From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794591260; b=H8YQYopmgKLJ+p9MTHngDiXXv/bqAYc94fWRQtw+H+/QC+XUOO8OGKqymZelwyu2JIkv 9GhJiipKq51+6nrYzu7EwxEBIGOCMiPmLB6G/ZoVYAfJaECl21EDmn1GWuOaJhUM1KCUL E8xWxJbA7NCSIX4eOqoiCR7egCv37ibgUJtD8TvYsZdHssYIq1G7Q5nx5B+ORv74+ukY6 e4lKpkgHgMm9gpGoKd0CZayCgcJuvemnN5Npus3os2oDMAdChOvrAHSU5yqsu1xPzjBnO /Z6WI6Vxs5dlnqerCDHrHv0w+uA53ZJLPe5oj+mMf6zyY9TlmRWR0pJNKr6Demd8APA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794591260; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=dzaHPfO/HpALPG8RtCCQmfls73hAxiKbiilPKg7Ev4s=; b=2LHVXFLUxQLSjGny+nF8eEY+Wv+THss5kncORGj4XC7mVVQHWspVKjaWfNrcZcD4oXyC g6x4WZxvYHUty7C2kPKRNY0sUeLX/dn3WshYuf8Vv0qZTwOswVOo0SiSSpUxPs6jf0prY a2PJMRDRuR4ICLT+tg+1cA/MoNT04KxIMCYIFzErTvDkJp2Q3VKikEeLAgLHsP1de/k/v iEb92zO1MJtvGCEt32XrsvGl6lTYaZC6hch8AxrxMGR2GXAK7F4cfF9I/jUUiJLIBxwBy jFQnFswh3ZUsnDK3fKN8S6UnezLXDEcJny0K6yOKd1U5xVWGnfRq3cm/WAN32RGJo/g== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=BbbyCTvW; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8AF8D60A3817; Fri, 13 Nov 2026 17:34:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=BbbyCTvW Received: by smtp.kernel.org (Postfix) with ESMTPSA id 383991F000C4; Fri, 13 Nov 2026 17:34:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794591260; bh=dzaHPfO/HpALPG8RtCCQmfls73hAxiKbiilPKg7Ev4s=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=BbbyCTvWMI3u0/LE8sa5nbuZYLrcldbKKXWDj+JDUrctWb4ziJf/GIFIikwjuB0c9 BpuW419kXcs6LDggWZvU6Jp2sG+xYMau/Tkqzf3RUvyqYvwbNt+XSbSIM/i7VbrlIs SyqjvAB+xRkHau23Na5uOIFVKHB24UnD7CS9dt6c= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, =?UTF-8?q?Christian=20K=C3=B6nig?= , Jesse Zhang , Alex Deucher , Sasha Levin Subject: [PATCH 6.12 342/670] drm/amdgpu: keep the CS user fence BO in GTT Date: Fri, 13 Nov 2026 10:48:26 -0500 Message-ID: <20261113153823.437248151@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153811.177190860@linuxfoundation.org> References: <20261113153811.177190860@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jesse Zhang [ Upstream commit 7a56d929dc2304edaa6231e1eb5eb82b7e8b74a9 ] The CS ioctl hands the GPU the GART address of the user fence BO, but since the BO keeps its own preferred and allowed domains, it no longer makes sure the BO is in GTT. A user fence in a VRAM BO, which only needs to be a page in size, gets its address from amdgpu_bo_gpu_offset(), which warns about non-contiguous VRAM. On navi31, a CS with a user fence in a 4K VRAM BO, or in one created with AMDGPU_GEM_CREATE_VM_ALWAYS_VALID: WARNING: amdgpu_object.c:1531 at amdgpu_bo_gpu_offset+0x86/0xb0 [amdgpu], CPU#11: cs_gem_checks/18393 RIP: 0010:amdgpu_bo_gpu_offset+0x86/0xb0 [amdgpu] Call Trace: amdgpu_cs_parser_bos.isra.0+0x4eb/0x850 [amdgpu] amdgpu_cs_ioctl+0x97e/0x2510 [amdgpu] drm_ioctl_kernel+0xac/0x110 [drm] drm_ioctl+0x2c6/0x5b0 [drm] __x64_sys_ioctl+0xa0/0xf0 do_syscall_64+0xa3/0x4d0 entry_SYSCALL_64_after_hwframe+0x76/0x7e and BOs which can't be in GTT at all, like GWS or OA ones of a page in size, pass the checks as well. Only take BOs which can't be anywhere else than in GTT as user fence, which the CS then validates there along with its other BOs. While at it, detect userptrs with amdgpu_ttm_tt_is_userptr(); amdgpu_ttm_tt_get_usermm() returns NULL once the task which created the userptr is gone. v2: only take BOs which can only be in GTT instead of special casing the user fence BO in the validation, use amdgpu_ttm_tt_is_userptr() (Christian) Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit f16989def9561d04d0f2e77216f5319112d29bf1) Cc: stable@vger.kernel.org Signed-off-by: Sasha Levin --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index c8e1d2251efcc..7b4bd20aee6f1 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -160,7 +160,12 @@ static int amdgpu_cs_p1_user_fence(struct amdgpu_cs_parser *p, if (size != PAGE_SIZE || data->offset > (size - 8)) return -EINVAL; - if (amdgpu_ttm_tt_get_usermm(p->uf_bo->tbo.ttm)) + if (amdgpu_ttm_tt_is_userptr(p->uf_bo->tbo.ttm)) + return -EINVAL; + + /* The GPU writes the user fence through the GART */ + if (p->uf_bo->preferred_domains != AMDGPU_GEM_DOMAIN_GTT && + p->uf_bo->allowed_domains != AMDGPU_GEM_DOMAIN_GTT) return -EINVAL; *offset = data->offset; -- 2.53.0