Commit c50729c6 authored by Matthew Auld's avatar Matthew Auld
Browse files

drm/gpusvm: fix hmm_pfn_to_map_order() usage 



Handle the case where the hmm range partially covers a huge page (like
2M), otherwise we can potentially end up doing something nasty like
mapping memory which is outside the range, and maybe not even mapped by
the mm. Fix is based on the xe userptr code, which in a future patch
will directly use gpusvm, so needs alignment here.

v2:
  - Add kernel-doc (Matt B)
  - s/fls/ilog2/ (Thomas)

Reported-by: default avatarThomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: default avatarMatthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: default avatarThomas Hellström <thomas.hellstrom@linux.intel.com>
Link: https://lore.kernel.org/r/20250828142430.615826-11-matthew.auld@intel.com
parent 5952d805

drivers/gpu/drm/drm_gpusvm.c

+31 −2
Original line number Diff line number Diff line
@@ -635,6 +635,35 @@ drm_gpusvm_range_alloc(struct drm_gpusvm *gpusvm, 
	return range;

}



/**

 * drm_gpusvm_hmm_pfn_to_order() - Get the largest CPU mapping order.

 * @hmm_pfn: The current hmm_pfn.

 * @hmm_pfn_index: Index of the @hmm_pfn within the pfn array.

 * @npages: Number of pages within the pfn array i.e the hmm range size.

 *

 * To allow skipping PFNs with the same flags (like when they belong to

 * the same huge PTE) when looping over the pfn array, take a given a hmm_pfn,

 * and return the largest order that will fit inside the CPU PTE, but also

 * crucially accounting for the original hmm range boundaries.

 *

 * Return: The largest order that will safely fit within the size of the hmm_pfn

 * CPU PTE.

 */

static unsigned int drm_gpusvm_hmm_pfn_to_order(unsigned long hmm_pfn,

						unsigned long hmm_pfn_index,

						unsigned long npages)

{

	unsigned long size;



	size = 1UL << hmm_pfn_to_map_order(hmm_pfn);

	size -= (hmm_pfn & ~HMM_PFN_FLAGS) & (size - 1);

	hmm_pfn_index += size;

	if (hmm_pfn_index > npages)

		size -= (hmm_pfn_index - npages);



	return ilog2(size);

}



/**

 * drm_gpusvm_check_pages() - Check pages

 * @gpusvm: Pointer to the GPU SVM structure
@@ -693,7 +722,7 @@ static bool drm_gpusvm_check_pages(struct drm_gpusvm *gpusvm, 
			err = -EFAULT;

			goto err_free;

		}

		i += 0x1 << hmm_pfn_to_map_order(pfns[i]);

		i += 0x1 << drm_gpusvm_hmm_pfn_to_order(pfns[i], i, npages);

	}



err_free:
@@ -1270,7 +1299,7 @@ int drm_gpusvm_range_get_pages(struct drm_gpusvm *gpusvm, 
	for (i = 0, j = 0; i < npages; ++j) {

		struct page *page = hmm_pfn_to_page(pfns[i]);



		order = hmm_pfn_to_map_order(pfns[i]);

		order = drm_gpusvm_hmm_pfn_to_order(pfns[i], i, npages);

		if (is_device_private_page(page) ||

		    is_device_coherent_page(page)) {

			if (zdd != page->zone_device_data && i > 0) {