From ebddb00faa82783d26276c9839f84bfd33a6479b Mon Sep 17 00:00:00 2001 From: Lyude Paul Date: Thu, 28 May 2026 15:27:15 -0400 Subject: [PATCH 01/11] Revert "nouveau/gsp/rm: cleanup remaining IS_ERR_OR_NULL usage" This reverts commit 1a80c009e27b42e8c202d4c5dbd9dad9e22af742. Embarassingly, it seems that I completely missed a pretty big issue this patch causes according to Danilo and Sashiko: https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html Where it seems this causes some machines to segfault during nouveau probe. So, revert this for the time being. Signed-off-by: Lyude Paul Reviewed-by: Timur Tabi Link: https://patch.msgid.link/20260528192847.4077458-2-lyude@redhat.com Signed-off-by: Danilo Krummrich --- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/ctrl.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/ctrl.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/ctrl.c index aa0ebd3dfb17..70b9ee911c5e 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/ctrl.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/ctrl.c @@ -42,7 +42,7 @@ r535_gsp_rpc_rm_ctrl_push(struct nvkm_gsp_object *object, void **params, u32 rep int ret = 0; rpc = nvkm_gsp_rpc_push(gsp, rpc, NVKM_GSP_RPC_REPLY_RECV, repc); - if (IS_ERR(rpc)) { + if (IS_ERR_OR_NULL(rpc)) { *params = NULL; return PTR_ERR(rpc); } diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c index 0c9657cb2dd7..41301f19729c 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c @@ -459,11 +459,11 @@ r535_gsp_msg_recv(struct nvkm_gsp *gsp, int fn, u32 gsp_rpc_len) retry: rpc = r535_gsp_msgq_peek(gsp, sizeof(*rpc), &retries); - if (IS_ERR(rpc)) + if (IS_ERR_OR_NULL(rpc)) return rpc; rpc = r535_gsp_msgq_recv(gsp, gsp_rpc_len, &retries); - if (IS_ERR(rpc)) + if (IS_ERR_OR_NULL(rpc)) return rpc; if (rpc->rpc_result) { @@ -561,7 +561,7 @@ r535_gsp_rpc_handle_reply(struct nvkm_gsp *gsp, u32 fn, break; case NVKM_GSP_RPC_REPLY_RECV: reply = r535_gsp_msg_recv(gsp, fn, gsp_rpc_len); - if (!IS_ERR(reply)) + if (!IS_ERR_OR_NULL(reply)) repv = reply->data; else repv = reply; From 1a8117455d0d6004d5398fcd2a4717a930eb307e Mon Sep 17 00:00:00 2001 From: Lyude Paul Date: Thu, 28 May 2026 15:27:16 -0400 Subject: [PATCH 02/11] Revert "nouveau/gsp/rm: cleanup IS_ERR_OR_NULL in core implementation" This is probably too risky, see the discussion here: https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html This reverts commit 67346c90ce275e835e93a4a13041afee47bd3f9e. Signed-off-by: Lyude Paul Reviewed-by: Timur Tabi Link: https://patch.msgid.link/20260528192847.4077458-3-lyude@redhat.com Signed-off-by: Danilo Krummrich --- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/alloc.c | 4 ++-- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/alloc.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/alloc.c index 27f275d2e151..46e3a29f2ad7 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/alloc.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/alloc.c @@ -35,7 +35,7 @@ r535_gsp_rpc_rm_free(struct nvkm_gsp_object *object) client->object.handle, object->handle); rpc = nvkm_gsp_rpc_get(gsp, NV_VGPU_MSG_FUNCTION_FREE, sizeof(*rpc)); - if (WARN_ON(IS_ERR(rpc))) + if (WARN_ON(IS_ERR_OR_NULL(rpc))) return -EIO; rpc->params.hRoot = client->object.handle; @@ -60,7 +60,7 @@ r535_gsp_rpc_rm_alloc_push(struct nvkm_gsp_object *object, void *params) void *ret = NULL; rpc = nvkm_gsp_rpc_push(gsp, rpc, NVKM_GSP_RPC_REPLY_RECV, sizeof(*rpc)); - if (IS_ERR(rpc)) + if (IS_ERR_OR_NULL(rpc)) return rpc; if (rpc->status) { diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c index 41301f19729c..3ca3de8f4340 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c @@ -324,7 +324,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32 gsp_rpc_len, int *retries) u32 size; rpc = r535_gsp_msgq_peek(gsp, sizeof(*rpc), info.retries); - if (IS_ERR(rpc)) { + if (IS_ERR_OR_NULL(rpc)) { kvfree(buf); return rpc; } @@ -333,7 +333,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32 gsp_rpc_len, int *retries) info.continuation = true; rpc = r535_gsp_msgq_recv_one_elem(gsp, &info); - if (IS_ERR(rpc)) { + if (IS_ERR_OR_NULL(rpc)) { kvfree(buf); return rpc; } From dd516da348f1b9fd6c6d6a6f14f0dd491f523658 Mon Sep 17 00:00:00 2001 From: Lyude Paul Date: Thu, 28 May 2026 15:27:17 -0400 Subject: [PATCH 03/11] Revert "nouveau/gsp/rm: cleanup WARN_ON(IS_ERR_OR_NULL)" This is probably too risky, see the discussion here: https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html This reverts commit 6198977a78af8769d3f3108e830901325b97cf03. Signed-off-by: Lyude Paul Reviewed-by: Timur Tabi Link: https://patch.msgid.link/20260528192847.4077458-4-lyude@redhat.com Signed-off-by: Danilo Krummrich --- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/bar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/bar.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/bar.c index 9cd68f8622d3..fae08ac3b18c 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/bar.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/bar.c @@ -55,7 +55,7 @@ r535_bar_bar2_update_pde(struct nvkm_gsp *gsp, u8 page_shift, u64 pdbe) rpc_update_bar_pde_v15_00 *rpc; rpc = nvkm_gsp_rpc_get(gsp, NV_VGPU_MSG_FUNCTION_UPDATE_BAR_PDE, sizeof(*rpc)); - if (WARN_ON(IS_ERR(rpc))) + if (WARN_ON(IS_ERR_OR_NULL(rpc))) return -EIO; rpc->info.barType = NV_RPC_UPDATE_PDE_BAR_2; From 80fa10569b90a1ac6aeb771c5e149c67027f36e8 Mon Sep 17 00:00:00 2001 From: Lyude Paul Date: Thu, 28 May 2026 15:27:18 -0400 Subject: [PATCH 04/11] Revert "nouveau/gsp: cleanup IS_ERR_OR_NULL in rpc_rd" This is probably much too risky. See the discussion here: https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html This reverts commit 47f15f6cf068c14d1a5054066c445bee23f6047e. Signed-off-by: Lyude Paul Reviewed-by: Timur Tabi Link: https://patch.msgid.link/20260528192847.4077458-5-lyude@redhat.com Signed-off-by: Danilo Krummrich --- drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h index d771134fa410..ab2bd88eebce 100644 --- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h +++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h @@ -293,7 +293,7 @@ nvkm_gsp_rpc_rd(struct nvkm_gsp *gsp, u32 fn, u32 argc) { void *argv = nvkm_gsp_rpc_get(gsp, fn, argc); - if (IS_ERR(argv)) + if (IS_ERR_OR_NULL(argv)) return argv; return nvkm_gsp_rpc_push(gsp, argv, NVKM_GSP_RPC_REPLY_RECV, argc); From 18178f2ac176f4b1e1c0555bed9d66b04fdf171e Mon Sep 17 00:00:00 2001 From: Lyude Paul Date: Thu, 28 May 2026 15:27:19 -0400 Subject: [PATCH 05/11] Revert "nouveau/gsp: cleanup IS_ERR_OR_NULL in rm_alloc functions" This is probably too risky, see the discussion here: https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html This reverts commit 281fe11c6c4aebc1a1eb9d21eaab7323ee5af979. Signed-off-by: Lyude Paul Reviewed-by: Timur Tabi Link: https://patch.msgid.link/20260528192847.4077458-6-lyude@redhat.com Signed-off-by: Danilo Krummrich --- drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h index ab2bd88eebce..64fed208e4cf 100644 --- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h +++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h @@ -373,7 +373,7 @@ nvkm_gsp_rm_alloc_get(struct nvkm_gsp_object *parent, u32 handle, u32 oclass, u3 object->handle = handle; argv = gsp->rm->api->alloc->get(object, oclass, argc); - if (IS_ERR(argv)) { + if (IS_ERR_OR_NULL(argv)) { object->client = NULL; return argv; } @@ -415,8 +415,8 @@ nvkm_gsp_rm_alloc(struct nvkm_gsp_object *parent, u32 handle, u32 oclass, u32 ar { void *argv = nvkm_gsp_rm_alloc_get(parent, handle, oclass, argc, object); - if (IS_ERR(argv)) - return PTR_ERR(argv); + if (IS_ERR_OR_NULL(argv)) + return argv ? PTR_ERR(argv) : -EIO; return nvkm_gsp_rm_alloc_wr(object, argv); } From f412fe573b3c78fdcf351e282a3c488bb073846b Mon Sep 17 00:00:00 2001 From: Tvrtko Ursulin Date: Fri, 22 May 2026 10:01:29 +0100 Subject: [PATCH 06/11] drm/sched: Fix clang build warning in kunit tests Initializing compile time constant struct or arrays from another such variable is a gcc extension, while clang strictly requires a compile time constant literal. As reported by LKP: >> drivers/gpu/drm/scheduler/tests/tests_scheduler.c:675:10: error: initializer element is not a compile-time constant drm_sched_scheduler_two_clients_attr), ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:224:13: note: expanded from macro 'KUNIT_CASE_PARAM_ATTR' .attr = attributes, .module_name = KBUILD_MODNAME} ^~~~~~~~~~ 1 error generated. vim +675 drivers/gpu/drm/scheduler/tests/tests_scheduler.c 671 672 static struct kunit_case drm_sched_scheduler_two_clients_tests[] = { 673 KUNIT_CASE_PARAM_ATTR(drm_sched_scheduler_two_clients_test, 674 drm_sched_scheduler_two_clients_gen_params, > 675 drm_sched_scheduler_two_clients_attr), 676 {} 677 }; 678 Fix it by using a compound literal as other tests do. Signed-off-by: Tvrtko Ursulin Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605220312.Pu7UO05u-lkp@intel.com/ Fixes: 97ef806a5314 ("drm/sched: Add some scheduling quality unit tests") Cc: Philipp Stanner Acked-by: Philipp Stanner Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260522090129.9385-1-tvrtko.ursulin@igalia.com --- drivers/gpu/drm/scheduler/tests/tests_scheduler.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/scheduler/tests/tests_scheduler.c b/drivers/gpu/drm/scheduler/tests/tests_scheduler.c index 8b2e4ef9915f..90d31888cf92 100644 --- a/drivers/gpu/drm/scheduler/tests/tests_scheduler.c +++ b/drivers/gpu/drm/scheduler/tests/tests_scheduler.c @@ -666,14 +666,10 @@ static void drm_sched_scheduler_two_clients_test(struct kunit *test) } } -static const struct kunit_attributes drm_sched_scheduler_two_clients_attr = { - .speed = KUNIT_SPEED_SLOW, -}; - static struct kunit_case drm_sched_scheduler_two_clients_tests[] = { KUNIT_CASE_PARAM_ATTR(drm_sched_scheduler_two_clients_test, drm_sched_scheduler_two_clients_gen_params, - drm_sched_scheduler_two_clients_attr), + { .speed = KUNIT_SPEED_SLOW }), {} }; @@ -858,14 +854,10 @@ static void drm_sched_scheduler_many_clients_test(struct kunit *test) drm_mock_sched_entity_free(client[i].entity); } -static const struct kunit_attributes drm_sched_scheduler_many_clients_attr = { - .speed = KUNIT_SPEED_SLOW, -}; - static struct kunit_case drm_sched_scheduler_many_clients_tests[] = { KUNIT_CASE_PARAM_ATTR(drm_sched_scheduler_many_clients_test, drm_sched_scheduler_many_clients_gen_params, - drm_sched_scheduler_many_clients_attr), + { .speed = KUNIT_SPEED_SLOW }), {} }; From 257adf5ea64901263071a4a8e6ff958c5e0712c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ma=C3=ADra=20Canal?= Date: Sat, 30 May 2026 15:37:43 -0300 Subject: [PATCH 07/11] drm/v3d: Flush MMU TLB and cache during runtime resume MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v3d_mmu_set_page_table() ends by calling v3d_mmu_flush_all() to flush the MMU cache and clear the TLB after reprogramming V3D_MMU_PT_PA_BASE. v3d_mmu_flush_all() is gated by pm_runtime_get_if_active(), which returns 0 unless runtime_status == RPM_ACTIVE. v3d_mmu_set_page_table() is called from two paths that *know* V3D is reachable, but where the runtime PM status might be wrong: 1. v3d_power_resume(): the runtime resume callback itself, where runtime_status is RPM_RESUMING. 2. v3d_reset(): called from the DRM scheduler timeout handler with the hung job's pm_runtime reference held, so RPM_ACTIVE, but here we don't need to take an extra reference for the duration of the flush either. In the first case pm_runtime_get_if_active() returns 0, the flush is silently skipped, and V3D resumes executing with whatever MMUC/TLB state happened to survive the last reset. This can leave stale translations live across runtime PM cycles, manifesting as random GPU hangs. Split the actual flush sequence into a helper that does the writes unconditionally, and have v3d_mmu_set_page_table() call it directly. Fixes: 458f2a712ab4 ("drm/v3d: Introduce Runtime Power Management") Link: https://patch.msgid.link/20260530-v3d-fix-rpi4-freezes-v1-2-c2c8307da6ce@igalia.com Signed-off-by: Maíra Canal Reviewed-by: Iago Toral Quiroga --- drivers/gpu/drm/v3d/v3d_mmu.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_mmu.c b/drivers/gpu/drm/v3d/v3d_mmu.c index 630c64e51d2f..94f6676d5633 100644 --- a/drivers/gpu/drm/v3d/v3d_mmu.c +++ b/drivers/gpu/drm/v3d/v3d_mmu.c @@ -37,13 +37,14 @@ static bool v3d_mmu_is_aligned(u32 page, u32 page_address, size_t alignment) IS_ALIGNED(page_address, alignment >> V3D_MMU_PAGE_SHIFT); } -int v3d_mmu_flush_all(struct v3d_dev *v3d) +/* + * Issue the MMUC flush and TLB clear unconditionally. The caller must + * already know that V3D is reachable. In particular, this is used from + * the runtime resume callback. + */ +static int v3d_mmu_flush_all_locked(struct v3d_dev *v3d) { - int ret = 0; - - /* Flush the PTs only if we're already awake */ - if (!pm_runtime_get_if_active(v3d->drm.dev)) - return 0; + int ret; V3D_WRITE(V3D_MMUC_CONTROL, V3D_MMUC_CONTROL_FLUSH | V3D_MMUC_CONTROL_ENABLE); @@ -52,7 +53,7 @@ int v3d_mmu_flush_all(struct v3d_dev *v3d) V3D_MMUC_CONTROL_FLUSHING), 100); if (ret) { dev_err(v3d->drm.dev, "MMUC flush wait idle failed\n"); - goto pm_put; + return ret; } V3D_WRITE(V3D_MMU_CTL, V3D_READ(V3D_MMU_CTL) | @@ -63,7 +64,19 @@ int v3d_mmu_flush_all(struct v3d_dev *v3d) if (ret) dev_err(v3d->drm.dev, "MMU TLB clear wait idle failed\n"); -pm_put: + return ret; +} + +int v3d_mmu_flush_all(struct v3d_dev *v3d) +{ + int ret; + + /* Flush the PTs only if we're already awake */ + if (!pm_runtime_get_if_active(v3d->drm.dev)) + return 0; + + ret = v3d_mmu_flush_all_locked(v3d); + v3d_pm_runtime_put(v3d); return ret; } @@ -85,7 +98,7 @@ int v3d_mmu_set_page_table(struct v3d_dev *v3d) V3D_MMU_ILLEGAL_ADDR_ENABLE); V3D_WRITE(V3D_MMUC_CONTROL, V3D_MMUC_CONTROL_ENABLE); - return v3d_mmu_flush_all(v3d); + return v3d_mmu_flush_all_locked(v3d); } void v3d_mmu_insert_ptes(struct v3d_bo *bo) From b81e8b02e8f26b13ff4d6410f7a9854ba7021b86 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ma=C3=ADra=20Canal?= Date: Sat, 30 May 2026 15:37:44 -0300 Subject: [PATCH 08/11] drm/v3d: Clean caches before runtime suspend MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On runtime suspend, clean the V3D caches before suspending so all dirty lines are written back to memory before the power domain is shut down. Fixes several system hangs reported in [1][2][3]. Closes: https://github.com/raspberrypi/linux/issues/7381 [1] Closes: https://github.com/raspberrypi/linux/issues/7396 [2] Closes: https://github.com/raspberrypi/linux/issues/7397 [3] Fixes: 458f2a712ab4 ("drm/v3d: Introduce Runtime Power Management") Link: https://patch.msgid.link/20260530-v3d-fix-rpi4-freezes-v1-3-c2c8307da6ce@igalia.com Signed-off-by: Maíra Canal Reviewed-by: Iago Toral Quiroga --- drivers/gpu/drm/v3d/v3d_power.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/v3d/v3d_power.c b/drivers/gpu/drm/v3d/v3d_power.c index 769e90032b04..f7df6393d38f 100644 --- a/drivers/gpu/drm/v3d/v3d_power.c +++ b/drivers/gpu/drm/v3d/v3d_power.c @@ -52,6 +52,8 @@ int v3d_power_suspend(struct device *dev) v3d_irq_disable(v3d); + v3d_clean_caches(v3d); + ret = v3d_suspend_sms(v3d); if (ret) { v3d_irq_enable(v3d); From 90ae44d1e1bc67e8f6ceef56f184047c5fe775c7 Mon Sep 17 00:00:00 2001 From: Lizhi Hou Date: Mon, 1 Jun 2026 21:06:24 -0700 Subject: [PATCH 09/11] accel/amdxdna: Preserve user address when PASID is disabled When PASID is not used, the buffer user address is set to AMDXDNA_INVALID_ADDR. As a result, heap buffer user address validation fails even though the original userspace address is available. Preserve the userspace address regardless of PASID usage so heap buffer address validation works correctly. Fixes: dbc8fd7a03cb ("accel/amdxdna: Add expandable device heap support") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260602040624.2206774-1-lizhi.hou@amd.com --- drivers/accel/amdxdna/amdxdna_gem.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c index 00efa8abfeea..63976c3bcbe0 100644 --- a/drivers/accel/amdxdna/amdxdna_gem.c +++ b/drivers/accel/amdxdna/amdxdna_gem.c @@ -349,8 +349,11 @@ static int amdxdna_hmm_register(struct amdxdna_gem_obj *abo, u32 nr_pages; int ret; - if (!amdxdna_pasid_on(abo->client)) + if (!amdxdna_pasid_on(abo->client)) { + /* Need to set uva for heap uva validation */ + abo->mem.uva = addr; return 0; + } mapp = kzalloc_obj(*mapp); if (!mapp) From 5d12ef71fbfd3b46c1319074e50f814215ae7f3b Mon Sep 17 00:00:00 2001 From: Lizhi Hou Date: Fri, 29 May 2026 08:28:37 -0700 Subject: [PATCH 10/11] accel/amdxdna: Remove drv_cmd tracing from job free callback aie2_sched_job_free() accesses job->drv_cmd for tracing purposes. However, job->drv_cmd is owned by the caller and may already have been freed when the job free callback runs, leading to a potential use-after-free. Remove the job->drv_cmd access from aie2_sched_job_free(). Fixes: 8711eb2dde2e ("accel/amdxdna: Improve tracing for job lifecycle and mailbox RX worker") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260529152837.1973405-1-lizhi.hou@amd.com --- drivers/accel/amdxdna/aie2_ctx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c index 658a5fb1fda6..2ad343728782 100644 --- a/drivers/accel/amdxdna/aie2_ctx.c +++ b/drivers/accel/amdxdna/aie2_ctx.c @@ -437,8 +437,9 @@ static void aie2_sched_job_free(struct drm_sched_job *sched_job) struct amdxdna_sched_job *job = drm_job_to_xdna_job(sched_job); struct amdxdna_hwctx *hwctx = job->hwctx; + /* job->drv_cmd could be freed, so use DEFAULT_IO */ trace_xdna_job(sched_job, hwctx->name, "job free", - job->seq, job->drv_cmd ? job->drv_cmd->opcode : DEFAULT_IO); + job->seq, DEFAULT_IO); if (!job->job_done) up(&hwctx->priv->job_sem); From 62c1671f6454ceaa80e9ceff63f821aa36f35154 Mon Sep 17 00:00:00 2001 From: Lizhi Hou Date: Fri, 29 May 2026 09:21:22 -0700 Subject: [PATCH 11/11] accel/amdxdna: Return errors for failed debug BO commands The config and sync debug BO commands currently may report success even when the operation fails. Capture the firmware return status and propagate the corresponding error to userspace. Fixes: 7ea046838021 ("accel/amdxdna: Support firmware debug buffer") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260529162122.1976376-1-lizhi.hou@amd.com --- drivers/accel/amdxdna/aie2_ctx.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c index 2ad343728782..da89b3701f5b 100644 --- a/drivers/accel/amdxdna/aie2_ctx.c +++ b/drivers/accel/amdxdna/aie2_ctx.c @@ -305,17 +305,13 @@ aie2_sched_drvcmd_resp_handler(void *handle, void __iomem *data, size_t size) struct amdxdna_sched_job *job = handle; int ret = 0; - if (unlikely(!data)) - goto out; - - if (unlikely(size != sizeof(u32))) { + if (unlikely(!data || size != sizeof(u32))) { + job->drv_cmd->result = U32_MAX; ret = -EINVAL; - goto out; + } else { + job->drv_cmd->result = readl(data); } - job->drv_cmd->result = readl(data); - -out: aie2_sched_notify(job); return ret; } @@ -940,6 +936,7 @@ static int aie2_hwctx_cfg_debug_bo(struct amdxdna_hwctx *hwctx, u32 bo_hdl, aie2_cmd_wait(hwctx, seq); if (cmd.result) { XDNA_ERR(xdna, "Response failure 0x%x", cmd.result); + ret = -EINVAL; goto put_obj; }