RE: [PATCH 1/2] Revert "drm/amdgpu: fix aperture mapping leak"

AMD General

Series is

Reviewed-by: Hawking Zhang <[email protected]>

Regards,
Hawking
-----Original Message-----
From: Kamal, Asad <[email protected]>
Sent: Tuesday, August 4, 2026 8:51 PM
To: [email protected]
Cc: Koenig, Christian <[email protected]>; YuanShang Mao (River) <[email protected]>; Zhang, Tiantian (Celine) <[email protected]>; Lazar, Lijo <[email protected]>; Zhang, Hawking <[email protected]>; Ma, Le <[email protected]>; Zhang, Morris <[email protected]>; Deucher, Alexander <[email protected]>; Wang, Yang(Kevin) <[email protected]>; Kamal, Asad <[email protected]>; Yuansheng Mao <[email protected]>
Subject: [PATCH 1/2] Revert "drm/amdgpu: fix aperture mapping leak"

devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devres_release_all() unmaps the aperture before the DRM device release callback fires amdgpu_device_fini_sw(). IP sw_fini callbacks (e.g. vcn_v4_0_sw_fini) write to fw_shared through a pointer derived from aper_base_kaddr, causing a kernel page fault on probe failure / rollback:

  BUG: unable to handle page fault ... PMD 0
  RIP: vcn_v4_0_sw_fini+0x7b/0x170 [amdgpu]
  Call Trace:
    amdgpu_device_fini_sw
    amdgpu_driver_release_kms
    devm_drm_dev_init_release
    devres_release_all

This reverts commit 3763eacdfba23f3d642dda8d23f0e261653fe7fe.

Fixes: 3763eacdfba2 ("drm/amdgpu: fix aperture mapping leak")
Reported-by: Yuansheng Mao <[email protected]>
Closes: https://gitlab.freedesktop.org/drm/amd/issues/SWDEV-599369
Signed-off-by: Asad Kamal <[email protected]>
Reviewed-by: Lijo Lazar <[email protected]>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c |  2 ++
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c    | 34 ++++++++++++----------
 2 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 638dfaf127fd..964efec0d335 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4185,6 +4185,8 @@ static void amdgpu_device_unmap_mmio(struct amdgpu_device *adev)

        iounmap(adev->rmmio);
        adev->rmmio = NULL;
+       if (adev->mman.aper_base_kaddr)
+               iounmap(adev->mman.aper_base_kaddr);
        adev->mman.aper_base_kaddr = NULL;

        /* Memory manager related */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index c4094edbdff1..0b00625603c0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -2139,23 +2139,17 @@ int amdgpu_ttm_init(struct amdgpu_device *adev)
        /* Change the size here instead of the init above so only lpfn is affected */
        amdgpu_ttm_disable_buffer_funcs(adev);
 #ifdef CONFIG_64BIT
-       if (adev->gmc.xgmi.connected_to_cpu) {
-               void *kaddr = devm_memremap(adev->dev, adev->gmc.aper_base,
-                                           adev->gmc.visible_vram_size,
-                                           MEMREMAP_WB);
-               if (IS_ERR(kaddr))
-                       return PTR_ERR(kaddr);
-               adev->mman.aper_base_kaddr = (__force void __iomem *)kaddr;
-       } else if (adev->gmc.is_app_apu) {
+#ifdef CONFIG_X86
+       if (adev->gmc.xgmi.connected_to_cpu)
+               adev->mman.aper_base_kaddr = ioremap_cache(adev->gmc.aper_base,
+                               adev->gmc.visible_vram_size);
+       else if (adev->gmc.is_app_apu)
                DRM_DEBUG_DRIVER(
                        "No need to ioremap when real vram size is 0\n");
-       } else {
-               adev->mman.aper_base_kaddr = devm_ioremap_wc(adev->dev,
-                                                            adev->gmc.aper_base,
-                                                            adev->gmc.visible_vram_size);
-               if (!adev->mman.aper_base_kaddr)
-                       return -ENOMEM;
-       }
+       else
+#endif
+               adev->mman.aper_base_kaddr = ioremap_wc(adev->gmc.aper_base,
+                               adev->gmc.visible_vram_size);
 #endif

        amdgpu_ttm_init_vram_resv_regions(adev);
@@ -2284,6 +2278,7 @@ int amdgpu_ttm_init(struct amdgpu_device *adev)
  */
 void amdgpu_ttm_fini(struct amdgpu_device *adev)  {
+       int idx;
        if (!adev->mman.initialized)
                return;

@@ -2306,7 +2301,14 @@ void amdgpu_ttm_fini(struct amdgpu_device *adev)
        amdgpu_ttm_unmark_vram_reserved(adev, AMDGPU_RESV_FW_VRAM_USAGE);
        amdgpu_ttm_unmark_vram_reserved(adev, AMDGPU_RESV_DRV_VRAM_USAGE);

-       adev->mman.aper_base_kaddr = NULL;
+       if (drm_dev_enter(adev_to_drm(adev), &idx)) {
+
+               if (adev->mman.aper_base_kaddr)
+                       iounmap(adev->mman.aper_base_kaddr);
+               adev->mman.aper_base_kaddr = NULL;
+
+               drm_dev_exit(idx);
+       }

        if (!adev->gmc.is_app_apu)
                amdgpu_vram_mgr_fini(adev);
--
2.46.0