Re: [PATCH 07/16] gpu: nova-core: mm: Add MMU v2 page table types

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] PdeOps::invalid in MMU v2 creates a valid large page PTE instead of an invalid PDE.
- [Medium] Commit message claims MMU v2 is for Hopper, contradicting the code implementation.
--

commit 123f278dccc75525e59331c1fb9bc862c6096243
Author: Joel Fernandes <joelagnelf@nvidia.com>

gpu: nova-core: mm: Add MMU v2 page table types

Add page table entry and directory structures for MMU version 2. The Pte,
Pde, and DualPde types each implement traits for the version-agnostic API
used by the forthcoming page-table walker and mapper.

>     Add page table entry and directory structures for MMU version 2 used by
>     Hopper and later GPUs.

[Severity: Medium]
Does the commit message have a typo regarding the supported architectures?

The commit message states MMU version 2 is used by Hopper and later GPUs,
but the module documentation in drivers/gpu/nova-core/mm/pagetable/ver2.rs
specifies it is for Turing, Ampere, and Ada GPUs. Hopper uses MMU v3.

> diff --git a/drivers/gpu/nova-core/mm/pagetable/ver2.rs b/drivers/gpu/nova-core/mm/pagetable/ver2.rs
> new file mode 100644
> index 0000000000000..089e5cc2bfc30
> --- /dev/null
> +++ b/drivers/gpu/nova-core/mm/pagetable/ver2.rs

[ ... ]

> +impl PdeOps for Pde {
> +    fn from_raw(val: u64) -> Self {
> +        Self::from_raw(val)
> +    }

[ ... ]

> +    fn invalid() -> Self {
> +        Self::zeroed()
> +            .with_valid_inverted(true)
> +            .with_aperture(AperturePde::Invalid)
> +    }

[Severity: High]
Does PdeOps::invalid() in MMU v2 create a valid large page PTE in hardware
instead of an invalid PDE?

By setting valid_inverted to true (bit 0 = 1), this constructs a raw value
where bit 0 is set. In NVIDIA MMU hardware, bit 0 at the PDE level acts as
the IS_PTE bit (0 = PDE, 1 = large page PTE).

The hardware will interpret this as a valid large page mapped to VRAM
physical address 0. If this is accessed, could it cause severe memory
corruption? 

While currently unreachable by untrusted input because install_mappings()
only uses AperturePde::VideoMemory, this breaks the page table abstraction
for any future code that uses invalid() to clear a PDE slot.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909-mmrebase-v1-0-8dd5d4225d2e@nvidia.com?part=7