linux-stable.git/drivers/gpu/drm/panthor, branch linux-6.16.y

drm/panthor: Defer scheduler entitiy destruction to queue release

2025-10-02T11:48:34+00:00

[ Upstream commit 7d9c3442b02ab7dd3c44e20095a178fd57d2eccb ]

Commit de8548813824 ("drm/panthor: Add the scheduler logical block")
handled destruction of a group's queues' drm scheduler entities early
into the group destruction procedure.

However, that races with the group submit ioctl, because by the time
entities are destroyed (through the group destroy ioctl), the submission
procedure might've already obtained a group handle, and therefore the
ability to push jobs into entities. This is met with a DRM error message
within the drm scheduler core as a situation that should never occur.

Fix by deferring drm scheduler entity destruction to queue release time.

Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
Signed-off-by: Adrián Larumbe 
Reviewed-by: Steven Price 
Reviewed-by: Boris Brezillon 
Signed-off-by: Steven Price 
Link: https://lore.kernel.org/r/20250919164436.531930-1-adrian.larumbe@collabora.com
Signed-off-by: Sasha Levin

drm/panthor: validate group queue count

2025-09-19T14:37:35+00:00

[ Upstream commit a00f2015acdbd8a4b3d2382eaeebe11db1925fad ]

A panthor group can have at most MAX_CS_PER_CSG panthor queues.

Fixes: 4bdca11507928 ("drm/panthor: Add the driver frontend block")
Signed-off-by: Chia-I Wu 
Reviewed-by: Boris Brezillon  # v1
Reviewed-by: Steven Price 
Signed-off-by: Steven Price 
Link: https://lore.kernel.org/r/20250903192133.288477-1-olvaffe@gmail.com
Signed-off-by: Sasha Levin

drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code

2025-08-15T14:38:45+00:00

[ Upstream commit fe69a391808404977b1f002a6e7447de3de7a88e ]

The object is potentially already gone after the drm_gem_object_put().
In general the object should be fully constructed before calling
drm_gem_handle_create(), except the debugfs tracking uses a separate
lock and list and separate flag to denotate whether the object is
actually initialized.

Since I'm touching this all anyway simplify this by only adding the
object to the debugfs when it's ready for that, which allows us to
delete that separate flag. panthor_gem_debugfs_bo_rm() already checks
whether we've actually been added to the list or this is some error
path cleanup.

v2: Fix build issues for !CONFIG_DEBUGFS (Adrián)

v3: Add linebreak and remove outdated comment (Liviu)

Fixes: a3707f53eb3f ("drm/panthor: show device-wide list of DRM GEM objects over DebugFS")
Cc: Adrián Larumbe 
Cc: Boris Brezillon 
Cc: Steven Price 
Cc: Liviu Dudau 
Reviewed-by: Liviu Dudau 
Signed-off-by: Simona Vetter 
Signed-off-by: Simona Vetter 
Reviewed-by: Steven Price 
Signed-off-by: Steven Price 
Link: https://lore.kernel.org/r/20250709135220.1428931-1-simona.vetter@ffwll.ch
Signed-off-by: Sasha Levin

drm/panthor: Fix build warning when DEBUG_FS is disabled

2025-04-29T16:12:23+00:00

Commit a3707f53eb3f ("drm/panthor: show device-wide list of DRM GEM
objects over DebugFS") causes a build warning and linking error when
built without support for DebugFS, because of a non-inline non-static
function declaration in a header file.

On top of that, the function is only being used inside a single
compilation unit, so there is no point in exposing it as a global
symbol.

This is a follow-up from Arnd Bergmann's first fix.
Also move panthor_gem_debugfs_set_usage_flags() into panthor_gem.c and
declare it static.

Fixes: a3707f53eb3f ("drm/panthor: show device-wide list of DRM GEM objects over DebugFS")
Reported-by: Arnd Bergmann 
Closes: https://lore.kernel.org/dri-devel/20250424142419.47b9d457@collabora.com/T/#t
Signed-off-by: Adrián Larumbe 
Reviewed-by: Steven Price 
Reviewed-by: Liviu Dudau 
Link: https://lore.kernel.org/r/20250424184041.356191-1-adrian.larumbe@collabora.com
Signed-off-by: Boris Brezillon

drm/panthor: show device-wide list of DRM GEM objects over DebugFS

2025-04-23T08:35:36+00:00

Add a device DebugFS file that displays a complete list of all the DRM
GEM objects that are exposed to UM through a DRM handle.

Since leaking object identifiers that might belong to a different NS is
inadmissible, this functionality is only made available in debug builds
with DEBUGFS support enabled.

File format is that of a table, with each entry displaying a variety of
fields with information about each GEM object.

Each GEM object entry in the file displays the following information
fields: Client PID, BO's global name, reference count, BO virtual size,
BO resize size, VM address in its DRM-managed range, BO label and a GEM
state flags.

There's also a usage flags field for the type of BO, which tells us
whether it's a kernel BO and/or mapped onto the FW's address space.

GEM state and usage flag meanings are printed in the file prelude, so
that UM parsing tools can interpret the numerical values in the table.

Signed-off-by: Adrián Larumbe 
Reviewed-by: Liviu Dudau 
Reviewed-by: Boris Brezillon 
Reviewed-by: Steven Price 
Link: https://lore.kernel.org/r/20250423021238.1639175-5-adrian.larumbe@collabora.com
Signed-off-by: Boris Brezillon

drm/panthor: Label all kernel BO's

2025-04-23T08:35:35+00:00

Kernel BO's aren't exposed to UM, so labelling them is the responsibility
of the driver itself. This kind of tagging will prove useful in further
commits when want to expose these objects through DebugFS.

Expand panthor_kernel_bo_create() interface to take a NUL-terminated
string. No bounds checking is done because all label strings are given
as statically-allocated literals, but if a more complex kernel BO naming
scheme with explicit memory allocation and formatting was desired in the
future, this would have to change.

Signed-off-by: Adrián Larumbe 
Reviewed-by: Boris Brezillon 
Reviewed-by: Liviu Dudau 
Reviewed-by: Steven Price 
Link: https://lore.kernel.org/r/20250423021238.1639175-4-adrian.larumbe@collabora.com
Signed-off-by: Boris Brezillon

drm/panthor: Add driver IOCTL for setting BO labels

2025-04-23T08:35:35+00:00

Allow UM to label a BO for which it possesses a DRM handle.

Signed-off-by: Adrián Larumbe 
Reviewed-by: Liviu Dudau 
Reviewed-by: Boris Brezillon 
Reviewed-by: Steven Price 
Link: https://lore.kernel.org/r/20250423021238.1639175-3-adrian.larumbe@collabora.com
Signed-off-by: Boris Brezillon

drm/panthor: Introduce BO labeling

2025-04-23T08:35:35+00:00

Add a new character string Panthor BO field, and a function that allows
setting it from within the driver.

Driver takes care of freeing the string when it's replaced or no longer
needed at object destruction time, but allocating it is the responsibility
of callers.

Signed-off-by: Adrián Larumbe 
Reviewed-by: Boris Brezillon 
Reviewed-by: Liviu Dudau 
Reviewed-by: Steven Price 
Link: https://lore.kernel.org/r/20250423021238.1639175-2-adrian.larumbe@collabora.com
Signed-off-by: Boris Brezillon

drm/panthor: Don't create a file offset for NO_MMAP BOs

2025-04-22T08:56:03+00:00

Right now the DRM_PANTHOR_BO_NO_MMAP flag is ignored by
panthor_ioctl_bo_mmap_offset(), meaning BOs with this flag set can
have a file offset but can't be mapped anyway, because
panthor_gem_mmap() will filter them out.

If we error out at mmap_offset creation time, we can get rid of
panthor_gem_mmap() and call drm_gem_shmem_object_mmap directly, and
we get rid of this inconsistency of having an mmap offset for a
BO that can never be mmap-ed.

Changes in v2:
- Get rid of panthor_gem_mmap()
- Get rid of the Fixes tag and adjust the commit message accordingly
- Return ENOPERM instead of EINVAL

Changes in v3:
- Don't leak the BO ref
- Add R-bs

Reviewed-by: Steven Price 
Reviewed-by: Liviu Dudau 
Reviewed-by: Adrián Larumbe 
Link: https://lore.kernel.org/r/20250417121942.3574111-1-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon

drm/panthor: Fix the panthor_gpu_coherency_init() error path

2025-04-17T09:29:49+00:00

The panthor_gpu_coherency_init() call has been moved around, but the
error path hasn't been adjusted accordingly. Make sure we undo what
has been done before this call in case of failure.

Fixes: 7d5a3b22f5b5 ("drm/panthor: Call panthor_gpu_coherency_init() after PM resume()")
Reported-by: Dan Carpenter 
Closes: https://lore.kernel.org/dri-devel/4da470aa-4f84-460e-aff8-dabc8cc4da15@stanley.mountain/T/#t
Reviewed-by: Steven Price 
Reviewed-by: Liviu Dudau 
Link: https://lore.kernel.org/r/20250414130120.581274-1-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon