AMD-GFX Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: "Christian König" <christian.koenig@amd.com>
To: Zhu Lingshan <lingshan.zhu@amd.com>,
	Alexander.Deucher@amd.com, felix.kuehling@amd.com
Cc: Ray.Huang@amd.com, amd-gfx@lists.freedesktop.org
Subject: Re: [PATCH 01/10] drm/amdgpu: introduce amdgpu_lookup_queue_by_doorbell
Date: Fri, 28 Aug 2026 15:08:32 +0200	[thread overview]
Message-ID: <bd072438-32ee-42bc-bc06-ae29775cc2a5@amd.com> (raw)
In-Reply-To: <20260828095349.9797-2-lingshan.zhu@amd.com>

On 8/28/26 11:53, Zhu Lingshan wrote:
> This commit introduces a new helper
> amdgpu_lookup_queue_by_doorbell which helps
> look up a user queue with the given doorbell id
> in a xarray.
> 
> This function takes a kref of the user space queue.

Well absolutely clear NAK to the whole approach.

This is the nonsense Sunil and I have worked quite hard to remove and we certainly shouldn't repeat such mistakes.

When the userq needs to be used from interrupt context we need to hold the xa_lock_irqsave() or otherwise we don't have any guarantee that the userq, userq_mgr or associated fpriv went out of scope.

Grabbing references from this side would obviously result in circle dependencies.

Regards,
Christian.

> 
> Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 30 +++++++++++++++++++++++
>  drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h |  2 ++
>  2 files changed, 32 insertions(+)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> index 0a816b3c5ff9..e0639f844a8e 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> @@ -609,6 +609,36 @@ struct amdgpu_usermode_queue *amdgpu_userq_get(struct amdgpu_userq_mgr *uq_mgr,
>  	return queue;
>  }
>  
> +/**
> + * amdgpu_lookup_queue_by_doorbell - look up a user queue by doorbell
> + * @xa: user queue XArray indexed by doorbell
> + * @doorbell: doorbell index
> + *
> + * Return: A queue with the doorbell indexed, or NULL if no such a queue found.
> + *
> + * This function increases kref of the queue, the caller
> + * must release the reference with amdgpu_userq_put().
> + */
> +struct amdgpu_usermode_queue *
> +amdgpu_lookup_queue_by_doorbell(struct xarray *xa, u32 doorbell)
> +{
> +	struct amdgpu_usermode_queue *queue;
> +	unsigned long flags;
> +
> +	xa_lock_irqsave(xa, flags);
> +	queue = xa_load(xa, doorbell);
> +	if (!queue)
> +		goto out_unlock;
> +
> +	if (!kref_get_unless_zero(&queue->refcount))
> +		queue = NULL;
> +
> +out_unlock:
> +	xa_unlock_irqrestore(xa, flags);
> +
> +	return queue;
> +}
> +
>  void amdgpu_userq_put(struct amdgpu_usermode_queue *queue)
>  {
>  	if (queue)
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
> index 6412a7f7b6ef..8fc73862f64e 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
> @@ -151,6 +151,8 @@ struct amdgpu_db_info {
>  };
>  
>  struct amdgpu_usermode_queue *amdgpu_userq_get(struct amdgpu_userq_mgr *uq_mgr, u32 qid);
> +struct amdgpu_usermode_queue *
> +amdgpu_lookup_queue_by_doorbell(struct xarray *xa, u32 doorbell);
>  void amdgpu_userq_put(struct amdgpu_usermode_queue *queue);
>  
>  int amdgpu_userq_ioctl(struct drm_device *dev, void *data, struct drm_file *filp);


  reply	other threads:[~2026-08-28 13:08 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-28  9:53 [PATCH 00/10] drm/amdgpu: secure userq lifecycle by its kref Zhu Lingshan
2026-08-28  9:53 ` [PATCH 01/10] drm/amdgpu: introduce amdgpu_lookup_queue_by_doorbell Zhu Lingshan
2026-08-28 13:08   ` Christian König [this message]
2026-08-28 15:59     ` Zhu, Lingshan
2026-08-28  9:53 ` [PATCH 02/10] drm/amdgpu: keep the userq manager alive as long as its queues Zhu Lingshan
2026-08-28 13:09   ` Christian König
2026-08-28 15:59     ` Zhu, Lingshan
2026-08-28 16:26       ` Christian König
2026-08-28  9:53 ` [PATCH 03/10] drm/amdgpu/gfx11: hold userq refs in private fault worker Zhu Lingshan
2026-08-28 13:11   ` Christian König
2026-08-28 15:59     ` Zhu, Lingshan
2026-08-28  9:53 ` [PATCH 04/10] drm/amdgpu/gfx12: " Zhu Lingshan
2026-08-28  9:53 ` [PATCH 05/10] drm/amdgpu: implement asynchronous userq destruction routine Zhu Lingshan
2026-08-28  9:53 ` [PATCH 06/10] drm/amdgpu: hold userq kref in MES reset Zhu Lingshan
2026-08-28  9:53 ` [PATCH 07/10] drm/amdgpu: hold userq kref during isolation scheduling Zhu Lingshan
2026-08-28  9:53 ` [PATCH 08/10] drm/amdgpu: hold userq kref during suspend and resume Zhu Lingshan
2026-08-28  9:53 ` [PATCH 09/10] drm/amdgpu: free userq by kref_put when fails to create Zhu Lingshan
2026-08-28  9:53 ` [PATCH 10/10] drm/amdgpu: take queue kref in userq_create to avoid UAF Zhu Lingshan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=bd072438-32ee-42bc-bc06-ae29775cc2a5@amd.com \
    --to=christian.koenig@amd.com \
    --cc=Alexander.Deucher@amd.com \
    --cc=Ray.Huang@amd.com \
    --cc=amd-gfx@lists.freedesktop.org \
    --cc=felix.kuehling@amd.com \
    --cc=lingshan.zhu@amd.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox