linux-stable.git/drivers/gpu/drm/virtio, branch v6.14

drm/virtio: Fix UAF in virtgpu_dma_buf_free_obj()

2025-01-19T12:12:28+00:00

Fix the following issues identified by Smatch static checker:
- The call to dma_buf_put(attach->dmabuf) after dma_buf_detach()
  leads to a UAF bug as dma_buf_detach() frees the attach object.
  Fix this by extracting the dmabuf object from attach and using
  that in the call to dma_buf_put().

- The resv object is extracted from attach before checking to see
  if attach is valid (that is !NULL) or not. Although, attach would
  very likely be valid, fix this by making sure that the resv object
  is used only after ensuring that attach is valid.

Fixes: 2885e575abc7 ("drm/virtio: Add helpers to initialize and free the imported object")
Fixes: ca77f27a2665 ("drm/virtio: Import prime buffers from other devices as guest blobs")
Cc: Gerd Hoffmann 
Cc: Dmitry Osipenko 
Cc: Gurchetan Singh 
Cc: Chia-I Wu 
Reported-by: Dan Carpenter 
Signed-off-by: Vivek Kasireddy 
Link: https://patchwork.freedesktop.org/patch/msgid/20241212055421.775759-1-vivek.kasireddy@intel.com
Reviewed-by: Dmitry Osipenko 
Tested-by: Dmitry Osipenko 
Signed-off-by: Dmitry Osipenko 
[dmitry.osipenko@collabora.com: Edited commit title]

Merge remote-tracking branch 'drm/drm-next' into drm-misc-next

2024-12-09T15:35:21+00:00

The v6.13-rc2 release included a bunch of breaking changes,
specifically the MODULE_IMPORT_NS commit.

Backmerge in order to fix them before the next pull-request.

Include the fix from Stephen Roswell.

Caused by commit

  25c3fd1183c0 ("drm/virtio: Add a helper to map and note the dma addrs and lengths")

Interacting with commit

  cdd30ebb1b9f ("module: Convert symbol namespace to string literal")

Reported-by: Stephen Rothwell 
Link: https://patchwork.freedesktop.org/patch/msgid/20241209121717.2abe8026@canb.auug.org.au
Signed-off-by: Maarten Lankhorst

drm: remove driver date from struct drm_driver and all drivers

2024-12-05T10:35:42+00:00

We stopped using the driver initialized date in commit 7fb8af6798e8
("drm: deprecate driver date") and (eventually) started returning "0"
for drm_version ioctl instead.

Finish the job, and remove the unused date member from struct
drm_driver, its initialization from drivers, along with the common
DRIVER_DATE macros.

v2: Also update drivers/accel (kernel test robot)

Reviewed-by: Javier Martinez Canillas 
Acked-by: Alex Deucher 
Acked-by: Simon Ser 
Acked-by: Jeffrey Hugo 
Acked-by: Lucas De Marchi 
Acked-by: Dmitry Baryshkov  # msm
Reviewed-by: Thomas Zimmermann 
Link: https://patchwork.freedesktop.org/patch/msgid/1f2bf2543aed270a06f6c707fd6ed1b78bf16712.1733322525.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula

drm/virtio: Add prepare and cleanup routines for imported dmabuf obj

2024-11-26T10:28:02+00:00

When an imported dmabuf obj is used as part of an atomic commit, we
need to pin it as part of prepare and unpin it during cleanup of
the associated FB, to make sure that it does not move until the
commit is completed (and also while it is being used on the Host).

Cc: Gerd Hoffmann 
Cc: Dmitry Osipenko 
Cc: Rob Clark 
Cc: Gurchetan Singh 
Cc: Chia-I Wu 
Signed-off-by: Vivek Kasireddy 
Tested-by: Dmitry Osipenko 
Reviewed-by: Dmitry Osipenko 
Signed-off-by: Dmitry Osipenko 
Link: https://patchwork.freedesktop.org/patch/msgid/20241126031643.3490496-6-vivek.kasireddy@intel.com

drm/virtio: Import prime buffers from other devices as guest blobs

2024-11-26T10:27:15+00:00

By importing scanout buffers from other devices, we should be able
to use the virtio-gpu driver in KMS only mode. Note that we attach
dynamically and register a move_notify() callback so that we can
let the VMM know of any location changes associated with the backing
store of the imported object by sending detach_backing cmd.

Cc: Gerd Hoffmann 
Cc: Dmitry Osipenko 
Cc: Rob Clark 
Cc: Gurchetan Singh 
Cc: Chia-I Wu 
Signed-off-by: Vivek Kasireddy 
Tested-by: Dmitry Osipenko 
Reviewed-by: Dmitry Osipenko 
Signed-off-by: Dmitry Osipenko 
[dmitry.osipenko@collabora.com: added kref check to move_notify]
Link: https://patchwork.freedesktop.org/patch/msgid/20241126031643.3490496-5-vivek.kasireddy@intel.com

drm/virtio: Add helpers to initialize and free the imported object

2024-11-26T09:52:52+00:00

The imported object can be considered a guest blob resource;
therefore, we use create_blob cmd while creating it. These helpers
are used in the next patch which does the actual import.

Cc: Gerd Hoffmann 
Cc: Dmitry Osipenko 
Cc: Rob Clark 
Cc: Gurchetan Singh 
Cc: Chia-I Wu 
Signed-off-by: Vivek Kasireddy 
Tested-by: Dmitry Osipenko 
Reviewed-by: Dmitry Osipenko 
Signed-off-by: Dmitry Osipenko 
Link: https://patchwork.freedesktop.org/patch/msgid/20241126031643.3490496-4-vivek.kasireddy@intel.com

drm/virtio: Add a helper to map and note the dma addrs and lengths

2024-11-26T09:52:45+00:00

This helper would be used when first initializing the object as
part of import and also when updating the plane where we need to
ensure that the imported object's backing is valid.

Cc: Gerd Hoffmann 
Cc: Dmitry Osipenko 
Cc: Rob Clark 
Cc: Gurchetan Singh 
Cc: Chia-I Wu 
Signed-off-by: Vivek Kasireddy 
Tested-by: Dmitry Osipenko 
Reviewed-by: Dmitry Osipenko 
Signed-off-by: Dmitry Osipenko 
Link: https://patchwork.freedesktop.org/patch/msgid/20241126031643.3490496-3-vivek.kasireddy@intel.com

drm/virtio: Implement VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING cmd

2024-11-26T09:52:18+00:00

This cmd is useful to let the VMM (i.e, Qemu) know that the backing
store associated with a resource is no longer valid, so that the VMM
can perform any cleanup or unmap operations.

The fence related changes and virtio_gpu_object_detach()/
virtio_gpu_detach_object_fenced() routines are extracted from a
patch by Dmitry Osipenko .

Cc: Gerd Hoffmann 
Cc: Dmitry Osipenko 
Cc: Rob Clark 
Cc: Gurchetan Singh 
Cc: Chia-I Wu 
Signed-off-by: Vivek Kasireddy 
Tested-by: Dmitry Osipenko 
Reviewed-by: Dmitry Osipenko 
Signed-off-by: Dmitry Osipenko 
Link: https://patchwork.freedesktop.org/patch/msgid/20241126031643.3490496-2-vivek.kasireddy@intel.com

drm/virtio: New fence for every plane update

2024-11-18T18:18:15+00:00

Having a fence linked to a virtio_gpu_framebuffer in the plane update
sequence would cause conflict when several planes referencing the same
framebuffer (e.g. Xorg screen covering multi-displays configured for an
extended mode) and those planes are updated concurrently. So it is needed
to allocate a fence for every plane state instead of the framebuffer.

Signed-off-by: Dongwon Kim 
[dmitry.osipenko@collabora.com: rebase, fix up, edit commit message]
Signed-off-by: Dmitry Osipenko 
Acked-by: Vivek Kasireddy 
Reviewed-by: Rob Clark 
Link: https://patchwork.freedesktop.org/patch/msgid/20241020230803.247419-2-dmitry.osipenko@collabora.com

drm/virtio: Use drm_gem_plane_helper_prepare_fb()

2024-11-18T18:18:13+00:00

Use drm_gem_plane_helper_prepare_fb() helper for explicit framebuffer
synchronization. We need to wait for explicit fences in a case of
Venus and native contexts when guest user space uses explicit fencing.

Signed-off-by: Dongwon Kim 
[dmitry.osipenko@collabora.com: edit commit message]
Signed-off-by: Dmitry Osipenko 
Acked-by: Vivek Kasireddy 
Reviewed-by: Rob Clark 
Link: https://patchwork.freedesktop.org/patch/msgid/20241020230803.247419-1-dmitry.osipenko@collabora.com