[qcom-next][kaanapali-mtp] Crash with 7.1-rc4

[sgaud-quic]

Crash seen on kaanapali-mtp with 7.1-rc4.
Branch : qcom-next-staging
Kernel Version : 7.1-rc4
Board : kaanapali-mtp
LAVA job : https://lava-oss.qualcomm.com/scheduler/job/102183

   36.690456][  T100] CPU: 0 UID: 0 PID: 100 Comm: kworker/u34:2 Tainted: G        W           7.1.0-rc4-00834-g62f1b08841b9 #1 PREEMPT 
[   36.702870][  T100] Tainted: [W]=WARN
[   36.706650][  T100] Hardware name: Qualcomm Technologies, Inc. Kaanapali MTP (DT)
[   36.714347][  T100] Workqueue: pm pm_runtime_work
[   36.719207][  T100] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
[   36.727078][  T100] pc : a6xx_gmu_rpmh_off+0xd0/0x8c0 [msm]
[   36.732866][  T100] lr : a6xx_gmu_rpmh_off+0xbc/0x8c0 [msm]
[   36.738646][  T100] sp : ffff800080e43af0
[   36.742788][  T100] x29: ffff800080e43af0 x28: ffffad64d202f000 x27: 0000000000000000
[   36.750841][  T100] x26: 0000000000000d28 x25: 0000000000000fc8 x24: 0000000000001268
[   36.758895][  T100] x23: 0000000000001508 x22: 000000081c07f685 x21: ffff8000841d0d28
[   36.766949][  T100] x20: f596ad64d2030480 x19: ffff000812b8c5b8 x18: 0000000000000000
[   36.775002][  T100] x17: 0000000000000000 x16: ffffad6502ef3290 x15: 0000000000000000
[   36.783056][  T100] x14: 000000000000000c x13: 0000000000000001 x12: 071c71c71c71c71c
[   36.791108][  T100] x11: 00000000000000c0 x10: ffffad6504444850 x9 : ffffad6502ef32d8
[   36.799160][  T100] x8 : ffff800080e43978 x7 : 0000000000000000 x6 : 0000000000000001
[   36.807215][  T100] x5 : 0000000000000000 x4 : ffff0008028ccc40 x3 : 000000000000e476
[   36.815268][  T100] x2 : 002160ebfad3c800 x1 : ffff8000841d0000 x0 : 000000081b6f6e0f
[   36.823323][  T100] Call trace:
[   36.826571][  T100]  a6xx_gmu_rpmh_off+0xd0/0x8c0 [msm] (P)
[   36.832351][  T100]  a6xx_gmu_force_off+0x90/0x318 [msm]
[   36.837860][  T100]  a6xx_gmu_shutdown+0x214/0x6a0 [msm]
[   36.843367][  T100]  a6xx_gmu_stop+0x4c/0xd0 [msm]
[   36.848341][  T100]  a6xx_gmu_pm_suspend+0x50/0x1b0 [msm]
[   36.853934][  T100]  adreno_runtime_suspend+0x38/0x68 [msm]
[   36.859711][  T100]  pm_generic_runtime_suspend+0x34/0x58
[   36.865273][  T100]  __rpm_callback+0x50/0x1f0
[   36.869857][  T100]  rpm_callback+0x7c/0x90
[   36.874170][  T100]  rpm_suspend+0xe8/0x6c0
[   36.878493][  T100]  pm_runtime_work+0xd0/0xe0
[   36.883079][  T100]  process_one_work+0x18c/0x578
[   36.887936][  T100]  worker_thread+0x1a4/0x320
[   36.892521][  T100]  kthread+0x120/0x140
[   36.896578][  T100]  ret_from_fork+0x10/0x20
[   36.900983][  T100] Code: 1a9fd7fb f9401e61 8b1a0035 d503201f (b94002bc) 
[   36.907978][  T100] ---[ end trace 0000000000000000 ]---

[sgaud-quic]

Root Cause: d55c4cc — "FROMLIST: drm/msm/a8xx: Fix RSCC offset"

What happened: The GPU runtime PM suspend path (pm_runtime_work → a6xx_gmu_rpmh_off) faults at [36.5s] trying to read an RSCC register via gmu->rscc, which points to an unmapped kernel VA.

Why: Commit d55c4cc changed the RSCC base for A8xx from gmu->mmio + 0x19000 to gpu->mmio + 0x50000. On Kaanapali, gpu->mmio (kgsl_3d0_reg_memory) is only 0x40000 bytes (0x03d00000–0x03d3ffff). Adding
0x50000 lands at physical 0x03d50000 — 0x10000 bytes past the end of the mapped region — so the resulting kernel VA has no PTE → level-3 translation fault → panic.