Re: [PATCH 1/2] drm/amdkfd: handle SVM interval notifier registration failures

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [High] drm/amdkfd: incorrect address unit in svm_range_restore_pages()
  [1]
--

commit 1895ed01e5a9a263f9ad3ebb51b71149e38c2024
Author: Aveline Noir <jm5905938@gmail.com>

drm/amdkfd: handle SVM interval notifier registration failures

This commit propagates MMU interval notifier registration errors and
registers staged SVM ranges before publishing them to the process SVMS
or handling retry faults.

> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
> index ed5e3318877be..8184cbbb829ef 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c

[ ... ]

> @@ -3203,11 +3235,11 @@ svm_range_restore_pages(struct amdgpu_device *adev, unsigned int pasid,
>  			goto retry_write_locked;
>  		}
>  		prange = svm_range_create_unregistered_range(node, p, mm, addr);
> -		if (!prange) {
> +		if (IS_ERR_OR_NULL(prange)) {
>  			pr_debug("failed to create unregistered range svms 0x%p address [0x%llx]\n",
>  				 svms, addr);
>  			mmap_write_downgrade(mm);
> -			r = -EFAULT;
> +			r = prange ? PTR_ERR(prange) : -EFAULT;
>  			goto out_unlock_svms;
>  		}
>  	}

[Severity: High]
This problem wasn't introduced by this patch, but does
svm_range_restore_pages() pass a page number instead of a byte address to
amdgpu_gmc_filter_faults_remove() [1]?

amdgpu_vm_handle_fault() passes addr >> PAGE_SHIFT into
svm_range_restore_pages(), which then passes addr unchanged to
amdgpu_gmc_filter_faults_remove() on the -EAGAIN exit path (and when
svm_range_skip_recover() returns true):

drivers/gpu/drm/amd/amdkfd/kfd_svm.c:svm_range_restore_pages() {
	...
	if (r == -EAGAIN) {
		pr_debug("recover vm fault later\n");
		amdgpu_gmc_filter_faults_remove(node->adev, addr, pasid);
		r = 0;
	}
}

amdgpu_gmc_filter_faults_remove() hashes its address argument via
amdgpu_gmc_fault_key(addr, pasid), which expects the page-aligned byte
address that amdgpu_gmc_filter_faults() originally inserted.  Passing the
shifted page number produces a mismatched key, so the fault entry is never
removed from the hardware fault filter and subsequent retries of the fault
are suppressed, leading to unrecoverable page faults and GPU hangs.

[1] https://sashiko.dev/#/bug/linux-c3a1de9c-2a28-405f-a897-3418639e7854

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-kfd-svm-baseline-errors-20261107-v1-0-9ef4008019ab@gmail.com?part=1