kernel/linux.git/drivers/gpu/host1x, branch v7.2-rc1

gpu: host1x: Fix iommu_map_sgtable() return value check

2026-05-28T15:19:30+00:00

Commit "iommu: return full error code from iommu_map_sg[_atomic]()" changed iommu_map_sgtable() to return an ssize_t and negative values in error cases, rather than a size_t and a zero. pin_job() also was incorrectly assigning to 'int', which could cause overflows into negative values. Update pin_job() to correctly check for errors from iommu_map_sgtable. Fixes: ad8f36e4b6b1 ("iommu: return full error code from iommu_map_sg[_atomic]()") Signed-off-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260421-iommu_map_sgtable-return-v1-1-fb484c07d2a1@nvidia.com

gpu: host1x: Fix missing 'host1x_context_device_bus_type'

2026-05-28T15:19:30+00:00

The drivers/gpu/host1x/context_bus.c does not include any declaration of host1x_context_device_bus_type, and after including "context.h" it also showed that there are two definitions in the kernel because the extern declaration was missing the const qualifier. Include linux/host1x_context_bus.h and drop the wrong declaration from context.h. While at it, also predeclare struct host1x_memory_context. Fixes the following sparse warning: drivers/gpu/host1x/context_bus.c:9:23: warning: symbol 'host1x_context_device_bus_type' was not declared. Should it be static? Signed-off-by: Ben Dooks [treding@nvidia.com: minor fixups, reword commit message to reflect changes] Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260123140512.609167-1-ben.dooks@codethink.co.uk

gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path

2026-05-28T15:19:29+00:00

After device_initialize(), the embedded struct device in struct host1x_device should be released through the device core with put_device(). In host1x_device_add(), if host1x_device_parse_dt() fails, the current error path frees the object directly with kfree(device). That bypasses the normal device lifetime handling and leaks the reference held on the embedded struct device. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using put_device() in the host1x_device_parse_dt() failure path. Fixes: f4c5cf88fbd50 ("gpu: host1x: Provide a proper struct bus_type") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Acked-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260413141526.2961841-1-lgs201920130244@gmail.com

gpu: host1x: mipi: Fix device_node reference leak in tegra_mipi_request()

2026-05-28T15:19:29+00:00

In tegra_mipi_request(), when provider.np is not equal with args.np, it returns without calling of_node_put(args.np), causing a reference leak. Convert to use the existing goto out pattern to ensure proper cleanup. Fixes: 767598d447aa ("gpu: host1x: mipi: Update tegra_mipi_request() to be node based") Signed-off-by: Felix Gu Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260416-mipi-v1-1-9c027175abdf@gmail.com

host1x: bus: Fix missing ops null check in error teardown

2026-05-28T15:19:28+00:00

In host1x_device_init(), the error teardown paths do not check client->ops before dereferencing it, unlike the forward init paths which correctly guard with 'client->ops &&'. This can result in a NULL pointer dereference if client->ops is NULL. Fix by adding the missing client->ops check in both the teardown and teardown_late labels. Signed-off-by: shayderrr Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260517170456.84927-1-darknessshayder@gmail.com

gpu: host1x: Skip redundant HW state update

2026-05-28T15:19:28+00:00

When the fence list is empty, host1x_intr_update_hw_state() falls through to host1x_intr_disable_syncpt_intr() which does two MMIO writes to disable the syncpoint interrupt and clear its status. The ISR has already disabled and acked the interrupt before calling host1x_intr_handle_interrupt(), making these two writes redundant. Skip the update_hw_state() call if no fences remain. Measured Syncpoint wait latency (50000 samples): Average latency: 10.6 us -> 9.4 us 99.99 pct latency: 51.90 us -> 36.58 us Signed-off-by: Tanmay Patil Acked-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260514103153.766343-3-tanmayp@nvidia.com

gpu: host1x: Skip redundant syncpoint loads in host1x_syncpt_wait()

2026-05-28T15:19:28+00:00

In host1x_syncpt_wait(), the hardware syncpoint value was loaded initially for expiry check, and then loaded a second time to populate the caller's value pointer. Reuse a single load for both purposes. After dma_fence_wait_timeout(), the previous code reloaded the syncpoint value for the expiry check, which is only required in the timeout case. On success (i.e., return value > 0, or return value == 0 with zero jiffies remaining), the ISR has already cached the value before signaling the fence. The value pointer can therefore be populated using the cached value using host1x_syncpt_read_min() without MMIO access. Only the timeout path requires a fresh load, move host1x_syncpt_load() under that path. Measured Syncpoint wait latency (50000 samples): Average latency: 12.2 us -> 10.6 us 99.99 pct latency: 62.96 us -> 51.90 us Signed-off-by: Tanmay Patil Acked-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260514103153.766343-2-tanmayp@nvidia.com

gpu: host1x: Allow entries in BO caches to be freed

2026-05-28T15:19:28+00:00

When a buffer object is pinned via host1x_bo_pin() with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to the underlying host1x_bo (taken in tegra_bo_pin / gather_bo_pin), so as long as a mapping was cached, the bo itself could not be freed. However, the only way to remove the cached mapping was through the free path of the buffer object. This meant that if a bo got cached, it could never get freed again. Resolve the circularity by holding a weak reference to the bo from the cache side. This is done by having the .pin callbacks not bump the bo's refcount -- instead the common Host1x bo code does so, except for the cache reference. Also move the remove-cache-mapping-on-free code into a common function inside Host1x code. This is only called from the TegraDRM GEM buffers since those are the only ones that can be cached at the moment. Reported-by: Aaron Kling Fixes: 1f39b1dfa53c ("drm/tegra: Implement buffer object cache") Signed-off-by: Mikko Perttunen Tested-by: Aaron Kling Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260515-host1x-bocache-leak-v1-1-a0375f68aeab@nvidia.com

gpu: host1x: convert MIPI to use operation function pointers

2026-03-19T07:18:36+00:00

Convert existing MIPI code to use operation function pointers, a necessary step for supporting Tegra20/Tegra30 SoCs. All common MIPI configuration that is SoC-independent remains in mipi.c, while all SoC-specific code is moved to tegra114-mipi.c (The naming matches the first SoC generation with a dedicated calibration block). Shared structures and function calls are placed into tegra-mipi-cal.h. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Acked-by: Mikko Perttunen Signed-off-by: Hans Verkuil

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-22T04:03:00+00:00

This converts some of the visually simpler cases that have been split over multiple lines. I only did the ones that are easy to verify the resulting diff by having just that final GFP_KERNEL argument on the next line. Somebody should probably do a proper coccinelle script for this, but for me the trivial script actually resulted in an assertion failure in the middle of the script. I probably had made it a bit _too_ trivial. So after fighting that far a while I decided to just do some of the syntactically simpler cases with variations of the previous 'sed' scripts. The more syntactically complex multi-line cases would mostly really want whitespace cleanup anyway. Signed-off-by: Linus Torvalds