From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794585757; b=DABdsbE4b/AEArsNiPuqb/yP79WAMoF47IREtAn50MFXG0r0UMaU0RyPV9S1CdKFQcEE zipVEv8xm+G6SmJv8JSiJ9g64pJ3crNi9GylvfUHaH7q4ie7TiicfVmRNiYSSkg3QCGEx rjaGTHiANGcsNWvU7S8y4FiGtOwuBefX7puy8vAEgC6ZmxgJttgLLMcmikh++fvYdID6I Wo+FsfLmvHEsu/jSR5/m90pPEJ68d0s/ySrGDiL4US1/T+ou8VRxWiq3irglkv1YhJgmR jFdSYg3LeHt1WeNoxnpdCLFRGPC8rgigBFahHOYIEDIdMD0VD+3GClI00CTZSDjRf/w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794585757; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=qxih9PnhGImNDUvKtnHy7ffCh40CCG9iMOjw9G2xNHU=; b=Uc6oOXUicWrG0UR7M8jO43NGjzds8wV2Rk6d0OgkjBZQEsEgtJ96VPOa4ZWkhoYfc4oS UZUnJ7StzomjeclN6kWjldcxvnSwi7N8IYHedZdp/nLNsMgyDojFqZbuafZscrWX43V/4 aXy5+OrSIJ0qN19O2Pwctnl5vyj7mnJ8My07KrhUJt7OS0HsYTZB5hrKNNaHInWZWamKc pNZHNIugdTWwPM2igV0cfMLXfm0hidNodHJNKa2tmlkpjpj81nUuI0pp7C56fnJkJo5lQ +Sk3JxOwjG9/dCcyyuvQ4GOb2J8Q8DTeVmSWCAWzSWbDC23FJbZmGY/G5ptB95xxcKA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=u884a+nw; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B4650606AE3A; Fri, 13 Nov 2026 16:02:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=u884a+nw Received: by smtp.kernel.org (Postfix) with ESMTPSA id 600771F000C4; Fri, 13 Nov 2026 16:02:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794585757; bh=qxih9PnhGImNDUvKtnHy7ffCh40CCG9iMOjw9G2xNHU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=u884a+nwYe2DRsMahp+7TNB0Uf8SsXNqYD3h0LMZ1CpArNHt0+SIOAdZyfisFATGa nCuaYo6AI1aHehlUklTH/DalH4gBRBD9vvqMdfrUVvD3ojJfqZ+9vfG8vIxKUG7o/k O3R7tNrTyA4a73rHBMpAE/DmSPVrWZlRLoQHo4c0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, =?UTF-8?q?Christian=20K=C3=B6nig?= , Jesse Zhang , Alex Deucher , Sasha Levin Subject: [PATCH 7.3 351/507] drm/amdgpu: keep the CS user fence BO in GTT Date: Fri, 13 Nov 2026 10:50:55 -0500 Message-ID: <20261113153807.333404488@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153753.358973689@linuxfoundation.org> References: <20261113153753.358973689@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jesse Zhang [ Upstream commit 7a56d929dc2304edaa6231e1eb5eb82b7e8b74a9 ] The CS ioctl hands the GPU the GART address of the user fence BO, but since the BO keeps its own preferred and allowed domains, it no longer makes sure the BO is in GTT. A user fence in a VRAM BO, which only needs to be a page in size, gets its address from amdgpu_bo_gpu_offset(), which warns about non-contiguous VRAM. On navi31, a CS with a user fence in a 4K VRAM BO, or in one created with AMDGPU_GEM_CREATE_VM_ALWAYS_VALID: WARNING: amdgpu_object.c:1531 at amdgpu_bo_gpu_offset+0x86/0xb0 [amdgpu], CPU#11: cs_gem_checks/18393 RIP: 0010:amdgpu_bo_gpu_offset+0x86/0xb0 [amdgpu] Call Trace: amdgpu_cs_parser_bos.isra.0+0x4eb/0x850 [amdgpu] amdgpu_cs_ioctl+0x97e/0x2510 [amdgpu] drm_ioctl_kernel+0xac/0x110 [drm] drm_ioctl+0x2c6/0x5b0 [drm] __x64_sys_ioctl+0xa0/0xf0 do_syscall_64+0xa3/0x4d0 entry_SYSCALL_64_after_hwframe+0x76/0x7e and BOs which can't be in GTT at all, like GWS or OA ones of a page in size, pass the checks as well. Only take BOs which can't be anywhere else than in GTT as user fence, which the CS then validates there along with its other BOs. While at it, detect userptrs with amdgpu_ttm_tt_is_userptr(); amdgpu_ttm_tt_get_usermm() returns NULL once the task which created the userptr is gone. v2: only take BOs which can only be in GTT instead of special casing the user fence BO in the validation, use amdgpu_ttm_tt_is_userptr() (Christian) Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit f16989def9561d04d0f2e77216f5319112d29bf1) Cc: stable@vger.kernel.org Signed-off-by: Sasha Levin --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index bb039ed938939..ba9c7dc084384 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -149,7 +149,12 @@ static int amdgpu_cs_p1_user_fence(struct amdgpu_cs_parser *p, if (size != PAGE_SIZE || data->offset > (size - 8)) return -EINVAL; - if (amdgpu_ttm_tt_get_usermm(p->uf_bo->tbo.ttm)) + if (amdgpu_ttm_tt_is_userptr(p->uf_bo->tbo.ttm)) + return -EINVAL; + + /* The GPU writes the user fence through the GART */ + if (p->uf_bo->preferred_domains != AMDGPU_GEM_DOMAIN_GTT && + p->uf_bo->allowed_domains != AMDGPU_GEM_DOMAIN_GTT) return -EINVAL; *offset = data->offset; -- 2.53.0