linux-rng/drivers/gpu/drm/amd/amdkfd, branch master

drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

2026-08-25T22:22:22Z

Both create_queue_cpsch() and create_queue_nocpsch() unconditionally call mqd_mgr->restore_mqd() when a CRIU restore is in progress (qd != NULL), with no NULL guard. On any system where restore_mqd is not implemented for the given queue type, a user holding CAP_CHECKPOINT_RESTORE can trigger a kernel NULL pointer dereference and panic the machine by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. Note that checkpoint_mqd is likewise unimplemented on GFX12, so no legitimate CRIU image can reach this path — only a hand-crafted restore payload. Add a NULL guard for restore_mqd immediately after mqd_mgr is resolved, unwinding via the existing error labels and returning -EOPNOTSUPP if the callback is not implemented. This mirrors the existing checkpoint_mqd guard in checkpoint_mqd(). Fixes: 48f0bdf4e38e ("drm/amdkfd: Added MQD manager files for GFX12.") Cc: stable@vger.kernel.org Signed-off-by: Vladimir Marioukhine Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher

drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram

2026-08-25T22:22:00Z

When migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set + MIGRATE_PFN_VALID unset) driver still allocates device pages. There is no dma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart() will return an uninitialized r. That can trigger out_free_vram_pages to drop all VRAM just set up. Initialize r and only call the last svm_migrate_copy_memory_gart if j > 0. Current code postponed the last page to the final copy. This patch flushes on the last page when reach to the end of current drm_buddy_block; avoids another svm_migrate_copy_memory_gart. Cc: stable@vger.kernel.org Signed-off-by: Xiaogang Chen Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher

drm/amdkfd: Fix error path at svm_migrate_copy_to_ram

2026-08-25T22:21:32Z

If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated system pages. To do that driver should use page physical address, or pfn, then get struct page*. Current driver uses dma address(for adev) that is not correct with IOMMU enabled, or even in general. The patch releases and unlocks allocated system pages based on where migration failed by struct page* of sys ram pages. Also dma_unmap correspodent system ram pages at error path. Cc: stable@vger.kernel.org Signed-off-by: Xiaogang Chen Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher

drm/amdkfd: Reject zero-sized AQL queue allocations after size halving

2026-08-25T22:18:44Z

KFD_IOC_ALLOC_MEMORY_OF_GPU with flag KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM and size=1 triggers the AQL wraparound workaround (size >>= 1), reducing size to 0. The resulting zero passes through PAGE_ALIGN(0) = 0 without validation, bypassing the per-process VRAM quota check in reserve_mem_limit() (vram_used + 0 > vram_available is always false). The fix adds post-halving zero-size validation in the primary allocation path (amdgpu_amdkfd_gpuvm.c). The check happens after size halving but before reserve_mem_limit(), and uses err_alignment_size error path to properly clean up the allocated kgd_mem structure and mutex. Cc: stable@vger.kernel.org Signed-off-by: Sunday Clement Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher

amdkfd: let profile_lock_device return an int other than uint32

2026-08-19T14:12:01Z

profile_lock_device() may return negive error code, so the type of the return value should be int, not uint32 Signed-off-by: Zhu Lingshan Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher

drm/amdkfd: preserve VRAM MQD across hibernation via unpin/repin

2026-08-12T13:37:44Z

On gfx9 ASICs with mqd_on_vram(), a compute queue MQD lives in a pinned VRAM buffer object. Pinned BOs are skipped by the VRAM eviction done at S4 suspend, so the MQD contents are lost across hibernation and the first submission after resume page-faults on a stale MQD. Unpin the MQD BO at suspend so the eviction migrates it into the hibernation image, and pin it back to VRAM on resume. The BO may return at a different VRAM address, so refresh the kernel mapping and cached GPU addresses and patch the MQD self-address via a new update_mqd_gpu_addr() mqd_manager op; skip eviction with a warning if that op is not implemented. v3: use unpin/repin instead of shadowing the MQD into a separate buffer. v4: drop the explicit VRAM->GTT placement at evict (a bare unpin is enough for the eviction pass to move the BO out of VRAM), and also repin at queue destroy. KFD queue restore runs late - user processes thaw before it, and under SR-IOV it is deferred until the VF exits full access - so once the VM has resumed an application can destroy a queue before its MQD BO is repinned, which would otherwise unpin an already-unpinned BO and touch a stale q->mqd. v5: drop support for no-HWS mode, and set q->mqd to NULL at eviction. Signed-off-by: Shikang Fan Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher

drm/amdgpu: Fix typo in comment

2026-08-06T17:47:02Z

Fix a spelling mistake in a comment. Signed-off-by: Kenji Takahashi Signed-off-by: Alex Deucher

drm/amdkfd: enable rs64mem for kfd queue

2026-08-06T16:46:14Z

Enabled RS64mem for KFD queues by integrating process and gang context index allocation in the per KFD device process and queue creation. Signed-off-by: Prike Liang Reviewed-by: Michael Chen Signed-off-by: Alex Deucher

drm/amdkfd: Unmap svm range from GPU set to no-access

2026-08-06T13:25:49Z

When KFD_IOCTL_SVM_ATTR_NO_ACCESS is applied to a GPU that has an SVM range mapped, unmap the range from that GPU. Once no GPU maps the range, the MMU notifier can skip queue eviction on CPU page faults. Replace the mapped_to_gpu boolean with bitmap_mapped to track which GPUs currently have the range mapped. Set bits in svm_range_map_to_gpus() and clear them in svm_range_unmap_from_gpus(). This is separate from bitmap_access/bitmap_aip which track user-requested attributes and must not be used to determine mapping state. Add bitmap_needs_unmap to svm_range, set for each GPU given no-access. Add svm_range_needs_unmap() to unmap the range from those GPUs when the app sets the no-access attribute. Bump the checkpoint timestamp on unmap so retry faults queued before the no-access unmap are dropped instead of restoring the mapping. v4: - Rename and set prange->mapping_done to false if validate and map not complete successfully (Felix) v3: - Correct error handling, support app retry update mapping (Felix) v2: - Add bitmap_mapped to not break get_attr (Felix) Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher

drm/amdkfd: Add helper svm_range_update_checkpoint_timestamp

2026-08-06T13:25:42Z

Extract svm_range_update_checkpoint_timestamp() from svm_range_unmap_from_cpu(). The next patch calls it when the app sets the no-access attribute. Change checkpoint_ts in svm_range_list from uint64_t to atomic64_t so svm_range_restore_pages() can read it from the page fault handler without holding the svms lock. No functional change, preparation for the next patch. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher