linux.git/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c, branch v7.2-rc2

drm/amdkfd: always resume_all after suspend_all

2026-06-04T19:38:08+00:00

Need to restore any good queues even if the suspend_all
failed for some.  Always run remove_queue as that will
schedule a GPU reset is removing the queue fails.

v2: move resume_all after remove

Fixes: eb067d65c33e ("drm/amdkfd: Update BadOpcode Interrupt handling with MES")
Reviewed-by: Amber Lin 
Signed-off-by: Alex Deucher

drm/amdkfd: fix NULL dereference in get_queue_ids()

2026-06-03T17:54:28+00:00

When usr_queue_id_array is NULL and num_queues is non-zero,
get_queue_ids() returns NULL. The callers check only IS_ERR() on the
return value; since IS_ERR(NULL) == false the check passes, and
suspend_queues() calls q_array_invalidate() which immediately
dereferences NULL while iterating num_queues times.

Userspace can trigger this via kfd_ioctl_set_debug_trap() by supplying
num_queues > 0 with a zero queue_array_ptr, causing a kernel panic.

A NULL usr_queue_id_array with num_queues == 0 is a legitimate no-op
(q_array_invalidate never executes, and resume_queues already guards
all queue_ids dereferences behind a NULL check). Return ERR_PTR(-EINVAL)
only when num_queues is non-zero and the pointer is absent; both callers
already propagate IS_ERR() returns correctly to userspace.

Fixes: a70a93fa568b ("drm/amdkfd: add debug suspend and resume process queues operation")
Signed-off-by: Muhammad Bilal 
Signed-off-by: Alex Deucher

drm/amdkfd: fix UAF race in destroy_queue_cpsch

2026-06-03T17:48:33+00:00

wait_on_destroy_queue() drops locks to wait for queue resume, allowing
a concurrent destroy to free the queue. Use is_being_destroyed flag to
serialize destruction.

Reviewed-by: Amir Shetaia 
Signed-off-by: Alysa Liu 
Signed-off-by: Alex Deucher

drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

2026-05-27T14:48:39+00:00

get_queue_ids() computes array_size = num_queues * sizeof(uint32_t),
which could overflow on 32-bit size_t build. using array_size()
instead, it saturates to SIZE_MAX on overflow.

Signed-off-by: Eric Huang 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher

drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id

2026-05-18T22:19:32+00:00

allocate_sdma_queue has an option where the sdma queue id can be
specified (used by CRIU). We weren't bounds-checking that
value.

Confirm it's less than the maximum number of queues.

Signed-off-by: David Francis 
Reviewed-by: Harish Kasiviswanathan 
Signed-off-by: Alex Deucher

drm/amdkfd: Check bounds on allocate_doorbell

2026-05-18T22:18:25+00:00

allocated_doorbell has an option to set the doorbell id
to a specific value (used by CRIU). This value was not
bounds checked.

Check to confirm it's less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS.

Signed-off-by: David Francis 
Reviewed-by: Harish Kasiviswanathan 
Signed-off-by: Alex Deucher

drm/amdkfd: fix unhalt_cpsch warning during module unload

2026-05-11T19:55:56+00:00

Downgrade unhalt_cpsch warning to dev_dbg when sched is already stopped

Signed-off-by: Perry Yuan 
Reviewed-by: Yifan Zhang 
Signed-off-by: Alex Deucher

amd/amdkfd: Add kfd_ioctl_profiler to contain profiler kernel driver changes

2026-05-11T19:55:55+00:00

kfd_ioctl_profiler takes a similar approach to that of
kfd_ioctl_dbg_trap (which contains debugger related IOCTL
services) where kfd_ioctl_profiler will contain all profiler
related IOCTL services. The IOCTL is designed to be expanded
as needed to support additional profiler functionality.

The current functionality of the IOCTL is to allow for profilers
which need PMC counters from GPU devices to both signal to other
profilers that may be on the system that the device has active PMC
profiling taking place on it (multiple PMC profilers on the same
device can result in corrupted counter data) and to setup the device
to allow for the collection of SQ PMC data on all queues on the device.

For PMC data for the SQ block (such as SQ_WAVES) to be available
to a profiler, mmPERFCOUNT_ENABLE must be set on the queues. When
profiling a single process, the profiler can inject PM4 packets into
each queue to turn on PERFCOUNT_ENABLE. When profiling system wide,
the profiler does not have this option and must have a way to turn
on profiling for queues in which it cannot inject packets into directly.

Accomplishing this requires a few steps:

1. Checking if the user has the necessary permissions to profile system
   wide on the device. This check uses the same check that linux perf
   uses to determine if a user has the necessary permissions to profile
   at this scope (primarily if the process has CAP_SYS_PERFMON or is root).

2. Locking the device for profiling. This is done by setting a lock bit
   on the device struct and storing the process that locked the device.

3. Iterating all queues on the device and issuing an MQD Update to enable
   perfcounting on the queues.

4. Actions to cleanup if the process exits or releases the lock.

The IOCTL also contains a link to the existing PC Sampling IOCTL as well.
This is per a suggestion that we should potentially remove the PC Sampling
IOCTL to have it be a part of the profiler IOCTL. This is a future change.
In addition, we do expect to expand the profiler IOCTL to include
additional profiler functionality in the future (which necessitates the
use of a version number).

v2: sqaush in proper IOCTL number

Proposed userpace support:
https://github.com/ROCm/rocm-systems/commit/40abc95a6463a61bb318a67efd6d9cc3e5ee8839

Signed-off-by: Benjamin Welton 
Signed-off-by: Perry Yuan 
Acked-by: Kent Russell 
Reviewed-by: Yifan Zhang 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher

drm/amdkfd: Make all TLB-flushes heavy-weight

2026-05-05T13:56:28+00:00

With only one sequence number we cannot track the need for legacy vs
heavy-weight flushes reliably. Always use heavy-weight.

Signed-off-by: Felix Kuehling 
Reviewed-by: Philip Yang 
Signed-off-by: Alex Deucher

drm/amdkfd: Reset queue/pipe in MES

2026-04-28T18:46:00+00:00

When removing queues fails, KFD calls amdgpu_mes to detect and reset
hung queues, then cleans up those hung queues in KFD.

Suggested-by: Jonathan Kim 
Signed-off-by: Amber Lin 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher