Re: [PATCH 03/10] drm/tyr: specify base type for registers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The `DOORBELL` register array exceeds the 2MB size of `TyrRegisters`, which will cause bounds-checking failures during access.
--

--- Patch [3]: [PATCH 03/10] drm/tyr: specify base type for registers ---
commit 0835e2ca0e8718a373eb876a88da9c8e609d5b61
Author: Gary Guo <gary@garyguo.net>

drm/tyr: specify base type for registers

This commit adds a base parameter to register definitions in the tyr drm
driver, associating them with a new TyrRegisters type bounded to a 2MB size.

> diff --git a/drivers/gpu/drm/tyr/driver.rs b/drivers/gpu/drm/tyr/driver.rs
> index 8348c6cd39295..401a4b321eaf8 100644
> --- a/drivers/gpu/drm/tyr/driver.rs
> +++ b/drivers/gpu/drm/tyr/driver.rs

[ ... ]

> @@ -43,6 +43,7 @@
>  };
>  
>  pub(crate) type IoMem<'a> = kernel::io::mem::IoMem<'a, SZ_2M>;
> +pub(crate) type TyrRegisters = kernel::io::Region<SZ_2M>;
>  
>  pub(crate) struct TyrDrmDriver;
>  

[ ... ]

> diff --git a/drivers/gpu/drm/tyr/regs.rs b/drivers/gpu/drm/tyr/regs.rs
> index 831357a8ef87d..ef21d90dbbc41 100644
> --- a/drivers/gpu/drm/tyr/regs.rs
> +++ b/drivers/gpu/drm/tyr/regs.rs

[ ... ]

> @@ -1637,6 +1677,8 @@ pub(crate) mod doorbell_block {
>      const STRIDE: usize = 0x10000;
>  
>      register! {
> +        base: TyrRegisters;
> +
>          /// Doorbell request register. Write-only.
>          pub(crate) DOORBELL(u32)[NUM_DOORBELLS, stride = STRIDE] @ 0x80000 {

[Severity: Medium]
Will this result in bounds-checking failures during access?

The DOORBELL register array is defined with an offset of 0x80000, 64 elements,
and a stride of 0x10000. The final element is located at
0x80000 + (63 * 0x10000) = 0x470000, which is approximately 4.6MB.

However, this patch explicitly associates the DOORBELL array with the
TyrRegisters base type, which is constrained to SZ_2M (2MB).

When accessing DOORBELL with an index >= 24 via the TyrRegisters I/O region,
it will cause a compile-time build_assert! failure for static indices or a
failure for dynamic indices because the access is out of bounds.

Could the driver's mapped MMIO size of SZ_2M be undersized, or is the DOORBELL
register improperly modeled here?

>              /// Doorbell set. Writing 1 triggers the doorbell.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721-typed_register-v1-0-452d72b60262@garyguo.net?part=3