From: Lizhi Hou <lizhi.hou@amd.com>
To: "Mario Limonciello (AMD) (kernel.org)" <superm1@kernel.org>,
<ogabbay@kernel.org>, <quic_jhugo@quicinc.com>,
<dri-devel@lists.freedesktop.org>,
<maciej.falkowski@linux.intel.com>
Cc: <linux-kernel@vger.kernel.org>, <max.zhen@amd.com>,
<sonal.santan@amd.com>
Subject: Re: [PATCH V1] accel/amdxdna: Fix cu_idx being cleared by memset() during command setup
Date: Wed, 10 Dec 2025 09:24:30 -0800 [thread overview]
Message-ID: <98299eea-9da5-f887-521e-402a735758be@amd.com> (raw)
In-Reply-To: <e62a3c30-162d-4ba4-bfed-4bb98d9ebfba@kernel.org>
Applied to drm-misc-next.
On 12/9/25 21:37, Mario Limonciello (AMD) (kernel.org) wrote:
>
>
> On 12/9/2025 3:16 PM, Lizhi Hou wrote:
>> For one command type, cu_idx is assigned before calling memset() on the
>> command structure. This results in cu_idx being overwritten, causing the
>> firmware to receive an incomplete or invalid command and leading to
>> unexpected command failures.
>>
>> Fix this by moving the memset() call before initializing cu_idx so that
>> all fields are populated in the correct order.
>>
>> Fixes: 71829d7f2f70 ("accel/amdxdna: Use MSG_OP_CHAIN_EXEC_NPU when
>> supported")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
>> ---
>> drivers/accel/amdxdna/aie2_message.c | 8 ++++----
>> 1 file changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/accel/amdxdna/aie2_message.c
>> b/drivers/accel/amdxdna/aie2_message.c
>> index a75156800467..03b75757a6e6 100644
>> --- a/drivers/accel/amdxdna/aie2_message.c
>> +++ b/drivers/accel/amdxdna/aie2_message.c
>> @@ -652,6 +652,7 @@ aie2_cmdlist_fill_npu_cf(struct amdxdna_gem_obj
>> *cmd_bo, void *slot, size_t *siz
>> u32 cmd_len;
>> void *cmd;
>> + memset(npu_slot, 0, sizeof(*npu_slot));
>> cmd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
>> if (*size < sizeof(*npu_slot) + cmd_len)
>> return -EINVAL;
>> @@ -660,7 +661,6 @@ aie2_cmdlist_fill_npu_cf(struct amdxdna_gem_obj
>> *cmd_bo, void *slot, size_t *siz
>> if (npu_slot->cu_idx == INVALID_CU_IDX)
>> return -EINVAL;
>> - memset(npu_slot, 0, sizeof(*npu_slot));
>> npu_slot->type = EXEC_NPU_TYPE_NON_ELF;
>> npu_slot->arg_cnt = cmd_len / sizeof(u32);
>> memcpy(npu_slot->args, cmd, cmd_len);
>> @@ -677,6 +677,7 @@ aie2_cmdlist_fill_npu_dpu(struct amdxdna_gem_obj
>> *cmd_bo, void *slot, size_t *si
>> u32 cmd_len;
>> u32 arg_sz;
>> + memset(npu_slot, 0, sizeof(*npu_slot));
>> sn = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
>> arg_sz = cmd_len - sizeof(*sn);
>> if (cmd_len < sizeof(*sn) || arg_sz > MAX_NPU_ARGS_SIZE)
>> @@ -689,7 +690,6 @@ aie2_cmdlist_fill_npu_dpu(struct amdxdna_gem_obj
>> *cmd_bo, void *slot, size_t *si
>> if (npu_slot->cu_idx == INVALID_CU_IDX)
>> return -EINVAL;
>> - memset(npu_slot, 0, sizeof(*npu_slot));
>> npu_slot->type = EXEC_NPU_TYPE_PARTIAL_ELF;
>> npu_slot->inst_buf_addr = sn->buffer;
>> npu_slot->inst_size = sn->buffer_size;
>> @@ -709,6 +709,7 @@ aie2_cmdlist_fill_npu_preempt(struct
>> amdxdna_gem_obj *cmd_bo, void *slot, size_t
>> u32 cmd_len;
>> u32 arg_sz;
>> + memset(npu_slot, 0, sizeof(*npu_slot));
>> pd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
>> arg_sz = cmd_len - sizeof(*pd);
>> if (cmd_len < sizeof(*pd) || arg_sz > MAX_NPU_ARGS_SIZE)
>> @@ -721,7 +722,6 @@ aie2_cmdlist_fill_npu_preempt(struct
>> amdxdna_gem_obj *cmd_bo, void *slot, size_t
>> if (npu_slot->cu_idx == INVALID_CU_IDX)
>> return -EINVAL;
>> - memset(npu_slot, 0, sizeof(*npu_slot));
>> npu_slot->type = EXEC_NPU_TYPE_PREEMPT;
>> npu_slot->inst_buf_addr = pd->inst_buf;
>> npu_slot->save_buf_addr = pd->save_buf;
>> @@ -745,6 +745,7 @@ aie2_cmdlist_fill_npu_elf(struct amdxdna_gem_obj
>> *cmd_bo, void *slot, size_t *si
>> u32 cmd_len;
>> u32 arg_sz;
>> + memset(npu_slot, 0, sizeof(*npu_slot));
>> pd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
>> arg_sz = cmd_len - sizeof(*pd);
>> if (cmd_len < sizeof(*pd) || arg_sz > MAX_NPU_ARGS_SIZE)
>> @@ -753,7 +754,6 @@ aie2_cmdlist_fill_npu_elf(struct amdxdna_gem_obj
>> *cmd_bo, void *slot, size_t *si
>> if (*size < sizeof(*npu_slot) + arg_sz)
>> return -EINVAL;
>> - memset(npu_slot, 0, sizeof(*npu_slot));
>> npu_slot->type = EXEC_NPU_TYPE_ELF;
>> npu_slot->inst_buf_addr = pd->inst_buf;
>> npu_slot->save_buf_addr = pd->save_buf;
>
prev parent reply other threads:[~2025-12-10 17:24 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-09 21:16 Lizhi Hou
2025-12-10 5:37 ` Mario Limonciello (AMD) (kernel.org)
2025-12-10 17:24 ` Lizhi Hou [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=98299eea-9da5-f887-521e-402a735758be@amd.com \
--to=lizhi.hou@amd.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maciej.falkowski@linux.intel.com \
--cc=max.zhen@amd.com \
--cc=ogabbay@kernel.org \
--cc=quic_jhugo@quicinc.com \
--cc=sonal.santan@amd.com \
--cc=superm1@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®