1. Patchew
  2. linux
  3. View series

[PATCH V1] accel/amdxdna: Fix tail-pointer polling in mailbox_get_msg()

Lizhi Hou posted 1 patch 2 weeks ago 
drivers/accel/amdxdna/amdxdna_mailbox.c | 19 +------------------
1 file changed, 1 insertion(+), 18 deletions(-)
[PATCH V1] accel/amdxdna: Fix tail-pointer polling in mailbox_get_msg()
Posted by Lizhi Hou 2 weeks ago 
In mailbox_get_msg(), mailbox_reg_read_non_zero() is called to poll for a
non-zero tail pointer. This assumed that a zero value indicates an error.
However, certain corner cases legitimately produce a zero tail pointer.
To handle these cases, remove mailbox_reg_read_non_zero(). The zero tail
pointer will be treated as a valid rewind event.

Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
 drivers/accel/amdxdna/amdxdna_mailbox.c | 19 +------------------
 1 file changed, 1 insertion(+), 18 deletions(-)

diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c
index 858df97cd3fb..a60a85ce564c 100644
--- a/drivers/accel/amdxdna/amdxdna_mailbox.c
+++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
@@ -112,22 +112,6 @@ static u32 mailbox_reg_read(struct mailbox_channel *mb_chann, u32 mbox_reg)
 	return readl(ringbuf_addr);
 }
 
-static int mailbox_reg_read_non_zero(struct mailbox_channel *mb_chann, u32 mbox_reg, u32 *val)
-{
-	struct xdna_mailbox_res *mb_res = &mb_chann->mb->res;
-	void __iomem *ringbuf_addr = mb_res->mbox_base + mbox_reg;
-	int ret, value;
-
-	/* Poll till value is not zero */
-	ret = readx_poll_timeout(readl, ringbuf_addr, value,
-				 value, 1 /* us */, 100);
-	if (ret < 0)
-		return ret;
-
-	*val = value;
-	return 0;
-}
-
 static inline void
 mailbox_set_headptr(struct mailbox_channel *mb_chann, u32 headptr_val)
 {
@@ -286,8 +270,7 @@ static int mailbox_get_msg(struct mailbox_channel *mb_chann)
 	u32 start_addr;
 	int ret;
 
-	if (mailbox_reg_read_non_zero(mb_chann, mb_chann->res[CHAN_RES_I2X].mb_tail_ptr_reg, &tail))
-		return -EINVAL;
+	tail = mailbox_get_tailptr(mb_chann, CHAN_RES_I2X);
 	head = mb_chann->i2x_head;
 	ringbuf_size = mailbox_get_ringbuf_size(mb_chann, CHAN_RES_I2X);
 	start_addr = mb_chann->res[CHAN_RES_I2X].rb_start_addr;
-- 
2.34.1
Re: [PATCH V1] accel/amdxdna: Fix tail-pointer polling in mailbox_get_msg()
Posted by Falkowski, Maciej 1 week, 6 days ago 
Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>

On 12/4/2025 7:16 PM, Lizhi Hou wrote:
> In mailbox_get_msg(), mailbox_reg_read_non_zero() is called to poll for a
> non-zero tail pointer. This assumed that a zero value indicates an error.
> However, certain corner cases legitimately produce a zero tail pointer.
> To handle these cases, remove mailbox_reg_read_non_zero(). The zero tail
> pointer will be treated as a valid rewind event.
>
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> ---
>   drivers/accel/amdxdna/amdxdna_mailbox.c | 19 +------------------
>   1 file changed, 1 insertion(+), 18 deletions(-)
>
> diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c
> index 858df97cd3fb..a60a85ce564c 100644
> --- a/drivers/accel/amdxdna/amdxdna_mailbox.c
> +++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
> @@ -112,22 +112,6 @@ static u32 mailbox_reg_read(struct mailbox_channel *mb_chann, u32 mbox_reg)
>   	return readl(ringbuf_addr);
>   }
>   
> -static int mailbox_reg_read_non_zero(struct mailbox_channel *mb_chann, u32 mbox_reg, u32 *val)
> -{
> -	struct xdna_mailbox_res *mb_res = &mb_chann->mb->res;
> -	void __iomem *ringbuf_addr = mb_res->mbox_base + mbox_reg;
> -	int ret, value;
> -
> -	/* Poll till value is not zero */
> -	ret = readx_poll_timeout(readl, ringbuf_addr, value,
> -				 value, 1 /* us */, 100);
> -	if (ret < 0)
> -		return ret;
> -
> -	*val = value;
> -	return 0;
> -}
> -
>   static inline void
>   mailbox_set_headptr(struct mailbox_channel *mb_chann, u32 headptr_val)
>   {
> @@ -286,8 +270,7 @@ static int mailbox_get_msg(struct mailbox_channel *mb_chann)
>   	u32 start_addr;
>   	int ret;
>   
> -	if (mailbox_reg_read_non_zero(mb_chann, mb_chann->res[CHAN_RES_I2X].mb_tail_ptr_reg, &tail))
> -		return -EINVAL;
> +	tail = mailbox_get_tailptr(mb_chann, CHAN_RES_I2X);
>   	head = mb_chann->i2x_head;
>   	ringbuf_size = mailbox_get_ringbuf_size(mb_chann, CHAN_RES_I2X);
>   	start_addr = mb_chann->res[CHAN_RES_I2X].rb_start_addr;
Re: [PATCH V1] accel/amdxdna: Fix tail-pointer polling in mailbox_get_msg()
Posted by Lizhi Hou 1 week, 3 days ago 
Applied to drm-misc-next

On 12/5/25 08:41, Falkowski, Maciej wrote:
> Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
>
> On 12/4/2025 7:16 PM, Lizhi Hou wrote:
>> In mailbox_get_msg(), mailbox_reg_read_non_zero() is called to poll 
>> for a
>> non-zero tail pointer. This assumed that a zero value indicates an 
>> error.
>> However, certain corner cases legitimately produce a zero tail pointer.
>> To handle these cases, remove mailbox_reg_read_non_zero(). The zero tail
>> pointer will be treated as a valid rewind event.
>>
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
>> ---
>>   drivers/accel/amdxdna/amdxdna_mailbox.c | 19 +------------------
>>   1 file changed, 1 insertion(+), 18 deletions(-)
>>
>> diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c 
>> b/drivers/accel/amdxdna/amdxdna_mailbox.c
>> index 858df97cd3fb..a60a85ce564c 100644
>> --- a/drivers/accel/amdxdna/amdxdna_mailbox.c
>> +++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
>> @@ -112,22 +112,6 @@ static u32 mailbox_reg_read(struct 
>> mailbox_channel *mb_chann, u32 mbox_reg)
>>       return readl(ringbuf_addr);
>>   }
>>   -static int mailbox_reg_read_non_zero(struct mailbox_channel 
>> *mb_chann, u32 mbox_reg, u32 *val)
>> -{
>> -    struct xdna_mailbox_res *mb_res = &mb_chann->mb->res;
>> -    void __iomem *ringbuf_addr = mb_res->mbox_base + mbox_reg;
>> -    int ret, value;
>> -
>> -    /* Poll till value is not zero */
>> -    ret = readx_poll_timeout(readl, ringbuf_addr, value,
>> -                 value, 1 /* us */, 100);
>> -    if (ret < 0)
>> -        return ret;
>> -
>> -    *val = value;
>> -    return 0;
>> -}
>> -
>>   static inline void
>>   mailbox_set_headptr(struct mailbox_channel *mb_chann, u32 headptr_val)
>>   {
>> @@ -286,8 +270,7 @@ static int mailbox_get_msg(struct mailbox_channel 
>> *mb_chann)
>>       u32 start_addr;
>>       int ret;
>>   -    if (mailbox_reg_read_non_zero(mb_chann, 
>> mb_chann->res[CHAN_RES_I2X].mb_tail_ptr_reg, &tail))
>> -        return -EINVAL;
>> +    tail = mailbox_get_tailptr(mb_chann, CHAN_RES_I2X);
>>       head = mb_chann->i2x_head;
>>       ringbuf_size = mailbox_get_ringbuf_size(mb_chann, CHAN_RES_I2X);
>>       start_addr = mb_chann->res[CHAN_RES_I2X].rb_start_addr;

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.