From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BAF0E3446B5; Tue, 11 Nov 2025 01:22:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762824143; cv=none; b=VzFmxQkZmUbG7l4Sxaud9h4d8W/LNSC9Yq7edHqPlwBQ+z5FbiW4QstFvNzYKrvd7j3Vy/s416aTCjhr7sGhE+dGGph1DoBBTACW30bzenTf3tZMxfjJCD8K2bkkI1hjCS5/KITiC1AyAo1jQrsqxiJAv9Zbaqt4/KxDB8qp/eg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762824143; c=relaxed/simple; bh=xZwbSjYMk3+f5dPTVZ26+tQA5LXEt8QzVFQnE52Cqx0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=PmYe9ZLRb++hrvr66EKDsDVMLMK/3m8+/j9r8P28TftldqWwT8ekN3P612bmT3a90PATqM0K0Wp3rTDiu38zQHfU+JmCX+iAG5sHINAbO7dYONsSjC4XgcD/i9RKmXjBppwWS9yxzPSrDc7nCDeCNLxFZpVj/vc8U7VTzzvBb2U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EGZ2MjuA; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="EGZ2MjuA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4ADB8C4CEF5; Tue, 11 Nov 2025 01:22:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1762824143; bh=xZwbSjYMk3+f5dPTVZ26+tQA5LXEt8QzVFQnE52Cqx0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EGZ2MjuA//AbLUE15uRvK/B1mxhDg+bGkt1eH0ZWFLhJ9mFFknu9DRYiY3pQSkrqo 71E6whsbqPbpYqoiIj+GXq+FPGqN96HvqA9XvZvGVl4bdHtgx56pmTyxTdU9vn9owt VEYpvJcAFzvqO0Z8dHeiCyLqRg8Ao+PMqC0O+hmY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= , Matthew Auld , Matthew Brost , Sasha Levin Subject: [PATCH 6.17 445/849] drm/gpusvm: fix hmm_pfn_to_map_order() usage Date: Tue, 11 Nov 2025 09:40:15 +0900 Message-ID: <20251111004547.193943693@linuxfoundation.org> X-Mailer: git-send-email 2.51.2 In-Reply-To: <20251111004536.460310036@linuxfoundation.org> References: <20251111004536.460310036@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 6.17-stable review patch. If anyone has any objections, please let me know. ------------------ From: Matthew Auld [ Upstream commit c50729c68aaf93611c855752b00e49ce1fdd1558 ] Handle the case where the hmm range partially covers a huge page (like 2M), otherwise we can potentially end up doing something nasty like mapping memory which is outside the range, and maybe not even mapped by the mm. Fix is based on the xe userptr code, which in a future patch will directly use gpusvm, so needs alignment here. v2: - Add kernel-doc (Matt B) - s/fls/ilog2/ (Thomas) Reported-by: Thomas Hellström Signed-off-by: Matthew Auld Cc: Matthew Brost Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20250828142430.615826-11-matthew.auld@intel.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/drm_gpusvm.c | 33 +++++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c index 5bb4c77db2c3c..1dd8f3b593df6 100644 --- a/drivers/gpu/drm/drm_gpusvm.c +++ b/drivers/gpu/drm/drm_gpusvm.c @@ -708,6 +708,35 @@ drm_gpusvm_range_alloc(struct drm_gpusvm *gpusvm, return range; } +/** + * drm_gpusvm_hmm_pfn_to_order() - Get the largest CPU mapping order. + * @hmm_pfn: The current hmm_pfn. + * @hmm_pfn_index: Index of the @hmm_pfn within the pfn array. + * @npages: Number of pages within the pfn array i.e the hmm range size. + * + * To allow skipping PFNs with the same flags (like when they belong to + * the same huge PTE) when looping over the pfn array, take a given a hmm_pfn, + * and return the largest order that will fit inside the CPU PTE, but also + * crucially accounting for the original hmm range boundaries. + * + * Return: The largest order that will safely fit within the size of the hmm_pfn + * CPU PTE. + */ +static unsigned int drm_gpusvm_hmm_pfn_to_order(unsigned long hmm_pfn, + unsigned long hmm_pfn_index, + unsigned long npages) +{ + unsigned long size; + + size = 1UL << hmm_pfn_to_map_order(hmm_pfn); + size -= (hmm_pfn & ~HMM_PFN_FLAGS) & (size - 1); + hmm_pfn_index += size; + if (hmm_pfn_index > npages) + size -= (hmm_pfn_index - npages); + + return ilog2(size); +} + /** * drm_gpusvm_check_pages() - Check pages * @gpusvm: Pointer to the GPU SVM structure @@ -766,7 +795,7 @@ static bool drm_gpusvm_check_pages(struct drm_gpusvm *gpusvm, err = -EFAULT; goto err_free; } - i += 0x1 << hmm_pfn_to_map_order(pfns[i]); + i += 0x1 << drm_gpusvm_hmm_pfn_to_order(pfns[i], i, npages); } err_free: @@ -1342,7 +1371,7 @@ int drm_gpusvm_range_get_pages(struct drm_gpusvm *gpusvm, for (i = 0, j = 0; i < npages; ++j) { struct page *page = hmm_pfn_to_page(pfns[i]); - order = hmm_pfn_to_map_order(pfns[i]); + order = drm_gpusvm_hmm_pfn_to_order(pfns[i], i, npages); if (is_device_private_page(page) || is_device_coherent_page(page)) { if (zdd != page->zone_device_data && i > 0) { -- 2.51.0