Re: [PATCH v3 1/2] drm/amdkfd: disable SVM when the GPUVM cannot cover CPU addresses

[Felix Kuehling <felix.kuehling@amd.com>]

On 2026-10-20 09:29, Daniel Huang wrote:
> KFD SVM maps memory in GPUVM at the same virtual address used by
> the CPU. However, svm_range_map_to_gpu() passes the corresponding
> PFNs to amdgpu_vm_update_range() without checking them against
> vm_manager.max_pfn.
>
> If the GPUVM address range is smaller than the CPU address range,
> the page-table walker can index beyond the allocated root page-table
> entries. Unlike the SVM path, the BO mapping path validates the
> address range through amdgpu_vm_verify_parameters().
>
> Only an explicit amdgpu.vm_size override configures a GPUVM smaller
> than the driver would select on its own, and that parameter is meant
> for driver testing rather than normal end-user configuration.
>
> Reproduced on a Radeon 780M (gfx1103) with amdgpu.vm_size=64.
> Repeated hipMallocManaged() allocations attempted to map CPU
> address 0x74bd48000000, well beyond the 64 GiB GPUVM limit.
> The out-of-bounds root entry contained SLUB poison with
> slub_debug=FZPU and recycled heap data without it, resulting in
> a general protection fault:
>
>    RIP: 0010:amdgpu_vm_cpu_update+0x2f/0x140 [amdgpu]
>     amdgpu_vm_pte_update_flags+0xfa/0x1e0 [amdgpu]
>     amdgpu_vm_ptes_update+0x38b/0xa00 [amdgpu]
>     amdgpu_vm_update_range+0x279/0x930 [amdgpu]
>     svm_range_map_to_gpu+0x13d/0x400 [amdgpu]
>     svm_range_validate_and_map+0x8d3/0xaa0 [amdgpu]
>     svm_ioctl+0x66/0x80 [amdgpu]
>     kfd_ioctl+0x40a/0x650 [amdgpu]
>
> As discussed in [1], rejecting out-of-range PFNs in
> amdgpu_vm_update_range() is too late. SVM must not be initialized
> when the GPUVM cannot represent the required CPU addresses.
>
> Prevent this by disabling KFD SVM support when the GPUVM address
> range is smaller than AMDGPU_GMC_HOLE_START. This prevents
> affected devices from advertising SVM support and excludes them
> from SVM mappings. Warn from kfd_update_svm_support_properties(),
> which runs after the device memory pgmap is registered, so that
> only devices that would otherwise have advertised SVM report the
> loss of the capability.
>
> KFD SVM has never been supported before GFXv9: kgd2kfd_init_zone_device()
> returns early for GC IP versions below 9.0.1, leaving kfd.pgmap.type at
> zero, so KFD_IS_SVM_API_SUPPORTED() is already false and
> HSA_CAP_SVMAPI_SUPPORTED is never advertised on GMC v6/v7/v8. The new
> condition therefore cannot change behaviour on those generations.
>
> The BO and userptr paths are unaffected. Their GPU virtual address is
> chosen by user space independently of the CPU address and validated by
> amdgpu_vm_verify_parameters() in amdgpu_vm_bo_map(), so an out of range
> address is rejected at map time instead of reaching the page tables.
> SVM is the only path whose address is dictated by the CPU mapping.
>
> [1] https://lore.kernel.org/amd-gfx/da43b0e3-5bd9-4aa1-86d3-b733f3bad108@amd.com/
>
> Closes: https://github.com/ROCm/TheRock/issues/9302
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Daniel Huang <danielhu@amd.com>

Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>


> ---
>   drivers/gpu/drm/amd/amdkfd/kfd_svm.h      | 15 +++++++++++++--
>   drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 ++++++++++-
>   2 files changed, 23 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.h b/drivers/gpu/drm/amd/amdkfd/kfd_svm.h
> index c7d7adae4476..f61030408f45 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.h
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.h
> @@ -203,11 +203,22 @@ struct kfd_process_device *
>   svm_range_get_pdd_by_node(struct svm_range *prange, struct kfd_node *node);
>   void svm_range_list_lock_and_flush_work(struct svm_range_list *svms, struct mm_struct *mm);
>   
> +/* SVM uses CPU virtual addresses for GPU mappings. Disable SVM if the GPUVM
> + * address range cannot cover the required CPU address range. The parameter
> + * must be named adev, AMDGPU_GMC_HOLE_START dereferences it.
> + */
> +static inline bool kfd_svm_vm_covers_user_va(struct amdgpu_device *adev)
> +{
> +	return (adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT) >=
> +		AMDGPU_GMC_HOLE_START;
> +}
> +
>   /* SVM API and HMM page migration work together, device memory type
>    * is initialized to not 0 when page migration register device memory.
>    */
> -#define KFD_IS_SVM_API_SUPPORTED(adev) ((adev)->kfd.pgmap.type != 0 ||\
> -					((adev)->apu_prefer_gtt))
> +#define KFD_IS_SVM_API_SUPPORTED(adev)					\
> +	(((adev)->kfd.pgmap.type != 0 || (adev)->apu_prefer_gtt) &&	\
> +	 kfd_svm_vm_covers_user_va(adev))
>   
>   void svm_range_bo_unref_async(struct svm_range_bo *svm_bo);
>   
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
> index 35b3abe57b80..5d12446b8ea8 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
> @@ -2471,8 +2471,17 @@ void kfd_update_svm_support_properties(struct amdgpu_device *adev)
>   				sys_props.generation_count++;
>   			else
>   				dev_err(adev->dev, "Failed to update SVM support properties. ret=%d\n", ret);
> -		} else
> +		} else {
> +#if IS_ENABLED(CONFIG_HSA_AMD_SVM)
> +			if ((adev->kfd.pgmap.type || adev->apu_prefer_gtt) &&
> +			    !kfd_svm_vm_covers_user_va(adev))
> +				dev_warn_once(adev->dev,
> +					      "GPUVM size 0x%llx is too small for KFD SVM; SVM disabled (amdgpu.vm_size=%d)\n",
> +					      adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT,
> +					      amdgpu_vm_size);
> +#endif
>   			dev->node_props.capability &= ~HSA_CAP_SVMAPI_SUPPORTED;
> +		}
>   	}
>   	up_write(&topology_lock);
>   }