Re: [PATCH v9 4/7] drm/tyr: add GPU virtual memory (VM) support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] `map_bo_range` and `unmap_range` do not validate that `va`, `map_size`, and `bo_offset` are page-aligned.
--

--- Patch [4]: [PATCH v9 4/7] drm/tyr: add GPU virtual memory (VM) support ---
commit f6b41ad5c64a48e1d1e8176179d981d7c1d18bd9
Author: Boris Brezillon <boris.brezillon@collabora.com>

drm/tyr: add GPU virtual memory (VM) support

This commit adds GPU virtual address space management using the DRM GPUVM
framework. Each virtual memory space is backed by ARM64 LPAE Stage 1 page
tables and can be mapped into hardware address space slots for GPU execution.
It provides map, unmap, and remap operations with page table synchronization.

> diff --git a/drivers/gpu/drm/tyr/vm.rs b/drivers/gpu/drm/tyr/vm.rs
> new file mode 100644
> index 0000000000000..c113820b55052
> --- /dev/null
> +++ b/drivers/gpu/drm/tyr/vm.rs

[ ... ]

> +    pub(crate) fn map_bo_range(
> +        &self,
> +        bo: &Bo,
> +        bo_offset: u64,
> +        map_size: u64,
> +        va: u64,
> +        flags: VmMapFlags,
> +    ) -> Result {
> +        let bo_size = u64::try_from(bo.size()).map_err(|_| EOVERFLOW)?;
> +        let bo_end = bo_offset.checked_add(map_size).ok_or(EINVAL)?;

[Severity: High]
Does this function need to validate that va, map_size, and bo_offset are
page-aligned before passing them to the DRM GPUVM framework?

If unaligned values are passed, drm_gpuvm_sm_map() might successfully split
or remove overlapping mappings in the GPUVM tree during its preliminary
unmap/remap steps. 

However, when it subsequently invokes the driver's sm_step_map(), the
underlying pt_map() divides the unaligned size by the page size (SZ_4K),
resulting in a page count of 0 for the unaligned remainder.

This causes the hardware page table update to fail with ENOMEM or EINVAL.
Because drm_gpuvm does not roll back earlier tree modifications if the map
step fails, could this leave the GPUVM tree out of sync with the hardware
page tables and potentially lead to state inconsistencies or memory corruption?

[ ... ]

> +    pub(crate) fn unmap_range(&self, va: u64, size: u64) -> Result {
> +        let end = va.checked_add(size).ok_or(EINVAL)?;

[Severity: High]
Similarly, should this function verify that va and size are page-aligned
before processing the unmap request?

Passing unaligned values here could lead to similar state inconsistencies
between the DRM GPUVM tree and the hardware page tables if the underlying
unmap operations fail or partially complete due to size truncation.

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722-fw-boot-b4-v9-0-8669d2a02590@collabora.com?part=4