svm_range_dma_map_dev() converts every zone device page returned by
hmm_range_fault() to a VRAM address using prange->svm_bo, and
svm_range_get_pte_flags() takes the VRAM node from prange->svm_bo too.
The dev_private_owner passed to HMM is per device or XGMI hive, not per
process, so HMM can also return pages of another svm_bo. For example,
after fork() the child shares the parent's VRAM pages, and validating
the child's range returns them. If the child's range has no svm_bo,
prange->svm_bo is dereferenced as NULL. If its svm_bo is on another
device in the hive, the address is computed with that device's VRAM
base and pgmap range instead of the page's.
Fail the mapping with -EFAULT for zone device pages outside the pgmap
of the svm_bo device. Clear the entry before returning, because its old
DMA mapping, if any, has already been unmapped and must not be unmapped
again.
Fixes: 1d5dbfe6c06a ("drm/amdkfd: classify and map mixed svm range pages in
GPU")
Signed-off-by: Aveline Noir <[email protected]>
---
Found by source review. Compile-tested only (W=1, no new warnings);
not tested on AMD hardware, so the fork case has not been reproduced.
KFD SVM is being moved to drm_gpusvm, so this is only meant as a small
fix for existing kernels.
---
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index ed5e3318877b..6e9b9dcaa136 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -181,7 +181,21 @@ svm_range_dma_map_dev(struct amdgpu_device *adev, struct
svm_range *prange,
page = hmm_pfn_to_page(hmm_pfns[i]);
if (is_zone_device_page(page)) {
- struct amdgpu_device *bo_adev =
prange->svm_bo->node->adev;
+ struct amdgpu_device *bo_adev = prange->svm_bo ?
+ prange->svm_bo->node->adev : NULL;
+
+ /*
+ * The pgmap owner is per device or XGMI hive, so HMM
+ * may return a page of another svm_bo, e.g. one shared
+ * with another process after fork(). The VRAM address
+ * below and svm_range_get_pte_flags() assume the
+ * svm_bo device.
+ */
+ if (!bo_adev ||
+ page_pgmap(page) != &bo_adev->kfd.pgmap) {
+ addr[i] = 0;
+ return -EFAULT;
+ }
addr[i] = (hmm_pfns[i] << PAGE_SHIFT) +
bo_adev->vm_manager.vram_base_offset -
---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261103-kfd-svm-foreign-vram-20261103-9ce0705305fd
