# DF-2205 — amdgpu_xgmi: error path leaves device half-initialized on hive list (Low)

## Claim
`amdgpu_xgmi_add_device()` in
`sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c` `list_add_tail()`s the device into
`hive->device_list` (line 85) **before** attempting
`psp_xgmi_get_topology_info()` (line 89).  If that call fails, the `goto
exit` at line 95 (and a second one at 114) does **not** remove the device,
so the hive permanently contains an entry whose topology was never fetched
or set.  The next `amdgpu_xgmi_add_device()` for any other node then copies
that stale `device_id` into `tmp_topology` (line 87) and drives
`psp_xgmi_set_topology_info` across the half-baked node (line 99).  `ret`
is only re-checked once (`if (!ret)` at line 109), so a
`set_topology_info` failure on a *later* node still leaves earlier nodes'
state partially applied.

## Verification approach
**HW-gated / source-only.**  Reachable only on Vega20 hardware with a PSP
topology fetch that fails (faulty PSP firmware / bad hardware link).
No GPU on this audit guest.  Per the task brief, source-only
confirmation is acceptable.

1. Confirm the `list_add_tail` precedes the `psp_xgmi_get_topology_info` call.
2. Confirm the error-path `goto exit` does not call `list_del`.
3. Confirm the subsequent `list_for_each_entry` would re-enter the stale
   node.
4. Author `fix.diff` (undo the linkage on error).
5. **Phase 8** — apply all 5 batched fixes and rebuild `amdgpu.ko` with
   `-Werror`.

## Source trace (confirmed)
* `sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:85` — `list_add_tail(&adev->gmc.xgmi.head, &hive->device_list);`
* `sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:89` — `ret = psp_xgmi_get_topology_info(&adev->psp, count, tmp_topology);`
* `sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:90-96` — `if (ret) { dev_err(...); goto exit; }` — **no `list_del` before `goto`**.
* `sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:86-87` — the next add for any node in the same hive will iterate `hive->device_list` (including the half-baked node) and copy its stale `device_id` into `tmp_topology`.
* `sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:98-108` — `list_for_each_entry(tmp_adev, &hive->device_list, ...)` will drive `psp_xgmi_set_topology_info` across every node, half-baked or not.
* `sys/dev/drm/amd/amdgpu/amdgpu_xgmi.c:109` — `if (!ret)` re-checks `ret` only once; a `set_topology_info` failure on a later node leaves earlier nodes' partial state in place.

## Files
* `VERDICT.md` — full narrative.
* `fix.diff` — on the `psp_xgmi_get_topology_info` failure path, `list_del(&adev->gmc.xgmi.head)` + `INIT_LIST_HEAD(...)` before the existing `dev_err` / `goto exit`.
* `build_baseline.log` — unpatched `amdgpu.ko` build, rc=0, `-Werror`.
* `build_patched.log` — patched `amdgpu.ko` rebuild (only `amdgpu_xgmi.o` recompiled), rc=0, `-Werror`.
* `env.txt` — guest environment.

## Reproduce
```
./build.sh    # applies fix.diff + rebuilds amdgpu.ko
./run.sh      # HW-gated no-op (see VERDICT.md)
```