Re: [PATCH 12/12] drm/tyr: add firmware loading and MCU boot support

[Deborah Brouwer <deborah.brouwer@collabora.com>]

On Sat, Feb 21, 2026 at 11:25:00AM +0000, Alice Ryhl wrote:
> On Wed, Feb 11, 2026 at 05:37:13PM -0800, Deborah Brouwer wrote:
> > Add firmware loading and management for the Mali CSF GPU. This introduces
> > the fw module that loads the Mali GPU firmware binary, parses it into
> > sections, and maps those sections into the MCU VM at the required
> > virtual addresses.
> > 
> > On probe, the firmware is loaded, its sections are mapped and populated,
> > the MCU VM is activated, and the MCU is booted.
> > 
> > Co-developed-by: Boris Brezillon <boris.brezillon@collabora.com>
> > Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
> > Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
> 
> > +/// Loaded firmware with sections mapped into MCU VM.
> > +pub(crate) struct Firmware {
> > +    /// Platform device reference (needed to access the MCU JOB_IRQ registers).
> > +    pdev: ARef<platform::Device>,
> > +
> > +    /// Iomem need to access registers.
> > +    iomem: Arc<Devres<IoMem>>,
> > +
> > +    /// MCU VM.
> > +    vm: Arc<Vm>,
> > +
> > +    /// List of firmware sections.
> > +    #[expect(dead_code)]
> > +    sections: KVec<KBox<Section>>,
> 
> Why the box?

Hm I don’t actually remember why we originally needed KBox, but we don’t need the section
addresses to stay stable anymore so I’ll remove it.

> 
> > +            let section_start = parsed.data_range.start as usize;
> > +            let section_end = parsed.data_range.end as usize;
> > +            let mut data = KVec::new();
> > +            data.extend_from_slice(&fw.data()[section_start..section_end], GFP_KERNEL)?;
> 
> Could this access be out of bounds?

Yes, that could go out of bounds. I’ll add a defensive bounds check and return
EINVAL if the range is invalid.

> 
> Alice