Re: [PATCH V1] accel/amdxdna: Fix deadlock on debug BO command timeout

[Max Zhen]

On 7/6/2026 Mon 22:57, Lizhi Hou wrote:
> Both amdxdna_hwctx_sync_debug_bo() and amdxdna_drm_config_hwctx_ioctl()
> hold xdna->dev_lock while invoking backend operations. If the hardware
> hangs, aie2_cmd_wait() blocks waiting for a firmware response. When the
> DRM scheduler timeout expires, aie2_sched_job_timedout() is invoked to
> reset the hardware. However, the timeout handler also attempts to acquire
> dev_lock, resulting in a deadlock.
>
> Avoid this by releasing dev_lock before waiting for the firmware
> response and reacquiring it after the wait completes. This allows the
> timeout handler to proceed with device recovery when a debug BO command
> times out.
>
> Fixes: 7ea046838021 ("accel/amdxdna: Support firmware debug buffer")
> Signed-off-by: Lizhi Hou <lizhi.hou@xxxxxxx>
Reviewed-by: Max Zhen <max.zhen@xxxxxxx>
> ---
>   drivers/accel/amdxdna/aie2_ctx.c    | 5 ++++-
>   drivers/accel/amdxdna/amdxdna_ctx.c | 6 ++++++
>   2 files changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
> index 7bf635634e64..30ccb8d5e23d 100644
> --- a/drivers/accel/amdxdna/aie2_ctx.c
> +++ b/drivers/accel/amdxdna/aie2_ctx.c
> @@ -900,13 +900,16 @@ static int aie2_hwctx_cu_config(struct amdxdna_hwctx *hwctx, void *buf, u32 size
>   static void aie2_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq)
>   {
>   	struct dma_fence *out_fence = aie2_cmd_get_out_fence(hwctx, seq);
> +	struct amdxdna_dev *xdna = hwctx->client->xdna;
>   
>   	if (!out_fence) {
> -		XDNA_ERR(hwctx->client->xdna, "Failed to get fence");
> +		XDNA_ERR(xdna, "Failed to get fence");
>   		return;
>   	}
>   
> +	mutex_unlock(&xdna->dev_lock);
>   	dma_fence_wait_timeout(out_fence, false, MAX_SCHEDULE_TIMEOUT);
> +	mutex_lock(&xdna->dev_lock);
>   	dma_fence_put(out_fence);
>   }
>   
> diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
> index 67a2abcf173e..9ae19393e488 100644
> --- a/drivers/accel/amdxdna/amdxdna_ctx.c
> +++ b/drivers/accel/amdxdna/amdxdna_ctx.c
> @@ -310,6 +310,7 @@ int amdxdna_drm_destroy_hwctx_ioctl(struct drm_device *dev, void *data, struct d
>   	if (!drm_dev_enter(dev, &idx))
>   		return -ENODEV;
>   
> +	mutex_lock(&xdna->client_lock);
>   	mutex_lock(&xdna->dev_lock);
>   	hwctx = xa_erase(&client->hwctx_xa, args->handle);
>   	if (!hwctx) {
> @@ -328,6 +329,7 @@ int amdxdna_drm_destroy_hwctx_ioctl(struct drm_device *dev, void *data, struct d
>   	XDNA_DBG(xdna, "PID %d destroyed HW context %d", client->pid, args->handle);
>   out:
>   	mutex_unlock(&xdna->dev_lock);
> +	mutex_unlock(&xdna->client_lock);
>   	drm_dev_exit(idx);
>   	return ret;
>   }
> @@ -388,6 +390,7 @@ int amdxdna_drm_config_hwctx_ioctl(struct drm_device *dev, void *data, struct dr
>   		goto free_buf;
>   	}
>   
> +	mutex_lock(&xdna->client_lock);
>   	mutex_lock(&xdna->dev_lock);
>   	hwctx = xa_load(&client->hwctx_xa, args->handle);
>   	if (!hwctx) {
> @@ -400,6 +403,7 @@ int amdxdna_drm_config_hwctx_ioctl(struct drm_device *dev, void *data, struct dr
>   
>   unlock:
>   	mutex_unlock(&xdna->dev_lock);
> +	mutex_unlock(&xdna->client_lock);
>   	amdxdna_pm_suspend_put(xdna);
>   free_buf:
>   	kfree(buf);
> @@ -428,6 +432,7 @@ int amdxdna_hwctx_sync_debug_bo(struct amdxdna_client *client, u32 debug_bo_hdl)
>   	}
>   
>   	abo = to_xdna_obj(gobj);
> +	mutex_lock(&xdna->client_lock);
>   	mutex_lock(&xdna->dev_lock);
>   	hwctx = xa_load(&client->hwctx_xa, abo->assigned_hwctx);
>   	if (!hwctx) {
> @@ -439,6 +444,7 @@ int amdxdna_hwctx_sync_debug_bo(struct amdxdna_client *client, u32 debug_bo_hdl)
>   
>   unlock:
>   	mutex_unlock(&xdna->dev_lock);
> +	mutex_unlock(&xdna->client_lock);
>   	amdxdna_pm_suspend_put(xdna);
>   put_obj:
>   	drm_gem_object_put(gobj);