accel/amdxdna: Fix cu_idx being cleared by memset() during command setup

[PATCH V1] accel/amdxdna: Fix cu_idx being cleared by memset() during command setup

Posted by Lizhi Hou 1 week, 1 day ago

For one command type, cu_idx is assigned before calling memset() on the
command structure. This results in cu_idx being overwritten, causing the
firmware to receive an incomplete or invalid command and leading to
unexpected command failures.

Fix this by moving the memset() call before initializing cu_idx so that
all fields are populated in the correct order.

Fixes: 71829d7f2f70 ("accel/amdxdna: Use MSG_OP_CHAIN_EXEC_NPU when supported")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
 drivers/accel/amdxdna/aie2_message.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/accel/amdxdna/aie2_message.c b/drivers/accel/amdxdna/aie2_message.c
index a75156800467..03b75757a6e6 100644
--- a/drivers/accel/amdxdna/aie2_message.c
+++ b/drivers/accel/amdxdna/aie2_message.c
@@ -652,6 +652,7 @@ aie2_cmdlist_fill_npu_cf(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *siz
 	u32 cmd_len;
 	void *cmd;
 
+	memset(npu_slot, 0, sizeof(*npu_slot));
 	cmd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
 	if (*size < sizeof(*npu_slot) + cmd_len)
 		return -EINVAL;
@@ -660,7 +661,6 @@ aie2_cmdlist_fill_npu_cf(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *siz
 	if (npu_slot->cu_idx == INVALID_CU_IDX)
 		return -EINVAL;
 
-	memset(npu_slot, 0, sizeof(*npu_slot));
 	npu_slot->type = EXEC_NPU_TYPE_NON_ELF;
 	npu_slot->arg_cnt = cmd_len / sizeof(u32);
 	memcpy(npu_slot->args, cmd, cmd_len);
@@ -677,6 +677,7 @@ aie2_cmdlist_fill_npu_dpu(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *si
 	u32 cmd_len;
 	u32 arg_sz;
 
+	memset(npu_slot, 0, sizeof(*npu_slot));
 	sn = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
 	arg_sz = cmd_len - sizeof(*sn);
 	if (cmd_len < sizeof(*sn) || arg_sz > MAX_NPU_ARGS_SIZE)
@@ -689,7 +690,6 @@ aie2_cmdlist_fill_npu_dpu(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *si
 	if (npu_slot->cu_idx == INVALID_CU_IDX)
 		return -EINVAL;
 
-	memset(npu_slot, 0, sizeof(*npu_slot));
 	npu_slot->type = EXEC_NPU_TYPE_PARTIAL_ELF;
 	npu_slot->inst_buf_addr = sn->buffer;
 	npu_slot->inst_size = sn->buffer_size;
@@ -709,6 +709,7 @@ aie2_cmdlist_fill_npu_preempt(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t
 	u32 cmd_len;
 	u32 arg_sz;
 
+	memset(npu_slot, 0, sizeof(*npu_slot));
 	pd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
 	arg_sz = cmd_len - sizeof(*pd);
 	if (cmd_len < sizeof(*pd) || arg_sz > MAX_NPU_ARGS_SIZE)
@@ -721,7 +722,6 @@ aie2_cmdlist_fill_npu_preempt(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t
 	if (npu_slot->cu_idx == INVALID_CU_IDX)
 		return -EINVAL;
 
-	memset(npu_slot, 0, sizeof(*npu_slot));
 	npu_slot->type = EXEC_NPU_TYPE_PREEMPT;
 	npu_slot->inst_buf_addr = pd->inst_buf;
 	npu_slot->save_buf_addr = pd->save_buf;
@@ -745,6 +745,7 @@ aie2_cmdlist_fill_npu_elf(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *si
 	u32 cmd_len;
 	u32 arg_sz;
 
+	memset(npu_slot, 0, sizeof(*npu_slot));
 	pd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
 	arg_sz = cmd_len - sizeof(*pd);
 	if (cmd_len < sizeof(*pd) || arg_sz > MAX_NPU_ARGS_SIZE)
@@ -753,7 +754,6 @@ aie2_cmdlist_fill_npu_elf(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *si
 	if (*size < sizeof(*npu_slot) + arg_sz)
 		return -EINVAL;
 
-	memset(npu_slot, 0, sizeof(*npu_slot));
 	npu_slot->type = EXEC_NPU_TYPE_ELF;
 	npu_slot->inst_buf_addr = pd->inst_buf;
 	npu_slot->save_buf_addr = pd->save_buf;
-- 
2.34.1

Re: [PATCH V1] accel/amdxdna: Fix cu_idx being cleared by memset() during command setup

Posted by Mario Limonciello (AMD) (kernel.org) 1 week ago


On 12/9/2025 3:16 PM, Lizhi Hou wrote:
> For one command type, cu_idx is assigned before calling memset() on the
> command structure. This results in cu_idx being overwritten, causing the
> firmware to receive an incomplete or invalid command and leading to
> unexpected command failures.
> 
> Fix this by moving the memset() call before initializing cu_idx so that
> all fields are populated in the correct order.
> 
> Fixes: 71829d7f2f70 ("accel/amdxdna: Use MSG_OP_CHAIN_EXEC_NPU when supported")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
> ---
>   drivers/accel/amdxdna/aie2_message.c | 8 ++++----
>   1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/accel/amdxdna/aie2_message.c b/drivers/accel/amdxdna/aie2_message.c
> index a75156800467..03b75757a6e6 100644
> --- a/drivers/accel/amdxdna/aie2_message.c
> +++ b/drivers/accel/amdxdna/aie2_message.c
> @@ -652,6 +652,7 @@ aie2_cmdlist_fill_npu_cf(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *siz
>   	u32 cmd_len;
>   	void *cmd;
>   
> +	memset(npu_slot, 0, sizeof(*npu_slot));
>   	cmd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
>   	if (*size < sizeof(*npu_slot) + cmd_len)
>   		return -EINVAL;
> @@ -660,7 +661,6 @@ aie2_cmdlist_fill_npu_cf(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *siz
>   	if (npu_slot->cu_idx == INVALID_CU_IDX)
>   		return -EINVAL;
>   
> -	memset(npu_slot, 0, sizeof(*npu_slot));
>   	npu_slot->type = EXEC_NPU_TYPE_NON_ELF;
>   	npu_slot->arg_cnt = cmd_len / sizeof(u32);
>   	memcpy(npu_slot->args, cmd, cmd_len);
> @@ -677,6 +677,7 @@ aie2_cmdlist_fill_npu_dpu(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *si
>   	u32 cmd_len;
>   	u32 arg_sz;
>   
> +	memset(npu_slot, 0, sizeof(*npu_slot));
>   	sn = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
>   	arg_sz = cmd_len - sizeof(*sn);
>   	if (cmd_len < sizeof(*sn) || arg_sz > MAX_NPU_ARGS_SIZE)
> @@ -689,7 +690,6 @@ aie2_cmdlist_fill_npu_dpu(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *si
>   	if (npu_slot->cu_idx == INVALID_CU_IDX)
>   		return -EINVAL;
>   
> -	memset(npu_slot, 0, sizeof(*npu_slot));
>   	npu_slot->type = EXEC_NPU_TYPE_PARTIAL_ELF;
>   	npu_slot->inst_buf_addr = sn->buffer;
>   	npu_slot->inst_size = sn->buffer_size;
> @@ -709,6 +709,7 @@ aie2_cmdlist_fill_npu_preempt(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t
>   	u32 cmd_len;
>   	u32 arg_sz;
>   
> +	memset(npu_slot, 0, sizeof(*npu_slot));
>   	pd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
>   	arg_sz = cmd_len - sizeof(*pd);
>   	if (cmd_len < sizeof(*pd) || arg_sz > MAX_NPU_ARGS_SIZE)
> @@ -721,7 +722,6 @@ aie2_cmdlist_fill_npu_preempt(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t
>   	if (npu_slot->cu_idx == INVALID_CU_IDX)
>   		return -EINVAL;
>   
> -	memset(npu_slot, 0, sizeof(*npu_slot));
>   	npu_slot->type = EXEC_NPU_TYPE_PREEMPT;
>   	npu_slot->inst_buf_addr = pd->inst_buf;
>   	npu_slot->save_buf_addr = pd->save_buf;
> @@ -745,6 +745,7 @@ aie2_cmdlist_fill_npu_elf(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *si
>   	u32 cmd_len;
>   	u32 arg_sz;
>   
> +	memset(npu_slot, 0, sizeof(*npu_slot));
>   	pd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
>   	arg_sz = cmd_len - sizeof(*pd);
>   	if (cmd_len < sizeof(*pd) || arg_sz > MAX_NPU_ARGS_SIZE)
> @@ -753,7 +754,6 @@ aie2_cmdlist_fill_npu_elf(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *si
>   	if (*size < sizeof(*npu_slot) + arg_sz)
>   		return -EINVAL;
>   
> -	memset(npu_slot, 0, sizeof(*npu_slot));
>   	npu_slot->type = EXEC_NPU_TYPE_ELF;
>   	npu_slot->inst_buf_addr = pd->inst_buf;
>   	npu_slot->save_buf_addr = pd->save_buf;

Re: [PATCH V1] accel/amdxdna: Fix cu_idx being cleared by memset() during command setup

Posted by Lizhi Hou 1 week ago

Applied to drm-misc-next.

On 12/9/25 21:37, Mario Limonciello (AMD) (kernel.org) wrote:
>
>
> On 12/9/2025 3:16 PM, Lizhi Hou wrote:
>> For one command type, cu_idx is assigned before calling memset() on the
>> command structure. This results in cu_idx being overwritten, causing the
>> firmware to receive an incomplete or invalid command and leading to
>> unexpected command failures.
>>
>> Fix this by moving the memset() call before initializing cu_idx so that
>> all fields are populated in the correct order.
>>
>> Fixes: 71829d7f2f70 ("accel/amdxdna: Use MSG_OP_CHAIN_EXEC_NPU when 
>> supported")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
>> ---
>>   drivers/accel/amdxdna/aie2_message.c | 8 ++++----
>>   1 file changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/accel/amdxdna/aie2_message.c 
>> b/drivers/accel/amdxdna/aie2_message.c
>> index a75156800467..03b75757a6e6 100644
>> --- a/drivers/accel/amdxdna/aie2_message.c
>> +++ b/drivers/accel/amdxdna/aie2_message.c
>> @@ -652,6 +652,7 @@ aie2_cmdlist_fill_npu_cf(struct amdxdna_gem_obj 
>> *cmd_bo, void *slot, size_t *siz
>>       u32 cmd_len;
>>       void *cmd;
>>   +    memset(npu_slot, 0, sizeof(*npu_slot));
>>       cmd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
>>       if (*size < sizeof(*npu_slot) + cmd_len)
>>           return -EINVAL;
>> @@ -660,7 +661,6 @@ aie2_cmdlist_fill_npu_cf(struct amdxdna_gem_obj 
>> *cmd_bo, void *slot, size_t *siz
>>       if (npu_slot->cu_idx == INVALID_CU_IDX)
>>           return -EINVAL;
>>   -    memset(npu_slot, 0, sizeof(*npu_slot));
>>       npu_slot->type = EXEC_NPU_TYPE_NON_ELF;
>>       npu_slot->arg_cnt = cmd_len / sizeof(u32);
>>       memcpy(npu_slot->args, cmd, cmd_len);
>> @@ -677,6 +677,7 @@ aie2_cmdlist_fill_npu_dpu(struct amdxdna_gem_obj 
>> *cmd_bo, void *slot, size_t *si
>>       u32 cmd_len;
>>       u32 arg_sz;
>>   +    memset(npu_slot, 0, sizeof(*npu_slot));
>>       sn = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
>>       arg_sz = cmd_len - sizeof(*sn);
>>       if (cmd_len < sizeof(*sn) || arg_sz > MAX_NPU_ARGS_SIZE)
>> @@ -689,7 +690,6 @@ aie2_cmdlist_fill_npu_dpu(struct amdxdna_gem_obj 
>> *cmd_bo, void *slot, size_t *si
>>       if (npu_slot->cu_idx == INVALID_CU_IDX)
>>           return -EINVAL;
>>   -    memset(npu_slot, 0, sizeof(*npu_slot));
>>       npu_slot->type = EXEC_NPU_TYPE_PARTIAL_ELF;
>>       npu_slot->inst_buf_addr = sn->buffer;
>>       npu_slot->inst_size = sn->buffer_size;
>> @@ -709,6 +709,7 @@ aie2_cmdlist_fill_npu_preempt(struct 
>> amdxdna_gem_obj *cmd_bo, void *slot, size_t
>>       u32 cmd_len;
>>       u32 arg_sz;
>>   +    memset(npu_slot, 0, sizeof(*npu_slot));
>>       pd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
>>       arg_sz = cmd_len - sizeof(*pd);
>>       if (cmd_len < sizeof(*pd) || arg_sz > MAX_NPU_ARGS_SIZE)
>> @@ -721,7 +722,6 @@ aie2_cmdlist_fill_npu_preempt(struct 
>> amdxdna_gem_obj *cmd_bo, void *slot, size_t
>>       if (npu_slot->cu_idx == INVALID_CU_IDX)
>>           return -EINVAL;
>>   -    memset(npu_slot, 0, sizeof(*npu_slot));
>>       npu_slot->type = EXEC_NPU_TYPE_PREEMPT;
>>       npu_slot->inst_buf_addr = pd->inst_buf;
>>       npu_slot->save_buf_addr = pd->save_buf;
>> @@ -745,6 +745,7 @@ aie2_cmdlist_fill_npu_elf(struct amdxdna_gem_obj 
>> *cmd_bo, void *slot, size_t *si
>>       u32 cmd_len;
>>       u32 arg_sz;
>>   +    memset(npu_slot, 0, sizeof(*npu_slot));
>>       pd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);
>>       arg_sz = cmd_len - sizeof(*pd);
>>       if (cmd_len < sizeof(*pd) || arg_sz > MAX_NPU_ARGS_SIZE)
>> @@ -753,7 +754,6 @@ aie2_cmdlist_fill_npu_elf(struct amdxdna_gem_obj 
>> *cmd_bo, void *slot, size_t *si
>>       if (*size < sizeof(*npu_slot) + arg_sz)
>>           return -EINVAL;
>>   -    memset(npu_slot, 0, sizeof(*npu_slot));
>>       npu_slot->type = EXEC_NPU_TYPE_ELF;
>>       npu_slot->inst_buf_addr = pd->inst_buf;
>>       npu_slot->save_buf_addr = pd->save_buf;
>