From c7ae3b2043282da8de92bd925c8f6bb614633181 Mon Sep 17 00:00:00 2001 From: Jesse Zhang Date: Wed, 23 Sep 2026 17:43:06 +0800 Subject: [PATCH] drm/amdgpu/userq: fix reading the WPTR at a non-zero BO offset The user queue UAPI permits the WPTR at any 8-byte aligned offset within a BO. amdgpu_userq_fence_read_wptr() locates the mapping containing the WPTR address, but amdgpu_bo_kmap() returns the start of the BO, so the code read the first u64 regardless of the WPTR offset. USERQ_SIGNAL uses this value as the exported fence seqno, so a wrong read makes the fence signal early (or never), breaking dependency synchronization. Translate the WPTR GPU address to a byte offset within the BO, accounting for the VA mapping start and the mapping's BO offset, before reading it. Fixes: a292fdecd728 ("drm/amdgpu: Implement userqueue signal/wait IOCTL") Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c index 6f1dc813ec5b..d90ac726f38c 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c @@ -370,7 +370,7 @@ static int amdgpu_userq_fence_read_wptr(struct amdgpu_device *adev, struct amdgpu_bo_va_mapping *mapping; struct amdgpu_bo *bo; struct drm_exec exec; - u64 addr, *ptr; + u64 addr, offset, *ptr; int ret; addr = queue->userq_prop->wptr_gpu_addr; @@ -402,7 +402,10 @@ static int amdgpu_userq_fence_read_wptr(struct amdgpu_device *adev, goto lock_error; } - *wptr = le64_to_cpu(*ptr); + /* The WPTR can be anywhere within the BO's VA mapping. */ + offset = addr - (mapping->start << AMDGPU_GPU_PAGE_SHIFT); + offset += mapping->offset; + *wptr = le64_to_cpu(ptr[offset / sizeof(*ptr)]); amdgpu_bo_kunmap(bo); drm_exec_fini(&exec);