On Fri, May 15, 2026 at 11:34:51AM +0900, Mikko Perttunen wrote: > When a buffer object is pinned via host1x_bo_pin() with a cache, the > resulting mapping is kept in the cache so it can be reused on subsequent > pins. Each mapping held a reference to the underlying host1x_bo (taken > in tegra_bo_pin / gather_bo_pin), so as long as a mapping was cached, > the bo itself could not be freed. > > However, the only way to remove the cached mapping was through the free > path of the buffer object. This meant that if a bo got cached, it could > never get freed again. > > Resolve the circularity by holding a weak reference to the bo from the > cache side. This is done by having the .pin callbacks not bump the bo's > refcount -- instead the common Host1x bo code does so, except for the > cache reference. > > Also move the remove-cache-mapping-on-free code into a common function > inside Host1x code. This is only called from the TegraDRM GEM buffers > since those are the only ones that can be cached at the moment. > > Reported-by: Aaron Kling <[email protected]> > Fixes: 1f39b1dfa53c ("drm/tegra: Implement buffer object cache") > Signed-off-by: Mikko Perttunen <[email protected]> > --- > drivers/gpu/drm/tegra/gem.c | 13 ++------- > drivers/gpu/drm/tegra/submit.c | 3 +-- > drivers/gpu/host1x/bus.c | 60 > +++++++++++++++++++++++++++++++++++++++++- > include/linux/host1x.h | 7 +++++ > 4 files changed, 69 insertions(+), 14 deletions(-)
Applied, thanks. Thierry
signature.asc
Description: PGP signature
