kernel/linux.git/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c, branch linux-7.1.y

drm/amdgpu/userq: Fix reading timeline points in wait ioctl

2026-06-04T19:54:20+00:00

Use correct u64 type. Signed-off-by: David Rosca Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 0ac98160dfb6ab3c6d7b38e0ff9687780beed9cb)

drm/amdgpu/userq: use drm_exec in amdgpu_userq_fence_read_wptr

2026-05-19T16:07:28+00:00

To access the bo from vm mapping first lock the root bo and then the object bo of the mapping to make sure both locks are taken safely. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 3aab50410653fe7eb35eb6f9c2b27e3549ab09e6)

drm/amdgpu: fix userq hang detection and reset

2026-05-11T21:47:11+00:00

Fix lock inversions pointed out by Prike and Sunil. The hang detection timeout *CAN'T* grab locks under which we wait for fences, especially not the userq_mutex lock. Then instead of this completely broken handling with the hang_detect_fence just cancel the work when fences are processed and re-start if necessary. Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher (cherry picked from commit 1b62077f045ac6ffde7c97005c6659569ac5c1ec)

drm/amdgpu: rework amdgpu_userq_signal_ioctl v3

2026-05-11T21:46:43+00:00

This one was fortunately not looking so bad as the wait ioctl path, but there were still a few things which could be fixed/improved: 1. Allocating with GFP_ATOMIC was quite unnecessary, we can do that before taking the userq_lock. 2. Use a new mutex as protection for the fence_drv_xa so that we can do memory allocations while holding it. 3. Starting the reset timer is unnecessary when the fence is already signaled when we create it. 4. Cleanup error handling, avoid trying to free the queue when we don't even got one. v2: fix incorrect usage of xa_find, destroy the new mutex on error v3: cleanup ref ordering Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher (cherry picked from commit 1609eb0f81a609d350169839128cecf298c84e7a)

drm/amdgpu: nuke amdgpu_userq_fence_slab v2

2026-05-05T14:23:06+00:00

As preparation for independent fences remove the extra slab, kmalloc should do just fine. v2: use GFP_KERNEL instead of GFP_ATOMIC Signed-off-by: Christian König Reviewed-by: Prike Liang Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher (cherry picked from commit 0d831487b5be0ae59cac865a0aa87b0acc3dc717)

drm/amdgpu: drop userq fence driver refs out of fence process()

2026-04-17T19:41:12+00:00

amdgpu_userq_wait_ioctl() takes extra references on waited-on fence drivers and stores them in waitq->fence_drv_xa. When a new userq fence is created, those references are transferred into userq_fence->fence_drv_array so they can be released when the fence completes. However, those inherited references are currently only dropped from amdgpu_userq_fence_driver_process(). If a fence never reaches that path, such as it is already signaled when created, so we need to explicitly release those fences in that case. v2: use a list(list_cut_before) for managing the signal userq driver fences.(Christian) Link: https://patchwork.freedesktop.org/patch/718078/?series=164763&rev=2 v3: Doesn't cache the userq first unsignaled fence and use the cut before list head directly.(Christian) Cc: Alex Deucher Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher

drm/amdgpu: make userq fence_drv drop explicit in queue destroy

2026-04-03T18:03:56+00:00

amdgpu_userq_fence_driver_free() is now responsible only for releasing per-queue ancillary state (last_fence, fence_drv_xa) and no longer touches the ownership reference, making each function's contract clear. v2: Get the userq fence driver from amdgpu_userq_fence_driver_alloc() directly and dropping the userq fence driver reference after removing userq_doorbell_xa entry.(Christian) Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher

drm/amdgpu: rework userq fence driver alloc/destroy

2026-04-03T17:59:28+00:00

The correct fix is to tie the global xa entry lifetime to the queue lifetime: insert in amdgpu_userq_create() and erase in amdgpu_userq_cleanup(), both at the well-defined doorbell_index key, making the operation O(1) and resolve the fence driver UAF problem by binding the userq driver fence to per queue. v2: clean up the local variables initialization. (Christian) Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher

drm/amdgpu/userq: convert comma to semicolon

2026-03-24T17:34:04+00:00

Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it seems best to use ';' unless ',' is intended. Found by inspection. No functional change intended. Compile tested only. Signed-off-by: Chen Ni Signed-off-by: Alex Deucher

drm/amdgpu: make amdgpu_user_wait_ioctl more resilent v2

2026-03-23T18:02:27+00:00

When the memory allocated by userspace isn't sufficient for all the fences then just wait on them instead of returning an error. v2: use correct variable as pointed out by Sunil Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher