[PATCH] accel/amdxdna: Use caller client for debug BO sync

[PATCH] accel/amdxdna: Use caller client for debug BO sync

[Shuvam Pandey]

amdxdna_drm_sync_bo_ioctl() looks up args->handle in the ioctl caller's
drm_file. For SYNC_DIRECT_FROM_DEVICE, it then calls
amdxdna_hwctx_sync_debug_bo(), but passes abo->client.

amdxdna_hwctx_sync_debug_bo() uses the passed client both as the handle
namespace for debug_bo_hdl and as the owner of the hardware context xarray.
Those must match the file that supplied args->handle. The BO's stored
client pointer is object state, not the ioctl context.

Pass filp->driver_priv instead, matching the original handle lookup.

Fixes: 7ea046838021 ("accel/amdxdna: Support firmware debug buffer")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com>
---
 drivers/accel/amdxdna/amdxdna_gem.c | 3 ++-

diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
index 6e367ddb9e1becb8d03cb4badec25deed38a851d..6c16b21994abc8f0ce58ee6dede219a84ade6825 100644
--- a/drivers/accel/amdxdna/amdxdna_gem.c
+++ b/drivers/accel/amdxdna/amdxdna_gem.c
@@ -1027,6 +1027,7 @@ int amdxdna_drm_get_bo_info_ioctl(struct drm_device *dev, void *data, struct drm
 int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev,
 			      void *data, struct drm_file *filp)
 {
+	struct amdxdna_client *client = filp->driver_priv;
 	struct amdxdna_dev *xdna = to_xdna_dev(dev);
 	struct amdxdna_drm_sync_bo *args = data;
 	struct amdxdna_gem_obj *abo;
@@ -1061,7 +1062,7 @@ int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev,
 		 args->handle, args->offset, args->size);
 
 	if (args->direction == SYNC_DIRECT_FROM_DEVICE)
-		ret = amdxdna_hwctx_sync_debug_bo(abo->client, args->handle);
+		ret = amdxdna_hwctx_sync_debug_bo(client, args->handle);
 
 put_obj:
 	drm_gem_object_put(gobj);
-- 
2.50.0

Re: [PATCH] accel/amdxdna: Use caller client for debug BO sync

[Lizhi Hou]

On 6/15/26 13:18, Shuvam Pandey wrote:
> amdxdna_drm_sync_bo_ioctl() looks up args->handle in the ioctl caller's
> drm_file. For SYNC_DIRECT_FROM_DEVICE, it then calls
> amdxdna_hwctx_sync_debug_bo(), but passes abo->client.
>
> amdxdna_hwctx_sync_debug_bo() uses the passed client both as the handle
> namespace for debug_bo_hdl and as the owner of the hardware context xarray.
> Those must match the file that supplied args->handle. The BO's stored
> client pointer is object state, not the ioctl context.
>
> Pass filp->driver_priv instead, matching the original handle lookup.
>
> Fixes: 7ea046838021 ("accel/amdxdna: Support firmware debug buffer")
> Cc: stable@vger.kernel.org # v6.19+
> Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com>
> ---
>   drivers/accel/amdxdna/amdxdna_gem.c | 3 ++-
>
> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
> index 6e367ddb9e1becb8d03cb4badec25deed38a851d..6c16b21994abc8f0ce58ee6dede219a84ade6825 100644
> --- a/drivers/accel/amdxdna/amdxdna_gem.c
> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
> @@ -1027,6 +1027,7 @@ int amdxdna_drm_get_bo_info_ioctl(struct drm_device *dev, void *data, struct drm
>   int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev,
>   			      void *data, struct drm_file *filp)
>   {
> +	struct amdxdna_client *client = filp->driver_priv;
>   	struct amdxdna_dev *xdna = to_xdna_dev(dev);
>   	struct amdxdna_drm_sync_bo *args = data;
>   	struct amdxdna_gem_obj *abo;
> @@ -1061,7 +1062,7 @@ int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev,
>   		 args->handle, args->offset, args->size);
>   
>   	if (args->direction == SYNC_DIRECT_FROM_DEVICE)
> -		ret = amdxdna_hwctx_sync_debug_bo(abo->client, args->handle);
> +		ret = amdxdna_hwctx_sync_debug_bo(client, args->handle);
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
>   
>   put_obj:
>   	drm_gem_object_put(gobj);

Re: [PATCH] accel/amdxdna: Use caller client for debug BO sync

[Lizhi Hou]

Applied to drm-misc-fixes.

On 6/15/26 13:18, Shuvam Pandey wrote:
> amdxdna_drm_sync_bo_ioctl() looks up args->handle in the ioctl caller's
> drm_file. For SYNC_DIRECT_FROM_DEVICE, it then calls
> amdxdna_hwctx_sync_debug_bo(), but passes abo->client.
>
> amdxdna_hwctx_sync_debug_bo() uses the passed client both as the handle
> namespace for debug_bo_hdl and as the owner of the hardware context xarray.
> Those must match the file that supplied args->handle. The BO's stored
> client pointer is object state, not the ioctl context.
>
> Pass filp->driver_priv instead, matching the original handle lookup.
>
> Fixes: 7ea046838021 ("accel/amdxdna: Support firmware debug buffer")
> Cc: stable@vger.kernel.org # v6.19+
> Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com>
> ---
>   drivers/accel/amdxdna/amdxdna_gem.c | 3 ++-
>
> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
> index 6e367ddb9e1becb8d03cb4badec25deed38a851d..6c16b21994abc8f0ce58ee6dede219a84ade6825 100644
> --- a/drivers/accel/amdxdna/amdxdna_gem.c
> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
> @@ -1027,6 +1027,7 @@ int amdxdna_drm_get_bo_info_ioctl(struct drm_device *dev, void *data, struct drm
>   int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev,
>   			      void *data, struct drm_file *filp)
>   {
> +	struct amdxdna_client *client = filp->driver_priv;
>   	struct amdxdna_dev *xdna = to_xdna_dev(dev);
>   	struct amdxdna_drm_sync_bo *args = data;
>   	struct amdxdna_gem_obj *abo;
> @@ -1061,7 +1062,7 @@ int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev,
>   		 args->handle, args->offset, args->size);
>   
>   	if (args->direction == SYNC_DIRECT_FROM_DEVICE)
> -		ret = amdxdna_hwctx_sync_debug_bo(abo->client, args->handle);
> +		ret = amdxdna_hwctx_sync_debug_bo(client, args->handle);
>   
>   put_obj:
>   	drm_gem_object_put(gobj);