* [PATCH V1] accel/amdxdna: Fix hardware context race in amdxdna_update_heap()
@ 2026-07-07 5:58 Lizhi Hou
2026-07-07 15:18 ` Max Zhen
0 siblings, 1 reply; 3+ messages in thread
From: Lizhi Hou @ 2026-07-07 5:58 UTC (permalink / raw)
To: ogabbay, quic_jhugo, dri-devel, mario.limonciello, karol.wachowski
Cc: Lizhi Hou, linux-kernel, max.zhen, sonal.santan
amdxdna_update_heap() iterates over hardware contexts while holding
xdna->dev_lock. During the iteration, amdxdna_pm_resume_get_locked() may
temporarily release and reacquire the lock, allowing hardware contexts to
be modified concurrently.
Fix the race by calling amdxdna_pm_resume_get_locked() before
iterating over hardware contexts.
Fixes: dbc8fd7a03cb ("accel/amdxdna: Add expandable device heap support")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
drivers/accel/amdxdna/aie2_ctx.c | 6 ------
drivers/accel/amdxdna/amdxdna_ctx.c | 24 +++++++++++++++---------
2 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
index 30ccb8d5e23d..101f324ee178 100644
--- a/drivers/accel/amdxdna/aie2_ctx.c
+++ b/drivers/accel/amdxdna/aie2_ctx.c
@@ -1222,10 +1222,6 @@ int aie2_hwctx_heap_expand(struct amdxdna_hwctx *hwctx,
u64 addr;
int ret;
- ret = amdxdna_pm_resume_get_locked(xdna);
- if (ret)
- return ret;
-
addr = amdxdna_obj_dma_addr(heap);
ret = aie2_add_host_buf(xdna->dev_handle, hwctx->fw_ctx_id,
addr, heap->mem.size);
@@ -1234,7 +1230,5 @@ int aie2_hwctx_heap_expand(struct amdxdna_hwctx *hwctx,
hwctx->name, heap->mem.size, ret);
}
- amdxdna_pm_suspend_put(xdna);
-
return ret;
}
diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
index 9ae19393e488..8f8df9d04ec5 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.c
+++ b/drivers/accel/amdxdna/amdxdna_ctx.c
@@ -472,9 +472,7 @@ static int amdxdna_hwctx_expand_heap(struct amdxdna_hwctx *hwctx)
break;
}
- mutex_unlock(&client->mm_lock);
ret = xdna->dev_info->ops->hwctx_heap_expand(hwctx, heap);
- mutex_lock(&client->mm_lock);
if (ret) {
amdxdna_gem_unpin(heap);
drm_gem_object_put(to_gobj(heap));
@@ -493,18 +491,26 @@ int amdxdna_update_heap(struct amdxdna_client *client, struct amdxdna_hwctx *hwc
unsigned long hwctx_id;
int ret;
- guard(mutex)(&client->mm_lock);
+ ret = amdxdna_pm_resume_get_locked(client->xdna);
+ if (ret)
+ return ret;
- if (hwctx)
- return amdxdna_hwctx_expand_heap(hwctx);
+ mutex_lock(&client->mm_lock);
- amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
+ if (hwctx) {
ret = amdxdna_hwctx_expand_heap(hwctx);
- if (ret)
- return ret;
+ } else {
+ amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
+ ret = amdxdna_hwctx_expand_heap(hwctx);
+ if (ret)
+ break;
+ }
}
+ mutex_unlock(&client->mm_lock);
- return 0;
+ amdxdna_pm_suspend_put(client->xdna);
+
+ return ret;
}
static void
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH V1] accel/amdxdna: Fix hardware context race in amdxdna_update_heap()
2026-07-07 5:58 [PATCH V1] accel/amdxdna: Fix hardware context race in amdxdna_update_heap() Lizhi Hou
@ 2026-07-07 15:18 ` Max Zhen
2026-07-07 17:13 ` Lizhi Hou
0 siblings, 1 reply; 3+ messages in thread
From: Max Zhen @ 2026-07-07 15:18 UTC (permalink / raw)
To: Lizhi Hou, ogabbay, quic_jhugo, dri-devel, mario.limonciello,
karol.wachowski
Cc: linux-kernel, sonal.santan
On 7/6/2026 Mon 22:58, Lizhi Hou wrote:
> amdxdna_update_heap() iterates over hardware contexts while holding
> xdna->dev_lock. During the iteration, amdxdna_pm_resume_get_locked() may
> temporarily release and reacquire the lock, allowing hardware contexts to
> be modified concurrently.
>
> Fix the race by calling amdxdna_pm_resume_get_locked() before
> iterating over hardware contexts.
>
> Fixes: dbc8fd7a03cb ("accel/amdxdna: Add expandable device heap support")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Max Zhen <max.zhen@amd.com>
> ---
> drivers/accel/amdxdna/aie2_ctx.c | 6 ------
> drivers/accel/amdxdna/amdxdna_ctx.c | 24 +++++++++++++++---------
> 2 files changed, 15 insertions(+), 15 deletions(-)
>
> diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
> index 30ccb8d5e23d..101f324ee178 100644
> --- a/drivers/accel/amdxdna/aie2_ctx.c
> +++ b/drivers/accel/amdxdna/aie2_ctx.c
> @@ -1222,10 +1222,6 @@ int aie2_hwctx_heap_expand(struct amdxdna_hwctx *hwctx,
> u64 addr;
> int ret;
>
> - ret = amdxdna_pm_resume_get_locked(xdna);
> - if (ret)
> - return ret;
> -
> addr = amdxdna_obj_dma_addr(heap);
> ret = aie2_add_host_buf(xdna->dev_handle, hwctx->fw_ctx_id,
> addr, heap->mem.size);
> @@ -1234,7 +1230,5 @@ int aie2_hwctx_heap_expand(struct amdxdna_hwctx *hwctx,
> hwctx->name, heap->mem.size, ret);
> }
>
> - amdxdna_pm_suspend_put(xdna);
> -
> return ret;
> }
> diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
> index 9ae19393e488..8f8df9d04ec5 100644
> --- a/drivers/accel/amdxdna/amdxdna_ctx.c
> +++ b/drivers/accel/amdxdna/amdxdna_ctx.c
> @@ -472,9 +472,7 @@ static int amdxdna_hwctx_expand_heap(struct amdxdna_hwctx *hwctx)
> break;
> }
>
> - mutex_unlock(&client->mm_lock);
> ret = xdna->dev_info->ops->hwctx_heap_expand(hwctx, heap);
> - mutex_lock(&client->mm_lock);
> if (ret) {
> amdxdna_gem_unpin(heap);
> drm_gem_object_put(to_gobj(heap));
> @@ -493,18 +491,26 @@ int amdxdna_update_heap(struct amdxdna_client *client, struct amdxdna_hwctx *hwc
> unsigned long hwctx_id;
> int ret;
>
> - guard(mutex)(&client->mm_lock);
> + ret = amdxdna_pm_resume_get_locked(client->xdna);
> + if (ret)
> + return ret;
>
> - if (hwctx)
> - return amdxdna_hwctx_expand_heap(hwctx);
> + mutex_lock(&client->mm_lock);
>
> - amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
> + if (hwctx) {
> ret = amdxdna_hwctx_expand_heap(hwctx);
> - if (ret)
> - return ret;
> + } else {
> + amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
> + ret = amdxdna_hwctx_expand_heap(hwctx);
> + if (ret)
> + break;
> + }
> }
> + mutex_unlock(&client->mm_lock);
>
> - return 0;
> + amdxdna_pm_suspend_put(client->xdna);
> +
> + return ret;
> }
>
> static void
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH V1] accel/amdxdna: Fix hardware context race in amdxdna_update_heap()
2026-07-07 15:18 ` Max Zhen
@ 2026-07-07 17:13 ` Lizhi Hou
0 siblings, 0 replies; 3+ messages in thread
From: Lizhi Hou @ 2026-07-07 17:13 UTC (permalink / raw)
To: Max Zhen, ogabbay, quic_jhugo, dri-devel, mario.limonciello,
karol.wachowski
Cc: linux-kernel, sonal.santan
Applied to drm-misc-fixes
On 7/7/26 08:18, Max Zhen wrote:
>
>
> On 7/6/2026 Mon 22:58, Lizhi Hou wrote:
>> amdxdna_update_heap() iterates over hardware contexts while holding
>> xdna->dev_lock. During the iteration, amdxdna_pm_resume_get_locked() may
>> temporarily release and reacquire the lock, allowing hardware
>> contexts to
>> be modified concurrently.
>>
>> Fix the race by calling amdxdna_pm_resume_get_locked() before
>> iterating over hardware contexts.
>>
>> Fixes: dbc8fd7a03cb ("accel/amdxdna: Add expandable device heap
>> support")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Max Zhen <max.zhen@amd.com>
>> ---
>> drivers/accel/amdxdna/aie2_ctx.c | 6 ------
>> drivers/accel/amdxdna/amdxdna_ctx.c | 24 +++++++++++++++---------
>> 2 files changed, 15 insertions(+), 15 deletions(-)
>>
>> diff --git a/drivers/accel/amdxdna/aie2_ctx.c
>> b/drivers/accel/amdxdna/aie2_ctx.c
>> index 30ccb8d5e23d..101f324ee178 100644
>> --- a/drivers/accel/amdxdna/aie2_ctx.c
>> +++ b/drivers/accel/amdxdna/aie2_ctx.c
>> @@ -1222,10 +1222,6 @@ int aie2_hwctx_heap_expand(struct
>> amdxdna_hwctx *hwctx,
>> u64 addr;
>> int ret;
>> - ret = amdxdna_pm_resume_get_locked(xdna);
>> - if (ret)
>> - return ret;
>> -
>> addr = amdxdna_obj_dma_addr(heap);
>> ret = aie2_add_host_buf(xdna->dev_handle, hwctx->fw_ctx_id,
>> addr, heap->mem.size);
>> @@ -1234,7 +1230,5 @@ int aie2_hwctx_heap_expand(struct amdxdna_hwctx
>> *hwctx,
>> hwctx->name, heap->mem.size, ret);
>> }
>> - amdxdna_pm_suspend_put(xdna);
>> -
>> return ret;
>> }
>> diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c
>> b/drivers/accel/amdxdna/amdxdna_ctx.c
>> index 9ae19393e488..8f8df9d04ec5 100644
>> --- a/drivers/accel/amdxdna/amdxdna_ctx.c
>> +++ b/drivers/accel/amdxdna/amdxdna_ctx.c
>> @@ -472,9 +472,7 @@ static int amdxdna_hwctx_expand_heap(struct
>> amdxdna_hwctx *hwctx)
>> break;
>> }
>> - mutex_unlock(&client->mm_lock);
>> ret = xdna->dev_info->ops->hwctx_heap_expand(hwctx, heap);
>> - mutex_lock(&client->mm_lock);
>> if (ret) {
>> amdxdna_gem_unpin(heap);
>> drm_gem_object_put(to_gobj(heap));
>> @@ -493,18 +491,26 @@ int amdxdna_update_heap(struct amdxdna_client
>> *client, struct amdxdna_hwctx *hwc
>> unsigned long hwctx_id;
>> int ret;
>> - guard(mutex)(&client->mm_lock);
>> + ret = amdxdna_pm_resume_get_locked(client->xdna);
>> + if (ret)
>> + return ret;
>> - if (hwctx)
>> - return amdxdna_hwctx_expand_heap(hwctx);
>> + mutex_lock(&client->mm_lock);
>> - amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
>> + if (hwctx) {
>> ret = amdxdna_hwctx_expand_heap(hwctx);
>> - if (ret)
>> - return ret;
>> + } else {
>> + amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
>> + ret = amdxdna_hwctx_expand_heap(hwctx);
>> + if (ret)
>> + break;
>> + }
>> }
>> + mutex_unlock(&client->mm_lock);
>> - return 0;
>> + amdxdna_pm_suspend_put(client->xdna);
>> +
>> + return ret;
>> }
>> static void
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-07 17:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-07 5:58 [PATCH V1] accel/amdxdna: Fix hardware context race in amdxdna_update_heap() Lizhi Hou
2026-07-07 15:18 ` Max Zhen
2026-07-07 17:13 ` Lizhi Hou
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®