[PATCH v2] rust: maple_tree: implement Send and Sync for MapleTree

[PATCH v2] rust: maple_tree: implement Send and Sync for MapleTree

[Joel Fernandes]

The C maple_tree struct contains a *mut c_void, which prevents Rust from
auto-deriving Send/Sync. Following is an example error message when using
MapleTree in nova-core's Vmm.

This propagates up through MapleTreeAlloc to Vmm, BarUser, Gpu, and NovaCore,
causing NovaCore to fail the Send bound required by pci::Driver:

  error[E0277]: `*mut c_void` cannot be sent between threads safely
      --> drivers/gpu/nova-core/driver.rs:77:22
       |
  77   | impl pci::Driver for NovaCore {
       |                      ^^^^^^^^ `*mut c_void` cannot be sent between threads safely
       |
       = help: within `MapleTreeAlloc<()>`, the trait `Send` is not implemented for `*mut c_void`
  note: required because it appears within the type `kernel::bindings::maple_tree`
  note: required because it appears within the type `Opaque<kernel::bindings::maple_tree>`
  note: required because it appears within the type `MapleTree<()>`
  note: required because it appears within the type `MapleTreeAlloc<()>`
       = note: required for `Box<MapleTreeAlloc<()>, Kmalloc>` to implement `Send`
  note: required because it appears within the type `core::pin::Pin<Box<MapleTreeAlloc<()>, Kmalloc>>`
  note: required because it appears within the type `Vmm`
  note: required because it appears within the type `BarUser`
  note: required because it appears within the type `Gpu`
  note: required because it appears within the type `NovaCore`
  note: required by a bound in `kernel::pci::Driver`
      --> rust/kernel/pci.rs:294:19

Implement Send and Sync for MapleTree. The tree contains no thread-local
state, and all shared access goes through the internal ma_lock spinlock.

Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
---
RFC->v2: Just adjusted a few comments as suggested by Gary.

Sending this separately as discussed in the nova mm patch series that needs it:
https://lore.kernel.org/all/252a4eef-f4f4-4edf-8154-06cae4ad8518@nvidia.com/

 rust/kernel/maple_tree.rs | 29 +++++++++++++++++++++++------
 1 file changed, 23 insertions(+), 6 deletions(-)

diff --git a/rust/kernel/maple_tree.rs b/rust/kernel/maple_tree.rs
index 265d6396a78a..2400c905270d 100644
--- a/rust/kernel/maple_tree.rs
+++ b/rust/kernel/maple_tree.rs
@@ -16,7 +16,11 @@
     alloc::Flags,
     error::to_result,
     prelude::*,
-    types::{ForeignOwnable, Opaque},
+    types::{
+        ForeignOwnable,
+        NotThreadSafe,
+        Opaque, //
+    },
 };
 
 /// A maple tree optimized for storing non-overlapping ranges.
@@ -240,7 +244,10 @@ pub fn lock(&self) -> MapleGuard<'_, T> {
         unsafe { bindings::spin_lock(self.ma_lock()) };
 
         // INVARIANT: We just took the spinlock.
-        MapleGuard(self)
+        MapleGuard {
+            tree: self,
+            _not_send: NotThreadSafe,
+        }
     }
 
     #[inline]
@@ -302,19 +309,29 @@ fn drop(mut self: Pin<&mut Self>) {
     }
 }
 
+// SAFETY: `MapleTree<T>` is `Send` if `T` is `Send` because `MapleTree` owns its elements.
+unsafe impl<T: ForeignOwnable + Send> Send for MapleTree<T> {}
+// SAFETY: `&MapleTree<T>` never hands out `&T`; all entry access is serialized
+// by `ma_lock` or `&mut Guard`, so `T: Send` suffices (`T: Sync` not required).
+unsafe impl<T: ForeignOwnable + Send> Sync for MapleTree<T> {}
+
 /// A reference to a [`MapleTree`] that owns the inner lock.
 ///
 /// # Invariants
 ///
 /// This guard owns the inner spinlock.
 #[must_use = "if unused, the lock will be immediately unlocked"]
-pub struct MapleGuard<'tree, T: ForeignOwnable>(&'tree MapleTree<T>);
+pub struct MapleGuard<'tree, T: ForeignOwnable> {
+    tree: &'tree MapleTree<T>,
+    // A held spinlock must be released on the same CPU that acquired it.
+    _not_send: NotThreadSafe,
+}
 
 impl<'tree, T: ForeignOwnable> Drop for MapleGuard<'tree, T> {
     #[inline]
     fn drop(&mut self) {
         // SAFETY: By the type invariants, we hold this spinlock.
-        unsafe { bindings::spin_unlock(self.0.ma_lock()) };
+        unsafe { bindings::spin_unlock(self.tree.ma_lock()) };
     }
 }
 
@@ -323,7 +340,7 @@ impl<'tree, T: ForeignOwnable> MapleGuard<'tree, T> {
     pub fn ma_state(&mut self, first: usize, end: usize) -> MaState<'_, T> {
         // SAFETY: The `MaState` borrows this `MapleGuard`, so it can also borrow the `MapleGuard`s
         // read/write permissions to the maple tree.
-        unsafe { MaState::new_raw(self.0, first, end) }
+        unsafe { MaState::new_raw(self.tree, first, end) }
     }
 
     /// Load the value at the given index.
@@ -375,7 +392,7 @@ pub fn ma_state(&mut self, first: usize, end: usize) -> MaState<'_, T> {
     #[inline]
     pub fn load(&mut self, index: usize) -> Option<T::BorrowedMut<'_>> {
         // SAFETY: `self.tree` contains a valid maple tree.
-        let ret = unsafe { bindings::mtree_load(self.0.tree.get(), index) };
+        let ret = unsafe { bindings::mtree_load(self.tree.tree.get(), index) };
         if ret.is_null() {
             return None;
         }
-- 
2.34.1

Re: [PATCH v2] rust: maple_tree: implement Send and Sync for MapleTree

[Boqun Feng]

On Wed, May 06, 2026 at 09:51:22AM -0400, Joel Fernandes wrote:
> The C maple_tree struct contains a *mut c_void, which prevents Rust from
> auto-deriving Send/Sync. Following is an example error message when using
> MapleTree in nova-core's Vmm.
> 
> This propagates up through MapleTreeAlloc to Vmm, BarUser, Gpu, and NovaCore,
> causing NovaCore to fail the Send bound required by pci::Driver:
> 
>   error[E0277]: `*mut c_void` cannot be sent between threads safely
>       --> drivers/gpu/nova-core/driver.rs:77:22
>        |
>   77   | impl pci::Driver for NovaCore {
>        |                      ^^^^^^^^ `*mut c_void` cannot be sent between threads safely
>        |
>        = help: within `MapleTreeAlloc<()>`, the trait `Send` is not implemented for `*mut c_void`
>   note: required because it appears within the type `kernel::bindings::maple_tree`
>   note: required because it appears within the type `Opaque<kernel::bindings::maple_tree>`
>   note: required because it appears within the type `MapleTree<()>`
>   note: required because it appears within the type `MapleTreeAlloc<()>`
>        = note: required for `Box<MapleTreeAlloc<()>, Kmalloc>` to implement `Send`
>   note: required because it appears within the type `core::pin::Pin<Box<MapleTreeAlloc<()>, Kmalloc>>`
>   note: required because it appears within the type `Vmm`
>   note: required because it appears within the type `BarUser`
>   note: required because it appears within the type `Gpu`
>   note: required because it appears within the type `NovaCore`
>   note: required by a bound in `kernel::pci::Driver`
>       --> rust/kernel/pci.rs:294:19
> 
> Implement Send and Sync for MapleTree. The tree contains no thread-local
> state, and all shared access goes through the internal ma_lock spinlock.
> 
> Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
> ---
> RFC->v2: Just adjusted a few comments as suggested by Gary.
> 
> Sending this separately as discussed in the nova mm patch series that needs it:
> https://lore.kernel.org/all/252a4eef-f4f4-4edf-8154-06cae4ad8518@nvidia.com/
> 
>  rust/kernel/maple_tree.rs | 29 +++++++++++++++++++++++------
>  1 file changed, 23 insertions(+), 6 deletions(-)
> 
> diff --git a/rust/kernel/maple_tree.rs b/rust/kernel/maple_tree.rs
> index 265d6396a78a..2400c905270d 100644
> --- a/rust/kernel/maple_tree.rs
> +++ b/rust/kernel/maple_tree.rs
> @@ -16,7 +16,11 @@
>      alloc::Flags,
>      error::to_result,
>      prelude::*,
> -    types::{ForeignOwnable, Opaque},
> +    types::{
> +        ForeignOwnable,
> +        NotThreadSafe,
> +        Opaque, //
> +    },
>  };
>  
>  /// A maple tree optimized for storing non-overlapping ranges.
> @@ -240,7 +244,10 @@ pub fn lock(&self) -> MapleGuard<'_, T> {
>          unsafe { bindings::spin_lock(self.ma_lock()) };
>  
>          // INVARIANT: We just took the spinlock.
> -        MapleGuard(self)
> +        MapleGuard {
> +            tree: self,
> +            _not_send: NotThreadSafe,
> +        }
>      }
>  
>      #[inline]
> @@ -302,19 +309,29 @@ fn drop(mut self: Pin<&mut Self>) {
>      }
>  }
>  
> +// SAFETY: `MapleTree<T>` is `Send` if `T` is `Send` because `MapleTree` owns its elements.
> +unsafe impl<T: ForeignOwnable + Send> Send for MapleTree<T> {}
> +// SAFETY: `&MapleTree<T>` never hands out `&T`; all entry access is serialized
> +// by `ma_lock` or `&mut Guard`, so `T: Send` suffices (`T: Sync` not required).
> +unsafe impl<T: ForeignOwnable + Send> Sync for MapleTree<T> {}

I think you missed this:

	https://lore.kernel.org/rust-for-linux/aepRx2jgIKmoRp-r@tardis.local/

;-)

But on a second thought, should that (we have methods of `&MapleTree<T>`
-> `&T`) happen, we could always guard those methods with T: Sync. Maybe
it's worth to keep a note on that but, anyway

Reviewed-by: Boqun Feng <boqun@kernel.org>

Regards,
Boqun

> +
>  /// A reference to a [`MapleTree`] that owns the inner lock.
>  ///
>  /// # Invariants
>  ///
>  /// This guard owns the inner spinlock.
>  #[must_use = "if unused, the lock will be immediately unlocked"]
> -pub struct MapleGuard<'tree, T: ForeignOwnable>(&'tree MapleTree<T>);
> +pub struct MapleGuard<'tree, T: ForeignOwnable> {
> +    tree: &'tree MapleTree<T>,
> +    // A held spinlock must be released on the same CPU that acquired it.
> +    _not_send: NotThreadSafe,
> +}
>  
>  impl<'tree, T: ForeignOwnable> Drop for MapleGuard<'tree, T> {
>      #[inline]
>      fn drop(&mut self) {
>          // SAFETY: By the type invariants, we hold this spinlock.
> -        unsafe { bindings::spin_unlock(self.0.ma_lock()) };
> +        unsafe { bindings::spin_unlock(self.tree.ma_lock()) };
>      }
>  }
>  
> @@ -323,7 +340,7 @@ impl<'tree, T: ForeignOwnable> MapleGuard<'tree, T> {
>      pub fn ma_state(&mut self, first: usize, end: usize) -> MaState<'_, T> {
>          // SAFETY: The `MaState` borrows this `MapleGuard`, so it can also borrow the `MapleGuard`s
>          // read/write permissions to the maple tree.
> -        unsafe { MaState::new_raw(self.0, first, end) }
> +        unsafe { MaState::new_raw(self.tree, first, end) }
>      }
>  
>      /// Load the value at the given index.
> @@ -375,7 +392,7 @@ pub fn ma_state(&mut self, first: usize, end: usize) -> MaState<'_, T> {
>      #[inline]
>      pub fn load(&mut self, index: usize) -> Option<T::BorrowedMut<'_>> {
>          // SAFETY: `self.tree` contains a valid maple tree.
> -        let ret = unsafe { bindings::mtree_load(self.0.tree.get(), index) };
> +        let ret = unsafe { bindings::mtree_load(self.tree.tree.get(), index) };
>          if ret.is_null() {
>              return None;
>          }
> -- 
> 2.34.1
> 

Re: [PATCH v2] rust: maple_tree: implement Send and Sync for MapleTree

[Joel Fernandes]

On 5/6/2026 11:46 AM, Boqun Feng wrote:
> On Wed, May 06, 2026 at 09:51:22AM -0400, Joel Fernandes wrote:
>> The C maple_tree struct contains a *mut c_void, which prevents Rust from
>> auto-deriving Send/Sync. Following is an example error message when using
>> MapleTree in nova-core's Vmm.
>>
>> This propagates up through MapleTreeAlloc to Vmm, BarUser, Gpu, and NovaCore,
>> causing NovaCore to fail the Send bound required by pci::Driver:
>>
>>   error[E0277]: `*mut c_void` cannot be sent between threads safely
>>       --> drivers/gpu/nova-core/driver.rs:77:22
>>        |
>>   77   | impl pci::Driver for NovaCore {
>>        |                      ^^^^^^^^ `*mut c_void` cannot be sent between threads safely
>>        |
>>        = help: within `MapleTreeAlloc<()>`, the trait `Send` is not implemented for `*mut c_void`
>>   note: required because it appears within the type `kernel::bindings::maple_tree`
>>   note: required because it appears within the type `Opaque<kernel::bindings::maple_tree>`
>>   note: required because it appears within the type `MapleTree<()>`
>>   note: required because it appears within the type `MapleTreeAlloc<()>`
>>        = note: required for `Box<MapleTreeAlloc<()>, Kmalloc>` to implement `Send`
>>   note: required because it appears within the type `core::pin::Pin<Box<MapleTreeAlloc<()>, Kmalloc>>`
>>   note: required because it appears within the type `Vmm`
>>   note: required because it appears within the type `BarUser`
>>   note: required because it appears within the type `Gpu`
>>   note: required because it appears within the type `NovaCore`
>>   note: required by a bound in `kernel::pci::Driver`
>>       --> rust/kernel/pci.rs:294:19
>>
>> Implement Send and Sync for MapleTree. The tree contains no thread-local
>> state, and all shared access goes through the internal ma_lock spinlock.
>>
>> Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
>> ---
>> RFC->v2: Just adjusted a few comments as suggested by Gary.
>>
>> Sending this separately as discussed in the nova mm patch series that needs it:
>> https://lore.kernel.org/all/252a4eef-f4f4-4edf-8154-06cae4ad8518@nvidia.com/
>>
>>  rust/kernel/maple_tree.rs | 29 +++++++++++++++++++++++------
>>  1 file changed, 23 insertions(+), 6 deletions(-)
>>
>> diff --git a/rust/kernel/maple_tree.rs b/rust/kernel/maple_tree.rs
>> index 265d6396a78a..2400c905270d 100644
>> --- a/rust/kernel/maple_tree.rs
>> +++ b/rust/kernel/maple_tree.rs
>> @@ -16,7 +16,11 @@
>>      alloc::Flags,
>>      error::to_result,
>>      prelude::*,
>> -    types::{ForeignOwnable, Opaque},
>> +    types::{
>> +        ForeignOwnable,
>> +        NotThreadSafe,
>> +        Opaque, //
>> +    },
>>  };
>>  
>>  /// A maple tree optimized for storing non-overlapping ranges.
>> @@ -240,7 +244,10 @@ pub fn lock(&self) -> MapleGuard<'_, T> {
>>          unsafe { bindings::spin_lock(self.ma_lock()) };
>>  
>>          // INVARIANT: We just took the spinlock.
>> -        MapleGuard(self)
>> +        MapleGuard {
>> +            tree: self,
>> +            _not_send: NotThreadSafe,
>> +        }
>>      }
>>  
>>      #[inline]
>> @@ -302,19 +309,29 @@ fn drop(mut self: Pin<&mut Self>) {
>>      }
>>  }
>>  
>> +// SAFETY: `MapleTree<T>` is `Send` if `T` is `Send` because `MapleTree` owns its elements.
>> +unsafe impl<T: ForeignOwnable + Send> Send for MapleTree<T> {}
>> +// SAFETY: `&MapleTree<T>` never hands out `&T`; all entry access is serialized
>> +// by `ma_lock` or `&mut Guard`, so `T: Send` suffices (`T: Sync` not required).
>> +unsafe impl<T: ForeignOwnable + Send> Sync for MapleTree<T> {}
> 
> I think you missed this:
> 
> 	https://lore.kernel.org/rust-for-linux/aepRx2jgIKmoRp-r@tardis.local/
> 
> ;-)

Oops, sorry about that.

> 
> But on a second thought, should that (we have methods of `&MapleTree<T>`
> -> `&T`) happen, we could always guard those methods with T: Sync. Maybe
> it's worth to keep a note on that but, anyway
> 
> Reviewed-by: Boqun Feng <boqun@kernel.org>
Ok, so I will leave as it is then, thanks for the tag!

--
Joel Fernandes

Claude review: rust: maple_tree: implement Send and Sync for MapleTree

[Claude Code Review Bot]

Overall Series Review

Subject: rust: maple_tree: implement Send and Sync for MapleTree
Author: Joel Fernandes <joelagnelf@nvidia.com>
Patches: 3
Reviewed: 2026-05-07T13:26:28.419240

---

This is a single patch (v2) that adds `Send` and `Sync` implementations for `MapleTree<T>` in the Rust kernel bindings. The motivation is clear and well-documented: the C `maple_tree` struct contains a `*mut c_void` which inhibits Rust's auto-trait derivation, blocking downstream users like Nova's `Vmm` from satisfying the `Send` bound required by `pci::Driver`.

The approach is correct and follows established kernel Rust patterns — it mirrors `XArray`'s Send/Sync implementation almost exactly (see `rust/kernel/xarray.rs:272-277`). The `MapleGuard` is also properly made `!Send` via `NotThreadSafe`, which is important since the underlying spinlock must be released on the same CPU that acquired it.

**Overall: This patch looks correct and ready to merge**, with one minor nit below.

---
Generated by Claude Code Patch Reviewer

Claude review: rust: maple_tree: implement Send and Sync for MapleTree

[Claude Code Review Bot]

Patch Review

**Send/Sync implementation — Correct**

The safety argument is sound:

```rust
// SAFETY: `MapleTree<T>` is `Send` if `T` is `Send` because `MapleTree` owns its elements.
unsafe impl<T: ForeignOwnable + Send> Send for MapleTree<T> {}
// SAFETY: `&MapleTree<T>` never hands out `&T`; all entry access is serialized
// by `ma_lock` or `&mut Guard`, so `T: Send` suffices (`T: Sync` not required).
unsafe impl<T: ForeignOwnable + Send> Sync for MapleTree<T> {}
```

This exactly matches the pattern used by `XArray` in the same codebase:
```rust
// SAFETY: `XArray<T>` has no shared mutable state so it is `Send` iff `T` is `Send`.
unsafe impl<T: ForeignOwnable + Send> Send for XArray<T> {}
// SAFETY: `XArray<T>` serialises the interior mutability it provides so it is `Sync` iff `T` is `Send`.
unsafe impl<T: ForeignOwnable + Send> Sync for XArray<T> {}
```

The reasoning for `Sync` only requiring `T: Send` (not `T: Sync`) is correct: `&MapleTree<T>` only allows access to the contained `T` values through the `MapleGuard`, which takes `&mut self` (exclusive access), so you never actually share a `&T` across threads simultaneously.

**MapleGuard !Send — Correct**

```rust
pub struct MapleGuard<'tree, T: ForeignOwnable> {
    tree: &'tree MapleTree<T>,
    // A held spinlock must be released on the same CPU that acquired it.
    _not_send: NotThreadSafe,
}
```

Making the guard `!Send` is essential for correctness. Spinlocks in the kernel must be released on the same CPU where they were acquired. This follows the same pattern used by `XArray`'s guard type. The comment is accurate and useful.

**Struct field access migration — Correct**

All references from `self.0` to `self.tree` are updated consistently:
- `self.0.ma_lock()` → `self.tree.ma_lock()` (in `Drop`)
- `self.0` → `self.tree` (in `ma_state`)
- `self.0.tree.get()` → `self.tree.tree.get()` (in `load`)

**Nit: Trailing comment in import**

```rust
    types::{
        ForeignOwnable,
        NotThreadSafe,
        Opaque, //
    },
```

The bare `//` after `Opaque` looks like a `rustfmt` trailing-comma guard (forces rustfmt to keep the multi-line format). This is a known idiom but it may look odd to reviewers unfamiliar with it. Not a blocking issue — it's a style preference — but worth noting since it was called out in review already and this is v2.

**Missing: `MapleTreeAlloc` Send/Sync**

`MapleTreeAlloc<T>` is `#[repr(transparent)]` around `MapleTree<T>`, so it *should* auto-derive `Send`/`Sync` once `MapleTree<T>` has them. The error trace in the commit message confirms the chain goes through `MapleTreeAlloc`, so this should work without explicit impls. This is fine as-is.

**Verdict: Patch is correct.** The safety invariants are well-reasoned, the pattern matches established precedent (`XArray`), and the `!Send` guard is properly handled. The only cosmetic nit is the `//` comment in the import block.

---
Generated by Claude Code Patch Reviewer

[PATCH v12 00/22] gpu: nova-core: Add memory management support

[Joel Fernandes]

The patches are based on drm-rust-next and work on Ampere, and should work on
Blackwell (with a few more patches) once John's Blackwell patches are merged,
however it does not depend on those patches and can independently go in.

This series depends on Alex Courbot's bitfield series:
https://lore.kernel.org/all/20260409-bitfield-v2-0-23ac400071cb@nvidia.com/

The git tree with all patches can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/jfern/linux.git (tag: nova-mm-v12-20260425)

Change log:

Changes from v11 to v12:
- Make VMM use maple tree for virtual address range management (Danilo)
- Added "rust: maple_tree: implement Send and Sync for MapleTree" sent out before.
- Refactored MMU-version dispatch from wrapper enums (Pte/Pde/DualPde) to
  trait-based generics (PteOps, PdeOps, DualPdeOps, MmuConfig). (Eliot, Alex)
- Replaces the previous `try_access()` patterns with access() (Danilo).
- Added Reviewed-by John Hubbard on some GSP patches.
- Removed the `Static GPU information from GSP.` comment that added no
  information beyond the field name (John Hubbard).
- Removed Nouveau references from one comment (John Hubbard).
- PRAMIN doc: widened address columns in the ASCII diagrams.
- Logged FB region and total VRAM at boot (Alex).
- Dropped a useless `as_ref()` in PRAMIN run_self_test.

Changes from v10 to v11:
- Rebased on new bitfield! macro infrastructure.
- Squashed Zhi Wang's "Use runtime BAR1 size" fix with Co-develop tag (Eliot)
- Refactored page table walker to generics (PtWalkInner<M: MmuConfig>)  (Eliot, Alex)
- Changed first_usable_fb_region() to return Range<u64> with checked_add (Eliot)
- Tightened visibility from pub(crate) to pub(super) across mm submodules (Eliot)
- TLB flush: added ack_globally bit for global engine acknowledgment.

Changes from v9 to v10:
- Rebased and dropped patches already merged in to drm-rust-next.
- GPU_BUDDY select folded into GpuMm patch.
- updated code with new register macro API.
- Refactored fb_regions() to use iterator (Alex Courbot).
- Renamed Pramin::window() to get_window() to make it more clear it is
  'acquiring a resource'.
- Converted Bar0WindowTarget to bounded_enum! macro, replacing TryFrom.
  Allows to use `with_*` instead of `try_with_*`.

Changes from v8 to v9:
- Added fixes from Zhi Wang for bitfield position changes in virtual address
  and larger BAR1 size on some platforms. Tested and working for vGPU usecase!
- Refactored gsp: boot() to return only GspStaticInfo, removing FbLayout (Alex).
- bar1_pde_base and bar2_pde_base are now accessed via GspStaticInfo directly (Alex).
- Added new patch "gsp: Expose total physical VRAM end from FB region info"
  introducing total_fb_end() to expose VRAM extent (Alex).
- Consolidated usable VRAM and BarUser setup; removed dedicated
  "fb: Add usable_vram field to FbLayout", "mm: Use usable VRAM region for
  buddy allocator", and "mm: Add BarUser to struct Gpu and create at boot".

Changes from v7 to v8:
- Incorporated "Select GPU_BUDDY for VRAM allocation" patch from the
  dependency series (Alex).
- Significant patch reordering for better logical flow (GSP/FB patches
  moved earlier, page table patches, Vmm, Bar1, tests) (Alex).
- Replaced several 'as' usages with into_safe_cast() (Danilo, Alex).
- Updated BAR 1 test cases to include exercising the block size API
  (Eliot, Danilo).

Changes from v6 to v7:
- Addressed DMA fence signalling usecase per Danilo's feedback.

Pre v6:
- Simplified PRAMIN code (John Hubbard, Alex Courbot).
- Handled different MMU versions: ver2 versus ver3 (John Hubbard).
- Added BAR1 usecase so we have user of DRM Buddy / VMM (John Hubbard).
- Iterating over clist/buddy bindings.

Link to v11: https://lore.kernel.org/all/20260415210548.3776595-21-joelagnelf@nvidia.com/
Link to v10: https://lore.kernel.org/all/20260331212048.2229260-1-joelagnelf@nvidia.com/
Link to v9: https://lore.kernel.org/all/20260311004008.2208806-1-joelagnelf@nvidia.com/
Link to v8: https://lore.kernel.org/all/20260224225323.3312204-1-joelagnelf@nvidia.com/
Link to v7: https://lore.kernel.org/all/20260218212020.800836-1-joelagnelf@nvidia.com/

Joel Fernandes (22):
  gpu: nova-core: gsp: Return GspStaticInfo from boot()
  gpu: nova-core: gsp: Extract usable FB region from GSP
  gpu: nova-core: gsp: Expose total physical VRAM end from FB region
    info
  gpu: nova-core: mm: Add support to use PRAMIN windows to write to VRAM
  docs: gpu: nova-core: Document the PRAMIN aperture mechanism
  gpu: nova-core: mm: Add common memory management types
  gpu: nova-core: mm: Add TLB flush support
  gpu: nova-core: mm: Add GpuMm centralized memory manager
  gpu: nova-core: mm: Add common types for all page table formats
  gpu: nova-core: mm: Add MMU v2 page table types
  gpu: nova-core: mm: Add MMU v3 page table types
  gpu: nova-core: mm: Add page table entry operation traits
  gpu: nova-core: mm: Add page table walker for MMU v2/v3
  gpu: nova-core: mm: Add Virtual Memory Manager
  gpu: nova-core: mm: Add virtual address range tracking to VMM
  gpu: nova-core: mm: Add multi-page mapping API to VMM
  gpu: nova-core: Add BAR1 aperture type and size constant
  gpu: nova-core: mm: Add BAR1 user interface
  gpu: nova-core: mm: Add BAR1 memory management self-tests
  gpu: nova-core: mm: Add PRAMIN aperture self-tests
  gpu: nova-core: mm: pramin: drop useless as_ref() in run_self_test
  rust: maple_tree: implement Send and Sync for MapleTree

 Documentation/gpu/nova/core/pramin.rst     | 123 +++++
 Documentation/gpu/nova/index.rst           |   1 +
 drivers/gpu/nova-core/Kconfig              |  11 +
 drivers/gpu/nova-core/driver.rs            |   3 +
 drivers/gpu/nova-core/gpu.rs               |  99 +++-
 drivers/gpu/nova-core/gsp/boot.rs          |  12 +-
 drivers/gpu/nova-core/gsp/commands.rs      |  18 +-
 drivers/gpu/nova-core/gsp/fw/commands.rs   |  60 ++-
 drivers/gpu/nova-core/mm.rs                | 267 +++++++++++
 drivers/gpu/nova-core/mm/bar_user.rs       | 400 ++++++++++++++++
 drivers/gpu/nova-core/mm/pagetable.rs      | 418 +++++++++++++++++
 drivers/gpu/nova-core/mm/pagetable/map.rs  | 355 ++++++++++++++
 drivers/gpu/nova-core/mm/pagetable/ver2.rs | 306 ++++++++++++
 drivers/gpu/nova-core/mm/pagetable/ver3.rs | 431 +++++++++++++++++
 drivers/gpu/nova-core/mm/pagetable/walk.rs | 258 +++++++++++
 drivers/gpu/nova-core/mm/pramin.rs         | 515 +++++++++++++++++++++
 drivers/gpu/nova-core/mm/tlb.rs            | 130 ++++++
 drivers/gpu/nova-core/mm/vmm.rs            | 370 +++++++++++++++
 drivers/gpu/nova-core/nova_core.rs         |   1 +
 drivers/gpu/nova-core/regs.rs              |  77 +++
 rust/kernel/maple_tree.rs                  |  29 +-
 21 files changed, 3868 insertions(+), 16 deletions(-)
 create mode 100644 Documentation/gpu/nova/core/pramin.rst
 create mode 100644 drivers/gpu/nova-core/mm.rs
 create mode 100644 drivers/gpu/nova-core/mm/bar_user.rs
 create mode 100644 drivers/gpu/nova-core/mm/pagetable.rs
 create mode 100644 drivers/gpu/nova-core/mm/pagetable/map.rs
 create mode 100644 drivers/gpu/nova-core/mm/pagetable/ver2.rs
 create mode 100644 drivers/gpu/nova-core/mm/pagetable/ver3.rs
 create mode 100644 drivers/gpu/nova-core/mm/pagetable/walk.rs
 create mode 100644 drivers/gpu/nova-core/mm/pramin.rs
 create mode 100644 drivers/gpu/nova-core/mm/tlb.rs
 create mode 100644 drivers/gpu/nova-core/mm/vmm.rs


base-commit: 74a720e00dfbb3ab92934660b4692b90331623ac
-- 
2.34.1

[PATCH v12 22/22] rust: maple_tree: implement Send and Sync for MapleTree

[Joel Fernandes]

The C maple_tree struct contains a *mut c_void, which prevents Rust from
auto-deriving Send/Sync. Following is an example error message when using
MapleTree in nova-core's Vmm.

This propagates up through MapleTreeAlloc to Vmm, BarUser, Gpu, and NovaCore,
causing NovaCore to fail the Send bound required by pci::Driver:

  error[E0277]: `*mut c_void` cannot be sent between threads safely
      --> drivers/gpu/nova-core/driver.rs:77:22
       |
  77   | impl pci::Driver for NovaCore {
       |                      ^^^^^^^^ `*mut c_void` cannot be sent between threads safely
       |
       = help: within `MapleTreeAlloc<()>`, the trait `Send` is not implemented for `*mut c_void`
  note: required because it appears within the type `kernel::bindings::maple_tree`
  note: required because it appears within the type `Opaque<kernel::bindings::maple_tree>`
  note: required because it appears within the type `MapleTree<()>`
  note: required because it appears within the type `MapleTreeAlloc<()>`
       = note: required for `Box<MapleTreeAlloc<()>, Kmalloc>` to implement `Send`
  note: required because it appears within the type `core::pin::Pin<Box<MapleTreeAlloc<()>, Kmalloc>>`
  note: required because it appears within the type `Vmm`
  note: required because it appears within the type `BarUser`
  note: required because it appears within the type `Gpu`
  note: required because it appears within the type `NovaCore`
  note: required by a bound in `kernel::pci::Driver`
      --> rust/kernel/pci.rs:294:19

Implement Send and Sync for MapleTree. The tree contains no thread-local
state, and all shared access goes through the internal ma_lock spinlock.

Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
---
 rust/kernel/maple_tree.rs | 29 +++++++++++++++++++++++------
 1 file changed, 23 insertions(+), 6 deletions(-)

diff --git a/rust/kernel/maple_tree.rs b/rust/kernel/maple_tree.rs
index 265d6396a78a..2400c905270d 100644
--- a/rust/kernel/maple_tree.rs
+++ b/rust/kernel/maple_tree.rs
@@ -16,7 +16,11 @@
     alloc::Flags,
     error::to_result,
     prelude::*,
-    types::{ForeignOwnable, Opaque},
+    types::{
+        ForeignOwnable,
+        NotThreadSafe,
+        Opaque, //
+    },
 };
 
 /// A maple tree optimized for storing non-overlapping ranges.
@@ -240,7 +244,10 @@ pub fn lock(&self) -> MapleGuard<'_, T> {
         unsafe { bindings::spin_lock(self.ma_lock()) };
 
         // INVARIANT: We just took the spinlock.
-        MapleGuard(self)
+        MapleGuard {
+            tree: self,
+            _not_send: NotThreadSafe,
+        }
     }
 
     #[inline]
@@ -302,19 +309,29 @@ fn drop(mut self: Pin<&mut Self>) {
     }
 }
 
+// SAFETY: `MapleTree<T>` is `Send` if `T` is `Send` because `MapleTree` owns its elements.
+unsafe impl<T: ForeignOwnable + Send> Send for MapleTree<T> {}
+// SAFETY: `&MapleTree<T>` never hands out `&T`; all entry access is serialized
+// by `ma_lock` or `&mut Guard`, so `T: Send` suffices (`T: Sync` not required).
+unsafe impl<T: ForeignOwnable + Send> Sync for MapleTree<T> {}
+
 /// A reference to a [`MapleTree`] that owns the inner lock.
 ///
 /// # Invariants
 ///
 /// This guard owns the inner spinlock.
 #[must_use = "if unused, the lock will be immediately unlocked"]
-pub struct MapleGuard<'tree, T: ForeignOwnable>(&'tree MapleTree<T>);
+pub struct MapleGuard<'tree, T: ForeignOwnable> {
+    tree: &'tree MapleTree<T>,
+    // A held spinlock must be released on the same CPU that acquired it.
+    _not_send: NotThreadSafe,
+}
 
 impl<'tree, T: ForeignOwnable> Drop for MapleGuard<'tree, T> {
     #[inline]
     fn drop(&mut self) {
         // SAFETY: By the type invariants, we hold this spinlock.
-        unsafe { bindings::spin_unlock(self.0.ma_lock()) };
+        unsafe { bindings::spin_unlock(self.tree.ma_lock()) };
     }
 }
 
@@ -323,7 +340,7 @@ impl<'tree, T: ForeignOwnable> MapleGuard<'tree, T> {
     pub fn ma_state(&mut self, first: usize, end: usize) -> MaState<'_, T> {
         // SAFETY: The `MaState` borrows this `MapleGuard`, so it can also borrow the `MapleGuard`s
         // read/write permissions to the maple tree.
-        unsafe { MaState::new_raw(self.0, first, end) }
+        unsafe { MaState::new_raw(self.tree, first, end) }
     }
 
     /// Load the value at the given index.
@@ -375,7 +392,7 @@ pub fn ma_state(&mut self, first: usize, end: usize) -> MaState<'_, T> {
     #[inline]
     pub fn load(&mut self, index: usize) -> Option<T::BorrowedMut<'_>> {
         // SAFETY: `self.tree` contains a valid maple tree.
-        let ret = unsafe { bindings::mtree_load(self.0.tree.get(), index) };
+        let ret = unsafe { bindings::mtree_load(self.tree.tree.get(), index) };
         if ret.is_null() {
             return None;
         }
-- 
2.34.1

Claude review: rust: maple_tree: implement Send and Sync for MapleTree

[Claude Code Review Bot]

Patch Review

Adds manual `Send`/`Sync` impls for `MapleTree<T>` (where `T: ForeignOwnable + Send`) and makes `MapleGuard` `!Send` via `NotThreadSafe`.

**The `Sync` safety argument deserves scrutiny:** The comment says `&MapleTree<T>` never hands out `&T` — all access goes through `ma_lock` via `MapleGuard`. This appears correct: `lock()` returns a `MapleGuard` requiring `&mut` for value access. The `T: Send` (not `T: Sync`) bound for the `Sync` impl is the right choice since values are effectively "moved" under the lock.

**This modifies shared kernel Rust infrastructure** (`rust/kernel/maple_tree.rs`), not just nova-core. It should get explicit review from Rust-for-Linux maintainers (who are CC'd).

The `NotThreadSafe` marker on `MapleGuard` is correct — spinlocks must be released on the same CPU that acquired them.

---
Generated by Claude Code Patch Reviewer