched_build_error_task_list(struct lima_sched_task *task) - - memcpy(buffer_chunk + 1, map.vaddr, buffer_chunk->size); - -- drm_gem_shmem_vunmap(&bo->base, &map); -+ drm_gem_vunmap_unlocked(&bo->base.base, &map); - } - - buffer_chunk = (void *)(buffer_chunk + 1) + buffer_chunk->size; -diff --git a/drivers/gpu/drm/panfrost/panfrost_dump.c b/drivers/gpu/drm/panfrost/panfrost_dump.c -index 6bd0634e2d580..e7942ac449c68 100644 ---- a/drivers/gpu/drm/panfrost/panfrost_dump.c -+++ b/drivers/gpu/drm/panfrost/panfrost_dump.c -@@ -209,7 +209,7 @@ void panfrost_core_dump(struct panfrost_job *job) - goto dump_header; - } - -- ret = drm_gem_shmem_vmap(&bo->base, &map); -+ ret = drm_gem_vmap_unlocked(&bo->base.base, &map); - if (ret) { - dev_err(pfdev->dev, "Panfrost Dump: couldn't map Buffer Object\n"); - iter.hdr->bomap.valid = 0; -@@ -236,7 +236,7 @@ void panfrost_core_dump(struct panfrost_job *job) - vaddr = map.vaddr; - memcpy(iter.data, vaddr, bo->base.base.size); - -- drm_gem_shmem_vunmap(&bo->base, &map); -+ drm_gem_vunmap_unlocked(&bo->base.base, &map); - - iter.hdr->bomap.valid = 1; - -diff --git a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c -index bc0df93f7f215..ba9b6e2b26363 100644 ---- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c -+++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c -@@ -106,7 +106,7 @@ static int panfrost_perfcnt_enable_locked(struct panfrost_device *pfdev, - goto err_close_bo; - } - -- ret = drm_gem_shmem_vmap(bo, &map); -+ ret = drm_gem_vmap_unlocked(&bo->base, &map); - if (ret) - goto err_put_mapping; - perfcnt->buf = map.vaddr; -@@ -165,7 +165,7 @@ static int panfrost_perfcnt_enable_locked(struct panfrost_device *pfdev, - return 0; - - err_vunmap: -- drm_gem_shmem_vunmap(bo, &map); -+ drm_gem_vunmap_unlocked(&bo->base, &map); - err_put_mapping: - panfrost_gem_mapping_put(perfcnt->mapping); - err_close_bo: -@@ -195,7 +195,7 @@ static int panfrost_perfcnt_disable_locked(struct panfrost_device *pfdev, - GPU_PERFCNT_CFG_MODE(GPU_PERFCNT_CFG_MODE_OFF)); - - perfcnt->user = NULL; -- drm_gem_shmem_vunmap(&perfcnt->mapping->obj->base, &map); -+ drm_gem_vunmap_unlocked(&perfcnt->mapping->obj->base.base, &map); - perfcnt->buf = NULL; - panfrost_gem_close(&perfcnt->mapping->obj->base.base, file_priv); - panfrost_mmu_as_put(pfdev, perfcnt->mapping->mmu); -diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c -index 695d9308d1f08..06a58dad5f5cf 100644 ---- a/drivers/gpu/drm/qxl/qxl_object.c -+++ b/drivers/gpu/drm/qxl/qxl_object.c -@@ -168,9 +168,16 @@ int qxl_bo_vmap_locked(struct qxl_bo *bo, struct iosys_map *map) - bo->map_count++; - goto out; - } -- r = ttm_bo_vmap(&bo->tbo, &bo->map); -+ -+ r = __qxl_bo_pin(bo); - if (r) - return r; -+ -+ r = ttm_bo_vmap(&bo->tbo, &bo->map); -+ if (r) { -+ __qxl_bo_unpin(bo); -+ return r; -+ } - bo->map_count = 1; - - /* TODO: Remove kptr in favor of map everywhere. */ -@@ -192,12 +199,6 @@ int qxl_bo_vmap(struct qxl_bo *bo, struct iosys_map *map) - if (r) - return r; - -- r = __qxl_bo_pin(bo); -- if (r) { -- qxl_bo_unreserve(bo); -- return r; -- } -- - r = qxl_bo_vmap_locked(bo, map); - qxl_bo_unreserve(bo); - return r; -@@ -247,6 +248,7 @@ void qxl_bo_vunmap_locked(struct qxl_bo *bo) - return; - bo->kptr = NULL; - ttm_bo_vunmap(&bo->tbo, &bo->map); -+ __qxl_bo_unpin(bo); - } - - int qxl_bo_vunmap(struct qxl_bo *bo) -@@ -258,7 +260,6 @@ int qxl_bo_vunmap(struct qxl_bo *bo) - return r; - - qxl_bo_vunmap_locked(bo); -- __qxl_bo_unpin(bo); - qxl_bo_unreserve(bo); - return 0; - } -diff --git a/drivers/gpu/drm/qxl/qxl_prime.c b/drivers/gpu/drm/qxl/qxl_prime.c -index 142d01415acb3..9169c26357d36 100644 ---- a/drivers/gpu/drm/qxl/qxl_prime.c -+++ b/drivers/gpu/drm/qxl/qxl_prime.c -@@ -59,7 +59,7 @@ int qxl_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map) - struct qxl_bo *bo = gem_to_qxl_bo(obj); - int ret; - -- ret = qxl_bo_vmap(bo, map); -+ ret = qxl_bo_vmap_locked(bo, map); - if (ret < 0) - return ret; - -@@ -71,5 +71,5 @@ void qxl_gem_prime_vunmap(struct drm_gem_object *obj, - { - struct qxl_bo *bo = gem_to_qxl_bo(obj); - -- qxl_bo_vunmap(bo); -+ qxl_bo_vunmap_locked(bo); - } -diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h -index bd42f25e449c2..a17c2f903f81e 100644 ---- a/include/drm/drm_gem.h -+++ b/include/drm/drm_gem.h -@@ -457,6 +457,9 @@ struct page **drm_gem_get_pages(struct drm_gem_object *obj); - void drm_gem_put_pages(struct drm_gem_object *obj, struct page **pages, - bool dirty, bool accessed); - -+int drm_gem_vmap_unlocked(struct drm_gem_object *obj, struct iosys_map *map); -+void drm_gem_vunmap_unlocked(struct drm_gem_object *obj, struct iosys_map *map); -+ - int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles, - int count, struct drm_gem_object ***objs_out); - struct drm_gem_object *drm_gem_object_lookup(struct drm_file *filp, u32 handle); --- -2.39.0 - diff --git a/queue-6.1/series b/queue-6.1/series index 6548dd9c640..cdf48f8af4f 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -2,11 +2,6 @@ mptcp-sockopt-make-tcp_fastopen_connect-generic.patch mptcp-fix-locking-for-setsockopt-corner-case.patch mptcp-deduplicate-error-paths-on-endpoint-creation.patch mptcp-fix-locking-for-in-kernel-listener-creation.patch -dma-buf-add-unlocked-variant-of-vmapping-functions.patch -drm-gem-take-reservation-lock-for-vmap-vunmap-operat.patch -drm-client-switch-drm_client_buffer_delete-to-unlock.patch -drm-client-prevent-null-dereference-in-drm_client_bu.patch -drm-client-fix-circular-reference-counting-issue.patch btrfs-move-the-auto-defrag-code-to-defrag.c.patch btrfs-lock-the-inode-in-shared-mode-before-starting-.patch asoc-amd-yc-add-dmi-support-for-new-acer-emdoor-plat.patch