drm/asahi: Add robust_isolation kernel parameter

This only allows binding one VM context at once, which serializes GPU
usage between VMs and therefore prevents one faulting VM from affecting
others.

Signed-off-by: Asahi Lina <lina@asahilina.net>

Author: hoshinolina

drivers/gpu/drm/asahi/asahi.rs

@@ -48,5 +48,10 @@ module_platform_driver! {
             permissions: 0o644,
             description: "Initial TVB size in blocks",
         },
+        robust_isolation: bool {
+            default: false,
+            permissions: 0o644,
+            description: "Fully isolate GPU contexts (limits performance)",
+        },
     },
 }

drivers/gpu/drm/asahi/mmu.rs

@@ -12,6 +12,7 @@
 
 use core::fmt::Debug;
 use core::mem::size_of;
+use core::num::NonZeroUsize;
 use core::ops::Range;
 use core::ptr::NonNull;
 use core::sync::atomic::{fence, AtomicU32, AtomicU64, AtomicU8, Ordering};
@@ -1459,6 +1460,17 @@ impl Uat {
         if binding.binding.is_none() {
             assert_eq!(binding.active_users, 0);
 
+            let isolation = {
+                let lock = crate::THIS_MODULE.kernel_param_lock();
+                *crate::robust_isolation.read(&lock)
+            };
+
+            self.slots.set_limit(if isolation {
+                NonZeroUsize::new(1)
+            } else {
+                None
+            });
+
             let slot = self.slots.get(binding.bind_token)?;
             if slot.changed() {
                 mod_pr_debug!("Vm Bind [{}]: bind_token={:?}\n", vm.id, slot.token(),);

drivers/gpu/drm/asahi/slotalloc.rs

@@ -15,6 +15,7 @@
 //! of serious system contention most allocation requests will be immediately fulfilled from the
 //! previous slot without doing an LRU scan.
 
+use core::num::NonZeroUsize;
 use core::ops::{Deref, DerefMut};
 use kernel::{
     alloc::{flags::*, vec_ext::VecExt},
@@ -108,6 +109,7 @@ struct SlotAllocatorInner<T: SlotItem> {
     slots: Vec<Option<Entry<T>>>,
     get_count: u64,
     drop_count: u64,
+    slot_limit: usize,
 }
 
 /// A single slot allocator instance.
@@ -156,6 +158,7 @@ impl<T: SlotItem> SlotAllocator<T> {
             slots,
             get_count: 0,
             drop_count: 0,
+            slot_limit: usize::MAX,
         };
 
         let alloc = Arc::pin_init(
@@ -177,6 +180,13 @@ impl<T: SlotItem> SlotAllocator<T> {
         cb(&mut inner.data)
     }
 
+    /// Set the slot limit for this allocator. New bindings will not use slots above
+    /// this threshold.
+    pub(crate) fn set_limit(&self, limit: Option<NonZeroUsize>) {
+        let mut inner = self.0.inner.lock();
+        inner.slot_limit = limit.unwrap_or(NonZeroUsize::MAX).get();
+    }
+
     /// Gets a fresh slot, optionally reusing a previous allocation if a `SlotToken` is provided.
     ///
     /// Blocks if no slots are free.
@@ -200,18 +210,20 @@ impl<T: SlotItem> SlotAllocator<T> {
         let mut inner = self.0.inner.lock();
 
         if let Some(token) = token {
-            let slot = &mut inner.slots[token.slot as usize];
-            if slot.is_some() {
-                let count = slot.as_ref().unwrap().get_time;
-                if count == token.time {
-                    let mut guard = Guard {
-                        item: Some(slot.take().unwrap().item),
-                        token,
-                        changed: false,
-                        alloc: self.0.clone(),
-                    };
-                    cb(&mut inner.data, &mut guard)?;
-                    return Ok(guard);
+            if (token.slot as usize) < inner.slot_limit {
+                let slot = &mut inner.slots[token.slot as usize];
+                if slot.is_some() {
+                    let count = slot.as_ref().unwrap().get_time;
+                    if count == token.time {
+                        let mut guard = Guard {
+                            item: Some(slot.take().unwrap().item),
+                            token,
+                            changed: false,
+                            alloc: self.0.clone(),
+                        };
+                        cb(&mut inner.data, &mut guard)?;
+                        return Ok(guard);
+                    }
                 }
             }
         }
@@ -222,6 +234,9 @@ impl<T: SlotItem> SlotAllocator<T> {
             let mut oldest_slot = 0u32;
 
             for (i, slot) in inner.slots.iter().enumerate() {
+                if i >= inner.slot_limit {
+                    break;
+                }
                 if let Some(slot) = slot.as_ref() {
                     if slot.drop_time < oldest_time {
                         oldest_slot = i as u32;
@@ -231,7 +246,7 @@ impl<T: SlotItem> SlotAllocator<T> {
             }
 
             if oldest_time == u64::MAX {
-                if first {
+                if first && inner.slot_limit == usize::MAX {
                     pr_warn!(
                         "{}: out of slots, blocking\n",
                         core::any::type_name::<Self>()