Merge tag 'drm-misc-fixes-2026-03-06' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

+13 -4

drivers/accel/amdxdna/aie2_message.c

··· 293 293 } 294 294 295 295 intr_reg = i2x.mb_head_ptr_reg + 4; 296 - hwctx->priv->mbox_chann = xdna_mailbox_create_channel(ndev->mbox, &x2i, &i2x, 297 - intr_reg, ret); 296 + hwctx->priv->mbox_chann = xdna_mailbox_alloc_channel(ndev->mbox); 298 297 if (!hwctx->priv->mbox_chann) { 299 298 XDNA_ERR(xdna, "Not able to create channel"); 300 299 ret = -EINVAL; 301 300 goto del_ctx_req; 301 + } 302 + 303 + ret = xdna_mailbox_start_channel(hwctx->priv->mbox_chann, &x2i, &i2x, 304 + intr_reg, ret); 305 + if (ret) { 306 + XDNA_ERR(xdna, "Not able to create channel"); 307 + ret = -EINVAL; 308 + goto free_channel; 302 309 } 303 310 ndev->hwctx_num++; 304 311 ··· 314 307 315 308 return 0; 316 309 310 + free_channel: 311 + xdna_mailbox_free_channel(hwctx->priv->mbox_chann); 317 312 del_ctx_req: 318 313 aie2_destroy_context_req(ndev, hwctx->fw_ctx_id); 319 314 return ret; ··· 331 322 332 323 xdna_mailbox_stop_channel(hwctx->priv->mbox_chann); 333 324 ret = aie2_destroy_context_req(ndev, hwctx->fw_ctx_id); 334 - xdna_mailbox_destroy_channel(hwctx->priv->mbox_chann); 325 + xdna_mailbox_free_channel(hwctx->priv->mbox_chann); 335 326 XDNA_DBG(xdna, "Destroyed fw ctx %d", hwctx->fw_ctx_id); 336 327 hwctx->priv->mbox_chann = NULL; 337 328 hwctx->fw_ctx_id = -1; ··· 930 921 return; 931 922 932 923 xdna_mailbox_stop_channel(ndev->mgmt_chann); 933 - xdna_mailbox_destroy_channel(ndev->mgmt_chann); 924 + xdna_mailbox_free_channel(ndev->mgmt_chann); 934 925 ndev->mgmt_chann = NULL; 935 926 } 936 927

+37 -26

drivers/accel/amdxdna/aie2_pci.c

··· 361 361 } 362 362 pci_set_master(pdev); 363 363 364 + mbox_res.ringbuf_base = ndev->sram_base; 365 + mbox_res.ringbuf_size = pci_resource_len(pdev, xdna->dev_info->sram_bar); 366 + mbox_res.mbox_base = ndev->mbox_base; 367 + mbox_res.mbox_size = MBOX_SIZE(ndev); 368 + mbox_res.name = "xdna_mailbox"; 369 + ndev->mbox = xdnam_mailbox_create(&xdna->ddev, &mbox_res); 370 + if (!ndev->mbox) { 371 + XDNA_ERR(xdna, "failed to create mailbox device"); 372 + ret = -ENODEV; 373 + goto disable_dev; 374 + } 375 + 376 + ndev->mgmt_chann = xdna_mailbox_alloc_channel(ndev->mbox); 377 + if (!ndev->mgmt_chann) { 378 + XDNA_ERR(xdna, "failed to alloc channel"); 379 + ret = -ENODEV; 380 + goto disable_dev; 381 + } 382 + 364 383 ret = aie2_smu_init(ndev); 365 384 if (ret) { 366 385 XDNA_ERR(xdna, "failed to init smu, ret %d", ret); 367 - goto disable_dev; 386 + goto free_channel; 368 387 } 369 388 370 389 ret = aie2_psp_start(ndev->psp_hdl); ··· 398 379 goto stop_psp; 399 380 } 400 381 401 - mbox_res.ringbuf_base = ndev->sram_base; 402 - mbox_res.ringbuf_size = pci_resource_len(pdev, xdna->dev_info->sram_bar); 403 - mbox_res.mbox_base = ndev->mbox_base; 404 - mbox_res.mbox_size = MBOX_SIZE(ndev); 405 - mbox_res.name = "xdna_mailbox"; 406 - ndev->mbox = xdnam_mailbox_create(&xdna->ddev, &mbox_res); 407 - if (!ndev->mbox) { 408 - XDNA_ERR(xdna, "failed to create mailbox device"); 409 - ret = -ENODEV; 410 - goto stop_psp; 411 - } 412 - 413 382 mgmt_mb_irq = pci_irq_vector(pdev, ndev->mgmt_chan_idx); 414 383 if (mgmt_mb_irq < 0) { 415 384 ret = mgmt_mb_irq; ··· 406 399 } 407 400 408 401 xdna_mailbox_intr_reg = ndev->mgmt_i2x.mb_head_ptr_reg + 4; 409 - ndev->mgmt_chann = xdna_mailbox_create_channel(ndev->mbox, 410 - &ndev->mgmt_x2i, 411 - &ndev->mgmt_i2x, 412 - xdna_mailbox_intr_reg, 413 - mgmt_mb_irq); 414 - if (!ndev->mgmt_chann) { 415 - XDNA_ERR(xdna, "failed to create management mailbox channel"); 402 + ret = xdna_mailbox_start_channel(ndev->mgmt_chann, 403 + &ndev->mgmt_x2i, 404 + &ndev->mgmt_i2x, 405 + xdna_mailbox_intr_reg, 406 + mgmt_mb_irq); 407 + if (ret) { 408 + XDNA_ERR(xdna, "failed to start management mailbox channel"); 416 409 ret = -EINVAL; 417 410 goto stop_psp; 418 411 } ··· 420 413 ret = aie2_mgmt_fw_init(ndev); 421 414 if (ret) { 422 415 XDNA_ERR(xdna, "initial mgmt firmware failed, ret %d", ret); 423 - goto destroy_mgmt_chann; 416 + goto stop_fw; 424 417 } 425 418 426 419 ret = aie2_pm_init(ndev); 427 420 if (ret) { 428 421 XDNA_ERR(xdna, "failed to init pm, ret %d", ret); 429 - goto destroy_mgmt_chann; 422 + goto stop_fw; 430 423 } 431 424 432 425 ret = aie2_mgmt_fw_query(ndev); 433 426 if (ret) { 434 427 XDNA_ERR(xdna, "failed to query fw, ret %d", ret); 435 - goto destroy_mgmt_chann; 428 + goto stop_fw; 436 429 } 437 430 438 431 ret = aie2_error_async_events_alloc(ndev); 439 432 if (ret) { 440 433 XDNA_ERR(xdna, "Allocate async events failed, ret %d", ret); 441 - goto destroy_mgmt_chann; 434 + goto stop_fw; 442 435 } 443 436 444 437 ndev->dev_status = AIE2_DEV_START; 445 438 446 439 return 0; 447 440 448 - destroy_mgmt_chann: 449 - aie2_destroy_mgmt_chann(ndev); 441 + stop_fw: 442 + aie2_suspend_fw(ndev); 443 + xdna_mailbox_stop_channel(ndev->mgmt_chann); 450 444 stop_psp: 451 445 aie2_psp_stop(ndev->psp_hdl); 452 446 fini_smu: 453 447 aie2_smu_fini(ndev); 448 + free_channel: 449 + xdna_mailbox_free_channel(ndev->mgmt_chann); 450 + ndev->mgmt_chann = NULL; 454 451 disable_dev: 455 452 pci_disable_device(pdev); 456 453

+49 -50

drivers/accel/amdxdna/amdxdna_mailbox.c

··· 460 460 return ret; 461 461 } 462 462 463 - struct mailbox_channel * 464 - xdna_mailbox_create_channel(struct mailbox *mb, 465 - const struct xdna_mailbox_chann_res *x2i, 466 - const struct xdna_mailbox_chann_res *i2x, 467 - u32 iohub_int_addr, 468 - int mb_irq) 463 + struct mailbox_channel *xdna_mailbox_alloc_channel(struct mailbox *mb) 469 464 { 470 465 struct mailbox_channel *mb_chann; 471 - int ret; 472 - 473 - if (!is_power_of_2(x2i->rb_size) || !is_power_of_2(i2x->rb_size)) { 474 - pr_err("Ring buf size must be power of 2"); 475 - return NULL; 476 - } 477 466 478 467 mb_chann = kzalloc_obj(*mb_chann); 479 468 if (!mb_chann) 480 469 return NULL; 481 470 471 + INIT_WORK(&mb_chann->rx_work, mailbox_rx_worker); 472 + mb_chann->work_q = create_singlethread_workqueue(MAILBOX_NAME); 473 + if (!mb_chann->work_q) { 474 + MB_ERR(mb_chann, "Create workqueue failed"); 475 + goto free_chann; 476 + } 482 477 mb_chann->mb = mb; 478 + 479 + return mb_chann; 480 + 481 + free_chann: 482 + kfree(mb_chann); 483 + return NULL; 484 + } 485 + 486 + void xdna_mailbox_free_channel(struct mailbox_channel *mb_chann) 487 + { 488 + destroy_workqueue(mb_chann->work_q); 489 + kfree(mb_chann); 490 + } 491 + 492 + int 493 + xdna_mailbox_start_channel(struct mailbox_channel *mb_chann, 494 + const struct xdna_mailbox_chann_res *x2i, 495 + const struct xdna_mailbox_chann_res *i2x, 496 + u32 iohub_int_addr, 497 + int mb_irq) 498 + { 499 + int ret; 500 + 501 + if (!is_power_of_2(x2i->rb_size) || !is_power_of_2(i2x->rb_size)) { 502 + pr_err("Ring buf size must be power of 2"); 503 + return -EINVAL; 504 + } 505 + 483 506 mb_chann->msix_irq = mb_irq; 484 507 mb_chann->iohub_int_addr = iohub_int_addr; 485 508 memcpy(&mb_chann->res[CHAN_RES_X2I], x2i, sizeof(*x2i)); ··· 512 489 mb_chann->x2i_tail = mailbox_get_tailptr(mb_chann, CHAN_RES_X2I); 513 490 mb_chann->i2x_head = mailbox_get_headptr(mb_chann, CHAN_RES_I2X); 514 491 515 - INIT_WORK(&mb_chann->rx_work, mailbox_rx_worker); 516 - mb_chann->work_q = create_singlethread_workqueue(MAILBOX_NAME); 517 - if (!mb_chann->work_q) { 518 - MB_ERR(mb_chann, "Create workqueue failed"); 519 - goto free_and_out; 520 - } 521 - 522 492 /* Everything look good. Time to enable irq handler */ 523 493 ret = request_irq(mb_irq, mailbox_irq_handler, 0, MAILBOX_NAME, mb_chann); 524 494 if (ret) { 525 495 MB_ERR(mb_chann, "Failed to request irq %d ret %d", mb_irq, ret); 526 - goto destroy_wq; 496 + return ret; 527 497 } 528 498 529 499 mb_chann->bad_state = false; 530 500 mailbox_reg_write(mb_chann, mb_chann->iohub_int_addr, 0); 531 501 532 - MB_DBG(mb_chann, "Mailbox channel created (irq: %d)", mb_chann->msix_irq); 533 - return mb_chann; 534 - 535 - destroy_wq: 536 - destroy_workqueue(mb_chann->work_q); 537 - free_and_out: 538 - kfree(mb_chann); 539 - return NULL; 540 - } 541 - 542 - int xdna_mailbox_destroy_channel(struct mailbox_channel *mb_chann) 543 - { 544 - struct mailbox_msg *mb_msg; 545 - unsigned long msg_id; 546 - 547 - MB_DBG(mb_chann, "IRQ disabled and RX work cancelled"); 548 - free_irq(mb_chann->msix_irq, mb_chann); 549 - destroy_workqueue(mb_chann->work_q); 550 - /* We can clean up and release resources */ 551 - 552 - xa_for_each(&mb_chann->chan_xa, msg_id, mb_msg) 553 - mailbox_release_msg(mb_chann, mb_msg); 554 - 555 - xa_destroy(&mb_chann->chan_xa); 556 - 557 - MB_DBG(mb_chann, "Mailbox channel destroyed, irq: %d", mb_chann->msix_irq); 558 - kfree(mb_chann); 502 + MB_DBG(mb_chann, "Mailbox channel started (irq: %d)", mb_chann->msix_irq); 559 503 return 0; 560 504 } 561 505 562 506 void xdna_mailbox_stop_channel(struct mailbox_channel *mb_chann) 563 507 { 508 + struct mailbox_msg *mb_msg; 509 + unsigned long msg_id; 510 + 564 511 /* Disable an irq and wait. This might sleep. */ 565 - disable_irq(mb_chann->msix_irq); 512 + free_irq(mb_chann->msix_irq, mb_chann); 566 513 567 514 /* Cancel RX work and wait for it to finish */ 568 - cancel_work_sync(&mb_chann->rx_work); 569 - MB_DBG(mb_chann, "IRQ disabled and RX work cancelled"); 515 + drain_workqueue(mb_chann->work_q); 516 + 517 + /* We can clean up and release resources */ 518 + xa_for_each(&mb_chann->chan_xa, msg_id, mb_msg) 519 + mailbox_release_msg(mb_chann, mb_msg); 520 + xa_destroy(&mb_chann->chan_xa); 521 + 522 + MB_DBG(mb_chann, "Mailbox channel stopped, irq: %d", mb_chann->msix_irq); 570 523 } 571 524 572 525 struct mailbox *xdnam_mailbox_create(struct drm_device *ddev,

+17 -14

drivers/accel/amdxdna/amdxdna_mailbox.h

··· 74 74 const struct xdna_mailbox_res *res); 75 75 76 76 /* 77 - * xdna_mailbox_create_channel() -- Create a mailbox channel instance 77 + * xdna_mailbox_alloc_channel() -- alloc a mailbox channel 78 78 * 79 - * @mailbox: the handle return from xdna_mailbox_create() 79 + * @mb: mailbox handle 80 + */ 81 + struct mailbox_channel *xdna_mailbox_alloc_channel(struct mailbox *mb); 82 + 83 + /* 84 + * xdna_mailbox_start_channel() -- start a mailbox channel instance 85 + * 86 + * @mb_chann: the handle return from xdna_mailbox_alloc_channel() 80 87 * @x2i: host to firmware mailbox resources 81 88 * @i2x: firmware to host mailbox resources 82 89 * @xdna_mailbox_intr_reg: register addr of MSI-X interrupt ··· 91 84 * 92 85 * Return: If success, return a handle of mailbox channel. Otherwise, return NULL. 93 86 */ 94 - struct mailbox_channel * 95 - xdna_mailbox_create_channel(struct mailbox *mailbox, 96 - const struct xdna_mailbox_chann_res *x2i, 97 - const struct xdna_mailbox_chann_res *i2x, 98 - u32 xdna_mailbox_intr_reg, 99 - int mb_irq); 87 + int 88 + xdna_mailbox_start_channel(struct mailbox_channel *mb_chann, 89 + const struct xdna_mailbox_chann_res *x2i, 90 + const struct xdna_mailbox_chann_res *i2x, 91 + u32 xdna_mailbox_intr_reg, 92 + int mb_irq); 100 93 101 94 /* 102 - * xdna_mailbox_destroy_channel() -- destroy mailbox channel 95 + * xdna_mailbox_free_channel() -- free mailbox channel 103 96 * 104 97 * @mailbox_chann: the handle return from xdna_mailbox_create_channel() 105 - * 106 - * Return: if success, return 0. otherwise return error code 107 98 */ 108 - int xdna_mailbox_destroy_channel(struct mailbox_channel *mailbox_chann); 99 + void xdna_mailbox_free_channel(struct mailbox_channel *mailbox_chann); 109 100 110 101 /* 111 102 * xdna_mailbox_stop_channel() -- stop mailbox channel 112 103 * 113 104 * @mailbox_chann: the handle return from xdna_mailbox_create_channel() 114 - * 115 - * Return: if success, return 0. otherwise return error code 116 105 */ 117 106 void xdna_mailbox_stop_channel(struct mailbox_channel *mailbox_chann); 118 107

+9 -3

drivers/accel/ethosu/ethosu_gem.c

··· 245 245 ((st->ifm.stride_kernel >> 1) & 0x1) + 1; 246 246 u32 stride_x = ((st->ifm.stride_kernel >> 5) & 0x2) + 247 247 (st->ifm.stride_kernel & 0x1) + 1; 248 - u32 ifm_height = st->ofm.height[2] * stride_y + 248 + s32 ifm_height = st->ofm.height[2] * stride_y + 249 249 st->ifm.height[2] - (st->ifm.pad_top + st->ifm.pad_bottom); 250 - u32 ifm_width = st->ofm.width * stride_x + 250 + s32 ifm_width = st->ofm.width * stride_x + 251 251 st->ifm.width - (st->ifm.pad_left + st->ifm.pad_right); 252 + 253 + if (ifm_height < 0 || ifm_width < 0) 254 + return -EINVAL; 252 255 253 256 len = feat_matrix_length(info, &st->ifm, ifm_width, 254 257 ifm_height, st->ifm.depth); ··· 420 417 return ret; 421 418 break; 422 419 case NPU_OP_ELEMENTWISE: 423 - use_ifm2 = !((st.ifm2.broadcast == 8) || (param == 5) || 420 + use_scale = ethosu_is_u65(edev) ? 421 + (st.ifm2.broadcast & 0x80) : 422 + (st.ifm2.broadcast == 8); 423 + use_ifm2 = !(use_scale || (param == 5) || 424 424 (param == 6) || (param == 7) || (param == 0x24)); 425 425 use_ifm = st.ifm.broadcast != 8; 426 426 ret = calc_sizes_elemwise(ddev, info, cmd, &st, use_ifm, use_ifm2);

+19 -9

drivers/accel/ethosu/ethosu_job.c

··· 143 143 return ret; 144 144 } 145 145 146 - static void ethosu_job_cleanup(struct kref *ref) 146 + static void ethosu_job_err_cleanup(struct ethosu_job *job) 147 147 { 148 - struct ethosu_job *job = container_of(ref, struct ethosu_job, 149 - refcount); 150 148 unsigned int i; 151 - 152 - pm_runtime_put_autosuspend(job->dev->base.dev); 153 - 154 - dma_fence_put(job->done_fence); 155 - dma_fence_put(job->inference_done_fence); 156 149 157 150 for (i = 0; i < job->region_cnt; i++) 158 151 drm_gem_object_put(job->region_bo[i]); ··· 153 160 drm_gem_object_put(job->cmd_bo); 154 161 155 162 kfree(job); 163 + } 164 + 165 + static void ethosu_job_cleanup(struct kref *ref) 166 + { 167 + struct ethosu_job *job = container_of(ref, struct ethosu_job, 168 + refcount); 169 + 170 + pm_runtime_put_autosuspend(job->dev->base.dev); 171 + 172 + dma_fence_put(job->done_fence); 173 + dma_fence_put(job->inference_done_fence); 174 + 175 + ethosu_job_err_cleanup(job); 156 176 } 157 177 158 178 static void ethosu_job_put(struct ethosu_job *job) ··· 460 454 } 461 455 } 462 456 ret = ethosu_job_push(ejob); 457 + if (!ret) { 458 + ethosu_job_put(ejob); 459 + return 0; 460 + } 463 461 464 462 out_cleanup_job: 465 463 if (ret) 466 464 drm_sched_job_cleanup(&ejob->base); 467 465 out_put_job: 468 - ethosu_job_put(ejob); 466 + ethosu_job_err_cleanup(ejob); 469 467 470 468 return ret; 471 469 }

+2 -2

drivers/gpu/drm/drm_syncobj.c

··· 875 875 return drm_syncobj_export_sync_file(file_private, args->handle, 876 876 point, &args->fd); 877 877 878 - if (point) 878 + if (args->point) 879 879 return -EINVAL; 880 880 881 881 return drm_syncobj_handle_to_fd(file_private, args->handle, ··· 909 909 args->handle, 910 910 point); 911 911 912 - if (point) 912 + if (args->point) 913 913 return -EINVAL; 914 914 915 915 return drm_syncobj_fd_to_handle(file_private, args->fd,

+5 -4

drivers/gpu/drm/panthor/panthor_sched.c

··· 893 893 894 894 out_sync: 895 895 /* Make sure the CPU caches are invalidated before the seqno is read. 896 - * drm_gem_shmem_sync() is a NOP if map_wc=true, so no need to check 896 + * panthor_gem_sync() is a NOP if map_wc=true, so no need to check 897 897 * it here. 898 898 */ 899 - panthor_gem_sync(&bo->base.base, queue->syncwait.offset, 899 + panthor_gem_sync(&bo->base.base, 900 + DRM_PANTHOR_BO_SYNC_CPU_CACHE_FLUSH_AND_INVALIDATE, 901 + queue->syncwait.offset, 900 902 queue->syncwait.sync64 ? 901 903 sizeof(struct panthor_syncobj_64b) : 902 - sizeof(struct panthor_syncobj_32b), 903 - DRM_PANTHOR_BO_SYNC_CPU_CACHE_FLUSH_AND_INVALIDATE); 904 + sizeof(struct panthor_syncobj_32b)); 904 905 905 906 return queue->syncwait.kmap + queue->syncwait.offset; 906 907

+5 -6

drivers/gpu/drm/ttm/ttm_bo.c

··· 1107 1107 static s64 1108 1108 ttm_bo_swapout_cb(struct ttm_lru_walk *walk, struct ttm_buffer_object *bo) 1109 1109 { 1110 - struct ttm_resource *res = bo->resource; 1111 - struct ttm_place place = { .mem_type = res->mem_type }; 1110 + struct ttm_place place = { .mem_type = bo->resource->mem_type }; 1112 1111 struct ttm_bo_swapout_walk *swapout_walk = 1113 1112 container_of(walk, typeof(*swapout_walk), walk); 1114 1113 struct ttm_operation_ctx *ctx = walk->arg.ctx; ··· 1147 1148 /* 1148 1149 * Move to system cached 1149 1150 */ 1150 - if (res->mem_type != TTM_PL_SYSTEM) { 1151 + if (bo->resource->mem_type != TTM_PL_SYSTEM) { 1151 1152 struct ttm_resource *evict_mem; 1152 1153 struct ttm_place hop; 1153 1154 ··· 1179 1180 1180 1181 if (ttm_tt_is_populated(tt)) { 1181 1182 spin_lock(&bdev->lru_lock); 1182 - ttm_resource_del_bulk_move(res, bo); 1183 + ttm_resource_del_bulk_move(bo->resource, bo); 1183 1184 spin_unlock(&bdev->lru_lock); 1184 1185 1185 1186 ret = ttm_tt_swapout(bdev, tt, swapout_walk->gfp_flags); 1186 1187 1187 1188 spin_lock(&bdev->lru_lock); 1188 1189 if (ret) 1189 - ttm_resource_add_bulk_move(res, bo); 1190 - ttm_resource_move_to_lru_tail(res); 1190 + ttm_resource_add_bulk_move(bo->resource, bo); 1191 + ttm_resource_move_to_lru_tail(bo->resource); 1191 1192 spin_unlock(&bdev->lru_lock); 1192 1193 } 1193 1194

Configure Feed

Configure Feed