On Mon, Jul 20, 2026 at 05:26:52PM -0700, Matthew Brost wrote:
> On Mon, Jul 20, 2026 at 04:48:02PM -0700, Stanislav Kinsburskii wrote:
> > On Mon, Jul 20, 2026 at 11:54:50AM -0700, Matthew Brost wrote:
> > > On Tue, Jul 14, 2026 at 03:54:32PM -0700, Stanislav Kinsburskii wrote:
> > > > drm_gpusvm_scan_mm() asks HMM to report the current CPU page-table
> > > > state without faulting missing entries by leaving default_flags set to
> > > > zero. The HMM PFN array is still caller-owned input/output state, and
> > > > the framework may preserve input bits while filling entries. It is not
> > > > safe for the caller to hand HMM an uninitialized array and then treat
> > > > entries without HMM_PFN_VALID as an authoritative unpopulated result.
> > > >
> > > > Use kvcalloc() for the temporary PFN array so entries that are not
> > > > reported as valid start from the documented zero state. This prevents
> > > > random stack or heap contents from being interpreted as HMM PFN flags or
> > > > PFN values during the scan.
> > > >
> > > > Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the
> > > > current migration state")
> > > > Cc: [email protected]
> > > > Signed-off-by: Stanislav Kinsburskii <[email protected]>
> > > > ---
> > > > drivers/gpu/drm/drm_gpusvm.c | 2 +-
> > > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > > >
> > > > diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> > > > index 1a8bb83bd28d..c8f489d7ff7e 100644
> > > > --- a/drivers/gpu/drm/drm_gpusvm.c
> > > > +++ b/drivers/gpu/drm/drm_gpusvm.c
> > > > @@ -859,7 +859,7 @@ enum drm_gpusvm_scan_result
> > > > drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
> > >
> > > Two other cases in gpusvm would need to be fixed as well:
> > >
> > > - drm_gpusvm_get_pages
> > > - drm_gpusvm_range_evict
> > >
> >
> > No, these two are fine, as the faulting is done with HMM_PFN_REQ_FAULT,
> > which either populates all the PFNs or fails.
> >
>
> Ah, yes clearly misunderstood the issue here / didn't read the commit
> message.
>
> This patch LGTM:
> Reviewed-by: Matthew Brost <[email protected]>
>
> Will merge to drm-misc-fixes shortly.
>
> But then drm_gpusvm_check_pages() should be fixed too as we don't set
> HMM_PFN_REQ_FAULT there either.
>
Indeed.
Please, see v2 of the patch.
Thanks,
Stanislav
> Matt
>
> > The only case where PFNs must be zeroed is when the caller wants to
> > collect the mapped PFNs. In this case, the missing PFNs are simply
> > ignored by the HMM framework.
> >
> > Thanks,
> > Stanislav
> >
> > > The offending patch is likely the one that added sticky bits to HMM:
> > > `git format-patch -1 285e871884ff3` for above two cases.
> > >
> > > While I think zeroing here would be the safest approach, it does not
> > > appear
> > > to be a problem in practice because the sticky bits are only used by
> > > `hmm_dma_map_pfn()` and `hmm_dma_unmap_pfn()`.
> > >
> > > Also, there are several non-gpusvm cases in the kernel that do not zero
> > > the PFN array either. So I'd say we should either fix the entire kernel
> > > in one pass, document that pfns must initialized to a known state, or
> > > leave this code alone.
> > >
> > > Matt
> > >
> > > > const struct dev_pagemap *other = NULL;
> > > > int err, i;
> > > >
> > > > - pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> > > > + pfns = kvcalloc(npages, sizeof(*pfns), GFP_KERNEL);
> > > > if (!pfns)
> > > > return DRM_GPUSVM_SCAN_UNPOPULATED;
> > > >
> > > >
> > > >
