Commit d6dd930a authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-misc-fixes-2025-10-16' of... 

Merge tag 'drm-misc-fixes-2025-10-16' of https://gitlab.freedesktop.org/drm/misc/kernel

 into drm-fixes

Short summary of fixes pull:

ast:
- Fix display output after reboot

bridge:
- lt9211: Fix version check

core:
- draw: Avoid color truncation
- gpuvm: Avoid kernel-doc warning
- sched: Avoid double free

panthor:
- Fix MCU suspend

qaic:
- Init bootlog in correct order
- Treat remaining == 0 as error in find_and_map_user_pages()
- Lock access to DBC request queue

rockchip:
- vop2: Fix destination size in atomic check

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://lore.kernel.org/r/20251016141607.GA73919@linux.fritz.box
parents 520133b0 5801e652

drivers/accel/qaic/qaic.h

+2 −0
Original line number Diff line number Diff line
@@ -97,6 +97,8 @@ struct dma_bridge_chan { 
	 * response queue's head and tail pointer of this DBC.

	 */

	void __iomem		*dbc_base;

	/* Synchronizes access to Request queue's head and tail pointer */

	struct mutex		req_lock;

	/* Head of list where each node is a memory handle queued in request queue */

	struct list_head	xfer_list;

	/* Synchronizes DBC readers during cleanup */

drivers/accel/qaic/qaic_control.c

+1 −1
Original line number Diff line number Diff line
@@ -407,7 +407,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev, 
		return -EINVAL;

	remaining = in_trans->size - resources->xferred_dma_size;

	if (remaining == 0)

		return 0;

		return -EINVAL;



	if (check_add_overflow(xfer_start_addr, remaining, &end))

		return -EINVAL;

drivers/accel/qaic/qaic_data.c

+10 −2
Original line number Diff line number Diff line
@@ -1356,13 +1356,17 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr 
		goto release_ch_rcu;

	}



	ret = mutex_lock_interruptible(&dbc->req_lock);

	if (ret)

		goto release_ch_rcu;



	head = readl(dbc->dbc_base + REQHP_OFF);

	tail = readl(dbc->dbc_base + REQTP_OFF);



	if (head == U32_MAX || tail == U32_MAX) {

		/* PCI link error */

		ret = -ENODEV;

		goto release_ch_rcu;

		goto unlock_req_lock;

	}



	queue_level = head <= tail ? tail - head : dbc->nelem - (head - tail);
@@ -1370,11 +1374,12 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr 
	ret = send_bo_list_to_device(qdev, file_priv, exec, args->hdr.count, is_partial, dbc,

				     head, &tail);

	if (ret)

		goto release_ch_rcu;

		goto unlock_req_lock;



	/* Finalize commit to hardware */

	submit_ts = ktime_get_ns();

	writel(tail, dbc->dbc_base + REQTP_OFF);

	mutex_unlock(&dbc->req_lock);



	update_profiling_data(file_priv, exec, args->hdr.count, is_partial, received_ts,

			      submit_ts, queue_level);
@@ -1382,6 +1387,9 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr 
	if (datapath_polling)

		schedule_work(&dbc->poll_work);



unlock_req_lock:

	if (ret)

		mutex_unlock(&dbc->req_lock);

release_ch_rcu:

	srcu_read_unlock(&dbc->ch_lock, rcu_id);

unlock_dev_srcu:

drivers/accel/qaic/qaic_debugfs.c

+3 −2
Original line number Diff line number Diff line
@@ -218,6 +218,9 @@ static int qaic_bootlog_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_d 
	if (ret)

		goto destroy_workqueue;



	dev_set_drvdata(&mhi_dev->dev, qdev);

	qdev->bootlog_ch = mhi_dev;



	for (i = 0; i < BOOTLOG_POOL_SIZE; i++) {

		msg = devm_kzalloc(&qdev->pdev->dev, sizeof(*msg), GFP_KERNEL);

		if (!msg) {
@@ -233,8 +236,6 @@ static int qaic_bootlog_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_d 
			goto mhi_unprepare;

	}



	dev_set_drvdata(&mhi_dev->dev, qdev);

	qdev->bootlog_ch = mhi_dev;

	return 0;



mhi_unprepare:

drivers/accel/qaic/qaic_drv.c

+3 −0
Original line number Diff line number Diff line
@@ -454,6 +454,9 @@ static struct qaic_device *create_qdev(struct pci_dev *pdev, 
			return NULL;

		init_waitqueue_head(&qdev->dbc[i].dbc_release);

		INIT_LIST_HEAD(&qdev->dbc[i].bo_lists);

		ret = drmm_mutex_init(drm, &qdev->dbc[i].req_lock);

		if (ret)

			return NULL;

	}



	return qdev;