* [PATCH V1] accel/amdxdna: Fix deadlock on debug BO command timeout
@ 2026-07-07 5:57 Lizhi Hou
2026-07-07 15:12 ` Max Zhen
0 siblings, 1 reply; 3+ messages in thread
From: Lizhi Hou @ 2026-07-07 5:57 UTC (permalink / raw)
To: ogabbay, quic_jhugo, dri-devel, mario.limonciello, karol.wachowski
Cc: Lizhi Hou, linux-kernel, max.zhen, sonal.santan
Both amdxdna_hwctx_sync_debug_bo() and amdxdna_drm_config_hwctx_ioctl()
hold xdna->dev_lock while invoking backend operations. If the hardware
hangs, aie2_cmd_wait() blocks waiting for a firmware response. When the
DRM scheduler timeout expires, aie2_sched_job_timedout() is invoked to
reset the hardware. However, the timeout handler also attempts to acquire
dev_lock, resulting in a deadlock.
Avoid this by releasing dev_lock before waiting for the firmware
response and reacquiring it after the wait completes. This allows the
timeout handler to proceed with device recovery when a debug BO command
times out.
Fixes: 7ea046838021 ("accel/amdxdna: Support firmware debug buffer")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
drivers/accel/amdxdna/aie2_ctx.c | 5 ++++-
drivers/accel/amdxdna/amdxdna_ctx.c | 6 ++++++
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
index 7bf635634e64..30ccb8d5e23d 100644
--- a/drivers/accel/amdxdna/aie2_ctx.c
+++ b/drivers/accel/amdxdna/aie2_ctx.c
@@ -900,13 +900,16 @@ static int aie2_hwctx_cu_config(struct amdxdna_hwctx *hwctx, void *buf, u32 size
static void aie2_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq)
{
struct dma_fence *out_fence = aie2_cmd_get_out_fence(hwctx, seq);
+ struct amdxdna_dev *xdna = hwctx->client->xdna;
if (!out_fence) {
- XDNA_ERR(hwctx->client->xdna, "Failed to get fence");
+ XDNA_ERR(xdna, "Failed to get fence");
return;
}
+ mutex_unlock(&xdna->dev_lock);
dma_fence_wait_timeout(out_fence, false, MAX_SCHEDULE_TIMEOUT);
+ mutex_lock(&xdna->dev_lock);
dma_fence_put(out_fence);
}
diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
index 67a2abcf173e..9ae19393e488 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.c
+++ b/drivers/accel/amdxdna/amdxdna_ctx.c
@@ -310,6 +310,7 @@ int amdxdna_drm_destroy_hwctx_ioctl(struct drm_device *dev, void *data, struct d
if (!drm_dev_enter(dev, &idx))
return -ENODEV;
+ mutex_lock(&xdna->client_lock);
mutex_lock(&xdna->dev_lock);
hwctx = xa_erase(&client->hwctx_xa, args->handle);
if (!hwctx) {
@@ -328,6 +329,7 @@ int amdxdna_drm_destroy_hwctx_ioctl(struct drm_device *dev, void *data, struct d
XDNA_DBG(xdna, "PID %d destroyed HW context %d", client->pid, args->handle);
out:
mutex_unlock(&xdna->dev_lock);
+ mutex_unlock(&xdna->client_lock);
drm_dev_exit(idx);
return ret;
}
@@ -388,6 +390,7 @@ int amdxdna_drm_config_hwctx_ioctl(struct drm_device *dev, void *data, struct dr
goto free_buf;
}
+ mutex_lock(&xdna->client_lock);
mutex_lock(&xdna->dev_lock);
hwctx = xa_load(&client->hwctx_xa, args->handle);
if (!hwctx) {
@@ -400,6 +403,7 @@ int amdxdna_drm_config_hwctx_ioctl(struct drm_device *dev, void *data, struct dr
unlock:
mutex_unlock(&xdna->dev_lock);
+ mutex_unlock(&xdna->client_lock);
amdxdna_pm_suspend_put(xdna);
free_buf:
kfree(buf);
@@ -428,6 +432,7 @@ int amdxdna_hwctx_sync_debug_bo(struct amdxdna_client *client, u32 debug_bo_hdl)
}
abo = to_xdna_obj(gobj);
+ mutex_lock(&xdna->client_lock);
mutex_lock(&xdna->dev_lock);
hwctx = xa_load(&client->hwctx_xa, abo->assigned_hwctx);
if (!hwctx) {
@@ -439,6 +444,7 @@ int amdxdna_hwctx_sync_debug_bo(struct amdxdna_client *client, u32 debug_bo_hdl)
unlock:
mutex_unlock(&xdna->dev_lock);
+ mutex_unlock(&xdna->client_lock);
amdxdna_pm_suspend_put(xdna);
put_obj:
drm_gem_object_put(gobj);
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH V1] accel/amdxdna: Fix deadlock on debug BO command timeout
2026-07-07 5:57 [PATCH V1] accel/amdxdna: Fix deadlock on debug BO command timeout Lizhi Hou
@ 2026-07-07 15:12 ` Max Zhen
2026-07-07 17:13 ` Lizhi Hou
0 siblings, 1 reply; 3+ messages in thread
From: Max Zhen @ 2026-07-07 15:12 UTC (permalink / raw)
To: Lizhi Hou, ogabbay, quic_jhugo, dri-devel, mario.limonciello,
karol.wachowski
Cc: linux-kernel, sonal.santan
On 7/6/2026 Mon 22:57, Lizhi Hou wrote:
> Both amdxdna_hwctx_sync_debug_bo() and amdxdna_drm_config_hwctx_ioctl()
> hold xdna->dev_lock while invoking backend operations. If the hardware
> hangs, aie2_cmd_wait() blocks waiting for a firmware response. When the
> DRM scheduler timeout expires, aie2_sched_job_timedout() is invoked to
> reset the hardware. However, the timeout handler also attempts to acquire
> dev_lock, resulting in a deadlock.
>
> Avoid this by releasing dev_lock before waiting for the firmware
> response and reacquiring it after the wait completes. This allows the
> timeout handler to proceed with device recovery when a debug BO command
> times out.
>
> Fixes: 7ea046838021 ("accel/amdxdna: Support firmware debug buffer")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Max Zhen <max.zhen@amd.com>
> ---
> drivers/accel/amdxdna/aie2_ctx.c | 5 ++++-
> drivers/accel/amdxdna/amdxdna_ctx.c | 6 ++++++
> 2 files changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
> index 7bf635634e64..30ccb8d5e23d 100644
> --- a/drivers/accel/amdxdna/aie2_ctx.c
> +++ b/drivers/accel/amdxdna/aie2_ctx.c
> @@ -900,13 +900,16 @@ static int aie2_hwctx_cu_config(struct amdxdna_hwctx *hwctx, void *buf, u32 size
> static void aie2_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq)
> {
> struct dma_fence *out_fence = aie2_cmd_get_out_fence(hwctx, seq);
> + struct amdxdna_dev *xdna = hwctx->client->xdna;
>
> if (!out_fence) {
> - XDNA_ERR(hwctx->client->xdna, "Failed to get fence");
> + XDNA_ERR(xdna, "Failed to get fence");
> return;
> }
>
> + mutex_unlock(&xdna->dev_lock);
> dma_fence_wait_timeout(out_fence, false, MAX_SCHEDULE_TIMEOUT);
> + mutex_lock(&xdna->dev_lock);
> dma_fence_put(out_fence);
> }
>
> diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
> index 67a2abcf173e..9ae19393e488 100644
> --- a/drivers/accel/amdxdna/amdxdna_ctx.c
> +++ b/drivers/accel/amdxdna/amdxdna_ctx.c
> @@ -310,6 +310,7 @@ int amdxdna_drm_destroy_hwctx_ioctl(struct drm_device *dev, void *data, struct d
> if (!drm_dev_enter(dev, &idx))
> return -ENODEV;
>
> + mutex_lock(&xdna->client_lock);
> mutex_lock(&xdna->dev_lock);
> hwctx = xa_erase(&client->hwctx_xa, args->handle);
> if (!hwctx) {
> @@ -328,6 +329,7 @@ int amdxdna_drm_destroy_hwctx_ioctl(struct drm_device *dev, void *data, struct d
> XDNA_DBG(xdna, "PID %d destroyed HW context %d", client->pid, args->handle);
> out:
> mutex_unlock(&xdna->dev_lock);
> + mutex_unlock(&xdna->client_lock);
> drm_dev_exit(idx);
> return ret;
> }
> @@ -388,6 +390,7 @@ int amdxdna_drm_config_hwctx_ioctl(struct drm_device *dev, void *data, struct dr
> goto free_buf;
> }
>
> + mutex_lock(&xdna->client_lock);
> mutex_lock(&xdna->dev_lock);
> hwctx = xa_load(&client->hwctx_xa, args->handle);
> if (!hwctx) {
> @@ -400,6 +403,7 @@ int amdxdna_drm_config_hwctx_ioctl(struct drm_device *dev, void *data, struct dr
>
> unlock:
> mutex_unlock(&xdna->dev_lock);
> + mutex_unlock(&xdna->client_lock);
> amdxdna_pm_suspend_put(xdna);
> free_buf:
> kfree(buf);
> @@ -428,6 +432,7 @@ int amdxdna_hwctx_sync_debug_bo(struct amdxdna_client *client, u32 debug_bo_hdl)
> }
>
> abo = to_xdna_obj(gobj);
> + mutex_lock(&xdna->client_lock);
> mutex_lock(&xdna->dev_lock);
> hwctx = xa_load(&client->hwctx_xa, abo->assigned_hwctx);
> if (!hwctx) {
> @@ -439,6 +444,7 @@ int amdxdna_hwctx_sync_debug_bo(struct amdxdna_client *client, u32 debug_bo_hdl)
>
> unlock:
> mutex_unlock(&xdna->dev_lock);
> + mutex_unlock(&xdna->client_lock);
> amdxdna_pm_suspend_put(xdna);
> put_obj:
> drm_gem_object_put(gobj);
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH V1] accel/amdxdna: Fix deadlock on debug BO command timeout
2026-07-07 15:12 ` Max Zhen
@ 2026-07-07 17:13 ` Lizhi Hou
0 siblings, 0 replies; 3+ messages in thread
From: Lizhi Hou @ 2026-07-07 17:13 UTC (permalink / raw)
To: Max Zhen, ogabbay, quic_jhugo, dri-devel, mario.limonciello,
karol.wachowski
Cc: linux-kernel, sonal.santan
Applied to drm-misc-fixes
On 7/7/26 08:12, Max Zhen wrote:
>
>
> On 7/6/2026 Mon 22:57, Lizhi Hou wrote:
>> Both amdxdna_hwctx_sync_debug_bo() and amdxdna_drm_config_hwctx_ioctl()
>> hold xdna->dev_lock while invoking backend operations. If the hardware
>> hangs, aie2_cmd_wait() blocks waiting for a firmware response. When the
>> DRM scheduler timeout expires, aie2_sched_job_timedout() is invoked to
>> reset the hardware. However, the timeout handler also attempts to
>> acquire
>> dev_lock, resulting in a deadlock.
>>
>> Avoid this by releasing dev_lock before waiting for the firmware
>> response and reacquiring it after the wait completes. This allows the
>> timeout handler to proceed with device recovery when a debug BO command
>> times out.
>>
>> Fixes: 7ea046838021 ("accel/amdxdna: Support firmware debug buffer")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Max Zhen <max.zhen@amd.com>
>> ---
>> drivers/accel/amdxdna/aie2_ctx.c | 5 ++++-
>> drivers/accel/amdxdna/amdxdna_ctx.c | 6 ++++++
>> 2 files changed, 10 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/accel/amdxdna/aie2_ctx.c
>> b/drivers/accel/amdxdna/aie2_ctx.c
>> index 7bf635634e64..30ccb8d5e23d 100644
>> --- a/drivers/accel/amdxdna/aie2_ctx.c
>> +++ b/drivers/accel/amdxdna/aie2_ctx.c
>> @@ -900,13 +900,16 @@ static int aie2_hwctx_cu_config(struct
>> amdxdna_hwctx *hwctx, void *buf, u32 size
>> static void aie2_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq)
>> {
>> struct dma_fence *out_fence = aie2_cmd_get_out_fence(hwctx, seq);
>> + struct amdxdna_dev *xdna = hwctx->client->xdna;
>> if (!out_fence) {
>> - XDNA_ERR(hwctx->client->xdna, "Failed to get fence");
>> + XDNA_ERR(xdna, "Failed to get fence");
>> return;
>> }
>> + mutex_unlock(&xdna->dev_lock);
>> dma_fence_wait_timeout(out_fence, false, MAX_SCHEDULE_TIMEOUT);
>> + mutex_lock(&xdna->dev_lock);
>> dma_fence_put(out_fence);
>> }
>> diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c
>> b/drivers/accel/amdxdna/amdxdna_ctx.c
>> index 67a2abcf173e..9ae19393e488 100644
>> --- a/drivers/accel/amdxdna/amdxdna_ctx.c
>> +++ b/drivers/accel/amdxdna/amdxdna_ctx.c
>> @@ -310,6 +310,7 @@ int amdxdna_drm_destroy_hwctx_ioctl(struct
>> drm_device *dev, void *data, struct d
>> if (!drm_dev_enter(dev, &idx))
>> return -ENODEV;
>> + mutex_lock(&xdna->client_lock);
>> mutex_lock(&xdna->dev_lock);
>> hwctx = xa_erase(&client->hwctx_xa, args->handle);
>> if (!hwctx) {
>> @@ -328,6 +329,7 @@ int amdxdna_drm_destroy_hwctx_ioctl(struct
>> drm_device *dev, void *data, struct d
>> XDNA_DBG(xdna, "PID %d destroyed HW context %d", client->pid,
>> args->handle);
>> out:
>> mutex_unlock(&xdna->dev_lock);
>> + mutex_unlock(&xdna->client_lock);
>> drm_dev_exit(idx);
>> return ret;
>> }
>> @@ -388,6 +390,7 @@ int amdxdna_drm_config_hwctx_ioctl(struct
>> drm_device *dev, void *data, struct dr
>> goto free_buf;
>> }
>> + mutex_lock(&xdna->client_lock);
>> mutex_lock(&xdna->dev_lock);
>> hwctx = xa_load(&client->hwctx_xa, args->handle);
>> if (!hwctx) {
>> @@ -400,6 +403,7 @@ int amdxdna_drm_config_hwctx_ioctl(struct
>> drm_device *dev, void *data, struct dr
>> unlock:
>> mutex_unlock(&xdna->dev_lock);
>> + mutex_unlock(&xdna->client_lock);
>> amdxdna_pm_suspend_put(xdna);
>> free_buf:
>> kfree(buf);
>> @@ -428,6 +432,7 @@ int amdxdna_hwctx_sync_debug_bo(struct
>> amdxdna_client *client, u32 debug_bo_hdl)
>> }
>> abo = to_xdna_obj(gobj);
>> + mutex_lock(&xdna->client_lock);
>> mutex_lock(&xdna->dev_lock);
>> hwctx = xa_load(&client->hwctx_xa, abo->assigned_hwctx);
>> if (!hwctx) {
>> @@ -439,6 +444,7 @@ int amdxdna_hwctx_sync_debug_bo(struct
>> amdxdna_client *client, u32 debug_bo_hdl)
>> unlock:
>> mutex_unlock(&xdna->dev_lock);
>> + mutex_unlock(&xdna->client_lock);
>> amdxdna_pm_suspend_put(xdna);
>> put_obj:
>> drm_gem_object_put(gobj);
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-07 17:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-07 5:57 [PATCH V1] accel/amdxdna: Fix deadlock on debug BO command timeout Lizhi Hou
2026-07-07 15:12 ` Max Zhen
2026-07-07 17:13 ` Lizhi Hou
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®