* [PATCH V2 01/20] accel/amdxdna: Rename NPU3 firmware files
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 02/20] accel/amdxdna: Remove mmap for doorbell David Zhang
` (18 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello
The NPU3 firmware files will be released as npu.sbin and cert.sbin.
Rename the current firmware names to match the firmware release names,
and add MODULE_FIRMWARE() declarations for the new 17f2_10 npu.sbin and
cert.sbin names.
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/amdxdna_pci_drv.c | 2 ++
drivers/accel/amdxdna/npu3_regs.c | 4 ++--
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.c b/drivers/accel/amdxdna/amdxdna_pci_drv.c
index bb339e641416..d9e2e71d3e05 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.c
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.c
@@ -28,6 +28,8 @@ MODULE_FIRMWARE("amdnpu/17f0_20/npu.sbin");
MODULE_FIRMWARE("amdnpu/1502_00/npu_7.sbin");
MODULE_FIRMWARE("amdnpu/17f0_10/npu_7.sbin");
MODULE_FIRMWARE("amdnpu/17f0_11/npu_7.sbin");
+MODULE_FIRMWARE("amdnpu/17f2_10/npu.sbin");
+MODULE_FIRMWARE("amdnpu/17f2_10/cert.sbin");
/*
* 0.0: Initial version
diff --git a/drivers/accel/amdxdna/npu3_regs.c b/drivers/accel/amdxdna/npu3_regs.c
index d76b2e99c308..8d287ef32fff 100644
--- a/drivers/accel/amdxdna/npu3_regs.c
+++ b/drivers/accel/amdxdna/npu3_regs.c
@@ -43,8 +43,8 @@ static const struct amdxdna_fw_feature_tbl npu3_fw_feature_table[] = {
};
static const struct amdxdna_dev_priv npu3_dev_priv = {
- .npufw_path = "npu.dev.sbin",
- .certfw_path = "cert.dev.sbin",
+ .npufw_path = "npu.sbin",
+ .certfw_path = "cert.sbin",
.mbox_bar = NPU3_MBOX_BAR,
.mbox_rbuf_bar = NPU3_MBOX_BUFFER_BAR,
.mbox_info_off = NPU3_MBOX_INFO_OFF,
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 02/20] accel/amdxdna: Remove mmap for doorbell
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
2026-10-06 4:22 ` [PATCH V2 01/20] accel/amdxdna: Rename NPU3 firmware files David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 03/20] accel/amdxdna: Add CERT firmware version support David Zhang
` (17 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello
Make kernel submission the default, so mapping the doorbell back to user
space is not needed:
- Remove .mmap handler and use standard drm_gem_mmap.
- Set hwctx->doorbell_offset to AMDXDNA_INVALID_DOORBELL_OFFSET on
context creation so userspace does not receive a valid-looking BAR
offset.
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_ctx.c | 20 +--------------
drivers/accel/amdxdna/aie4_pci.c | 33 -------------------------
drivers/accel/amdxdna/aie4_pci.h | 1 -
drivers/accel/amdxdna/amdxdna_pci_drv.c | 17 +------------
drivers/accel/amdxdna/amdxdna_pci_drv.h | 1 -
5 files changed, 2 insertions(+), 70 deletions(-)
diff --git a/drivers/accel/amdxdna/aie4_ctx.c b/drivers/accel/amdxdna/aie4_ctx.c
index 8408b0d2696f..8157f2a6fd10 100644
--- a/drivers/accel/amdxdna/aie4_ctx.c
+++ b/drivers/accel/amdxdna/aie4_ctx.c
@@ -158,7 +158,7 @@ static int aie4_hwctx_create(struct amdxdna_hwctx *hwctx)
}
priv->hw_ctx_id = resp.hw_context_id;
- hwctx->doorbell_offset = resp.doorbell_offset;
+ hwctx->doorbell_offset = AMDXDNA_INVALID_DOORBELL_OFFSET;
return 0;
}
@@ -313,21 +313,3 @@ int aie4_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq, u32 timeout)
return ret <= 0 ? ret : 0;
}
-
-int aie4_hwctx_valid_doorbell(struct amdxdna_client *client, u32 vm_pgoff)
-{
- struct amdxdna_hwctx *hwctx;
- unsigned long hwctx_id;
- int idx;
-
- idx = srcu_read_lock(&client->hwctx_srcu);
- amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
- if (vm_pgoff == (hwctx->doorbell_offset >> PAGE_SHIFT)) {
- srcu_read_unlock(&client->hwctx_srcu, idx);
- return 1;
- }
- }
- srcu_read_unlock(&client->hwctx_srcu, idx);
-
- return 0;
-}
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index a58a83af42a4..db02d25e3f4a 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -518,38 +518,6 @@ static int aie4m_pcidev_init(struct amdxdna_dev *xdna)
return 0;
}
-static int aie4_doorbell_mmap(struct amdxdna_client *client, struct vm_area_struct *vma)
-{
- struct amdxdna_dev *xdna = client->xdna;
- struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
- const struct amdxdna_dev_priv *npriv = xdna->dev_info->dev_priv;
- phys_addr_t res_start;
- unsigned long pfn;
- int ret;
-
- if (!aie4_hwctx_valid_doorbell(client, vma->vm_pgoff)) {
- XDNA_ERR(xdna, "Invalid doorbell page offset 0x%lx", vma->vm_pgoff);
- return -EINVAL;
- }
-
- if (vma_pages(vma) != 1) {
- XDNA_ERR(xdna, "can only map one page, got %ld", vma_pages(vma));
- return -EINVAL;
- }
-
- res_start = pci_resource_start(pdev, xdna->dev_info->doorbell_bar) + npriv->doorbell_off;
- pfn = PHYS_PFN(res_start) + vma->vm_pgoff;
- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
- vm_flags_set(vma, VM_IO | VM_DONTEXPAND | VM_DONTDUMP);
- ret = io_remap_pfn_range(vma, vma->vm_start,
- pfn,
- PAGE_SIZE,
- vma->vm_page_prot);
-
- XDNA_DBG(xdna, "doorbell ret %d", ret);
- return ret;
-}
-
static int aie4_get_info(struct amdxdna_client *client, struct amdxdna_drm_get_info *args)
{
struct amdxdna_dev *xdna = client->xdna;
@@ -661,7 +629,6 @@ const struct amdxdna_dev_ops aie4_vf_ops = {
.fini = aie4_vf_fini,
.hwctx_init = aie4_hwctx_init,
.hwctx_fini = aie4_hwctx_fini,
- .mmap = aie4_doorbell_mmap,
.cmd_wait = aie4_cmd_wait,
.get_aie_info = aie4_get_info,
};
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index 3fd5eace3ed7..c6219544dc0f 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -69,7 +69,6 @@ int aie4_attach_work_buffer(struct amdxdna_dev_hdl *ndev);
int aie4_hwctx_init(struct amdxdna_hwctx *hwctx);
void aie4_hwctx_fini(struct amdxdna_hwctx *hwctx);
int aie4_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq, u32 timeout);
-int aie4_hwctx_valid_doorbell(struct amdxdna_client *client, u32 vm_pgoff);
/* aie4_sriov.c */
#if IS_ENABLED(CONFIG_PCI_IOV)
diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.c b/drivers/accel/amdxdna/amdxdna_pci_drv.c
index d9e2e71d3e05..3140af69e29c 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.c
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.c
@@ -250,21 +250,6 @@ static int amdxdna_drm_set_state_ioctl(struct drm_device *dev, void *data, struc
return ret;
}
-static int amdxdna_drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
-{
- struct drm_file *drm_filp = filp->private_data;
- struct amdxdna_client *client = drm_filp->driver_priv;
- struct amdxdna_dev *xdna = client->xdna;
-
- if (likely(vma->vm_pgoff >= DRM_FILE_PAGE_OFFSET_START))
- return drm_gem_mmap(filp, vma);
-
- if (!xdna->dev_info->ops->mmap)
- return -EOPNOTSUPP;
-
- return xdna->dev_info->ops->mmap(client, vma);
-}
-
static const struct drm_ioctl_desc amdxdna_drm_ioctls[] = {
/* Context */
DRM_IOCTL_DEF_DRV(AMDXDNA_CREATE_HWCTX, amdxdna_drm_create_hwctx_ioctl, 0),
@@ -323,7 +308,7 @@ static const struct file_operations amdxdna_fops = {
.poll = drm_poll,
.read = drm_read,
.llseek = noop_llseek,
- .mmap = amdxdna_drm_gem_mmap,
+ .mmap = drm_gem_mmap,
.show_fdinfo = drm_show_fdinfo,
.fop_flags = FOP_UNSIGNED_OFFSET,
};
diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.h b/drivers/accel/amdxdna/amdxdna_pci_drv.h
index a997d27a504d..84c8973e9197 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.h
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.h
@@ -57,7 +57,6 @@ struct amdxdna_dev_ops {
int (*resume)(struct amdxdna_dev *xdna);
int (*suspend)(struct amdxdna_dev *xdna);
int (*sriov_configure)(struct amdxdna_dev *xdna, int num_vfs);
- int (*mmap)(struct amdxdna_client *client, struct vm_area_struct *vma);
int (*hwctx_init)(struct amdxdna_hwctx *hwctx);
void (*hwctx_fini)(struct amdxdna_hwctx *hwctx);
int (*hwctx_config)(struct amdxdna_hwctx *hwctx, u32 type, u64 value, void *buf, u32 size);
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 03/20] accel/amdxdna: Add CERT firmware version support
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
2026-10-06 4:22 ` [PATCH V2 01/20] accel/amdxdna: Rename NPU3 firmware files David Zhang
2026-10-06 4:22 ` [PATCH V2 02/20] accel/amdxdna: Remove mmap for doorbell David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 04/20] accel/amdxdna: Upgrade firmware version to 6.0 David Zhang
` (16 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello
Add support to query and validate CERT firmware version:
- Add mailbox opcodes and structs to query NPU firmware version (identify)
and CERT firmware version.
- Unify firmware version storage by using struct
amdxdna_drm_query_firmware_version across the driver.
- Introduce aie_check_cert_protocol() and cert_feature_tbl to validate
CERT firmware host queue protocol compatibility against driver
capabilities.
- Add helper functions amdxdna_get_firmware_version() and
amdxdna_get_aie_version() to share version query handling across
generations.
Note on patch ordering:
Introducing CERT firmware protocol validation prior to the firmware 6.0
upgrade ensures host queue protocol compatibility (host_queue_major/minor)
is validated before the host queue layout restructure, preserving
bisectability.
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie.c | 45 ++++++++++++++++++++---
drivers/accel/amdxdna/aie.h | 9 ++++-
drivers/accel/amdxdna/aie2_message.c | 4 +--
drivers/accel/amdxdna/aie2_pci.c | 47 +++----------------------
drivers/accel/amdxdna/aie2_pci.h | 4 +--
drivers/accel/amdxdna/aie4_message.c | 45 +++++++++++++++++++++++
drivers/accel/amdxdna/aie4_msg_priv.h | 30 ++++++++++++++++
drivers/accel/amdxdna/aie4_pci.c | 17 ++++++++-
drivers/accel/amdxdna/aie4_pci.h | 11 ++++++
drivers/accel/amdxdna/amdxdna_pci_drv.h | 10 ++----
drivers/accel/amdxdna/amdxdna_sysfs.c | 2 +-
drivers/accel/amdxdna/npu3_regs.c | 7 ++++
12 files changed, 169 insertions(+), 62 deletions(-)
diff --git a/drivers/accel/amdxdna/aie.c b/drivers/accel/amdxdna/aie.c
index dd6f36f222c7..01a439c0ccf4 100644
--- a/drivers/accel/amdxdna/aie.c
+++ b/drivers/accel/amdxdna/aie.c
@@ -65,13 +65,12 @@ int aie_send_mgmt_msg_wait(struct aie_device *aie, struct xdna_mailbox_msg *msg)
return ret;
}
-int aie_check_protocol(struct aie_device *aie, u32 fw_major, u32 fw_minor)
+static int aie_check_protocol_impl(struct aie_device *aie, u32 fw_major, u32 fw_minor,
+ const struct amdxdna_fw_feature_tbl *feature)
{
- const struct amdxdna_fw_feature_tbl *feature;
bool found = false;
- for (feature = aie->xdna->dev_info->fw_feature_tbl;
- feature->major; feature++) {
+ for (; feature && feature->major; feature++) {
if (feature->major != fw_major)
continue;
if (fw_minor < feature->min_minor)
@@ -88,6 +87,44 @@ int aie_check_protocol(struct aie_device *aie, u32 fw_major, u32 fw_minor)
return found ? 0 : -EOPNOTSUPP;
}
+int aie_check_protocol(struct aie_device *aie, u32 fw_major, u32 fw_minor)
+{
+ return aie_check_protocol_impl(aie, fw_major, fw_minor,
+ aie->xdna->dev_info->fw_feature_tbl);
+}
+
+int aie_check_cert_protocol(struct aie_device *aie, u32 cert_major, u32 cert_minor)
+{
+ return aie_check_protocol_impl(aie, cert_major, cert_minor,
+ aie->xdna->dev_info->cert_feature_tbl);
+}
+
+int amdxdna_get_aie_version(struct amdxdna_client *client,
+ struct amdxdna_drm_get_info *args,
+ struct amdxdna_drm_query_aie_version *version)
+{
+ u32 buf_sz;
+
+ buf_sz = min_t(u32, args->buffer_size, sizeof(*version));
+ if (copy_to_user(u64_to_user_ptr(args->buffer), version, buf_sz))
+ return -EFAULT;
+
+ return 0;
+}
+
+int amdxdna_get_firmware_version(struct amdxdna_client *client,
+ struct amdxdna_drm_get_info *args,
+ struct amdxdna_drm_query_firmware_version *version)
+{
+ u32 buf_sz;
+
+ buf_sz = min_t(u32, args->buffer_size, sizeof(*version));
+ if (copy_to_user(u64_to_user_ptr(args->buffer), version, buf_sz))
+ return -EFAULT;
+
+ return 0;
+}
+
static void amdxdna_update_vbnv(struct amdxdna_dev *xdna,
const struct amdxdna_rev_vbnv *tbl,
u32 rev)
diff --git a/drivers/accel/amdxdna/aie.h b/drivers/accel/amdxdna/aie.h
index 0483d582b7f8..899399756661 100644
--- a/drivers/accel/amdxdna/aie.h
+++ b/drivers/accel/amdxdna/aie.h
@@ -28,6 +28,7 @@ struct aie_device {
struct psp_device *psp_hdl;
struct smu_device *smu_hdl;
+ struct amdxdna_drm_query_aie_version version;
struct amdxdna_drm_query_aie_metadata metadata;
};
@@ -96,6 +97,7 @@ void aie_dump_mgmt_chann_debug(struct aie_device *aie);
void aie_destroy_chann(struct aie_device *aie, struct mailbox_channel **chann);
int aie_send_mgmt_msg_wait(struct aie_device *aie, struct xdna_mailbox_msg *msg);
int aie_check_protocol(struct aie_device *aie, u32 fw_major, u32 fw_minor);
+int aie_check_cert_protocol(struct aie_device *aie, u32 fw_major, u32 fw_minor);
void amdxdna_vbnv_init(struct amdxdna_dev *xdna);
int amdxdna_get_metadata(struct aie_device *aie, struct amdxdna_client *client,
struct amdxdna_drm_get_info *args);
@@ -103,7 +105,12 @@ void *amdxdna_alloc_msg_buffer(struct amdxdna_dev *xdna, u32 *size,
dma_addr_t *dma_addr);
void amdxdna_free_msg_buffer(struct amdxdna_dev *xdna, size_t size,
void *cpu_addr, dma_addr_t dma_addr);
-
+int amdxdna_get_aie_version(struct amdxdna_client *client,
+ struct amdxdna_drm_get_info *args,
+ struct amdxdna_drm_query_aie_version *version);
+int amdxdna_get_firmware_version(struct amdxdna_client *client,
+ struct amdxdna_drm_get_info *args,
+ struct amdxdna_drm_query_firmware_version *version);
/* aie_psp.c */
struct psp_device *aiem_psp_create(struct drm_device *ddev, struct psp_config *conf);
int aie_psp_start(struct psp_device *psp);
diff --git a/drivers/accel/amdxdna/aie2_message.c b/drivers/accel/amdxdna/aie2_message.c
index f658760c3d48..bae0cc4c3580 100644
--- a/drivers/accel/amdxdna/aie2_message.c
+++ b/drivers/accel/amdxdna/aie2_message.c
@@ -149,7 +149,7 @@ int aie2_query_aie_metadata(struct amdxdna_dev_hdl *ndev,
}
int aie2_query_firmware_version(struct amdxdna_dev_hdl *ndev,
- struct amdxdna_fw_ver *fw_ver)
+ struct amdxdna_drm_query_firmware_version *fw_ver)
{
DECLARE_AIE_MSG(firmware_version, MSG_OP_GET_FIRMWARE_VERSION);
int ret;
@@ -160,7 +160,7 @@ int aie2_query_firmware_version(struct amdxdna_dev_hdl *ndev,
fw_ver->major = resp.major;
fw_ver->minor = resp.minor;
- fw_ver->sub = resp.sub;
+ fw_ver->patch = resp.sub;
fw_ver->build = resp.build;
return 0;
diff --git a/drivers/accel/amdxdna/aie2_pci.c b/drivers/accel/amdxdna/aie2_pci.c
index 7a4314ca843b..5dc6e5b97afc 100644
--- a/drivers/accel/amdxdna/aie2_pci.c
+++ b/drivers/accel/amdxdna/aie2_pci.c
@@ -205,15 +205,16 @@ static int aie2_mgmt_fw_init(struct amdxdna_dev_hdl *ndev)
static int aie2_mgmt_fw_query(struct amdxdna_dev_hdl *ndev)
{
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
int ret;
- ret = aie2_query_firmware_version(ndev, &ndev->aie.xdna->fw_ver);
+ ret = aie2_query_firmware_version(ndev, &xdna->fw_ver);
if (ret) {
XDNA_ERR(ndev->aie.xdna, "query firmware version failed");
return ret;
}
- ret = aie2_query_aie_version(ndev, &ndev->version);
+ ret = aie2_query_aie_version(ndev, &ndev->aie.version);
if (ret) {
XDNA_ERR(ndev->aie.xdna, "Query AIE version failed");
return ret;
@@ -673,44 +674,6 @@ static int aie2_get_aie_status(struct amdxdna_client *client,
return 0;
}
-static int aie2_get_aie_version(struct amdxdna_client *client,
- struct amdxdna_drm_get_info *args)
-{
- struct amdxdna_drm_query_aie_version version;
- struct amdxdna_dev *xdna = client->xdna;
- struct amdxdna_dev_hdl *ndev;
- u32 buf_sz;
-
- ndev = xdna->dev_handle;
- version.major = ndev->version.major;
- version.minor = ndev->version.minor;
-
- buf_sz = min(args->buffer_size, sizeof(version));
- if (copy_to_user(u64_to_user_ptr(args->buffer), &version, buf_sz))
- return -EFAULT;
-
- return 0;
-}
-
-static int aie2_get_firmware_version(struct amdxdna_client *client,
- struct amdxdna_drm_get_info *args)
-{
- struct amdxdna_drm_query_firmware_version version;
- struct amdxdna_dev *xdna = client->xdna;
- u32 buf_sz;
-
- version.major = xdna->fw_ver.major;
- version.minor = xdna->fw_ver.minor;
- version.patch = xdna->fw_ver.sub;
- version.build = xdna->fw_ver.build;
-
- buf_sz = min(args->buffer_size, sizeof(version));
- if (copy_to_user(u64_to_user_ptr(args->buffer), &version, buf_sz))
- return -EFAULT;
-
- return 0;
-}
-
static int aie2_get_power_mode(struct amdxdna_client *client,
struct amdxdna_drm_get_info *args)
{
@@ -1025,7 +988,7 @@ static int aie2_get_info(struct amdxdna_client *client, struct amdxdna_drm_get_i
ret = amdxdna_get_metadata(&ndev->aie, client, args);
break;
case DRM_AMDXDNA_QUERY_AIE_VERSION:
- ret = aie2_get_aie_version(client, args);
+ ret = amdxdna_get_aie_version(client, args, &ndev->aie.version);
break;
case DRM_AMDXDNA_QUERY_CLOCK_METADATA:
ret = aie2_get_clock_metadata(client, args);
@@ -1037,7 +1000,7 @@ static int aie2_get_info(struct amdxdna_client *client, struct amdxdna_drm_get_i
ret = aie2_get_hwctx_status(client, args);
break;
case DRM_AMDXDNA_QUERY_FIRMWARE_VERSION:
- ret = aie2_get_firmware_version(client, args);
+ ret = amdxdna_get_firmware_version(client, args, &xdna->fw_ver);
break;
case DRM_AMDXDNA_GET_POWER_MODE:
ret = aie2_get_power_mode(client, args);
diff --git a/drivers/accel/amdxdna/aie2_pci.h b/drivers/accel/amdxdna/aie2_pci.h
index 2c7019bd26b5..67971f0c4acf 100644
--- a/drivers/accel/amdxdna/aie2_pci.h
+++ b/drivers/accel/amdxdna/aie2_pci.h
@@ -74,7 +74,6 @@ enum aie2_sram_reg_idx {
};
struct amdxdna_client;
-struct amdxdna_fw_ver;
struct amdxdna_hwctx;
struct amdxdna_sched_job;
@@ -150,7 +149,6 @@ struct amdxdna_dev_hdl {
void __iomem *mbox_base;
u32 total_col;
- struct amdxdna_drm_query_aie_version version;
struct aie2_exec_msg_ops *exec_msg_ops;
struct drm_gpu_scheduler *hwctx_sched;
struct ida hwctx_sched_ida;
@@ -263,7 +261,7 @@ int aie2_query_aie_version(struct amdxdna_dev_hdl *ndev,
int aie2_query_aie_metadata(struct amdxdna_dev_hdl *ndev,
struct amdxdna_drm_query_aie_metadata *metadata);
int aie2_query_firmware_version(struct amdxdna_dev_hdl *ndev,
- struct amdxdna_fw_ver *fw_ver);
+ struct amdxdna_drm_query_firmware_version *fw_ver);
int aie2_query_app_health(struct amdxdna_dev_hdl *ndev, u32 context_id,
struct app_health_report *report);
int aie2_get_dev_revision(struct amdxdna_dev_hdl *ndev, enum aie2_dev_revision *rev);
diff --git a/drivers/accel/amdxdna/aie4_message.c b/drivers/accel/amdxdna/aie4_message.c
index 88037edbb02a..b137a2a40b34 100644
--- a/drivers/accel/amdxdna/aie4_message.c
+++ b/drivers/accel/amdxdna/aie4_message.c
@@ -64,6 +64,51 @@ int aie4_query_aie_metadata(struct amdxdna_dev_hdl *ndev,
return 0;
}
+int aie4_query_npu_firmware_version(struct amdxdna_dev_hdl *ndev,
+ struct amdxdna_drm_query_firmware_version *fw_version)
+{
+ DECLARE_AIE_MSG(aie4_msg_identify, AIE4_MSG_OP_IDENTIFY);
+ int ret;
+
+ ret = aie_send_mgmt_msg_wait(&ndev->aie, &msg);
+ if (ret)
+ return ret;
+
+ fw_version->major = resp.fw_major;
+ fw_version->minor = resp.fw_minor;
+ fw_version->patch = resp.fw_patch;
+ fw_version->build = resp.fw_build;
+
+ return 0;
+}
+
+int aie4_query_cert_firmware_version(struct amdxdna_dev_hdl *ndev,
+ struct amdxdna_drm_query_firmware_version *cert_version)
+{
+ DECLARE_AIE_MSG(aie4_msg_query_cert_firmware_version,
+ AIE4_MSG_OP_QUERY_CERT_FIRMWARE_VERSION);
+ int ret;
+
+ ret = aie_send_mgmt_msg_wait(&ndev->aie, &msg);
+ if (ret)
+ return ret;
+
+ ret = aie_check_cert_protocol(&ndev->aie,
+ resp.host_queue_major, resp.host_queue_minor);
+ if (ret) {
+ XDNA_ERR(ndev->aie.xdna, "host queue %d.%d is not supported",
+ resp.host_queue_major, resp.host_queue_minor);
+ return ret;
+ }
+
+ cert_version->major = resp.major_version;
+ cert_version->minor = resp.minor_version;
+ cert_version->patch = resp.hotfix;
+ cert_version->build = resp.build;
+
+ return 0;
+}
+
int aie4_attach_work_buffer(struct amdxdna_dev_hdl *ndev)
{
DECLARE_AIE_MSG(aie4_msg_attach_work_buffer, AIE4_MSG_OP_ATTACH_WORK_BUFFER);
diff --git a/drivers/accel/amdxdna/aie4_msg_priv.h b/drivers/accel/amdxdna/aie4_msg_priv.h
index af0866045b91..5b97c8057de0 100644
--- a/drivers/accel/amdxdna/aie4_msg_priv.h
+++ b/drivers/accel/amdxdna/aie4_msg_priv.h
@@ -10,8 +10,10 @@
#include <linux/types.h>
enum aie4_msg_opcode {
+ AIE4_MSG_OP_IDENTIFY = 0x10002,
AIE4_MSG_OP_SUSPEND = 0x10003,
AIE4_MSG_OP_ATTACH_WORK_BUFFER = 0x1000D,
+ AIE4_MSG_OP_QUERY_CERT_FIRMWARE_VERSION = 0x1000F,
AIE4_MSG_OP_CREATE_VFS = 0x20001,
AIE4_MSG_OP_DESTROY_VFS = 0x20002,
@@ -30,6 +32,18 @@ enum aie4_msg_status {
MAX_AIE4_MSG_STATUS_CODE = 0x4,
};
+struct aie4_msg_identify_req {
+ __u32 rsvd;
+} __packed;
+
+struct aie4_msg_identify_resp {
+ enum aie4_msg_status status;
+ __u32 fw_major;
+ __u32 fw_minor;
+ __u32 fw_patch;
+ __u32 fw_build;
+} __packed;
+
struct aie4_msg_suspend_req {
__u32 rsvd;
} __packed;
@@ -132,6 +146,22 @@ struct aie4_msg_aie4_tile_info_resp {
struct aie4_tile_info info;
} __packed;
+struct aie4_msg_query_cert_firmware_version_req {
+ __u32 resvd;
+} __packed;
+
+struct aie4_msg_query_cert_firmware_version_resp {
+ enum aie4_msg_status status;
+ __u8 major_version;
+ __u8 minor_version;
+ __u8 git_hash[41];
+ __u8 date[11];
+ __u8 hotfix;
+ __u8 build;
+ __u16 host_queue_major;
+ __u16 host_queue_minor;
+} __packed;
+
#define AIE4_WORK_BUFFER_MIN_SIZE SZ_4M
struct aie4_msg_attach_work_buffer_req {
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index db02d25e3f4a..3cb81bc1b627 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -271,7 +271,22 @@ static void aie4_partition_fini(struct amdxdna_dev_hdl *ndev)
static int aie4_query(struct amdxdna_dev_hdl *ndev)
{
- return aie4_query_aie_metadata(ndev, &ndev->aie.metadata);
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+ int ret;
+
+ ret = aie4_query_npu_firmware_version(ndev, &xdna->fw_ver);
+ if (ret)
+ return ret;
+
+ ret = aie4_query_cert_firmware_version(ndev, &ndev->cert_version);
+ if (ret)
+ return ret;
+
+ ret = aie4_query_aie_metadata(ndev, &ndev->aie.metadata);
+ if (ret)
+ return ret;
+
+ return 0;
}
static int aie4_pf_hw_start(struct amdxdna_dev_hdl *ndev)
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index c6219544dc0f..8c62ee6a9b23 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -57,6 +57,13 @@ struct amdxdna_dev_hdl {
void *work_buf;
dma_addr_t work_buf_addr;
u32 work_buf_size;
+
+ struct amdxdna_drm_query_firmware_version cert_version;
+};
+
+enum aie4_fw_feature {
+ AIE4_HSA_COMMAND = 5,
+ AIE4_FEATURE_MAX
};
/* aie4_message.c */
@@ -64,6 +71,10 @@ int aie4_query_aie_metadata(struct amdxdna_dev_hdl *ndev,
struct amdxdna_drm_query_aie_metadata *metadata);
int aie4_suspend_fw(struct amdxdna_dev_hdl *ndev);
int aie4_attach_work_buffer(struct amdxdna_dev_hdl *ndev);
+int aie4_query_npu_firmware_version(struct amdxdna_dev_hdl *ndev,
+ struct amdxdna_drm_query_firmware_version *fw_version);
+int aie4_query_cert_firmware_version(struct amdxdna_dev_hdl *ndev,
+ struct amdxdna_drm_query_firmware_version *cert_version);
/* aie4_ctx.c */
int aie4_hwctx_init(struct amdxdna_hwctx *hwctx);
diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.h b/drivers/accel/amdxdna/amdxdna_pci_drv.h
index 84c8973e9197..0002e6ef32ba 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.h
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.h
@@ -99,16 +99,10 @@ struct amdxdna_dev_info {
size_t dev_heap_max_size;
const struct amdxdna_dev_priv *dev_priv;
const struct amdxdna_fw_feature_tbl *fw_feature_tbl;
+ const struct amdxdna_fw_feature_tbl *cert_feature_tbl;
const struct amdxdna_dev_ops *ops;
};
-struct amdxdna_fw_ver {
- u32 major;
- u32 minor;
- u32 sub;
- u32 build;
-};
-
struct amdxdna_carveout;
struct amdxdna_dev {
@@ -120,7 +114,7 @@ struct amdxdna_dev {
struct mutex dev_lock; /* per device lock */
struct list_head client_list;
struct mutex client_lock; /* client_list */
- struct amdxdna_fw_ver fw_ver;
+ struct amdxdna_drm_query_firmware_version fw_ver;
struct rw_semaphore notifier_lock; /* for mmu notifier*/
struct workqueue_struct *notifier_wq;
diff --git a/drivers/accel/amdxdna/amdxdna_sysfs.c b/drivers/accel/amdxdna/amdxdna_sysfs.c
index d9e359ee8182..e20b7fb1e5d1 100644
--- a/drivers/accel/amdxdna/amdxdna_sysfs.c
+++ b/drivers/accel/amdxdna/amdxdna_sysfs.c
@@ -37,7 +37,7 @@ static ssize_t fw_version_show(struct device *dev, struct device_attribute *attr
struct amdxdna_dev *xdna = dev_get_drvdata(dev);
return sprintf(buf, "%d.%d.%d.%d\n", xdna->fw_ver.major,
- xdna->fw_ver.minor, xdna->fw_ver.sub,
+ xdna->fw_ver.minor, xdna->fw_ver.patch,
xdna->fw_ver.build);
}
static DEVICE_ATTR_RO(fw_version);
diff --git a/drivers/accel/amdxdna/npu3_regs.c b/drivers/accel/amdxdna/npu3_regs.c
index 8d287ef32fff..e82bc0a4f597 100644
--- a/drivers/accel/amdxdna/npu3_regs.c
+++ b/drivers/accel/amdxdna/npu3_regs.c
@@ -42,6 +42,11 @@ static const struct amdxdna_fw_feature_tbl npu3_fw_feature_table[] = {
{ 0 }
};
+static const struct amdxdna_fw_feature_tbl npu3_cert_feature_table[] = {
+ { .features = BIT_U64(AIE4_HSA_COMMAND), .major = 1, .min_minor = 0 },
+ { 0 }
+};
+
static const struct amdxdna_dev_priv npu3_dev_priv = {
.npufw_path = "npu.sbin",
.certfw_path = "cert.sbin",
@@ -85,6 +90,7 @@ const struct amdxdna_dev_info dev_npu3_pf_info = {
.device_type = AMDXDNA_DEV_TYPE_PF,
.dev_priv = &npu3_dev_priv,
.fw_feature_tbl = npu3_fw_feature_table,
+ .cert_feature_tbl = npu3_cert_feature_table,
.ops = &aie4_pf_ops,
};
@@ -96,5 +102,6 @@ const struct amdxdna_dev_info dev_npu3_vf_info = {
.device_type = AMDXDNA_DEV_TYPE_UMQ,
.dev_priv = &npu3_dev_vf_priv,
.fw_feature_tbl = npu3_fw_feature_table,
+ .cert_feature_tbl = npu3_cert_feature_table,
.ops = &aie4_vf_ops,
};
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 04/20] accel/amdxdna: Upgrade firmware version to 6.0
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (2 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 03/20] accel/amdxdna: Add CERT firmware version support David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 05/20] accel/amdxdna: Add NPU3 classic device support David Zhang
` (15 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello
Upgrade firmware interface version to 6.0. Update host queue layout,
opcode definitions, and context creation/destruction request structures.
Parse priority band and PASID for hardware context creation. Protocol
compatibility for this queue layout is validated against the CERT
firmware protocol version.
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_ctx.c | 23 ++++++++++++++++++++---
drivers/accel/amdxdna/aie4_host_queue.h | 7 +++++--
drivers/accel/amdxdna/aie4_message.c | 11 +++++++++++
drivers/accel/amdxdna/aie4_msg_priv.h | 20 +++++++++++++++++---
drivers/accel/amdxdna/aie4_pci.h | 1 +
drivers/accel/amdxdna/npu3_regs.c | 2 +-
6 files changed, 55 insertions(+), 9 deletions(-)
diff --git a/drivers/accel/amdxdna/aie4_ctx.c b/drivers/accel/amdxdna/aie4_ctx.c
index 8157f2a6fd10..5eb918e1d58c 100644
--- a/drivers/accel/amdxdna/aie4_ctx.c
+++ b/drivers/accel/amdxdna/aie4_ctx.c
@@ -9,6 +9,7 @@
#include <drm/drm_gem_shmem_helper.h>
#include <drm/drm_print.h>
#include <drm/gpu_scheduler.h>
+#include <linux/iommu.h>
#include <linux/types.h>
#include "aie.h"
@@ -110,6 +111,22 @@ static int aie4_msg_destroy_context(struct amdxdna_dev_hdl *ndev, u32 hw_context
return aie_send_mgmt_msg_wait(&ndev->aie, &msg);
}
+static u8 aie4_parse_priority_to_dev(u32 priority)
+{
+ switch (priority) {
+ case AMDXDNA_QOS_LOW_PRIORITY:
+ return AIE4_CONTEXT_PRIORITY_BAND_IDLE;
+ case AMDXDNA_QOS_NORMAL_PRIORITY:
+ return AIE4_CONTEXT_PRIORITY_BAND_NORMAL;
+ case AMDXDNA_QOS_HIGH_PRIORITY:
+ return AIE4_CONTEXT_PRIORITY_BAND_FOCUS;
+ case AMDXDNA_QOS_REALTIME_PRIORITY:
+ return AIE4_CONTEXT_PRIORITY_BAND_REAL_TIME;
+ default:
+ return AIE4_CONTEXT_PRIORITY_BAND_NORMAL;
+ }
+}
+
static int aie4_hwctx_create(struct amdxdna_hwctx *hwctx)
{
DECLARE_AIE_MSG(aie4_msg_create_hw_context, AIE4_MSG_OP_CREATE_HW_CONTEXT);
@@ -129,9 +146,9 @@ static int aie4_hwctx_create(struct amdxdna_hwctx *hwctx)
req.partition_id = ndev->partition_id;
req.request_num_tiles = hwctx->num_tiles;
- req.pasid = FIELD_PREP(AIE4_MSG_PASID, client->pasid) |
- FIELD_PREP(AIE4_MSG_PASID_VLD, 1);
- req.priority_band = hwctx->qos.priority;
+ req.pasid = aie4_msg_pasid(client);
+ req.pasid = req.pasid == IOMMU_PASID_INVALID ? 0 : req.pasid;
+ req.priority_band = aie4_parse_priority_to_dev(hwctx->qos.priority);
req.hsa_addr_high = upper_32_bits(amdxdna_gem_dev_addr(priv->umq_bo));
req.hsa_addr_low = lower_32_bits(amdxdna_gem_dev_addr(priv->umq_bo));
diff --git a/drivers/accel/amdxdna/aie4_host_queue.h b/drivers/accel/amdxdna/aie4_host_queue.h
index 1b33eda3f727..95ebbb714c6f 100644
--- a/drivers/accel/amdxdna/aie4_host_queue.h
+++ b/drivers/accel/amdxdna/aie4_host_queue.h
@@ -10,6 +10,7 @@
#define CTX_MAX_CMDS 32
+/* Host queue header layout. */
struct host_queue_header {
__u64 read_index;
struct {
@@ -17,8 +18,10 @@ struct host_queue_header {
__u16 minor;
} version;
__u32 capacity; /* Queue capacity, must be power of two. */
- __u64 write_index;
+ __u64 padding0[6];
+ __u64 write_index; /* different cacheline from read_index to avoid false sharing */
+ __u64 padding1[6];
__u64 data_address; /* The xdna dev addr for payload. */
-};
+} __packed;
#endif /* _AIE4_HOST_QUEUE_H_ */
diff --git a/drivers/accel/amdxdna/aie4_message.c b/drivers/accel/amdxdna/aie4_message.c
index b137a2a40b34..bdbd1d116b61 100644
--- a/drivers/accel/amdxdna/aie4_message.c
+++ b/drivers/accel/amdxdna/aie4_message.c
@@ -5,6 +5,8 @@
#include <drm/amdxdna_accel.h>
#include <drm/drm_print.h>
+#include <linux/bitfield.h>
+#include <linux/iommu.h>
#include <linux/mutex.h>
#include "aie.h"
@@ -14,6 +16,15 @@
#include "amdxdna_mailbox_helper.h"
#include "amdxdna_pci_drv.h"
+u32 aie4_msg_pasid(struct amdxdna_client *client)
+{
+ if (!amdxdna_pasid_on(client))
+ return IOMMU_PASID_INVALID;
+
+ return FIELD_PREP(AIE4_MSG_PASID, client->pasid) |
+ FIELD_PREP(AIE4_MSG_PASID_VLD, 1);
+}
+
int aie4_suspend_fw(struct amdxdna_dev_hdl *ndev)
{
DECLARE_AIE_MSG(aie4_msg_suspend, AIE4_MSG_OP_SUSPEND);
diff --git a/drivers/accel/amdxdna/aie4_msg_priv.h b/drivers/accel/amdxdna/aie4_msg_priv.h
index 5b97c8057de0..b9f7c61f36e3 100644
--- a/drivers/accel/amdxdna/aie4_msg_priv.h
+++ b/drivers/accel/amdxdna/aie4_msg_priv.h
@@ -12,7 +12,6 @@
enum aie4_msg_opcode {
AIE4_MSG_OP_IDENTIFY = 0x10002,
AIE4_MSG_OP_SUSPEND = 0x10003,
- AIE4_MSG_OP_ATTACH_WORK_BUFFER = 0x1000D,
AIE4_MSG_OP_QUERY_CERT_FIRMWARE_VERSION = 0x1000F,
AIE4_MSG_OP_CREATE_VFS = 0x20001,
@@ -23,6 +22,8 @@ enum aie4_msg_opcode {
AIE4_MSG_OP_CREATE_HW_CONTEXT = 0x30003,
AIE4_MSG_OP_DESTROY_HW_CONTEXT = 0x30004,
AIE4_MSG_OP_AIE_TILE_INFO = 0x30006,
+
+ AIE4_MSG_OP_ATTACH_WORK_BUFFER = 0x40001,
};
enum aie4_msg_status {
@@ -32,6 +33,14 @@ enum aie4_msg_status {
MAX_AIE4_MSG_STATUS_CODE = 0x4,
};
+enum aie4_msg_context_priority_band {
+ AIE4_CONTEXT_PRIORITY_BAND_IDLE = 0,
+ AIE4_CONTEXT_PRIORITY_BAND_NORMAL,
+ AIE4_CONTEXT_PRIORITY_BAND_FOCUS,
+ AIE4_CONTEXT_PRIORITY_BAND_REAL_TIME,
+ AIE4_CONTEXT_PRIORITY_BAND_COUNT
+};
+
struct aie4_msg_identify_req {
__u32 rsvd;
} __packed;
@@ -94,7 +103,9 @@ struct aie4_msg_create_hw_context_req {
#define AIE4_MSG_PASID GENMASK(19, 0)
#define AIE4_MSG_PASID_VLD GENMASK(31, 31)
__u32 pasid;
- __u32 priority_band;
+ __u8 priority_band;
+ __u8 priority_level;
+ __u16 restore_id;
} __packed;
struct aie4_msg_create_hw_context_resp {
@@ -106,11 +117,14 @@ struct aie4_msg_create_hw_context_resp {
struct aie4_msg_destroy_hw_context_req {
__u32 hw_context_id;
- __u32 resvd1;
+#define AIE4_MSG_GRACEFUL_FLAG GENMASK(0, 0)
+ __u32 graceful_flag;
} __packed;
struct aie4_msg_destroy_hw_context_resp {
enum aie4_msg_status status;
+ __u16 restore_id;
+ __u16 resvd;
} __packed;
struct aie4_tile_info {
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index 8c62ee6a9b23..bdbb2d7cf0e7 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -75,6 +75,7 @@ int aie4_query_npu_firmware_version(struct amdxdna_dev_hdl *ndev,
struct amdxdna_drm_query_firmware_version *fw_version);
int aie4_query_cert_firmware_version(struct amdxdna_dev_hdl *ndev,
struct amdxdna_drm_query_firmware_version *cert_version);
+u32 aie4_msg_pasid(struct amdxdna_client *client);
/* aie4_ctx.c */
int aie4_hwctx_init(struct amdxdna_hwctx *hwctx);
diff --git a/drivers/accel/amdxdna/npu3_regs.c b/drivers/accel/amdxdna/npu3_regs.c
index e82bc0a4f597..93f749acb5d5 100644
--- a/drivers/accel/amdxdna/npu3_regs.c
+++ b/drivers/accel/amdxdna/npu3_regs.c
@@ -38,7 +38,7 @@
#define MP1_C2PMSG_60_ALT_1 0x3B109F0
static const struct amdxdna_fw_feature_tbl npu3_fw_feature_table[] = {
- { .major = 5, .min_minor = 10 },
+ { .major = 6, .min_minor = 0 },
{ 0 }
};
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 05/20] accel/amdxdna: Add NPU3 classic device support
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (3 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 04/20] accel/amdxdna: Upgrade firmware version to 6.0 David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 06/20] accel/amdxdna: Add AIE version query to aie4_get_info David Zhang
` (14 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello
Add NPU3 classic device operations (aie4_classic_ops) and register
definitions, as well as the PCI device ID and firmware declarations for
NPU3 classic devices. Remove device IDs 0x1B0B and 0x1B0C because those
devices will not be released.
Also guard dev_heap_mm initialization and takedown against zero-sized
device heap, as NPU3 does not configure a dedicated device memory heap.
Note: System suspend/resume support requires draining and managing
in-flight commands by leveraging the kernel-mode queue (KMQ) infra.
Full suspend and resume callbacks for all AIE4 device types are
introduced in a subsequent patch with KMQ support.
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_pci.c | 83 +++++++++++++++++++++++++
drivers/accel/amdxdna/aie4_pci.h | 1 +
drivers/accel/amdxdna/amdxdna_pci_drv.c | 23 ++++---
drivers/accel/amdxdna/amdxdna_pci_drv.h | 1 +
drivers/accel/amdxdna/npu3_regs.c | 14 +++++
5 files changed, 115 insertions(+), 7 deletions(-)
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index 3cb81bc1b627..880619e3a4a8 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -359,6 +359,51 @@ static void aie4_vf_hw_stop(struct amdxdna_dev_hdl *ndev)
aie4_mailbox_fini(ndev);
}
+static int aie4_classic_hw_start(struct amdxdna_dev_hdl *ndev)
+{
+ int ret;
+
+ ret = aie4_fw_start(ndev);
+ if (ret)
+ return ret;
+
+ ret = aie4_mailbox_init(ndev);
+ if (ret)
+ goto stop_fw;
+
+ ret = aie4_query(ndev);
+ if (ret)
+ goto mailbox_fini;
+
+ ret = aie4_attach_work_buffer(ndev);
+ if (ret)
+ goto mailbox_fini;
+
+ ret = aie4_partition_init(ndev);
+ if (ret)
+ goto mailbox_fini;
+
+ return 0;
+
+mailbox_fini:
+ aie4_mailbox_fini(ndev);
+stop_fw:
+ aie4_fw_stop(ndev);
+ return ret;
+}
+
+static void aie4_classic_hw_stop(struct amdxdna_dev_hdl *ndev)
+{
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+
+ drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+
+ aie4_partition_fini(ndev);
+ aie4_suspend_fw(ndev);
+ aie4_mailbox_fini(ndev);
+ aie4_fw_stop(ndev);
+}
+
static int aie4_request_firmware(struct amdxdna_dev_hdl *ndev,
const struct firmware **npufw,
const struct firmware **certfw)
@@ -621,6 +666,29 @@ static int aie4_vf_init(struct amdxdna_dev *xdna)
return aie4_vf_hw_start(xdna->dev_handle);
}
+static int aie4_classic_init(struct amdxdna_dev *xdna)
+{
+ int ret;
+
+ ret = aie4m_pcidev_init(xdna);
+ if (ret)
+ return ret;
+
+ ret = aie4_alloc_work_buffer(xdna->dev_handle);
+ if (ret)
+ return ret;
+
+ ret = aie4_classic_hw_start(xdna->dev_handle);
+ if (ret)
+ goto free_work_buf;
+
+ return 0;
+
+free_work_buf:
+ aie4_free_work_buffer(xdna->dev_handle);
+ return ret;
+}
+
static void aie4_pf_fini(struct amdxdna_dev *xdna)
{
aie4_sriov_stop(xdna->dev_handle);
@@ -633,6 +701,12 @@ static void aie4_vf_fini(struct amdxdna_dev *xdna)
aie4_vf_hw_stop(xdna->dev_handle);
}
+static void aie4_classic_fini(struct amdxdna_dev *xdna)
+{
+ aie4_classic_hw_stop(xdna->dev_handle);
+ aie4_free_work_buffer(xdna->dev_handle);
+}
+
const struct amdxdna_dev_ops aie4_pf_ops = {
.init = aie4_pf_init,
.fini = aie4_pf_fini,
@@ -647,3 +721,12 @@ const struct amdxdna_dev_ops aie4_vf_ops = {
.cmd_wait = aie4_cmd_wait,
.get_aie_info = aie4_get_info,
};
+
+const struct amdxdna_dev_ops aie4_classic_ops = {
+ .init = aie4_classic_init,
+ .fini = aie4_classic_fini,
+ .hwctx_init = aie4_hwctx_init,
+ .hwctx_fini = aie4_hwctx_fini,
+ .cmd_wait = aie4_cmd_wait,
+ .get_aie_info = aie4_get_info,
+};
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index bdbb2d7cf0e7..940e67347d74 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -96,5 +96,6 @@ static inline int aie4_sriov_stop(struct amdxdna_dev_hdl *ndev)
extern const struct amdxdna_dev_ops aie4_pf_ops;
extern const struct amdxdna_dev_ops aie4_vf_ops;
+extern const struct amdxdna_dev_ops aie4_classic_ops;
#endif /* _AIE4_PCI_H_ */
diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.c b/drivers/accel/amdxdna/amdxdna_pci_drv.c
index 3140af69e29c..f5f7831c4e80 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.c
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.c
@@ -28,8 +28,14 @@ MODULE_FIRMWARE("amdnpu/17f0_20/npu.sbin");
MODULE_FIRMWARE("amdnpu/1502_00/npu_7.sbin");
MODULE_FIRMWARE("amdnpu/17f0_10/npu_7.sbin");
MODULE_FIRMWARE("amdnpu/17f0_11/npu_7.sbin");
+MODULE_FIRMWARE("amdnpu/17f1_10/npu.sbin");
+MODULE_FIRMWARE("amdnpu/17f1_10/cert.sbin");
MODULE_FIRMWARE("amdnpu/17f2_10/npu.sbin");
MODULE_FIRMWARE("amdnpu/17f2_10/cert.sbin");
+MODULE_FIRMWARE("amdnpu/17f1_13/npu.sbin");
+MODULE_FIRMWARE("amdnpu/17f1_13/cert.sbin");
+MODULE_FIRMWARE("amdnpu/17f2_13/npu.sbin");
+MODULE_FIRMWARE("amdnpu/17f2_13/cert.sbin");
/*
* 0.0: Initial version
@@ -55,10 +61,9 @@ MODULE_FIRMWARE("amdnpu/17f2_10/cert.sbin");
static const struct pci_device_id pci_ids[] = {
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x1502) },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x17f0) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x17f1) },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x17f2) },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x17f3) },
- { PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x1B0B) },
- { PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x1B0C) },
{0}
};
@@ -69,10 +74,12 @@ static const struct amdxdna_device_id amdxdna_ids[] = {
{ 0x17f0, 0x10, &dev_npu4_info },
{ 0x17f0, 0x11, &dev_npu5_info },
{ 0x17f0, 0x20, &dev_npu6_info },
+ { 0x17f1, 0x10, &dev_npu3_classic_info },
{ 0x17f2, 0x10, &dev_npu3_pf_info },
{ 0x17f3, 0x10, &dev_npu3_vf_info },
- { 0x1B0B, 0x10, &dev_npu3_pf_info },
- { 0x1B0C, 0x10, &dev_npu3_vf_info },
+ { 0x17f1, 0x13, &dev_npu3_classic_info },
+ { 0x17f2, 0x13, &dev_npu3_pf_info },
+ { 0x17f3, 0x13, &dev_npu3_vf_info },
{0}
};
@@ -140,8 +147,9 @@ static int amdxdna_drm_open(struct drm_device *ddev, struct drm_file *filp)
mmgrab(client->mm);
xa_init_flags(&client->hwctx_xa, XA_FLAGS_ALLOC);
xa_init_flags(&client->dev_heap_xa, XA_FLAGS_ALLOC);
- drm_mm_init(&client->dev_heap_mm, xdna->dev_info->dev_mem_base,
- xdna->dev_info->dev_heap_max_size);
+ if (xdna->dev_info->dev_heap_max_size)
+ drm_mm_init(&client->dev_heap_mm, xdna->dev_info->dev_mem_base,
+ xdna->dev_info->dev_heap_max_size);
mutex_init(&client->mm_lock);
mutex_lock(&xdna->client_lock);
@@ -176,7 +184,8 @@ static void amdxdna_client_cleanup(struct amdxdna_client *client)
xa_for_each(&client->dev_heap_xa, heap_id, heap)
drm_gem_object_put(to_gobj(heap));
xa_destroy(&client->dev_heap_xa);
- drm_mm_takedown(&client->dev_heap_mm);
+ if (client->xdna->dev_info->dev_heap_max_size)
+ drm_mm_takedown(&client->dev_heap_mm);
mutex_destroy(&client->mm_lock);
mmdrop(client->mm);
diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.h b/drivers/accel/amdxdna/amdxdna_pci_drv.h
index 0002e6ef32ba..953bf783b3f7 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.h
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.h
@@ -169,6 +169,7 @@ struct amdxdna_client {
/* Add device info below */
extern const struct amdxdna_dev_info dev_npu1_info;
+extern const struct amdxdna_dev_info dev_npu3_classic_info;
extern const struct amdxdna_dev_info dev_npu3_pf_info;
extern const struct amdxdna_dev_info dev_npu3_vf_info;
extern const struct amdxdna_dev_info dev_npu4_info;
diff --git a/drivers/accel/amdxdna/npu3_regs.c b/drivers/accel/amdxdna/npu3_regs.c
index 93f749acb5d5..c82433d62901 100644
--- a/drivers/accel/amdxdna/npu3_regs.c
+++ b/drivers/accel/amdxdna/npu3_regs.c
@@ -105,3 +105,17 @@ const struct amdxdna_dev_info dev_npu3_vf_info = {
.cert_feature_tbl = npu3_cert_feature_table,
.ops = &aie4_vf_ops,
};
+
+const struct amdxdna_dev_info dev_npu3_classic_info = {
+ .mbox_bar = NPU3_MBOX_BAR,
+ .sram_bar = NPU3_MBOX_BUFFER_BAR,
+ .psp_bar = NPU3_PSP_BAR_INDEX,
+ .smu_bar = NPU3_SMU_BAR_INDEX,
+ .doorbell_bar = NPU3_DOORBELL_BAR,
+ .default_vbnv = "RyzenAI-npu3",
+ .device_type = AMDXDNA_DEV_TYPE_UMQ,
+ .dev_priv = &npu3_dev_priv,
+ .fw_feature_tbl = npu3_fw_feature_table,
+ .cert_feature_tbl = npu3_cert_feature_table,
+ .ops = &aie4_classic_ops,
+};
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 06/20] accel/amdxdna: Add AIE version query to aie4_get_info
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (4 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 05/20] accel/amdxdna: Add NPU3 classic device support David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 07/20] accel/amdxdna: Add get and set power_mode for AIE4 David Zhang
` (13 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello, Hayden Laccabue
Add AIE version query via DRM_AMDXDNA_GET_INFO. The NPU firmware
version query already existed internally; it is now also exposed
through this ioctl alongside the new AIE version query.
These versions are mandatory once released, the firmware management
interfaces must support those queries in their stable version.
Propagating any failure to abort device initialization is intentional.
Co-developed-by: Hayden Laccabue <hayden.laccabue@amd.com>
Signed-off-by: Hayden Laccabue <hayden.laccabue@amd.com>
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_message.c | 20 ++++++++++++++++++++
drivers/accel/amdxdna/aie4_msg_priv.h | 11 +++++++++++
drivers/accel/amdxdna/aie4_pci.c | 10 ++++++++++
drivers/accel/amdxdna/aie4_pci.h | 2 ++
4 files changed, 43 insertions(+)
diff --git a/drivers/accel/amdxdna/aie4_message.c b/drivers/accel/amdxdna/aie4_message.c
index bdbd1d116b61..4814cbb1f2c5 100644
--- a/drivers/accel/amdxdna/aie4_message.c
+++ b/drivers/accel/amdxdna/aie4_message.c
@@ -75,6 +75,26 @@ int aie4_query_aie_metadata(struct amdxdna_dev_hdl *ndev,
return 0;
}
+int aie4_query_aie_version(struct amdxdna_dev_hdl *ndev,
+ struct amdxdna_drm_query_aie_version *version)
+{
+ DECLARE_AIE_MSG(aie4_msg_aie4_version_info, AIE4_MSG_OP_AIE_VERSION_INFO);
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+ int ret;
+
+ ret = aie_send_mgmt_msg_wait(&ndev->aie, &msg);
+ if (ret)
+ return ret;
+
+ XDNA_DBG(xdna, "Query AIE version - major: %u minor: %u",
+ resp.major, resp.minor);
+
+ version->major = resp.major;
+ version->minor = resp.minor;
+
+ return 0;
+}
+
int aie4_query_npu_firmware_version(struct amdxdna_dev_hdl *ndev,
struct amdxdna_drm_query_firmware_version *fw_version)
{
diff --git a/drivers/accel/amdxdna/aie4_msg_priv.h b/drivers/accel/amdxdna/aie4_msg_priv.h
index b9f7c61f36e3..81842fa1d6ce 100644
--- a/drivers/accel/amdxdna/aie4_msg_priv.h
+++ b/drivers/accel/amdxdna/aie4_msg_priv.h
@@ -22,6 +22,7 @@ enum aie4_msg_opcode {
AIE4_MSG_OP_CREATE_HW_CONTEXT = 0x30003,
AIE4_MSG_OP_DESTROY_HW_CONTEXT = 0x30004,
AIE4_MSG_OP_AIE_TILE_INFO = 0x30006,
+ AIE4_MSG_OP_AIE_VERSION_INFO = 0x30007,
AIE4_MSG_OP_ATTACH_WORK_BUFFER = 0x40001,
};
@@ -160,6 +161,16 @@ struct aie4_msg_aie4_tile_info_resp {
struct aie4_tile_info info;
} __packed;
+struct aie4_msg_aie4_version_info_req {
+ __u32 resvd;
+} __packed;
+
+struct aie4_msg_aie4_version_info_resp {
+ enum aie4_msg_status status;
+ __u16 major;
+ __u16 minor;
+} __packed;
+
struct aie4_msg_query_cert_firmware_version_req {
__u32 resvd;
} __packed;
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index 880619e3a4a8..aea3edd51b4f 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -282,6 +282,10 @@ static int aie4_query(struct amdxdna_dev_hdl *ndev)
if (ret)
return ret;
+ ret = aie4_query_aie_version(ndev, &ndev->aie.version);
+ if (ret)
+ return ret;
+
ret = aie4_query_aie_metadata(ndev, &ndev->aie.metadata);
if (ret)
return ret;
@@ -588,6 +592,12 @@ static int aie4_get_info(struct amdxdna_client *client, struct amdxdna_drm_get_i
case DRM_AMDXDNA_QUERY_AIE_METADATA:
ret = amdxdna_get_metadata(&ndev->aie, client, args);
break;
+ case DRM_AMDXDNA_QUERY_AIE_VERSION:
+ ret = amdxdna_get_aie_version(client, args, &ndev->aie.version);
+ break;
+ case DRM_AMDXDNA_QUERY_FIRMWARE_VERSION:
+ ret = amdxdna_get_firmware_version(client, args, &xdna->fw_ver);
+ break;
default:
XDNA_ERR(xdna, "Not supported request parameter %u", args->param);
ret = -EOPNOTSUPP;
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index 940e67347d74..5ae5e8427a3b 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -69,6 +69,8 @@ enum aie4_fw_feature {
/* aie4_message.c */
int aie4_query_aie_metadata(struct amdxdna_dev_hdl *ndev,
struct amdxdna_drm_query_aie_metadata *metadata);
+int aie4_query_aie_version(struct amdxdna_dev_hdl *ndev,
+ struct amdxdna_drm_query_aie_version *version);
int aie4_suspend_fw(struct amdxdna_dev_hdl *ndev);
int aie4_attach_work_buffer(struct amdxdna_dev_hdl *ndev);
int aie4_query_npu_firmware_version(struct amdxdna_dev_hdl *ndev,
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 07/20] accel/amdxdna: Add get and set power_mode for AIE4
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (5 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 06/20] accel/amdxdna: Add AIE version query to aie4_get_info David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 08/20] accel/amdxdna: Add clock, DPM frequency, and resource info queries " David Zhang
` (12 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello, Soham Donwalkar,
Nishad Saraf
Add power mode support for AIE4 devices via DRM_AMDXDNA_GET_INFO and
DRM_AMDXDNA_SET_STATE:
- Add AIE4_MSG_OP_POWER_OVERRIDE mailbox support
- Add DRM_AMDXDNA_GET_POWER_MODE support
- Implement aie4_set_power_mode() and wire .set_aie_state
Firmware boots in POWER_MODE_DEFAULT after a reload, so re-send the
cached user power mode override whenever the hardware starts via
aie4_restore_power_mode(). On a fresh probe, pw_mode is
POWER_MODE_DEFAULT.
Co-developed-by: Soham Donwalkar <soham.donwalkar@amd.com>
Signed-off-by: Soham Donwalkar <soham.donwalkar@amd.com>
Co-developed-by: Nishad Saraf <nishad.saraf@amd.com>
Signed-off-by: Nishad Saraf <nishad.saraf@amd.com>
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_message.c | 17 ++++
drivers/accel/amdxdna/aie4_msg_priv.h | 9 ++
drivers/accel/amdxdna/aie4_pci.c | 116 ++++++++++++++++++++++++++
drivers/accel/amdxdna/aie4_pci.h | 6 ++
4 files changed, 148 insertions(+)
diff --git a/drivers/accel/amdxdna/aie4_message.c b/drivers/accel/amdxdna/aie4_message.c
index 4814cbb1f2c5..25a510bd7419 100644
--- a/drivers/accel/amdxdna/aie4_message.c
+++ b/drivers/accel/amdxdna/aie4_message.c
@@ -157,3 +157,20 @@ int aie4_attach_work_buffer(struct amdxdna_dev_hdl *ndev)
return ret;
}
+
+int aie4_msg_set_power_mode(struct amdxdna_dev_hdl *ndev, u8 power_mode)
+{
+ DECLARE_AIE_MSG(aie4_msg_power_override, AIE4_MSG_OP_POWER_OVERRIDE);
+ int ret;
+
+ req.power_mode = power_mode;
+
+ ret = aie_send_mgmt_msg_wait(&ndev->aie, &msg);
+ if (ret)
+ XDNA_WARN(ndev->aie.xdna,
+ "Failed to set power mode %u, ret %d", (u32)power_mode, ret);
+ else
+ XDNA_DBG(ndev->aie.xdna, "Power mode set to %u", (u32)power_mode);
+
+ return ret;
+}
diff --git a/drivers/accel/amdxdna/aie4_msg_priv.h b/drivers/accel/amdxdna/aie4_msg_priv.h
index 81842fa1d6ce..4c06792df1bd 100644
--- a/drivers/accel/amdxdna/aie4_msg_priv.h
+++ b/drivers/accel/amdxdna/aie4_msg_priv.h
@@ -23,6 +23,7 @@ enum aie4_msg_opcode {
AIE4_MSG_OP_DESTROY_HW_CONTEXT = 0x30004,
AIE4_MSG_OP_AIE_TILE_INFO = 0x30006,
AIE4_MSG_OP_AIE_VERSION_INFO = 0x30007,
+ AIE4_MSG_OP_POWER_OVERRIDE = 0x3000B,
AIE4_MSG_OP_ATTACH_WORK_BUFFER = 0x40001,
};
@@ -187,6 +188,14 @@ struct aie4_msg_query_cert_firmware_version_resp {
__u16 host_queue_minor;
} __packed;
+struct aie4_msg_power_override_req {
+ __u32 power_mode;
+} __packed;
+
+struct aie4_msg_power_override_resp {
+ enum aie4_msg_status status;
+} __packed;
+
#define AIE4_WORK_BUFFER_MIN_SIZE SZ_4M
struct aie4_msg_attach_work_buffer_req {
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index aea3edd51b4f..c7acbc6287ff 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -4,6 +4,7 @@
*/
#include <drm/amdxdna_accel.h>
+#include <drm/drm_drv.h>
#include <drm/drm_managed.h>
#include <drm/drm_print.h>
#include <linux/firmware.h>
@@ -15,6 +16,7 @@
#include "amdxdna_mailbox.h"
#include "amdxdna_mailbox_helper.h"
#include "amdxdna_pci_drv.h"
+#include "amdxdna_pm.h"
#define NO_IOHUB 0
#define PSP_NOTIFY_INTR 0xD007BE11
@@ -293,6 +295,15 @@ static int aie4_query(struct amdxdna_dev_hdl *ndev)
return 0;
}
+/* Restore cached power mode override across hardware start. */
+int aie4_restore_power_mode(struct amdxdna_dev_hdl *ndev)
+{
+ if (ndev->pw_mode == POWER_MODE_DEFAULT)
+ return 0;
+
+ return aie4_msg_set_power_mode(ndev, ndev->pw_mode);
+}
+
static int aie4_pf_hw_start(struct amdxdna_dev_hdl *ndev)
{
int ret;
@@ -309,6 +320,10 @@ static int aie4_pf_hw_start(struct amdxdna_dev_hdl *ndev)
if (ret)
goto mbox_fini;
+ ret = aie4_restore_power_mode(ndev);
+ if (ret)
+ goto mbox_fini;
+
return 0;
mbox_fini:
@@ -346,8 +361,14 @@ static int aie4_vf_hw_start(struct amdxdna_dev_hdl *ndev)
if (ret)
goto mailbox_fini;
+ ret = aie4_restore_power_mode(ndev);
+ if (ret)
+ goto partition_fini;
+
return 0;
+partition_fini:
+ aie4_partition_fini(ndev);
mailbox_fini:
aie4_mailbox_fini(ndev);
return ret;
@@ -387,8 +408,14 @@ static int aie4_classic_hw_start(struct amdxdna_dev_hdl *ndev)
if (ret)
goto mailbox_fini;
+ ret = aie4_restore_power_mode(ndev);
+ if (ret)
+ goto partition_fini;
+
return 0;
+partition_fini:
+ aie4_partition_fini(ndev);
mailbox_fini:
aie4_mailbox_fini(ndev);
stop_fw:
@@ -528,6 +555,7 @@ static int aie4m_pcidev_init(struct amdxdna_dev *xdna)
ndev->priv = xdna->dev_info->dev_priv;
ndev->aie.xdna = xdna;
+ ndev->pw_mode = POWER_MODE_DEFAULT;
xdna->dev_handle = ndev;
xa_init_flags(&ndev->cert_comp_xa, XA_FLAGS_ALLOC);
@@ -582,6 +610,24 @@ static int aie4m_pcidev_init(struct amdxdna_dev *xdna)
return 0;
}
+static int aie4_get_power_mode(struct amdxdna_client *client,
+ struct amdxdna_drm_get_info *args)
+{
+ struct amdxdna_drm_get_power_mode mode = {};
+ struct amdxdna_dev *xdna = client->xdna;
+ struct amdxdna_dev_hdl *ndev;
+ u32 buf_sz;
+
+ ndev = xdna->dev_handle;
+ mode.power_mode = ndev->pw_mode;
+
+ buf_sz = min_t(u32, args->buffer_size, sizeof(mode));
+ if (copy_to_user(u64_to_user_ptr(args->buffer), &mode, buf_sz))
+ return -EFAULT;
+
+ return 0;
+}
+
static int aie4_get_info(struct amdxdna_client *client, struct amdxdna_drm_get_info *args)
{
struct amdxdna_dev *xdna = client->xdna;
@@ -598,6 +644,9 @@ static int aie4_get_info(struct amdxdna_client *client, struct amdxdna_drm_get_i
case DRM_AMDXDNA_QUERY_FIRMWARE_VERSION:
ret = amdxdna_get_firmware_version(client, args, &xdna->fw_ver);
break;
+ case DRM_AMDXDNA_GET_POWER_MODE:
+ ret = aie4_get_power_mode(client, args);
+ break;
default:
XDNA_ERR(xdna, "Not supported request parameter %u", args->param);
ret = -EOPNOTSUPP;
@@ -608,6 +657,71 @@ static int aie4_get_info(struct amdxdna_client *client, struct amdxdna_drm_get_i
return ret;
}
+static int aie4_set_power_mode(struct amdxdna_client *client,
+ struct amdxdna_drm_set_state *args)
+{
+ struct amdxdna_drm_set_power_mode power_state = { 0 };
+ struct amdxdna_dev *xdna = client->xdna;
+ struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
+ u8 power_mode;
+ int ret;
+
+ if (args->buffer_size < sizeof(power_state))
+ return -EINVAL;
+
+ if (copy_from_user(&power_state, u64_to_user_ptr(args->buffer),
+ sizeof(power_state))) {
+ XDNA_ERR(xdna, "Failed to copy power mode request into kernel");
+ return -EFAULT;
+ }
+
+ if (XDNA_MBZ_DBG(xdna, power_state.pad, sizeof(power_state.pad)))
+ return -EINVAL;
+
+ power_mode = power_state.power_mode;
+ if (power_mode > POWER_MODE_TURBO) {
+ XDNA_ERR(xdna, "Invalid power mode %d", power_mode);
+ return -EINVAL;
+ }
+
+ ret = aie4_msg_set_power_mode(xdna->dev_handle, power_mode);
+ if (ret)
+ return ret;
+
+ ndev->pw_mode = power_mode;
+ return 0;
+}
+
+static int aie4_set_state(struct amdxdna_client *client,
+ struct amdxdna_drm_set_state *args)
+{
+ struct amdxdna_dev *xdna = client->xdna;
+ int ret, idx;
+
+ if (!drm_dev_enter(&xdna->ddev, &idx))
+ return -ENODEV;
+
+ ret = amdxdna_pm_resume_get_locked(xdna);
+ if (ret)
+ goto dev_exit;
+
+ switch (args->param) {
+ case DRM_AMDXDNA_SET_POWER_MODE:
+ ret = aie4_set_power_mode(client, args);
+ break;
+ default:
+ XDNA_ERR(xdna, "Not supported request parameter %u", args->param);
+ ret = -EOPNOTSUPP;
+ break;
+ }
+
+ amdxdna_pm_suspend_put(xdna);
+
+dev_exit:
+ drm_dev_exit(idx);
+ return ret;
+}
+
static int aie4_alloc_work_buffer(struct amdxdna_dev_hdl *ndev)
{
struct amdxdna_dev *xdna = ndev->aie.xdna;
@@ -730,6 +844,7 @@ const struct amdxdna_dev_ops aie4_vf_ops = {
.hwctx_fini = aie4_hwctx_fini,
.cmd_wait = aie4_cmd_wait,
.get_aie_info = aie4_get_info,
+ .set_aie_state = aie4_set_state,
};
const struct amdxdna_dev_ops aie4_classic_ops = {
@@ -739,4 +854,5 @@ const struct amdxdna_dev_ops aie4_classic_ops = {
.hwctx_fini = aie4_hwctx_fini,
.cmd_wait = aie4_cmd_wait,
.get_aie_info = aie4_get_info,
+ .set_aie_state = aie4_set_state,
};
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index 5ae5e8427a3b..fd2c50dc8080 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -58,6 +58,8 @@ struct amdxdna_dev_hdl {
dma_addr_t work_buf_addr;
u32 work_buf_size;
+ u8 pw_mode;
+
struct amdxdna_drm_query_firmware_version cert_version;
};
@@ -77,6 +79,7 @@ int aie4_query_npu_firmware_version(struct amdxdna_dev_hdl *ndev,
struct amdxdna_drm_query_firmware_version *fw_version);
int aie4_query_cert_firmware_version(struct amdxdna_dev_hdl *ndev,
struct amdxdna_drm_query_firmware_version *cert_version);
+int aie4_msg_set_power_mode(struct amdxdna_dev_hdl *ndev, u8 power_mode);
u32 aie4_msg_pasid(struct amdxdna_client *client);
/* aie4_ctx.c */
@@ -84,6 +87,9 @@ int aie4_hwctx_init(struct amdxdna_hwctx *hwctx);
void aie4_hwctx_fini(struct amdxdna_hwctx *hwctx);
int aie4_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq, u32 timeout);
+/* aie4_pci.c */
+int aie4_restore_power_mode(struct amdxdna_dev_hdl *ndev);
+
/* aie4_sriov.c */
#if IS_ENABLED(CONFIG_PCI_IOV)
int aie4_sriov_configure(struct amdxdna_dev *xdna, int num_vfs);
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 08/20] accel/amdxdna: Add clock, DPM frequency, and resource info queries for AIE4
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (6 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 07/20] accel/amdxdna: Add get and set power_mode for AIE4 David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 09/20] accel/amdxdna: Add context switch hysteresis with debugfs control David Zhang
` (11 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello, Soham Donwalkar
Add support for querying clock metadata, DPM frequency table, and
hardware resource information for AIE4/NPU3 devices:
- Move struct dpm_clk_freq and common clock/TOPS counters into struct
aie_device.
- Add NPU3 DPM clock table, DPM control, and counter updates by querying
active DPM levels via AIE4_MSG_OP_GET_CURRENT_DPM_LEVEL.
- Query AIE4 DPM frequency table from firmware via
AIE4_MSG_OP_GET_DPM_FREQ_TABLE.
Co-developed-by: Soham Donwalkar <soham.donwalkar@amd.com>
Signed-off-by: Soham Donwalkar <soham.donwalkar@amd.com>
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie.h | 36 +++++++++++
drivers/accel/amdxdna/aie2_pci.c | 14 ++---
drivers/accel/amdxdna/aie2_pci.h | 35 +----------
drivers/accel/amdxdna/aie2_pm.c | 10 +--
drivers/accel/amdxdna/aie4_message.c | 88 +++++++++++++++++++++++++++
drivers/accel/amdxdna/aie4_msg_priv.h | 31 ++++++++++
drivers/accel/amdxdna/aie4_pci.c | 82 ++++++++++++++++++++++++-
drivers/accel/amdxdna/aie4_pci.h | 12 ++++
drivers/accel/amdxdna/npu1_regs.c | 19 +++---
drivers/accel/amdxdna/npu3_regs.c | 78 ++++++++++++++++++++++++
drivers/accel/amdxdna/npu4_regs.c | 30 ++++-----
11 files changed, 367 insertions(+), 68 deletions(-)
diff --git a/drivers/accel/amdxdna/aie.h b/drivers/accel/amdxdna/aie.h
index 899399756661..6268b708d17b 100644
--- a/drivers/accel/amdxdna/aie.h
+++ b/drivers/accel/amdxdna/aie.h
@@ -30,8 +30,44 @@ struct aie_device {
struct amdxdna_drm_query_aie_version version;
struct amdxdna_drm_query_aie_metadata metadata;
+
+ u32 clk_gating;
+ u32 npuclk_freq;
+ u32 hclk_freq;
+ u32 max_tops;
+ u32 curr_tops;
+};
+
+struct aie_hw_ops {
+ int (*set_dpm)(struct aie_device *aie, u32 dpm_level);
+ int (*update_counters)(struct aie_device *aie);
};
+#define aie_update_counters(ndev) \
+({ \
+ typeof(ndev) _ndev = ndev; \
+ if ((_ndev)->priv->hw_ops && (_ndev)->priv->hw_ops->update_counters) \
+ (_ndev)->priv->hw_ops->update_counters(&(_ndev)->aie); \
+})
+
+struct dpm_clk_freq {
+ u32 npuclk;
+ u32 hclk;
+};
+
+#include <linux/amd-pmf-io.h>
+
+#if IS_ENABLED(CONFIG_AMD_PMF)
+#define AIE_GET_PMF_NPU_METRICS(metrics) amd_pmf_get_npu_data(metrics)
+#else
+#define AIE_GET_PMF_NPU_METRICS(metrics) \
+({ \
+ typeof(metrics) _m = metrics; \
+ memset(_m, 0xff, sizeof(*_m)); \
+ (-EOPNOTSUPP); \
+})
+#endif
+
#define DECLARE_AIE_MSG(name, op) \
DECLARE_XDNA_MSG_COMMON(name, op, -1)
#define AIE_FEATURE_ON(aie, feature) test_bit(feature, &(aie)->feature_mask)
diff --git a/drivers/accel/amdxdna/aie2_pci.c b/drivers/accel/amdxdna/aie2_pci.c
index 5dc6e5b97afc..b70af1923643 100644
--- a/drivers/accel/amdxdna/aie2_pci.c
+++ b/drivers/accel/amdxdna/aie2_pci.c
@@ -294,7 +294,7 @@ static struct xrs_action_ops aie2_xrs_actions = {
static void aie2_smu_fini(struct amdxdna_dev_hdl *ndev)
{
- ndev->priv->hw_ops->set_dpm(ndev, 0);
+ ndev->priv->hw_ops->set_dpm(&ndev->aie, 0);
aie_smu_fini(ndev->aie.smu_hdl);
}
@@ -706,12 +706,12 @@ static int aie2_get_clock_metadata(struct amdxdna_client *client,
if (!clock)
return -ENOMEM;
- aie2_update_counters(ndev);
+ aie_update_counters(ndev);
snprintf(clock->mp_npu_clock.name, sizeof(clock->mp_npu_clock.name),
"MP-NPU Clock");
- clock->mp_npu_clock.freq_mhz = ndev->npuclk_freq;
+ clock->mp_npu_clock.freq_mhz = ndev->aie.npuclk_freq;
snprintf(clock->h_clock.name, sizeof(clock->h_clock.name), "H Clock");
- clock->h_clock.freq_mhz = ndev->hclk_freq;
+ clock->h_clock.freq_mhz = ndev->aie.hclk_freq;
buf_sz = min(args->buffer_size, sizeof(*clock));
if (copy_to_user(u64_to_user_ptr(args->buffer), clock, buf_sz))
@@ -867,11 +867,11 @@ static int aie2_query_resource_info(struct amdxdna_client *client,
ndev = xdna->dev_handle;
priv = ndev->priv;
- aie2_update_counters(ndev);
+ aie_update_counters(ndev);
res_info.npu_clk_max = priv->dpm_clk_tbl[ndev->max_dpm_level].hclk;
- res_info.npu_tops_max = ndev->max_tops;
+ res_info.npu_tops_max = ndev->aie.max_tops;
res_info.npu_task_max = priv->hwctx_limit;
- res_info.npu_tops_curr = ndev->curr_tops;
+ res_info.npu_tops_curr = ndev->aie.curr_tops;
res_info.npu_task_curr = ndev->hwctx_num;
buf_sz = min(args->buffer_size, sizeof(res_info));
diff --git a/drivers/accel/amdxdna/aie2_pci.h b/drivers/accel/amdxdna/aie2_pci.h
index 67971f0c4acf..0c8dd6510292 100644
--- a/drivers/accel/amdxdna/aie2_pci.h
+++ b/drivers/accel/amdxdna/aie2_pci.h
@@ -40,8 +40,8 @@
pci_resource_len(NDEV2PDEV(_ndev), (_ndev)->aie.xdna->dev_info->mbox_bar); \
})
+#define AIE2_GET_PMF_NPU_METRICS(metrics) AIE_GET_PMF_NPU_METRICS(metrics)
#if IS_ENABLED(CONFIG_AMD_PMF)
-#define AIE2_GET_PMF_NPU_METRICS(metrics) amd_pmf_get_npu_data(metrics)
#define AIE2_GET_PMF_NPU_DATA(field, val) \
({ \
struct amd_pmf_npu_metrics _npu_metrics; \
@@ -52,13 +52,6 @@
(_ret); \
})
#else
-#define AIE2_GET_PMF_NPU_METRICS(metrics) \
-({ \
- typeof(metrics) _m = metrics; \
- memset(_m, 0xff, sizeof(*_m)); \
- (-EOPNOTSUPP); \
-})
-
#define SENSOR_DEFAULT_npu_power U32_MAX
#define AIE2_GET_PMF_NPU_DATA(field, val) \
({ \
@@ -91,11 +84,6 @@ struct rt_config {
unsigned long feature_mask;
};
-struct dpm_clk_freq {
- u32 npuclk;
- u32 hclk;
-};
-
/*
* Define the maximum number of pending commands in a hardware context.
* Must be power of 2!
@@ -158,11 +146,6 @@ struct amdxdna_dev_hdl {
u32 dpm_level;
u32 dft_dpm_level;
u32 max_dpm_level;
- u32 clk_gating;
- u32 npuclk_freq;
- u32 hclk_freq;
- u32 max_tops;
- u32 curr_tops;
u32 force_preempt_enabled;
u32 frame_boundary_preempt;
@@ -177,18 +160,6 @@ struct amdxdna_dev_hdl {
unsigned long last_signal_ts;
};
-struct aie2_hw_ops {
- int (*set_dpm)(struct amdxdna_dev_hdl *ndev, u32 dpm_level);
- int (*update_counters)(struct amdxdna_dev_hdl *ndev);
-};
-
-#define aie2_update_counters(ndev) \
-({ \
- typeof(ndev) _ndev = ndev; \
- if (_ndev->priv->hw_ops->update_counters) \
- _ndev->priv->hw_ops->update_counters(_ndev); \
-})
-
enum aie2_fw_feature {
AIE2_NPU_COMMAND,
AIE2_PREEMPT,
@@ -219,7 +190,7 @@ struct amdxdna_dev_priv {
struct aie_bar_off_pair sram_offs[SRAM_MAX_INDEX];
struct aie_bar_off_pair psp_regs_off[PSP_MAX_REGS];
struct aie_bar_off_pair smu_regs_off[SMU_MAX_REGS];
- const struct aie2_hw_ops *hw_ops;
+ const struct aie_hw_ops *hw_ops;
};
extern const struct amdxdna_dev_ops aie2_ops;
@@ -234,7 +205,7 @@ extern const struct rt_config npu1_default_rt_cfg[];
extern const struct rt_config npu4_default_rt_cfg[];
extern const struct amdxdna_fw_feature_tbl npu4_fw_feature_table[];
extern const struct amdxdna_rev_vbnv npu4_rev_vbnv_tbl[];
-extern const struct aie2_hw_ops npu4_hw_ops;
+extern const struct aie_hw_ops npu4_hw_ops;
/* aie2_pm.c */
int aie2_pm_init(struct amdxdna_dev_hdl *ndev);
diff --git a/drivers/accel/amdxdna/aie2_pm.c b/drivers/accel/amdxdna/aie2_pm.c
index 4fe6030d2c41..f4ced7b67c25 100644
--- a/drivers/accel/amdxdna/aie2_pm.c
+++ b/drivers/accel/amdxdna/aie2_pm.c
@@ -23,7 +23,7 @@ static int aie2_pm_set_clk_gating(struct amdxdna_dev_hdl *ndev, u32 val)
if (ret)
return ret;
- ndev->clk_gating = val;
+ ndev->aie.clk_gating = val;
return 0;
}
@@ -35,7 +35,7 @@ int aie2_pm_set_dpm(struct amdxdna_dev_hdl *ndev, u32 dpm_level)
if (ret)
return ret;
- ret = ndev->priv->hw_ops->set_dpm(ndev, dpm_level);
+ ret = ndev->priv->hw_ops->set_dpm(&ndev->aie, dpm_level);
if (!ret)
ndev->dpm_level = dpm_level;
amdxdna_pm_suspend_put(ndev->aie.xdna);
@@ -49,11 +49,11 @@ int aie2_pm_init(struct amdxdna_dev_hdl *ndev)
if (ndev->dev_status != AIE2_DEV_UNINIT) {
/* Resume device */
- ret = ndev->priv->hw_ops->set_dpm(ndev, ndev->dpm_level);
+ ret = ndev->priv->hw_ops->set_dpm(&ndev->aie, ndev->dpm_level);
if (ret)
return ret;
- ret = aie2_pm_set_clk_gating(ndev, ndev->clk_gating);
+ ret = aie2_pm_set_clk_gating(ndev, ndev->aie.clk_gating);
if (ret)
return ret;
@@ -64,7 +64,7 @@ int aie2_pm_init(struct amdxdna_dev_hdl *ndev)
ndev->max_dpm_level++;
ndev->max_dpm_level--;
- ret = ndev->priv->hw_ops->set_dpm(ndev, ndev->max_dpm_level);
+ ret = ndev->priv->hw_ops->set_dpm(&ndev->aie, ndev->max_dpm_level);
if (ret)
return ret;
ndev->dpm_level = ndev->max_dpm_level;
diff --git a/drivers/accel/amdxdna/aie4_message.c b/drivers/accel/amdxdna/aie4_message.c
index 25a510bd7419..7112b0bc3725 100644
--- a/drivers/accel/amdxdna/aie4_message.c
+++ b/drivers/accel/amdxdna/aie4_message.c
@@ -140,6 +140,94 @@ int aie4_query_cert_firmware_version(struct amdxdna_dev_hdl *ndev,
return 0;
}
+int aie4_init_dpm_freq_table(struct amdxdna_dev_hdl *ndev)
+{
+ DECLARE_AIE_MSG(aie4_msg_get_dpm_freq_table, AIE4_MSG_OP_GET_DPM_FREQ_TABLE);
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+ u32 aie_levels, npu_levels, i;
+ int ret;
+
+ for (i = 0; i < AIE4_MAX_DPM_LEVEL_COUNT && ndev->priv->dpm_clk_tbl &&
+ ndev->priv->dpm_clk_tbl[i].hclk; i++)
+ ndev->dpm_clk_tbl[i] = ndev->priv->dpm_clk_tbl[i];
+ ndev->max_aieclk_level = i ? i - 1 : 0;
+ ndev->max_npuhclk_level = i ? i - 1 : 0;
+
+ ret = aie_send_mgmt_msg_wait(&ndev->aie, &msg);
+ if (ret) {
+ XDNA_WARN(xdna, "Get DPM freq table failed, ret %d status 0x%x",
+ ret, resp.status);
+ return ret;
+ }
+
+ aie_levels = resp.aieclk_table.num_levels;
+ npu_levels = resp.npuhclk_table.num_levels;
+
+ if (!aie_levels || !npu_levels ||
+ aie_levels > AIE4_MAX_DPM_LEVEL_COUNT ||
+ npu_levels > AIE4_MAX_DPM_LEVEL_COUNT) {
+ XDNA_ERR(xdna, "invalid dpm levels, aieclk: %u, npuhclk: %u",
+ aie_levels, npu_levels);
+ return -EINVAL;
+ }
+
+ for (i = 0; i < aie_levels; i++) {
+ if (!resp.aieclk_table.values[i]) {
+ XDNA_ERR(xdna, "invalid dpm aieclk frequency 0 at level %u", i);
+ return -EINVAL;
+ }
+ }
+
+ for (i = 0; i < npu_levels; i++) {
+ if (!resp.npuhclk_table.values[i]) {
+ XDNA_ERR(xdna, "invalid dpm npuhclk frequency 0 at level %u", i);
+ return -EINVAL;
+ }
+ }
+
+ memset(ndev->dpm_clk_tbl, 0, sizeof(ndev->dpm_clk_tbl));
+ for (i = 0; i < aie_levels; i++)
+ ndev->dpm_clk_tbl[i].npuclk = resp.aieclk_table.values[i];
+
+ for (i = 0; i < npu_levels; i++)
+ ndev->dpm_clk_tbl[i].hclk = resp.npuhclk_table.values[i];
+
+ ndev->max_aieclk_level = aie_levels - 1;
+ ndev->max_npuhclk_level = npu_levels - 1;
+
+ return 0;
+}
+
+int aie4_query_dpm_level(struct amdxdna_dev_hdl *ndev,
+ u32 *aieclk_dpm_level, u32 *npuhclk_dpm_level)
+{
+ DECLARE_AIE_MSG(aie4_msg_get_dpm_level, AIE4_MSG_OP_GET_CURRENT_DPM_LEVEL);
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+ int ret;
+
+ ret = aie_send_mgmt_msg_wait(&ndev->aie, &msg);
+ if (ret)
+ return ret;
+
+ /*
+ * Validate against ndev->max_aieclk_level and ndev->max_npuhclk_level
+ * to ensure reported levels index into populated entries in dpm_clk_tbl.
+ */
+ if (resp.aieclk_dpm_level > ndev->max_aieclk_level ||
+ resp.npuhclk_dpm_level > ndev->max_npuhclk_level) {
+ XDNA_ERR(xdna,
+ "invalid dpm level, aie: %u/%u, npu: %u/%u",
+ resp.aieclk_dpm_level, ndev->max_aieclk_level,
+ resp.npuhclk_dpm_level, ndev->max_npuhclk_level);
+ return -EINVAL;
+ }
+
+ *aieclk_dpm_level = resp.aieclk_dpm_level;
+ *npuhclk_dpm_level = resp.npuhclk_dpm_level;
+
+ return 0;
+}
+
int aie4_attach_work_buffer(struct amdxdna_dev_hdl *ndev)
{
DECLARE_AIE_MSG(aie4_msg_attach_work_buffer, AIE4_MSG_OP_ATTACH_WORK_BUFFER);
diff --git a/drivers/accel/amdxdna/aie4_msg_priv.h b/drivers/accel/amdxdna/aie4_msg_priv.h
index 4c06792df1bd..fe78df9e23c8 100644
--- a/drivers/accel/amdxdna/aie4_msg_priv.h
+++ b/drivers/accel/amdxdna/aie4_msg_priv.h
@@ -24,6 +24,8 @@ enum aie4_msg_opcode {
AIE4_MSG_OP_AIE_TILE_INFO = 0x30006,
AIE4_MSG_OP_AIE_VERSION_INFO = 0x30007,
AIE4_MSG_OP_POWER_OVERRIDE = 0x3000B,
+ AIE4_MSG_OP_GET_DPM_FREQ_TABLE = 0x30012,
+ AIE4_MSG_OP_GET_CURRENT_DPM_LEVEL = 0x30013,
AIE4_MSG_OP_ATTACH_WORK_BUFFER = 0x40001,
};
@@ -196,6 +198,35 @@ struct aie4_msg_power_override_resp {
enum aie4_msg_status status;
} __packed;
+#define AIE4_MAX_DPM_LEVEL_COUNT 10
+
+struct aie4_dpm_table {
+ __u32 num_levels;
+ __u32 values[AIE4_MAX_DPM_LEVEL_COUNT];
+} __packed;
+
+/* AIE4_MSG_OP_GET_DPM_FREQ_TABLE */
+struct aie4_msg_get_dpm_freq_table_req {
+ __u32 rsvd;
+} __packed;
+
+struct aie4_msg_get_dpm_freq_table_resp {
+ enum aie4_msg_status status;
+ struct aie4_dpm_table aieclk_table;
+ struct aie4_dpm_table npuhclk_table;
+} __packed;
+
+/* AIE4_MSG_OP_GET_CURRENT_DPM_LEVEL */
+struct aie4_msg_get_dpm_level_req {
+ __u32 rsvd;
+} __packed;
+
+struct aie4_msg_get_dpm_level_resp {
+ enum aie4_msg_status status;
+ __u32 aieclk_dpm_level;
+ __u32 npuhclk_dpm_level;
+} __packed;
+
#define AIE4_WORK_BUFFER_MIN_SIZE SZ_4M
struct aie4_msg_attach_work_buffer_req {
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index c7acbc6287ff..3e02dabaf5fe 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -292,6 +292,17 @@ static int aie4_query(struct amdxdna_dev_hdl *ndev)
if (ret)
return ret;
+ ndev->total_col = min_t(u32, AIE4_TOTAL_COLUMN, ndev->aie.metadata.cols);
+
+ ret = aie4_init_dpm_freq_table(ndev);
+ if (ret) {
+ if (ret == -ETIME)
+ return ret;
+ /* if query dpm from fw failed, using default value */
+ if (ndev->priv->hw_ops && ndev->priv->hw_ops->set_dpm)
+ (void)ndev->priv->hw_ops->set_dpm(&ndev->aie, 0);
+ }
+
return 0;
}
@@ -628,11 +639,71 @@ static int aie4_get_power_mode(struct amdxdna_client *client,
return 0;
}
+static int aie4_query_clock_metadata(struct amdxdna_client *client,
+ struct amdxdna_drm_get_info *args)
+{
+ struct amdxdna_drm_query_clock_metadata *clock;
+ struct amdxdna_dev *xdna = client->xdna;
+ struct amdxdna_dev_hdl *ndev;
+ int ret = 0;
+ u32 buf_sz;
+
+ ndev = xdna->dev_handle;
+ clock = kzalloc_obj(*clock);
+ if (!clock)
+ return -ENOMEM;
+
+ aie_update_counters(ndev);
+ snprintf(clock->mp_npu_clock.name, sizeof(clock->mp_npu_clock.name),
+ "MP-NPU Clock");
+ clock->mp_npu_clock.freq_mhz = ndev->aie.npuclk_freq;
+ snprintf(clock->h_clock.name, sizeof(clock->h_clock.name), "H Clock");
+ clock->h_clock.freq_mhz = ndev->aie.hclk_freq;
+
+ buf_sz = min_t(u32, args->buffer_size, sizeof(*clock));
+ if (copy_to_user(u64_to_user_ptr(args->buffer), clock, buf_sz))
+ ret = -EFAULT;
+
+ kfree(clock);
+ return ret;
+}
+
+static int aie4_query_resource_info(struct amdxdna_client *client,
+ struct amdxdna_drm_get_info *args)
+{
+ struct amdxdna_drm_get_resource_info res_info = {};
+ struct amdxdna_dev_hdl *ndev;
+ struct amdxdna_dev *xdna;
+ u32 buf_sz;
+
+ xdna = client->xdna;
+ ndev = xdna->dev_handle;
+
+ aie_update_counters(ndev);
+ res_info.npu_clk_max = ndev->dpm_clk_tbl[ndev->max_npuhclk_level].hclk;
+ res_info.npu_tops_max = ndev->aie.max_tops;
+ res_info.npu_tops_curr = ndev->aie.curr_tops;
+ /* Context accounting is populated in later patches in the series. */
+
+ buf_sz = min_t(u32, args->buffer_size, sizeof(res_info));
+ if (copy_to_user(u64_to_user_ptr(args->buffer), &res_info, buf_sz))
+ return -EFAULT;
+
+ return 0;
+}
+
static int aie4_get_info(struct amdxdna_client *client, struct amdxdna_drm_get_info *args)
{
struct amdxdna_dev *xdna = client->xdna;
struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
- int ret;
+ int ret, idx;
+
+ if (!drm_dev_enter(&xdna->ddev, &idx))
+ return -ENODEV;
+
+ ret = amdxdna_pm_resume_get_locked(xdna);
+ if (ret)
+ goto dev_exit;
switch (args->param) {
case DRM_AMDXDNA_QUERY_AIE_METADATA:
@@ -641,19 +712,28 @@ static int aie4_get_info(struct amdxdna_client *client, struct amdxdna_drm_get_i
case DRM_AMDXDNA_QUERY_AIE_VERSION:
ret = amdxdna_get_aie_version(client, args, &ndev->aie.version);
break;
+ case DRM_AMDXDNA_QUERY_CLOCK_METADATA:
+ ret = aie4_query_clock_metadata(client, args);
+ break;
case DRM_AMDXDNA_QUERY_FIRMWARE_VERSION:
ret = amdxdna_get_firmware_version(client, args, &xdna->fw_ver);
break;
case DRM_AMDXDNA_GET_POWER_MODE:
ret = aie4_get_power_mode(client, args);
break;
+ case DRM_AMDXDNA_QUERY_RESOURCE_INFO:
+ ret = aie4_query_resource_info(client, args);
+ break;
default:
XDNA_ERR(xdna, "Not supported request parameter %u", args->param);
ret = -EOPNOTSUPP;
}
+ amdxdna_pm_suspend_put(xdna);
XDNA_DBG(xdna, "Got param %d", args->param);
+dev_exit:
+ drm_dev_exit(idx);
return ret;
}
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index fd2c50dc8080..6e9e7f874a44 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -11,6 +11,7 @@
#include <linux/pci.h>
#include "aie.h"
+#include "aie4_msg_priv.h"
#include "amdxdna_mailbox.h"
struct cert_comp {
@@ -40,6 +41,9 @@ struct amdxdna_dev_priv {
struct aie_bar_off_pair psp_regs_off[PSP_MAX_REGS];
struct aie_bar_off_pair smu_regs_off[SMU_MAX_REGS];
+
+ const struct dpm_clk_freq *dpm_clk_tbl;
+ const struct aie_hw_ops *hw_ops;
};
struct amdxdna_dev_hdl {
@@ -50,6 +54,11 @@ struct amdxdna_dev_hdl {
struct mailbox *mbox;
u32 partition_id;
+ u32 total_col;
+ u32 max_aieclk_level;
+ u32 max_npuhclk_level;
+
+ struct dpm_clk_freq dpm_clk_tbl[AIE4_MAX_DPM_LEVEL_COUNT];
struct xarray cert_comp_xa; /* device level indexed by msix id */
struct mutex cert_comp_lock; /* protects cert_comp operations*/
@@ -79,6 +88,9 @@ int aie4_query_npu_firmware_version(struct amdxdna_dev_hdl *ndev,
struct amdxdna_drm_query_firmware_version *fw_version);
int aie4_query_cert_firmware_version(struct amdxdna_dev_hdl *ndev,
struct amdxdna_drm_query_firmware_version *cert_version);
+int aie4_init_dpm_freq_table(struct amdxdna_dev_hdl *ndev);
+int aie4_query_dpm_level(struct amdxdna_dev_hdl *ndev,
+ u32 *aieclk_dpm_level, u32 *npuhclk_dpm_level);
int aie4_msg_set_power_mode(struct amdxdna_dev_hdl *ndev, u8 power_mode);
u32 aie4_msg_pasid(struct amdxdna_client *client);
diff --git a/drivers/accel/amdxdna/npu1_regs.c b/drivers/accel/amdxdna/npu1_regs.c
index ca779674017a..b4a0ede636f0 100644
--- a/drivers/accel/amdxdna/npu1_regs.c
+++ b/drivers/accel/amdxdna/npu1_regs.c
@@ -71,24 +71,25 @@ static const struct amdxdna_fw_feature_tbl npu1_fw_feature_table[] = {
{ 0 }
};
-static int npu1_set_dpm(struct amdxdna_dev_hdl *ndev, u32 dpm_level)
+static int npu1_set_dpm(struct aie_device *aie, u32 dpm_level)
{
+ struct amdxdna_dev_hdl *ndev = aie->xdna->dev_handle;
u32 npuclk, hclk;
int ret;
npuclk = ndev->priv->dpm_clk_tbl[dpm_level].npuclk;
hclk = ndev->priv->dpm_clk_tbl[dpm_level].hclk;
- ret = aie_smu_set_clocks(ndev->aie.smu_hdl, &npuclk, &hclk);
+ ret = aie_smu_set_clocks(aie->smu_hdl, &npuclk, &hclk);
if (ret)
return ret;
- ndev->npuclk_freq = npuclk;
- ndev->hclk_freq = hclk;
- ndev->max_tops = 2 * ndev->total_col;
- ndev->curr_tops = ndev->max_tops * hclk / 1028;
+ aie->npuclk_freq = npuclk;
+ aie->hclk_freq = hclk;
+ aie->max_tops = 2 * ndev->total_col;
+ aie->curr_tops = aie->max_tops * hclk / 1028;
- XDNA_DBG(ndev->aie.xdna, "MP-NPU clock %d, H clock %d\n",
- ndev->npuclk_freq, ndev->hclk_freq);
+ XDNA_DBG(aie->xdna, "MP-NPU clock %d, H clock %d\n",
+ aie->npuclk_freq, aie->hclk_freq);
return 0;
}
@@ -123,7 +124,7 @@ static const struct amdxdna_dev_priv npu1_dev_priv = {
DEFINE_BAR_OFFSET(SMU_RESP_REG, NPU1_SMU, MPNPU_PUB_SCRATCH6),
DEFINE_BAR_OFFSET(SMU_OUT_REG, NPU1_SMU, MPNPU_PUB_SCRATCH7),
},
- .hw_ops = &(const struct aie2_hw_ops) {
+ .hw_ops = &(const struct aie_hw_ops) {
.set_dpm = npu1_set_dpm,
},
};
diff --git a/drivers/accel/amdxdna/npu3_regs.c b/drivers/accel/amdxdna/npu3_regs.c
index c82433d62901..cff99ddd3a55 100644
--- a/drivers/accel/amdxdna/npu3_regs.c
+++ b/drivers/accel/amdxdna/npu3_regs.c
@@ -37,6 +37,8 @@
#define MP1_C2PMSG_61_ALT_1 0x3B109F4
#define MP1_C2PMSG_60_ALT_1 0x3B109F0
+#define NPU3_DPM_TOPS(ndev, hclk) (4096 * (ndev)->total_col * (hclk) / 1000000)
+
static const struct amdxdna_fw_feature_tbl npu3_fw_feature_table[] = {
{ .major = 6, .min_minor = 0 },
{ 0 }
@@ -47,9 +49,82 @@ static const struct amdxdna_fw_feature_tbl npu3_cert_feature_table[] = {
{ 0 }
};
+static const struct dpm_clk_freq npu3_dpm_clk_table[] = {
+ { 400, 400 },
+ { 960, 576 },
+ { 1108, 576 },
+ { 1200, 847 },
+ { 1200, 1200 },
+ { 1200, 1200 },
+ { 1200, 1200 },
+ { 1200, 1200 },
+ { 0 }
+};
+
+static int npu3_set_dpm(struct aie_device *aie, u32 dpm_level)
+{
+ struct amdxdna_dev_hdl *ndev = aie->xdna->dev_handle;
+ u32 aie_lvl, npu_lvl;
+
+ if (dpm_level > max(ndev->max_aieclk_level, ndev->max_npuhclk_level)) {
+ XDNA_ERR(aie->xdna, "Invalid dpm level %u (max aie %u, npu %u)",
+ dpm_level, ndev->max_aieclk_level, ndev->max_npuhclk_level);
+ return -EINVAL;
+ }
+
+ aie_lvl = min(dpm_level, ndev->max_aieclk_level);
+ npu_lvl = min(dpm_level, ndev->max_npuhclk_level);
+
+ aie->npuclk_freq = ndev->dpm_clk_tbl[aie_lvl].npuclk;
+ aie->hclk_freq = ndev->dpm_clk_tbl[npu_lvl].hclk;
+ aie->max_tops = NPU3_DPM_TOPS(ndev, ndev->dpm_clk_tbl[ndev->max_npuhclk_level].hclk);
+ aie->curr_tops = NPU3_DPM_TOPS(ndev, aie->hclk_freq);
+
+ XDNA_DBG(aie->xdna, "MP-NPU clock %d, H clock %d\n",
+ aie->npuclk_freq, aie->hclk_freq);
+
+ return 0;
+}
+
+static int npu3_update_counters(struct aie_device *aie)
+{
+ struct amdxdna_dev_hdl *ndev = aie->xdna->dev_handle;
+ u32 aieclk_level, npuhclk_level;
+ int ret;
+
+ /* Use firmware DPM table or pre-defined table, never mixed. */
+ ret = aie4_query_dpm_level(ndev, &aieclk_level, &npuhclk_level);
+ if (ret) {
+ XDNA_WARN(aie->xdna, "Failed to get DPM level from fw: %d", ret);
+ return ret;
+ }
+
+ if (aieclk_level > ndev->max_aieclk_level ||
+ npuhclk_level > ndev->max_npuhclk_level) {
+ XDNA_ERR(aie->xdna, "DPM level exceeds max: aie %u/%u, npu %u/%u",
+ aieclk_level, ndev->max_aieclk_level,
+ npuhclk_level, ndev->max_npuhclk_level);
+ return -EINVAL;
+ }
+
+ aie->npuclk_freq = ndev->dpm_clk_tbl[aieclk_level].npuclk;
+ aie->hclk_freq = ndev->dpm_clk_tbl[npuhclk_level].hclk;
+ aie->max_tops = NPU3_DPM_TOPS(ndev,
+ ndev->dpm_clk_tbl[ndev->max_npuhclk_level].hclk);
+ aie->curr_tops = NPU3_DPM_TOPS(ndev, aie->hclk_freq);
+
+ return 0;
+}
+
+static const struct aie_hw_ops npu3_hw_ops = {
+ .set_dpm = npu3_set_dpm,
+ .update_counters = npu3_update_counters,
+};
+
static const struct amdxdna_dev_priv npu3_dev_priv = {
.npufw_path = "npu.sbin",
.certfw_path = "cert.sbin",
+ .dpm_clk_tbl = npu3_dpm_clk_table,
.mbox_bar = NPU3_MBOX_BAR,
.mbox_rbuf_bar = NPU3_MBOX_BUFFER_BAR,
.mbox_info_off = NPU3_MBOX_INFO_OFF,
@@ -71,14 +146,17 @@ static const struct amdxdna_dev_priv npu3_dev_priv = {
DEFINE_BAR_OFFSET(SMU_RESP_REG, NPU3_SMU, MP1_C2PMSG_60_ALT_1),
DEFINE_BAR_OFFSET(SMU_OUT_REG, NPU3_SMU, MP1_C2PMSG_61_ALT_1),
},
+ .hw_ops = &npu3_hw_ops,
};
static const struct amdxdna_dev_priv npu3_dev_vf_priv = {
/* vf device does not load firmware */
+ .dpm_clk_tbl = npu3_dpm_clk_table,
.mbox_bar = NPU3_MBOX_BAR,
.mbox_rbuf_bar = NPU3_MBOX_BUFFER_BAR,
.mbox_info_off = NPU3_MBOX_INFO_OFF,
/* vf device does not have smu and psp */
+ .hw_ops = &npu3_hw_ops,
};
const struct amdxdna_dev_info dev_npu3_pf_info = {
diff --git a/drivers/accel/amdxdna/npu4_regs.c b/drivers/accel/amdxdna/npu4_regs.c
index c9648c8032ec..624c1babdff8 100644
--- a/drivers/accel/amdxdna/npu4_regs.c
+++ b/drivers/accel/amdxdna/npu4_regs.c
@@ -104,42 +104,44 @@ const struct amdxdna_fw_feature_tbl npu4_fw_feature_table[] = {
{ 0 }
};
-static int npu4_set_dpm(struct amdxdna_dev_hdl *ndev, u32 dpm_level)
+static int npu4_set_dpm(struct aie_device *aie, u32 dpm_level)
{
+ struct amdxdna_dev_hdl *ndev = aie->xdna->dev_handle;
int ret;
- ret = aie_smu_set_dpm(ndev->aie.smu_hdl, dpm_level);
+ ret = aie_smu_set_dpm(aie->smu_hdl, dpm_level);
if (ret)
return ret;
- ndev->npuclk_freq = ndev->priv->dpm_clk_tbl[dpm_level].npuclk;
- ndev->hclk_freq = ndev->priv->dpm_clk_tbl[dpm_level].hclk;
- ndev->max_tops = NPU4_DPM_TOPS(ndev, ndev->priv->dpm_clk_tbl[ndev->max_dpm_level].hclk);
- ndev->curr_tops = NPU4_DPM_TOPS(ndev, ndev->hclk_freq);
+ aie->npuclk_freq = ndev->priv->dpm_clk_tbl[dpm_level].npuclk;
+ aie->hclk_freq = ndev->priv->dpm_clk_tbl[dpm_level].hclk;
+ aie->max_tops = NPU4_DPM_TOPS(ndev, ndev->priv->dpm_clk_tbl[ndev->max_dpm_level].hclk);
+ aie->curr_tops = NPU4_DPM_TOPS(ndev, aie->hclk_freq);
- XDNA_DBG(ndev->aie.xdna, "MP-NPU clock %d, H clock %d\n",
- ndev->npuclk_freq, ndev->hclk_freq);
+ XDNA_DBG(aie->xdna, "MP-NPU clock %d, H clock %d\n",
+ aie->npuclk_freq, aie->hclk_freq);
return 0;
}
-static int npu4_update_counters(struct amdxdna_dev_hdl *ndev)
+static int npu4_update_counters(struct aie_device *aie)
{
+ struct amdxdna_dev_hdl *ndev = aie->xdna->dev_handle;
struct amd_pmf_npu_metrics npu_metrics;
int ret;
- ret = AIE2_GET_PMF_NPU_METRICS(&npu_metrics);
+ ret = AIE_GET_PMF_NPU_METRICS(&npu_metrics);
if (ret)
return ret;
- ndev->npuclk_freq = npu_metrics.mpnpuclk_freq;
- ndev->hclk_freq = npu_metrics.npuclk_freq;
- ndev->curr_tops = NPU4_DPM_TOPS(ndev, ndev->hclk_freq);
+ aie->npuclk_freq = npu_metrics.mpnpuclk_freq;
+ aie->hclk_freq = npu_metrics.npuclk_freq;
+ aie->curr_tops = NPU4_DPM_TOPS(ndev, aie->hclk_freq);
return 0;
}
-const struct aie2_hw_ops npu4_hw_ops = {
+const struct aie_hw_ops npu4_hw_ops = {
.set_dpm = npu4_set_dpm,
.update_counters = npu4_update_counters,
};
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 09/20] accel/amdxdna: Add context switch hysteresis with debugfs control
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (7 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 08/20] accel/amdxdna: Add clock, DPM frequency, and resource info queries " David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:35 ` sashiko-bot
2026-10-06 4:22 ` [PATCH V2 10/20] accel/amdxdna: Refactor AIE4 hardware initialization sequence David Zhang
` (10 subsequent siblings)
19 siblings, 1 reply; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello, Nishad Saraf
Add aie4_set_ctx_hysteresis() to configure the AIE4 context switch
hysteresis timeout via the SET_RUNTIME_CONFIG message, applied at hw
start (PF and classic paths) with a default of 1000 us.
Expose a debugfs node 'ctx_switch_hysteresis_us' to change the timeout
at runtime (0 disables hysteresis). The stored value is re-applied on
every hw start so it survives runtime suspend/resume.
Co-developed-by: Nishad Saraf <nishads@amd.com>
Signed-off-by: Nishad Saraf <nishads@amd.com>
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_message.c | 43 +++++++++++++
drivers/accel/amdxdna/aie4_msg_priv.h | 24 +++++++
drivers/accel/amdxdna/aie4_pci.c | 83 ++++++++++++++++++++++++-
drivers/accel/amdxdna/aie4_pci.h | 9 +++
drivers/accel/amdxdna/amdxdna_debugfs.c | 3 +
drivers/accel/amdxdna/amdxdna_pci_drv.h | 1 +
6 files changed, 161 insertions(+), 2 deletions(-)
diff --git a/drivers/accel/amdxdna/aie4_message.c b/drivers/accel/amdxdna/aie4_message.c
index 7112b0bc3725..5720aa88e6d6 100644
--- a/drivers/accel/amdxdna/aie4_message.c
+++ b/drivers/accel/amdxdna/aie4_message.c
@@ -262,3 +262,46 @@ int aie4_msg_set_power_mode(struct amdxdna_dev_hdl *ndev, u8 power_mode)
return ret;
}
+
+int aie4_set_runtime_cfg(struct amdxdna_dev_hdl *ndev, u32 type,
+ const void *data, size_t size)
+{
+ DECLARE_AIE_MSG(aie4_msg_set_runtime_cfg, AIE4_MSG_OP_SET_RUNTIME_CONFIG);
+ u8 buf[sizeof(req.type) + AIE4_RUNTIME_CFG_MAX_DATA_SIZE] = { 0 };
+ int ret;
+
+ if (size > AIE4_RUNTIME_CFG_MAX_DATA_SIZE)
+ return -EINVAL;
+
+ /* Stage runtime config type and payload for firmware mailbox message. */
+ req.type = type;
+ memcpy(buf, &req.type, sizeof(req.type));
+ memcpy(buf + sizeof(req.type), data, size);
+
+ msg.send_data = buf;
+ msg.send_size = sizeof(req.type) + size;
+
+ ret = aie_send_mgmt_msg_wait(&ndev->aie, &msg);
+ if (ret)
+ XDNA_ERR(ndev->aie.xdna, "Failed to set runtime cfg %u: %d", type, ret);
+ return ret;
+}
+
+int aie4_set_ctx_hysteresis(struct amdxdna_dev_hdl *ndev, u32 timeout_us)
+{
+ struct aie4_msg_runtime_config_ctx_switch_hysteresis cfg = {
+ .timeout_us = timeout_us,
+ };
+ int ret;
+
+ ret = aie4_set_runtime_cfg(ndev, AIE4_RUNTIME_CONFIG_CTX_SWITCH_HYSTERESIS,
+ &cfg, sizeof(cfg));
+ if (ret)
+ XDNA_WARN(ndev->aie.xdna,
+ "Failed to set ctx switch hysteresis to %u us (%d), using fw default",
+ timeout_us, ret);
+ else
+ XDNA_DBG(ndev->aie.xdna, "Context switch hysteresis set to %u us", timeout_us);
+
+ return ret;
+}
diff --git a/drivers/accel/amdxdna/aie4_msg_priv.h b/drivers/accel/amdxdna/aie4_msg_priv.h
index fe78df9e23c8..636bf8d04c76 100644
--- a/drivers/accel/amdxdna/aie4_msg_priv.h
+++ b/drivers/accel/amdxdna/aie4_msg_priv.h
@@ -12,6 +12,7 @@
enum aie4_msg_opcode {
AIE4_MSG_OP_IDENTIFY = 0x10002,
AIE4_MSG_OP_SUSPEND = 0x10003,
+ AIE4_MSG_OP_SET_RUNTIME_CONFIG = 0x10007,
AIE4_MSG_OP_QUERY_CERT_FIRMWARE_VERSION = 0x1000F,
AIE4_MSG_OP_CREATE_VFS = 0x20001,
@@ -65,6 +66,29 @@ struct aie4_msg_suspend_resp {
enum aie4_msg_status status;
} __packed;
+/* Type selector for AIE4_MSG_OP_SET_RUNTIME_CONFIG. */
+enum aie4_msg_runtime_config_type {
+ AIE4_RUNTIME_CONFIG_CTX_SWITCH_HYSTERESIS = 0xD,
+ AIE4_MAX_RUNTIME_CONFIG
+};
+
+struct aie4_msg_set_runtime_cfg_req {
+ __u32 type;
+ __u8 data[4];
+} __packed;
+
+struct aie4_msg_set_runtime_cfg_resp {
+ enum aie4_msg_status status;
+} __packed;
+
+/* Maximum payload for runtime config firmware message. */
+#define AIE4_RUNTIME_CFG_MAX_DATA_SIZE 16
+
+/* Context switch hysteresis timeout in microseconds (0 disables). */
+struct aie4_msg_runtime_config_ctx_switch_hysteresis {
+ __u32 timeout_us;
+} __packed;
+
struct aie4_msg_create_vfs_req {
__u32 vf_cnt;
} __packed;
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index 3e02dabaf5fe..a315d2a5607e 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -5,8 +5,10 @@
#include <drm/amdxdna_accel.h>
#include <drm/drm_drv.h>
+#include <drm/drm_file.h>
#include <drm/drm_managed.h>
#include <drm/drm_print.h>
+#include <linux/debugfs.h>
#include <linux/firmware.h>
#include <linux/sizes.h>
@@ -315,6 +317,22 @@ int aie4_restore_power_mode(struct amdxdna_dev_hdl *ndev)
return aie4_msg_set_power_mode(ndev, ndev->pw_mode);
}
+static int aie4_config_fw(struct amdxdna_dev_hdl *ndev)
+{
+ int ret;
+
+ ret = aie4_attach_work_buffer(ndev);
+ if (ret)
+ return ret;
+
+ /* Best-effort tuning knob; failure is warned inside and does not fail hw start */
+ ret = aie4_set_ctx_hysteresis(ndev, ndev->ctx_switch_hysteresis_us);
+ if (ret == -ETIME)
+ return ret;
+
+ return 0;
+}
+
static int aie4_pf_hw_start(struct amdxdna_dev_hdl *ndev)
{
int ret;
@@ -327,7 +345,7 @@ static int aie4_pf_hw_start(struct amdxdna_dev_hdl *ndev)
if (ret)
goto stop_fw;
- ret = aie4_attach_work_buffer(ndev);
+ ret = aie4_config_fw(ndev);
if (ret)
goto mbox_fini;
@@ -411,7 +429,7 @@ static int aie4_classic_hw_start(struct amdxdna_dev_hdl *ndev)
if (ret)
goto mailbox_fini;
- ret = aie4_attach_work_buffer(ndev);
+ ret = aie4_config_fw(ndev);
if (ret)
goto mailbox_fini;
@@ -566,6 +584,7 @@ static int aie4m_pcidev_init(struct amdxdna_dev *xdna)
ndev->priv = xdna->dev_info->dev_priv;
ndev->aie.xdna = xdna;
+ ndev->ctx_switch_hysteresis_us = AIE4_CTX_HYSTERESIS_US;
ndev->pw_mode = POWER_MODE_DEFAULT;
xdna->dev_handle = ndev;
@@ -911,15 +930,74 @@ static void aie4_classic_fini(struct amdxdna_dev *xdna)
aie4_free_work_buffer(xdna->dev_handle);
}
+static int aie4_ctx_hysteresis_get(void *data, u64 *val)
+{
+ struct amdxdna_dev_hdl *ndev = data;
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+
+ guard(mutex)(&xdna->dev_lock);
+ *val = ndev->ctx_switch_hysteresis_us;
+
+ return 0;
+}
+
+static int aie4_ctx_hysteresis_set(void *data, u64 val)
+{
+ struct amdxdna_dev_hdl *ndev = data;
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+ int ret, idx;
+
+ if (val > U32_MAX)
+ return -EINVAL;
+
+ if (!drm_dev_enter(&xdna->ddev, &idx))
+ return -ENODEV;
+
+ mutex_lock(&xdna->dev_lock);
+
+ ret = amdxdna_pm_resume_get_locked(xdna);
+ if (ret)
+ goto unlock;
+
+ ret = aie4_set_ctx_hysteresis(ndev, (u32)val);
+ if (!ret)
+ ndev->ctx_switch_hysteresis_us = (u32)val;
+
+ amdxdna_pm_suspend_put(xdna);
+
+unlock:
+ mutex_unlock(&xdna->dev_lock);
+ drm_dev_exit(idx);
+
+ return ret;
+}
+
+/* Context switch hysteresis timeout in microseconds; 0 disables hysteresis. */
+DEFINE_DEBUGFS_ATTRIBUTE(aie4_ctx_hysteresis_fops, aie4_ctx_hysteresis_get,
+ aie4_ctx_hysteresis_set, "%llu\n");
+
+static void aie4_debugfs_init(struct amdxdna_dev *xdna)
+{
+ struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
+
+ /* Context switch hysteresis is only supported on PF and classic devices. */
+ if (!to_pci_dev(xdna->ddev.dev)->is_virtfn)
+ debugfs_create_file_unsafe("ctx_switch_hysteresis_us", 0600,
+ xdna->ddev.accel->debugfs_root, ndev,
+ &aie4_ctx_hysteresis_fops);
+}
+
const struct amdxdna_dev_ops aie4_pf_ops = {
.init = aie4_pf_init,
.fini = aie4_pf_fini,
+ .debugfs_init = aie4_debugfs_init,
.sriov_configure = aie4_sriov_configure,
};
const struct amdxdna_dev_ops aie4_vf_ops = {
.init = aie4_vf_init,
.fini = aie4_vf_fini,
+ .debugfs_init = aie4_debugfs_init,
.hwctx_init = aie4_hwctx_init,
.hwctx_fini = aie4_hwctx_fini,
.cmd_wait = aie4_cmd_wait,
@@ -930,6 +1008,7 @@ const struct amdxdna_dev_ops aie4_vf_ops = {
const struct amdxdna_dev_ops aie4_classic_ops = {
.init = aie4_classic_init,
.fini = aie4_classic_fini,
+ .debugfs_init = aie4_debugfs_init,
.hwctx_init = aie4_hwctx_init,
.hwctx_fini = aie4_hwctx_fini,
.cmd_wait = aie4_cmd_wait,
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index 6e9e7f874a44..959ef3695813 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -14,6 +14,9 @@
#include "aie4_msg_priv.h"
#include "amdxdna_mailbox.h"
+/* Default context switch hysteresis timeout in microseconds. */
+#define AIE4_CTX_HYSTERESIS_US 1000
+
struct cert_comp {
struct amdxdna_dev_hdl *ndev;
u32 msix_idx;
@@ -69,6 +72,9 @@ struct amdxdna_dev_hdl {
u8 pw_mode;
+ /* Context switch hysteresis timeout in microseconds. */
+ u32 ctx_switch_hysteresis_us;
+
struct amdxdna_drm_query_firmware_version cert_version;
};
@@ -92,6 +98,9 @@ int aie4_init_dpm_freq_table(struct amdxdna_dev_hdl *ndev);
int aie4_query_dpm_level(struct amdxdna_dev_hdl *ndev,
u32 *aieclk_dpm_level, u32 *npuhclk_dpm_level);
int aie4_msg_set_power_mode(struct amdxdna_dev_hdl *ndev, u8 power_mode);
+int aie4_set_runtime_cfg(struct amdxdna_dev_hdl *ndev, u32 type,
+ const void *data, size_t size);
+int aie4_set_ctx_hysteresis(struct amdxdna_dev_hdl *ndev, u32 timeout_us);
u32 aie4_msg_pasid(struct amdxdna_client *client);
/* aie4_ctx.c */
diff --git a/drivers/accel/amdxdna/amdxdna_debugfs.c b/drivers/accel/amdxdna/amdxdna_debugfs.c
index a6ec17c63629..1f63cc91b168 100644
--- a/drivers/accel/amdxdna/amdxdna_debugfs.c
+++ b/drivers/accel/amdxdna/amdxdna_debugfs.c
@@ -126,4 +126,7 @@ void amdxdna_debugfs_init(struct amdxdna_dev *xdna)
xdna,
amdxdna_dbgfs_files[i].fops);
}
+
+ if (xdna->dev_info->ops->debugfs_init)
+ xdna->dev_info->ops->debugfs_init(xdna);
}
diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.h b/drivers/accel/amdxdna/amdxdna_pci_drv.h
index 953bf783b3f7..11f46ec738d7 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.h
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.h
@@ -54,6 +54,7 @@ struct amdxdna_sched_job;
struct amdxdna_dev_ops {
int (*init)(struct amdxdna_dev *xdna);
void (*fini)(struct amdxdna_dev *xdna);
+ void (*debugfs_init)(struct amdxdna_dev *xdna);
int (*resume)(struct amdxdna_dev *xdna);
int (*suspend)(struct amdxdna_dev *xdna);
int (*sriov_configure)(struct amdxdna_dev *xdna, int num_vfs);
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* Re: [PATCH V2 09/20] accel/amdxdna: Add context switch hysteresis with debugfs control
2026-10-06 4:22 ` [PATCH V2 09/20] accel/amdxdna: Add context switch hysteresis with debugfs control David Zhang
@ 2026-10-06 4:35 ` sashiko-bot
0 siblings, 0 replies; 31+ messages in thread
From: sashiko-bot @ 2026-10-06 4:35 UTC (permalink / raw)
To: David Zhang; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] amdxdna: unaligned memory access in aie4_set_runtime_cfg()
--
commit 1c7fe2fcd8c5df7169f8d7c14de7898318de0123
Author: David Zhang <yidong.zhang@amd.com>
accel/amdxdna: Add context switch hysteresis with debugfs control
This commit adds aie4_set_ctx_hysteresis() to configure the AIE4 context
switch hysteresis timeout. It also exposes a debugfs node to change the
timeout at runtime.
> diff --git a/drivers/accel/amdxdna/aie4_message.c b/drivers/accel/amdxdna/aie4_message.c
> index 7112b0bc3725a..5720aa88e6d6d 100644
> --- a/drivers/accel/amdxdna/aie4_message.c
> +++ b/drivers/accel/amdxdna/aie4_message.c
[ ... ]
> @@ -262,3 +262,46 @@ int aie4_msg_set_power_mode(struct amdxdna_dev_hdl *ndev, u8 power_mode)
>
> return ret;
> }
> +
> +int aie4_set_runtime_cfg(struct amdxdna_dev_hdl *ndev, u32 type,
> + const void *data, size_t size)
> +{
> + DECLARE_AIE_MSG(aie4_msg_set_runtime_cfg, AIE4_MSG_OP_SET_RUNTIME_CONFIG);
> + u8 buf[sizeof(req.type) + AIE4_RUNTIME_CFG_MAX_DATA_SIZE] = { 0 };
[Severity: Medium]
Could this lead to unaligned memory access? The payload buffer is declared as
a byte array with no alignment guarantees, meaning its start address on the
stack might not be 4-byte aligned.
Later in this function, buf is assigned to msg.send_data and passed to
aie_send_mgmt_msg_wait(). When the mailbox code processes this message, it
does:
drivers/accel/amdxdna/amdxdna_mailbox.c:xdna_mailbox_send_msg() {
...
if (unlikely(((u32 *)msg->send_data)[0] == TOMBSTONE)) {
...
}
Dereferencing a potentially unaligned pointer via a u32 pointer cast is
undefined behavior. While x86_64 hardware typically handles unaligned reads
gracefully, the compiler is permitted to optimize assuming the pointer is
strictly 4-byte aligned, which can lead to miscompilation. Furthermore, this
will trigger Undefined Behavior Sanitizer (UBSAN) warnings during runtime
testing.
Could the buffer be aligned, perhaps by using __aligned(4) or an appropriately
typed struct?
> + int ret;
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261006042230.547807-1-yidong.zhang@amd.com?part=9
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH V2 10/20] accel/amdxdna: Refactor AIE4 hardware initialization sequence
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (8 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 09/20] accel/amdxdna: Add context switch hysteresis with debugfs control David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 11/20] accel/amdxdna: Decouple AIE4 doorbell and MSI-X notify transport hooks David Zhang
` (9 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello
Reorganize AIE4 hardware initialization into distinct phases:
- aie4_query_fw(): Query NPU and CERT firmware versions.
- aie4_config_fw(): Attach work buffer and configure context switch
hysteresis.
- aie4_setup_aie(): Query AIE version, metadata, initialize DPM frequency
table, and initialize partitions.
Update aie4_pf_hw_start(), aie4_vf_hw_start(), and aie4_classic_hw_start()
to use these phases and unify error unwinding labels. As part of this,
aie4_pf_hw_start() now also calls aie4_query_fw(), which it previously
did not do.
Additionally:
- Zero-initialize struct smu_config smu_conf in aie4_prepare_firmware().
- Clean up iomem pointer type in aie4_fw_is_alive() to void __iomem *.
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_pci.c | 79 +++++++++++++++++++-------------
1 file changed, 46 insertions(+), 33 deletions(-)
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index a315d2a5607e..4a5f30b42743 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -49,7 +49,7 @@ static int aie4_fw_is_alive(struct amdxdna_dev *xdna)
{
const struct amdxdna_dev_priv *npriv = xdna->dev_info->dev_priv;
struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
- u32 __iomem *src;
+ void __iomem *src;
u32 fw_is_valid;
int ret;
@@ -273,7 +273,8 @@ static void aie4_partition_fini(struct amdxdna_dev_hdl *ndev)
XDNA_ERR(xdna, "partition fini failed: %d", ret);
}
-static int aie4_query(struct amdxdna_dev_hdl *ndev)
+/* Verify CERT protocol compatibility before starting hardware. */
+static int aie4_query_fw(struct amdxdna_dev_hdl *ndev)
{
struct amdxdna_dev *xdna = ndev->aie.xdna;
int ret;
@@ -286,25 +287,6 @@ static int aie4_query(struct amdxdna_dev_hdl *ndev)
if (ret)
return ret;
- ret = aie4_query_aie_version(ndev, &ndev->aie.version);
- if (ret)
- return ret;
-
- ret = aie4_query_aie_metadata(ndev, &ndev->aie.metadata);
- if (ret)
- return ret;
-
- ndev->total_col = min_t(u32, AIE4_TOTAL_COLUMN, ndev->aie.metadata.cols);
-
- ret = aie4_init_dpm_freq_table(ndev);
- if (ret) {
- if (ret == -ETIME)
- return ret;
- /* if query dpm from fw failed, using default value */
- if (ndev->priv->hw_ops && ndev->priv->hw_ops->set_dpm)
- (void)ndev->priv->hw_ops->set_dpm(&ndev->aie, 0);
- }
-
return 0;
}
@@ -333,6 +315,32 @@ static int aie4_config_fw(struct amdxdna_dev_hdl *ndev)
return 0;
}
+static int aie4_setup_aie(struct amdxdna_dev_hdl *ndev)
+{
+ int ret;
+
+ ret = aie4_query_aie_version(ndev, &ndev->aie.version);
+ if (ret)
+ return ret;
+
+ ret = aie4_query_aie_metadata(ndev, &ndev->aie.metadata);
+ if (ret)
+ return ret;
+
+ ndev->total_col = min_t(u32, AIE4_TOTAL_COLUMN, ndev->aie.metadata.cols);
+
+ ret = aie4_init_dpm_freq_table(ndev);
+ if (ret) {
+ if (ret == -ETIME)
+ return ret;
+ /* if query dpm from fw failed, using default value */
+ if (ndev->priv->hw_ops && ndev->priv->hw_ops->set_dpm)
+ (void)ndev->priv->hw_ops->set_dpm(&ndev->aie, 0);
+ }
+
+ return aie4_partition_init(ndev);
+}
+
static int aie4_pf_hw_start(struct amdxdna_dev_hdl *ndev)
{
int ret;
@@ -345,6 +353,10 @@ static int aie4_pf_hw_start(struct amdxdna_dev_hdl *ndev)
if (ret)
goto stop_fw;
+ ret = aie4_query_fw(ndev);
+ if (ret)
+ goto mbox_fini;
+
ret = aie4_config_fw(ndev);
if (ret)
goto mbox_fini;
@@ -382,13 +394,13 @@ static int aie4_vf_hw_start(struct amdxdna_dev_hdl *ndev)
if (ret)
return ret;
- ret = aie4_query(ndev);
+ ret = aie4_query_fw(ndev);
if (ret)
- goto mailbox_fini;
+ goto mbox_fini;
- ret = aie4_partition_init(ndev);
+ ret = aie4_setup_aie(ndev);
if (ret)
- goto mailbox_fini;
+ goto mbox_fini;
ret = aie4_restore_power_mode(ndev);
if (ret)
@@ -398,7 +410,7 @@ static int aie4_vf_hw_start(struct amdxdna_dev_hdl *ndev)
partition_fini:
aie4_partition_fini(ndev);
-mailbox_fini:
+mbox_fini:
aie4_mailbox_fini(ndev);
return ret;
}
@@ -425,17 +437,17 @@ static int aie4_classic_hw_start(struct amdxdna_dev_hdl *ndev)
if (ret)
goto stop_fw;
- ret = aie4_query(ndev);
+ ret = aie4_query_fw(ndev);
if (ret)
- goto mailbox_fini;
+ goto mbox_fini;
ret = aie4_config_fw(ndev);
if (ret)
- goto mailbox_fini;
+ goto mbox_fini;
- ret = aie4_partition_init(ndev);
+ ret = aie4_setup_aie(ndev);
if (ret)
- goto mailbox_fini;
+ goto mbox_fini;
ret = aie4_restore_power_mode(ndev);
if (ret)
@@ -445,10 +457,11 @@ static int aie4_classic_hw_start(struct amdxdna_dev_hdl *ndev)
partition_fini:
aie4_partition_fini(ndev);
-mailbox_fini:
+mbox_fini:
aie4_mailbox_fini(ndev);
stop_fw:
aie4_fw_stop(ndev);
+
return ret;
}
@@ -522,8 +535,8 @@ static int aie4_prepare_firmware(struct amdxdna_dev_hdl *ndev,
void __iomem *tbl[PCI_NUM_RESOURCES])
{
struct amdxdna_dev *xdna = ndev->aie.xdna;
+ struct smu_config smu_conf = {};
struct psp_config psp_conf;
- struct smu_config smu_conf;
int i;
psp_conf.fw_size = npufw->size;
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 11/20] accel/amdxdna: Decouple AIE4 doorbell and MSI-X notify transport hooks
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (9 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 10/20] accel/amdxdna: Refactor AIE4 hardware initialization sequence David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 12/20] accel/amdxdna: Implement AIE4 kernel queue lifecycle and memory layout David Zhang
` (8 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello, Wendy Liang
Separate PCI-specific doorbell and interrupt notification handling from
the transport-neutral context code.
Note that new transport functions are wired in later patches in this
series. Neither NULL dereference nor BAR boundary bypass can occur
because doorbell ringing is not invoked until full context setup and BAR
validation are established.
Co-developed-by: Wendy Liang <wendy.liang@amd.com>
Signed-off-by: Wendy Liang <wendy.liang@amd.com>
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_ctx.c | 29 ++++---------
drivers/accel/amdxdna/aie4_pci.c | 66 +++++++++++++++++++++++++++++
drivers/accel/amdxdna/aie4_pci.h | 14 ++++++
drivers/accel/amdxdna/amdxdna_ctx.h | 2 +
4 files changed, 90 insertions(+), 21 deletions(-)
diff --git a/drivers/accel/amdxdna/aie4_ctx.c b/drivers/accel/amdxdna/aie4_ctx.c
index 5eb918e1d58c..5a2fc19bad20 100644
--- a/drivers/accel/amdxdna/aie4_ctx.c
+++ b/drivers/accel/amdxdna/aie4_ctx.c
@@ -22,18 +22,9 @@
#include "amdxdna_mailbox_helper.h"
#include "amdxdna_pci_drv.h"
-static irqreturn_t cert_comp_isr(int irq, void *p)
-{
- struct cert_comp *cert_comp = p;
-
- wake_up_all(&cert_comp->waitq);
- return IRQ_HANDLED;
-}
-
static struct cert_comp *aie4_lookup_cert_comp(struct amdxdna_dev_hdl *ndev, u32 msix_idx)
{
struct amdxdna_dev *xdna = ndev->aie.xdna;
- struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
struct cert_comp *cert_comp;
int ret;
@@ -51,32 +42,27 @@ static struct cert_comp *aie4_lookup_cert_comp(struct amdxdna_dev_hdl *ndev, u32
cert_comp->ndev = ndev;
cert_comp->msix_idx = msix_idx;
+ cert_comp->irq = -ENOENT;
init_waitqueue_head(&cert_comp->waitq);
kref_init(&cert_comp->kref);
- ret = pci_irq_vector(pdev, cert_comp->msix_idx);
- if (ret < 0) {
- XDNA_ERR(xdna, "MSI-X idx %u is invalid, ret:%d", msix_idx, ret);
- goto free_cert_comp;
- }
- cert_comp->irq = ret;
-
- ret = request_irq(cert_comp->irq, cert_comp_isr, 0, "xdna_hsa", cert_comp);
+ /* Transport-specific: PCI wires an MSI-X irq, platform an IPI callback. */
+ ret = aie4_request_notification(cert_comp);
if (ret) {
- XDNA_ERR(xdna, "request irq %d failed %d", cert_comp->irq, ret);
+ XDNA_ERR(xdna, "request notification for msix idx %u failed %d", msix_idx, ret);
goto free_cert_comp;
}
ret = xa_err(xa_store(&ndev->cert_comp_xa, msix_idx, cert_comp, GFP_KERNEL));
if (ret) {
- XDNA_ERR(xdna, "store cert_comp for msix idx %d failed %d", msix_idx, ret);
+ XDNA_ERR(xdna, "store cert_comp for msix idx %u failed %d", msix_idx, ret);
goto free_irq;
}
return cert_comp;
free_irq:
- free_irq(cert_comp->irq, cert_comp);
+ aie4_free_notification(cert_comp);
free_cert_comp:
kfree(cert_comp);
return NULL;
@@ -90,7 +76,7 @@ static void cert_comp_release(struct kref *kref)
drm_WARN_ON(&ndev->aie.xdna->ddev, !mutex_is_locked(&ndev->cert_comp_lock));
xa_erase(&ndev->cert_comp_xa, cert_comp->msix_idx);
- free_irq(cert_comp->irq, cert_comp);
+ aie4_free_notification(cert_comp);
kfree(cert_comp);
}
@@ -100,6 +86,7 @@ static void aie4_put_cert_comp(struct cert_comp *cert_comp)
ndev = cert_comp->ndev;
guard(mutex)(&ndev->cert_comp_lock);
+
kref_put(&cert_comp->kref, cert_comp_release);
}
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index 4a5f30b42743..9d970d4da435 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -14,6 +14,7 @@
#include "aie.h"
#include "aie4_msg_priv.h"
+#include "amdxdna_ctx.h"
#include "aie4_pci.h"
#include "amdxdna_mailbox.h"
#include "amdxdna_mailbox_helper.h"
@@ -110,6 +111,69 @@ static void aie4_mailbox_fini(struct amdxdna_dev_hdl *ndev)
ndev->mbox = NULL;
}
+static irqreturn_t cert_comp_isr(int irq, void *p)
+{
+ struct cert_comp *cert_comp = p;
+
+ wake_up_all(&cert_comp->waitq);
+ return IRQ_HANDLED;
+}
+
+/* Wire per-cert completion notification interrupt. */
+int aie4_request_notification(struct cert_comp *comp)
+{
+ struct pci_dev *pdev = to_pci_dev(comp->ndev->aie.xdna->ddev.dev);
+ int ret;
+
+ ret = pci_irq_vector(pdev, comp->msix_idx);
+ if (ret < 0)
+ return ret;
+ comp->irq = ret;
+
+ ret = request_irq(comp->irq, cert_comp_isr, 0, "xdna_hsa", comp);
+ if (ret) {
+ comp->irq = -ENOENT;
+ return ret;
+ }
+
+ return 0;
+}
+
+/* Tear down per-cert completion notification interrupt. */
+void aie4_free_notification(struct cert_comp *comp)
+{
+ if (comp->irq >= 0)
+ free_irq(comp->irq, comp);
+}
+
+/* Validate and configure hardware context doorbell target. */
+int aie4_doorbell_setup(struct amdxdna_hwctx *hwctx,
+ const struct aie4_msg_create_hw_context_resp *resp)
+{
+ struct amdxdna_dev *xdna = hwctx->client->xdna;
+ struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+ struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
+ u64 db_off = (u64)ndev->priv->doorbell_off + resp->doorbell_offset;
+
+ /* Validate doorbell offset against mapped BAR bounds. */
+ if (db_off + sizeof(u32) >
+ pci_resource_len(pdev, xdna->dev_info->doorbell_bar)) {
+ XDNA_ERR(xdna, "doorbell offset 0x%llx out of BAR", db_off);
+ return -EINVAL;
+ }
+
+ priv->doorbell_addr = ndev->doorbell_base + ndev->priv->doorbell_off +
+ resp->doorbell_offset;
+ return 0;
+}
+
+/* Ring context doorbell to notify CERT. */
+void aie4_doorbell_ring(struct amdxdna_hwctx *hwctx)
+{
+ writel(0, hwctx->priv->doorbell_addr);
+}
+
static int aie4_irq_init(struct amdxdna_dev *xdna)
{
struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
@@ -623,6 +687,7 @@ static int aie4m_pcidev_init(struct amdxdna_dev *xdna)
set_bit(SMU_REG_BAR(ndev, i), &bars);
set_bit(xdna->dev_info->mbox_bar, &bars);
set_bit(xdna->dev_info->sram_bar, &bars);
+ set_bit(xdna->dev_info->doorbell_bar, &bars);
for (i = 0; i < PCI_NUM_RESOURCES; i++) {
if (!test_bit(i, &bars))
@@ -636,6 +701,7 @@ static int aie4m_pcidev_init(struct amdxdna_dev *xdna)
ndev->mbox_base = tbl[xdna->dev_info->mbox_bar];
ndev->rbuf_base = tbl[xdna->dev_info->sram_bar];
+ ndev->doorbell_base = tbl[xdna->dev_info->doorbell_bar];
pci_set_master(pdev);
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index 959ef3695813..9fcdfcc5a15f 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -32,6 +32,8 @@ struct amdxdna_hwctx_priv {
struct cert_comp *cert_comp;
u32 hw_ctx_id;
+
+ void __iomem *doorbell_addr;
};
struct amdxdna_dev_priv {
@@ -54,6 +56,7 @@ struct amdxdna_dev_hdl {
const struct amdxdna_dev_priv *priv;
void __iomem *mbox_base;
void __iomem *rbuf_base;
+ void __iomem *doorbell_base;
struct mailbox *mbox;
u32 partition_id;
@@ -111,6 +114,17 @@ int aie4_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq, u32 timeout);
/* aie4_pci.c */
int aie4_restore_power_mode(struct amdxdna_dev_hdl *ndev);
+/*
+ * Transport hooks implemented by PCI backend. Doorbell hooks are wired during
+ * kernel queue creation and command submission in later patches in the series.
+ */
+struct aie4_msg_create_hw_context_resp;
+int aie4_doorbell_setup(struct amdxdna_hwctx *hwctx,
+ const struct aie4_msg_create_hw_context_resp *resp);
+void aie4_doorbell_ring(struct amdxdna_hwctx *hwctx);
+int aie4_request_notification(struct cert_comp *comp);
+void aie4_free_notification(struct cert_comp *comp);
+
/* aie4_sriov.c */
#if IS_ENABLED(CONFIG_PCI_IOV)
int aie4_sriov_configure(struct amdxdna_dev *xdna, int num_vfs);
diff --git a/drivers/accel/amdxdna/amdxdna_ctx.h b/drivers/accel/amdxdna/amdxdna_ctx.h
index 6e78bab8a02c..9bbc3db4ebde 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.h
+++ b/drivers/accel/amdxdna/amdxdna_ctx.h
@@ -6,6 +6,8 @@
#ifndef _AMDXDNA_CTX_H_
#define _AMDXDNA_CTX_H_
+#include <drm/amdxdna_accel.h>
+#include <drm/gpu_scheduler.h>
#include <linux/bitfield.h>
#include "amdxdna_gem.h"
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 12/20] accel/amdxdna: Implement AIE4 kernel queue lifecycle and memory layout
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (10 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 11/20] accel/amdxdna: Decouple AIE4 doorbell and MSI-X notify transport hooks David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 13/20] accel/amdxdna: Prepare for AIE4 command submission David Zhang
` (7 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello, Wendy Liang
Initialize kernel-mode submission required buffers, workqueue, and
hardware contexts:
- Update queue definition that is being used to send requests.
- Add job workqueue for pending and running jobs.
- Add mutex protection for each io.
- Initialize queue with direct and indirect packet, format queue header.
- Add kernel-mode submission required steps in hwctx create/destroy.
- Add aie4_get_cert_comp() to safely acquire a reference to the
per-hwctx completion tracker under io_lock in aie4_cmd_wait() before
waiting on the queue, preventing race conditions with
aie4_hwctx_destroy().
Co-developed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Max Zhen <max.zhen@amd.com>
Co-developed-by: Wendy Liang <wendy.liang@amd.com>
Signed-off-by: Wendy Liang <wendy.liang@amd.com>
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_ctx.c | 196 ++++++++++++++++++++----
drivers/accel/amdxdna/aie4_host_queue.h | 65 ++++++++
drivers/accel/amdxdna/aie4_pci.h | 42 +++++
3 files changed, 270 insertions(+), 33 deletions(-)
diff --git a/drivers/accel/amdxdna/aie4_ctx.c b/drivers/accel/amdxdna/aie4_ctx.c
index 5a2fc19bad20..226570367f71 100644
--- a/drivers/accel/amdxdna/aie4_ctx.c
+++ b/drivers/accel/amdxdna/aie4_ctx.c
@@ -22,6 +22,13 @@
#include "amdxdna_mailbox_helper.h"
#include "amdxdna_pci_drv.h"
+#define CTX_INVALID_ID (~0U)
+#define CTX_INVALID_DOORBELL AMDXDNA_INVALID_DOORBELL_OFFSET
+
+static void job_worker(struct work_struct *work)
+{
+}
+
static struct cert_comp *aie4_lookup_cert_comp(struct amdxdna_dev_hdl *ndev, u32 msix_idx)
{
struct amdxdna_dev *xdna = ndev->aie.xdna;
@@ -38,7 +45,7 @@ static struct cert_comp *aie4_lookup_cert_comp(struct amdxdna_dev_hdl *ndev, u32
cert_comp = kzalloc_obj(*cert_comp);
if (!cert_comp)
- return NULL;
+ return ERR_PTR(-ENOMEM);
cert_comp->ndev = ndev;
cert_comp->msix_idx = msix_idx;
@@ -65,7 +72,7 @@ static struct cert_comp *aie4_lookup_cert_comp(struct amdxdna_dev_hdl *ndev, u32
aie4_free_notification(cert_comp);
free_cert_comp:
kfree(cert_comp);
- return NULL;
+ return ERR_PTR(ret);
}
static void cert_comp_release(struct kref *kref)
@@ -73,8 +80,6 @@ static void cert_comp_release(struct kref *kref)
struct cert_comp *cert_comp = container_of(kref, struct cert_comp, kref);
struct amdxdna_dev_hdl *ndev = cert_comp->ndev;
- drm_WARN_ON(&ndev->aie.xdna->ddev, !mutex_is_locked(&ndev->cert_comp_lock));
-
xa_erase(&ndev->cert_comp_xa, cert_comp->msix_idx);
aie4_free_notification(cert_comp);
kfree(cert_comp);
@@ -82,20 +87,41 @@ static void cert_comp_release(struct kref *kref)
static void aie4_put_cert_comp(struct cert_comp *cert_comp)
{
- struct amdxdna_dev_hdl *ndev;
+ struct amdxdna_dev_hdl *ndev = cert_comp->ndev;
- ndev = cert_comp->ndev;
guard(mutex)(&ndev->cert_comp_lock);
kref_put(&cert_comp->kref, cert_comp_release);
}
-static int aie4_msg_destroy_context(struct amdxdna_dev_hdl *ndev, u32 hw_context_id)
+static struct cert_comp *aie4_get_cert_comp(struct amdxdna_hwctx *hwctx)
+{
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+ struct cert_comp *cert_comp;
+
+ /* Take io_lock to serialize against cert_comp link/unlink. */
+ guard(mutex)(&priv->io_lock);
+
+ cert_comp = READ_ONCE(priv->cert_comp);
+ if (cert_comp)
+ kref_get(&cert_comp->kref);
+
+ return cert_comp;
+}
+
+static void aie4_msg_destroy_context(struct amdxdna_dev_hdl *ndev, u32 hw_context_id)
{
DECLARE_AIE_MSG(aie4_msg_destroy_hw_context, AIE4_MSG_OP_DESTROY_HW_CONTEXT);
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+ int ret;
+
+ if (hw_context_id == CTX_INVALID_ID)
+ return;
req.hw_context_id = hw_context_id;
- return aie_send_mgmt_msg_wait(&ndev->aie, &msg);
+ ret = aie_send_mgmt_msg_wait(&ndev->aie, &msg);
+ if (ret)
+ XDNA_WARN(xdna, "destroy ctx id %d failed %d", hw_context_id, ret);
}
static u8 aie4_parse_priority_to_dev(u32 priority)
@@ -114,19 +140,20 @@ static u8 aie4_parse_priority_to_dev(u32 priority)
}
}
-static int aie4_hwctx_create(struct amdxdna_hwctx *hwctx)
+int aie4_hwctx_create(struct amdxdna_hwctx *hwctx)
{
DECLARE_AIE_MSG(aie4_msg_create_hw_context, AIE4_MSG_OP_CREATE_HW_CONTEXT);
struct amdxdna_client *client = hwctx->client;
struct amdxdna_hwctx_priv *priv = hwctx->priv;
- struct amdxdna_dev *xdna = hwctx->client->xdna;
+ struct amdxdna_dev *xdna = client->xdna;
struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
+ struct cert_comp *cert_comp;
int ret;
drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
if (!ndev->partition_id || !hwctx->num_tiles) {
- XDNA_ERR(xdna, "invalid request partition_id %d, num_tiles %d",
+ XDNA_ERR(xdna, "invalid request partition_id %u, num_tiles %d",
ndev->partition_id, hwctx->num_tiles);
return -EINVAL;
}
@@ -136,7 +163,6 @@ static int aie4_hwctx_create(struct amdxdna_hwctx *hwctx)
req.pasid = aie4_msg_pasid(client);
req.pasid = req.pasid == IOMMU_PASID_INVALID ? 0 : req.pasid;
req.priority_band = aie4_parse_priority_to_dev(hwctx->qos.priority);
-
req.hsa_addr_high = upper_32_bits(amdxdna_gem_dev_addr(priv->umq_bo));
req.hsa_addr_low = lower_32_bits(amdxdna_gem_dev_addr(priv->umq_bo));
@@ -150,72 +176,142 @@ static int aie4_hwctx_create(struct amdxdna_hwctx *hwctx)
}
XDNA_DBG(xdna, "resp msix: %d, ctx id: %d, doorbell: %d",
- resp.job_complete_msix_idx,
- resp.hw_context_id,
+ resp.job_complete_msix_idx, resp.hw_context_id,
resp.doorbell_offset);
/* setup interrupt completion per msix index */
- priv->cert_comp = aie4_lookup_cert_comp(ndev, resp.job_complete_msix_idx);
- if (!priv->cert_comp) {
+ cert_comp = aie4_lookup_cert_comp(ndev, resp.job_complete_msix_idx);
+ if (IS_ERR(cert_comp)) {
aie4_msg_destroy_context(ndev, resp.hw_context_id);
- return -EINVAL;
+ return PTR_ERR(cert_comp);
}
priv->hw_ctx_id = resp.hw_context_id;
- hwctx->doorbell_offset = AMDXDNA_INVALID_DOORBELL_OFFSET;
+
+ hwctx->fw_ctx_id = resp.hw_context_id;
+ hwctx->start_col = 0;
+ hwctx->num_col = ndev->total_col;
+
+ /* Set up driver doorbell and return invalid offset to userspace. */
+ mutex_lock(&priv->io_lock);
+ ret = aie4_doorbell_setup(hwctx, &resp);
+ if (ret) {
+ mutex_unlock(&priv->io_lock);
+ aie4_msg_destroy_context(ndev, resp.hw_context_id);
+ aie4_put_cert_comp(cert_comp);
+ priv->hw_ctx_id = CTX_INVALID_ID;
+ hwctx->fw_ctx_id = -1;
+ return ret;
+ }
+ WRITE_ONCE(priv->cert_comp, cert_comp);
+ mutex_unlock(&priv->io_lock);
+ hwctx->doorbell_offset = CTX_INVALID_DOORBELL;
+ wake_up_all(&priv->job_list_wq);
return 0;
}
-static void aie4_hwctx_destroy(struct amdxdna_hwctx *hwctx)
+void aie4_hwctx_destroy(struct amdxdna_hwctx *hwctx, enum aie4_hwctx_flags flags)
{
struct amdxdna_client *client = hwctx->client;
struct amdxdna_hwctx_priv *priv = hwctx->priv;
struct amdxdna_dev *xdna = client->xdna;
struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
+ struct cert_comp *cert_comp;
drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
- aie4_msg_destroy_context(ndev, priv->hw_ctx_id);
- aie4_put_cert_comp(priv->cert_comp);
+ mutex_lock(&priv->io_lock);
+ cert_comp = priv->cert_comp;
+ WRITE_ONCE(priv->cert_comp, NULL);
+ mutex_unlock(&priv->io_lock);
+
+ if (cert_comp)
+ wake_up_all(&cert_comp->waitq);
+
+ if (flags != AIE4_HWCTX_DISCONNECT)
+ aie4_msg_destroy_context(ndev, priv->hw_ctx_id);
+
+ if (cert_comp)
+ aie4_put_cert_comp(cert_comp);
+
+ priv->hw_ctx_id = CTX_INVALID_ID;
+ hwctx->fw_ctx_id = -1;
+ hwctx->doorbell_offset = CTX_INVALID_DOORBELL;
+
+ cancel_work_sync(&priv->job_work);
}
static void aie4_hwctx_umq_fini(struct amdxdna_hwctx *hwctx)
{
if (hwctx->priv && hwctx->priv->umq_bo)
- amdxdna_gem_put_obj(hwctx->priv->umq_bo);
+ drm_gem_object_put(to_gobj(hwctx->priv->umq_bo));
}
static int aie4_hwctx_umq_init(struct amdxdna_hwctx *hwctx)
{
+ const size_t indir_pkts_sz = CTX_MAX_CMDS * HSA_MAX_LEVEL1_INDIRECT_ENTRIES *
+ sizeof(struct host_indirect_packet_data);
+ const size_t pkts_sz = CTX_MAX_CMDS * sizeof(struct host_queue_packet);
struct amdxdna_hwctx_priv *priv = hwctx->priv;
struct amdxdna_dev *xdna = hwctx->client->xdna;
struct amdxdna_gem_obj *umq_bo;
struct host_queue_header *qhdr;
+ u64 data_dev_addr;
+ void *umq_va;
int ret;
+ int i;
+ /* Queue lives in user-allocated BO so device can access it under PASID. */
umq_bo = amdxdna_gem_get_obj(hwctx->client, hwctx->umq_bo_hdl, AMDXDNA_BO_SHARE);
if (!umq_bo) {
XDNA_ERR(xdna, "cannot find umq_bo handle %d", hwctx->umq_bo_hdl);
return -ENOENT;
}
- if (umq_bo->mem.size < sizeof(*qhdr)) {
- XDNA_ERR(xdna, "umq_bo size is too small");
+
+ /* Ensure user BO can hold queue header and direct/indirect packet arrays. */
+ if (umq_bo->mem.size < sizeof(*qhdr) ||
+ (umq_bo->mem.size < sizeof(*qhdr) + pkts_sz + indir_pkts_sz)) {
+ XDNA_ERR(xdna, "umq_bo size %zu is too small",
+ (size_t)umq_bo->mem.size);
ret = -EINVAL;
goto put_umq_bo;
}
- /* get kva address for host queue read index and write index */
- qhdr = amdxdna_gem_vmap(umq_bo);
- if (!qhdr) {
+ umq_va = amdxdna_gem_vmap(umq_bo);
+ if (!umq_va) {
ret = -ENOMEM;
goto put_umq_bo;
}
+ qhdr = umq_va;
priv->umq_bo = umq_bo;
priv->umq_read_index = &qhdr->read_index;
priv->umq_write_index = &qhdr->write_index;
+ /* Lay out direct packets after header, followed by indirect packets. */
+ data_dev_addr = amdxdna_gem_dev_addr(umq_bo) + sizeof(*qhdr);
+ priv->umq_pkts = umq_va + sizeof(*qhdr);
+ priv->umq_indirect_pkts = umq_va + sizeof(*qhdr) + pkts_sz;
+ priv->umq_indirect_pkts_dev_addr = data_dev_addr + pkts_sz;
+
+ /* Clear only the driver-managed header and packet regions. */
+ memset(umq_va, 0, sizeof(*qhdr) + pkts_sz + indir_pkts_sz);
+ priv->write_index = QUEUE_INDEX_START;
+ qhdr->read_index = QUEUE_INDEX_START;
+ qhdr->write_index = QUEUE_INDEX_START;
+ qhdr->version.major = HOST_QUEUE_MAJOR_VERSION;
+ qhdr->version.minor = HOST_QUEUE_MINOR_VERSION;
+ qhdr->capacity = CTX_MAX_CMDS;
+ qhdr->data_address = data_dev_addr;
+ for (i = 0; i < CTX_MAX_CMDS; i++)
+ priv->umq_pkts[i].pkt_header.common_header.opcode = OPCODE_EXEC_BUF;
+ for (i = 0; i < CTX_MAX_CMDS * HSA_MAX_LEVEL1_INDIRECT_ENTRIES; i++) {
+ priv->umq_indirect_pkts[i].header.opcode = OPCODE_EXEC_BUF;
+ priv->umq_indirect_pkts[i].header.count = sizeof(struct exec_buf);
+ priv->umq_indirect_pkts[i].header.distribute = 1;
+ }
+
return 0;
put_umq_bo:
@@ -227,28 +323,52 @@ int aie4_hwctx_init(struct amdxdna_hwctx *hwctx)
{
struct amdxdna_client *client = hwctx->client;
struct amdxdna_dev *xdna = client->xdna;
+ struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
struct amdxdna_hwctx_priv *priv;
int ret;
+ if (!AIE_FEATURE_ON(&ndev->aie, AIE4_HSA_COMMAND))
+ return -EOPNOTSUPP;
+
priv = kzalloc_obj(*priv);
if (!priv)
return -ENOMEM;
hwctx->priv = priv;
+ priv->hwctx = hwctx;
+
+ /* Initialize io_lock guarding cert_comp binding. */
+ mutex_init(&priv->io_lock);
+
+ INIT_LIST_HEAD(&priv->pending_job_list);
+ INIT_LIST_HEAD(&priv->running_job_list);
+ init_waitqueue_head(&priv->job_list_wq);
+ INIT_WORK(&priv->job_work, job_worker);
ret = aie4_hwctx_umq_init(hwctx);
if (ret)
- goto free_priv;
+ goto destroy_lock;
ret = aie4_hwctx_create(hwctx);
if (ret)
goto umq_fini;
- XDNA_DBG(xdna, "hwctx %s init completed", hwctx->name);
+ priv->job_work_q = alloc_ordered_workqueue("aie4_job_%d_%d", 0,
+ client->pid, hwctx->fw_ctx_id);
+ if (!priv->job_work_q) {
+ XDNA_ERR(xdna, "Create job_work_q failed");
+ ret = -ENOMEM;
+ goto destroy_ctx;
+ }
+
+ XDNA_DBG(xdna, "hwctx %d.%d init completed", client->pid, hwctx->fw_ctx_id);
return 0;
+destroy_ctx:
+ aie4_hwctx_destroy(hwctx, AIE4_HWCTX_NORMAL);
umq_fini:
aie4_hwctx_umq_fini(hwctx);
-free_priv:
+destroy_lock:
+ mutex_destroy(&priv->io_lock);
kfree(priv);
hwctx->priv = NULL;
return ret;
@@ -256,8 +376,14 @@ int aie4_hwctx_init(struct amdxdna_hwctx *hwctx)
void aie4_hwctx_fini(struct amdxdna_hwctx *hwctx)
{
- aie4_hwctx_destroy(hwctx);
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+
+ aie4_hwctx_destroy(hwctx, AIE4_HWCTX_ERROR);
+ cancel_work_sync(&priv->job_work);
+ if (priv->job_work_q)
+ destroy_workqueue(priv->job_work_q);
aie4_hwctx_umq_fini(hwctx);
+ mutex_destroy(&priv->io_lock);
kfree(hwctx->priv);
}
@@ -301,10 +427,12 @@ static inline bool check_cmd_done(struct amdxdna_hwctx *hwctx, u64 seq)
int aie4_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq, u32 timeout)
{
unsigned long wait_jifs = MAX_SCHEDULE_TIMEOUT;
- struct amdxdna_hwctx_priv *priv = hwctx->priv;
- struct cert_comp *cert_comp = priv->cert_comp;
+ struct cert_comp *cert_comp = aie4_get_cert_comp(hwctx);
long ret;
+ if (!cert_comp)
+ return -EAGAIN;
+
if (timeout)
wait_jifs = msecs_to_jiffies(timeout);
@@ -315,5 +443,7 @@ int aie4_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq, u32 timeout)
if (!ret)
ret = -ETIME;
+ aie4_put_cert_comp(cert_comp);
+
return ret <= 0 ? ret : 0;
}
diff --git a/drivers/accel/amdxdna/aie4_host_queue.h b/drivers/accel/amdxdna/aie4_host_queue.h
index 95ebbb714c6f..d2ed2fd65fb1 100644
--- a/drivers/accel/amdxdna/aie4_host_queue.h
+++ b/drivers/accel/amdxdna/aie4_host_queue.h
@@ -6,9 +6,14 @@
#ifndef _AIE4_HOST_QUEUE_H_
#define _AIE4_HOST_QUEUE_H_
+#include <linux/bits.h>
#include <linux/types.h>
#define CTX_MAX_CMDS 32
+#define HSA_MAX_LEVEL1_INDIRECT_ENTRIES 6
+#define QUEUE_INDEX_START 0
+#define HOST_QUEUE_MAJOR_VERSION 1
+#define HOST_QUEUE_MINOR_VERSION 0
/* Host queue header layout. */
struct host_queue_header {
@@ -24,4 +29,64 @@ struct host_queue_header {
__u64 data_address; /* The xdna dev addr for payload. */
} __packed;
+/* Payload for an OPCODE_EXEC_BUF host-queue packet (single command). */
+struct exec_buf {
+ u32 dtrace_buf_host_addr_low;
+ u32 dpu_control_code_host_addr_low;
+ u32 dpu_control_code_host_addr_high;
+ u16 args_len;
+ u16 dtrace_buf_host_addr_high;
+ u32 args_host_addr_low;
+ u32 args_host_addr_high;
+} __packed;
+
+#define OPCODE_EXEC_BUF 1
+#define CHAIN_FLG_LAST_CMD 0
+#define CHAIN_FLG_NOT_LAST_CMD 1
+struct common_header {
+ u16 reserved; /* MBZ. */
+ u8 opcode;
+ u8 chain_flag;
+ u16 count;
+ u8 distribute;
+ u8 indirect;
+} __packed;
+
+struct host_queue_packet_header {
+ struct common_header common_header;
+ u64 completion_signal;
+} __packed;
+
+struct host_queue_packet {
+ struct host_queue_packet_header pkt_header;
+ u32 data[12]; /* total 64-byte packet */
+} __packed;
+
+struct host_indirect_packet_entry {
+ u32 host_addr_low;
+ u32 host_addr_high_uc_index;
+} __packed;
+
+#define HIPE_HOST_ADDR_HIGH_SHIFT 0
+#define HIPE_HOST_ADDR_HIGH_MASK GENMASK(24, 0)
+#define HIPE_UC_INDEX_SHIFT 25
+#define HIPE_UC_INDEX_MASK GENMASK(31, 25)
+
+static inline void hipe_set_host_addr_high(u32 *val, u32 addr_hi)
+{
+ *val &= ~HIPE_HOST_ADDR_HIGH_MASK;
+ *val |= (addr_hi << HIPE_HOST_ADDR_HIGH_SHIFT) & HIPE_HOST_ADDR_HIGH_MASK;
+}
+
+static inline void hipe_set_uc_index(u32 *val, u32 uc_idx)
+{
+ *val &= ~HIPE_UC_INDEX_MASK;
+ *val |= (uc_idx << HIPE_UC_INDEX_SHIFT) & HIPE_UC_INDEX_MASK;
+}
+
+struct host_indirect_packet_data {
+ struct common_header header;
+ struct exec_buf payload;
+} __packed;
+
#endif /* _AIE4_HOST_QUEUE_H_ */
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index 9fcdfcc5a15f..8660f1a4d42e 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -8,7 +8,10 @@
#include <linux/device.h>
#include <linux/iopoll.h>
+#include <linux/list.h>
#include <linux/pci.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
#include "aie.h"
#include "aie4_msg_priv.h"
@@ -25,15 +28,45 @@ struct cert_comp {
wait_queue_head_t waitq;
};
+/*
+ * aie4 kernel-submission job states (stored in amdxdna_sched_job priv.aie4.state).
+ * Anonymous enum - the aie4_job_state identifier is already a field-access macro.
+ */
+enum {
+ AIE4_JOB_STATE_INIT,
+ AIE4_JOB_STATE_PENDING,
+ AIE4_JOB_STATE_SUBMITTING,
+ AIE4_JOB_STATE_SUBMITTED,
+ AIE4_JOB_STATE_DONE,
+};
+
struct amdxdna_hwctx_priv {
+ struct amdxdna_hwctx *hwctx;
struct amdxdna_gem_obj *umq_bo;
u64 *umq_read_index;
u64 *umq_write_index;
+ /* Last valid read_index fallback for torn or invalid samples. */
+ u64 last_read_index;
struct cert_comp *cert_comp;
u32 hw_ctx_id;
+ /* Direct and indirect packet storage aliasing umq_bo. */
+ u64 write_index;
+ struct host_queue_packet *umq_pkts;
+ struct host_indirect_packet_data *umq_indirect_pkts;
+ u64 umq_indirect_pkts_dev_addr;
+ /* Transport doorbell target set by aie4_doorbell_setup(). */
void __iomem *doorbell_addr;
+
+ struct mutex io_lock; /* serialize submit, protect job lists */
+ struct list_head pending_job_list;
+ /* Head of pending_job_list, read locklessly by wait conditions. */
+ struct amdxdna_sched_job *pending_head;
+ struct list_head running_job_list;
+ wait_queue_head_t job_list_wq;
+ struct work_struct job_work;
+ struct workqueue_struct *job_work_q;
};
struct amdxdna_dev_priv {
@@ -107,9 +140,18 @@ int aie4_set_ctx_hysteresis(struct amdxdna_dev_hdl *ndev, u32 timeout_us);
u32 aie4_msg_pasid(struct amdxdna_client *client);
/* aie4_ctx.c */
+enum aie4_hwctx_flags {
+ AIE4_HWCTX_NORMAL = 0,
+ AIE4_HWCTX_GRACEFUL,
+ AIE4_HWCTX_DISCONNECT, /* sets has_error, do not destroy context */
+ AIE4_HWCTX_ERROR, /* sets has_error, destroy context */
+};
+
int aie4_hwctx_init(struct amdxdna_hwctx *hwctx);
void aie4_hwctx_fini(struct amdxdna_hwctx *hwctx);
int aie4_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq, u32 timeout);
+int aie4_hwctx_create(struct amdxdna_hwctx *hwctx);
+void aie4_hwctx_destroy(struct amdxdna_hwctx *hwctx, enum aie4_hwctx_flags);
/* aie4_pci.c */
int aie4_restore_power_mode(struct amdxdna_dev_hdl *ndev);
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 13/20] accel/amdxdna: Prepare for AIE4 command submission
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (11 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 12/20] accel/amdxdna: Implement AIE4 kernel queue lifecycle and memory layout David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:35 ` sashiko-bot
2026-10-06 4:22 ` [PATCH V2 14/20] accel/amdxdna: Implement AIE4 command packet building and submission David Zhang
` (6 subsequent siblings)
19 siblings, 1 reply; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello, Wendy Liang
Prepare the data structures and completion wait helpers required for
AIE4 command submission:
- Define struct amdxdna_cmd_start_dpu in amdxdna_ctx.h for the
ERT_START_DPU payload.
- Extend union amdxdna_job_priv with an aie4 member for queue list
linkage and job state tracking.
- Implement smp_rmb() ordering and non-sleeping retry in
get_read_index(), returning the cached last_read_index instead of
zero when a torn read is detected.
- Update check_cmd_done() and aie4_cmd_wait() to detect asynchronous
device disconnect and reset via check_cert_comp_linked().
Co-developed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Max Zhen <max.zhen@amd.com>
Co-developed-by: Wendy Liang <wendy.liang@amd.com>
Signed-off-by: Wendy Liang <wendy.liang@amd.com>
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_ctx.c | 59 ++++++++++++++++++++---------
drivers/accel/amdxdna/amdxdna_ctx.h | 20 ++++++++++
2 files changed, 61 insertions(+), 18 deletions(-)
diff --git a/drivers/accel/amdxdna/aie4_ctx.c b/drivers/accel/amdxdna/aie4_ctx.c
index 226570367f71..0672aba7c195 100644
--- a/drivers/accel/amdxdna/aie4_ctx.c
+++ b/drivers/accel/amdxdna/aie4_ctx.c
@@ -394,34 +394,52 @@ static inline bool valid_queue_index(u64 read, u64 write, u32 capacity)
static u64 get_read_index(struct amdxdna_hwctx *hwctx)
{
- u64 wi = READ_ONCE(*hwctx->priv->umq_write_index);
- u64 ri = READ_ONCE(*hwctx->priv->umq_read_index);
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
struct amdxdna_dev *xdna = hwctx->client->xdna;
+ u64 ri, wi;
- /*
- * CERT cannot update read index as uint64 atomically. Driver may read
- * half-updated read index when it has bits in high 32bit. In case read
- * index is not valid, wait for some time and retry once. It should
- * allow CERT to complete the read index update.
- */
+ /* Sample read_index before write_index to guarantee wi >= ri. */
+ ri = READ_ONCE(*priv->umq_read_index);
+ /* Order the read_index sample before the write_index sample. */
+ smp_rmb();
+ wi = READ_ONCE(priv->write_index);
+
+ /* Non-atomic 64-bit counter update by CERT; re-sample once if invalid. */
if (!valid_queue_index(ri, wi, CTX_MAX_CMDS)) {
- XDNA_WARN(xdna, "Invalid index, ri %llu, wi %llu", ri, wi);
- usleep_range(100, 200);
- ri = READ_ONCE(*hwctx->priv->umq_read_index);
+ ri = READ_ONCE(*priv->umq_read_index);
+ /* Order the read_index sample before the write_index sample. */
+ smp_rmb();
+ wi = READ_ONCE(priv->write_index);
if (!valid_queue_index(ri, wi, CTX_MAX_CMDS)) {
- XDNA_ERR(xdna, "Invalid index after retry, ri %llu, wi %llu", ri, wi);
- ri = 0;
+ /* Fall back to cached read_index if sample is still invalid. */
+ XDNA_DBG(xdna, "Invalid index, ri %llu, wi %llu", ri, wi);
+ return READ_ONCE(priv->last_read_index);
}
}
+ /*
+ * Cache valid sample as fallback for torn reads. Lockless on purpose:
+ * a racing caller may store an older value, which only delays seeing
+ * a completion until the next wakeup, never reports one early.
+ */
+ WRITE_ONCE(priv->last_read_index, ri);
return ri;
}
-static inline bool check_cmd_done(struct amdxdna_hwctx *hwctx, u64 seq)
+/* Verify cert_comp remains linked to detect disconnect or reset. */
+static bool check_cert_comp_linked(struct amdxdna_hwctx *hwctx, struct cert_comp *comp)
{
- u64 read_idx = get_read_index(hwctx);
+ /* READ_ONCE pairs with the link/unlink WRITE_ONCE. */
+ return comp == READ_ONCE(hwctx->priv->cert_comp);
+}
- return read_idx > seq;
+static inline bool check_cmd_done(struct amdxdna_hwctx *hwctx, u64 seq, struct cert_comp *comp)
+{
+ /* Lockless check for wait_event condition; detects completion or disconnect. */
+ if (!check_cert_comp_linked(hwctx, comp))
+ return true;
+
+ return get_read_index(hwctx) > seq;
}
int aie4_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq, u32 timeout)
@@ -437,11 +455,16 @@ int aie4_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq, u32 timeout)
wait_jifs = msecs_to_jiffies(timeout);
ret = wait_event_interruptible_timeout(cert_comp->waitq,
- (check_cmd_done(hwctx, seq)),
+ check_cmd_done(hwctx, seq, cert_comp),
wait_jifs);
- if (!ret)
+ if (!ret) {
ret = -ETIME;
+ } else if (ret > 0 && !check_cert_comp_linked(hwctx, cert_comp) &&
+ get_read_index(hwctx) <= seq) {
+ /* Disconnect (suspend or TDR) before the command completed. */
+ ret = -EAGAIN;
+ }
aie4_put_cert_comp(cert_comp);
diff --git a/drivers/accel/amdxdna/amdxdna_ctx.h b/drivers/accel/amdxdna/amdxdna_ctx.h
index 9bbc3db4ebde..b3677851d1c5 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.h
+++ b/drivers/accel/amdxdna/amdxdna_ctx.h
@@ -48,6 +48,18 @@ struct amdxdna_cmd_start_npu {
u32 prop_args[]; /* properties and regular kernel arguments */
};
+/*
+ * struct amdxdna_cmd_start_dpu - interpretation of data payload for
+ * ERT_START_DPU in amdxdna_cmd.
+ */
+struct amdxdna_cmd_start_dpu {
+ u64 dtrace_buffer; /* dtrace buffer address 2 words */
+ u64 instruction_buffer; /* buffer address 2 words */
+ u32 instruction_buffer_size; /* size of buffer in bytes */
+ u16 uc_index; /* microblaze controller index */
+ u16 chained; /* number of following amdxdna_cmd_start_dpu elements */
+};
+
/*
* Interpretation of the beginning of data payload for ERT_CMD_CHAIN in
* amdxdna_cmd. The rest of the payload in amdxdna_cmd is cmd BO handles.
@@ -138,8 +150,14 @@ struct amdxdna_drv_cmd {
};
struct app_health_report;
+
union amdxdna_job_priv {
struct app_health_report *aie2_health;
+ /* aie4 kernel submission: queue linkage + job state */
+ struct {
+ struct list_head list;
+ u32 state;
+ } aie4;
};
struct amdxdna_sched_job {
@@ -162,6 +180,8 @@ struct amdxdna_sched_job {
};
#define aie2_job_health priv.aie2_health
+#define aie4_job_list priv.aie4.list
+#define aie4_job_state priv.aie4.state
static inline u32
amdxdna_cmd_get_op(struct amdxdna_gem_obj *abo)
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* Re: [PATCH V2 13/20] accel/amdxdna: Prepare for AIE4 command submission
2026-10-06 4:22 ` [PATCH V2 13/20] accel/amdxdna: Prepare for AIE4 command submission David Zhang
@ 2026-10-06 4:35 ` sashiko-bot
0 siblings, 0 replies; 31+ messages in thread
From: sashiko-bot @ 2026-10-06 4:35 UTC (permalink / raw)
To: David Zhang; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] amdxdna: monotonic regression in get_read_index() due to lockless update
--
commit 556cf69a63f5758be4c65cd88bedd02f3117e2ca
Author: David Zhang <yidong.zhang@amd.com>
accel/amdxdna: Prepare for AIE4 command submission
This commit prepares data structures and completion wait helpers for AIE4
command submission. It extends the amdxdna_job_priv structure and implements
an ordered retry mechanism in get_read_index() when a torn read is detected.
> diff --git a/drivers/accel/amdxdna/aie4_ctx.c b/drivers/accel/amdxdna/aie4_ctx.c
> --- a/drivers/accel/amdxdna/aie4_ctx.c
> +++ b/drivers/accel/amdxdna/aie4_ctx.c
[ ... ]
> static u64 get_read_index(struct amdxdna_hwctx *hwctx)
> {
[ ... ]
> + /*
> + * Cache valid sample as fallback for torn reads. Lockless on purpose:
> + * a racing caller may store an older value, which only delays seeing
> + * a completion until the next wakeup, never reports one early.
> + */
> + WRITE_ONCE(priv->last_read_index, ri);
[Severity: Medium]
Can this lockless assignment allow concurrent get_read_index() callers to
overwrite a newer completion index with an older one?
For example, if Thread A reads ri=10, and Thread B reads ri=11 and writes
last_read_index=11, could Thread A then execute this assignment and write
last_read_index=10? This appears to cause last_read_index to go backward.
> return ri;
> }
[ ... ]
> int aie4_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq, u32 timeout)
> {
[ ... ]
> - if (!ret)
> + if (!ret) {
> ret = -ETIME;
> + } else if (ret > 0 && !check_cert_comp_linked(hwctx, cert_comp) &&
> + get_read_index(hwctx) <= seq) {
[Severity: Medium]
If last_read_index went backward as described above, could this check
falsely evaluate to true?
If a torn read falls back to the stale last_read_index while the device
disconnects or suspends, it seems a successfully completed command might
incorrectly fail and return -EAGAIN.
> + /* Disconnect (suspend or TDR) before the command completed. */
> + ret = -EAGAIN;
> + }
>
> aie4_put_cert_comp(cert_comp);
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261006042230.547807-1-yidong.zhang@amd.com?part=13
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH V2 14/20] accel/amdxdna: Implement AIE4 command packet building and submission
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (12 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 13/20] accel/amdxdna: Prepare for AIE4 command submission David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:41 ` sashiko-bot
2026-10-06 7:12 ` Eva Crystal
2026-10-06 4:22 ` [PATCH V2 15/20] accel/amdxdna: Make hmm_invalidate common for AIE2 and AIE4 David Zhang
` (5 subsequent siblings)
19 siblings, 2 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello, Wendy Liang
Implement kernel-mode command submission and hardware queue packet
assembly for AIE4:
- Add aie4_cmd_submit() to validate incoming command buffers, reserve
GEM fences, serialize submissions via the context pending list, and
dispatch to the hardware queue.
- Lock all job BOs and attach job->fence directly to their reservation
objects.
- In amdxdna_fence_create(), allocate a unique timeline context per job.
- In amdxdna_fence_get_timeline_name(), return KBUILD_MODNAME rather than
a dynamic name to satisfy dma_fence lifetime guarantees if a fence
outlives the context or device.
- Implement packet encoders: fill_direct_pkt() and fill_indirect_pkt(),
validating that dtrace buffer addresses do not exceed the 48-bit
hardware packet limit.
- Advance the hardware write index, ring the doorbell, and register
in-flight jobs on the running list for completion tracking.
- Add aie4_hwctx_wait_for_running() with timeout to safely quiesce worker
threads.
- Add .hwctx_stop callback to struct amdxdna_dev_ops and invoke it prior
to synchronize_srcu() in amdxdna_hwctx_destroy_rcu() and
amdxdna_hwctx_remove_all() to wake cmd_wait waiters and prevent circular
deadlock with dev_lock. Guard aie4_hwctx_stop() against repeated
invocation and avoid calling it a second time in aie4_hwctx_fini().
- Enqueue partially submitted command chains to the running list so the
job worker reaps published commands and safely aborts them without
prematurely freeing job resources.
- Hold references to sub-command BOs in chained submissions until job
release to prevent use-after-free and DMA writeback to freed memory.
- Pre-validate all sub-command BOs and payloads upfront before dispatching
packets to the hardware queue.
- Avoid prematurely setting has_error on partial chain submission failure
so the worker safely reaps published commands without racing hardware.
- Return -EAGAIN in aie4_cmd_wait() when unblocked before hardware
completion.
Job completion is not yet bounded by a timeout. A job that never
completes in hardware, including a partially submitted chain, keeps
its fence unsignaled until the hardware context is stopped,
destroyed or suspended, at which point all running jobs are aborted
and their fences signaled with -ECANCELED. Job timeout detection
and recovery (TDR) will be added in a follow-up change to guarantee
the fence signaling in finite time.
Co-developed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Max Zhen <max.zhen@amd.com>
Co-developed-by: Wendy Liang <wendy.liang@amd.com>
Signed-off-by: Wendy Liang <wendy.liang@amd.com>
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_ctx.c | 688 +++++++++++++++++++++++-
drivers/accel/amdxdna/aie4_pci.c | 4 +
drivers/accel/amdxdna/aie4_pci.h | 4 +
drivers/accel/amdxdna/amdxdna_ctx.c | 25 +-
drivers/accel/amdxdna/amdxdna_ctx.h | 6 +-
drivers/accel/amdxdna/amdxdna_pci_drv.h | 1 +
6 files changed, 711 insertions(+), 17 deletions(-)
diff --git a/drivers/accel/amdxdna/aie4_ctx.c b/drivers/accel/amdxdna/aie4_ctx.c
index 0672aba7c195..882938d368ef 100644
--- a/drivers/accel/amdxdna/aie4_ctx.c
+++ b/drivers/accel/amdxdna/aie4_ctx.c
@@ -25,9 +25,7 @@
#define CTX_INVALID_ID (~0U)
#define CTX_INVALID_DOORBELL AMDXDNA_INVALID_DOORBELL_OFFSET
-static void job_worker(struct work_struct *work)
-{
-}
+static void job_worker(struct work_struct *work);
static struct cert_comp *aie4_lookup_cert_comp(struct amdxdna_dev_hdl *ndev, u32 msix_idx)
{
@@ -203,6 +201,7 @@ int aie4_hwctx_create(struct amdxdna_hwctx *hwctx)
hwctx->fw_ctx_id = -1;
return ret;
}
+ WRITE_ONCE(priv->has_error, false);
WRITE_ONCE(priv->cert_comp, cert_comp);
mutex_unlock(&priv->io_lock);
hwctx->doorbell_offset = CTX_INVALID_DOORBELL;
@@ -211,6 +210,17 @@ int aie4_hwctx_create(struct amdxdna_hwctx *hwctx)
return 0;
}
+/* Linked cert_comp acts as connected sentinel for submit waiters. */
+static bool aie4_hwctx_connected(struct amdxdna_hwctx *hwctx)
+{
+ return !!READ_ONCE(hwctx->priv->cert_comp);
+}
+
+static bool aie4_hwctx_has_error(struct amdxdna_hwctx *hwctx)
+{
+ return READ_ONCE(hwctx->priv->has_error);
+}
+
void aie4_hwctx_destroy(struct amdxdna_hwctx *hwctx, enum aie4_hwctx_flags flags)
{
struct amdxdna_client *client = hwctx->client;
@@ -218,10 +228,16 @@ void aie4_hwctx_destroy(struct amdxdna_hwctx *hwctx, enum aie4_hwctx_flags flags
struct amdxdna_dev *xdna = client->xdna;
struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
struct cert_comp *cert_comp;
+ bool has_error = false;
drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+ if (flags == AIE4_HWCTX_DISCONNECT || flags == AIE4_HWCTX_ERROR)
+ has_error = true;
+
mutex_lock(&priv->io_lock);
+ if (has_error)
+ WRITE_ONCE(priv->has_error, true);
cert_comp = priv->cert_comp;
WRITE_ONCE(priv->cert_comp, NULL);
mutex_unlock(&priv->io_lock);
@@ -229,6 +245,9 @@ void aie4_hwctx_destroy(struct amdxdna_hwctx *hwctx, enum aie4_hwctx_flags flags
if (cert_comp)
wake_up_all(&cert_comp->waitq);
+ if (has_error)
+ wake_up_all(&priv->job_list_wq);
+
if (flags != AIE4_HWCTX_DISCONNECT)
aie4_msg_destroy_context(ndev, priv->hw_ctx_id);
@@ -239,7 +258,9 @@ void aie4_hwctx_destroy(struct amdxdna_hwctx *hwctx, enum aie4_hwctx_flags flags
hwctx->fw_ctx_id = -1;
hwctx->doorbell_offset = CTX_INVALID_DOORBELL;
- cancel_work_sync(&priv->job_work);
+ /* Skip cancel_work_sync on error so worker can abort in-flight jobs. */
+ if (!has_error)
+ cancel_work_sync(&priv->job_work);
}
static void aie4_hwctx_umq_fini(struct amdxdna_hwctx *hwctx)
@@ -374,14 +395,25 @@ int aie4_hwctx_init(struct amdxdna_hwctx *hwctx)
return ret;
}
-void aie4_hwctx_fini(struct amdxdna_hwctx *hwctx)
+void aie4_hwctx_stop(struct amdxdna_hwctx *hwctx)
{
struct amdxdna_hwctx_priv *priv = hwctx->priv;
+ if (priv->hw_ctx_id == CTX_INVALID_ID)
+ return;
+
+ /* Mark error to drain running jobs and unlink cert_comp to wake waiters. */
aie4_hwctx_destroy(hwctx, AIE4_HWCTX_ERROR);
- cancel_work_sync(&priv->job_work);
- if (priv->job_work_q)
+}
+
+void aie4_hwctx_fini(struct amdxdna_hwctx *hwctx)
+{
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+
+ if (priv->job_work_q) {
+ aie4_hwctx_wait_for_running(hwctx);
destroy_workqueue(priv->job_work_q);
+ }
aie4_hwctx_umq_fini(hwctx);
mutex_destroy(&priv->io_lock);
kfree(hwctx->priv);
@@ -470,3 +502,645 @@ int aie4_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq, u32 timeout)
return ret <= 0 ? ret : 0;
}
+
+/* ---- kernel-mode submission (driver fills the queue and rings doorbell) ---- */
+
+/* Publish a command to CERT and return the assigned command sequence (slot). */
+static u64 publish_cmd(struct amdxdna_hwctx *hwctx)
+{
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+ u64 wi = priv->write_index;
+
+ /* Paired with the lockless READ_ONCE() readers of write_index. */
+ WRITE_ONCE(priv->write_index, wi + 1);
+ /* Order the packet-slot writes before CERT sees the new write_index. */
+ wmb();
+ WRITE_ONCE(*priv->umq_write_index, wi + 1);
+ return wi;
+}
+
+static int wait_till_seq_completed(struct amdxdna_hwctx *hwctx, u64 seq)
+{
+ struct cert_comp *cert_comp;
+ int ret;
+
+ /* Wait for queue slot; freezable for suspend, interruptible for signals. */
+ cert_comp = aie4_get_cert_comp(hwctx);
+ if (!cert_comp)
+ return -EAGAIN;
+
+ ret = wait_event_freezable(cert_comp->waitq,
+ check_cmd_done(hwctx, seq, cert_comp));
+ if (ret) {
+ aie4_put_cert_comp(cert_comp);
+ return ret; /* -ERESTARTSYS: signal on the submit path */
+ }
+
+ if (check_cert_comp_linked(hwctx, cert_comp))
+ ret = 0; /* real completion */
+ else
+ ret = -EAGAIN; /* disconnect (suspend or TDR) */
+
+ aie4_put_cert_comp(cert_comp);
+ return ret;
+}
+
+static int wait_till_connected_hsa_not_full(struct amdxdna_hwctx *hwctx)
+{
+ struct amdxdna_dev *xdna = hwctx->client->xdna;
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+ u64 wi = READ_ONCE(priv->write_index);
+ bool hsa_not_full = !!(wi < CTX_MAX_CMDS);
+ int ret;
+
+ do {
+ mutex_unlock(&priv->io_lock);
+ if (!hsa_not_full) {
+ ret = wait_till_seq_completed(hwctx, wi - CTX_MAX_CMDS);
+ if (ret && ret != -EAGAIN) {
+ mutex_lock(&priv->io_lock);
+ return ret;
+ }
+ if (!ret)
+ hsa_not_full = true;
+ }
+ ret = wait_event_freezable(priv->job_list_wq,
+ aie4_hwctx_connected(hwctx) ||
+ aie4_hwctx_has_error(hwctx));
+ mutex_lock(&priv->io_lock);
+ if (ret)
+ return ret;
+ if (aie4_hwctx_has_error(hwctx)) {
+ XDNA_DBG(xdna, "ctx %s in error; unwinding -ENODEV",
+ hwctx->name);
+ return -ENODEV;
+ }
+ } while (!hsa_not_full || !aie4_hwctx_connected(hwctx));
+
+ return 0;
+}
+
+static int fill_indirect_pkt(struct amdxdna_hwctx_priv *priv, u64 slot_idx,
+ u32 total_slots, struct amdxdna_cmd_start_dpu *dpu,
+ u16 entries)
+{
+ struct host_queue_packet *pkt = &priv->umq_pkts[slot_idx];
+ struct host_indirect_packet_entry *hipe =
+ (struct host_indirect_packet_entry *)(pkt->data);
+ u16 i;
+
+ if (!entries || entries > HSA_MAX_LEVEL1_INDIRECT_ENTRIES) {
+ XDNA_ERR(priv->hwctx->client->xdna, "Invalid indirect entries %u", entries);
+ return -EINVAL;
+ }
+
+ for (i = 0; i < entries; i++, dpu++, hipe++) {
+ struct host_indirect_packet_data *hipd;
+ u64 indirect_pkt_dev_addr;
+ u32 uci = READ_ONCE(dpu->uc_index);
+ u64 dtrace_buf = READ_ONCE(dpu->dtrace_buffer);
+ u64 inst_buf = READ_ONCE(dpu->instruction_buffer);
+ u32 idx;
+
+ /* Validate uc_index against indirect packet bounds before publication. */
+ if (uci >= HSA_MAX_LEVEL1_INDIRECT_ENTRIES) {
+ XDNA_ERR(priv->hwctx->client->xdna, "Invalid uc index %d", uci);
+ return -EINVAL;
+ }
+ if (upper_32_bits(dtrace_buf) > U16_MAX) {
+ XDNA_ERR(priv->hwctx->client->xdna,
+ "Invalid dtrace buffer address 0x%llx", dtrace_buf);
+ return -EINVAL;
+ }
+ idx = uci * total_slots + slot_idx;
+ hipd = &priv->umq_indirect_pkts[idx];
+ indirect_pkt_dev_addr = priv->umq_indirect_pkts_dev_addr +
+ sizeof(struct host_indirect_packet_data) * idx;
+
+ /* Point the indirect entry at the indirect packet. */
+ hipe->host_addr_low = lower_32_bits(indirect_pkt_dev_addr);
+ hipe_set_host_addr_high(&hipe->host_addr_high_uc_index,
+ upper_32_bits(indirect_pkt_dev_addr));
+ hipe_set_uc_index(&hipe->host_addr_high_uc_index, uci);
+
+ /* Fill in the indirect packet. */
+ hipd->payload.dpu_control_code_host_addr_low =
+ lower_32_bits(inst_buf);
+ hipd->payload.dpu_control_code_host_addr_high =
+ upper_32_bits(inst_buf);
+ hipd->payload.dtrace_buf_host_addr_low =
+ lower_32_bits(dtrace_buf);
+ hipd->payload.dtrace_buf_host_addr_high =
+ lower_16_bits(upper_32_bits(dtrace_buf));
+ }
+ pkt->pkt_header.common_header.distribute = 1;
+ pkt->pkt_header.common_header.indirect = 1;
+ pkt->pkt_header.common_header.count = entries * sizeof(*hipe);
+ return 0;
+}
+
+static int fill_direct_pkt(struct amdxdna_hwctx_priv *priv, u64 slot_idx,
+ struct amdxdna_cmd_start_dpu *dpu)
+{
+ struct host_queue_packet *pkt = &priv->umq_pkts[slot_idx];
+ struct exec_buf *ebuf = (struct exec_buf *)(pkt->data);
+ u64 dtrace_buf = READ_ONCE(dpu->dtrace_buffer);
+ u64 inst_buf = READ_ONCE(dpu->instruction_buffer);
+
+ if (upper_32_bits(dtrace_buf) > U16_MAX) {
+ XDNA_ERR(priv->hwctx->client->xdna,
+ "Invalid dtrace buffer address 0x%llx", dtrace_buf);
+ return -EINVAL;
+ }
+
+ memset(pkt->data, 0, sizeof(pkt->data));
+ ebuf->dpu_control_code_host_addr_low = lower_32_bits(inst_buf);
+ ebuf->dpu_control_code_host_addr_high = upper_32_bits(inst_buf);
+ ebuf->dtrace_buf_host_addr_low = lower_32_bits(dtrace_buf);
+ ebuf->dtrace_buf_host_addr_high = lower_16_bits(upper_32_bits(dtrace_buf));
+ pkt->pkt_header.common_header.distribute = 0;
+ pkt->pkt_header.common_header.indirect = 0;
+ pkt->pkt_header.common_header.count = sizeof(*ebuf);
+ return 0;
+}
+
+static int validate_cmd_abo(struct amdxdna_dev *xdna, struct amdxdna_gem_obj *cmd_abo,
+ u16 *chained_cnt)
+{
+ struct amdxdna_cmd_start_dpu *dpu;
+ u32 payload_size;
+ u16 chained;
+ u32 op;
+ u16 i;
+
+ op = amdxdna_cmd_get_op(cmd_abo);
+ if (op != ERT_START_DPU) {
+ XDNA_ERR(xdna, "Invalid exec buf op, %d", op);
+ return -EINVAL;
+ }
+
+ dpu = amdxdna_cmd_get_payload(cmd_abo, &payload_size);
+ if (!dpu) {
+ XDNA_ERR(xdna, "Invalid DPU payload");
+ return -EINVAL;
+ }
+ chained = READ_ONCE(dpu->chained);
+ if (chained >= HSA_MAX_LEVEL1_INDIRECT_ENTRIES ||
+ payload_size < (u32)(chained + 1) * sizeof(*dpu)) {
+ XDNA_ERR(xdna, "Invalid DPU chained entries %u, payload %u",
+ chained, payload_size);
+ return -EINVAL;
+ }
+
+ if (!chained) {
+ u64 dtrace_buf = READ_ONCE(dpu->dtrace_buffer);
+
+ if (upper_32_bits(dtrace_buf) > U16_MAX) {
+ XDNA_ERR(xdna, "Invalid dtrace buffer address 0x%llx", dtrace_buf);
+ return -EINVAL;
+ }
+ } else {
+ for (i = 0; i <= chained; i++) {
+ u32 uci = READ_ONCE(dpu[i].uc_index);
+ u64 dtrace_buf = READ_ONCE(dpu[i].dtrace_buffer);
+
+ if (uci >= HSA_MAX_LEVEL1_INDIRECT_ENTRIES) {
+ XDNA_ERR(xdna, "Invalid uc index %u", uci);
+ return -EINVAL;
+ }
+ if (upper_32_bits(dtrace_buf) > U16_MAX) {
+ XDNA_ERR(xdna, "Invalid dtrace buffer address 0x%llx", dtrace_buf);
+ return -EINVAL;
+ }
+ }
+ }
+
+ if (chained_cnt)
+ *chained_cnt = chained;
+
+ return 0;
+}
+
+/* Build and submit one HSA command into the user host queue. Holds io_lock. */
+static int submit_one_cmd(struct amdxdna_hwctx *hwctx,
+ struct amdxdna_gem_obj *cmd_abo, bool last_of_chain,
+ u64 *seq)
+{
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+ struct amdxdna_dev *xdna = hwctx->client->xdna;
+ struct amdxdna_cmd_start_dpu *dpu;
+ struct host_queue_packet *pkt;
+ u64 slot_idx;
+ u16 chained;
+ int ret;
+
+ ret = validate_cmd_abo(xdna, cmd_abo, &chained);
+ if (ret)
+ return ret;
+
+ dpu = amdxdna_cmd_get_payload(cmd_abo, NULL);
+
+ /* Wait for queue slot and connected state. Drops and re-acquires io_lock. */
+ ret = wait_till_connected_hsa_not_full(hwctx);
+ if (ret) {
+ XDNA_DBG(xdna, "Wait for queue slot / ctx reconnect interrupted, ret %d", ret);
+ return ret;
+ }
+
+ slot_idx = priv->write_index & (CTX_MAX_CMDS - 1);
+ if (chained) {
+ ret = fill_indirect_pkt(priv, slot_idx, CTX_MAX_CMDS, dpu, chained + 1);
+ if (ret)
+ return ret;
+ } else {
+ ret = fill_direct_pkt(priv, slot_idx, dpu);
+ if (ret)
+ return ret;
+ }
+
+ pkt = &priv->umq_pkts[slot_idx];
+ pkt->pkt_header.common_header.opcode = OPCODE_EXEC_BUF;
+ pkt->pkt_header.common_header.chain_flag =
+ last_of_chain ? CHAIN_FLG_LAST_CMD : CHAIN_FLG_NOT_LAST_CMD;
+ pkt->pkt_header.common_header.reserved = 0x0;
+ pkt->pkt_header.completion_signal = amdxdna_gem_dev_addr(cmd_abo) +
+ offsetof(struct amdxdna_cmd, header);
+ *seq = publish_cmd(hwctx);
+ aie4_doorbell_ring(hwctx);
+ XDNA_DBG(xdna, "Submitted one cmd, %s seq %lld", hwctx->name, *seq);
+ return 0;
+}
+
+/* Peek head job without removing it from running list. */
+static struct amdxdna_sched_job *peek_running_job(struct amdxdna_hwctx *hwctx)
+{
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+ struct amdxdna_sched_job *job;
+
+ mutex_lock(&priv->io_lock);
+ job = list_first_entry_or_null(&priv->running_job_list,
+ struct amdxdna_sched_job, aie4_job_list);
+ mutex_unlock(&priv->io_lock);
+ return job;
+}
+
+/* Remove a job from the running list once it is completed or reaped. */
+static void dequeue_running_job(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job)
+{
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+
+ mutex_lock(&priv->io_lock);
+ list_del(&job->aie4_job_list);
+ mutex_unlock(&priv->io_lock);
+}
+
+static void aie4_job_release(struct kref *ref)
+{
+ struct amdxdna_sched_job *job =
+ container_of(ref, struct amdxdna_sched_job, refcnt);
+ u32 i;
+
+ for (i = 0; i < job->aie4_cmd_bo_cnt; i++)
+ amdxdna_gem_put_obj(job->aie4_cmd_bos[i]);
+ kfree(job->aie4_cmd_bos);
+
+ amdxdna_sched_job_cleanup(job);
+ if (job->out_fence)
+ dma_fence_put(job->out_fence);
+ kfree(job);
+}
+
+static void job_done(struct amdxdna_sched_job *job)
+{
+ job->aie4_job_state = AIE4_JOB_STATE_DONE;
+ dma_fence_signal(job->fence);
+ /* Release submitter mm reference taken at submit. */
+ mmput_async(job->mm);
+ kref_put(&job->refcnt, aie4_job_release);
+}
+
+static void job_complete(struct amdxdna_sched_job *job)
+{
+ job_done(job);
+}
+
+/* Advance read_index when disconnected to unblock waiters. */
+static void update_read_index(struct amdxdna_hwctx *hwctx, u64 idx)
+{
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+
+ /* Order cmd-bo state write before the waiter observes completion. */
+ wmb();
+ WRITE_ONCE(*priv->umq_read_index, idx);
+}
+
+static void job_abort(struct amdxdna_sched_job *job)
+{
+ struct amdxdna_hwctx *hwctx = job->hwctx;
+ u32 i;
+
+ XDNA_WARN(hwctx->client->xdna, "aborting %s job %lld", hwctx->name, job->seq);
+ amdxdna_cmd_set_state(job->cmd_bo, ERT_CMD_STATE_ABORT);
+ for (i = 0; i < job->aie4_cmd_bo_cnt; i++)
+ amdxdna_cmd_set_state(job->aie4_cmd_bos[i], ERT_CMD_STATE_ABORT);
+ dma_fence_set_error(job->fence, -ECANCELED);
+ /* Advance read_index only if CERT has not already moved past this job. */
+ if (get_read_index(hwctx) <= job->seq)
+ update_read_index(hwctx, job->seq + 1);
+ job_done(job);
+}
+
+/* Job timeout detection (TDR) will guarantee the fence signalling */
+static void job_worker(struct work_struct *work)
+{
+ struct amdxdna_hwctx_priv *priv =
+ container_of(work, struct amdxdna_hwctx_priv, job_work);
+ struct amdxdna_hwctx *hwctx = priv->hwctx;
+ struct amdxdna_sched_job *job;
+
+ while ((job = peek_running_job(hwctx))) {
+ wait_till_seq_completed(hwctx, job->seq);
+ if (get_read_index(hwctx) > job->seq) {
+ dequeue_running_job(hwctx, job);
+ /* Abort partially submitted jobs; complete fully submitted ones. */
+ if (job->aie4_job_state != AIE4_JOB_STATE_SUBMITTED)
+ job_abort(job);
+ else
+ job_complete(job);
+ } else if (aie4_hwctx_has_error(hwctx)) {
+ dequeue_running_job(hwctx, job);
+ job_abort(job);
+ } else {
+ /* suspend/resume */
+ break;
+ }
+ }
+}
+
+int aie4_hwctx_wait_for_running(struct amdxdna_hwctx *hwctx)
+{
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+ struct amdxdna_dev *xdna = hwctx->client->xdna;
+ struct amdxdna_sched_job *job;
+ long error;
+ int ret = 0;
+
+ mutex_lock(&priv->io_lock);
+ job = READ_ONCE(priv->pending_head);
+ if (job && job->aie4_job_state == AIE4_JOB_STATE_SUBMITTING) {
+ mutex_unlock(&priv->io_lock);
+ error = wait_event_timeout(priv->job_list_wq,
+ READ_ONCE(priv->pending_head) != job,
+ msecs_to_jiffies(2000));
+ if (!error) {
+ XDNA_WARN(xdna, "hwctx %s wait for submitting job timed out",
+ hwctx->name);
+ ret = -ETIMEDOUT;
+ }
+ } else {
+ mutex_unlock(&priv->io_lock);
+ }
+
+ queue_work(priv->job_work_q, &priv->job_work);
+ flush_work(&priv->job_work);
+ return ret;
+}
+
+/*
+ * Submit job command(s) to host queue. Called with io_lock held.
+ * Returns 0 on success or if partial chain is queued for worker abort.
+ */
+static int submit_job_cmds(struct amdxdna_hwctx *hwctx,
+ struct amdxdna_sched_job *job, u32 op)
+{
+ struct amdxdna_gem_obj *cmd_abo = job->cmd_bo;
+ struct amdxdna_dev *xdna = hwctx->client->xdna;
+ struct amdxdna_cmd_chain *payload;
+ u32 payload_len, ccnt;
+ int ret;
+ u32 i;
+
+ /* Single cmd. */
+ if (op == ERT_START_DPU) {
+ ret = submit_one_cmd(hwctx, cmd_abo, true, &job->seq);
+ if (!ret)
+ job->aie4_job_state = AIE4_JOB_STATE_SUBMITTED;
+ return ret;
+ }
+
+ /* Cmd chain. */
+ payload = amdxdna_cmd_get_payload(cmd_abo, &payload_len);
+ if (!payload) {
+ XDNA_ERR(xdna, "Invalid cmd payload for chained cmd");
+ return -EINVAL;
+ }
+ ccnt = READ_ONCE(payload->command_count);
+ /* A command chain cannot exceed queue capacity. */
+ if (!ccnt || ccnt > CTX_MAX_CMDS ||
+ payload_len < struct_size(payload, data, ccnt)) {
+ XDNA_ERR(xdna, "Invalid command count %u", ccnt);
+ return -EINVAL;
+ }
+
+ job->aie4_cmd_bos = kcalloc(ccnt, sizeof(*job->aie4_cmd_bos), GFP_KERNEL);
+ if (!job->aie4_cmd_bos)
+ return -ENOMEM;
+
+ /* Validate all sub-command BOs and payloads before dispatching packets. */
+ for (i = 0; i < ccnt; i++) {
+ u32 boh = (u32)(payload->data[i]);
+
+ job->aie4_cmd_bos[i] = amdxdna_gem_get_obj(hwctx->client, boh, AMDXDNA_BO_SHARE);
+ if (!job->aie4_cmd_bos[i]) {
+ XDNA_ERR(xdna, "Failed to find cmd BO %u at index %u", boh, i);
+ ret = -ENOENT;
+ goto err_put_bos;
+ }
+
+ ret = validate_cmd_abo(xdna, job->aie4_cmd_bos[i], NULL);
+ if (ret) {
+ amdxdna_gem_put_obj(job->aie4_cmd_bos[i]);
+ goto err_put_bos;
+ }
+ }
+ job->aie4_cmd_bo_cnt = ccnt;
+
+ for (i = 0; i < ccnt; i++) {
+ ret = submit_one_cmd(hwctx, job->aie4_cmd_bos[i], i + 1 == ccnt, &job->seq);
+ if (ret)
+ break;
+ job->aie4_job_state = AIE4_JOB_STATE_SUBMITTING;
+ }
+
+ if (!ret) {
+ job->aie4_job_state = AIE4_JOB_STATE_SUBMITTED;
+ return 0;
+ }
+
+ /*
+ * If partial submission occurred, return 0 so the job is queued to
+ * running_job_list. The worker will wait for hardware to finish the
+ * published packets (up to job->seq), then abort the job safely.
+ */
+ if (job->aie4_job_state == AIE4_JOB_STATE_SUBMITTING)
+ return 0;
+
+ for (i = 0; i < ccnt; i++)
+ amdxdna_gem_put_obj(job->aie4_cmd_bos[i]);
+ kfree(job->aie4_cmd_bos);
+ job->aie4_cmd_bos = NULL;
+ job->aie4_cmd_bo_cnt = 0;
+
+ return ret;
+
+err_put_bos:
+ while (i--)
+ amdxdna_gem_put_obj(job->aie4_cmd_bos[i]);
+ kfree(job->aie4_cmd_bos);
+ job->aie4_cmd_bos = NULL;
+ return ret;
+}
+
+/* Pending list serializes job submissions on the hardware queue. */
+/* Publish current pending-list head for lockless submit wait condition. */
+static void update_pending_head(struct amdxdna_hwctx_priv *priv)
+{
+ WRITE_ONCE(priv->pending_head,
+ list_first_entry_or_null(&priv->pending_job_list,
+ struct amdxdna_sched_job, aie4_job_list));
+}
+
+static void enqueue_pending_job(struct amdxdna_hwctx *hwctx,
+ struct amdxdna_sched_job *job)
+{
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+
+ mutex_lock(&priv->io_lock);
+ list_add_tail(&job->aie4_job_list, &priv->pending_job_list);
+ job->aie4_job_state = AIE4_JOB_STATE_PENDING;
+ update_pending_head(priv);
+ mutex_unlock(&priv->io_lock);
+
+ /* Let the next pending submitter re-check whether it is now first. */
+ wake_up_all(&priv->job_list_wq);
+}
+
+static void cancel_pending_job(struct amdxdna_hwctx *hwctx,
+ struct amdxdna_sched_job *job)
+{
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+
+ mutex_lock(&priv->io_lock);
+ list_del(&job->aie4_job_list);
+ job->aie4_job_state = AIE4_JOB_STATE_INIT;
+ update_pending_head(priv);
+ mutex_unlock(&priv->io_lock);
+ /* Let the next pending submitter re-check whether it is now first. */
+ wake_up_all(&priv->job_list_wq);
+}
+
+int aie4_cmd_submit(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job, u64 *seq)
+{
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+ struct amdxdna_dev *xdna = hwctx->client->xdna;
+ struct ww_acquire_ctx acquire_ctx;
+ struct amdxdna_gem_obj *abo;
+ u32 op;
+ int i;
+ int ret;
+
+ XDNA_DBG(xdna, "ctx %s job %p received", hwctx->name, job);
+
+ if (!job->cmd_bo) {
+ XDNA_ERR(xdna, "No command BO in job");
+ return -EINVAL;
+ }
+
+ op = amdxdna_cmd_get_op(job->cmd_bo);
+ if (op != ERT_START_DPU && op != ERT_CMD_CHAIN) {
+ XDNA_ERR(xdna, "Invalid cmd opcode %d", op);
+ return -EINVAL;
+ }
+
+ INIT_LIST_HEAD(&job->aie4_job_list);
+
+ /* Pin submitter's address space until job completion. */
+ if (!mmget_not_zero(job->mm)) {
+ XDNA_ERR(xdna, "Failed to get mm reference");
+ return -ESRCH;
+ }
+
+ /* Lock BO reservations and attach job fence. */
+ ret = drm_gem_lock_reservations(job->bos, job->bo_cnt, &acquire_ctx);
+ if (ret) {
+ XDNA_WARN(xdna, "Failed to lock BOs, ret %d", ret);
+ goto put_mm;
+ }
+
+ for (i = 0; i < job->bo_cnt; i++) {
+ ret = dma_resv_reserve_fences(job->bos[i]->resv, 1);
+ if (ret) {
+ XDNA_WARN(xdna, "Failed to reserve fences %d", ret);
+ drm_gem_unlock_reservations(job->bos, job->bo_cnt, &acquire_ctx);
+ goto put_mm;
+ }
+ }
+
+ down_read(&xdna->notifier_lock);
+ for (i = 0; i < job->bo_cnt; i++) {
+ abo = to_xdna_obj(job->bos[i]);
+ if (abo->mem.map_invalid) {
+ up_read(&xdna->notifier_lock);
+ drm_gem_unlock_reservations(job->bos, job->bo_cnt, &acquire_ctx);
+ ret = -EINVAL;
+ goto put_mm;
+ }
+ }
+
+ job->out_fence = dma_fence_get(job->fence);
+ for (i = 0; i < job->bo_cnt; i++)
+ dma_resv_add_fence(job->bos[i]->resv, job->out_fence, DMA_RESV_USAGE_WRITE);
+
+ up_read(&xdna->notifier_lock);
+ drm_gem_unlock_reservations(job->bos, job->bo_cnt, &acquire_ctx);
+
+ /* Wait until this job reaches head of pending list. */
+ enqueue_pending_job(hwctx, job);
+ ret = wait_event_freezable(priv->job_list_wq,
+ READ_ONCE(priv->pending_head) == job);
+ if (ret) {
+ cancel_pending_job(hwctx, job);
+ goto signal_fence;
+ }
+
+ mutex_lock(&priv->io_lock);
+ ret = submit_job_cmds(hwctx, job, op);
+ if (ret) {
+ /* No command was published; cancel pending job and signal fence error. */
+ mutex_unlock(&priv->io_lock);
+ cancel_pending_job(hwctx, job);
+ goto signal_fence;
+ }
+
+ /* Move in-flight or partial job to running list for worker completion. */
+ list_move_tail(&job->aie4_job_list, &priv->running_job_list);
+ update_pending_head(priv);
+ *seq = job->seq;
+ mutex_unlock(&priv->io_lock);
+
+ /* Release the next pending submitter and kick the reaper. */
+ wake_up_all(&priv->job_list_wq);
+ atomic64_inc(&hwctx->job_submit_cnt);
+ queue_work(priv->job_work_q, &priv->job_work);
+ return 0;
+
+signal_fence:
+ /* Map -ERESTARTSYS to -ECANCELED for exported fence error status. */
+ dma_fence_set_error(job->fence, ret == -ERESTARTSYS ? -ECANCELED : ret);
+ dma_fence_signal(job->fence);
+ dma_fence_put(job->out_fence);
+ job->out_fence = NULL;
+put_mm:
+ mmput(job->mm);
+ return ret;
+}
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index 9d970d4da435..c7b12bde50c0 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -1078,7 +1078,9 @@ const struct amdxdna_dev_ops aie4_vf_ops = {
.fini = aie4_vf_fini,
.debugfs_init = aie4_debugfs_init,
.hwctx_init = aie4_hwctx_init,
+ .hwctx_stop = aie4_hwctx_stop,
.hwctx_fini = aie4_hwctx_fini,
+ .cmd_submit = aie4_cmd_submit,
.cmd_wait = aie4_cmd_wait,
.get_aie_info = aie4_get_info,
.set_aie_state = aie4_set_state,
@@ -1089,7 +1091,9 @@ const struct amdxdna_dev_ops aie4_classic_ops = {
.fini = aie4_classic_fini,
.debugfs_init = aie4_debugfs_init,
.hwctx_init = aie4_hwctx_init,
+ .hwctx_stop = aie4_hwctx_stop,
.hwctx_fini = aie4_hwctx_fini,
+ .cmd_submit = aie4_cmd_submit,
.cmd_wait = aie4_cmd_wait,
.get_aie_info = aie4_get_info,
.set_aie_state = aie4_set_state,
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index 8660f1a4d42e..87de22e80ae6 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -50,6 +50,7 @@ struct amdxdna_hwctx_priv {
struct cert_comp *cert_comp;
u32 hw_ctx_id;
+ bool has_error;
/* Direct and indirect packet storage aliasing umq_bo. */
u64 write_index;
@@ -148,10 +149,13 @@ enum aie4_hwctx_flags {
};
int aie4_hwctx_init(struct amdxdna_hwctx *hwctx);
+void aie4_hwctx_stop(struct amdxdna_hwctx *hwctx);
void aie4_hwctx_fini(struct amdxdna_hwctx *hwctx);
int aie4_cmd_wait(struct amdxdna_hwctx *hwctx, u64 seq, u32 timeout);
+int aie4_cmd_submit(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job, u64 *seq);
int aie4_hwctx_create(struct amdxdna_hwctx *hwctx);
void aie4_hwctx_destroy(struct amdxdna_hwctx *hwctx, enum aie4_hwctx_flags);
+int aie4_hwctx_wait_for_running(struct amdxdna_hwctx *hwctx);
/* aie4_pci.c */
int aie4_restore_power_mode(struct amdxdna_dev_hdl *ndev);
diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
index 888e857ec558..608b86fe8f6b 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.c
+++ b/drivers/accel/amdxdna/amdxdna_ctx.c
@@ -25,7 +25,6 @@
struct amdxdna_fence {
struct dma_fence base;
spinlock_t lock; /* for base */
- struct amdxdna_hwctx *hwctx;
};
static const char *amdxdna_fence_get_driver_name(struct dma_fence *fence)
@@ -35,11 +34,8 @@ static const char *amdxdna_fence_get_driver_name(struct dma_fence *fence)
static const char *amdxdna_fence_get_timeline_name(struct dma_fence *fence)
{
- struct amdxdna_fence *xdna_fence;
-
- xdna_fence = container_of(fence, struct amdxdna_fence, base);
-
- return xdna_fence->hwctx->name;
+ /* Constant string ensures name remains valid if fence outlives device. */
+ return KBUILD_MODNAME;
}
static const struct dma_fence_ops fence_ops = {
@@ -55,9 +51,9 @@ static struct dma_fence *amdxdna_fence_create(struct amdxdna_hwctx *hwctx)
if (!fence)
return NULL;
- fence->hwctx = hwctx;
spin_lock_init(&fence->lock);
- dma_fence_init(&fence->base, &fence_ops, &fence->lock, hwctx->id, 0);
+ /* Unique timeline context prevents eviction from shared BO reservation. */
+ dma_fence_init(&fence->base, &fence_ops, &fence->lock, dma_fence_context_alloc(1), 0);
return &fence->base;
}
@@ -84,6 +80,9 @@ static void amdxdna_hwctx_destroy_rcu(struct amdxdna_hwctx *hwctx,
struct amdxdna_client *client = hwctx->client;
struct amdxdna_dev *xdna = client->xdna;
+ if (xdna->dev_info->ops->hwctx_stop)
+ xdna->dev_info->ops->hwctx_stop(hwctx);
+
synchronize_srcu(ss);
/* At this point, user is not able to submit new commands */
@@ -206,11 +205,17 @@ int amdxdna_cmd_set_error(struct amdxdna_gem_obj *abo,
*/
void amdxdna_hwctx_remove_all(struct amdxdna_client *client)
{
+ struct amdxdna_dev *xdna = client->xdna;
struct amdxdna_hwctx *hwctx;
unsigned long hwctx_id;
+ if (xdna->dev_info->ops->hwctx_stop) {
+ amdxdna_for_each_hwctx(client, hwctx_id, hwctx)
+ xdna->dev_info->ops->hwctx_stop(hwctx);
+ }
+
amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
- XDNA_DBG(client->xdna, "PID %d close HW context %d",
+ XDNA_DBG(xdna, "PID %d close HW context %d",
client->pid, hwctx->id);
xa_erase(&client->hwctx_xa, hwctx->id);
amdxdna_hwctx_destroy_rcu(hwctx, &client->hwctx_srcu);
@@ -289,6 +294,8 @@ int amdxdna_drm_create_hwctx_ioctl(struct drm_device *dev, void *data, struct dr
free_name:
kfree(hwctx->name);
fini_hwctx:
+ if (xdna->dev_info->ops->hwctx_stop)
+ xdna->dev_info->ops->hwctx_stop(hwctx);
xdna->dev_info->ops->hwctx_fini(hwctx);
release_expanded_heap:
amdxdna_hwctx_release_expanded_heap(hwctx);
diff --git a/drivers/accel/amdxdna/amdxdna_ctx.h b/drivers/accel/amdxdna/amdxdna_ctx.h
index b3677851d1c5..2e6b300d652f 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.h
+++ b/drivers/accel/amdxdna/amdxdna_ctx.h
@@ -157,6 +157,8 @@ union amdxdna_job_priv {
struct {
struct list_head list;
u32 state;
+ u32 cmd_bo_cnt;
+ struct amdxdna_gem_obj **cmd_bos;
} aie4;
};
@@ -179,9 +181,11 @@ struct amdxdna_sched_job {
struct drm_gem_object *bos[] __counted_by(bo_cnt);
};
-#define aie2_job_health priv.aie2_health
+#define aie2_job_health priv.aie2_health
#define aie4_job_list priv.aie4.list
#define aie4_job_state priv.aie4.state
+#define aie4_cmd_bo_cnt priv.aie4.cmd_bo_cnt
+#define aie4_cmd_bos priv.aie4.cmd_bos
static inline u32
amdxdna_cmd_get_op(struct amdxdna_gem_obj *abo)
diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.h b/drivers/accel/amdxdna/amdxdna_pci_drv.h
index 11f46ec738d7..632f8ba74b72 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.h
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.h
@@ -59,6 +59,7 @@ struct amdxdna_dev_ops {
int (*suspend)(struct amdxdna_dev *xdna);
int (*sriov_configure)(struct amdxdna_dev *xdna, int num_vfs);
int (*hwctx_init)(struct amdxdna_hwctx *hwctx);
+ void (*hwctx_stop)(struct amdxdna_hwctx *hwctx);
void (*hwctx_fini)(struct amdxdna_hwctx *hwctx);
int (*hwctx_config)(struct amdxdna_hwctx *hwctx, u32 type, u64 value, void *buf, u32 size);
int (*hwctx_sync_debug_bo)(struct amdxdna_hwctx *hwctx, u32 debug_bo_hdl);
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* Re: [PATCH V2 14/20] accel/amdxdna: Implement AIE4 command packet building and submission
2026-10-06 4:22 ` [PATCH V2 14/20] accel/amdxdna: Implement AIE4 command packet building and submission David Zhang
@ 2026-10-06 4:41 ` sashiko-bot
2026-10-06 7:12 ` Eva Crystal
1 sibling, 0 replies; 31+ messages in thread
From: sashiko-bot @ 2026-10-06 4:41 UTC (permalink / raw)
To: David Zhang; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Critical] accel/amdxdna: TOCTOU out-of-bounds read/write in amdxdna_cmd_get_payload()
- [High] accel/amdxdna: chained sub-command BOs bypass fence attachment
--
commit c176cc9653a37bd631df8131c299b9255f903027
Author: David Zhang <yidong.zhang@amd.com>
accel/amdxdna: Implement AIE4 command packet building and submission
This commit implements kernel-mode command submission and hardware queue
packet assembly for AIE4. It introduces aie4_cmd_submit() to validate
incoming command buffers, lock reservations, and dispatch to the hardware
queue while tracking job completions.
> diff --git a/drivers/accel/amdxdna/aie4_ctx.c b/drivers/accel/amdxdna/aie4_ctx.c
> --- a/drivers/accel/amdxdna/aie4_ctx.c
> +++ b/drivers/accel/amdxdna/aie4_ctx.c
[ ... ]
> @@ -731,21 +731,21 @@ static int submit_one_cmd(struct amdxdna_hwctx *hwctx,
> struct amdxdna_gem_obj *cmd_abo, bool last_of_chain,
> u64 *seq)
> {
> struct amdxdna_hwctx_priv *priv = hwctx->priv;
> struct amdxdna_dev *xdna = hwctx->client->xdna;
> struct amdxdna_cmd_start_dpu *dpu;
> struct host_queue_packet *pkt;
> u64 slot_idx;
> u16 chained;
> int ret;
>
> ret = validate_cmd_abo(xdna, cmd_abo, &chained);
> if (ret)
> return ret;
>
> dpu = amdxdna_cmd_get_payload(cmd_abo, NULL);
[Severity: Critical]
Is there a TOCTOU race window here between validation and payload retrieval?
Userspace can concurrently modify cmd_abo (which is a mapped BO) between
the bounds checks in validate_cmd_abo() and this call to
amdxdna_cmd_get_payload().
When the size argument is passed as NULL, amdxdna_cmd_get_payload() skips
its internal size bounds checks and computes the pointer offset directly
from the potentially modified header (AMDXDNA_CMD_EXTRA_CU_MASK).
This could allow it to return a pointer significantly out of bounds,
leading to an out-of-bounds read when dpu is subsequently accessed, or
potentially leaking arbitrary kernel memory to the hardware queue.
[ ... ]
> @@ -911,21 +911,21 @@ static int submit_job_cmds(struct amdxdna_hwctx *hwctx,
> struct amdxdna_sched_job *job, u32 op)
> {
[ ... ]
> /* Validate all sub-command BOs and payloads before dispatching packets. */
> for (i = 0; i < ccnt; i++) {
> u32 boh = (u32)(payload->data[i]);
>
> job->aie4_cmd_bos[i] = amdxdna_gem_get_obj(hwctx->client, boh, AMDXDNA_BO_SHARE);
> if (!job->aie4_cmd_bos[i]) {
> XDNA_ERR(xdna, "Failed to find cmd BO %u at index %u", boh, i);
> ret = -ENOENT;
> goto err_put_bos;
> }
[Severity: High]
Does this skip dma_resv fence attachment and mapping checks for sub-command
BOs?
Userspace can submit an ERT_CMD_CHAIN job with sub-command handles in the
payload that are omitted from the ioctl's top-level args->bos array.
Because these sub-command BOs are fetched dynamically here from user handles,
their reservations aren't locked and map_invalid is never checked before
dispatch.
[ ... ]
> @@ -1050,15 +1050,15 @@ int aie4_cmd_submit(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job,
[ ... ]
> job->out_fence = dma_fence_get(job->fence);
> for (i = 0; i < job->bo_cnt; i++)
> dma_resv_add_fence(job->bos[i]->resv, job->out_fence, DMA_RESV_USAGE_WRITE);
[Severity: High]
Are the dynamically fetched sub-command BOs missing their execution fences?
The execution fences are exclusively attached to BOs present in the top-level
job->bos array.
Since the dynamically fetched sub-command BOs in job->aie4_cmd_bos bypass this
fence attachment, hardware DMA can occur on BOs without a corresponding
dma_resv execution fence.
This might lead the memory manager to consider these BOs idle, potentially
reclaiming, migrating, or unmapping their pages while the device is actively
writing to them.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261006042230.547807-1-yidong.zhang@amd.com?part=14
^ permalink raw reply [flat|nested] 31+ messages in thread* Re: [PATCH V2 14/20] accel/amdxdna: Implement AIE4 command packet building and submission
2026-10-06 4:22 ` [PATCH V2 14/20] accel/amdxdna: Implement AIE4 command packet building and submission David Zhang
2026-10-06 4:41 ` sashiko-bot
@ 2026-10-06 7:12 ` Eva Crystal
2026-10-07 22:54 ` Zhang, Yidong (David)
1 sibling, 1 reply; 31+ messages in thread
From: Eva Crystal @ 2026-10-06 7:12 UTC (permalink / raw)
To: yidong.zhang, quic_jhugo, karol.wachowski, max.zhen, lizhi.hou,
ogabbay, dri-devel, linux-kernel
Cc: sonal.santan, mario.limonciello, wendy.liang
On Mon, Oct 05, 2026 at 09:22:24PM -0700, David Zhang wrote:
> +/* Job timeout detection (TDR) will guarantee the fence signalling */
> +static void job_worker(struct work_struct *work)
> +{
> + struct amdxdna_hwctx_priv *priv =
> + container_of(work, struct amdxdna_hwctx_priv, job_work);
> + struct amdxdna_hwctx *hwctx = priv->hwctx;
> + struct amdxdna_sched_job *job;
> +
> + while ((job = peek_running_job(hwctx))) {
> + wait_till_seq_completed(hwctx, job->seq);
> + if (get_read_index(hwctx) > job->seq) {
> + dequeue_running_job(hwctx, job);
> + /* Abort partially submitted jobs; complete fully submitted ones. */
> + if (job->aie4_job_state != AIE4_JOB_STATE_SUBMITTED)
> + job_abort(job);
> + else
> + job_complete(job);
> +static void job_done(struct amdxdna_sched_job *job)
> +{
> + job->aie4_job_state = AIE4_JOB_STATE_DONE;
> + dma_fence_signal(job->fence);
> + /* Release submitter mm reference taken at submit. */
> + mmput_async(job->mm);
> + kref_put(&job->refcnt, aie4_job_release);
> +}
The get_read_index(hwctx) > job->seq test here reads a value userspace can write, and this patch is the first to let it release resources rather than just end a wait.
priv->umq_read_index = &qhdr->read_index is already in drm-misc-next (drivers/accel/amdxdna/aie4_ctx.c:212 at 34e9ab018249), but there its only consumer was check_cmd_done() from aie4_cmd_wait() and aie4_vf_ops had no .cmd_submit, so forging it only ended your own wait early. Here it decides dma_fence_signal(), mmput_async() and the BO reference drops in aie4_job_release().
The queue is userspace's own BO: hwctx->umq_bo_hdl is args->umq_bo from CREATE_HWCTX (drivers/accel/amdxdna/amdxdna_ctx.c:252) and is mmappable read-write (drivers/accel/amdxdna/amdxdna_gem.c:1409), so the submitter shares the pages the driver vmaps. valid_queue_index() bounds it only against the kernel copy priv->write_index, so any value in [write_index - 32, write_index] passes and one store retires every outstanding job. Nothing else is consulted: cert_comp_isr() (drivers/accel/amdxdna/aie4_pci.c:114) only calls wake_up_all(), and aie4 has no per-job mailbox handler.
I may be overstating the impact. I found no kernel memory corruption: no driver allocation's free is gated on a job fence, and the queue BO reference drops in aie4_hwctx_fini(), after hwctx_stop() has done the synchronous aie4_msg_destroy_context(). User pages look covered, since SVA is the default and the core invalidates device TLBs on every mm invalidation (drivers/iommu/iommu-sva.c:341). What is left is cross-process integrity: job->out_fence sits in every argument BO's reservation as DMA_RESV_USAGE_WRITE and those export as dma-buf (drivers/accel/amdxdna/amdxdna_gem.c:680), so an importer is told the NPU is done when it is not. I cannot tell from source whether CERT keeps executing packets it already fetched once the host moves read_index past them; if it stops, this is self inflicted only. You have the hardware.
Would a driver owned completion word work, device mapped but not user mapped? Or could CERT report the count in a register or mailbox message the ISR reads?
Separately: abo->mem.map_invalid is set in the MMU notifier (drivers/accel/amdxdna/amdxdna_gem.c:247) and at mmap time for imported BOs (drivers/accel/amdxdna/amdxdna_gem.c:505), but cleared only in aie2_populate_range() (drivers/accel/amdxdna/aie2_ctx.c:1145), static and called only from aie2_cmd_submit(). On aie4 it is never cleared, so aie4_cmd_submit() returns -EINVAL for that BO's remaining life. An imported dma-buf argument BO that userspace mmapped starts with the flag set and can never be submitted.
Eva Crystal (0xiviel)
XSource Security
https://xsourcesec.com
^ permalink raw reply [flat|nested] 31+ messages in thread* Re: [PATCH V2 14/20] accel/amdxdna: Implement AIE4 command packet building and submission
2026-10-06 7:12 ` Eva Crystal
@ 2026-10-07 22:54 ` Zhang, Yidong (David)
0 siblings, 0 replies; 31+ messages in thread
From: Zhang, Yidong (David) @ 2026-10-07 22:54 UTC (permalink / raw)
To: Eva Crystal, quic_jhugo, karol.wachowski, max.zhen, lizhi.hou,
ogabbay, dri-devel, linux-kernel
Cc: sonal.santan, mario.limonciello, wendy.liang
On 10/6/2026 12:12 AM, Eva Crystal wrote:
> On Mon, Oct 05, 2026 at 09:22:24PM -0700, David Zhang wrote:
>
>> +/* Job timeout detection (TDR) will guarantee the fence signalling */
>> +static void job_worker(struct work_struct *work)
>> +{
>> + struct amdxdna_hwctx_priv *priv =
>> + container_of(work, struct amdxdna_hwctx_priv, job_work);
>> + struct amdxdna_hwctx *hwctx = priv->hwctx;
>> + struct amdxdna_sched_job *job;
>> +
>> + while ((job = peek_running_job(hwctx))) {
>> + wait_till_seq_completed(hwctx, job->seq);
>> + if (get_read_index(hwctx) > job->seq) {
>> + dequeue_running_job(hwctx, job);
>> + /* Abort partially submitted jobs; complete fully submitted ones. */
>> + if (job->aie4_job_state != AIE4_JOB_STATE_SUBMITTED)
>> + job_abort(job);
>> + else
>> + job_complete(job);
>> +static void job_done(struct amdxdna_sched_job *job)
>> +{
>> + job->aie4_job_state = AIE4_JOB_STATE_DONE;
>> + dma_fence_signal(job->fence);
>> + /* Release submitter mm reference taken at submit. */
>> + mmput_async(job->mm);
>> + kref_put(&job->refcnt, aie4_job_release);
>> +}
> The get_read_index(hwctx) > job->seq test here reads a value userspace can write, and this patch is the first to let it release resources rather than just end a wait.
>
> priv->umq_read_index = &qhdr->read_index is already in drm-misc-next (drivers/accel/amdxdna/aie4_ctx.c:212 at 34e9ab018249), but there its only consumer was check_cmd_done() from aie4_cmd_wait() and aie4_vf_ops had no .cmd_submit, so forging it only ended your own wait early. Here it decides dma_fence_signal(), mmput_async() and the BO reference drops in aie4_job_release().
>
> The queue is userspace's own BO: hwctx->umq_bo_hdl is args->umq_bo from CREATE_HWCTX (drivers/accel/amdxdna/amdxdna_ctx.c:252) and is mmappable read-write (drivers/accel/amdxdna/amdxdna_gem.c:1409), so the submitter shares the pages the driver vmaps. valid_queue_index() bounds it only against the kernel copy priv->write_index, so any value in [write_index - 32, write_index] passes and one store retires every outstanding job. Nothing else is consulted: cert_comp_isr() (drivers/accel/amdxdna/aie4_pci.c:114) only calls wake_up_all(), and aie4 has no per-job mailbox handler.
>
> I may be overstating the impact. I found no kernel memory corruption: no driver allocation's free is gated on a job fence, and the queue BO reference drops in aie4_hwctx_fini(), after hwctx_stop() has done the synchronous aie4_msg_destroy_context(). User pages look covered, since SVA is the default and the core invalidates device TLBs on every mm invalidation (drivers/iommu/iommu-sva.c:341). What is left is cross-process integrity: job->out_fence sits in every argument BO's reservation as DMA_RESV_USAGE_WRITE and those export as dma-buf (drivers/accel/amdxdna/amdxdna_gem.c:680), so an importer is told the NPU is done when it is not. I cannot tell from source whether CERT keeps executing packets it already fetched once the host moves read_index past them; if it stops, this is self inflicted only. You have the hardware.
>
> Would a driver owned completion word work, device mapped but not user mapped? Or could CERT report the count in a register or mailbox message the ISR reads?
Hi Eva,
The forging read_index only signals that process's own job fences, the
impact is self-inflicted.
We cannot change the hw/fw at this moment. The CERT fw access memory
with user space address, thus the memory need to be user mapped.
>
> Separately: abo->mem.map_invalid is set in the MMU notifier (drivers/accel/amdxdna/amdxdna_gem.c:247) and at mmap time for imported BOs (drivers/accel/amdxdna/amdxdna_gem.c:505), but cleared only in aie2_populate_range() (drivers/accel/amdxdna/aie2_ctx.c:1145), static and called only from aie2_cmd_submit(). On aie4 it is never cleared, so aie4_cmd_submit() returns -EINVAL for that BO's remaining life. An imported dma-buf argument BO that userspace mmapped starts with the flag set and can never be submitted.
I missed merge one patch which rename the aie2_populate_range to
amdxdna_populate_range. I got this patch in V3 that both aie2 and aie4
both call this common API.
/David
> Eva Crystal (0xiviel)
> XSource Security
> https://xsourcesec.com
>
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH V2 15/20] accel/amdxdna: Make hmm_invalidate common for AIE2 and AIE4
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (13 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 14/20] accel/amdxdna: Implement AIE4 command packet building and submission David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 16/20] accel/amdxdna: Finalize runtime PM before acquiring dev_lock on removal David Zhang
` (4 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello, Hayden Laccabue
The HMM range invalidation callback (.hmm_invalidate) has identical
logic across NPU generations: waiting on the GEM object's reservation
fences using dma_resv_wait_timeout() with DMA_RESV_USAGE_BOOKKEEP.
Consolidate this callback by moving it from aie2_ctx.c into aie.c as
aie_hmm_invalidate(), and declare it in aie.h. Wire .hmm_invalidate to
aie_hmm_invalidate in aie2_ops, aie4_vf_ops, and aie4_classic_ops.
Co-developed-by: Hayden Laccabue <Hayden.Laccabue@amd.com>
Signed-off-by: Hayden Laccabue <Hayden.Laccabue@amd.com>
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie.c | 18 ++++++++++++++++++
drivers/accel/amdxdna/aie.h | 2 ++
drivers/accel/amdxdna/aie2_ctx.c | 15 ---------------
drivers/accel/amdxdna/aie2_pci.c | 2 +-
drivers/accel/amdxdna/aie2_pci.h | 1 -
drivers/accel/amdxdna/aie4_pci.c | 2 ++
6 files changed, 23 insertions(+), 17 deletions(-)
diff --git a/drivers/accel/amdxdna/aie.c b/drivers/accel/amdxdna/aie.c
index 01a439c0ccf4..010d94715ff4 100644
--- a/drivers/accel/amdxdna/aie.c
+++ b/drivers/accel/amdxdna/aie.c
@@ -3,9 +3,12 @@
* Copyright (C) 2026, Advanced Micro Devices, Inc.
*/
+#include <linux/dma-resv.h>
#include <linux/errno.h>
+#include <linux/sched.h>
#include "aie.h"
+#include "amdxdna_gem.h"
#include "amdxdna_mailbox_helper.h"
#include "amdxdna_mailbox.h"
#include "amdxdna_pci_drv.h"
@@ -202,3 +205,18 @@ void amdxdna_free_msg_buffer(struct amdxdna_dev *xdna, size_t size,
dma_free_noncoherent(xdna->ddev.dev, size, cpu_addr, dma_addr, DMA_FROM_DEVICE);
}
+
+void aie_hmm_invalidate(struct amdxdna_gem_obj *abo,
+ unsigned long cur_seq)
+{
+ struct amdxdna_dev *xdna = to_xdna_dev(to_gobj(abo)->dev);
+ struct drm_gem_object *gobj = to_gobj(abo);
+ long ret;
+
+ ret = dma_resv_wait_timeout(gobj->resv, DMA_RESV_USAGE_BOOKKEEP,
+ true, MAX_SCHEDULE_TIMEOUT);
+ if (!ret)
+ XDNA_ERR(xdna, "Failed to wait for bo, ret %ld", ret);
+ else if (ret == -ERESTARTSYS)
+ XDNA_DBG(xdna, "Wait for bo interrupted by signal");
+}
diff --git a/drivers/accel/amdxdna/aie.h b/drivers/accel/amdxdna/aie.h
index 6268b708d17b..5cb9ebf45379 100644
--- a/drivers/accel/amdxdna/aie.h
+++ b/drivers/accel/amdxdna/aie.h
@@ -14,6 +14,7 @@
struct psp_device;
struct smu_device;
+struct amdxdna_gem_obj;
struct aie_device {
struct amdxdna_dev *xdna;
@@ -141,6 +142,7 @@ void *amdxdna_alloc_msg_buffer(struct amdxdna_dev *xdna, u32 *size,
dma_addr_t *dma_addr);
void amdxdna_free_msg_buffer(struct amdxdna_dev *xdna, size_t size,
void *cpu_addr, dma_addr_t dma_addr);
+void aie_hmm_invalidate(struct amdxdna_gem_obj *abo, unsigned long cur_seq);
int amdxdna_get_aie_version(struct amdxdna_client *client,
struct amdxdna_drm_get_info *args,
struct amdxdna_drm_query_aie_version *version);
diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
index d927c8c9d557..8c1b29964f8f 100644
--- a/drivers/accel/amdxdna/aie2_ctx.c
+++ b/drivers/accel/amdxdna/aie2_ctx.c
@@ -1277,21 +1277,6 @@ int aie2_cmd_submit(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job,
return ret;
}
-void aie2_hmm_invalidate(struct amdxdna_gem_obj *abo,
- unsigned long cur_seq)
-{
- struct amdxdna_dev *xdna = to_xdna_dev(to_gobj(abo)->dev);
- struct drm_gem_object *gobj = to_gobj(abo);
- long ret;
-
- ret = dma_resv_wait_timeout(gobj->resv, DMA_RESV_USAGE_BOOKKEEP,
- true, MAX_SCHEDULE_TIMEOUT);
- if (!ret)
- XDNA_ERR(xdna, "Failed to wait for bo, ret %ld", ret);
- else if (ret == -ERESTARTSYS)
- XDNA_DBG(xdna, "Wait for bo interrupted by signal");
-}
-
int aie2_hwctx_heap_expand(struct amdxdna_hwctx *hwctx,
struct amdxdna_gem_obj *heap)
{
diff --git a/drivers/accel/amdxdna/aie2_pci.c b/drivers/accel/amdxdna/aie2_pci.c
index b70af1923643..c4e916e832cb 100644
--- a/drivers/accel/amdxdna/aie2_pci.c
+++ b/drivers/accel/amdxdna/aie2_pci.c
@@ -1216,7 +1216,7 @@ const struct amdxdna_dev_ops aie2_ops = {
.hwctx_config = aie2_hwctx_config,
.hwctx_sync_debug_bo = aie2_hwctx_sync_debug_bo,
.cmd_submit = aie2_cmd_submit,
- .hmm_invalidate = aie2_hmm_invalidate,
+ .hmm_invalidate = aie_hmm_invalidate,
.get_array = aie2_get_array,
.get_dev_revision = aie2_get_dev_rev,
.hwctx_heap_expand = aie2_hwctx_heap_expand,
diff --git a/drivers/accel/amdxdna/aie2_pci.h b/drivers/accel/amdxdna/aie2_pci.h
index 0c8dd6510292..ba17df97223a 100644
--- a/drivers/accel/amdxdna/aie2_pci.h
+++ b/drivers/accel/amdxdna/aie2_pci.h
@@ -272,7 +272,6 @@ int aie2_hwctx_sync_debug_bo(struct amdxdna_hwctx *hwctx, u32 debug_bo_hdl);
void aie2_hwctx_suspend(struct amdxdna_client *client);
int aie2_hwctx_resume(struct amdxdna_client *client);
int aie2_cmd_submit(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job, u64 *seq);
-void aie2_hmm_invalidate(struct amdxdna_gem_obj *abo, unsigned long cur_seq);
int aie2_hwctx_heap_expand(struct amdxdna_hwctx *hwctx, struct amdxdna_gem_obj *heap);
#endif /* _AIE2_PCI_H_ */
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index c7b12bde50c0..3b930197d5ee 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -1082,6 +1082,7 @@ const struct amdxdna_dev_ops aie4_vf_ops = {
.hwctx_fini = aie4_hwctx_fini,
.cmd_submit = aie4_cmd_submit,
.cmd_wait = aie4_cmd_wait,
+ .hmm_invalidate = aie_hmm_invalidate,
.get_aie_info = aie4_get_info,
.set_aie_state = aie4_set_state,
};
@@ -1095,6 +1096,7 @@ const struct amdxdna_dev_ops aie4_classic_ops = {
.hwctx_fini = aie4_hwctx_fini,
.cmd_submit = aie4_cmd_submit,
.cmd_wait = aie4_cmd_wait,
+ .hmm_invalidate = aie_hmm_invalidate,
.get_aie_info = aie4_get_info,
.set_aie_state = aie4_set_state,
};
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 16/20] accel/amdxdna: Finalize runtime PM before acquiring dev_lock on removal
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (14 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 15/20] accel/amdxdna: Make hmm_invalidate common for AIE2 and AIE4 David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 7:13 ` Eva Crystal
2026-10-06 4:22 ` [PATCH V2 17/20] accel/amdxdna: Implement AIE4 suspend and resume David Zhang
` (3 subsequent siblings)
19 siblings, 1 reply; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello
When the device is runtime-suspended, pm_runtime_forbid() synchronously
resumes the device via rpm_resume(), which invokes
amdxdna_pm_runtime_resume(). Because amdxdna_pm_runtime_resume()
acquires dev_lock, calling amdxdna_pm_fini() inside ops->fini() while
holding dev_lock in amdxdna_remove() causes a deadlock.
Move amdxdna_pm_fini() out of ops->fini() and invoke it before acquiring
dev_lock in amdxdna_remove() as well as the probe failure unwind path.
Also call pm_runtime_dont_use_autosuspend() in amdxdna_pm_fini() to
disable autosuspend upon teardown.
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie2_pci.c | 2 --
drivers/accel/amdxdna/amdxdna_pci_drv.c | 4 ++++
drivers/accel/amdxdna/amdxdna_pm.c | 1 +
3 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/accel/amdxdna/aie2_pci.c b/drivers/accel/amdxdna/aie2_pci.c
index c4e916e832cb..bee3d973e6bc 100644
--- a/drivers/accel/amdxdna/aie2_pci.c
+++ b/drivers/accel/amdxdna/aie2_pci.c
@@ -623,7 +623,6 @@ static int aie2_init(struct amdxdna_dev *xdna)
release_firmware(fw);
aie2_msg_init(ndev);
amdxdna_vbnv_init(xdna);
- amdxdna_pm_init(xdna);
return 0;
stop_hw:
@@ -638,7 +637,6 @@ static int aie2_init(struct amdxdna_dev *xdna)
static void aie2_fini(struct amdxdna_dev *xdna)
{
- amdxdna_pm_fini(xdna);
aie2_hw_stop(xdna);
aie2_hwctx_sched_fini(xdna->dev_handle);
}
diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.c b/drivers/accel/amdxdna/amdxdna_pci_drv.c
index f5f7831c4e80..8faf651fb534 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.c
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.c
@@ -415,6 +415,8 @@ static int amdxdna_probe(struct pci_dev *pdev, const struct pci_device_id *id)
goto iommu_fini;
}
+ amdxdna_pm_init(xdna);
+
ret = amdxdna_sysfs_init(xdna);
if (ret) {
XDNA_ERR(xdna, "Create amdxdna attrs failed: %d", ret);
@@ -433,6 +435,7 @@ static int amdxdna_probe(struct pci_dev *pdev, const struct pci_device_id *id)
failed_sysfs_fini:
amdxdna_sysfs_fini(xdna);
failed_dev_fini:
+ amdxdna_pm_fini(xdna);
mutex_lock(&xdna->dev_lock);
xdna->dev_info->ops->fini(xdna);
mutex_unlock(&xdna->dev_lock);
@@ -448,6 +451,7 @@ static void amdxdna_remove(struct pci_dev *pdev)
drm_dev_unplug(&xdna->ddev);
amdxdna_sysfs_fini(xdna);
+ amdxdna_pm_fini(xdna);
mutex_lock(&xdna->client_lock);
mutex_lock(&xdna->dev_lock);
diff --git a/drivers/accel/amdxdna/amdxdna_pm.c b/drivers/accel/amdxdna/amdxdna_pm.c
index b1fafddd7ad5..9c030b7836fb 100644
--- a/drivers/accel/amdxdna/amdxdna_pm.c
+++ b/drivers/accel/amdxdna/amdxdna_pm.c
@@ -75,4 +75,5 @@ void amdxdna_pm_fini(struct amdxdna_dev *xdna)
pm_runtime_get_noresume(dev);
pm_runtime_forbid(dev);
+ pm_runtime_dont_use_autosuspend(dev);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* Re: [PATCH V2 16/20] accel/amdxdna: Finalize runtime PM before acquiring dev_lock on removal
2026-10-06 4:22 ` [PATCH V2 16/20] accel/amdxdna: Finalize runtime PM before acquiring dev_lock on removal David Zhang
@ 2026-10-06 7:13 ` Eva Crystal
2026-10-06 17:01 ` Lizhi Hou
0 siblings, 1 reply; 31+ messages in thread
From: Eva Crystal @ 2026-10-06 7:13 UTC (permalink / raw)
To: yidong.zhang, quic_jhugo, karol.wachowski, max.zhen, lizhi.hou,
ogabbay, dri-devel, linux-kernel
Cc: sonal.santan, mario.limonciello
On Mon, Oct 05, 2026 at 09:22:26PM -0700, David Zhang wrote:
> When the device is runtime-suspended, pm_runtime_forbid() synchronously
> resumes the device via rpm_resume(), which invokes
> amdxdna_pm_runtime_resume(). Because amdxdna_pm_runtime_resume()
> acquires dev_lock, calling amdxdna_pm_fini() inside ops->fini() while
> holding dev_lock in amdxdna_remove() causes a deadlock.
> - amdxdna_pm_fini(xdna);
> aie2_hw_stop(xdna);
> aie2_hwctx_sched_fini(xdna->dev_handle);
This is worth more than its position in the series suggests: the deadlock is already live on shipping AIE2 parts, not only on the new AIE4 path.
On current drm-misc-next, amdxdna_remove() holds dev_lock across ops->fini(xdna) (drivers/accel/amdxdna/amdxdna_pci_drv.c:457 and drivers/accel/amdxdna/amdxdna_pci_drv.c:463 at 34e9ab018249), and aie2_fini() opens with amdxdna_pm_fini() (drivers/accel/amdxdna/aie2_pci.c:640 at the same commit). pm_runtime_forbid() then calls rpm_resume(dev, 0) synchronously (drivers/base/power/runtime.c:1672), which lands in amdxdna_pm_resume() and its guard(mutex)(&xdna->dev_lock) on the same task. The base wires RUNTIME_PM_OPS(amdxdna_pm_suspend, amdxdna_pm_resume, NULL) and aie2_ops supplies .suspend and .resume, so runtime PM is active on aie2 before this series adds .runtime_suspend. With amdxdna_pm_init() setting a 5000 ms autosuspend delay then pm_runtime_allow(), an unbind or rmmod more than five seconds after the last NPU access hangs holding dev_lock.
Three things that would help it travel:
* Fixes: 1aa82181a3c2 ("accel/amdxdna: Fix dead lock for suspend and resume") looks right. amdxdna_pm.c had no dev_lock when 063db451832b created it, and 1aa82181a3c2 adds exactly the two guards the base still carries.
* Cc: stable@vger.kernel.org is warranted, since 1aa82181a3c2 is in v7.0 and later.
* Could this be split out to drm-misc-fixes on its own? At position 16 of a 20 patch AIE4 series it is unlikely to be picked up as a fix, and splitting it stops the fixes cadence holding up the feature work.
One question: amdxdna_pm_fini() now runs after drm_dev_unplug(), so pm_runtime_forbid() resumes hardware on a device already unregistered with its user mappings torn down. Intended?
Eva Crystal (0xiviel)
XSource Security
https://xsourcesec.com
^ permalink raw reply [flat|nested] 31+ messages in thread* Re: [PATCH V2 16/20] accel/amdxdna: Finalize runtime PM before acquiring dev_lock on removal
2026-10-06 7:13 ` Eva Crystal
@ 2026-10-06 17:01 ` Lizhi Hou
2026-10-07 1:18 ` Eva Crystal
0 siblings, 1 reply; 31+ messages in thread
From: Lizhi Hou @ 2026-10-06 17:01 UTC (permalink / raw)
To: Eva Crystal, yidong.zhang, quic_jhugo, karol.wachowski, max.zhen,
ogabbay, dri-devel, linux-kernel
Cc: sonal.santan, mario.limonciello
On 10/6/26 00:13, Eva Crystal wrote:
> On Mon, Oct 05, 2026 at 09:22:26PM -0700, David Zhang wrote:
>
>> When the device is runtime-suspended, pm_runtime_forbid() synchronously
>> resumes the device via rpm_resume(), which invokes
>> amdxdna_pm_runtime_resume(). Because amdxdna_pm_runtime_resume()
>> acquires dev_lock, calling amdxdna_pm_fini() inside ops->fini() while
>> holding dev_lock in amdxdna_remove() causes a deadlock.
>> - amdxdna_pm_fini(xdna);
>> aie2_hw_stop(xdna);
>> aie2_hwctx_sched_fini(xdna->dev_handle);
> This is worth more than its position in the series suggests: the deadlock is already live on shipping AIE2 parts, not only on the new AIE4 path.
>
> On current drm-misc-next, amdxdna_remove() holds dev_lock across ops->fini(xdna) (drivers/accel/amdxdna/amdxdna_pci_drv.c:457 and drivers/accel/amdxdna/amdxdna_pci_drv.c:463 at 34e9ab018249), and aie2_fini() opens with amdxdna_pm_fini() (drivers/accel/amdxdna/aie2_pci.c:640 at the same commit). pm_runtime_forbid() then calls rpm_resume(dev, 0) synchronously (drivers/base/power/runtime.c:1672), which lands in amdxdna_pm_resume() and its guard(mutex)(&xdna->dev_lock) on the same task. The base wires RUNTIME_PM_OPS(amdxdna_pm_suspend, amdxdna_pm_resume, NULL) and aie2_ops supplies .suspend and .resume, so runtime PM is active on aie2 before this series adds .runtime_suspend. With amdxdna_pm_init() setting a 5000 ms autosuspend delay then pm_runtime_allow(), an unbind or rmmod more than five seconds after the last NPU access hangs holding dev_lock.
On the remove path, pm_runtime_forbid() does not call
amdxdna_pm_resume(). The PCI core has already resumed the device.
pci_device_remove() calls pm_runtime_get_sync() and pm_runtime_barrier()
before amdxdna_remove(). That get resumes a runtime-suspended device,
and the usage count stays elevated through aie2_fini().
pm_runtime_forbid() then enters rpm_resume() with status RPM_ACTIVE,
which returns immediately and does not run ->runtime_resume()
Lizhi
>
> Three things that would help it travel:
>
> * Fixes: 1aa82181a3c2 ("accel/amdxdna: Fix dead lock for suspend and resume") looks right. amdxdna_pm.c had no dev_lock when 063db451832b created it, and 1aa82181a3c2 adds exactly the two guards the base still carries.
> * Cc: stable@vger.kernel.org is warranted, since 1aa82181a3c2 is in v7.0 and later.
> * Could this be split out to drm-misc-fixes on its own? At position 16 of a 20 patch AIE4 series it is unlikely to be picked up as a fix, and splitting it stops the fixes cadence holding up the feature work.
>
> One question: amdxdna_pm_fini() now runs after drm_dev_unplug(), so pm_runtime_forbid() resumes hardware on a device already unregistered with its user mappings torn down. Intended?
>
> Eva Crystal (0xiviel)
> XSource Security
> https://xsourcesec.com
>
>
^ permalink raw reply [flat|nested] 31+ messages in thread* Re: [PATCH V2 16/20] accel/amdxdna: Finalize runtime PM before acquiring dev_lock on removal
2026-10-06 17:01 ` Lizhi Hou
@ 2026-10-07 1:18 ` Eva Crystal
0 siblings, 0 replies; 31+ messages in thread
From: Eva Crystal @ 2026-10-07 1:18 UTC (permalink / raw)
To: Lizhi Hou
Cc: yidong.zhang, quic_jhugo, karol.wachowski, max.zhen, ogabbay,
dri-devel, linux-kernel, sonal.santan, mario.limonciello
└─$ sed -n '/^You are right/,$p'
/home/iviel/xdna-audit/aie4-kmq-v2-reply-16-retraction.md
You are right, and I withdraw the claim.
The step I missed is pci_device_remove(), which calls
pm_runtime_get_sync() at drivers/pci/pci-driver.c:527 before
drv->remove() at :535 and only drops it at :536 once remove returns.
Once that get succeeds, the device is RPM_ACTIVE for all of
amdxdna_remove(), so pm_runtime_forbid() takes the early return in
rpm_resume() at drivers/base/power/runtime.c:820 and never fetches the
->runtime_resume callback at :936 at all. No second dev_lock
acquisition, no deadlock.
The AIE2 deadlock claim is therefore wrong, and the Fixes:
1aa82181a3c2, Cc: stable and split-to-drm-misc-fixes suggestions go
with it. I withdraw the drm_dev_unplug() question too, since nothing
resumes on that path.
I had not reproduced this before sending. Sorry for the noise.
Eva Crystal (0xiviel)
XSource Security
https://xsourcesec.com
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH V2 17/20] accel/amdxdna: Implement AIE4 suspend and resume
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (15 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 16/20] accel/amdxdna: Finalize runtime PM before acquiring dev_lock on removal David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:22 ` [PATCH V2 18/20] accel/amdxdna: Link SR-IOV VFs for power management sequencing David Zhang
` (2 subsequent siblings)
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello
Implement suspend and resume callbacks for AIE4 Physical Function (PF),
Virtual Function (VF), and Classic device types:
- Add .suspend and .resume hooks in amdxdna_dev_ops for aie4_pf_ops,
aie4_vf_ops, and aie4_classic_ops.
- Implement aie4_hwctx_suspend_all() to destroy or drain contexts across
all registered clients and wait for in-flight jobs.
- Implement aie4_hwctx_resume_all() to recreate firmware contexts and
kick doorbells via aie4_hwctx_resume_jobs() to resume hardware queue
consumption.
- Guard firmware destroy message in aie4_hwctx_destroy() when context
ID is invalid.
- Restore SR-IOV virtual functions on PF resume via aie4_restore_sriov().
Call pci_disable_device() in the suspend paths to balance
pci_enable_device() in the resume paths.
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_ctx.c | 18 +-
drivers/accel/amdxdna/aie4_pci.c | 247 ++++++++++++++++++++++++
drivers/accel/amdxdna/aie4_pci.h | 9 +
drivers/accel/amdxdna/aie4_sriov.c | 4 +-
drivers/accel/amdxdna/amdxdna_pci_drv.h | 3 +
5 files changed, 279 insertions(+), 2 deletions(-)
diff --git a/drivers/accel/amdxdna/aie4_ctx.c b/drivers/accel/amdxdna/aie4_ctx.c
index 882938d368ef..5dc079d3f564 100644
--- a/drivers/accel/amdxdna/aie4_ctx.c
+++ b/drivers/accel/amdxdna/aie4_ctx.c
@@ -248,7 +248,7 @@ void aie4_hwctx_destroy(struct amdxdna_hwctx *hwctx, enum aie4_hwctx_flags flags
if (has_error)
wake_up_all(&priv->job_list_wq);
- if (flags != AIE4_HWCTX_DISCONNECT)
+ if (flags != AIE4_HWCTX_DISCONNECT && priv->hw_ctx_id != CTX_INVALID_ID)
aie4_msg_destroy_context(ndev, priv->hw_ctx_id);
if (cert_comp)
@@ -356,6 +356,7 @@ int aie4_hwctx_init(struct amdxdna_hwctx *hwctx)
return -ENOMEM;
hwctx->priv = priv;
priv->hwctx = hwctx;
+ priv->hw_ctx_id = CTX_INVALID_ID;
/* Initialize io_lock guarding cert_comp binding. */
mutex_init(&priv->io_lock);
@@ -906,6 +907,21 @@ int aie4_hwctx_wait_for_running(struct amdxdna_hwctx *hwctx)
return ret;
}
+void aie4_hwctx_resume_jobs(struct amdxdna_hwctx *hwctx)
+{
+ struct amdxdna_hwctx_priv *priv = hwctx->priv;
+
+ mutex_lock(&priv->io_lock);
+ if (list_empty(&priv->running_job_list)) {
+ mutex_unlock(&priv->io_lock);
+ return;
+ }
+ aie4_doorbell_ring(hwctx);
+ mutex_unlock(&priv->io_lock);
+
+ queue_work(priv->job_work_q, &priv->job_work);
+}
+
/*
* Submit job command(s) to host queue. Called with io_lock held.
* Returns 0 on success or if partial chain is queued for worker abort.
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index 3b930197d5ee..f7fa55c82baa 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -1066,11 +1066,254 @@ static void aie4_debugfs_init(struct amdxdna_dev *xdna)
&aie4_ctx_hysteresis_fops);
}
+void aie4_hwctx_suspend_all(struct amdxdna_dev_hdl *ndev, int clean_jobs)
+{
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+ struct amdxdna_client *client;
+ struct amdxdna_hwctx *hwctx;
+ unsigned long hwctx_id;
+ int idx;
+
+ drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+
+ amdxdna_for_each_client(xdna, client) {
+ idx = srcu_read_lock(&client->hwctx_srcu);
+ amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
+ /* clean up workers and drain running jobs */
+ if (clean_jobs) {
+ int ret;
+
+ aie4_hwctx_destroy(hwctx, AIE4_HWCTX_ERROR);
+ ret = aie4_hwctx_wait_for_running(hwctx);
+ if (ret)
+ XDNA_WARN(xdna, "hwctx %s wait for running failed %d",
+ hwctx->name, ret);
+ } else {
+ aie4_hwctx_destroy(hwctx, AIE4_HWCTX_NORMAL);
+ }
+ }
+ srcu_read_unlock(&client->hwctx_srcu, idx);
+ }
+
+ XDNA_DBG(xdna, "Finished hwctx suspend");
+}
+
+int aie4_hwctx_resume_all(struct amdxdna_dev_hdl *ndev)
+{
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+ struct amdxdna_client *client;
+ struct amdxdna_hwctx *hwctx;
+ unsigned long hwctx_id;
+ int ret, idx;
+
+ drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+
+ amdxdna_for_each_client(xdna, client) {
+ idx = srcu_read_lock(&client->hwctx_srcu);
+ amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
+ ret = aie4_hwctx_create(hwctx);
+ if (ret)
+ goto error;
+ aie4_hwctx_resume_jobs(hwctx);
+ }
+ srcu_read_unlock(&client->hwctx_srcu, idx);
+ }
+
+ XDNA_DBG(xdna, "Finished hwctx resume");
+ return 0;
+error:
+ srcu_read_unlock(&client->hwctx_srcu, idx);
+ XDNA_DBG(xdna, "Failed hwctx resume");
+ return ret;
+}
+
+static int aie4_restore_sriov(struct amdxdna_dev_hdl *ndev)
+{
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+ struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
+ int ret;
+
+ if (ndev->num_vfs) {
+ if (pci_num_vf(pdev) != ndev->num_vfs) {
+ XDNA_ERR(xdna, "inconsistent vf number");
+ return -EINVAL;
+ }
+ ret = aie4_create_vfs(ndev, ndev->num_vfs);
+ if (ret) {
+ XDNA_ERR(xdna, "create vfs failed, %d", ret);
+ return ret;
+ }
+ XDNA_DBG(xdna, "restored num_vfs %d", ndev->num_vfs);
+ }
+
+ return 0;
+}
+
+static int aie4_pf_suspend(struct amdxdna_dev *xdna)
+{
+ struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
+ struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
+
+ drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+ aie4_pf_hw_stop(ndev);
+ pci_disable_device(pdev);
+
+ XDNA_DBG(xdna, "pf suspend done");
+ return 0;
+}
+
+static int aie4_pf_resume(struct amdxdna_dev *xdna)
+{
+ struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
+ struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
+ int ret;
+
+ drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+
+ ret = pci_enable_device(pdev);
+ if (ret) {
+ XDNA_ERR(xdna, "enable pci device failed %d", ret);
+ return ret;
+ }
+ pci_set_master(pdev);
+
+ ret = aie4_pf_hw_start(ndev);
+ if (ret) {
+ XDNA_ERR(xdna, "hw_start failed %d", ret);
+ goto pci_disable;
+ }
+
+ ret = aie4_restore_sriov(ndev);
+ if (ret)
+ goto hw_stop;
+
+ XDNA_DBG(xdna, "pf resume done");
+ return 0;
+hw_stop:
+ aie4_pf_hw_stop(ndev);
+pci_disable:
+ pci_disable_device(pdev);
+ return ret;
+}
+
+static int aie4_vf_suspend(struct amdxdna_dev *xdna)
+{
+ struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
+ struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
+
+ drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+ aie4_hwctx_suspend_all(ndev, false);
+ /*
+ * partition_fini and mailbox messages should not be called here
+ * because PF suspend will do the cleanup for all VFs.
+ */
+ aie4_mailbox_fini(ndev);
+ pci_disable_device(pdev);
+
+ XDNA_DBG(xdna, "vf suspend done");
+ return 0;
+}
+
+static int aie4_vf_resume(struct amdxdna_dev *xdna)
+{
+ struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
+ struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
+ int ret;
+
+ drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+
+ ret = pci_enable_device(pdev);
+ if (ret) {
+ XDNA_ERR(xdna, "enable pci device failed %d", ret);
+ return ret;
+ }
+ pci_set_master(pdev);
+
+ ret = aie4_vf_hw_start(ndev);
+ if (ret) {
+ XDNA_ERR(xdna, "hw_start failed %d", ret);
+ /* Contexts cannot reconnect; fail waiters and abort running jobs. */
+ aie4_hwctx_suspend_all(ndev, true);
+ goto pci_disable;
+ }
+
+ ret = aie4_hwctx_resume_all(ndev);
+ if (ret) {
+ XDNA_ERR(xdna, "hwctx_resume failed %d", ret);
+ goto hw_clear;
+ }
+
+ XDNA_DBG(xdna, "vf resume done");
+ return 0;
+
+hw_clear:
+ aie4_hwctx_suspend_all(ndev, true);
+ aie4_vf_hw_stop(ndev);
+pci_disable:
+ pci_disable_device(pdev);
+ return ret;
+}
+
+static int aie4_classic_suspend(struct amdxdna_dev *xdna)
+{
+ struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
+ struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
+
+ drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+ aie4_hwctx_suspend_all(ndev, false);
+ aie4_classic_hw_stop(ndev);
+ pci_disable_device(pdev);
+
+ XDNA_DBG(xdna, "classic suspend done");
+ return 0;
+}
+
+static int aie4_classic_resume(struct amdxdna_dev *xdna)
+{
+ struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
+ struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
+ int ret;
+
+ drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+
+ ret = pci_enable_device(pdev);
+ if (ret) {
+ XDNA_ERR(xdna, "enable pci device failed %d", ret);
+ return ret;
+ }
+ pci_set_master(pdev);
+
+ ret = aie4_classic_hw_start(ndev);
+ if (ret) {
+ XDNA_ERR(xdna, "hw_start failed %d", ret);
+ /* Contexts cannot reconnect; fail waiters and abort running jobs. */
+ aie4_hwctx_suspend_all(ndev, true);
+ goto pci_disable;
+ }
+
+ ret = aie4_hwctx_resume_all(ndev);
+ if (ret) {
+ XDNA_ERR(xdna, "hwctx_resume failed %d", ret);
+ goto hw_clear;
+ }
+
+ XDNA_DBG(xdna, "classic resume done");
+ return 0;
+hw_clear:
+ aie4_hwctx_suspend_all(ndev, true);
+ aie4_classic_hw_stop(ndev);
+pci_disable:
+ pci_disable_device(pdev);
+ return ret;
+}
+
const struct amdxdna_dev_ops aie4_pf_ops = {
.init = aie4_pf_init,
.fini = aie4_pf_fini,
.debugfs_init = aie4_debugfs_init,
.sriov_configure = aie4_sriov_configure,
+ .resume = aie4_pf_resume,
+ .suspend = aie4_pf_suspend,
};
const struct amdxdna_dev_ops aie4_vf_ops = {
@@ -1085,6 +1328,8 @@ const struct amdxdna_dev_ops aie4_vf_ops = {
.hmm_invalidate = aie_hmm_invalidate,
.get_aie_info = aie4_get_info,
.set_aie_state = aie4_set_state,
+ .resume = aie4_vf_resume,
+ .suspend = aie4_vf_suspend,
};
const struct amdxdna_dev_ops aie4_classic_ops = {
@@ -1099,4 +1344,6 @@ const struct amdxdna_dev_ops aie4_classic_ops = {
.hmm_invalidate = aie_hmm_invalidate,
.get_aie_info = aie4_get_info,
.set_aie_state = aie4_set_state,
+ .resume = aie4_classic_resume,
+ .suspend = aie4_classic_suspend,
};
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index 87de22e80ae6..011d2f4f0b68 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -97,6 +97,7 @@ struct amdxdna_dev_hdl {
u32 total_col;
u32 max_aieclk_level;
u32 max_npuhclk_level;
+ u32 num_vfs;
struct dpm_clk_freq dpm_clk_tbl[AIE4_MAX_DPM_LEVEL_COUNT];
@@ -156,8 +157,11 @@ int aie4_cmd_submit(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job,
int aie4_hwctx_create(struct amdxdna_hwctx *hwctx);
void aie4_hwctx_destroy(struct amdxdna_hwctx *hwctx, enum aie4_hwctx_flags);
int aie4_hwctx_wait_for_running(struct amdxdna_hwctx *hwctx);
+void aie4_hwctx_resume_jobs(struct amdxdna_hwctx *hwctx);
/* aie4_pci.c */
+void aie4_hwctx_suspend_all(struct amdxdna_dev_hdl *ndev, int clean_jobs);
+int aie4_hwctx_resume_all(struct amdxdna_dev_hdl *ndev);
int aie4_restore_power_mode(struct amdxdna_dev_hdl *ndev);
/*
@@ -173,9 +177,14 @@ void aie4_free_notification(struct cert_comp *comp);
/* aie4_sriov.c */
#if IS_ENABLED(CONFIG_PCI_IOV)
+int aie4_create_vfs(struct amdxdna_dev_hdl *ndev, int num_vfs);
int aie4_sriov_configure(struct amdxdna_dev *xdna, int num_vfs);
int aie4_sriov_stop(struct amdxdna_dev_hdl *ndev);
#else
+static inline int aie4_create_vfs(struct amdxdna_dev_hdl *ndev, int num_vfs)
+{
+ return 0;
+}
#define aie4_sriov_configure NULL
static inline int aie4_sriov_stop(struct amdxdna_dev_hdl *ndev)
{
diff --git a/drivers/accel/amdxdna/aie4_sriov.c b/drivers/accel/amdxdna/aie4_sriov.c
index e1ce633768a5..0eea28f62676 100644
--- a/drivers/accel/amdxdna/aie4_sriov.c
+++ b/drivers/accel/amdxdna/aie4_sriov.c
@@ -26,7 +26,7 @@ static int aie4_destroy_vfs(struct amdxdna_dev_hdl *ndev)
return ret;
}
-static int aie4_create_vfs(struct amdxdna_dev_hdl *ndev, int num_vfs)
+int aie4_create_vfs(struct amdxdna_dev_hdl *ndev, int num_vfs)
{
DECLARE_AIE_MSG(aie4_msg_create_vfs, AIE4_MSG_OP_CREATE_VFS);
int ret;
@@ -55,6 +55,7 @@ int aie4_sriov_stop(struct amdxdna_dev_hdl *ndev)
}
pci_disable_sriov(pdev);
+ ndev->num_vfs = 0;
return aie4_destroy_vfs(ndev);
}
@@ -75,6 +76,7 @@ static int aie4_sriov_start(struct amdxdna_dev_hdl *ndev, int num_vfs)
return ret;
}
+ ndev->num_vfs = num_vfs;
return num_vfs;
}
diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.h b/drivers/accel/amdxdna/amdxdna_pci_drv.h
index 632f8ba74b72..fde48ef0ca6c 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.h
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.h
@@ -169,6 +169,9 @@ struct amdxdna_client {
#define amdxdna_for_each_hwctx(client, hwctx_id, entry) \
xa_for_each(&(client)->hwctx_xa, hwctx_id, entry)
+#define amdxdna_for_each_client(xdna, client) \
+ list_for_each_entry(client, &(xdna)->client_list, node)
+
/* Add device info below */
extern const struct amdxdna_dev_info dev_npu1_info;
extern const struct amdxdna_dev_info dev_npu3_classic_info;
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* [PATCH V2 18/20] accel/amdxdna: Link SR-IOV VFs for power management sequencing
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (16 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 17/20] accel/amdxdna: Implement AIE4 suspend and resume David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:35 ` sashiko-bot
2026-10-06 4:22 ` [PATCH V2 19/20] accel/amdxdna: Implement runtime suspend and resume support David Zhang
2026-10-06 4:22 ` [PATCH V2 20/20] accel/amdxdna: Enable AIE4 firmware logging to DRAM David Zhang
19 siblings, 1 reply; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello
Add PM device links between Physical Function (PF) supplier and Virtual
Function (VF) consumers via device_link_add() upon SR-IOV enablement.
This ensures the PM core enforces the proper power management sequence:
suspending VFs before the PF, and resuming the PF before VFs. If linking
fails, roll back SR-IOV initialization.
Also add a comment clarifying that pci_disable_sriov() removes VF drivers
before firmware VF contexts are destroyed.
The links are created only when SR-IOV is enabled and are removed
when a VF driver unbinds. Rebinding a VF driver alone is not
supported; to rebind, disable and re-enable SR-IOV by writing 0 and
then the number of VFs to sriov_numvfs, which recreates the VFs and
their links.
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_sriov.c | 73 ++++++++++++++++++++++++++++++
1 file changed, 73 insertions(+)
diff --git a/drivers/accel/amdxdna/aie4_sriov.c b/drivers/accel/amdxdna/aie4_sriov.c
index 0eea28f62676..3cad0526087d 100644
--- a/drivers/accel/amdxdna/aie4_sriov.c
+++ b/drivers/accel/amdxdna/aie4_sriov.c
@@ -56,9 +56,74 @@ int aie4_sriov_stop(struct amdxdna_dev_hdl *ndev)
pci_disable_sriov(pdev);
ndev->num_vfs = 0;
+
+ /*
+ * pci_disable_sriov() removes VF drivers first; call destroy_vfs after
+ * so firmware VF contexts are not cleared before VF drivers finish cleanup.
+ */
return aie4_destroy_vfs(ndev);
}
+static int aie4_for_each_vfs(struct amdxdna_dev *xdna,
+ int (*cb)(struct amdxdna_dev *, struct pci_dev *))
+{
+ struct pci_dev *pdev_pf = to_pci_dev(xdna->ddev.dev);
+ struct pci_dev *pdev_vf;
+ int pos, ret;
+ u16 vf_did;
+
+ pos = pci_find_ext_capability(pdev_pf, PCI_EXT_CAP_ID_SRIOV);
+ if (!pos)
+ return 0;
+ ret = pci_read_config_word(pdev_pf, pos + PCI_SRIOV_VF_DID, &vf_did);
+ if (ret) {
+ XDNA_ERR(xdna, "read VF Device ID failed %d", ret);
+ return -ENODEV;
+ }
+
+ for (pdev_vf = pci_get_device(pdev_pf->vendor, vf_did, NULL);
+ pdev_vf;
+ pdev_vf = pci_get_device(pdev_pf->vendor, vf_did, pdev_vf)) {
+ if (!pdev_vf->is_virtfn || pdev_vf->physfn != pdev_pf)
+ continue;
+
+ ret = cb(xdna, pdev_vf);
+ if (ret) {
+ /* Release reference on early return. */
+ pci_dev_put(pdev_vf);
+ return ret;
+ }
+ }
+
+ return 0;
+}
+
+static int aie4_link_vf(struct amdxdna_dev *xdna, struct pci_dev *pdev_vf)
+{
+ struct pci_dev *pdev_pf = to_pci_dev(xdna->ddev.dev);
+ struct device_link *link;
+
+ /*
+ * The link is removed when the VF driver unbinds. To rebind VF
+ * drivers, re-enable SR-IOV via sriov_numvfs (0, then N).
+ */
+ link = device_link_add(&pdev_vf->dev, /* consumer = VF */
+ &pdev_pf->dev, /* supplier = PF */
+ DL_FLAG_PM_RUNTIME | DL_FLAG_AUTOREMOVE_CONSUMER);
+ if (!link) {
+ XDNA_ERR(xdna, "Failed to link VF %s", pci_name(pdev_vf));
+ return -EINVAL;
+ }
+
+ XDNA_DBG(xdna, "Linked VF %s", pci_name(pdev_vf));
+ return 0;
+}
+
+static int aie4_link_vfs(struct amdxdna_dev *xdna)
+{
+ return aie4_for_each_vfs(xdna, aie4_link_vf);
+}
+
static int aie4_sriov_start(struct amdxdna_dev_hdl *ndev, int num_vfs)
{
struct amdxdna_dev *xdna = ndev->aie.xdna;
@@ -76,6 +141,14 @@ static int aie4_sriov_start(struct amdxdna_dev_hdl *ndev, int num_vfs)
return ret;
}
+ ret = aie4_link_vfs(xdna);
+ if (ret) {
+ XDNA_ERR(xdna, "link VFs failed, ret: %d", ret);
+ pci_disable_sriov(pdev);
+ aie4_destroy_vfs(ndev);
+ return ret;
+ }
+
ndev->num_vfs = num_vfs;
return num_vfs;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* Re: [PATCH V2 18/20] accel/amdxdna: Link SR-IOV VFs for power management sequencing
2026-10-06 4:22 ` [PATCH V2 18/20] accel/amdxdna: Link SR-IOV VFs for power management sequencing David Zhang
@ 2026-10-06 4:35 ` sashiko-bot
0 siblings, 0 replies; 31+ messages in thread
From: sashiko-bot @ 2026-10-06 4:35 UTC (permalink / raw)
To: David Zhang; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] PM device link between PF and VF is lost on VF driver unbind
--
commit e5da3c2c28df6a2bd8639c6fb55cd8abc88ea7e5
Author: David Zhang <yidong.zhang@amd.com>
accel/amdxdna: Link SR-IOV VFs for power management sequencing
This commit adds PM device links between Physical Function (PF) supplier
and Virtual Function (VF) consumers via device_link_add() upon SR-IOV
enablement. The intent is to ensure the PM core enforces proper sequencing
between the PF and VFs.
> diff --git a/drivers/accel/amdxdna/aie4_sriov.c b/drivers/accel/amdxdna/aie4_sriov.c
> index 0eea28f626763..3cad0526087db 100644
> --- a/drivers/accel/amdxdna/aie4_sriov.c
> +++ b/drivers/accel/amdxdna/aie4_sriov.c
[ ... ]
> @@ -56,9 +56,74 @@ int aie4_sriov_stop(struct amdxdna_dev_hdl *ndev)
[ ... ]
> +static int aie4_link_vf(struct amdxdna_dev *xdna, struct pci_dev *pdev_vf)
> +{
> + struct pci_dev *pdev_pf = to_pci_dev(xdna->ddev.dev);
> + struct device_link *link;
> +
> + /*
> + * The link is removed when the VF driver unbinds. To rebind VF
> + * drivers, re-enable SR-IOV via sriov_numvfs (0, then N).
> + */
> + link = device_link_add(&pdev_vf->dev, /* consumer = VF */
> + &pdev_pf->dev, /* supplier = PF */
> + DL_FLAG_PM_RUNTIME | DL_FLAG_AUTOREMOVE_CONSUMER);
[Severity: High]
Does this flag choice break subsequent binds like vfio-pci passthrough?
Using DL_FLAG_AUTOREMOVE_CONSUMER causes the PM device link between the PF
and VF to be permanently deleted when the VF driver is unbound via sysfs.
If the PF is then allowed to enter runtime suspend and the VF is later
rebound to a driver like vfio-pci for virtualization passthrough, the PM
core will not automatically resume the PF. The VF driver will then probe
while the PF hardware is suspended, which can lead to a system crash or
hang.
While the comment notes that rebinding is not supported, any root user
or virtualization management daemon (like libvirt) can still trigger
this standard SR-IOV passthrough use-case because the driver does not set
suppress_bind_attrs = true to block sysfs unbind/bind operations.
> + if (!link) {
> + XDNA_ERR(xdna, "Failed to link VF %s", pci_name(pdev_vf));
> + return -EINVAL;
> + }
> +
> + XDNA_DBG(xdna, "Linked VF %s", pci_name(pdev_vf));
> + return 0;
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261006042230.547807-1-yidong.zhang@amd.com?part=18
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH V2 19/20] accel/amdxdna: Implement runtime suspend and resume support
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (17 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 18/20] accel/amdxdna: Link SR-IOV VFs for power management sequencing David Zhang
@ 2026-10-06 4:22 ` David Zhang
2026-10-06 4:43 ` sashiko-bot
2026-10-06 4:22 ` [PATCH V2 20/20] accel/amdxdna: Enable AIE4 firmware logging to DRAM David Zhang
19 siblings, 1 reply; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello
Add runtime suspend/resume for AIE4 driver.
Wake and acquire an RPM reference across amdxdna_sriov_configure() so
that SR-IOV management commands execute with the device active.
Update amdxdna_pm.c to implement amdxdna_pm_runtime_suspend() and
amdxdna_pm_runtime_resume().
Wrap .driver.pm with pm_ptr() to allow the dev_pm_ops structure and
its callbacks to be discarded as dead code when CONFIG_PM is disabled.
Detect passthrough VFs by comparing the VF driver with the PF driver,
since drv->owner is NULL for built-in drivers.
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie2_pci.c | 2 ++
drivers/accel/amdxdna/aie4_pci.c | 31 +++++++++++++++++++
drivers/accel/amdxdna/aie4_pci.h | 8 +++++
drivers/accel/amdxdna/aie4_sriov.c | 41 +++++++++++++++++++++++++
drivers/accel/amdxdna/amdxdna_pci_drv.c | 17 +++++++---
drivers/accel/amdxdna/amdxdna_pci_drv.h | 2 ++
drivers/accel/amdxdna/amdxdna_pm.c | 34 ++++++++++++++++++++
drivers/accel/amdxdna/amdxdna_pm.h | 4 ++-
8 files changed, 134 insertions(+), 5 deletions(-)
diff --git a/drivers/accel/amdxdna/aie2_pci.c b/drivers/accel/amdxdna/aie2_pci.c
index bee3d973e6bc..d8b1aa3e0bef 100644
--- a/drivers/accel/amdxdna/aie2_pci.c
+++ b/drivers/accel/amdxdna/aie2_pci.c
@@ -1207,6 +1207,8 @@ const struct amdxdna_dev_ops aie2_ops = {
.fini = aie2_fini,
.resume = aie2_hw_resume,
.suspend = aie2_hw_suspend,
+ .runtime_resume = aie2_hw_resume,
+ .runtime_suspend = aie2_hw_suspend,
.get_aie_info = aie2_get_info,
.set_aie_state = aie2_set_state,
.hwctx_init = aie2_hwctx_init,
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index f7fa55c82baa..c395052eb6fd 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -1162,6 +1162,17 @@ static int aie4_pf_suspend(struct amdxdna_dev *xdna)
return 0;
}
+static int aie4_pf_runtime_suspend(struct amdxdna_dev *xdna)
+{
+ int ret;
+
+ ret = aie4_vfs_alive(xdna);
+ if (ret)
+ return ret;
+
+ return aie4_pf_suspend(xdna);
+}
+
static int aie4_pf_resume(struct amdxdna_dev *xdna)
{
struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
@@ -1214,6 +1225,20 @@ static int aie4_vf_suspend(struct amdxdna_dev *xdna)
return 0;
}
+static int aie4_vf_runtime_suspend(struct amdxdna_dev *xdna)
+{
+ struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
+ struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
+
+ drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+ aie4_hwctx_suspend_all(ndev, false);
+ aie4_vf_hw_stop(ndev);
+ pci_disable_device(pdev);
+
+ XDNA_DBG(xdna, "vf runtime suspend done");
+ return 0;
+}
+
static int aie4_vf_resume(struct amdxdna_dev *xdna)
{
struct amdxdna_dev_hdl *ndev = xdna->dev_handle;
@@ -1314,6 +1339,8 @@ const struct amdxdna_dev_ops aie4_pf_ops = {
.sriov_configure = aie4_sriov_configure,
.resume = aie4_pf_resume,
.suspend = aie4_pf_suspend,
+ .runtime_resume = aie4_pf_resume,
+ .runtime_suspend = aie4_pf_runtime_suspend,
};
const struct amdxdna_dev_ops aie4_vf_ops = {
@@ -1330,6 +1357,8 @@ const struct amdxdna_dev_ops aie4_vf_ops = {
.set_aie_state = aie4_set_state,
.resume = aie4_vf_resume,
.suspend = aie4_vf_suspend,
+ .runtime_resume = aie4_vf_resume,
+ .runtime_suspend = aie4_vf_runtime_suspend,
};
const struct amdxdna_dev_ops aie4_classic_ops = {
@@ -1346,4 +1375,6 @@ const struct amdxdna_dev_ops aie4_classic_ops = {
.set_aie_state = aie4_set_state,
.resume = aie4_classic_resume,
.suspend = aie4_classic_suspend,
+ .runtime_resume = aie4_classic_resume,
+ .runtime_suspend = aie4_classic_suspend,
};
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index 011d2f4f0b68..a03c39457ab8 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -180,16 +180,24 @@ void aie4_free_notification(struct cert_comp *comp);
int aie4_create_vfs(struct amdxdna_dev_hdl *ndev, int num_vfs);
int aie4_sriov_configure(struct amdxdna_dev *xdna, int num_vfs);
int aie4_sriov_stop(struct amdxdna_dev_hdl *ndev);
+int aie4_vfs_alive(struct amdxdna_dev *xdna);
#else
static inline int aie4_create_vfs(struct amdxdna_dev_hdl *ndev, int num_vfs)
{
return 0;
}
+
#define aie4_sriov_configure NULL
+
static inline int aie4_sriov_stop(struct amdxdna_dev_hdl *ndev)
{
return 0;
}
+
+static inline int aie4_vfs_alive(struct amdxdna_dev *xdna)
+{
+ return 0;
+}
#endif
extern const struct amdxdna_dev_ops aie4_pf_ops;
diff --git a/drivers/accel/amdxdna/aie4_sriov.c b/drivers/accel/amdxdna/aie4_sriov.c
index 3cad0526087d..c89bb033bb16 100644
--- a/drivers/accel/amdxdna/aie4_sriov.c
+++ b/drivers/accel/amdxdna/aie4_sriov.c
@@ -6,6 +6,7 @@
#include <drm/amdxdna_accel.h>
#include <drm/drm_print.h>
#include <linux/pci.h>
+#include <linux/pm_runtime.h>
#include "aie.h"
#include "aie4_msg_priv.h"
@@ -119,6 +120,46 @@ static int aie4_link_vf(struct amdxdna_dev *xdna, struct pci_dev *pdev_vf)
return 0;
}
+/* Check if a VF is actively running workloads or in passthrough. */
+static int aie4_check_vf_alive(struct amdxdna_dev *xdna, struct pci_dev *pdev_vf)
+{
+ struct device *pf_dev = xdna->ddev.dev;
+ struct device_driver *drv;
+ bool busy = false;
+
+ if (!device_trylock(&pdev_vf->dev)) {
+ XDNA_WARN(xdna, "VF:%s is busy (locked)", pci_name(pdev_vf));
+ return -EBUSY;
+ }
+
+ drv = pdev_vf->dev.driver;
+ if (!drv) {
+ device_unlock(&pdev_vf->dev);
+ return 0;
+ }
+
+ /* VF bound to a driver other than the PF's (amdxdna) is passthrough. */
+ if (drv != pf_dev->driver) {
+ XDNA_WARN(xdna, "VF:%s is in passthrough", pci_name(pdev_vf));
+ busy = true;
+ } else if (!pm_runtime_suspended(&pdev_vf->dev)) {
+ XDNA_WARN(xdna, "VF:%s is busy", pci_name(pdev_vf));
+ busy = true;
+ }
+
+ device_unlock(&pdev_vf->dev);
+ return busy ? -EBUSY : 0;
+}
+
+int aie4_vfs_alive(struct amdxdna_dev *xdna)
+{
+ if (pci_vfs_assigned(to_pci_dev(xdna->ddev.dev))) {
+ XDNA_WARN(xdna, "VF devices are being used in VMs, cannot suspend");
+ return -EBUSY;
+ }
+ return aie4_for_each_vfs(xdna, aie4_check_vf_alive);
+}
+
static int aie4_link_vfs(struct amdxdna_dev *xdna)
{
return aie4_for_each_vfs(xdna, aie4_link_vf);
diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.c b/drivers/accel/amdxdna/amdxdna_pci_drv.c
index 8faf651fb534..57985ebee0ac 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.c
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.c
@@ -469,18 +469,27 @@ static void amdxdna_remove(struct pci_dev *pdev)
static const struct dev_pm_ops amdxdna_pm_ops = {
SYSTEM_SLEEP_PM_OPS(amdxdna_pm_suspend, amdxdna_pm_resume)
- RUNTIME_PM_OPS(amdxdna_pm_suspend, amdxdna_pm_resume, NULL)
+ RUNTIME_PM_OPS(amdxdna_pm_runtime_suspend, amdxdna_pm_runtime_resume, NULL)
};
static int amdxdna_sriov_configure(struct pci_dev *pdev, int num_vfs)
{
struct amdxdna_dev *xdna = pci_get_drvdata(pdev);
+ int ret;
guard(mutex)(&xdna->dev_lock);
+
+ ret = amdxdna_pm_resume_get_locked(xdna);
+ if (ret)
+ return ret;
+
if (xdna->dev_info->ops->sriov_configure)
- return xdna->dev_info->ops->sriov_configure(xdna, num_vfs);
+ ret = xdna->dev_info->ops->sriov_configure(xdna, num_vfs);
+ else
+ ret = -EOPNOTSUPP;
- return -ENOENT;
+ amdxdna_pm_suspend_put(xdna);
+ return ret;
}
static struct pci_driver amdxdna_pci_driver = {
@@ -488,7 +497,7 @@ static struct pci_driver amdxdna_pci_driver = {
.id_table = pci_ids,
.probe = amdxdna_probe,
.remove = amdxdna_remove,
- .driver.pm = &amdxdna_pm_ops,
+ .driver.pm = pm_ptr(&amdxdna_pm_ops),
.sriov_configure = amdxdna_sriov_configure,
};
diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.h b/drivers/accel/amdxdna/amdxdna_pci_drv.h
index fde48ef0ca6c..f669f6a6cc4c 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.h
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.h
@@ -57,6 +57,8 @@ struct amdxdna_dev_ops {
void (*debugfs_init)(struct amdxdna_dev *xdna);
int (*resume)(struct amdxdna_dev *xdna);
int (*suspend)(struct amdxdna_dev *xdna);
+ int (*runtime_resume)(struct amdxdna_dev *xdna);
+ int (*runtime_suspend)(struct amdxdna_dev *xdna);
int (*sriov_configure)(struct amdxdna_dev *xdna, int num_vfs);
int (*hwctx_init)(struct amdxdna_hwctx *hwctx);
void (*hwctx_stop)(struct amdxdna_hwctx *hwctx);
diff --git a/drivers/accel/amdxdna/amdxdna_pm.c b/drivers/accel/amdxdna/amdxdna_pm.c
index 9c030b7836fb..2b4ce301bb96 100644
--- a/drivers/accel/amdxdna/amdxdna_pm.c
+++ b/drivers/accel/amdxdna/amdxdna_pm.c
@@ -37,11 +37,40 @@ int amdxdna_pm_resume(struct device *dev)
return ret;
}
+int amdxdna_pm_runtime_suspend(struct device *dev)
+{
+ struct amdxdna_dev *xdna = to_xdna_dev(dev_get_drvdata(dev));
+ int ret = -EOPNOTSUPP;
+
+ guard(mutex)(&xdna->dev_lock);
+ if (xdna->dev_info->ops->runtime_suspend)
+ ret = xdna->dev_info->ops->runtime_suspend(xdna);
+
+ XDNA_DBG(xdna, "Runtime suspend done ret %d", ret);
+ return ret;
+}
+
+int amdxdna_pm_runtime_resume(struct device *dev)
+{
+ struct amdxdna_dev *xdna = to_xdna_dev(dev_get_drvdata(dev));
+ int ret = -EOPNOTSUPP;
+
+ guard(mutex)(&xdna->dev_lock);
+ if (xdna->dev_info->ops->runtime_resume)
+ ret = xdna->dev_info->ops->runtime_resume(xdna);
+
+ XDNA_DBG(xdna, "Runtime resume done ret %d", ret);
+ return ret;
+}
+
int amdxdna_pm_resume_get(struct amdxdna_dev *xdna)
{
struct device *dev = xdna->ddev.dev;
int ret;
+ if (!pm_runtime_enabled(dev))
+ return 0;
+
ret = pm_runtime_resume_and_get(dev);
if (ret) {
XDNA_ERR(xdna, "Resume failed: %d", ret);
@@ -55,6 +84,10 @@ void amdxdna_pm_suspend_put(struct amdxdna_dev *xdna)
{
struct device *dev = xdna->ddev.dev;
+ if (!pm_runtime_enabled(dev))
+ return;
+
+ pm_runtime_mark_last_busy(dev);
pm_runtime_put_autosuspend(dev);
}
@@ -66,6 +99,7 @@ void amdxdna_pm_init(struct amdxdna_dev *xdna)
pm_runtime_set_autosuspend_delay(dev, AMDXDNA_AUTOSUSPEND_DELAY);
pm_runtime_use_autosuspend(dev);
pm_runtime_allow(dev);
+ pm_runtime_mark_last_busy(dev);
pm_runtime_put_autosuspend(dev);
}
diff --git a/drivers/accel/amdxdna/amdxdna_pm.h b/drivers/accel/amdxdna/amdxdna_pm.h
index 3d26b973e0e3..26df3d50d8ea 100644
--- a/drivers/accel/amdxdna/amdxdna_pm.h
+++ b/drivers/accel/amdxdna/amdxdna_pm.h
@@ -9,7 +9,9 @@
#include "amdxdna_pci_drv.h"
int amdxdna_pm_suspend(struct device *dev);
-int amdxdna_pm_resume(struct device *dev);
+int amdxdna_pm_resume(struct device *dev);
+int amdxdna_pm_runtime_suspend(struct device *dev);
+int amdxdna_pm_runtime_resume(struct device *dev);
int amdxdna_pm_resume_get(struct amdxdna_dev *xdna);
void amdxdna_pm_suspend_put(struct amdxdna_dev *xdna);
void amdxdna_pm_init(struct amdxdna_dev *xdna);
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread* Re: [PATCH V2 19/20] accel/amdxdna: Implement runtime suspend and resume support
2026-10-06 4:22 ` [PATCH V2 19/20] accel/amdxdna: Implement runtime suspend and resume support David Zhang
@ 2026-10-06 4:43 ` sashiko-bot
0 siblings, 0 replies; 31+ messages in thread
From: sashiko-bot @ 2026-10-06 4:43 UTC (permalink / raw)
To: David Zhang; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] accel/amdxdna: VF device link removed on unbind causes PF to suspend
- [Medium] pm: returning -EOPNOTSUPP from runtime_suspend bricks PM state machine
- [Low] accel/amdxdna: runtime suspend deferral spams kernel log for passthrough VFs
--
commit 9c2d41f547122e82068d6c644e6875d8381ac627
Author: David Zhang <yidong.zhang@amd.com>
Subject: accel/amdxdna: Implement runtime suspend and resume support
This commit adds runtime PM support to the AIE4 driver. It wraps the
device PM operations and implements runtime suspend/resume callbacks
for the PF and VF. It also detects passthrough VFs to prevent the PF
from suspending when VFs are in use.
> diff --git a/drivers/accel/amdxdna/aie4_sriov.c b/drivers/accel/amdxdna/aie4_sriov.c
> index 3cad0526087db..c89bb033bb167 100644
> --- a/drivers/accel/amdxdna/aie4_sriov.c
> +++ b/drivers/accel/amdxdna/aie4_sriov.c
[ ... ]
> +/* Check if a VF is actively running workloads or in passthrough. */
> +static int aie4_check_vf_alive(struct amdxdna_dev *xdna, struct pci_dev *pdev_vf)
> +{
> + struct device *pf_dev = xdna->ddev.dev;
> + struct device_driver *drv;
> + bool busy = false;
> +
> + if (!device_trylock(&pdev_vf->dev)) {
> + XDNA_WARN(xdna, "VF:%s is busy (locked)", pci_name(pdev_vf));
> + return -EBUSY;
> + }
> +
> + drv = pdev_vf->dev.driver;
> + if (!drv) {
> + device_unlock(&pdev_vf->dev);
> + return 0;
> + }
[Severity: High]
Does returning 0 here allow the PF to suspend prematurely when a VF is
unbound?
In aie4_link_vf(), the device link between the PF and VF is created with
DL_FLAG_AUTOREMOVE_CONSUMER. When the user unbinds the host driver to
prepare for passthrough (e.g., to vfio-pci), this device link drops.
Since the VF temporarily has no driver during this transition, returning 0
here allows the PM core to successfully runtime-suspend the PF.
When vfio-pci later binds to the VF, it wakes the VF, but because the PM
link to the PF no longer exists, the PF remains suspended. The guest VM will
then attempt to use the VF with the underlying hardware powered off.
Could this lead to PCIe AER, host freezes, or MMIO faults?
> +
> + /* VF bound to a driver other than the PF's (amdxdna) is passthrough. */
> + if (drv != pf_dev->driver) {
> + XDNA_WARN(xdna, "VF:%s is in passthrough", pci_name(pdev_vf));
> + busy = true;
> + } else if (!pm_runtime_suspended(&pdev_vf->dev)) {
> + XDNA_WARN(xdna, "VF:%s is busy", pci_name(pdev_vf));
> + busy = true;
> + }
> +
> + device_unlock(&pdev_vf->dev);
> + return busy ? -EBUSY : 0;
> +}
> +
> +int aie4_vfs_alive(struct amdxdna_dev *xdna)
> +{
> + if (pci_vfs_assigned(to_pci_dev(xdna->ddev.dev))) {
> + XDNA_WARN(xdna, "VF devices are being used in VMs, cannot suspend");
> + return -EBUSY;
> + }
[Severity: Low]
Will using XDNA_WARN here flood the kernel log during normal passthrough
operation?
Returning -EBUSY to defer suspend is correct, but the PM core re-evaluates
auto-suspend upon every pm_runtime_get/put cycle (e.g., from sysfs reads or
background tasks).
Because passthrough or VM assignment is a normal, expected state, returning
-EBUSY repeatedly will spam the log with these warnings.
Should these expected state deferrals use XDNA_DBG instead?
> diff --git a/drivers/accel/amdxdna/amdxdna_pm.c b/drivers/accel/amdxdna/amdxdna_pm.c
> index 9c030b7836fbb..2b4ce301bb96f 100644
> --- a/drivers/accel/amdxdna/amdxdna_pm.c
> +++ b/drivers/accel/amdxdna/amdxdna_pm.c
[ ... ]
> +int amdxdna_pm_runtime_suspend(struct device *dev)
> +{
> + struct amdxdna_dev *xdna = to_xdna_dev(dev_get_drvdata(dev));
> + int ret = -EOPNOTSUPP;
> +
> + guard(mutex)(&xdna->dev_lock);
> + if (xdna->dev_info->ops->runtime_suspend)
> + ret = xdna->dev_info->ops->runtime_suspend(xdna);
[Severity: Medium]
Can returning -EOPNOTSUPP here permanently break the PM state machine for
devices without a runtime_suspend callback?
The Linux PM core (specifically rpm_suspend() in drivers/base/power/runtime.c)
treats any return value from the runtime_suspend callback other than 0,
-EAGAIN, or -EBUSY as a fatal error.
This triggers the PM core to set dev->power.runtime_error = 1, which blocks
all future runtime PM operations (get, put, suspend, resume) for that
device until manually cleared.
If a device variant does not implement the callback, shouldn't this wrapper
return 0 so the PM core can safely transition?
> +
> + XDNA_DBG(xdna, "Runtime suspend done ret %d", ret);
> + return ret;
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261006042230.547807-1-yidong.zhang@amd.com?part=19
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH V2 20/20] accel/amdxdna: Enable AIE4 firmware logging to DRAM
2026-10-06 4:22 [PATCH V2 00/20] accel/amdxdna: Kernel submission and PM for AIE4 David Zhang
` (18 preceding siblings ...)
2026-10-06 4:22 ` [PATCH V2 19/20] accel/amdxdna: Implement runtime suspend and resume support David Zhang
@ 2026-10-06 4:22 ` David Zhang
19 siblings, 0 replies; 31+ messages in thread
From: David Zhang @ 2026-10-06 4:22 UTC (permalink / raw)
To: quic_jhugo, karol.wachowski, max.zhen, lizhi.hou, ogabbay,
dri-devel, linux-kernel
Cc: David Zhang, sonal.santan, mario.limonciello
Allocate a DRAM buffer for firmware logging, and also set the log level
to less verbose. This will give the best performance numbers.
Signed-off-by: David Zhang <yidong.zhang@amd.com>
---
drivers/accel/amdxdna/aie4_message.c | 20 ++++++++++
drivers/accel/amdxdna/aie4_msg_priv.h | 24 ++++++++++++
drivers/accel/amdxdna/aie4_pci.c | 53 +++++++++++++++++++++++++++
drivers/accel/amdxdna/aie4_pci.h | 5 +++
4 files changed, 102 insertions(+)
diff --git a/drivers/accel/amdxdna/aie4_message.c b/drivers/accel/amdxdna/aie4_message.c
index 5720aa88e6d6..89902492502c 100644
--- a/drivers/accel/amdxdna/aie4_message.c
+++ b/drivers/accel/amdxdna/aie4_message.c
@@ -246,6 +246,26 @@ int aie4_attach_work_buffer(struct amdxdna_dev_hdl *ndev)
return ret;
}
+int aie4_start_fw_log(struct amdxdna_dev_hdl *ndev, u32 level)
+{
+ DECLARE_AIE_MSG(aie4_msg_start_fw_log, AIE4_MSG_OP_START_FW_LOG);
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+ int ret;
+
+ req.buff_addr = ndev->fw_log_buf_addr;
+ req.buff_size = ndev->fw_log_buf_size;
+ req.log_level = level;
+
+ ret = aie_send_mgmt_msg_wait(&ndev->aie, &msg);
+ if (ret)
+ XDNA_WARN(xdna, "Failed to start fw log, ret %d", ret);
+ else
+ XDNA_DBG(xdna, "Started fw log, level %u size 0x%x",
+ level, ndev->fw_log_buf_size);
+
+ return ret;
+}
+
int aie4_msg_set_power_mode(struct amdxdna_dev_hdl *ndev, u8 power_mode)
{
DECLARE_AIE_MSG(aie4_msg_power_override, AIE4_MSG_OP_POWER_OVERRIDE);
diff --git a/drivers/accel/amdxdna/aie4_msg_priv.h b/drivers/accel/amdxdna/aie4_msg_priv.h
index 636bf8d04c76..566f6abc9e2d 100644
--- a/drivers/accel/amdxdna/aie4_msg_priv.h
+++ b/drivers/accel/amdxdna/aie4_msg_priv.h
@@ -29,6 +29,7 @@ enum aie4_msg_opcode {
AIE4_MSG_OP_GET_CURRENT_DPM_LEVEL = 0x30013,
AIE4_MSG_OP_ATTACH_WORK_BUFFER = 0x40001,
+ AIE4_MSG_OP_START_FW_LOG = 0x40003,
};
enum aie4_msg_status {
@@ -263,4 +264,27 @@ struct aie4_msg_attach_work_buffer_resp {
enum aie4_msg_status status;
} __packed;
+/* Dynamic firmware log levels. */
+enum aie4_fw_log_level {
+ AIE4_FW_LOG_LEVEL_OFF,
+ AIE4_FW_LOG_LEVEL_ERR,
+ AIE4_FW_LOG_LEVEL_WRN,
+ AIE4_FW_LOG_LEVEL_INF,
+ AIE4_FW_LOG_LEVEL_DBG,
+ AIE4_FW_LOG_LEVEL_MAX,
+};
+
+#define AIE4_FW_LOG_BUF_SIZE SZ_1M
+
+struct aie4_msg_start_fw_log_req {
+ __u64 buff_addr;
+ __u32 buff_size;
+ __u32 log_level;
+ __u32 reserved;
+} __packed;
+
+struct aie4_msg_start_fw_log_resp {
+ enum aie4_msg_status status;
+} __packed;
+
#endif /* _AIE4_MSG_PRIV_H_ */
diff --git a/drivers/accel/amdxdna/aie4_pci.c b/drivers/accel/amdxdna/aie4_pci.c
index c395052eb6fd..d2c3b48e8ec3 100644
--- a/drivers/accel/amdxdna/aie4_pci.c
+++ b/drivers/accel/amdxdna/aie4_pci.c
@@ -376,6 +376,16 @@ static int aie4_config_fw(struct amdxdna_dev_hdl *ndev)
if (ret == -ETIME)
return ret;
+ /*
+ * Give the firmware high performance DRAM to log into with less
+ * verbose level.
+ */
+ if (ndev->fw_log_buf) {
+ ret = aie4_start_fw_log(ndev, AIE4_FW_LOG_LEVEL_ERR);
+ if (ret == -ETIME)
+ return ret;
+ }
+
return 0;
}
@@ -934,6 +944,41 @@ static void aie4_free_work_buffer(struct amdxdna_dev_hdl *ndev)
ndev->work_buf = NULL;
}
+/*
+ * Firmware logging is best effort: a device that cannot spare the buffer still
+ * runs, it just does not log. Never fail hw start or probe on this.
+ */
+static void aie4_alloc_fw_log_buffer(struct amdxdna_dev_hdl *ndev)
+{
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+ u32 buf_size = AIE4_FW_LOG_BUF_SIZE;
+
+ ndev->fw_log_buf = amdxdna_alloc_msg_buffer(xdna, &buf_size,
+ &ndev->fw_log_buf_addr);
+ if (IS_ERR(ndev->fw_log_buf)) {
+ XDNA_WARN(xdna, "Failed to alloc fw log buffer, size 0x%x",
+ AIE4_FW_LOG_BUF_SIZE);
+ ndev->fw_log_buf = NULL;
+ return;
+ }
+
+ ndev->fw_log_buf_size = buf_size;
+ XDNA_DBG(xdna, "FW log buffer allocated: size 0x%x", buf_size);
+}
+
+/* Free logging buffer after firmware execution has stopped. */
+static void aie4_free_fw_log_buffer(struct amdxdna_dev_hdl *ndev)
+{
+ struct amdxdna_dev *xdna = ndev->aie.xdna;
+
+ if (!ndev->fw_log_buf)
+ return;
+
+ amdxdna_free_msg_buffer(xdna, ndev->fw_log_buf_size, ndev->fw_log_buf,
+ ndev->fw_log_buf_addr);
+ ndev->fw_log_buf = NULL;
+}
+
static int aie4_pf_init(struct amdxdna_dev *xdna)
{
int ret;
@@ -946,6 +991,8 @@ static int aie4_pf_init(struct amdxdna_dev *xdna)
if (ret)
return ret;
+ aie4_alloc_fw_log_buffer(xdna->dev_handle);
+
ret = aie4_pf_hw_start(xdna->dev_handle);
if (ret)
goto free_work_buf;
@@ -953,6 +1000,7 @@ static int aie4_pf_init(struct amdxdna_dev *xdna)
return 0;
free_work_buf:
+ aie4_free_fw_log_buffer(xdna->dev_handle);
aie4_free_work_buffer(xdna->dev_handle);
return ret;
}
@@ -980,6 +1028,8 @@ static int aie4_classic_init(struct amdxdna_dev *xdna)
if (ret)
return ret;
+ aie4_alloc_fw_log_buffer(xdna->dev_handle);
+
ret = aie4_classic_hw_start(xdna->dev_handle);
if (ret)
goto free_work_buf;
@@ -987,6 +1037,7 @@ static int aie4_classic_init(struct amdxdna_dev *xdna)
return 0;
free_work_buf:
+ aie4_free_fw_log_buffer(xdna->dev_handle);
aie4_free_work_buffer(xdna->dev_handle);
return ret;
}
@@ -995,6 +1046,7 @@ static void aie4_pf_fini(struct amdxdna_dev *xdna)
{
aie4_sriov_stop(xdna->dev_handle);
aie4_pf_hw_stop(xdna->dev_handle);
+ aie4_free_fw_log_buffer(xdna->dev_handle);
aie4_free_work_buffer(xdna->dev_handle);
}
@@ -1006,6 +1058,7 @@ static void aie4_vf_fini(struct amdxdna_dev *xdna)
static void aie4_classic_fini(struct amdxdna_dev *xdna)
{
aie4_classic_hw_stop(xdna->dev_handle);
+ aie4_free_fw_log_buffer(xdna->dev_handle);
aie4_free_work_buffer(xdna->dev_handle);
}
diff --git a/drivers/accel/amdxdna/aie4_pci.h b/drivers/accel/amdxdna/aie4_pci.h
index a03c39457ab8..b6cca62abcbc 100644
--- a/drivers/accel/amdxdna/aie4_pci.h
+++ b/drivers/accel/amdxdna/aie4_pci.h
@@ -108,6 +108,10 @@ struct amdxdna_dev_hdl {
dma_addr_t work_buf_addr;
u32 work_buf_size;
+ void *fw_log_buf;
+ dma_addr_t fw_log_buf_addr;
+ u32 fw_log_buf_size;
+
u8 pw_mode;
/* Context switch hysteresis timeout in microseconds. */
@@ -128,6 +132,7 @@ int aie4_query_aie_version(struct amdxdna_dev_hdl *ndev,
struct amdxdna_drm_query_aie_version *version);
int aie4_suspend_fw(struct amdxdna_dev_hdl *ndev);
int aie4_attach_work_buffer(struct amdxdna_dev_hdl *ndev);
+int aie4_start_fw_log(struct amdxdna_dev_hdl *ndev, u32 level);
int aie4_query_npu_firmware_version(struct amdxdna_dev_hdl *ndev,
struct amdxdna_drm_query_firmware_version *fw_version);
int aie4_query_cert_firmware_version(struct amdxdna_dev_hdl *ndev,
--
2.34.1
^ permalink raw reply related [flat|nested] 31+ messages in thread