[PATCH V1] accel/amdxdna: Preserve user address when PASID is disabled

[PATCH V1] accel/amdxdna: Preserve user address when PASID is disabled

[Lizhi Hou]

When PASID is not used, the buffer user address is set to
AMDXDNA_INVALID_ADDR. As a result, heap buffer user address validation
fails even though the original userspace address is available.

Preserve the userspace address regardless of PASID usage so heap buffer
address validation works correctly.

Fixes: dbc8fd7a03cb ("accel/amdxdna: Add expandable device heap support")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
 drivers/accel/amdxdna/amdxdna_gem.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
index 77e5fad08ae5..33cf5af98ceb 100644
--- a/drivers/accel/amdxdna/amdxdna_gem.c
+++ b/drivers/accel/amdxdna/amdxdna_gem.c
@@ -349,8 +349,11 @@ static int amdxdna_hmm_register(struct amdxdna_gem_obj *abo,
 	u32 nr_pages;
 	int ret;
 
-	if (!amdxdna_pasid_on(abo->client))
+	if (!amdxdna_pasid_on(abo->client)) {
+		/* Need to set uva for heap uva validation */
+		abo->mem.uva = addr;
 		return 0;
+	}
 
 	mapp = kzalloc_obj(*mapp);
 	if (!mapp)
-- 
2.34.1

Re: [PATCH V1] accel/amdxdna: Preserve user address when PASID is disabled

[Mario Limonciello]

On 6/1/26 23:06, Lizhi Hou wrote:
> When PASID is not used, the buffer user address is set to
> AMDXDNA_INVALID_ADDR. As a result, heap buffer user address validation
> fails even though the original userspace address is available.
> 
> Preserve the userspace address regardless of PASID usage so heap buffer
> address validation works correctly.
> 
> Fixes: dbc8fd7a03cb ("accel/amdxdna: Add expandable device heap support")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
> ---
>   drivers/accel/amdxdna/amdxdna_gem.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
> index 77e5fad08ae5..33cf5af98ceb 100644
> --- a/drivers/accel/amdxdna/amdxdna_gem.c
> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
> @@ -349,8 +349,11 @@ static int amdxdna_hmm_register(struct amdxdna_gem_obj *abo,
>   	u32 nr_pages;
>   	int ret;
>   
> -	if (!amdxdna_pasid_on(abo->client))
> +	if (!amdxdna_pasid_on(abo->client)) {
> +		/* Need to set uva for heap uva validation */
> +		abo->mem.uva = addr;
>   		return 0;
> +	}
>   
>   	mapp = kzalloc_obj(*mapp);
>   	if (!mapp)

Re: [PATCH V1] accel/amdxdna: Preserve user address when PASID is disabled

[Lizhi Hou]

Applied to drm-misc-next-fixes

On 6/2/26 07:15, Mario Limonciello wrote:
>
>
> On 6/1/26 23:06, Lizhi Hou wrote:
>> When PASID is not used, the buffer user address is set to
>> AMDXDNA_INVALID_ADDR. As a result, heap buffer user address validation
>> fails even though the original userspace address is available.
>>
>> Preserve the userspace address regardless of PASID usage so heap buffer
>> address validation works correctly.
>>
>> Fixes: dbc8fd7a03cb ("accel/amdxdna: Add expandable device heap 
>> support")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
>> ---
>>   drivers/accel/amdxdna/amdxdna_gem.c | 5 ++++-
>>   1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c 
>> b/drivers/accel/amdxdna/amdxdna_gem.c
>> index 77e5fad08ae5..33cf5af98ceb 100644
>> --- a/drivers/accel/amdxdna/amdxdna_gem.c
>> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
>> @@ -349,8 +349,11 @@ static int amdxdna_hmm_register(struct 
>> amdxdna_gem_obj *abo,
>>       u32 nr_pages;
>>       int ret;
>>   -    if (!amdxdna_pasid_on(abo->client))
>> +    if (!amdxdna_pasid_on(abo->client)) {
>> +        /* Need to set uva for heap uva validation */
>> +        abo->mem.uva = addr;
>>           return 0;
>> +    }
>>         mapp = kzalloc_obj(*mapp);
>>       if (!mapp)
>

Claude review: accel/amdxdna: Preserve user address when PASID is disabled

[Claude Code Review Bot]

Overall Series Review

Subject: accel/amdxdna: Preserve user address when PASID is disabled
Author: Lizhi Hou <lizhi.hou@amd.com>
Patches: 3
Reviewed: 2026-06-04T13:24:31.255992

---

This is a single-patch fix for the `accel/amdxdna` driver. The bug is clear: when PASID is disabled, `amdxdna_hmm_register()` returns early without setting `abo->mem.uva`, so it stays at `AMDXDNA_INVALID_ADDR` (its initialization value from `amdxdna_gem_create_obj()` at line 178). Later, `amdxdna_init_dev_bo()` calls `amdxdna_gem_uva(heap)` on each heap BO and checks:

```c
heap_addr = amdxdna_gem_uva(heap);
if (heap_addr == AMDXDNA_INVALID_ADDR) {
    XDNA_ERR(xdna, "Heap %d is not mapped", heap_id);
    return -EAGAIN;
}
```

This validation always fails in the no-PASID path because `uva` was never populated, even though the BO was successfully mapped. The fix is correct and minimal.

One minor observation: there is a behavioral asymmetry between the PASID-on and PASID-off paths after this patch that is worth noting but not blocking.

---

---
Generated by Claude Code Patch Reviewer

Claude review: accel/amdxdna: Preserve user address when PASID is disabled

[Claude Code Review Bot]

Patch Review

**Correctness: The fix is correct.** Setting `abo->mem.uva = addr` before the early return ensures that `amdxdna_gem_uva()` returns a valid address for heap validation in `amdxdna_init_dev_bo()`, regardless of PASID state.

**Minor observations (non-blocking):**

1. **Cleanup asymmetry on munmap.** In the PASID-on path, `uva` is reset to `AMDXDNA_INVALID_ADDR` when the last umap entry is removed (`amdxdna_umap_release()` at `amdxdna_gem.c:322`). In the no-PASID path, no `mapp` is created and no entry is added to `umap_list`, so `uva` is never reset after munmap — it persists until the BO is freed. This means `amdxdna_gem_uva()` could return a stale address for an unmapped BO in the no-PASID case. In practice this is likely harmless because `amdxdna_obj_dma_addr()` uses `abo->mem.dma_addr` (not `uva`) when PASID is off, and heap validation would only occur during subsequent `amdxdna_init_dev_bo()` calls. But it's worth calling out.

2. **Repeated mmap behavior.** In the PASID-on path, `uva` is only set on the first mmap (guarded by `list_empty(&abo->mem.umap_list)` at line 389). With this patch, the no-PASID path sets `uva` on every mmap call unconditionally. For heap BOs this is fine since they're typically mmapped once, but it's a subtle behavioral difference.

3. **Locking.** The PASID-on path writes `uva` under `notifier_lock` (line 388–392). This patch writes `uva` without the lock. Since the no-PASID path doesn't manipulate `umap_list` and mmap is serialized by the mm's `mmap_lock`, this is safe in practice. The header comment (amdxdna_gem.h:33–36) already states `uva` can be accessed without `notifier_lock`.

**Verdict:** The patch is a clear bug fix with a correct Fixes tag. The asymmetries noted above are pre-existing design characteristics of the PASID-on vs PASID-off paths rather than issues introduced by this patch.

Reviewed-by tag warranted.

---
Generated by Claude Code Patch Reviewer