Re: [PATCH V1] accel/amdxdna: Fix deadlock on debug BO command timeout

[Lizhi Hou <lizhi.hou@amd.com>]

Applied to drm-misc-fixes

On 7/7/26 08:12, Max Zhen wrote:
>
>
> On 7/6/2026 Mon 22:57, Lizhi Hou wrote:
>> Both amdxdna_hwctx_sync_debug_bo() and amdxdna_drm_config_hwctx_ioctl()
>> hold xdna->dev_lock while invoking backend operations. If the hardware
>> hangs, aie2_cmd_wait() blocks waiting for a firmware response. When the
>> DRM scheduler timeout expires, aie2_sched_job_timedout() is invoked to
>> reset the hardware. However, the timeout handler also attempts to 
>> acquire
>> dev_lock, resulting in a deadlock.
>>
>> Avoid this by releasing dev_lock before waiting for the firmware
>> response and reacquiring it after the wait completes. This allows the
>> timeout handler to proceed with device recovery when a debug BO command
>> times out.
>>
>> Fixes: 7ea046838021 ("accel/amdxdna: Support firmware debug buffer")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Max Zhen <max.zhen@amd.com>
>> ---
>>   drivers/accel/amdxdna/aie2_ctx.c    | 5 ++++-
>>   drivers/accel/amdxdna/amdxdna_ctx.c | 6 ++++++
>>   2 files changed, 10 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/accel/amdxdna/aie2_ctx.c 
>> b/drivers/accel/amdxdna/aie2_ctx.c
>> index 7bf635634e64..30ccb8d5e23d 100644
>> --- a/drivers/accel/amdxdna/aie2_ctx.c
>> +++ b/drivers/accel/amdxdna/aie2_ctx.c
>> @@ -900,13 +900,16 @@ static int aie2_hwctx_cu_config(struct 
>> amdxdna_hwctx *hwctx, void *buf, u32 size
>>   static void aie2_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq)
>>   {
>>       struct dma_fence *out_fence = aie2_cmd_get_out_fence(hwctx, seq);
>> +    struct amdxdna_dev *xdna = hwctx->client->xdna;
>>         if (!out_fence) {
>> -        XDNA_ERR(hwctx->client->xdna, "Failed to get fence");
>> +        XDNA_ERR(xdna, "Failed to get fence");
>>           return;
>>       }
>>   +    mutex_unlock(&xdna->dev_lock);
>>       dma_fence_wait_timeout(out_fence, false, MAX_SCHEDULE_TIMEOUT);
>> +    mutex_lock(&xdna->dev_lock);
>>       dma_fence_put(out_fence);
>>   }
>>   diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c 
>> b/drivers/accel/amdxdna/amdxdna_ctx.c
>> index 67a2abcf173e..9ae19393e488 100644
>> --- a/drivers/accel/amdxdna/amdxdna_ctx.c
>> +++ b/drivers/accel/amdxdna/amdxdna_ctx.c
>> @@ -310,6 +310,7 @@ int amdxdna_drm_destroy_hwctx_ioctl(struct 
>> drm_device *dev, void *data, struct d
>>       if (!drm_dev_enter(dev, &idx))
>>           return -ENODEV;
>>   +    mutex_lock(&xdna->client_lock);
>>       mutex_lock(&xdna->dev_lock);
>>       hwctx = xa_erase(&client->hwctx_xa, args->handle);
>>       if (!hwctx) {
>> @@ -328,6 +329,7 @@ int amdxdna_drm_destroy_hwctx_ioctl(struct 
>> drm_device *dev, void *data, struct d
>>       XDNA_DBG(xdna, "PID %d destroyed HW context %d", client->pid, 
>> args->handle);
>>   out:
>>       mutex_unlock(&xdna->dev_lock);
>> +    mutex_unlock(&xdna->client_lock);
>>       drm_dev_exit(idx);
>>       return ret;
>>   }
>> @@ -388,6 +390,7 @@ int amdxdna_drm_config_hwctx_ioctl(struct 
>> drm_device *dev, void *data, struct dr
>>           goto free_buf;
>>       }
>>   +    mutex_lock(&xdna->client_lock);
>>       mutex_lock(&xdna->dev_lock);
>>       hwctx = xa_load(&client->hwctx_xa, args->handle);
>>       if (!hwctx) {
>> @@ -400,6 +403,7 @@ int amdxdna_drm_config_hwctx_ioctl(struct 
>> drm_device *dev, void *data, struct dr
>>     unlock:
>>       mutex_unlock(&xdna->dev_lock);
>> +    mutex_unlock(&xdna->client_lock);
>>       amdxdna_pm_suspend_put(xdna);
>>   free_buf:
>>       kfree(buf);
>> @@ -428,6 +432,7 @@ int amdxdna_hwctx_sync_debug_bo(struct 
>> amdxdna_client *client, u32 debug_bo_hdl)
>>       }
>>         abo = to_xdna_obj(gobj);
>> +    mutex_lock(&xdna->client_lock);
>>       mutex_lock(&xdna->dev_lock);
>>       hwctx = xa_load(&client->hwctx_xa, abo->assigned_hwctx);
>>       if (!hwctx) {
>> @@ -439,6 +444,7 @@ int amdxdna_hwctx_sync_debug_bo(struct 
>> amdxdna_client *client, u32 debug_bo_hdl)
>>     unlock:
>>       mutex_unlock(&xdna->dev_lock);
>> +    mutex_unlock(&xdna->client_lock);
>>       amdxdna_pm_suspend_put(xdna);
>>   put_obj:
>>       drm_gem_object_put(gobj);
>