* [PATCH v7 1/7] drm/tyr: add resources to RegistrationData
2026-07-14 3:18 [PATCH v7 0/7] drm/tyr: firmware loading and MCU boot support Deborah Brouwer
@ 2026-07-14 3:18 ` Deborah Brouwer
2026-07-14 3:18 ` [PATCH v7 2/7] drm/tyr: add a generic slot manager Deborah Brouwer
` (5 subsequent siblings)
6 siblings, 0 replies; 14+ messages in thread
From: Deborah Brouwer @ 2026-07-14 3:18 UTC (permalink / raw)
To: Daniel Almeida, Alice Ryhl, Danilo Krummrich, David Airlie,
Simona Vetter, Benno Lossin, Gary Guo
Cc: dri-devel, linux-kernel, rust-for-linux, Deborah Brouwer,
boris.brezillon, samitolvanen, work, acourbot, lyude, laura.nao,
beata.michalska, alvin.sun, steven.price
Currently Tyr is not storing any resources in its drm::Driver
RegistrationData.
Move Tyr's device-private resources and gpu information from
drm::Driver::Data to drm::Driver::RegistrationData. This allows Tyr to
access this data safely within the lifetime of its binding to its parent
platform device and while registered with userspace.
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
drivers/gpu/drm/tyr/driver.rs | 42 +++++++++++++++++++++---------------------
drivers/gpu/drm/tyr/file.rs | 11 ++++++-----
2 files changed, 27 insertions(+), 26 deletions(-)
diff --git a/drivers/gpu/drm/tyr/driver.rs b/drivers/gpu/drm/tyr/driver.rs
index 8348c6cd3929..46ce5c41e310 100644
--- a/drivers/gpu/drm/tyr/driver.rs
+++ b/drivers/gpu/drm/tyr/driver.rs
@@ -6,6 +6,7 @@
OptionalClk, //
},
device::{
+ Bound,
Core,
Device,
DeviceContext, //
@@ -27,10 +28,7 @@
regulator,
regulator::Regulator,
sizes::SZ_2M,
- sync::{
- aref::ARef,
- Mutex, //
- },
+ sync::Mutex,
time, //
};
@@ -53,13 +51,17 @@
#[pin_data(PinnedDrop)]
pub(crate) struct TyrPlatformDriverData<'bound> {
- _device: ARef<TyrDrmDevice>,
_reg: drm::Registration<'bound, TyrDrmDriver>,
}
+/// Data owned by the DRM [`Registration`].
+///
+/// This data can have references tied to the parent platform device binding scope
+/// and is accessible only while the DRM device is registered with userspace.
#[pin_data]
-pub(crate) struct TyrDrmDeviceData {
- pub(crate) pdev: ARef<platform::Device>,
+pub(crate) struct TyrDrmRegistrationData<'bound> {
+ /// Parent platform device.
+ pub(crate) pdev: &'bound platform::Device<Bound>,
#[pin]
clks: Mutex<Clocks>,
@@ -67,9 +69,10 @@ pub(crate) struct TyrDrmDeviceData {
#[pin]
regulators: Mutex<Regulators>,
- /// Some information on the GPU.
- ///
- /// This is mainly queried by userspace, i.e.: Mesa.
+ /// GPU MMIO register mapping.
+ pub(crate) iomem: IoMem<'bound>,
+
+ /// GPU information read from hardware during probe.
pub(crate) gpu_info: GpuInfo,
}
@@ -134,10 +137,10 @@ fn probe<'bound>(
// other threads of execution.
unsafe { pdev.dma_set_mask_and_coherent(DmaMask::try_new(pa_bits)?)? };
- let platform: ARef<platform::Device> = pdev.into();
+ let unreg_dev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, Ok(()))?;
- let data = try_pin_init!(TyrDrmDeviceData {
- pdev: platform.clone(),
+ let reg_data = try_pin_init!(TyrDrmRegistrationData {
+ pdev,
clks <- new_mutex!(Clocks {
core: core_clk,
stacks: stacks_clk,
@@ -147,18 +150,15 @@ fn probe<'bound>(
_mali: mali_regulator,
_sram: sram_regulator,
}),
+ iomem,
gpu_info,
});
- let tdev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, data)?;
// SAFETY: `reg` is stored in `TyrPlatformDriverData` and dropped when the driver is
// unbound; it is never forgotten.
- let reg = unsafe { drm::Registration::new(pdev.as_ref(), tdev, (), 0)? };
+ let reg = unsafe { drm::Registration::new(pdev.as_ref(), unreg_dev, reg_data, 0)? };
- let driver = TyrPlatformDriverData {
- _device: reg.device().into(),
- _reg: reg,
- };
+ let driver = TyrPlatformDriverData { _reg: reg };
// We need this to be dev_info!() because dev_dbg!() does not work at
// all in Rust for now, and we need to see whether probe succeeded.
@@ -184,8 +184,8 @@ fn drop(self: Pin<&mut Self>) {}
#[vtable]
impl drm::Driver for TyrDrmDriver {
- type Data = TyrDrmDeviceData;
- type RegistrationData<'a> = ();
+ type Data = ();
+ type RegistrationData<'bound> = TyrDrmRegistrationData<'bound>;
type File = TyrDrmFileData;
type Object = drm::gem::shmem::Object<BoData>;
type ParentDevice<Ctx: DeviceContext> = platform::Device<Ctx>;
diff --git a/drivers/gpu/drm/tyr/file.rs b/drivers/gpu/drm/tyr/file.rs
index b686041d5d6b..9f60a90d4948 100644
--- a/drivers/gpu/drm/tyr/file.rs
+++ b/drivers/gpu/drm/tyr/file.rs
@@ -12,7 +12,8 @@
use crate::driver::{
TyrDrmDevice,
- TyrDrmDriver, //
+ TyrDrmDriver,
+ TyrDrmRegistrationData, //
};
#[pin_data]
@@ -31,15 +32,15 @@ fn open(_dev: &drm::Device<Self::Driver>) -> Result<Pin<KBox<Self>>> {
impl TyrDrmFileData {
pub(crate) fn dev_query(
- ddev: &TyrDrmDevice<Registered>,
- _reg_data: &(),
+ _ddev: &TyrDrmDevice<Registered>,
+ reg_data: &TyrDrmRegistrationData<'_>,
devquery: &mut uapi::drm_panthor_dev_query,
_file: &TyrDrmFile,
) -> Result<u32> {
if devquery.pointer == 0 {
match devquery.type_ {
uapi::drm_panthor_dev_query_type_DRM_PANTHOR_DEV_QUERY_GPU_INFO => {
- devquery.size = core::mem::size_of_val(&ddev.gpu_info) as u32;
+ devquery.size = core::mem::size_of_val(®_data.gpu_info) as u32;
Ok(0)
}
_ => Err(EINVAL),
@@ -53,7 +54,7 @@ pub(crate) fn dev_query(
)
.writer();
- writer.write(&ddev.gpu_info)?;
+ writer.write(®_data.gpu_info)?;
Ok(0)
}
--
2.54.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [PATCH v7 2/7] drm/tyr: add a generic slot manager
2026-07-14 3:18 [PATCH v7 0/7] drm/tyr: firmware loading and MCU boot support Deborah Brouwer
2026-07-14 3:18 ` [PATCH v7 1/7] drm/tyr: add resources to RegistrationData Deborah Brouwer
@ 2026-07-14 3:18 ` Deborah Brouwer
2026-07-14 3:26 ` sashiko-bot
2026-07-14 3:18 ` [PATCH v7 3/7] drm/tyr: add Memory Management Unit (MMU) support Deborah Brouwer
` (4 subsequent siblings)
6 siblings, 1 reply; 14+ messages in thread
From: Deborah Brouwer @ 2026-07-14 3:18 UTC (permalink / raw)
To: Daniel Almeida, Alice Ryhl, Danilo Krummrich, David Airlie,
Simona Vetter, Benno Lossin, Gary Guo
Cc: dri-devel, linux-kernel, rust-for-linux, Deborah Brouwer,
boris.brezillon, samitolvanen, work, acourbot, lyude, laura.nao,
beata.michalska, alvin.sun, steven.price
From: Boris Brezillon <boris.brezillon@collabora.com>
Introduce a generic slot manager to dynamically allocate limited hardware
slots to software "seats". It can be used for both address space (AS) and
command stream group (CSG) slots.
The slot manager initially assigns seats to its free slots. It will
continue to reuse the same slot for a seat, as long as another seat does
not start to use the slot in the interim.
When contention arises because all of the slots are allocated, the slot
manager will lazily evict and reuse slots that have become idle (if any).
The seat state is protected using the LockedBy pattern with the same lock
that guards the SlotManager. This ensures the seat state stays consistent
across slot operations.
Hardware specific behaviour is controlled through the SlotManager's
specific manager type that implements the `SlotOperations` trait.
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Co-developed-by: Deborah Brouwer <deborah.brouwer@collabora.com>
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
drivers/gpu/drm/tyr/slot.rs | 378 ++++++++++++++++++++++++++++++++++++++++++++
drivers/gpu/drm/tyr/tyr.rs | 1 +
2 files changed, 379 insertions(+)
diff --git a/drivers/gpu/drm/tyr/slot.rs b/drivers/gpu/drm/tyr/slot.rs
new file mode 100644
index 000000000000..5c266fcf30ea
--- /dev/null
+++ b/drivers/gpu/drm/tyr/slot.rs
@@ -0,0 +1,378 @@
+// SPDX-License-Identifier: GPL-2.0 or MIT
+
+//! Slot management abstraction for limited hardware resources.
+//!
+//! This module provides a generic [`SlotManager`] that assigns limited hardware
+//! slots to logical "seats". A seat represents an entity (such as a virtual memory
+//! (VM) address space) that needs access to a hardware slot.
+//!
+//! The [`SlotManager`] tracks slot allocation using sequence numbers (seqno) to detect
+//! when a seat's binding has been invalidated. When a seat requests activation,
+//! the manager will either reuse the seat's existing slot (if still valid),
+//! allocate a free slot (if any are available), or evict the oldest idle slot if any
+//! slots are idle.
+//!
+//! Hardware-specific behavior is customized by implementing the [`SlotOperations`]
+//! trait, which allows callbacks when slots are activated or evicted.
+//!
+//! This is currently used for managing address space slots in the GPU, and it will
+//! also be used to manage Command Stream Group (CSG) interface slots in the future.
+//!
+//! [SlotOperations]: crate::slot::SlotOperations
+//! [SlotManager]: crate::slot::SlotManager
+#![expect(dead_code)]
+
+use core::{
+ mem::take,
+ ops::{
+ Deref,
+ DerefMut, //
+ }, //
+};
+
+use kernel::{
+ prelude::*,
+ sync::LockedBy, //
+};
+
+/// Seat information.
+///
+/// This can't be accessed directly by the element embedding a `Seat`,
+/// but is used by the generic slot manager logic to control residency
+/// of a certain object on a hardware slot.
+pub(crate) struct SeatInfo {
+ /// Slot used by this seat.
+ ///
+ /// This index is only valid if the slot pointed to by this index
+ /// has its `SlotInfo::seqno` match `SeatInfo::seqno`. Otherwise,
+ /// it means the object has been evicted from the hardware slot,
+ /// and a new slot needs to be acquired to make this object
+ /// resident again.
+ slot: u8,
+
+ /// Sequence number encoding the last time this seat was active.
+ /// We also use it to check if a slot is still bound to a seat.
+ seqno: u64,
+}
+
+/// Seat state.
+///
+/// This is meant to be embedded in the object that wants to acquire
+/// hardware slots. It also starts in the `Seat::NoSeat` state, and
+/// the slot manager will change the object value when an active/evict
+/// request is issued.
+#[derive(Default)]
+pub(crate) enum Seat {
+ #[expect(clippy::enum_variant_names)]
+ /// Resource is not resident.
+ ///
+ /// All objects start with a seat in the `Seat::NoSeat` state. The seat also
+ /// gets back to that state if the user requests eviction. It
+ /// can also end up in that state next time an operation is done
+ /// on a `Seat::Idle` seat and the slot manager finds out this
+ /// object has been evicted from the slot.
+ #[default]
+ NoSeat,
+
+ /// Resource is actively used and resident.
+ ///
+ /// When a seat is in the `Seat::Active` state, it can't be evicted, and the
+ /// slot pointed to by `SeatInfo::slot` is guaranteed to be reserved
+ /// for this object as long as the seat stays active.
+ Active(SeatInfo),
+
+ /// Resource is idle and might or might not be resident.
+ ///
+ /// When a seat is in the`Seat::Idle` state, we can't know for sure if the
+ /// object is resident or evicted until the next request we issue
+ /// to the slot manager. This tells the slot manager it can
+ /// reclaim the underlying slot if needed.
+ /// In order for the hardware to use this object again, the seat
+ /// needs to be turned into an `Seat::Active` state again
+ /// with a `SlotManager::activate()` call.
+ Idle(SeatInfo),
+}
+
+impl Seat {
+ /// Get the slot index this seat is pointing to.
+ ///
+ /// If the seat is not `Seat::Active` we can't trust the
+ /// `SeatInfo`. In that case `None` is returned, otherwise
+ /// `Some(SeatInfo::slot)` is returned.
+ pub(super) fn slot(&self) -> Option<u8> {
+ match self {
+ Self::Active(info) => Some(info.slot),
+ _ => None,
+ }
+ }
+}
+
+/// Information related to a slot.
+struct SlotInfo<T> {
+ /// Type specific data attached to a slot.
+ slot_data: T,
+
+ /// Sequence number from when this slot was last activated.
+ seqno: u64,
+}
+
+/// Slot state.
+#[derive(Default)]
+enum SlotState<T> {
+ /// Slot is free.
+ #[default]
+ Free,
+
+ /// Slot is active.
+ Active(SlotInfo<T>),
+
+ /// Slot is idle.
+ Idle(SlotInfo<T>),
+}
+
+/// Trait describing the slot-related operations.
+pub(crate) trait SlotOperations {
+ /// Implementation-specific data associated with each slot.
+ type SlotData;
+
+ /// Called when a slot is being activated for a seat.
+ fn activate(&mut self, _slot_idx: usize, _slot_data: &Self::SlotData) -> Result {
+ Ok(())
+ }
+
+ /// Called when a slot is being evicted and freed.
+ fn evict(&mut self, _slot_idx: usize, _slot_data: &Self::SlotData) -> Result {
+ Ok(())
+ }
+}
+
+/// A generic slot manager that provides access to a limited number of hardware slots.
+pub(crate) struct SlotManager<T: SlotOperations, const MAX_SLOTS: usize> {
+ /// A specific implementation of the generic slot manager.
+ manager: T,
+
+ /// Number of slots actually available.
+ slot_count: usize,
+
+ /// Slot array used to track the state of each slot.
+ slots: [SlotState<T::SlotData>; MAX_SLOTS],
+
+ /// Sequence number incremented each time a Seat is successfully activated
+ use_seqno: u64,
+}
+
+pub(crate) type LockedSeat<T, const MAX_SLOTS: usize> = LockedBy<Seat, SlotManager<T, MAX_SLOTS>>;
+
+impl<T: SlotOperations, const MAX_SLOTS: usize> SlotManager<T, MAX_SLOTS> {
+ /// Creates a specific instance of a slot manager.
+ pub(crate) fn new(manager: T, slot_count: usize) -> Result<Self> {
+ if slot_count == 0 {
+ pr_err!("Invalid slot count: 0");
+ return Err(EINVAL);
+ }
+ if slot_count > MAX_SLOTS {
+ pr_err!(
+ "Slot count: {} cannot exceed MAX_SLOTS: {}",
+ slot_count,
+ MAX_SLOTS
+ );
+ return Err(EINVAL);
+ }
+ Ok(Self {
+ manager,
+ slot_count,
+ slots: [const { SlotState::Free }; MAX_SLOTS],
+ use_seqno: 1,
+ })
+ }
+
+ /// Records a slot as active for the given seat.
+ fn record_active_slot(
+ &mut self,
+ slot_idx: usize,
+ locked_seat: &LockedSeat<T, MAX_SLOTS>,
+ slot_data: T::SlotData,
+ ) -> Result {
+ let cur_seqno = self.use_seqno;
+
+ *locked_seat.access_mut(self) = Seat::Active(SeatInfo {
+ slot: slot_idx as u8,
+ seqno: cur_seqno,
+ });
+
+ self.slots[slot_idx] = SlotState::Active(SlotInfo {
+ slot_data,
+ seqno: cur_seqno,
+ });
+
+ self.use_seqno += 1;
+ Ok(())
+ }
+
+ /// Activates a slot for the given seat.
+ fn activate_slot(
+ &mut self,
+ slot_idx: usize,
+ locked_seat: &LockedSeat<T, MAX_SLOTS>,
+ slot_data: T::SlotData,
+ ) -> Result {
+ self.manager.activate(slot_idx, &slot_data)?;
+ self.record_active_slot(slot_idx, locked_seat, slot_data)
+ }
+
+ /// Finds a slot for the given seat. A free slot is preferred, but if none
+ /// are available, the oldest idle slot is evicted and reused. Otherwise, if
+ /// there are no free or idle slots, return [`EBUSY`].
+ fn allocate_slot(
+ &mut self,
+ locked_seat: &LockedSeat<T, MAX_SLOTS>,
+ slot_data: T::SlotData,
+ ) -> Result {
+ let slots = &self.slots[..self.slot_count];
+
+ let mut idle_slot_idx = None;
+ let mut idle_slot_seqno: u64 = 0;
+
+ for (slot_idx, slot) in slots.iter().enumerate() {
+ match slot {
+ SlotState::Free => {
+ return self.activate_slot(slot_idx, locked_seat, slot_data);
+ }
+ SlotState::Idle(slot_info) => {
+ if idle_slot_idx.is_none() || slot_info.seqno < idle_slot_seqno {
+ idle_slot_idx = Some(slot_idx);
+ idle_slot_seqno = slot_info.seqno;
+ }
+ }
+ SlotState::Active(_) => (),
+ }
+ }
+
+ match idle_slot_idx {
+ Some(slot_idx) => {
+ // Lazily evict idle slot just before it is reused.
+ if let SlotState::Idle(slot_info) = &self.slots[slot_idx] {
+ self.manager.evict(slot_idx, &slot_info.slot_data)?;
+ }
+ self.activate_slot(slot_idx, locked_seat, slot_data)
+ }
+ None => Err(EBUSY),
+ }
+ }
+
+ /// Converts an active slot and its seat to idle state.
+ fn idle_slot(&mut self, slot_idx: usize, locked_seat: &LockedSeat<T, MAX_SLOTS>) -> Result {
+ let slot = take(&mut self.slots[slot_idx]);
+
+ // If the slot was active, make it idle.
+ if let SlotState::Active(slot_info) = slot {
+ self.slots[slot_idx] = SlotState::Idle(slot_info);
+ }
+
+ // If the seat was active, make it idle, or keep it idle if it was already idle.
+ *locked_seat.access_mut(self) = match locked_seat.access(self) {
+ Seat::Active(seat_info) | Seat::Idle(seat_info) => Seat::Idle(SeatInfo {
+ slot: seat_info.slot,
+ seqno: seat_info.seqno,
+ }),
+ Seat::NoSeat => Seat::NoSeat,
+ };
+ Ok(())
+ }
+
+ /// Evicts an active or idle slot: calls the eviction callback and marks the slot as free
+ /// and the seat as NoSeat.
+ fn evict_slot(&mut self, slot_idx: usize, locked_seat: &LockedSeat<T, MAX_SLOTS>) -> Result {
+ match &self.slots[slot_idx] {
+ SlotState::Active(slot_info) | SlotState::Idle(slot_info) => {
+ self.manager.evict(slot_idx, &slot_info.slot_data)?;
+ take(&mut self.slots[slot_idx]);
+ }
+ _ => (),
+ }
+
+ *locked_seat.access_mut(self) = Seat::NoSeat;
+ Ok(())
+ }
+
+ /// Checks that the seat state matches the slot's state.
+ /// If they don't match, the seat is stale and is reset to `NoSeat`.
+ fn check_seat(&mut self, locked_seat: &LockedSeat<T, MAX_SLOTS>) {
+ let (slot_idx, seat_seqno, is_active) = match locked_seat.access(self) {
+ Seat::Active(seat_info) => (seat_info.slot as usize, seat_info.seqno, true),
+ Seat::Idle(seat_info) => (seat_info.slot as usize, seat_info.seqno, false),
+ _ => return,
+ };
+
+ let valid = if is_active {
+ !kernel::warn_on!(!matches!(
+ &self.slots[slot_idx],
+ SlotState::Active(slot_info) if slot_info.seqno == seat_seqno
+ ))
+ } else {
+ matches!(
+ &self.slots[slot_idx],
+ SlotState::Idle(slot_info) if slot_info.seqno == seat_seqno
+ )
+ };
+
+ if !valid {
+ *locked_seat.access_mut(self) = Seat::NoSeat;
+ }
+ }
+
+ /// Activate a resource on any available/reclaimable slot.
+ pub(crate) fn activate(
+ &mut self,
+ locked_seat: &LockedSeat<T, MAX_SLOTS>,
+ slot_data: T::SlotData,
+ ) -> Result {
+ self.check_seat(locked_seat);
+ match locked_seat.access(self) {
+ // If a seat still has a valid slot, just reuse the slot and refresh the bookkeeping.
+ Seat::Active(seat_info) | Seat::Idle(seat_info) => {
+ self.record_active_slot(seat_info.slot as usize, locked_seat, slot_data)
+ }
+ _ => self.allocate_slot(locked_seat, slot_data),
+ }
+ }
+
+ /// Flag a resource as idle. This method will be used for user VM support.
+ #[expect(dead_code)]
+ pub(crate) fn idle(&mut self, locked_seat: &LockedSeat<T, MAX_SLOTS>) -> Result {
+ self.check_seat(locked_seat);
+ if let Seat::Active(seat_info) = locked_seat.access(self) {
+ self.idle_slot(seat_info.slot as usize, locked_seat)?;
+ }
+ Ok(())
+ }
+
+ /// Evict a resource from its slot.
+ pub(crate) fn evict(&mut self, locked_seat: &LockedSeat<T, MAX_SLOTS>) -> Result {
+ self.check_seat(locked_seat);
+
+ match locked_seat.access(self) {
+ Seat::Active(seat_info) | Seat::Idle(seat_info) => {
+ let slot_idx = seat_info.slot as usize;
+ self.evict_slot(slot_idx, locked_seat)?;
+ }
+ _ => (),
+ }
+
+ Ok(())
+ }
+}
+
+impl<T: SlotOperations, const MAX_SLOTS: usize> Deref for SlotManager<T, MAX_SLOTS> {
+ type Target = T;
+
+ fn deref(&self) -> &Self::Target {
+ &self.manager
+ }
+}
+
+impl<T: SlotOperations, const MAX_SLOTS: usize> DerefMut for SlotManager<T, MAX_SLOTS> {
+ fn deref_mut(&mut self) -> &mut Self::Target {
+ &mut self.manager
+ }
+}
diff --git a/drivers/gpu/drm/tyr/tyr.rs b/drivers/gpu/drm/tyr/tyr.rs
index 95cda7b0962f..7c9a8063b3b9 100644
--- a/drivers/gpu/drm/tyr/tyr.rs
+++ b/drivers/gpu/drm/tyr/tyr.rs
@@ -12,6 +12,7 @@
mod gem;
mod gpu;
mod regs;
+mod slot;
kernel::module_platform_driver! {
type: TyrPlatformDriver,
--
2.54.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [PATCH v7 2/7] drm/tyr: add a generic slot manager
2026-07-14 3:18 ` [PATCH v7 2/7] drm/tyr: add a generic slot manager Deborah Brouwer
@ 2026-07-14 3:26 ` sashiko-bot
0 siblings, 0 replies; 14+ messages in thread
From: sashiko-bot @ 2026-07-14 3:26 UTC (permalink / raw)
To: Deborah Brouwer; +Cc: dri-devel, ojeda
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] Hardware and software slot states diverge when `manager.activate()` fails after a successful lazy eviction.
- [Medium] Truncation of `slot_idx` to `u8` causes permanent leakage of hardware slots when `MAX_SLOTS > 256`.
- [Medium] Re-activating an already valid seat with new `slot_data` updates the software tracking but fails to reprogram the hardware, leading to mismatched eviction.
--
--- Patch [2]: [PATCH v7 2/7] drm/tyr: add a generic slot manager ---
commit aac93e6de5af8d0538293cb60a9c909446516880
Author: Boris Brezillon <boris.brezillon@collabora.com>
drm/tyr: add a generic slot manager
Introduce a generic slot manager to dynamically allocate limited hardware
slots to software "seats". It can be used for both address space (AS) and
command stream group (CSG) slots.
The slot manager initially assigns seats to its free slots. It will
continue to reuse the same slot for a seat, as long as another seat does
not start to use the slot in the interim.
When contention arises because all of the slots are allocated, the slot
manager will lazily evict and reuse slots that have become idle (if any).
The seat state is protected using the LockedBy pattern with the same lock
that guards the SlotManager. This ensures the seat state stays consistent
across slot operations.
Hardware specific behaviour is controlled through the SlotManager's
specific manager type that implements the `SlotOperations` trait.
> diff --git a/drivers/gpu/drm/tyr/slot.rs b/drivers/gpu/drm/tyr/slot.rs
> new file mode 100644
> index 0000000000000..5c266fcf30eab
> --- /dev/null
> +++ b/drivers/gpu/drm/tyr/slot.rs
> @@ -0,0 +1,378 @@
[ ... ]
> +pub(crate) struct SeatInfo {
> + /// Slot used by this seat.
> + ///
> + /// This index is only valid if the slot pointed to by this index
> + /// has its `SlotInfo::seqno` match `SeatInfo::seqno`. Otherwise,
> + /// it means the object has been evicted from the hardware slot,
> + /// and a new slot needs to be acquired to make this object
> + /// resident again.
> + slot: u8,
> +
> + /// Sequence number encoding the last time this seat was active.
> + /// We also use it to check if a slot is still bound to a seat.
> + seqno: u64,
> +}
[ ... ]
> +impl<T: SlotOperations, const MAX_SLOTS: usize> SlotManager<T, MAX_SLOTS> {
> + /// Creates a specific instance of a slot manager.
> + pub(crate) fn new(manager: T, slot_count: usize) -> Result<Self> {
> + if slot_count == 0 {
> + pr_err!("Invalid slot count: 0");
> + return Err(EINVAL);
> + }
> + if slot_count > MAX_SLOTS {
> + pr_err!(
> + "Slot count: {} cannot exceed MAX_SLOTS: {}",
> + slot_count,
> + MAX_SLOTS
> + );
> + return Err(EINVAL);
> + }
> + Ok(Self {
> + manager,
> + slot_count,
> + slots: [const { SlotState::Free }; MAX_SLOTS],
> + use_seqno: 1,
> + })
> + }
> +
> + /// Records a slot as active for the given seat.
> + fn record_active_slot(
> + &mut self,
> + slot_idx: usize,
> + locked_seat: &LockedSeat<T, MAX_SLOTS>,
> + slot_data: T::SlotData,
> + ) -> Result {
> + let cur_seqno = self.use_seqno;
> +
> + *locked_seat.access_mut(self) = Seat::Active(SeatInfo {
> + slot: slot_idx as u8,
[Severity: Medium]
Since the SlotManager::new() constructor accepts any usize for slot_count,
what happens if a driver instantiates this generic manager with > 256 slots?
In SeatInfo, the slot is stored as a u8:
slot: u8,
When record_active_slot() assigns a slot, it unconditionally casts the index:
slot: slot_idx as u8,
If an index >= 256 is used, wouldn't it silently truncate? During subsequent
operations, check_seat() would read the truncated index, fail the sequence
number validation against the wrong slot, and forcefully transition the seat
to NoSeat. Would the actual high-index hardware slot remain stuck in
SlotState::Active forever, causing a resource leak?
> + seqno: cur_seqno,
> + });
> +
> + self.slots[slot_idx] = SlotState::Active(SlotInfo {
> + slot_data,
> + seqno: cur_seqno,
> + });
> +
> + self.use_seqno += 1;
> + Ok(())
> + }
[ ... ]
> + /// Finds a slot for the given seat. A free slot is preferred, but if none
> + /// are available, the oldest idle slot is evicted and reused. Otherwise, if
> + /// there are no free or idle slots, return [`EBUSY`].
> + fn allocate_slot(
> + &mut self,
> + locked_seat: &LockedSeat<T, MAX_SLOTS>,
> + slot_data: T::SlotData,
> + ) -> Result {
> + let slots = &self.slots[..self.slot_count];
> +
> + let mut idle_slot_idx = None;
> + let mut idle_slot_seqno: u64 = 0;
> +
> + for (slot_idx, slot) in slots.iter().enumerate() {
> + match slot {
> + SlotState::Free => {
> + return self.activate_slot(slot_idx, locked_seat, slot_data);
> + }
> + SlotState::Idle(slot_info) => {
> + if idle_slot_idx.is_none() || slot_info.seqno < idle_slot_seqno {
> + idle_slot_idx = Some(slot_idx);
> + idle_slot_seqno = slot_info.seqno;
> + }
> + }
> + SlotState::Active(_) => (),
> + }
> + }
> +
> + match idle_slot_idx {
> + Some(slot_idx) => {
> + // Lazily evict idle slot just before it is reused.
> + if let SlotState::Idle(slot_info) = &self.slots[slot_idx] {
> + self.manager.evict(slot_idx, &slot_info.slot_data)?;
> + }
> + self.activate_slot(slot_idx, locked_seat, slot_data)
[Severity: High]
What happens to the software state if self.manager.evict() succeeds, but
self.activate_slot() fails (e.g. due to a hardware timeout)?
If self.activate_slot() returns an error, the function returns early.
Crucially, the software state in self.slots[slot_idx] is not cleared to
SlotState::Free and remains SlotState::Idle(old_slot_info).
When the previous owner of that slot later calls activate(), won't
check_seat() see matching sequence numbers and leave the seat valid?
Could the seat then seamlessly transition to Active without calling
manager.activate(), resulting in the software thinking it is active while
the hardware is actually evicted?
> + }
> + None => Err(EBUSY),
> + }
> + }
[ ... ]
> + /// Activate a resource on any available/reclaimable slot.
> + pub(crate) fn activate(
> + &mut self,
> + locked_seat: &LockedSeat<T, MAX_SLOTS>,
> + slot_data: T::SlotData,
> + ) -> Result {
> + self.check_seat(locked_seat);
> + match locked_seat.access(self) {
> + // If a seat still has a valid slot, just reuse the slot and refresh the bookkeeping.
> + Seat::Active(seat_info) | Seat::Idle(seat_info) => {
> + self.record_active_slot(seat_info.slot as usize, locked_seat, slot_data)
[Severity: Medium]
Can slot_data change between activations of the same seat?
If a seat is already Active or Idle, activate() calls record_active_slot()
directly. This updates the software tracking in self.slots[slot_idx] with
the newly provided slot_data, but skips calling self.manager.activate().
If the new slot_data differs from the data originally used to program the
hardware, won't the hardware continue operating with the old configuration?
Furthermore, when the slot is eventually evicted, would self.manager.evict()
be invoked with the newly updated slot_data, potentially passing incorrect
parameters to the hardware unprogramming routine?
> + }
> + _ => self.allocate_slot(locked_seat, slot_data),
> + }
> + }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-fw-boot-b4-v7-0-afd8dc1494dd@collabora.com?part=2
^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH v7 3/7] drm/tyr: add Memory Management Unit (MMU) support
2026-07-14 3:18 [PATCH v7 0/7] drm/tyr: firmware loading and MCU boot support Deborah Brouwer
2026-07-14 3:18 ` [PATCH v7 1/7] drm/tyr: add resources to RegistrationData Deborah Brouwer
2026-07-14 3:18 ` [PATCH v7 2/7] drm/tyr: add a generic slot manager Deborah Brouwer
@ 2026-07-14 3:18 ` Deborah Brouwer
2026-07-14 3:30 ` sashiko-bot
2026-07-14 3:18 ` [PATCH v7 4/7] drm/tyr: add GPU virtual memory (VM) support Deborah Brouwer
` (3 subsequent siblings)
6 siblings, 1 reply; 14+ messages in thread
From: Deborah Brouwer @ 2026-07-14 3:18 UTC (permalink / raw)
To: Daniel Almeida, Alice Ryhl, Danilo Krummrich, David Airlie,
Simona Vetter, Benno Lossin, Gary Guo
Cc: dri-devel, linux-kernel, rust-for-linux, Deborah Brouwer,
boris.brezillon, samitolvanen, work, acourbot, lyude, laura.nao,
beata.michalska, alvin.sun, steven.price
From: Boris Brezillon <boris.brezillon@collabora.com>
Add Memory Management Unit (MMU) support in Tyr. The MMU module wraps a
SlotManager instance to allocate MMU address-space slots for use by
virtual memory (VM) address spaces. The MMU's SlotManager uses an
AddressSpaceManager to handle the hardware-specific callbacks. For
example, the AddressSpaceManager activates and evicts VMs from slots by
writing commands to the MMU registers.
Add an implementation block for the MMU's MEMATTR register to provide
a method for translating the Memory Attribute Indirection Register (MAIR)
format from the pagetable configuration to a format understood by the MMU.
Create an mmu instance during probe, it will be used by subsequent patches
in this series.
Wrap the iomem stored in TyrDrmRegistrationData in an Arc. The iomem
is stored in the mmu through its AddressSpaceManager. In anticipation
of the iomem also being stored in the firmware object, set up shared
ownership of the iomem now.
Update Kconfig to add the new MMU and IOMMU dependencies required
by this MMU module.
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Co-developed-by: Deborah Brouwer <deborah.brouwer@collabora.com>
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
drivers/gpu/drm/tyr/Kconfig | 3 +
drivers/gpu/drm/tyr/driver.rs | 13 +-
drivers/gpu/drm/tyr/mmu.rs | 103 +++++++
drivers/gpu/drm/tyr/mmu/address_space.rs | 490 +++++++++++++++++++++++++++++++
drivers/gpu/drm/tyr/regs.rs | 123 +++++++-
drivers/gpu/drm/tyr/slot.rs | 1 -
drivers/gpu/drm/tyr/tyr.rs | 1 +
7 files changed, 729 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/tyr/Kconfig b/drivers/gpu/drm/tyr/Kconfig
index 51a68ef8212c..61a2fd6f961a 100644
--- a/drivers/gpu/drm/tyr/Kconfig
+++ b/drivers/gpu/drm/tyr/Kconfig
@@ -5,9 +5,12 @@ config DRM_TYR
depends on DRM=y
depends on RUST
depends on ARM || ARM64 || COMPILE_TEST
+ depends on MMU
depends on !GENERIC_ATOMIC64 # for IOMMU_IO_PGTABLE_LPAE
depends on COMMON_CLK
+ depends on IOMMU_SUPPORT
default n
+ select IOMMU_IO_PGTABLE_LPAE
select RUST_DRM_GEM_SHMEM_HELPER
help
Rust DRM driver for ARM Mali CSF-based GPUs.
diff --git a/drivers/gpu/drm/tyr/driver.rs b/drivers/gpu/drm/tyr/driver.rs
index 46ce5c41e310..74b55a389754 100644
--- a/drivers/gpu/drm/tyr/driver.rs
+++ b/drivers/gpu/drm/tyr/driver.rs
@@ -28,7 +28,10 @@
regulator,
regulator::Regulator,
sizes::SZ_2M,
- sync::Mutex,
+ sync::{
+ Arc,
+ Mutex, //
+ },
time, //
};
@@ -37,6 +40,7 @@
gem::BoData,
gpu,
gpu::GpuInfo,
+ mmu::Mmu,
regs::gpu_control::*, //
};
@@ -70,7 +74,7 @@ pub(crate) struct TyrDrmRegistrationData<'bound> {
regulators: Mutex<Regulators>,
/// GPU MMIO register mapping.
- pub(crate) iomem: IoMem<'bound>,
+ pub(crate) iomem: Arc<IoMem<'bound>>,
/// GPU information read from hardware during probe.
pub(crate) gpu_info: GpuInfo,
@@ -121,7 +125,8 @@ fn probe<'bound>(
let sram_regulator = Regulator::<regulator::Enabled>::get(pdev.as_ref(), c"sram")?;
let request = pdev.io_request_by_index(0).ok_or(ENODEV)?;
- let iomem = request.iomap_sized::<SZ_2M>()?;
+
+ let iomem = Arc::new(request.iomap_sized::<SZ_2M>()?, GFP_KERNEL)?;
issue_soft_reset(pdev.as_ref(), &iomem)?;
gpu::l2_power_on(pdev.as_ref(), &iomem)?;
@@ -139,6 +144,8 @@ fn probe<'bound>(
let unreg_dev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, Ok(()))?;
+ let _mmu = Mmu::new(iomem.as_arc_borrow(), &gpu_info)?;
+
let reg_data = try_pin_init!(TyrDrmRegistrationData {
pdev,
clks <- new_mutex!(Clocks {
diff --git a/drivers/gpu/drm/tyr/mmu.rs b/drivers/gpu/drm/tyr/mmu.rs
new file mode 100644
index 000000000000..beae87c816e5
--- /dev/null
+++ b/drivers/gpu/drm/tyr/mmu.rs
@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: GPL-2.0 or MIT
+
+//! Memory Management Unit (MMU) module.
+//!
+//! The GPU MMU provides a limited number of memory address spaces for use by command streams.
+//! The MMU translates virtual addresses to physical addresses and manages memory configuration
+//! and access permissions.
+//!
+//! This MMU module is essentially a locked wrapper around a [`SlotManager`] instance.
+//! The [`SlotManager`] manages the assignment of virtual address spaces to hardware address-space
+//! (AS) slots. MMU commands such as updates and flushes are carried out by the
+//! [`AddressSpaceManager`] which actually writes to the MMU registers.
+#![expect(dead_code)]
+
+use core::ops::Range;
+
+use kernel::{
+ new_mutex,
+ prelude::*,
+ sync::{
+ Arc,
+ ArcBorrow,
+ Mutex, //
+ }, //
+};
+
+use crate::{
+ driver::IoMem,
+ gpu::GpuInfo,
+ mmu::address_space::{
+ AddressSpaceManager,
+ VmAsData, //
+ },
+ regs::{
+ gpu_control::AS_PRESENT,
+ MAX_AS, //
+ },
+ slot::SlotManager, //
+};
+
+pub(crate) mod address_space;
+
+pub(crate) type AsSlotManager<'bound> = SlotManager<AddressSpaceManager<'bound>, MAX_AS>;
+
+/// Locked wrapper for carrying out virtual memory (VM) operations on the MMU.
+#[pin_data]
+pub(crate) struct Mmu<'bound> {
+ /// Slot Manager instance used to allocate hardware slots and write to MMU registers.
+ #[pin]
+ pub(crate) as_manager: Mutex<AsSlotManager<'bound>>,
+}
+
+impl<'bound> Mmu<'bound> {
+ /// Create an MMU component for this device.
+ pub(crate) fn new(
+ iomem: ArcBorrow<'_, IoMem<'bound>>,
+ gpu_info: &GpuInfo,
+ ) -> Result<Arc<Mmu<'bound>>> {
+ let present = AS_PRESENT::from_raw(gpu_info.as_present).present().get();
+ let slot_count = present.count_ones().try_into()?;
+
+ let as_manager = AddressSpaceManager::new(iomem.into(), present)?;
+ let mmu_init = try_pin_init!(Self{
+ as_manager <- new_mutex!(SlotManager::new(as_manager, slot_count)?),
+ });
+ Arc::pin_init(mmu_init, GFP_KERNEL)
+ }
+
+ /// Assign a VM to an AS slot, provide a translation table,
+ /// and update the MMU to make the VM resident.
+ pub(crate) fn activate_vm(&self, vm: ArcBorrow<'_, VmAsData<'bound>>) -> Result {
+ self.as_manager.lock().activate_vm(vm)
+ }
+
+ /// Evict a VM from its AS slot and flush the MMU.
+ pub(crate) fn deactivate_vm(&self, vm: &VmAsData<'bound>) -> Result {
+ self.as_manager.lock().deactivate_vm(vm)
+ }
+
+ /// Flush MMU translation caches after a VM update.
+ pub(crate) fn flush_vm(&self, vm: &VmAsData<'bound>) -> Result {
+ self.as_manager.lock().flush_vm(vm)
+ }
+
+ /// Flags the start of a VM update.
+ ///
+ /// If the VM is resident, any GPU access on the memory range being
+ /// updated will be blocked until `Mmu::end_vm_update()` is called.
+ /// This guarantees the atomicity of a VM update.
+ /// If the VM is not resident, this is a NOP.
+ pub(crate) fn start_vm_update(&self, vm: &VmAsData<'bound>, region: &Range<u64>) -> Result {
+ self.as_manager.lock().start_vm_update(vm, region)
+ }
+
+ /// Flags the end of a VM update.
+ ///
+ /// If the VM is resident, this will let GPU accesses on the updated
+ /// range go through, in case any of them were blocked.
+ /// If the VM is not resident, this is a NOP.
+ pub(crate) fn end_vm_update(&self, vm: &VmAsData<'bound>) -> Result {
+ self.as_manager.lock().end_vm_update(vm)
+ }
+}
diff --git a/drivers/gpu/drm/tyr/mmu/address_space.rs b/drivers/gpu/drm/tyr/mmu/address_space.rs
new file mode 100644
index 000000000000..20dca96f4a1e
--- /dev/null
+++ b/drivers/gpu/drm/tyr/mmu/address_space.rs
@@ -0,0 +1,490 @@
+// SPDX-License-Identifier: GPL-2.0 or MIT
+
+//! Address space module.
+//!
+//! This module handles the hardware interaction for MMU operations through
+//! MMIO register access.
+//!
+
+use core::ops::Range;
+
+use kernel::{
+ device::{
+ Bound,
+ Device, //
+ }, //
+ error::Result,
+ io::{
+ poll,
+ register::Array,
+ Io, //
+ },
+ iommu::pgtable::{
+ Config,
+ IoPageTable,
+ ARM64LPAES1, //
+ },
+ prelude::*,
+ sizes::{
+ SZ_2M,
+ SZ_4K, //
+ },
+ sync::{
+ Arc,
+ ArcBorrow,
+ LockedBy, //
+ },
+ time::Delta, //
+};
+
+use crate::{
+ driver::IoMem,
+ mmu::{
+ AsSlotManager,
+ Mmu, //
+ },
+ regs::{
+ mmu_control::mmu_as_control,
+ mmu_control::mmu_as_control::*,
+ MAX_AS, //
+ },
+ slot::{
+ LockedSeat,
+ Seat,
+ SlotOperations, //
+ }, //
+};
+
+/// Address space configuration values to be written to MMU registers.
+#[derive(Clone, Copy)]
+struct AddressSpaceConfig {
+ /// Translation configuration. Configures how the MMU walks the page table for this
+ /// address space.
+ transcfg: u64,
+
+ /// Translation table base address. The address of the page table.
+ transtab: u64,
+
+ /// Memory attributes such as cacheability.
+ memattr: u64,
+}
+
+/// Virtual memory (VM) address space data for use in MMU operations.
+#[pin_data]
+pub(crate) struct VmAsData<'bound> {
+ /// This address-space seat tracks this VM's binding to a hardware address space slot.
+ /// It can only be accessed when holding the `Mmu::as_manager` lock.
+ as_seat: LockedSeat<AddressSpaceManager<'bound>, MAX_AS>,
+
+ /// Virtual address bits for this address space.
+ va_bits: u8,
+
+ /// The page table which maps GPU virtual addresses to physical addresses for this VM.
+ #[pin]
+ pub(crate) page_table: IoPageTable<'bound, ARM64LPAES1>,
+}
+
+impl<'bound> VmAsData<'bound> {
+ /// Creates VM address space data by initializing all of its fields.
+ pub(crate) fn new<'a>(
+ mmu: &'a Mmu<'bound>,
+ pdev: &'bound Device<Bound>,
+ va_bits: u32,
+ pa_bits: u32,
+ ) -> impl pin_init::PinInit<VmAsData<'bound>, Error> + 'a {
+ let pt_config = Config {
+ quirks: 0,
+ pgsize_bitmap: SZ_4K | SZ_2M,
+ ias: va_bits,
+ oas: pa_bits,
+ coherent_walk: false,
+ };
+
+ let page_table_init = IoPageTable::new(pdev, pt_config);
+
+ try_pin_init!(Self {
+ as_seat: LockedBy::new(&mmu.as_manager, Seat::NoSeat),
+ va_bits: va_bits as u8,
+ page_table <- page_table_init,
+ }? Error)
+ }
+
+ /// Computes the hardware configuration for this address space.
+ fn as_config(&self) -> Result<AddressSpaceConfig> {
+ let pt = &self.page_table;
+ // The hardware computes the valid input address range as:
+ // INA_BITS_VALID = min(HW_INA_BITS, 55 - INA_BITS)
+ // To configure our desired va_bits, we solve for INA_BITS:
+ // INA_BITS = 55 - va_bits
+ // This assumes HW_INA_BITS (hardware capability) >= va_bits.
+ let ina_bits_field_value = 55 - self.va_bits;
+ let ina_bits = match ina_bits_field_value {
+ 7 => mmu_as_control::InaBits::Bits48,
+ 8 => mmu_as_control::InaBits::Bits47,
+ 9 => mmu_as_control::InaBits::Bits46,
+ 10 => mmu_as_control::InaBits::Bits45,
+ 11 => mmu_as_control::InaBits::Bits44,
+ 12 => mmu_as_control::InaBits::Bits43,
+ 13 => mmu_as_control::InaBits::Bits42,
+ 14 => mmu_as_control::InaBits::Bits41,
+ 15 => mmu_as_control::InaBits::Bits40,
+ 16 => mmu_as_control::InaBits::Bits39,
+ 17 => mmu_as_control::InaBits::Bits38,
+ 18 => mmu_as_control::InaBits::Bits37,
+ 19 => mmu_as_control::InaBits::Bits36,
+ 20 => mmu_as_control::InaBits::Bits35,
+ 21 => mmu_as_control::InaBits::Bits34,
+ 22 => mmu_as_control::InaBits::Bits33,
+ 23 => mmu_as_control::InaBits::Bits32,
+ 24 => mmu_as_control::InaBits::Bits31,
+ 25 => mmu_as_control::InaBits::Bits30,
+ 26 => mmu_as_control::InaBits::Bits29,
+ 27 => mmu_as_control::InaBits::Bits28,
+ 28 => mmu_as_control::InaBits::Bits27,
+ 29 => mmu_as_control::InaBits::Bits26,
+ 30 => mmu_as_control::InaBits::Bits25,
+ _ => return Err(EINVAL),
+ };
+
+ let transcfg = mmu_as_control::TRANSCFG::zeroed()
+ .with_ptw_memattr(mmu_as_control::PtwMemattr::WriteBack)
+ .with_r_allocate(true)
+ .with_mode(mmu_as_control::AddressSpaceMode::Aarch64_4K)
+ .with_ina_bits(ina_bits)
+ .into_raw();
+
+ Ok(AddressSpaceConfig {
+ transcfg,
+ // SAFETY: The caller must ensure that the address space is evicted
+ // and cleaned up before the `VmAsData` is dropped.
+ transtab: unsafe { pt.ttbr() },
+ memattr: MEMATTR::from_mair(pt.mair()).into_raw(),
+ })
+ }
+}
+
+/// Coordinates all hardware-level address space operations through MMIO register
+/// operations including enabling, disabling, flushing, and updating address spaces.
+pub(crate) struct AddressSpaceManager<'bound> {
+ /// Memory-mapped I/O region for GPU register access.
+ iomem: Arc<IoMem<'bound>>,
+
+ /// Bitmask of present address space slots from GPU_AS_PRESENT register.
+ as_present: u32,
+}
+
+impl<'bound> AddressSpaceManager<'bound> {
+ /// Creates a new address space manager.
+ ///
+ /// Initializes the manager with references to the platform device and
+ /// I/O memory region, along with the bitmask of available AS slots.
+ pub(super) fn new(
+ iomem: Arc<IoMem<'bound>>,
+ as_present: u32,
+ ) -> Result<AddressSpaceManager<'bound>> {
+ Ok(Self { iomem, as_present })
+ }
+
+ /// Validates that an AS slot number is within range and present in hardware.
+ ///
+ /// Checks that the slot index is less than [`MAX_AS`] and that
+ /// the corresponding bit is set in the `as_present` mask read from the GPU.
+ ///
+ /// Returns [`EINVAL`] if the slot is out of range or not present in hardware.
+ fn validate_as_slot(&self, as_nr: usize) -> Result {
+ if as_nr >= MAX_AS {
+ pr_err!("AS slot {} out of valid range (max {})\n", as_nr, MAX_AS);
+ return Err(EINVAL);
+ }
+
+ if (self.as_present & (1 << as_nr)) == 0 {
+ pr_err!(
+ "AS slot {} not present in hardware (AS_PRESENT={:#x})\n",
+ as_nr,
+ self.as_present
+ );
+ return Err(EINVAL);
+ }
+
+ Ok(())
+ }
+
+ /// Waits for an AS slot to become ready (not active).
+ ///
+ /// Returns an error if polling times out after 10ms or if register access fails.
+ fn as_wait_ready(&self, as_nr: usize) -> Result {
+ let io = &*self.iomem;
+ let op = || {
+ let status_reg = STATUS::try_at(as_nr).ok_or(EINVAL)?;
+ Ok(io.read(status_reg))
+ };
+ let cond = |status: &STATUS| -> bool { !status.active_ext() };
+ poll::read_poll_timeout(op, cond, Delta::from_millis(0), Delta::from_millis(10))?;
+
+ Ok(())
+ }
+
+ /// Sends a command to an AS slot.
+ ///
+ /// Returns an error if waiting for ready times out or if register write fails.
+ fn as_send_cmd(&mut self, as_nr: usize, cmd: MmuCommand) -> Result {
+ self.as_wait_ready(as_nr)?;
+ let io = &*self.iomem;
+ let command_reg = COMMAND::try_at(as_nr).ok_or(EINVAL)?;
+ io.write(command_reg, COMMAND::zeroed().with_command(cmd));
+ Ok(())
+ }
+
+ /// Sends a command to an AS slot and waits for completion.
+ ///
+ /// Returns an error if sending the command fails or if waiting for completion times out.
+ fn as_send_cmd_and_wait(&mut self, as_nr: usize, cmd: MmuCommand) -> Result {
+ self.as_send_cmd(as_nr, cmd)?;
+ self.as_wait_ready(as_nr)?;
+ Ok(())
+ }
+
+ /// Enables an AS slot with the provided configuration.
+ ///
+ /// Returns an error if the slot is invalid or if register writes/commands fail.
+ fn as_enable(&mut self, as_nr: usize, as_config: &AddressSpaceConfig) -> Result {
+ self.validate_as_slot(as_nr)?;
+
+ let io = &*self.iomem;
+
+ let transtab = as_config.transtab;
+ io.write(
+ TRANSTAB_LO::try_at(as_nr).ok_or(EINVAL)?,
+ TRANSTAB_LO::from_raw(transtab as u32),
+ );
+ io.write(
+ TRANSTAB_HI::try_at(as_nr).ok_or(EINVAL)?,
+ TRANSTAB_HI::from_raw((transtab >> 32) as u32),
+ );
+
+ let transcfg = as_config.transcfg;
+ io.write(
+ TRANSCFG_LO::try_at(as_nr).ok_or(EINVAL)?,
+ TRANSCFG_LO::from_raw(transcfg as u32),
+ );
+ io.write(
+ TRANSCFG_HI::try_at(as_nr).ok_or(EINVAL)?,
+ TRANSCFG_HI::from_raw((transcfg >> 32) as u32),
+ );
+
+ let memattr = as_config.memattr;
+ io.write(
+ MEMATTR_LO::try_at(as_nr).ok_or(EINVAL)?,
+ MEMATTR_LO::from_raw(memattr as u32),
+ );
+ io.write(
+ MEMATTR_HI::try_at(as_nr).ok_or(EINVAL)?,
+ MEMATTR_HI::from_raw((memattr >> 32) as u32),
+ );
+
+ self.as_send_cmd_and_wait(as_nr, MmuCommand::Update)?;
+
+ Ok(())
+ }
+
+ /// Disables an AS slot and clears its configuration.
+ ///
+ /// Returns an error if the slot is invalid or if register writes/commands fail.
+ fn as_disable(&mut self, as_nr: usize) -> Result {
+ self.validate_as_slot(as_nr)?;
+
+ // Flush AS before disabling
+ self.as_send_cmd_and_wait(as_nr, MmuCommand::FlushMem)?;
+
+ let io = &*self.iomem;
+
+ io.write(
+ TRANSTAB_LO::try_at(as_nr).ok_or(EINVAL)?,
+ TRANSTAB_LO::from_raw(0),
+ );
+ io.write(
+ TRANSTAB_HI::try_at(as_nr).ok_or(EINVAL)?,
+ TRANSTAB_HI::from_raw(0),
+ );
+
+ io.write(
+ MEMATTR_LO::try_at(as_nr).ok_or(EINVAL)?,
+ MEMATTR_LO::from_raw(0),
+ );
+ io.write(
+ MEMATTR_HI::try_at(as_nr).ok_or(EINVAL)?,
+ MEMATTR_HI::from_raw(0),
+ );
+
+ let transcfg = TRANSCFG::zeroed()
+ .with_mode(AddressSpaceMode::Unmapped)
+ .into_raw();
+
+ io.write(
+ TRANSCFG_LO::try_at(as_nr).ok_or(EINVAL)?,
+ TRANSCFG_LO::from_raw(transcfg as u32),
+ );
+ io.write(
+ TRANSCFG_HI::try_at(as_nr).ok_or(EINVAL)?,
+ TRANSCFG_HI::from_raw((transcfg >> 32) as u32),
+ );
+
+ self.as_send_cmd_and_wait(as_nr, MmuCommand::Update)?;
+
+ Ok(())
+ }
+
+ /// Locks a region of the translation tables for an atomic update.
+ ///
+ /// Programs the MMU LOCKADDR register for the given address space and issues
+ /// the lock command. The hardware rounds the requested range up to a
+ /// power-of-two region aligned to its size.
+ ///
+ /// Returns an error if the slot is invalid or if register writes/commands fail.
+ fn as_start_update(&mut self, as_nr: usize, region: &Range<u64>) -> Result {
+ self.validate_as_slot(as_nr)?;
+
+ // The lock operates on full 64-byte cache lines of translation table entries.
+ // Since each translation table entry (TTE) is 8 bytes, a cache line has 8 TTEs.
+ // Since each TTE maps one page, the minimum locked region size will be 8 pages.
+ //
+ // With 4KiB pages (Aarch64_4K mode), the minimum locked region is 32KiB.
+ let lock_region_min_size: u64 = 4096 * 8;
+
+ // Count the number of trailing zero bits (zeros at the right/least-significant
+ // end of the binary representation). For a power-of-two value, this equals the
+ // base-2 exponent (e.g., 32 KiB = 2^15 → 15).
+ let lock_region_min_size_log2 = lock_region_min_size.trailing_zeros() as u8;
+
+ // XOR the first and last addresses to identify which bits differ between them.
+ // The highest set bit in the result determines the exponent of the smallest
+ // power-of-two region that can contain both addresses.
+ //
+ // Example:
+ // addr_xor = 0x1000 ^ 0x2FFF = 0x3FFF
+ // highest set bit in 0x3FFF is bit 13
+ // minimum region size = 2^(13 + 1) = 16 KiB
+ let addr_xor = region.start ^ (region.end - 1);
+ let region_size_log2 = 64 - addr_xor.leading_zeros() as u8;
+
+ let lock_region_log2 = core::cmp::max(region_size_log2, lock_region_min_size_log2);
+
+ // Align the LOCKADDR base address down to the lock region size (1 << lock_region_log2).
+ //
+ // The MMU ignores the low lock_region_log2 bits of LOCKADDR base, so ensure
+ // they are cleared in software to avoid ambiguity.
+ let lockaddr_base = region.start & !((1u64 << lock_region_log2) - 1);
+
+ // The LOCKADDR size field encodes the lock region size as log2(size) - 1,
+ // per the hardware definition. For example, a 32 KiB region is encoded as 14
+ // because log2(32 KiB) = 15.
+ let lockaddr_size = lock_region_log2 - 1;
+
+ let io = &*self.iomem;
+
+ // The LOCKADDR base field stores address bits 63:12, so remove the low 12 bits
+ // before passing this value to the register macro helper.
+ // These bits are guaranteed to be zero anyway because of the minimum
+ // size of the locked region.
+ let lockaddr_base_field = lockaddr_base >> 12;
+
+ let lockaddr_val = LOCKADDR::zeroed()
+ .try_with_size(lockaddr_size)?
+ .try_with_base(lockaddr_base_field)?
+ .into_raw();
+
+ io.write(
+ LOCKADDR_LO::try_at(as_nr).ok_or(EINVAL)?,
+ LOCKADDR_LO::from_raw(lockaddr_val as u32),
+ );
+ io.write(
+ LOCKADDR_HI::try_at(as_nr).ok_or(EINVAL)?,
+ LOCKADDR_HI::from_raw((lockaddr_val >> 32) as u32),
+ );
+
+ self.as_send_cmd(as_nr, MmuCommand::Lock)
+ }
+
+ /// Completes an atomic translation table update.
+ ///
+ /// Returns an error if the slot is invalid or if the flush command fails.
+ fn as_end_update(&mut self, as_nr: usize) -> Result {
+ self.validate_as_slot(as_nr)?;
+ self.as_send_cmd_and_wait(as_nr, MmuCommand::FlushPt)?;
+ Ok(())
+ }
+
+ /// Flushes the translation table cache for an AS slot.
+ ///
+ /// Returns an error if the slot is invalid or if the flush command fails.
+ fn as_flush(&mut self, as_nr: usize) -> Result {
+ self.validate_as_slot(as_nr)?;
+ self.as_send_cmd(as_nr, MmuCommand::FlushPt)
+ }
+}
+
+impl<'bound> SlotOperations for AddressSpaceManager<'bound> {
+ /// VM address space data associated with a hardware slot.
+ type SlotData = Arc<VmAsData<'bound>>;
+
+ /// Activates an address space in a hardware slot.
+ fn activate(&mut self, slot_idx: usize, slot_data: &Self::SlotData) -> Result {
+ let as_config = slot_data.as_config()?;
+ self.as_enable(slot_idx, &as_config)
+ }
+
+ /// Evicts an address space from a hardware slot.
+ fn evict(&mut self, slot_idx: usize, _slot_data: &Self::SlotData) -> Result {
+ self.as_flush(slot_idx)?;
+ self.as_disable(slot_idx)?;
+ Ok(())
+ }
+}
+
+impl<'bound> AsSlotManager<'bound> {
+ /// Locks a region for translation table updates if the VM has an active slot.
+ pub(super) fn start_vm_update(&mut self, vm: &VmAsData<'bound>, region: &Range<u64>) -> Result {
+ let seat = vm.as_seat.access(self);
+ match seat.slot() {
+ Some(slot) => {
+ let as_nr = slot as usize;
+ self.as_start_update(as_nr, region)
+ }
+ _ => Ok(()),
+ }
+ }
+
+ /// Completes translation table updates and unlocks the region.
+ pub(super) fn end_vm_update(&mut self, vm: &VmAsData<'bound>) -> Result {
+ let seat = vm.as_seat.access(self);
+ match seat.slot() {
+ Some(slot) => {
+ let as_nr = slot as usize;
+ self.as_end_update(as_nr)
+ }
+ _ => Ok(()),
+ }
+ }
+
+ /// Flushes the translation table cache if the VM has an active slot.
+ pub(super) fn flush_vm(&mut self, vm: &VmAsData<'bound>) -> Result {
+ let seat = vm.as_seat.access(self);
+ match seat.slot() {
+ Some(slot) => {
+ let as_nr = slot as usize;
+ self.as_flush(as_nr)
+ }
+ _ => Ok(()),
+ }
+ }
+
+ /// Activates a VM by assigning it to a hardware slot.
+ pub(super) fn activate_vm(&mut self, vm: ArcBorrow<'_, VmAsData<'bound>>) -> Result {
+ self.activate(&vm.as_seat, vm.into())
+ }
+
+ /// Deactivates a VM by evicting it from its hardware slot.
+ pub(super) fn deactivate_vm(&mut self, vm: &VmAsData<'bound>) -> Result {
+ self.evict(&vm.as_seat)
+ }
+}
diff --git a/drivers/gpu/drm/tyr/regs.rs b/drivers/gpu/drm/tyr/regs.rs
index 831357a8ef87..eae9213fb1c2 100644
--- a/drivers/gpu/drm/tyr/regs.rs
+++ b/drivers/gpu/drm/tyr/regs.rs
@@ -25,7 +25,7 @@
//
// Nevertheless, it is useful to have most of them defined, like the C driver
// does.
-#![allow(dead_code)]
+#![expect(dead_code)]
/// Combine two 32-bit values into a single 64-bit value.
pub(crate) fn join_u64(lo: u32, hi: u32) -> u64 {
@@ -45,6 +45,8 @@ pub(crate) fn read_u64_no_tearing(lo_read: impl Fn() -> u32, hi_read: impl Fn()
}
}
+pub(crate) use mmu_control::mmu_as_control::MAX_AS;
+
/// These registers correspond to the GPU_CONTROL register page.
/// They are involved in GPU configuration and control.
pub(crate) mod gpu_control {
@@ -965,6 +967,8 @@ pub(crate) mod mmu_as_control {
register, //
};
+ use pin_init::Zeroable;
+
/// Maximum number of hardware address space slots.
/// The actual number of slots available is usually lower.
pub(crate) const MAX_AS: usize = 16;
@@ -1158,7 +1162,124 @@ fn from(val: MMU_MEMATTR_STAGE1) -> Self {
pub(crate) MEMATTR_HI(u32)[MAX_AS, stride = STRIDE] @ 0x240c {
31:0 value;
}
+ }
+
+ impl MEMATTR {
+ ///
+ /// In the ARM Architecture Reference Manual, the MAIR encoding for Normal memory
+ /// uses the format `0bxxRW` where:
+ /// - `W` (bit 0) = Write-Allocate policy
+ /// - `R` (bit 1) = Read-Allocate policy
+ /// E.g., `0b0011` would allow both read and write allocation on a cache miss.
+ ///
+ /// ARM MAIR Write-Allocate bit (bit 0 of a cache policy nibble).
+ const ARM_MAIR_WRITE_ALLOCATE: u8 = 0x1;
+ /// ARM MAIR Read-Allocate bit (bit 1 of a cache policy nibble).
+ const ARM_MAIR_READ_ALLOCATE: u8 = 0x2;
+ /// ARM MAIR Write-back bit (bit 2 of a cache policy nibble).
+ const ARM_MAIR_WRITE_BACK: u8 = 0x4;
+ /// Mask for the inner cache policy nibble in MAIR attribute bytes.
+ const ARM_MAIR_INNER_MASK: u8 = 0x0f;
+
+ /// Check if a MAIR attribute byte represents device memory.
+ ///
+ /// Device memory (memory-mapped I/O, registers) cannot be cached and must
+ /// be mapped as GPU `NonCacheable`.
+ fn is_device_memory(mair_attr: u8) -> bool {
+ // In AArch64 MAIR, device memory has bits [1:0] of outer nibble = 0.
+ let outer = mair_attr >> 4;
+ (outer & 0x3) == 0
+ }
+
+ /// Check if normal memory is fully write-back cacheable.
+ ///
+ /// ARM MAIR has two cache policy levels (outer [7:4] and inner [3:0]).
+ /// For memory to be truly write-back, BOTH levels must have the write-back bit set.
+ /// If only one level is write-back, treat it as non-cacheable for GPU purposes.
+ fn is_writeback_cacheable(mair_attr: u8) -> bool {
+ let outer = mair_attr >> 4;
+ let inner = mair_attr & Self::ARM_MAIR_INNER_MASK;
+
+ (outer & Self::ARM_MAIR_WRITE_BACK) != 0 && (inner & Self::ARM_MAIR_WRITE_BACK) != 0
+ }
+
+ // Helper to encode a MEMATTR attribute from its individual fields.
+ fn encode_attribute(
+ alloc_w: bool,
+ alloc_r: bool,
+ alloc_sel: AllocPolicySelect,
+ coherency: Coherency,
+ memory_type: MemoryType,
+ ) -> MMU_MEMATTR_STAGE1 {
+ MMU_MEMATTR_STAGE1::zeroed()
+ .with_alloc_w(alloc_w)
+ .with_alloc_r(alloc_r)
+ .with_alloc_sel(alloc_sel)
+ .with_coherency(coherency)
+ .with_memory_type(memory_type)
+ }
+
+ /// Convert one MAIR attribute byte into a MEMATTR attribute.
+ // TODO: Add a `coherent` parameter like panthor's mair_to_memattr().
+ // For now, assume a non-coherent system and always encode write-back
+ // memory with MidgardInnerDomain coherency.
+ fn attribute_from_mair(mair_attr: u8) -> MMU_MEMATTR_STAGE1 {
+ // Device memory or non-write-back normal memory
+ if Self::is_device_memory(mair_attr) || !Self::is_writeback_cacheable(mair_attr) {
+ return Self::encode_attribute(
+ false,
+ false,
+ AllocPolicySelect::Alloc,
+ Coherency::MidgardInnerDomain,
+ MemoryType::NonCacheable,
+ );
+ }
+
+ // Write-back cacheable normal memory
+ let inner: u8 = mair_attr & Self::ARM_MAIR_INNER_MASK;
+ Self::encode_attribute(
+ (inner & Self::ARM_MAIR_WRITE_ALLOCATE) != 0,
+ (inner & Self::ARM_MAIR_READ_ALLOCATE) != 0,
+ AllocPolicySelect::Alloc,
+ Coherency::MidgardInnerDomain,
+ MemoryType::WriteBack,
+ )
+ }
+
+ /// Write one converted MAIR attribute into a corresponding MEMATTR slot.
+ fn with_encoded_attribute(self, index: usize, attr: MMU_MEMATTR_STAGE1) -> Self {
+ debug_assert!(index < 8);
+
+ let shift = index * 8;
+ let mask = !(0xffu64 << shift);
+ let raw = (self.into_raw() & mask) | ((u64::from(attr.into_raw())) << shift);
+
+ Self::from_raw(raw)
+ }
+ /// Convert an AArch64 MAIR value into the GPU MEMATTR register encoding.
+ ///
+ /// Both MAIR and MEMATTR are 64-bit values with eight 8-bit memory
+ /// attribute entries, but the bits do not map directly. The GPU MEMATTR encoding
+ /// is less detailed than the MAIR encoding, so MAIR is converted to MEMATTR
+ /// conservatively as follows:
+ ///
+ /// 1. Device memory, or Normal Memory that is not write-back cacheable, is encoded
+ /// as GPU `NonCacheable`
+ ///
+ /// 2. Normal memory that is write-back cacheable is encoded as GPU `WriteBack`,
+ /// and the inner allocation hints are preserved.
+ pub(crate) fn from_mair(mair: u64) -> Self {
+ mair.to_le_bytes()
+ .into_iter()
+ .enumerate()
+ .fold(Self::zeroed(), |acc, (i, attr)| {
+ acc.with_encoded_attribute(i, Self::attribute_from_mair(attr))
+ })
+ }
+ }
+
+ register! {
/// Lock region address for each address space.
pub(crate) LOCKADDR(u64)[MAX_AS, stride = STRIDE] @ 0x2410 {
/// Lock region size.
diff --git a/drivers/gpu/drm/tyr/slot.rs b/drivers/gpu/drm/tyr/slot.rs
index 5c266fcf30ea..9f60e5e1c653 100644
--- a/drivers/gpu/drm/tyr/slot.rs
+++ b/drivers/gpu/drm/tyr/slot.rs
@@ -20,7 +20,6 @@
//!
//! [SlotOperations]: crate::slot::SlotOperations
//! [SlotManager]: crate::slot::SlotManager
-#![expect(dead_code)]
use core::{
mem::take,
diff --git a/drivers/gpu/drm/tyr/tyr.rs b/drivers/gpu/drm/tyr/tyr.rs
index 7c9a8063b3b9..79045d0135a8 100644
--- a/drivers/gpu/drm/tyr/tyr.rs
+++ b/drivers/gpu/drm/tyr/tyr.rs
@@ -11,6 +11,7 @@
mod file;
mod gem;
mod gpu;
+mod mmu;
mod regs;
mod slot;
--
2.54.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [PATCH v7 3/7] drm/tyr: add Memory Management Unit (MMU) support
2026-07-14 3:18 ` [PATCH v7 3/7] drm/tyr: add Memory Management Unit (MMU) support Deborah Brouwer
@ 2026-07-14 3:30 ` sashiko-bot
0 siblings, 0 replies; 14+ messages in thread
From: sashiko-bot @ 2026-07-14 3:30 UTC (permalink / raw)
To: Deborah Brouwer; +Cc: ojeda, dri-devel
Thank you for your contribution! Sashiko AI review found 8 potential issue(s) to consider:
- [Critical] Early returns in the MMU eviction path on hardware timeouts skip hardware disablement, leading to a use-after-free of the page tables.
- [High] The MAIR attribute parsing logic incorrectly classifies valid Write-Back memory as device memory and Non-cacheable memory as Write-Back due to flawed bitwise checks.
- [High] Bit-shift panic and integer underflow when `as_start_update` is called with an empty or wrapping region.
- [High] Hardware AS slot assignment fails when the AS_PRESENT mask has holes because it maps a contiguous logical index directly to a physical slot.
- [High] VM updates crossing a 4GB boundary fail because the calculated lock region size exceeds the 5-bit LOCKADDR.size field.
- [High] `AddressSpaceManager::as_flush` does not wait for the hardware `FlushPt` command to complete.
- [High] `AddressSpaceManager::as_start_update` does not wait for the hardware `Lock` command to complete.
- [Medium] Creating a VM with unsupported `va_bits` causes a panic due to arithmetic underflow.
--
--- Patch [3]: [PATCH v7 3/7] drm/tyr: add Memory Management Unit (MMU) support ---
commit 3d38e41a867c897b123982cd2a02b0eb472ce1c9
Author: Boris Brezillon <boris.brezillon@collabora.com>
drm/tyr: add Memory Management Unit (MMU) support
Add Memory Management Unit (MMU) support in Tyr. The MMU module wraps a
SlotManager instance to allocate MMU address-space slots for use by
virtual memory (VM) address spaces. The MMU's SlotManager uses an
AddressSpaceManager to handle the hardware-specific callbacks. For
example, the AddressSpaceManager activates and evicts VMs from slots by
writing commands to the MMU registers.
Add an implementation block for the MMU's MEMATTR register to provide
a method for translating the Memory Attribute Indirection Register (MAIR)
format from the pagetable configuration to a format understood by the MMU.
Create an mmu instance during probe, it will be used by subsequent patches
in this series.
Wrap the iomem stored in TyrDrmRegistrationData in an Arc. The iomem
is stored in the mmu through its AddressSpaceManager. In anticipation
of the iomem also being stored in the firmware object, set up shared
ownership of the iomem now.
Update Kconfig to add the new MMU and IOMMU dependencies required
by this MMU module.
> diff --git a/drivers/gpu/drm/tyr/mmu/address_space.rs b/drivers/gpu/drm/tyr/mmu/address_space.rs
> index 0000000000000..20dca96f4a1ee 100644
> --- /dev/null
> +++ b/drivers/gpu/drm/tyr/mmu/address_space.rs
[ ... ]
> +impl<'bound> VmAsData<'bound> {
[ ... ]
> + fn as_config(&self) -> Result<AddressSpaceConfig> {
> + let pt = &self.page_table;
[ ... ]
> + let ina_bits_field_value = 55 - self.va_bits;
[Severity: Medium]
Can this arithmetic operation in VmAsData::as_config() underflow and cause a
kernel panic if a VM is created with va_bits greater than 55?
[ ... ]
> +impl<'bound> AddressSpaceManager<'bound> {
[ ... ]
> + fn validate_as_slot(&self, as_nr: usize) -> Result {
> + if as_nr >= MAX_AS {
> + pr_err!("AS slot {} out of valid range (max {})\n", as_nr, MAX_AS);
> + return Err(EINVAL);
> + }
> +
> + if (self.as_present & (1 << as_nr)) == 0 {
[Severity: High]
Does this logic in AddressSpaceManager::validate_as_slot() fail if the
AS_PRESENT mask contains holes?
During probe, Mmu::new() sets up the generic SlotManager with the total
count of present bits:
Mmu::new()
let slot_count = present.count_ones().try_into()?;
let as_manager = AddressSpaceManager::new(iomem.into(), present)?;
...
SlotManager::new(as_manager, slot_count)?
This assigns contiguous logical indices (e.g. 0, 1, 2) to slots. If the mask is
sparse (like 0b1011), checking the physical bit directly with the logical
index might falsely fail validation when as_nr maps to a missing bit.
[ ... ]
> + fn as_disable(&mut self, as_nr: usize) -> Result {
> + self.validate_as_slot(as_nr)?;
> +
> + // Flush AS before disabling
> + self.as_send_cmd_and_wait(as_nr, MmuCommand::FlushMem)?;
[Severity: Critical]
If as_send_cmd_and_wait() times out and returns an error, does the ? operator
cause AddressSpaceManager::as_disable() and the evict() path to abort early?
If eviction aborts without zeroing the TRANSTAB registers, the hardware slot
remains active and pointing to page tables that the OS is about to free, which
could lead to a use-after-free of those page tables by the hardware.
[ ... ]
> + fn as_start_update(&mut self, as_nr: usize, region: &Range<u64>) -> Result {
> + self.validate_as_slot(as_nr)?;
[ ... ]
> + let addr_xor = region.start ^ (region.end - 1);
[Severity: High]
Can this cause an arithmetic underflow and out-of-bounds bit shift panic if
AddressSpaceManager::as_start_update() is called with a region where
region.start and region.end are both 0?
If region.end is 0, region.end - 1 wraps to u64::MAX. addr_xor becomes
very large, leading to region_size_log2 becoming 64.
Later in the function:
let lockaddr_base = region.start & !((1u64 << lock_region_log2) - 1);
Shifting 1u64 by 64 will deterministically panic in Rust.
> + let region_size_log2 = 64 - addr_xor.leading_zeros() as u8;
> +
> + let lock_region_log2 = core::cmp::max(region_size_log2, lock_region_min_size_log2);
[ ... ]
> + let lockaddr_size = lock_region_log2 - 1;
[ ... ]
> + let lockaddr_val = LOCKADDR::zeroed()
> + .try_with_size(lockaddr_size)?
[Severity: High]
Are valid VM updates that cross a 4GB boundary rejected here?
If an update crosses a 4GB boundary (e.g. from 0xFFFFF000 to 0x100001000),
the XOR of the start and end addresses sets bit 32. This makes
region_size_log2 equal to 33, and lockaddr_size is calculated as 32.
Since the hardware field is 5 bits (max 31), try_with_size() will return
an error instead of proceeding.
[ ... ]
> + io.write(
> + LOCKADDR_HI::try_at(as_nr).ok_or(EINVAL)?,
> + LOCKADDR_HI::from_raw((lockaddr_val >> 32) as u32),
> + );
> +
> + self.as_send_cmd(as_nr, MmuCommand::Lock)
> + }
[Severity: High]
Does this code need to wait for the Lock command to complete?
Since as_send_cmd() returns immediately, the CPU might begin modifying the
page tables before the hardware has actually locked the TLB, breaking atomicity.
[ ... ]
> + fn as_flush(&mut self, as_nr: usize) -> Result {
> + self.validate_as_slot(as_nr)?;
> + self.as_send_cmd(as_nr, MmuCommand::FlushPt)
> + }
[Severity: High]
Does this code need to wait for the FlushPt command to complete?
If as_flush() returns before the hardware completes the flush, the CPU could
proceed to unmap or free pages while the GPU is still processing them, creating
a TLB use-after-free scenario.
> diff --git a/drivers/gpu/drm/tyr/regs.rs b/drivers/gpu/drm/tyr/regs.rs
> index 831357a8ef87d..eae9213fb1c2b 100644
> --- a/drivers/gpu/drm/tyr/regs.rs
> +++ b/drivers/gpu/drm/tyr/regs.rs
[ ... ]
> + impl MEMATTR {
[ ... ]
> + fn is_device_memory(mair_attr: u8) -> bool {
> + // In AArch64 MAIR, device memory has bits [1:0] of outer nibble = 0.
> + let outer = mair_attr >> 4;
> + (outer & 0x3) == 0
> + }
[Severity: High]
Can MEMATTR::is_device_memory() incorrectly classify valid memory attributes
as device memory?
If a buffer is mapped using a MAIR attribute where the outer cache policy is
Write-Back but No-Allocate (e.g. 0xCC), outer & 0x3 would evaluate to
12 & 3 == 0. This incorrectly categorizes the memory as device memory.
[ ... ]
> + fn is_writeback_cacheable(mair_attr: u8) -> bool {
> + let outer = mair_attr >> 4;
> + let inner = mair_attr & Self::ARM_MAIR_INNER_MASK;
> +
> + (outer & Self::ARM_MAIR_WRITE_BACK) != 0 && (inner & Self::ARM_MAIR_WRITE_BACK) != 0
> + }
[Severity: High]
Does MEMATTR::is_writeback_cacheable() mistakenly identify memory as Write-Back
when the inner cache policy is Non-Cacheable?
For an attribute like 0x74 (Outer Write-Back, Inner Non-Cacheable), outer & 4
and inner & 4 are both non-zero, violating the requested cache policy by
mapping Inner Non-Cacheable memory as fully Write-Back.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-fw-boot-b4-v7-0-afd8dc1494dd@collabora.com?part=3
^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH v7 4/7] drm/tyr: add GPU virtual memory (VM) support
2026-07-14 3:18 [PATCH v7 0/7] drm/tyr: firmware loading and MCU boot support Deborah Brouwer
` (2 preceding siblings ...)
2026-07-14 3:18 ` [PATCH v7 3/7] drm/tyr: add Memory Management Unit (MMU) support Deborah Brouwer
@ 2026-07-14 3:18 ` Deborah Brouwer
2026-07-14 3:28 ` sashiko-bot
2026-07-14 3:18 ` [PATCH v7 5/7] drm/tyr: add a kernel buffer object Deborah Brouwer
` (2 subsequent siblings)
6 siblings, 1 reply; 14+ messages in thread
From: Deborah Brouwer @ 2026-07-14 3:18 UTC (permalink / raw)
To: Daniel Almeida, Alice Ryhl, Danilo Krummrich, David Airlie,
Simona Vetter, Benno Lossin, Gary Guo
Cc: dri-devel, linux-kernel, rust-for-linux, Deborah Brouwer,
boris.brezillon, samitolvanen, work, acourbot, lyude, laura.nao,
beata.michalska, alvin.sun, steven.price
From: Boris Brezillon <boris.brezillon@collabora.com>
Add GPU virtual address space management using the DRM GPUVM framework.
Each virtual memory (VM) space is backed by ARM64 LPAE Stage 1 page tables
and can be mapped into hardware address space (AS) slots for GPU execution.
The implementation provides memory isolation and virtual address
allocation. VMs support mapping GEM buffer objects with configurable
protection flags (readonly, noexec, uncached) and handle both 4KB and 2MB
page sizes. A new_dummy_object() helper is provided to create a dummy GEM
object for use as a GPUVM root.
The vm module integrates with the MMU for address space activation and
provides map/unmap/remap operations with page table synchronization.
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Co-developed-by: Daniel Almeida <daniel.almeida@collabora.com>
Signed-off-by: Daniel Almeida <daniel.almeida@collabora.com>
Co-developed-by: Deborah Brouwer <deborah.brouwer@collabora.com>
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
drivers/gpu/drm/tyr/Kconfig | 1 +
drivers/gpu/drm/tyr/driver.rs | 4 +-
drivers/gpu/drm/tyr/gem.rs | 26 +-
drivers/gpu/drm/tyr/mmu.rs | 1 -
drivers/gpu/drm/tyr/tyr.rs | 1 +
drivers/gpu/drm/tyr/vm.rs | 811 ++++++++++++++++++++++++++++++++++++++++++
6 files changed, 839 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/tyr/Kconfig b/drivers/gpu/drm/tyr/Kconfig
index 61a2fd6f961a..79ea4bb214de 100644
--- a/drivers/gpu/drm/tyr/Kconfig
+++ b/drivers/gpu/drm/tyr/Kconfig
@@ -12,6 +12,7 @@ config DRM_TYR
default n
select IOMMU_IO_PGTABLE_LPAE
select RUST_DRM_GEM_SHMEM_HELPER
+ select RUST_DRM_GPUVM
help
Rust DRM driver for ARM Mali CSF-based GPUs.
diff --git a/drivers/gpu/drm/tyr/driver.rs b/drivers/gpu/drm/tyr/driver.rs
index 74b55a389754..9195c8be5203 100644
--- a/drivers/gpu/drm/tyr/driver.rs
+++ b/drivers/gpu/drm/tyr/driver.rs
@@ -37,7 +37,7 @@
use crate::{
file::TyrDrmFileData,
- gem::BoData,
+ gem::Bo,
gpu,
gpu::GpuInfo,
mmu::Mmu,
@@ -194,7 +194,7 @@ impl drm::Driver for TyrDrmDriver {
type Data = ();
type RegistrationData<'bound> = TyrDrmRegistrationData<'bound>;
type File = TyrDrmFileData;
- type Object = drm::gem::shmem::Object<BoData>;
+ type Object = Bo;
type ParentDevice<Ctx: DeviceContext> = platform::Device<Ctx>;
const INFO: drm::DriverInfo = INFO;
diff --git a/drivers/gpu/drm/tyr/gem.rs b/drivers/gpu/drm/tyr/gem.rs
index 1640a161754b..c28be61a01bb 100644
--- a/drivers/gpu/drm/tyr/gem.rs
+++ b/drivers/gpu/drm/tyr/gem.rs
@@ -5,8 +5,12 @@
//! DRM's GEM subsystem with shmem backing.
use kernel::{
- drm::gem,
- prelude::*, //
+ drm::gem::{
+ self,
+ shmem, //
+ },
+ prelude::*,
+ sync::aref::ARef, //
};
use crate::driver::{
@@ -34,3 +38,21 @@ fn new(_dev: &TyrDrmDevice, _size: usize, args: BoCreateArgs) -> impl PinInit<Se
try_pin_init!(Self { flags: args.flags })
}
}
+
+/// Type alias for Tyr GEM buffer objects.
+pub(crate) type Bo = gem::shmem::Object<BoData>;
+
+/// Creates a dummy GEM object to serve as the root of a GPUVM.
+pub(crate) fn new_dummy_object(ddev: &TyrDrmDevice) -> Result<ARef<Bo>> {
+ let bo = Bo::new(
+ ddev,
+ 4096,
+ shmem::ObjectConfig {
+ map_wc: true,
+ parent_resv_obj: None,
+ },
+ BoCreateArgs { flags: 0 },
+ )?;
+
+ Ok(bo)
+}
diff --git a/drivers/gpu/drm/tyr/mmu.rs b/drivers/gpu/drm/tyr/mmu.rs
index beae87c816e5..0ed20e03569c 100644
--- a/drivers/gpu/drm/tyr/mmu.rs
+++ b/drivers/gpu/drm/tyr/mmu.rs
@@ -10,7 +10,6 @@
//! The [`SlotManager`] manages the assignment of virtual address spaces to hardware address-space
//! (AS) slots. MMU commands such as updates and flushes are carried out by the
//! [`AddressSpaceManager`] which actually writes to the MMU registers.
-#![expect(dead_code)]
use core::ops::Range;
diff --git a/drivers/gpu/drm/tyr/tyr.rs b/drivers/gpu/drm/tyr/tyr.rs
index 79045d0135a8..92f6885cdaae 100644
--- a/drivers/gpu/drm/tyr/tyr.rs
+++ b/drivers/gpu/drm/tyr/tyr.rs
@@ -14,6 +14,7 @@
mod mmu;
mod regs;
mod slot;
+mod vm;
kernel::module_platform_driver! {
type: TyrPlatformDriver,
diff --git a/drivers/gpu/drm/tyr/vm.rs b/drivers/gpu/drm/tyr/vm.rs
new file mode 100644
index 000000000000..2358096afc7e
--- /dev/null
+++ b/drivers/gpu/drm/tyr/vm.rs
@@ -0,0 +1,811 @@
+// SPDX-License-Identifier: GPL-2.0 or MIT
+
+//! GPU virtual memory management using the DRM GPUVM framework.
+//!
+//! This module manages GPU virtual address spaces, providing memory isolation and
+//! the illusion of owning the entire virtual address (VA) range, similar to CPU virtual memory.
+//! Each virtual memory (VM) area is backed by ARM64 LPAE Stage 1 page tables and can be
+//! mapped into hardware address space (AS) slots for GPU execution.
+#![expect(dead_code)]
+
+use core::marker::PhantomData;
+use core::ops::Range;
+
+use kernel::{
+ device::{
+ Bound,
+ Device, //
+ },
+ drm::{
+ gpuvm::{
+ DriverGpuVm,
+ GpuVaAlloc,
+ GpuVm,
+ GpuVmBo,
+ OpMap,
+ OpMapRequest,
+ OpMapped,
+ OpRemap,
+ OpRemapped,
+ OpUnmap,
+ OpUnmapped,
+ UniqueRefGpuVm, //
+ }, //
+ },
+ fmt,
+ impl_flags,
+ iommu::pgtable::{
+ prot,
+ IoPageTable,
+ ARM64LPAES1, //
+ },
+ new_mutex,
+ prelude::*,
+ sizes::{
+ SZ_1G,
+ SZ_2M,
+ SZ_4K, //
+ },
+ sync::{
+ aref::ARef,
+ Arc,
+ ArcBorrow,
+ Mutex, //
+ },
+ uapi, //
+};
+
+use crate::{
+ driver::{
+ TyrDrmDevice,
+ TyrDrmDriver, //
+ },
+ gem,
+ gem::Bo,
+ gpu::GpuInfo,
+ mmu::{
+ address_space::VmAsData,
+ Mmu, //
+ },
+ regs::gpu_control::MMU_FEATURES,
+};
+
+impl_flags!(
+ /// Flags controlling virtual memory mapping behavior.
+ ///
+ /// These flags control access permissions and caching behavior for GPU virtual
+ /// memory mappings.
+ #[derive(Debug, Clone, Default, Copy, PartialEq, Eq)]
+ pub(crate) struct VmMapFlags(u32);
+
+ /// Individual flags that can be combined in [`VmMapFlags`].
+ #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+ pub(crate) enum VmFlag {
+ /// Map as read-only.
+ Readonly = uapi::drm_panthor_vm_bind_op_flags_DRM_PANTHOR_VM_BIND_OP_MAP_READONLY as u32,
+ /// Map as non-executable.
+ Noexec = uapi::drm_panthor_vm_bind_op_flags_DRM_PANTHOR_VM_BIND_OP_MAP_NOEXEC as u32,
+ /// Map as uncached.
+ Uncached = uapi::drm_panthor_vm_bind_op_flags_DRM_PANTHOR_VM_BIND_OP_MAP_UNCACHED as u32,
+ }
+);
+
+impl VmMapFlags {
+ /// Convert the flags to `pgtable::prot`.
+ fn to_prot(self) -> u32 {
+ let mut prot = 0;
+
+ if self.contains(VmFlag::Readonly) {
+ prot |= prot::READ;
+ } else {
+ prot |= prot::READ | prot::WRITE;
+ }
+
+ if self.contains(VmFlag::Noexec) {
+ prot |= prot::NOEXEC;
+ }
+
+ if !self.contains(VmFlag::Uncached) {
+ prot |= prot::CACHE;
+ }
+
+ prot
+ }
+}
+
+impl fmt::Display for VmMapFlags {
+ fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+ let mut first = true;
+
+ if self.contains(VmFlag::Readonly) {
+ write!(f, "READONLY")?;
+ first = false;
+ }
+ if self.contains(VmFlag::Noexec) {
+ if !first {
+ write!(f, " | ")?;
+ }
+ write!(f, "NOEXEC")?;
+ first = false;
+ }
+
+ if self.contains(VmFlag::Uncached) {
+ if !first {
+ write!(f, " | ")?;
+ }
+ write!(f, "UNCACHED")?;
+ }
+
+ Ok(())
+ }
+}
+
+impl TryFrom<u32> for VmMapFlags {
+ type Error = Error;
+
+ fn try_from(value: u32) -> Result<Self, Self::Error> {
+ let valid = VmFlag::Readonly as u32 | VmFlag::Noexec as u32 | VmFlag::Uncached as u32;
+
+ if value & !valid != 0 {
+ pr_err!("Invalid VM map flags: {:#x}\n", value);
+ return Err(EINVAL);
+ }
+ Ok(Self(value))
+ }
+}
+
+/// Arguments for a virtual memory map operation.
+struct VmMapArgs<'bound> {
+ /// Access permissions and caching behavior for the mapping.
+ flags: VmMapFlags,
+ /// GEM buffer object registered with the GPUVM framework.
+ vm_bo: ARef<GpuVmBo<GpuVmData<'bound>>>,
+ /// Offset in bytes from the start of the buffer object.
+ bo_offset: u64,
+}
+
+/// Type of virtual memory operation.
+enum VmOpType<'bound> {
+ /// Map a GEM buffer object into the virtual address space.
+ Map(VmMapArgs<'bound>),
+ /// Unmap a region from the virtual address space.
+ Unmap,
+}
+
+/// Preallocated resources needed to execute a VM operation.
+///
+/// VM operations may require allocating new GPUVA objects to track mappings.
+/// To avoid allocation failures during the operation, preallocate the
+/// maximum number of GPUVAs that might be needed.
+struct VmOpResources<'bound> {
+ /// Preallocated GPUVA objects for remap operations.
+ ///
+ /// Partial unmap requests or map requests overlapping existing mappings
+ /// will trigger a remap call, which needs to register up to three VA
+ /// objects (one for the new mapping, and two for the previous and next
+ /// mappings).
+ preallocated_gpuvas: [Option<GpuVaAlloc<GpuVmData<'bound>>>; 3],
+}
+
+/// Request to execute a virtual memory operation.
+struct VmOpRequest<'bound> {
+ /// Request type.
+ op_type: VmOpType<'bound>,
+
+ /// Region of the virtual address space covered by this request.
+ region: Range<u64>,
+}
+
+/// Arguments for a page table map operation.
+struct PtMapArgs {
+ /// Memory protection flags describing allowed accesses for this mapping.
+ ///
+ /// This is directly derived from [`VmMapFlags`] via [`VmMapFlags::to_prot`].
+ prot: u32,
+}
+
+/// Type of page table operation.
+enum PtOpType {
+ /// Map pages into the page table.
+ Map(PtMapArgs),
+ /// Unmap pages from the page table.
+ Unmap,
+}
+
+/// Context for updating the GPU page table.
+///
+/// This context is created when beginning a page table update operation and
+/// automatically flushes changes when dropped. It ensures that the
+/// Memory Management Unit (MMU) state is properly managed and Translation
+/// Lookaside Buffer (TLB) entries are flushed.
+pub(crate) struct PtUpdateContext<'ctx, 'bound> {
+ /// Device used for DMA-mapping GEM shmem SG tables.
+ dev: &'ctx Device<Bound>,
+
+ /// Page table.
+ pt: &'ctx IoPageTable<'bound, ARM64LPAES1>,
+
+ /// MMU manager.
+ mmu: &'ctx Mmu<'bound>,
+
+ /// Reference to the address space data to pass to the MMU functions.
+ as_data: &'ctx VmAsData<'bound>,
+
+ /// Region of the virtual address space covered by this request.
+ region: Range<u64>,
+
+ /// Operation type.
+ op_type: PtOpType,
+
+ /// Preallocated resources that can be used when executing the request.
+ resources: &'ctx mut VmOpResources<'bound>,
+}
+
+impl<'ctx, 'bound> PtUpdateContext<'ctx, 'bound> {
+ /// Creates a new page table update context.
+ ///
+ /// This prepares the MMU for a page table update.
+ /// The context will automatically flush the TLB and
+ /// complete the update when dropped.
+ fn new(
+ dev: &'ctx Device<Bound>,
+ pt: &'ctx IoPageTable<'bound, ARM64LPAES1>,
+ mmu: &'ctx Mmu<'bound>,
+ as_data: &'ctx VmAsData<'bound>,
+ region: Range<u64>,
+ op_type: PtOpType,
+ resources: &'ctx mut VmOpResources<'bound>,
+ ) -> Result<PtUpdateContext<'ctx, 'bound>> {
+ mmu.start_vm_update(as_data, ®ion)?;
+
+ Ok(Self {
+ dev,
+ pt,
+ mmu,
+ as_data,
+ region,
+ op_type,
+ resources,
+ })
+ }
+
+ /// Finds one of our pre-allocated VAs.
+ ///
+ /// It is a logic error to call this more than three times for a given
+ /// PtUpdateContext.
+ fn preallocated_gpuva(&mut self) -> Result<GpuVaAlloc<GpuVmData<'bound>>> {
+ self.resources
+ .preallocated_gpuvas
+ .iter_mut()
+ .find_map(|f| f.take())
+ .ok_or(EINVAL)
+ }
+}
+
+impl Drop for PtUpdateContext<'_, '_> {
+ fn drop(&mut self) {
+ if let Err(e) = self.mmu.end_vm_update(self.as_data) {
+ pr_err!("Failed to end VM update {:?}\n", e);
+ }
+
+ if let Err(e) = self.mmu.flush_vm(self.as_data) {
+ pr_err!("Failed to flush VM {:?}\n", e);
+ }
+ }
+}
+
+/// Driver implementation for the GPUVM framework.
+///
+/// Implements [`DriverGpuVm`] to provide VM operation callbacks (map, unmap, remap)
+/// and associated types for buffer objects, virtual addresses, and contexts.
+pub(crate) struct GpuVmData<'bound> {
+ _phantom: PhantomData<&'bound ()>,
+}
+
+/// GPU virtual address space.
+///
+/// Each VM can be mapped into a hardware address space slot.
+#[pin_data]
+pub(crate) struct Vm<'bound> {
+ /// Data referenced by an AS when the VM is active
+ as_data: Arc<VmAsData<'bound>>,
+ /// MMU manager.
+ mmu: Arc<Mmu<'bound>>,
+ /// Parent device used for DMA mapping and page-table operations.
+ dev: &'bound Device<Bound>,
+ /// DRM GPUVM core for managing virtual address space.
+ #[pin]
+ gpuvm_unique: Mutex<UniqueRefGpuVm<GpuVmData<'bound>>>,
+ /// Non-core part of the GPUVM. Can be used for stuff that doesn't modify the
+ /// internal mapping tree, like GpuVm::obtain()
+ gpuvm: ARef<GpuVm<GpuVmData<'bound>>>,
+ /// VA range for this VM.
+ va_range: Range<u64>,
+}
+
+impl<'bound> Vm<'bound> {
+ /// Creates a new GPU virtual address space.
+ ///
+ /// The VM is initialized with a page table configured according to the GPU's
+ /// address translation capabilities and registered with the GPUVM framework.
+ pub(crate) fn new(
+ dev: &'bound Device<Bound>,
+ ddev: &TyrDrmDevice,
+ mmu: ArcBorrow<'_, Mmu<'bound>>,
+ gpu_info: &GpuInfo,
+ ) -> Result<Arc<Vm<'bound>>> {
+ let mmu_features = MMU_FEATURES::from_raw(gpu_info.mmu_features);
+ let va_bits = mmu_features.va_bits().get();
+ let pa_bits = mmu_features.pa_bits().get();
+
+ let range = 0..(1u64 << va_bits);
+ let reserve_range = 0..0u64;
+
+ // dummy_obj is used to initialize the GPUVM tree.
+ let dummy_obj = gem::new_dummy_object(ddev).inspect_err(|e| {
+ pr_err!("Failed to create dummy GEM object: {:?}\n", e);
+ })?;
+
+ let gpuvm_unique = GpuVm::new::<Error, _>(
+ c"Tyr::GpuVm",
+ ddev,
+ &*dummy_obj,
+ range.clone(),
+ reserve_range,
+ GpuVmData::<'bound> {
+ _phantom: PhantomData::<&()>,
+ },
+ )
+ .inspect_err(|e| {
+ pr_err!("Failed to create GpuVm: {:?}\n", e);
+ })?;
+ let gpuvm = ARef::from(&*gpuvm_unique);
+
+ let as_data = Arc::pin_init(VmAsData::new(&mmu, dev, va_bits, pa_bits), GFP_KERNEL)?;
+
+ let vm = Arc::pin_init(
+ pin_init!(Self{
+ as_data,
+ dev,
+ mmu: mmu.into(),
+ gpuvm,
+ gpuvm_unique <- new_mutex!(gpuvm_unique),
+ va_range: range,
+ }),
+ GFP_KERNEL,
+ )?;
+
+ Ok(vm)
+ }
+
+ /// Activate the VM in a hardware address space slot.
+ pub(crate) fn activate(&self) -> Result {
+ self.mmu
+ .activate_vm(self.as_data.as_arc_borrow())
+ .inspect_err(|e| {
+ pr_err!("Failed to activate VM: {:?}\n", e);
+ })
+ }
+
+ /// Deactivate the VM by evicting it from its address space slot.
+ fn deactivate(&self) -> Result {
+ self.mmu.deactivate_vm(&self.as_data).inspect_err(|e| {
+ pr_err!("Failed to deactivate VM: {:?}\n", e);
+ })
+ }
+
+ /// Kills the VM by deactivating it and unmapping all regions.
+ pub(crate) fn kill(&self) {
+ // TODO: Turn the VM into a state where it can't be used.
+ let _ = self.deactivate().inspect_err(|e| {
+ pr_err!("Failed to deactivate VM: {:?}\n", e);
+ });
+ let _ = self
+ .unmap_range(self.va_range.start, self.va_range.end - self.va_range.start)
+ .inspect_err(|e| {
+ pr_err!("Failed to unmap range during deactivate: {:?}\n", e);
+ });
+ }
+
+ /// Executes a virtual memory operation.
+ ///
+ /// This handles both map and unmap operations by coordinating between the
+ /// GPUVM framework and the hardware page table.
+ fn exec_op<'a>(
+ &self,
+ gpuvm_unique: &mut UniqueRefGpuVm<GpuVmData<'bound>>,
+ req: VmOpRequest<'bound>,
+ resources: &'a mut VmOpResources<'bound>,
+ ) -> Result {
+ let pt = &self.as_data.page_table;
+
+ match req.op_type {
+ VmOpType::Map(args) => {
+ let mut pt_upd = PtUpdateContext::new(
+ self.dev,
+ pt,
+ &self.mmu,
+ &self.as_data,
+ req.region,
+ PtOpType::Map(PtMapArgs {
+ prot: args.flags.to_prot(),
+ }),
+ resources,
+ )?;
+
+ gpuvm_unique.sm_map(OpMapRequest {
+ addr: pt_upd.region.start,
+ range: pt_upd.region.end - pt_upd.region.start,
+ gem_offset: args.bo_offset,
+ vm_bo: &args.vm_bo,
+ context: &mut pt_upd,
+ })
+ //PtUpdateContext drops here flushing the page table
+ }
+ VmOpType::Unmap => {
+ let mut pt_upd = PtUpdateContext::new(
+ self.dev,
+ pt,
+ &self.mmu,
+ &self.as_data,
+ req.region,
+ PtOpType::Unmap,
+ resources,
+ )?;
+
+ gpuvm_unique.sm_unmap(
+ pt_upd.region.start,
+ pt_upd.region.end - pt_upd.region.start,
+ &mut pt_upd,
+ )
+ //PtUpdateContext drops here flushing the page table
+ }
+ }
+ }
+
+ /// Maps a GEM buffer object range into the VM at the specified virtual address.
+ ///
+ /// This creates a mapping from GPU virtual address `va` to the physical pages
+ /// backing the GEM object, starting at `bo_offset` bytes into the object and
+ /// spanning `size` bytes. The mapping respects the access permissions and
+ /// caching behavior specified in `flags`.
+ pub(crate) fn map_bo_range(
+ &self,
+ bo: &Bo,
+ bo_offset: u64,
+ size: u64,
+ va: u64,
+ flags: VmMapFlags,
+ ) -> Result {
+ let req = VmOpRequest {
+ op_type: VmOpType::Map(VmMapArgs {
+ vm_bo: self.gpuvm.obtain(bo, ())?,
+ flags,
+ bo_offset,
+ }),
+ region: va..(va + size),
+ };
+ let mut resources = VmOpResources {
+ preallocated_gpuvas: [
+ Some(GpuVaAlloc::<GpuVmData<'bound>>::new(GFP_KERNEL)?),
+ Some(GpuVaAlloc::<GpuVmData<'bound>>::new(GFP_KERNEL)?),
+ Some(GpuVaAlloc::<GpuVmData<'bound>>::new(GFP_KERNEL)?),
+ ],
+ };
+ {
+ let mut gpuvm_unique = self.gpuvm_unique.lock();
+ self.exec_op(gpuvm_unique.as_mut().get_mut(), req, &mut resources)?;
+ }
+ // We flush the defer cleanup list now. Things will be different in
+ // the asynchronous VM_BIND path, where we want the cleanup to
+ // happen outside the DMA signalling path.
+ self.gpuvm.deferred_cleanup();
+ Ok(())
+ }
+
+ /// Unmaps a virtual address range from the VM.
+ ///
+ /// This removes any existing mappings in the specified range, freeing the
+ /// virtual address space for reuse.
+ pub(crate) fn unmap_range(&self, va: u64, size: u64) -> Result {
+ let req = VmOpRequest {
+ op_type: VmOpType::Unmap,
+ region: va..(va + size),
+ };
+ let mut resources = VmOpResources {
+ preallocated_gpuvas: [
+ Some(GpuVaAlloc::<GpuVmData<'bound>>::new(GFP_KERNEL)?),
+ Some(GpuVaAlloc::<GpuVmData<'bound>>::new(GFP_KERNEL)?),
+ None,
+ ],
+ };
+ {
+ let mut gpuvm_unique = self.gpuvm_unique.lock();
+ self.exec_op(gpuvm_unique.as_mut().get_mut(), req, &mut resources)?;
+ }
+ // We flush the defer cleanup list now. Things will be different in
+ // the asynchronous VM_BIND path, where we want the cleanup to
+ // happen outside the DMA signalling path.
+ self.gpuvm.deferred_cleanup();
+ Ok(())
+ }
+}
+
+impl<'bound> DriverGpuVm for GpuVmData<'bound> {
+ type Driver = TyrDrmDriver;
+ type Object = Bo;
+ type VmBoData = ();
+ type VaData = ();
+ type SmContext<'ctx>
+ = PtUpdateContext<'ctx, 'bound>
+ where
+ Self: 'ctx;
+
+ /// Indicates that a new mapping should be created.
+ fn sm_step_map<'op>(
+ &mut self,
+ op: OpMap<'op, Self>,
+ context: &mut Self::SmContext<'_>,
+ ) -> Result<OpMapped<'op, Self>, Error> {
+ let start_iova = op.addr();
+ let mut iova = start_iova;
+ let mut bytes_left_to_map = op.length();
+ let mut gem_offset = op.gem_offset();
+ let sgt = op.obj().sg_table(context.dev).inspect_err(|e| {
+ pr_err!("Failed to get sg_table: {:?}\n", e);
+ })?;
+ let prot = match &context.op_type {
+ PtOpType::Map(args) => args.prot,
+ _ => {
+ return Err(EINVAL);
+ }
+ };
+
+ for sgt_entry in sgt.iter() {
+ // Expressly convert to u64 to work with arm 32-bit builds.
+ #[allow(clippy::useless_conversion)]
+ let mut paddr = u64::from(sgt_entry.dma_address());
+ #[allow(clippy::useless_conversion)]
+ let mut sgt_entry_length = u64::from(sgt_entry.dma_len());
+
+ if bytes_left_to_map == 0 {
+ break;
+ }
+
+ if gem_offset > 0 {
+ // Skip the entire SGT entry if the gem_offset exceeds its length.
+ let skip = u64::min(sgt_entry_length, gem_offset);
+ paddr += skip;
+ sgt_entry_length -= skip;
+ gem_offset -= skip;
+ }
+
+ if sgt_entry_length == 0 {
+ continue;
+ }
+
+ if gem_offset != 0 {
+ pr_err!("Invalid gem_offset {} in page table mapping.\n", gem_offset);
+ return Err(EINVAL);
+ }
+ let len = u64::min(sgt_entry_length, bytes_left_to_map);
+
+ let segment_mapped = match pt_map(context.pt, iova, paddr, len, prot) {
+ Ok(segment_mapped) => segment_mapped,
+ Err(e) => {
+ // clean up any successful mappings from previous SGT entries.
+ let total_mapped = iova - start_iova;
+ if total_mapped > 0 {
+ let _ = pt_unmap(context.pt, start_iova..(start_iova + total_mapped));
+ }
+ return Err(e);
+ }
+ };
+
+ // Since there could be a partial mapping, only advance by the actual amount mapped
+ bytes_left_to_map -= segment_mapped;
+ iova += segment_mapped;
+ }
+
+ let gpuva = context.preallocated_gpuva()?;
+ let op = op.insert(gpuva, pin_init::init_zeroed());
+
+ Ok(op)
+ }
+
+ /// Indicates that an existing mapping should be removed.
+ fn sm_step_unmap<'op>(
+ &mut self,
+ op: OpUnmap<'op, Self>,
+ context: &mut Self::SmContext<'_>,
+ ) -> Result<OpUnmapped<'op, Self>, Error> {
+ let start_iova = op.va().addr();
+ let length = op.va().length();
+
+ let region = start_iova..(start_iova + length);
+ pt_unmap(context.pt, region.clone()).inspect_err(|e| {
+ pr_err!(
+ "Failed to unmap region {:#x}..{:#x}: {:?}\n",
+ region.start,
+ region.end,
+ e
+ );
+ })?;
+
+ let (op_unmapped, _va_removed) = op.remove();
+
+ Ok(op_unmapped)
+ }
+
+ /// Indicates that an existing mapping should be split up.
+ fn sm_step_remap<'op>(
+ &mut self,
+ op: OpRemap<'op, Self>,
+ context: &mut Self::SmContext<'_>,
+ ) -> Result<OpRemapped<'op, Self>, Error> {
+ let unmap_start = if let Some(prev) = op.prev() {
+ prev.addr() + prev.length()
+ } else {
+ op.va_to_unmap().addr()
+ };
+
+ let unmap_end = if let Some(next) = op.next() {
+ next.addr()
+ } else {
+ op.va_to_unmap().addr() + op.va_to_unmap().length()
+ };
+
+ let unmap_length = unmap_end - unmap_start;
+
+ if unmap_length > 0 {
+ let region = unmap_start..(unmap_start + unmap_length);
+ pt_unmap(context.pt, region.clone()).inspect_err(|e| {
+ pr_err!(
+ "Failed to unmap remap region {:#x}..{:#x}: {:?}\n",
+ region.start,
+ region.end,
+ e
+ );
+ })?;
+ }
+
+ let prev_va = context.preallocated_gpuva()?;
+ let next_va = context.preallocated_gpuva()?;
+
+ let (op_remapped, _remap_ret) = op.remap(
+ [prev_va, next_va],
+ pin_init::init_zeroed(),
+ pin_init::init_zeroed(),
+ );
+
+ Ok(op_remapped)
+ }
+}
+
+/// This function selects the largest supported block size (currently 4KB or 2MB)
+/// that can be used for a mapping at the given address and size, respecting alignment constraints.
+///
+/// We can map multiple pages at once but we can't exceed the size of the
+/// table entry itself. So, if mapping 4KB pages, figure out how many pages
+/// can be mapped before we hit the 2MB boundary. Or, if mapping 2MB pages,
+/// figure out how many pages can be mapped before hitting the 1GB boundary
+/// Returns the page size (4KB or 2MB) and the number of pages that can be mapped at that size.
+fn get_pgsize(addr: u64, size: u64) -> (u64, u64) {
+ // Get the distance to the next boundary of 2MB block
+ let blk_offset_2m = addr.wrapping_neg() % (SZ_2M as u64);
+
+ // Use 4K blocks if the address is not 2MB aligned, or we have less than 2MB to map
+ if blk_offset_2m != 0 || size < SZ_2M as u64 {
+ let pgcount = if blk_offset_2m == 0 {
+ size / SZ_4K as u64
+ } else {
+ u64::min(blk_offset_2m, size) / SZ_4K as u64
+ };
+ return (SZ_4K as u64, pgcount);
+ }
+
+ let blk_offset_1g = addr.wrapping_neg() % (SZ_1G as u64);
+ let blk_offset = if blk_offset_1g == 0 {
+ SZ_1G as u64
+ } else {
+ blk_offset_1g
+ };
+ let pgcount = u64::min(blk_offset, size) / SZ_2M as u64;
+
+ (SZ_2M as u64, pgcount)
+}
+
+/// Maps a physical address range into the page table at the specified virtual address.
+///
+/// This function maps `len` bytes of physical memory starting at `paddr` to the
+/// virtual address `iova`, using the protection flags specified in `prot`. It
+/// automatically selects optimal page sizes to minimize page table overhead.
+///
+/// If the mapping fails partway through, all successfully mapped pages are
+/// unmapped before returning an error.
+///
+/// Returns the number of bytes successfully mapped.
+fn pt_map(
+ pt: &IoPageTable<'_, ARM64LPAES1>,
+ iova: u64,
+ paddr: u64,
+ len: u64,
+ prot: u32,
+) -> Result<u64> {
+ let mut segment_mapped = 0u64;
+ while segment_mapped < len {
+ let remaining = len - segment_mapped;
+ let curr_iova = iova + segment_mapped;
+ let curr_paddr = paddr + segment_mapped;
+
+ let (pgsize, pgcount) = get_pgsize(curr_iova | curr_paddr, remaining);
+
+ // SAFETY:
+ // No other io-pgtable operation can currently access this range because Tyr holds
+ // the gpuvm_unique mutex for the entire sm_map() operation.
+ // The addresses being mapped won't overlap any existing mappings in this
+ // page table because drm_gpuvm_sm_map() checks each requested mapping and either unmaps
+ // or remaps any overlap before creating the new mapping.
+ let (mapped, result) = unsafe {
+ pt.map_pages(
+ curr_iova as usize,
+ (curr_paddr as usize).try_into().unwrap(),
+ pgsize as usize,
+ pgcount as usize,
+ prot,
+ GFP_KERNEL,
+ )
+ };
+
+ if let Err(e) = result {
+ pr_err!("pt.map_pages failed at iova {:#x}: {:?}\n", curr_iova, e);
+ if segment_mapped > 0 {
+ let _ = pt_unmap(pt, iova..(iova + segment_mapped));
+ }
+ return Err(e);
+ }
+
+ if mapped == 0 {
+ pr_err!("Failed to map any pages at iova {:#x}\n", curr_iova);
+ if segment_mapped > 0 {
+ let _ = pt_unmap(pt, iova..(iova + segment_mapped));
+ }
+ return Err(ENOMEM);
+ }
+
+ segment_mapped += mapped as u64;
+ }
+
+ Ok(segment_mapped)
+}
+
+/// Unmaps a virtual address range from the page table.
+///
+/// This function removes all page table entries in the specified range,
+/// automatically handling different page sizes that may be present.
+fn pt_unmap(pt: &IoPageTable<'_, ARM64LPAES1>, range: Range<u64>) -> Result {
+ let mut iova = range.start;
+ let mut bytes_left_to_unmap = range.end - range.start;
+
+ while bytes_left_to_unmap > 0 {
+ let (pgsize, pgcount) = get_pgsize(iova, bytes_left_to_unmap);
+
+ // SAFETY:
+ // No other io-pgtable operation can currently access this range because Tyr holds
+ // the gpuvm_unique mutex for the entire sm_unmap() operation.
+ // We know that this page table has one or more consecutive mappings
+ // starting at `iova` with the total size of `pgcount * pgsize` because
+ // gpuvm callbacks provide exactly the range that was previously mapped.
+ let unmapped = unsafe { pt.unmap_pages(iova as usize, pgsize as usize, pgcount as usize) };
+
+ if unmapped == 0 {
+ pr_err!("Failed to unmap any bytes at iova {:#x}\n", iova);
+ return Err(EINVAL);
+ }
+
+ bytes_left_to_unmap -= unmapped as u64;
+ iova += unmapped as u64;
+ }
+
+ Ok(())
+}
--
2.54.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [PATCH v7 4/7] drm/tyr: add GPU virtual memory (VM) support
2026-07-14 3:18 ` [PATCH v7 4/7] drm/tyr: add GPU virtual memory (VM) support Deborah Brouwer
@ 2026-07-14 3:28 ` sashiko-bot
0 siblings, 0 replies; 14+ messages in thread
From: sashiko-bot @ 2026-07-14 3:28 UTC (permalink / raw)
To: Deborah Brouwer; +Cc: dri-devel, ojeda
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
- [Critical] Casting 64-bit physical and virtual addresses to `usize` causes silent truncation on 32-bit platforms with LPAE, leading to incorrect mappings and memory corruption.
- [High] Insufficient `GpuVaAlloc` preallocation causes map/unmap operations to fail midway with `EINVAL`, leaving hardware page tables out of sync with the GPUVM tree.
- [High] Unmapping regions backed by non-2MB-aligned physical addresses fails and leaks the mappings because `pt_unmap` incorrectly assumes the mapped page size is 2MB.
- [High] Missing bounds check on GEM object size in `map_bo_range` allows creating overgrown mappings, leading to permanent memory leaks and GPUVM tree corruption.
- [Medium] Successfully mapped pages during a failing `pt.map_pages` call are not unmapped, permanently leaking page table entries.
--
--- Patch [4]: [PATCH v7 4/7] drm/tyr: add GPU virtual memory (VM) support ---
commit 809ab9f421f459ef56a480ccf227ec9341b24878
Author: Boris Brezillon <boris.brezillon@collabora.com>
drm/tyr: add GPU virtual memory (VM) support
Add GPU virtual address space management using the DRM GPUVM framework.
Each virtual memory space is backed by ARM64 LPAE Stage 1 page tables
and can be mapped into hardware address space slots for GPU execution.
> diff --git a/drivers/gpu/drm/tyr/vm.rs b/drivers/gpu/drm/tyr/vm.rs
> index 0000000000000..2358096afc7e8 100644
> --- /dev/null
> +++ b/drivers/gpu/drm/tyr/vm.rs
[ ... ]
> pub(crate) fn map_bo_range(
> &self,
> bo: &Bo,
> bo_offset: u64,
> size: u64,
> va: u64,
> flags: VmMapFlags,
> ) -> Result {
> let req = VmOpRequest {
> op_type: VmOpType::Map(VmMapArgs {
> vm_bo: self.gpuvm.obtain(bo, ())?,
> flags,
> bo_offset,
> }),
> region: va..(va + size),
> };
[Severity: High]
Does this code allow mapping a region larger than the actual GEM object?
If bo_offset + size exceeds the object's size, sm_step_map() will finish
when the scatter-gather table is exhausted but register a GPUVA node for
the full oversized range. When this oversized virtual address range is
later unmapped, the driver might attempt to unmap page table entries that
were never populated, which can cause pt.unmap_pages() to return 0 and
abort the unmap operation.
> let mut resources = VmOpResources {
> preallocated_gpuvas: [
> Some(GpuVaAlloc::<GpuVmData<'bound>>::new(GFP_KERNEL)?),
> Some(GpuVaAlloc::<GpuVmData<'bound>>::new(GFP_KERNEL)?),
> Some(GpuVaAlloc::<GpuVmData<'bound>>::new(GFP_KERNEL)?),
> ],
> };
[Severity: High]
Is preallocating 3 VAs sufficient for a map operation?
If the new mapping overlaps and splits two existing mappings, it can trigger
two remaps. A single remap consumes 2 preallocated VAs, plus 1 for the new
mapping, requiring up to 5 VAs in total. Can this cause the map operation to
fail midway with EINVAL and leave the software GPUVM tracking tree out of
sync with the hardware page tables?
[ ... ]
> pub(crate) fn unmap_range(&self, va: u64, size: u64) -> Result {
> let req = VmOpRequest {
> op_type: VmOpType::Unmap,
> region: va..(va + size),
> };
> let mut resources = VmOpResources {
> preallocated_gpuvas: [
> Some(GpuVaAlloc::<GpuVmData<'bound>>::new(GFP_KERNEL)?),
> Some(GpuVaAlloc::<GpuVmData<'bound>>::new(GFP_KERNEL)?),
> None,
> ],
> };
[Severity: High]
Will this array have enough VAs for a complex unmap?
An unmap operation that splits two existing mappings could require up to 4 VAs
for the leftover segments, but this initialization only allocates 2.
[ ... ]
> fn pt_map(
> pt: &IoPageTable<'_, ARM64LPAES1>,
> iova: u64,
> paddr: u64,
> len: u64,
> prot: u32,
> ) -> Result<u64> {
[ ... ]
> let (mapped, result) = unsafe {
> pt.map_pages(
> curr_iova as usize,
> (curr_paddr as usize).try_into().unwrap(),
> pgsize as usize,
> pgcount as usize,
> prot,
> GFP_KERNEL,
> )
> };
[Severity: Critical]
Does casting curr_paddr and curr_iova to usize truncate 64-bit addresses
on 32-bit platforms with LPAE?
This could cause incorrect physical pages to be mapped into the GPU's
address space, potentially leading to unauthorized memory access or data
corruption.
> if let Err(e) = result {
> pr_err!("pt.map_pages failed at iova {:#x}: {:?}\n", curr_iova, e);
> if segment_mapped > 0 {
> let _ = pt_unmap(pt, iova..(iova + segment_mapped));
> }
> return Err(e);
> }
[Severity: Medium]
If pt.map_pages() succeeds in mapping some pages but returns an error for
a subsequent page, does this error path leak the pages that were just
successfully mapped?
The cleanup unmaps segment_mapped (the bytes mapped in previous loop
iterations) but doesn't appear to include the mapped bytes returned by
the failing pt.map_pages() call.
[ ... ]
> fn pt_unmap(pt: &IoPageTable<'_, ARM64LPAES1>, range: Range<u64>) -> Result {
> let mut iova = range.start;
> let mut bytes_left_to_unmap = range.end - range.start;
>
> while bytes_left_to_unmap > 0 {
> let (pgsize, pgcount) = get_pgsize(iova, bytes_left_to_unmap);
>
> let unmapped = unsafe { pt.unmap_pages(iova as usize, pgsize as usize, pgcount as usize) };
[Severity: High]
Can this fail to unmap regions if they were originally backed by physical
addresses that were not 2MB-aligned?
In pt_map(), the page size is calculated using both virtual and physical
addresses:
get_pgsize(curr_iova | curr_paddr, remaining);
However, pt_unmap() calculates the page size using only the virtual address:
get_pgsize(iova, bytes_left_to_unmap);
If a user maps a physical address that is not 2MB-aligned into a virtual
address that is 2MB-aligned, it appears pt_map() will fall back to 4KB
pages, but pt_unmap() will attempt to unmap using 2MB blocks.
[Severity: Critical]
Does casting iova to usize here also cause silent truncation on 32-bit
platforms?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-fw-boot-b4-v7-0-afd8dc1494dd@collabora.com?part=4
^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH v7 5/7] drm/tyr: add a kernel buffer object
2026-07-14 3:18 [PATCH v7 0/7] drm/tyr: firmware loading and MCU boot support Deborah Brouwer
` (3 preceding siblings ...)
2026-07-14 3:18 ` [PATCH v7 4/7] drm/tyr: add GPU virtual memory (VM) support Deborah Brouwer
@ 2026-07-14 3:18 ` Deborah Brouwer
2026-07-14 3:26 ` sashiko-bot
2026-07-14 3:18 ` [PATCH v7 6/7] drm/tyr: add parser for firmware binary Deborah Brouwer
2026-07-14 3:18 ` [PATCH v7 7/7] drm/tyr: add Microcontroller Unit (MCU) booting Deborah Brouwer
6 siblings, 1 reply; 14+ messages in thread
From: Deborah Brouwer @ 2026-07-14 3:18 UTC (permalink / raw)
To: Daniel Almeida, Alice Ryhl, Danilo Krummrich, David Airlie,
Simona Vetter, Benno Lossin, Gary Guo
Cc: dri-devel, linux-kernel, rust-for-linux, Deborah Brouwer,
boris.brezillon, samitolvanen, work, acourbot, lyude, laura.nao,
beata.michalska, alvin.sun, steven.price
Introduce a buffer object type (KernelBo) for internal driver allocations
that are managed by the kernel rather than userspace.
KernelBo wraps a GEM shmem object and automatically handles GPU virtual
address space mapping during creation and unmapping on drop. This provides
a safe and convenient way for the driver to both allocate and clean up
internal buffers for kernel-managed resources.
Co-developed-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
drivers/gpu/drm/tyr/gem.rs | 101 +++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 97 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/tyr/gem.rs b/drivers/gpu/drm/tyr/gem.rs
index c28be61a01bb..47a05a33388e 100644
--- a/drivers/gpu/drm/tyr/gem.rs
+++ b/drivers/gpu/drm/tyr/gem.rs
@@ -4,18 +4,29 @@
//! This module provides buffer object (BO) management functionality using
//! DRM's GEM subsystem with shmem backing.
+use core::ops::Range;
+
use kernel::{
drm::gem::{
self,
shmem, //
},
prelude::*,
- sync::aref::ARef, //
+ sync::{
+ aref::ARef,
+ Arc, //
+ }, //
};
-use crate::driver::{
- TyrDrmDevice,
- TyrDrmDriver, //
+use crate::{
+ driver::{
+ TyrDrmDevice,
+ TyrDrmDriver, //
+ },
+ vm::{
+ Vm,
+ VmMapFlags, //
+ },
};
/// Tyr's DriverObject type for GEM objects.
@@ -56,3 +67,85 @@ pub(crate) fn new_dummy_object(ddev: &TyrDrmDevice) -> Result<ARef<Bo>> {
Ok(bo)
}
+
+/// Specifies how to choose a GPU virtual address for a [`KernelBo`].
+/// An automatic VA allocation strategy will be added in the future.
+pub(crate) enum KernelBoVaAlloc {
+ /// Explicit VA address specified by the caller.
+ #[expect(dead_code)]
+ Explicit(u64),
+}
+
+/// A kernel-owned buffer object with automatic GPU virtual address mapping.
+///
+/// This structure represents a buffer object that is created and managed entirely
+/// by the kernel driver, as opposed to userspace-created GEM objects. It combines
+/// a GEM object with automatic GPU virtual address (VA) space mapping and cleanup.
+///
+/// When dropped, the buffer is automatically unmapped from the GPU VA space.
+pub(crate) struct KernelBo<'bound> {
+ /// The underlying GEM buffer object.
+ #[expect(dead_code)]
+ pub(crate) bo: ARef<Bo>,
+ /// The GPU VM this buffer is mapped into.
+ vm: Arc<Vm<'bound>>,
+ /// The GPU VA range occupied by this buffer.
+ va_range: Range<u64>,
+}
+
+impl<'bound> KernelBo<'bound> {
+ /// Creates a new kernel-owned buffer object and maps it into GPU VA space.
+ ///
+ /// This function allocates a new shmem-backed GEM object and immediately maps
+ /// it into the specified GPU virtual memory space. The mapping is automatically
+ /// cleaned up when the [`KernelBo`] is dropped.
+ #[expect(dead_code)]
+ pub(crate) fn new(
+ ddev: &TyrDrmDevice,
+ vm: Arc<Vm<'bound>>,
+ size: u64,
+ va_alloc: KernelBoVaAlloc,
+ flags: VmMapFlags,
+ ) -> Result<Self> {
+ if size == 0 {
+ pr_err!("Cannot create KernelBo with size 0\n");
+ return Err(EINVAL);
+ }
+
+ let KernelBoVaAlloc::Explicit(va) = va_alloc;
+
+ let bo = Bo::new(
+ ddev,
+ size as usize,
+ shmem::ObjectConfig {
+ map_wc: true,
+ parent_resv_obj: None,
+ },
+ BoCreateArgs { flags: 0 },
+ )?;
+
+ vm.map_bo_range(&bo, 0, size, va, flags)?;
+
+ Ok(KernelBo {
+ bo,
+ vm,
+ va_range: va..(va + size),
+ })
+ }
+}
+
+impl Drop for KernelBo<'_> {
+ fn drop(&mut self) {
+ let va = self.va_range.start;
+ let size = self.va_range.end - self.va_range.start;
+
+ if let Err(e) = self.vm.unmap_range(va, size) {
+ pr_err!(
+ "Failed to unmap KernelBo range {:#x}..{:#x}: {:?}\n",
+ self.va_range.start,
+ self.va_range.end,
+ e
+ );
+ }
+ }
+}
--
2.54.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [PATCH v7 5/7] drm/tyr: add a kernel buffer object
2026-07-14 3:18 ` [PATCH v7 5/7] drm/tyr: add a kernel buffer object Deborah Brouwer
@ 2026-07-14 3:26 ` sashiko-bot
0 siblings, 0 replies; 14+ messages in thread
From: sashiko-bot @ 2026-07-14 3:26 UTC (permalink / raw)
To: Deborah Brouwer; +Cc: dri-devel, ojeda
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Critical] Unhandled `unmap_range` error during `KernelBo` drop leads to dangling page table entries and use-after-free.
- [High] Silent truncation of `size` to `usize` on 32-bit architectures leads to mismatched buffer allocation and VM mapping.
- [Medium] The virtual address range calculation `va + size` can overflow `u64`, causing a kernel panic or invalid state.
--
--- Patch [5]: [PATCH v7 5/7] drm/tyr: add a kernel buffer object ---
commit 63ba028b17f1b868f89f67c9bd905f6f1b2dc8cd
Author: Deborah Brouwer <deborah.brouwer@collabora.com>
drm/tyr: add a kernel buffer object
Introduce a buffer object type (KernelBo) for internal driver allocations
that are managed by the kernel rather than userspace.
KernelBo wraps a GEM shmem object and automatically handles GPU virtual
address space mapping during creation and unmapping on drop. This provides
a safe and convenient way for the driver to both allocate and clean up
internal buffers for kernel-managed resources.
> diff --git a/drivers/gpu/drm/tyr/gem.rs b/drivers/gpu/drm/tyr/gem.rs
> index c28be61a01bb2..47a05a33388e3 100644
> --- a/drivers/gpu/drm/tyr/gem.rs
> +++ b/drivers/gpu/drm/tyr/gem.rs
[ ... ]
> @@ -56,3 +67,85 @@ pub(crate) fn new_dummy_object(ddev: &TyrDrmDevice) -> Result<ARef<Bo>> {
>
> Ok(bo)
> }
> +
> +/// Specifies how to choose a GPU virtual address for a [`KernelBo`].
> +/// An automatic VA allocation strategy will be added in the future.
> +pub(crate) enum KernelBoVaAlloc {
> + /// Explicit VA address specified by the caller.
> + #[expect(dead_code)]
> + Explicit(u64),
> +}
> +
> +/// A kernel-owned buffer object with automatic GPU virtual address mapping.
> +///
> +/// This structure represents a buffer object that is created and managed entirely
> +/// by the kernel driver, as opposed to userspace-created GEM objects. It combines
> +/// a GEM object with automatic GPU virtual address (VA) space mapping and cleanup.
> +///
> +/// When dropped, the buffer is automatically unmapped from the GPU VA space.
> +pub(crate) struct KernelBo<'bound> {
[ ... ]
> +impl<'bound> KernelBo<'bound> {
> + /// Creates a new kernel-owned buffer object and maps it into GPU VA space.
> + ///
> + /// This function allocates a new shmem-backed GEM object and immediately maps
> + /// it into the specified GPU virtual memory space. The mapping is automatically
> + /// cleaned up when the [`KernelBo`] is dropped.
> + #[expect(dead_code)]
> + pub(crate) fn new(
> + ddev: &TyrDrmDevice,
> + vm: Arc<Vm<'bound>>,
> + size: u64,
> + va_alloc: KernelBoVaAlloc,
> + flags: VmMapFlags,
> + ) -> Result<Self> {
> + if size == 0 {
> + pr_err!("Cannot create KernelBo with size 0\n");
> + return Err(EINVAL);
> + }
> +
> + let KernelBoVaAlloc::Explicit(va) = va_alloc;
> +
> + let bo = Bo::new(
> + ddev,
> + size as usize,
[Severity: High]
Does this silently truncate the allocation size on 32-bit architectures?
If a size larger than 4GB is passed, it appears Bo::new() will allocate the
truncated size, but vm.map_bo_range() will be called with the full u64 size
below.
Could this lead to out-of-bounds GPU virtual memory mappings if the mapping size
isn't strictly validated against the actual allocation?
> + shmem::ObjectConfig {
> + map_wc: true,
> + parent_resv_obj: None,
> + },
> + BoCreateArgs { flags: 0 },
> + )?;
> +
> + vm.map_bo_range(&bo, 0, size, va, flags)?;
> +
> + Ok(KernelBo {
> + bo,
> + vm,
> + va_range: va..(va + size),
[Severity: Medium]
Could this addition overflow u64?
If va + size exceeds u64::MAX, it will either panic or wrap around.
If it wraps, va_range.end will be smaller than va_range.start, which
could later cause an underflow panic during drop when calculating
self.va_range.end - self.va_range.start.
> + })
> + }
> +}
> +
> +impl Drop for KernelBo<'_> {
> + fn drop(&mut self) {
> + let va = self.va_range.start;
> + let size = self.va_range.end - self.va_range.start;
> +
> + if let Err(e) = self.vm.unmap_range(va, size) {
[Severity: Critical]
Is it safe to continue dropping the buffer object if unmap_range() fails?
If unmap_range() fails (e.g., due to OOM when splitting page tables or a
hardware timeout), the error is only logged. The underlying self.bo will
still be dropped, potentially freeing its physical pages back to the system.
Since the unmap failed, the GPU's page tables might still contain valid entries
pointing to those freed pages. Could this allow the GPU to access memory
reallocated to other kernel subsystems or userspace, causing a use-after-free?
> + pr_err!(
> + "Failed to unmap KernelBo range {:#x}..{:#x}: {:?}\n",
> + self.va_range.start,
> + self.va_range.end,
> + e
> + );
> + }
> + }
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-fw-boot-b4-v7-0-afd8dc1494dd@collabora.com?part=5
^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH v7 6/7] drm/tyr: add parser for firmware binary
2026-07-14 3:18 [PATCH v7 0/7] drm/tyr: firmware loading and MCU boot support Deborah Brouwer
` (4 preceding siblings ...)
2026-07-14 3:18 ` [PATCH v7 5/7] drm/tyr: add a kernel buffer object Deborah Brouwer
@ 2026-07-14 3:18 ` Deborah Brouwer
2026-07-14 3:28 ` sashiko-bot
2026-07-14 3:18 ` [PATCH v7 7/7] drm/tyr: add Microcontroller Unit (MCU) booting Deborah Brouwer
6 siblings, 1 reply; 14+ messages in thread
From: Deborah Brouwer @ 2026-07-14 3:18 UTC (permalink / raw)
To: Daniel Almeida, Alice Ryhl, Danilo Krummrich, David Airlie,
Simona Vetter, Benno Lossin, Gary Guo
Cc: dri-devel, linux-kernel, rust-for-linux, Deborah Brouwer,
boris.brezillon, samitolvanen, work, acourbot, lyude, laura.nao,
beata.michalska, alvin.sun, steven.price
From: Daniel Almeida <daniel.almeida@collabora.com>
Add a parser for the Mali CSF GPU firmware binary format. The firmware
consists of a header followed by entries describing how to load firmware
sections into the MCU's memory.
The parser extracts section metadata including virtual address ranges,
data byte offsets within the binary, and section flags controlling
permissions and cache modes. It validates the basic firmware structure
and alignment and ignores protected-mode sections for now.
Signed-off-by: Daniel Almeida <daniel.almeida@collabora.com>
Co-developed-by: Beata Michalska <beata.michalska@arm.com>
Signed-off-by: Beata Michalska <beata.michalska@arm.com>
Co-developed-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Co-developed-by: Deborah Brouwer <deborah.brouwer@collabora.com>
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
drivers/gpu/drm/tyr/fw/parser.rs | 521 +++++++++++++++++++++++++++++++++++++++
1 file changed, 521 insertions(+)
diff --git a/drivers/gpu/drm/tyr/fw/parser.rs b/drivers/gpu/drm/tyr/fw/parser.rs
new file mode 100644
index 000000000000..198a754b294f
--- /dev/null
+++ b/drivers/gpu/drm/tyr/fw/parser.rs
@@ -0,0 +1,521 @@
+// SPDX-License-Identifier: GPL-2.0 or MIT
+
+//! Firmware binary parser for Mali CSF (Command Stream Frontend) GPU.
+//!
+//! This module implements a parser for the Mali GPU firmware binary format. The firmware
+//! file contains a header followed by a sequence of entries, each describing how to load
+//! firmware sections into the MCU (Microcontroller Unit) memory. The parser extracts section
+//! metadata including:
+//! - Virtual address ranges where sections should be mapped
+//! - Data ranges (byte offsets) within the firmware binary
+//! - Section flags (permissions, cache modes)
+
+use core::{
+ mem::size_of,
+ ops::Range, //
+};
+
+use kernel::{
+ bits::bit_u32,
+ prelude::*,
+ str::CString, //
+};
+
+use crate::{
+ fw::{
+ SectionFlag,
+ SectionFlags,
+ CSF_MCU_SHARED_REGION_START, //
+ },
+ vm::{
+ VmFlag,
+ VmMapFlags, //
+ }, //
+};
+
+/// A parsed firmware section ready for loading into MCU memory.
+///
+/// Represents a single firmware section extracted from the firmware binary, containing
+/// all information needed to map the section's data into the MCU's virtual address space.
+pub(super) struct ParsedSection {
+ /// Byte offset range within the firmware binary where this section's data resides.
+ pub(super) data_range: Range<u32>,
+ /// MCU virtual address range where this section should be mapped.
+ pub(super) va: Range<u32>,
+ /// Memory protection and caching flags for the mapping.
+ pub(super) vm_map_flags: VmMapFlags,
+}
+
+/// A bare-bones `std::io::Cursor<[u8]>` clone to keep track of the current position in the
+/// firmware binary.
+///
+/// Provides methods to sequentially read primitive types and byte arrays from the firmware
+/// binary while maintaining the current read position.
+struct Cursor<'a> {
+ data: &'a [u8],
+ pos: usize,
+}
+
+impl<'a> Cursor<'a> {
+ fn new(data: &'a [u8]) -> Self {
+ Self { data, pos: 0 }
+ }
+
+ fn len(&self) -> usize {
+ self.data.len()
+ }
+
+ fn pos(&self) -> usize {
+ self.pos
+ }
+
+ /// Returns a view into the cursor's data.
+ ///
+ /// This spawns a new cursor, leaving the current cursor unchanged.
+ fn view(&self, range: Range<usize>) -> Result<Cursor<'_>> {
+ if range.start < self.pos || range.end > self.data.len() {
+ pr_err!(
+ "Invalid cursor range {:?} for data of length {}",
+ range,
+ self.data.len()
+ );
+
+ Err(EINVAL)
+ } else {
+ Ok(Self {
+ data: &self.data[range],
+ pos: 0,
+ })
+ }
+ }
+
+ /// Reads a slice of bytes from the current position and advances the cursor.
+ ///
+ /// Returns an error if the read would exceed the data bounds.
+ fn read(&mut self, nbytes: usize) -> Result<&[u8]> {
+ let start = self.pos;
+ let end = start + nbytes;
+
+ if end > self.data.len() {
+ pr_err!(
+ "Invalid firmware file: read of size {} at position {} is out of bounds",
+ nbytes,
+ start,
+ );
+ return Err(EINVAL);
+ }
+
+ self.pos += nbytes;
+ Ok(&self.data[start..end])
+ }
+
+ /// Reads a little-endian `u8` from the current position and advances the cursor.
+ fn read_u8(&mut self) -> Result<u8> {
+ let bytes = self.read(size_of::<u8>())?;
+ Ok(bytes[0])
+ }
+
+ /// Reads a little-endian `u16` from the current position and advances the cursor.
+ fn read_u16(&mut self) -> Result<u16> {
+ let bytes = self.read(size_of::<u16>())?;
+ Ok(u16::from_le_bytes(bytes.try_into().unwrap()))
+ }
+
+ /// Reads a little-endian `u32` from the current position and advances the cursor.
+ fn read_u32(&mut self) -> Result<u32> {
+ let bytes = self.read(size_of::<u32>())?;
+ Ok(u32::from_le_bytes(bytes.try_into().unwrap()))
+ }
+
+ /// Advances the cursor position by the specified number of bytes.
+ ///
+ /// Returns an error if the advance would exceed the data bounds.
+ fn advance(&mut self, nbytes: usize) -> Result {
+ if self.pos + nbytes > self.data.len() {
+ pr_err!(
+ "Invalid firmware file: advance of size {} at position {} is out of bounds",
+ nbytes,
+ self.pos,
+ );
+ return Err(EINVAL);
+ }
+ self.pos += nbytes;
+ Ok(())
+ }
+}
+
+/// Parser for Mali CSF GPU firmware binaries.
+///
+/// Parses the firmware binary format, extracting section metadata including virtual
+/// address ranges, data offsets, and memory protection flags needed to load firmware
+/// into the MCU's memory.
+pub(super) struct FwParser<'a> {
+ cursor: Cursor<'a>,
+}
+
+impl<'a> FwParser<'a> {
+ /// Creates a new firmware parser for the given firmware binary data.
+ pub(super) fn new(data: &'a [u8]) -> Self {
+ Self {
+ cursor: Cursor::new(data),
+ }
+ }
+
+ /// Parses the firmware binary and returns a collection of parsed sections.
+ ///
+ /// This method validates the firmware header and iterates through all entries
+ /// in the binary, extracting section information needed for loading.
+ pub(super) fn parse(&mut self) -> Result<KVec<ParsedSection>> {
+ let fw_header = self.parse_fw_header()?;
+
+ let mut parsed_sections = KVec::new();
+ while (self.cursor.pos() as u32) < fw_header.size {
+ let entry_section = self.parse_entry()?;
+
+ if let Some(inner) = entry_section.inner {
+ parsed_sections.push(inner, GFP_KERNEL)?;
+ }
+ }
+
+ Ok(parsed_sections)
+ }
+
+ fn parse_fw_header(&mut self) -> Result<FirmwareHeader> {
+ let fw_header: FirmwareHeader = match FirmwareHeader::new(&mut self.cursor) {
+ Ok(fw_header) => fw_header,
+ Err(e) => {
+ pr_err!("Invalid firmware file: {}", e.to_errno());
+ return Err(e);
+ }
+ };
+
+ if fw_header.size > self.cursor.len() as u32 {
+ pr_err!("Firmware image is truncated");
+ return Err(EINVAL);
+ }
+ Ok(fw_header)
+ }
+
+ fn parse_entry(&mut self) -> Result<EntrySection> {
+ let entry_section = EntrySection {
+ entry_hdr: EntryHeader(self.cursor.read_u32()?),
+ inner: None,
+ };
+
+ if self.cursor.pos() % size_of::<u32>() != 0
+ || entry_section.entry_hdr.size() as usize % size_of::<u32>() != 0
+ {
+ pr_err!(
+ "Firmware entry isn't 32 bit aligned, offset={:#x} size={:#x}\n",
+ self.cursor.pos() - size_of::<u32>(),
+ entry_section.entry_hdr.size()
+ );
+ return Err(EINVAL);
+ }
+
+ let section_hdr_size = entry_section.entry_hdr.size() as usize - size_of::<EntryHeader>();
+
+ let entry_section = {
+ let mut entry_cursor = self
+ .cursor
+ .view(self.cursor.pos()..self.cursor.pos() + section_hdr_size)?;
+
+ match entry_section.entry_hdr.entry_type() {
+ Ok(EntryType::Iface) => Ok(EntrySection {
+ entry_hdr: entry_section.entry_hdr,
+ inner: Self::parse_section_entry(&mut entry_cursor)?,
+ }),
+ Ok(
+ EntryType::Config
+ | EntryType::FutfTest
+ | EntryType::TraceBuffer
+ | EntryType::TimelineMetadata
+ | EntryType::BuildInfoMetadata,
+ ) => Ok(entry_section),
+
+ entry_type => {
+ if entry_type.is_err() || !entry_section.entry_hdr.optional() {
+ if !entry_section.entry_hdr.optional() {
+ pr_err!(
+ "Failed to handle firmware entry type: {}\n",
+ entry_type
+ .map_or(entry_section.entry_hdr.entry_type_raw(), |e| e as u8)
+ );
+ Err(EINVAL)
+ } else {
+ Ok(entry_section)
+ }
+ } else {
+ Ok(entry_section)
+ }
+ }
+ }
+ };
+
+ if entry_section.is_ok() {
+ self.cursor.advance(section_hdr_size)?;
+ }
+
+ entry_section
+ }
+
+ fn parse_section_entry(entry_cursor: &mut Cursor<'_>) -> Result<Option<ParsedSection>> {
+ let section_hdr: SectionHeader = SectionHeader::new(entry_cursor)?;
+
+ if section_hdr.data.end < section_hdr.data.start {
+ pr_err!(
+ "Firmware corrupted, data.end < data.start (0x{:x} < 0x{:x})\n",
+ section_hdr.data.end,
+ section_hdr.data.start
+ );
+ return Err(EINVAL);
+ }
+
+ if section_hdr.va.end < section_hdr.va.start {
+ pr_err!(
+ "Firmware corrupted, section_hdr.va.end < section_hdr.va.start (0x{:x} < 0x{:x})\n",
+ section_hdr.va.end,
+ section_hdr.va.start
+ );
+ return Err(EINVAL);
+ }
+
+ if section_hdr.section_flags.contains(SectionFlag::Prot) {
+ pr_info!("Firmware protected mode entry not supported, ignoring");
+ return Ok(None);
+ }
+
+ if section_hdr.va.start == CSF_MCU_SHARED_REGION_START
+ && !section_hdr.section_flags.contains(SectionFlag::Shared)
+ {
+ pr_err!(
+ "Interface at 0x{:x} must be shared",
+ CSF_MCU_SHARED_REGION_START
+ );
+ return Err(EINVAL);
+ }
+
+ let name_len = entry_cursor.len() - entry_cursor.pos();
+ let name_bytes = entry_cursor.read(name_len)?;
+
+ let mut name = KVec::with_capacity(name_bytes.len() + 1, GFP_KERNEL)?;
+ name.extend_from_slice(name_bytes, GFP_KERNEL)?;
+ name.push(0, GFP_KERNEL)?;
+
+ let _name = CStr::from_bytes_with_nul(&name)
+ .ok()
+ .and_then(|name| CString::try_from(name).ok());
+
+ let cache_mode = section_hdr.section_flags.cache_mode();
+ let mut vm_map_flags = VmMapFlags::empty();
+
+ if !section_hdr.section_flags.contains(SectionFlag::Write) {
+ vm_map_flags |= VmFlag::Readonly;
+ }
+ if !section_hdr.section_flags.contains(SectionFlag::Exec) {
+ vm_map_flags |= VmFlag::Noexec;
+ }
+ if cache_mode != SectionFlag::CacheModeCached.into() {
+ vm_map_flags |= VmFlag::Uncached;
+ }
+
+ Ok(Some(ParsedSection {
+ data_range: section_hdr.data.clone(),
+ va: section_hdr.va,
+ vm_map_flags,
+ }))
+ }
+}
+
+/// Firmware binary header containing version and size information.
+///
+/// The header is located at the beginning of the firmware binary and contains
+/// a magic value for validation, version information, and the total size of
+/// all structured headers that follow.
+#[expect(dead_code)]
+struct FirmwareHeader {
+ /// Magic value to check binary validity.
+ magic: u32,
+
+ /// Minor firmware version.
+ minor: u8,
+
+ /// Major firmware version.
+ major: u8,
+
+ /// Padding. Must be set to zero.
+ _padding1: u16,
+
+ /// Firmware version hash.
+ version_hash: u32,
+
+ /// Padding. Must be set to zero.
+ _padding2: u32,
+
+ /// Total size of all the structured data headers at beginning of firmware binary.
+ size: u32,
+}
+
+impl FirmwareHeader {
+ const FW_BINARY_MAGIC: u32 = 0xc3f13a6e;
+ const FW_BINARY_MAJOR_MAX: u8 = 0;
+
+ /// Reads and validates a firmware header from the cursor.
+ ///
+ /// Verifies the magic value, version compatibility, and padding fields.
+ fn new(cursor: &mut Cursor<'_>) -> Result<Self> {
+ let magic = cursor.read_u32()?;
+ if magic != Self::FW_BINARY_MAGIC {
+ pr_err!("Invalid firmware magic");
+ return Err(EINVAL);
+ }
+
+ let minor = cursor.read_u8()?;
+ let major = cursor.read_u8()?;
+
+ if major > Self::FW_BINARY_MAJOR_MAX {
+ pr_err!(
+ "Unsupported firmware binary header version {}.{} (expected {}.x)\n",
+ major,
+ minor,
+ Self::FW_BINARY_MAJOR_MAX
+ );
+ return Err(EINVAL);
+ }
+
+ let padding1 = cursor.read_u16()?;
+ let version_hash = cursor.read_u32()?;
+ let padding2 = cursor.read_u32()?;
+ let size = cursor.read_u32()?;
+
+ if padding1 != 0 || padding2 != 0 {
+ pr_err!("Invalid firmware file: header padding is not zero");
+ return Err(EINVAL);
+ }
+
+ let fw_header = Self {
+ magic,
+ minor,
+ major,
+ _padding1: padding1,
+ version_hash,
+ _padding2: padding2,
+ size,
+ };
+
+ Ok(fw_header)
+ }
+}
+
+/// Firmware section header for loading binary sections into MCU memory.
+#[derive(Debug)]
+struct SectionHeader {
+ section_flags: SectionFlags,
+ /// MCU virtual range to map this binary section to.
+ va: Range<u32>,
+ /// References the data in the FW binary.
+ data: Range<u32>,
+}
+
+impl SectionHeader {
+ /// Reads and validates a section header from the cursor.
+ ///
+ /// Parses section flags, virtual address range, and data range from the firmware binary.
+ fn new(cursor: &mut Cursor<'_>) -> Result<Self> {
+ let section_flags = cursor.read_u32()?;
+ let section_flags = SectionFlags::try_from(section_flags)?;
+
+ let va_start = cursor.read_u32()?;
+ let va_end = cursor.read_u32()?;
+
+ let va = va_start..va_end;
+
+ if va.is_empty() {
+ pr_err!(
+ "Invalid firmware file: empty VA range at pos {}\n",
+ cursor.pos(),
+ );
+ return Err(EINVAL);
+ }
+
+ let data_start = cursor.read_u32()?;
+ let data_end = cursor.read_u32()?;
+ let data = data_start..data_end;
+
+ Ok(Self {
+ section_flags,
+ va,
+ data,
+ })
+ }
+}
+
+/// A firmware entry containing a header and optional parsed section data.
+///
+/// Represents a single entry in the firmware binary, which may contain loadable
+/// section data or metadata that doesn't require loading.
+struct EntrySection {
+ entry_hdr: EntryHeader,
+ inner: Option<ParsedSection>,
+}
+
+/// Header for a firmware entry, packed into a single u32.
+///
+/// The entry header encodes the entry type, size, and optional flag in a
+/// 32-bit value with the following layout:
+/// - Bits 0-7: Entry type
+/// - Bits 8-15: Size in bytes
+/// - Bit 31: Optional flag
+struct EntryHeader(u32);
+
+impl EntryHeader {
+ fn entry_type_raw(&self) -> u8 {
+ (self.0 & 0xff) as u8
+ }
+
+ fn entry_type(&self) -> Result<EntryType> {
+ let v = self.entry_type_raw();
+ EntryType::try_from(v)
+ }
+
+ fn optional(&self) -> bool {
+ self.0 & bit_u32(31) != 0
+ }
+
+ fn size(&self) -> u32 {
+ self.0 >> 8 & 0xff
+ }
+}
+
+#[derive(Clone, Copy, Debug)]
+#[repr(u8)]
+enum EntryType {
+ /// Host <-> FW interface.
+ Iface = 0,
+ /// FW config.
+ Config = 1,
+ /// Unit tests.
+ FutfTest = 2,
+ /// Trace buffer interface.
+ TraceBuffer = 3,
+ /// Timeline metadata interface.
+ TimelineMetadata = 4,
+ /// Metadata about how the FW binary was built.
+ BuildInfoMetadata = 6,
+}
+
+impl TryFrom<u8> for EntryType {
+ type Error = Error;
+
+ fn try_from(value: u8) -> Result<Self, Self::Error> {
+ match value {
+ 0 => Ok(EntryType::Iface),
+ 1 => Ok(EntryType::Config),
+ 2 => Ok(EntryType::FutfTest),
+ 3 => Ok(EntryType::TraceBuffer),
+ 4 => Ok(EntryType::TimelineMetadata),
+ 6 => Ok(EntryType::BuildInfoMetadata),
+ _ => Err(EINVAL),
+ }
+ }
+}
--
2.54.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [PATCH v7 6/7] drm/tyr: add parser for firmware binary
2026-07-14 3:18 ` [PATCH v7 6/7] drm/tyr: add parser for firmware binary Deborah Brouwer
@ 2026-07-14 3:28 ` sashiko-bot
0 siblings, 0 replies; 14+ messages in thread
From: sashiko-bot @ 2026-07-14 3:28 UTC (permalink / raw)
To: Deborah Brouwer; +Cc: ojeda, dri-devel
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [High] Integer underflow when parsing a firmware entry with size 0, leading to a kernel panic.
- [High] Missing validation of firmware data offsets against the binary size.
- [Low] Unnecessary memory allocations and string parsing for the section name which is immediately discarded.
- [Low] Redundant and unreachable virtual address range validation check.
--
--- Patch [6]: [PATCH v7 6/7] drm/tyr: add parser for firmware binary ---
commit e96b99b53f7521bb5685e37e8217c78b4047a1ee
Author: Daniel Almeida <daniel.almeida@collabora.com>
drm/tyr: add parser for firmware binary
Add a parser for the Mali CSF GPU firmware binary format. The firmware
consists of a header followed by entries describing how to load firmware
sections into the MCU's memory.
> diff --git a/drivers/gpu/drm/tyr/fw/parser.rs b/drivers/gpu/drm/tyr/fw/parser.rs
> new file mode 100644
> index 0000000000000..198a754b294f4
> --- /dev/null
> +++ b/drivers/gpu/drm/tyr/fw/parser.rs
[ ... ]
> + fn parse_entry(&mut self) -> Result<EntrySection> {
> + let entry_section = EntrySection {
> + entry_hdr: EntryHeader(self.cursor.read_u32()?),
> + inner: None,
> + };
> +
> + if self.cursor.pos() % size_of::<u32>() != 0
> + || entry_section.entry_hdr.size() as usize % size_of::<u32>() != 0
> + {
> + pr_err!(
> + "Firmware entry isn't 32 bit aligned, offset={:#x} size={:#x}\n",
> + self.cursor.pos() - size_of::<u32>(),
> + entry_section.entry_hdr.size()
> + );
> + return Err(EINVAL);
> + }
> +
> + let section_hdr_size = entry_section.entry_hdr.size() as usize - size_of::<EntryHeader>();
[Severity: High]
If a firmware entry has a size of 0, will this subtraction underflow?
If entry_hdr.size() is 0, the alignment check earlier in FwParser::parse_entry()
passes since 0 % 4 == 0. This subtraction would then wrap around to a very
large value.
When this underflowed value is added to self.cursor.pos(), it can wrap
around to a value smaller than the current position, creating a range where
range.start > range.end. When Cursor::view() receives this range, the slice
operation &self.data[range] will unconditionally panic, leading to a kernel
crash.
Should there be a check to ensure entry_hdr.size() is at least
size_of::<EntryHeader>()?
> +
> + let entry_section = {
> + let mut entry_cursor = self
> + .cursor
> + .view(self.cursor.pos()..self.cursor.pos() + section_hdr_size)?;
[ ... ]
> + fn parse_section_entry(entry_cursor: &mut Cursor<'_>) -> Result<Option<ParsedSection>> {
> + let section_hdr: SectionHeader = SectionHeader::new(entry_cursor)?;
> +
> + if section_hdr.data.end < section_hdr.data.start {
> + pr_err!(
> + "Firmware corrupted, data.end < data.start (0x{:x} < 0x{:x})\n",
> + section_hdr.data.end,
> + section_hdr.data.start
> + );
> + return Err(EINVAL);
> + }
> +
> + if section_hdr.va.end < section_hdr.va.start {
[Severity: Low]
Is this validation check reachable?
SectionHeader::new() already validates that the virtual address range is not
empty by calling va.is_empty(). Since Range::is_empty() returns true if
start >= end, the condition section_hdr.va.end < section_hdr.va.start here in
FwParser::parse_section_entry() appears to be dead code.
> + pr_err!(
> + "Firmware corrupted, section_hdr.va.end < section_hdr.va.start (0x{:x} < 0x{:x})\n",
> + section_hdr.va.end,
> + section_hdr.va.start
> + );
> + return Err(EINVAL);
> + }
> +
> + if section_hdr.section_flags.contains(SectionFlag::Prot) {
[ ... ]
> + let name_len = entry_cursor.len() - entry_cursor.pos();
> + let name_bytes = entry_cursor.read(name_len)?;
> +
> + let mut name = KVec::with_capacity(name_bytes.len() + 1, GFP_KERNEL)?;
> + name.extend_from_slice(name_bytes, GFP_KERNEL)?;
> + name.push(0, GFP_KERNEL)?;
> +
> + let _name = CStr::from_bytes_with_nul(&name)
> + .ok()
> + .and_then(|name| CString::try_from(name).ok());
[Severity: Low]
Are these string allocations and validations used anywhere?
The parsed section name is bound to _name, which is intentionally unused and
immediately dropped. The allocated memory for the KVec and CString is freed
without being attached to the ParsedSection or used further.
Could this parsing be removed to save CPU cycles and avoid unnecessary memory
allocations during firmware loading?
> +
> + let cache_mode = section_hdr.section_flags.cache_mode();
[ ... ]
> +impl SectionHeader {
> + /// Reads and validates a section header from the cursor.
> + ///
> + /// Parses section flags, virtual address range, and data range from the firmware binary.
> + fn new(cursor: &mut Cursor<'_>) -> Result<Self> {
> + let section_flags = cursor.read_u32()?;
> + let section_flags = SectionFlags::try_from(section_flags)?;
> +
> + let va_start = cursor.read_u32()?;
> + let va_end = cursor.read_u32()?;
> +
> + let va = va_start..va_end;
> +
> + if va.is_empty() {
> + pr_err!(
> + "Invalid firmware file: empty VA range at pos {}\n",
> + cursor.pos(),
> + );
> + return Err(EINVAL);
> + }
> +
> + let data_start = cursor.read_u32()?;
> + let data_end = cursor.read_u32()?;
> + let data = data_start..data_end;
[Severity: High]
Does this code validate that the data offsets are within the firmware binary?
The data_start and data_end offsets are read directly from the firmware
without being checked against the total size of the firmware binary.
When FwParser::parse_section_entry() returns the ParsedSection with this
data_range, downstream code that uses it to slice the firmware could
encounter an out-of-bounds access. In Rust, this would trigger an
unconditional panic and crash the kernel if the firmware is corrupted or
maliciously crafted.
> +
> + Ok(Self {
> + section_flags,
> + va,
> + data,
> + })
> + }
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-fw-boot-b4-v7-0-afd8dc1494dd@collabora.com?part=6
^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH v7 7/7] drm/tyr: add Microcontroller Unit (MCU) booting
2026-07-14 3:18 [PATCH v7 0/7] drm/tyr: firmware loading and MCU boot support Deborah Brouwer
` (5 preceding siblings ...)
2026-07-14 3:18 ` [PATCH v7 6/7] drm/tyr: add parser for firmware binary Deborah Brouwer
@ 2026-07-14 3:18 ` Deborah Brouwer
2026-07-14 3:34 ` sashiko-bot
6 siblings, 1 reply; 14+ messages in thread
From: Deborah Brouwer @ 2026-07-14 3:18 UTC (permalink / raw)
To: Daniel Almeida, Alice Ryhl, Danilo Krummrich, David Airlie,
Simona Vetter, Benno Lossin, Gary Guo
Cc: dri-devel, linux-kernel, rust-for-linux, Deborah Brouwer,
boris.brezillon, samitolvanen, work, acourbot, lyude, laura.nao,
beata.michalska, alvin.sun, steven.price
Add a firmware module to load, parse, and map the MCU firmware sections
into shared GEM memory at the required virtual addresses accessible by the
GPU.
Create a firmware instance during probe and store it inside the
TyrDrmRegistrationData to keep it alive after probe. Use the firmware
instance to boot the MCU.
Remove the dead-code annotations from the MMU, VM, slot manager, and
kernel BO code now that these paths are used by the firmware module.
Update Kconfig to add the RUST_FW_LOADER_ABSTRACTIONS dependency
required by this module.
Co-developed-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
drivers/gpu/drm/tyr/Kconfig | 1 +
drivers/gpu/drm/tyr/driver.rs | 17 ++-
drivers/gpu/drm/tyr/fw.rs | 263 ++++++++++++++++++++++++++++++++++++++++++
drivers/gpu/drm/tyr/gem.rs | 3 -
drivers/gpu/drm/tyr/tyr.rs | 1 +
drivers/gpu/drm/tyr/vm.rs | 1 -
6 files changed, 281 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/tyr/Kconfig b/drivers/gpu/drm/tyr/Kconfig
index 79ea4bb214de..8f13e49f11f9 100644
--- a/drivers/gpu/drm/tyr/Kconfig
+++ b/drivers/gpu/drm/tyr/Kconfig
@@ -13,6 +13,7 @@ config DRM_TYR
select IOMMU_IO_PGTABLE_LPAE
select RUST_DRM_GEM_SHMEM_HELPER
select RUST_DRM_GPUVM
+ select RUST_FW_LOADER_ABSTRACTIONS
help
Rust DRM driver for ARM Mali CSF-based GPUs.
diff --git a/drivers/gpu/drm/tyr/driver.rs b/drivers/gpu/drm/tyr/driver.rs
index 9195c8be5203..46ba91af9aca 100644
--- a/drivers/gpu/drm/tyr/driver.rs
+++ b/drivers/gpu/drm/tyr/driver.rs
@@ -37,6 +37,7 @@
use crate::{
file::TyrDrmFileData,
+ fw::Firmware,
gem::Bo,
gpu,
gpu::GpuInfo,
@@ -67,6 +68,9 @@ pub(crate) struct TyrDrmRegistrationData<'bound> {
/// Parent platform device.
pub(crate) pdev: &'bound platform::Device<Bound>,
+ /// Firmware sections.
+ pub(crate) fw: Firmware<'bound>,
+
#[pin]
clks: Mutex<Clocks>,
@@ -144,10 +148,21 @@ fn probe<'bound>(
let unreg_dev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, Ok(()))?;
- let _mmu = Mmu::new(iomem.as_arc_borrow(), &gpu_info)?;
+ let mmu = Mmu::new(iomem.as_arc_borrow(), &gpu_info)?;
+
+ let firmware = Firmware::new(
+ pdev.as_ref(),
+ iomem.clone(),
+ &unreg_dev,
+ mmu.as_arc_borrow(),
+ &gpu_info,
+ )?;
+
+ firmware.boot()?;
let reg_data = try_pin_init!(TyrDrmRegistrationData {
pdev,
+ fw: firmware,
clks <- new_mutex!(Clocks {
core: core_clk,
stacks: stacks_clk,
diff --git a/drivers/gpu/drm/tyr/fw.rs b/drivers/gpu/drm/tyr/fw.rs
new file mode 100644
index 000000000000..554808a792aa
--- /dev/null
+++ b/drivers/gpu/drm/tyr/fw.rs
@@ -0,0 +1,263 @@
+// SPDX-License-Identifier: GPL-2.0 or MIT
+
+//! Firmware loading and management for Mali CSF GPU.
+//!
+//! This module handles loading the Mali GPU firmware binary, parsing it into sections,
+//! and mapping those sections into the MCU's virtual address space. Each firmware section
+//! has specific properties (read/write/execute permissions, cache modes) and must be loaded
+//! at specific virtual addresses expected by the MCU.
+//!
+//! See [`Firmware`] for the main firmware management interface and [`Section`] for
+//! individual firmware sections.
+//!
+//! [`Firmware`]: crate::fw::Firmware
+//! [`Section`]: crate::fw::Section
+
+use kernel::{
+ bits::genmask_u32,
+ device::{
+ Bound,
+ Device, //
+ },
+ drm::{
+ gem::BaseObject, //
+ },
+ impl_flags,
+ io::{
+ poll,
+ Io, //
+ },
+ prelude::*,
+ str::CString,
+ sync::{
+ Arc,
+ ArcBorrow, //
+ },
+ time, //
+};
+
+use crate::{
+ driver::{
+ IoMem,
+ TyrDrmDevice, //
+ },
+ fw::parser::{
+ FwParser,
+ ParsedSection, //
+ },
+ gem,
+ gem::{
+ KernelBo,
+ KernelBoVaAlloc, //
+ },
+ gpu::GpuInfo,
+
+ mmu::Mmu,
+ regs::{
+ gpu_control::{
+ McuControlMode,
+ McuStatus,
+ GPU_ID,
+ MCU_CONTROL,
+ MCU_STATUS, //
+ }, //
+ job_control::JOB_IRQ_RAWSTAT, //
+ },
+ vm::Vm, //
+};
+
+mod parser;
+
+impl_flags!(
+ #[derive(Debug, Clone, Default, Copy, PartialEq, Eq)]
+ pub(super) struct SectionFlags(u32);
+
+ #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+ pub(super) enum SectionFlag {
+ Read = 1 << 0,
+ Write = 1 << 1,
+ Exec = 1 << 2,
+ CacheModeNone = 0 << 3,
+ CacheModeCached = 1 << 3,
+ CacheModeUncachedCoherent = 2 << 3,
+ CacheModeCachedCoherent = 3 << 3,
+ Prot = 1 << 5,
+ Shared = 1 << 30,
+ Zero = 1 << 31,
+ }
+);
+
+pub(super) const CACHE_MODE_MASK: SectionFlags = SectionFlags(genmask_u32(3..=4));
+
+pub(super) const CSF_MCU_SHARED_REGION_START: u32 = 0x04000000;
+
+impl SectionFlags {
+ fn cache_mode(&self) -> SectionFlags {
+ *self & CACHE_MODE_MASK
+ }
+}
+
+impl TryFrom<u32> for SectionFlags {
+ type Error = Error;
+
+ fn try_from(value: u32) -> Result<Self, Self::Error> {
+ let valid_flags = SectionFlags::from(SectionFlag::Read)
+ | SectionFlags::from(SectionFlag::Write)
+ | SectionFlags::from(SectionFlag::Exec)
+ | CACHE_MODE_MASK
+ | SectionFlags::from(SectionFlag::Prot)
+ | SectionFlags::from(SectionFlag::Shared)
+ | SectionFlags::from(SectionFlag::Zero);
+
+ if value & valid_flags.0 != value {
+ Err(EINVAL)
+ } else {
+ Ok(Self(value))
+ }
+ }
+}
+
+/// A parsed section of the firmware binary.
+struct Section<'bound> {
+ // Raw firmware section data for reset purposes
+ #[expect(dead_code)]
+ data: KVec<u8>,
+
+ // Keep the BO backing this firmware section so that both the
+ // GPU mapping and CPU mapping remain valid until the Section is dropped.
+ #[expect(dead_code)]
+ mem: gem::KernelBo<'bound>,
+}
+
+/// Loaded firmware with sections mapped into MCU VM.
+pub(crate) struct Firmware<'bound> {
+ /// Iomem need to access registers.
+ iomem: Arc<IoMem<'bound>>,
+
+ /// MCU VM.
+ vm: Arc<Vm<'bound>>,
+
+ /// List of firmware sections.
+ #[expect(dead_code)]
+ sections: KVec<Section<'bound>>,
+}
+
+impl<'bound> Drop for Firmware<'bound> {
+ fn drop(&mut self) {
+ // AS slots retain a VM ref, we need to kill the circular ref manually.
+ self.vm.kill();
+ }
+}
+
+impl<'bound> Firmware<'bound> {
+ fn init_section_mem(mem: &mut KernelBo<'bound>, data: &KVec<u8>) -> Result {
+ if data.is_empty() {
+ return Ok(());
+ }
+
+ let vmap = mem.bo.vmap::<0>()?;
+ let size = mem.bo.size();
+
+ if data.len() > size {
+ pr_err!("fw section {} bigger than BO {}\n", data.len(), size);
+ return Err(EINVAL);
+ }
+
+ for (i, &byte) in data.iter().enumerate() {
+ vmap.try_write8(byte, i)?;
+ }
+
+ Ok(())
+ }
+
+ fn request(ddev: &TyrDrmDevice, gpu_info: &GpuInfo) -> Result<kernel::firmware::Firmware> {
+ let gpu_id = GPU_ID::from_raw(gpu_info.gpu_id);
+
+ let path = CString::try_from_fmt(fmt!(
+ "arm/mali/arch{}.{}/mali_csffw.bin",
+ gpu_id.arch_major().get(),
+ gpu_id.arch_minor().get()
+ ))?;
+
+ kernel::firmware::Firmware::request(&path, ddev.as_ref().as_ref())
+ }
+
+ fn load(
+ ddev: &TyrDrmDevice,
+ gpu_info: &GpuInfo,
+ ) -> Result<(kernel::firmware::Firmware, KVec<ParsedSection>)> {
+ let fw = Self::request(ddev, gpu_info)?;
+ let mut parser = FwParser::new(fw.data());
+
+ let parsed_sections = parser.parse()?;
+
+ Ok((fw, parsed_sections))
+ }
+
+ /// Load firmware and map sections into MCU VM.
+ pub(crate) fn new(
+ dev: &'bound Device<Bound>,
+ iomem: Arc<IoMem<'bound>>,
+ ddev: &TyrDrmDevice,
+ mmu: ArcBorrow<'_, Mmu<'bound>>,
+ gpu_info: &GpuInfo,
+ ) -> Result<Firmware<'bound>> {
+ let vm = Vm::new(dev, ddev, mmu, gpu_info)?;
+ vm.activate()?;
+
+ let (fw, parsed_sections) = Self::load(ddev, gpu_info)?;
+ let mut sections = KVec::new();
+ for parsed in parsed_sections {
+ let size = (parsed.va.end - parsed.va.start) as usize;
+ let va = u64::from(parsed.va.start);
+
+ let mut mem = KernelBo::new(
+ ddev,
+ vm.clone(),
+ size.try_into().unwrap(),
+ KernelBoVaAlloc::Explicit(va),
+ parsed.vm_map_flags,
+ )?;
+
+ let section_start = parsed.data_range.start as usize;
+ let section_end = parsed.data_range.end as usize;
+ let mut data = KVec::new();
+
+ // Ensure that the firmware slice is not out of bounds.
+ let fw_data = fw.data();
+ let bytes = fw_data.get(section_start..section_end).ok_or(EINVAL)?;
+ data.extend_from_slice(bytes, GFP_KERNEL)?;
+
+ Self::init_section_mem(&mut mem, &data)?;
+
+ sections.push(Section { data, mem }, GFP_KERNEL)?;
+ }
+
+ let firmware = Firmware {
+ iomem,
+ vm,
+ sections,
+ };
+
+ Ok(firmware)
+ }
+
+ pub(crate) fn boot(&self) -> Result {
+ let io = &self.iomem;
+ io.write_reg(MCU_CONTROL::zeroed().with_req(McuControlMode::Auto));
+
+ if let Err(e) = poll::read_poll_timeout(
+ || Ok((io.read(MCU_STATUS), io.read(JOB_IRQ_RAWSTAT))),
+ |(mcu_status, irq_rawstat)| {
+ mcu_status.value() == McuStatus::Enabled && irq_rawstat.glb()
+ },
+ time::Delta::from_millis(1),
+ time::Delta::from_millis(100),
+ ) {
+ let status = io.read(MCU_STATUS);
+ pr_err!("MCU failed to boot, status: {:?}", status.value());
+ return Err(e);
+ }
+ Ok(())
+ }
+}
diff --git a/drivers/gpu/drm/tyr/gem.rs b/drivers/gpu/drm/tyr/gem.rs
index 47a05a33388e..e9bf35682a47 100644
--- a/drivers/gpu/drm/tyr/gem.rs
+++ b/drivers/gpu/drm/tyr/gem.rs
@@ -72,7 +72,6 @@ pub(crate) fn new_dummy_object(ddev: &TyrDrmDevice) -> Result<ARef<Bo>> {
/// An automatic VA allocation strategy will be added in the future.
pub(crate) enum KernelBoVaAlloc {
/// Explicit VA address specified by the caller.
- #[expect(dead_code)]
Explicit(u64),
}
@@ -85,7 +84,6 @@ pub(crate) enum KernelBoVaAlloc {
/// When dropped, the buffer is automatically unmapped from the GPU VA space.
pub(crate) struct KernelBo<'bound> {
/// The underlying GEM buffer object.
- #[expect(dead_code)]
pub(crate) bo: ARef<Bo>,
/// The GPU VM this buffer is mapped into.
vm: Arc<Vm<'bound>>,
@@ -99,7 +97,6 @@ impl<'bound> KernelBo<'bound> {
/// This function allocates a new shmem-backed GEM object and immediately maps
/// it into the specified GPU virtual memory space. The mapping is automatically
/// cleaned up when the [`KernelBo`] is dropped.
- #[expect(dead_code)]
pub(crate) fn new(
ddev: &TyrDrmDevice,
vm: Arc<Vm<'bound>>,
diff --git a/drivers/gpu/drm/tyr/tyr.rs b/drivers/gpu/drm/tyr/tyr.rs
index 92f6885cdaae..e7ec450bdc9c 100644
--- a/drivers/gpu/drm/tyr/tyr.rs
+++ b/drivers/gpu/drm/tyr/tyr.rs
@@ -9,6 +9,7 @@
mod driver;
mod file;
+mod fw;
mod gem;
mod gpu;
mod mmu;
diff --git a/drivers/gpu/drm/tyr/vm.rs b/drivers/gpu/drm/tyr/vm.rs
index 2358096afc7e..7534e68359bf 100644
--- a/drivers/gpu/drm/tyr/vm.rs
+++ b/drivers/gpu/drm/tyr/vm.rs
@@ -6,7 +6,6 @@
//! the illusion of owning the entire virtual address (VA) range, similar to CPU virtual memory.
//! Each virtual memory (VM) area is backed by ARM64 LPAE Stage 1 page tables and can be
//! mapped into hardware address space (AS) slots for GPU execution.
-#![expect(dead_code)]
use core::marker::PhantomData;
use core::ops::Range;
--
2.54.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [PATCH v7 7/7] drm/tyr: add Microcontroller Unit (MCU) booting
2026-07-14 3:18 ` [PATCH v7 7/7] drm/tyr: add Microcontroller Unit (MCU) booting Deborah Brouwer
@ 2026-07-14 3:34 ` sashiko-bot
0 siblings, 0 replies; 14+ messages in thread
From: sashiko-bot @ 2026-07-14 3:34 UTC (permalink / raw)
To: Deborah Brouwer; +Cc: ojeda, dri-devel
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] Hardware address space slots and `Vm` memory leak on `Firmware::new` error paths.
- [High] Integer underflow when parsing firmware entry sizes causes a kernel panic.
- [Medium] The firmware boot sequence polls for the global interrupt to signal completion but fails to clear it.
--
--- Patch [7]: [PATCH v7 7/7] drm/tyr: add Microcontroller Unit (MCU) booting ---
commit e1820d2f1cae463780da8954dc7c2dd33531c48e
Author: Deborah Brouwer <deborah.brouwer@collabora.com>
drm/tyr: add Microcontroller Unit (MCU) booting
Add a firmware module to load, parse, and map the MCU firmware sections
into shared GEM memory at the required virtual addresses accessible by the
GPU.
> diff --git a/drivers/gpu/drm/tyr/fw.rs b/drivers/gpu/drm/tyr/fw.rs
> index 0000000000000..554808a792aa5
> --- /dev/null
> +++ b/drivers/gpu/drm/tyr/fw.rs
[ ... ]
> + fn load(
> + ddev: &TyrDrmDevice,
> + gpu_info: &GpuInfo,
> + ) -> Result<(kernel::firmware::Firmware, KVec<ParsedSection>)> {
> + let fw = Self::request(ddev, gpu_info)?;
> + let mut parser = FwParser::new(fw.data());
> +
> + let parsed_sections = parser.parse()?;
[Severity: High]
When parsing the firmware entry sizes, is there a risk of an integer underflow
if the entry size is 0?
Looking at FwParser::parse_entry() in parser.rs, the alignment check doesn't
seem to reject a size of 0:
if self.cursor.pos() % size_of::<u32>() != 0
|| entry_section.entry_hdr.size() as usize % size_of::<u32>() != 0
{
...
return Err(EINVAL);
}
Since 0 % 4 == 0, the check passes. Then it calculates section_hdr_size:
let section_hdr_size = entry_section.entry_hdr.size() as usize - size_of::<EntryHeader>();
If the size is 0, subtracting size_of::<EntryHeader>() (which is 4) will
underflow, causing a kernel panic. Should there be a check to ensure the
size is at least size_of::<EntryHeader>()?
> +
> + Ok((fw, parsed_sections))
> + }
> +
> + /// Load firmware and map sections into MCU VM.
> + pub(crate) fn new(
> + dev: &'bound Device<Bound>,
> + iomem: Arc<IoMem<'bound>>,
> + ddev: &TyrDrmDevice,
> + mmu: ArcBorrow<'_, Mmu<'bound>>,
> + gpu_info: &GpuInfo,
> + ) -> Result<Firmware<'bound>> {
> + let vm = Vm::new(dev, ddev, mmu, gpu_info)?;
> + vm.activate()?;
> +
> + let (fw, parsed_sections) = Self::load(ddev, gpu_info)?;
> + let mut sections = KVec::new();
[Severity: High]
If an error occurs after vm.activate(), such as in Self::load() or
KernelBo::new(), does this leak the hardware address space slot and the
Vm allocation?
vm.activate() creates a circular reference by storing an Arc<VmAsData> in the
hardware slot manager. This cycle is normally broken by self.vm.kill() in
Firmware::drop():
impl<'bound> Drop for Firmware<'bound> {
fn drop(&mut self) {
// AS slots retain a VM ref, we need to kill the circular ref manually.
self.vm.kill();
}
}
If Firmware::new() returns early with an error, the Firmware object is never
constructed, so its Drop implementation won't run. Should vm.kill() be
called on these error paths before returning?
[ ... ]
> + pub(crate) fn boot(&self) -> Result {
> + let io = &self.iomem;
> + io.write_reg(MCU_CONTROL::zeroed().with_req(McuControlMode::Auto));
> +
> + if let Err(e) = poll::read_poll_timeout(
> + || Ok((io.read(MCU_STATUS), io.read(JOB_IRQ_RAWSTAT))),
> + |(mcu_status, irq_rawstat)| {
> + mcu_status.value() == McuStatus::Enabled && irq_rawstat.glb()
> + },
> + time::Delta::from_millis(1),
> + time::Delta::from_millis(100),
> + ) {
> + let status = io.read(MCU_STATUS);
> + pr_err!("MCU failed to boot, status: {:?}", status.value());
> + return Err(e);
> + }
> + Ok(())
> + }
> +}
[Severity: Medium]
Does this leave the global interrupt asserted in the hardware's RAWSTAT
register?
The polling loop checks for the interrupt:
|(mcu_status, irq_rawstat)| {
mcu_status.value() == McuStatus::Enabled && irq_rawstat.glb()
}
But once the loop succeeds, it returns without writing to JOB_IRQ_CLEAR to
acknowledge and clear the interrupt. Could this cause an immediate spurious
interrupt to fire once the DRM driver registers its interrupt handler and
unmasks interrupts at the GIC?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-fw-boot-b4-v7-0-afd8dc1494dd@collabora.com?part=7
^ permalink raw reply [flat|nested] 14+ messages in thread