linux.git/drivers/gpu/drm/hyperv, branch master

drm/hyperv: validate VMBus packet size in receive callback

2026-05-25T11:31:53+00:00

hyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one
of four message-type branches without knowing how many bytes the host
wrote into hv->recv_buf. The completion path then runs
memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that
wakes on wait_for_completion_timeout() can read up to 16 KiB of
residue from a prior message as if it were the response payload.

Pass bytes_recvd into hyperv_receive_sub() and reject any packet that
does not cover the pipe + synthvid header. A single switch on
msg->vid_hdr.type then computes the type-specific payload size: the
three completion-driving types (SYNTHVID_VERSION_RESPONSE,
SYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through
to a shared exit that requires that size before memcpy/complete, while
SYNTHVID_FEATURE_CHANGE validates its own payload and returns before
reading is_dirt_needed. Unknown types are dropped.

SYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills
resolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT
array. Validate the fixed prefix first so resolution_count can be
read, bound it against the array, then require only the count-sized
array, so the shorter responses the host actually sends are accepted.

Only run the sub-handler when vmbus_recvpacket() returned success. The
memcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE
only on a successful receive; on -ENOBUFS vmbus_recvpacket() instead
reports the required length, which can exceed hv->recv_buf, so copying
bytes_recvd would read and write past the 16 KiB buffers. Gating on the
success return keeps the copy bounded. The nonzero-return path is itself
a malformed-message case and is now logged rather than silently skipped;
channel recovery is not attempted.

Rejected packets are reported via drm_err_ratelimited() rather than
silently dropped, matching the CoCo-hardened pattern in
hv_kvp_onchannelcallback().

Fixes: 76c56a5affeb ("drm/hyperv: Add DRM driver for hyperv synthetic video device")
Cc: stable@vger.kernel.org # 5.14+
Signed-off-by: Berkant Koc 
Assisted-by: Claude:claude-opus-4-7 berkoc-pipeline
Reviewed-by: Michael Kelley 
Tested-by: Michael Kelley 
Signed-off-by: Hamza Mahfooz 
Link: https://patch.msgid.link/8200dbc199c7a9b75ac7e8af6c748d2189b5ebd5.1779542874.git.me@berkoc.com

drm/hyperv: validate resolution_count and fix WIN8 fallback

2026-05-25T11:31:36+00:00

A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 walks past
the supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT] array in the
parse loop. Bound resolution_count against the array size, folded
into the existing zero-check.

When the WIN10 resolution probe fails, the caller in
hyperv_connect_vsp() left hv->screen_*_max / preferred_* unpopulated,
which sets mode_config.max_width / max_height to 0 and makes
drm_internal_framebuffer_create() reject every userspace framebuffer
with -EINVAL. The pre-WIN10 branch had the same gap for
preferred_width / preferred_height. Use a single post-probe fallback
guarded by screen_width_max == 0 so both paths converge on the WIN8
defaults.

Signed-off-by: Berkant Koc 
Assisted-by: Claude:claude-opus-4-7 berkoc-pipeline
Fixes: 76c56a5affeb ("drm/hyperv: Add DRM driver for hyperv synthetic video device")
Cc: stable@vger.kernel.org # 5.14+
Reviewed-by: Michael Kelley 
Tested-by: Michael Kelley 
Signed-off-by: Hamza Mahfooz 
Link: https://patch.msgid.link/6945b22419c7d404b4954a113de2ac9c900dba93.1779542874.git.me@berkoc.com

drm/hyperv: Remove reference to hyperv_fb driver

2026-02-14T10:09:38+00:00

Remove hyperv_fb reference as the driver is removed.

Signed-off-by: Prasanna Kumar T S M 
Signed-off-by: Helge Deller

drm/hyperv: move Kconfig under driver directory

2025-12-10T09:02:53+00:00

Almost all DRM driver Kconfig options are in dedicated Kconfig files
under driver directories. Follow suit in hyperv.

Cc: Deepak Rawat 
Reviewed-by: Deepak Rawat 
Reviewed-by: Maarten Lankhorst 
Link: https://patch.msgid.link/4923196ab968bfdbcc2d7572d9be9886c32c06c9.1762251845.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula

drm/hyperv: include drm_print.h where needed

2025-11-04T12:37:15+00:00

hyperv_drm_drv.c and hyperv_drm_modeset.c depend on drm_print.h being
indirectly included via drm_buddy.h, drm_mm.h, or
ttm/ttm_resource.h. Include drm_print.h explicitly.

Reported-by: Stephen Rothwell 
Closes: https://lore.kernel.org/r/20251104101158.1cc9abcd@canb.auug.org.au
Fixes: f6e8dc9edf96 ("drm: include drm_print.h where needed")
Cc: Thomas Zimmermann 
Reviewed-by: Thomas Zimmermann 
Link: https://patch.msgid.link/20251104100253.646577-1-jani.nikula@intel.com
Signed-off-by: Jani Nikula

drm/hypervdrm: Use vblank timer

2025-10-01T06:32:02+00:00

HyperV's virtual hardware does not provide vblank interrupts. Use a
vblank timer to simulate the interrupt. Rate-limits the display's
update frequency to the display-mode settings. Avoids excessive CPU
overhead with compositors that do not rate-limit their output.

Signed-off-by: Thomas Zimmermann 
Reviewed-by: Javier Martinez Canillas 
Tested-by: Michael Kelley 
Tested-by: Prasanna Kumar T S M 
Link: https://lore.kernel.org/r/20250916083816.30275-5-tzimmermann@suse.de

drm/hyperv: Add support for drm_panic

2025-06-05T12:59:56+00:00

Add drm_panic module for hyperv drm so that panic screen can be
displayed on panic.

Signed-off-by: Ryosuke Yasuoka 
Reviewed-by: Jocelyn Falempe 
Link: https://lore.kernel.org/r/20250526090117.80593-2-ryasuoka@redhat.com
Signed-off-by: Jocelyn Falempe

drm/hyperv: Replace simple-KMS with regular atomic helpers

2025-05-15T12:31:38+00:00

Drop simple-KMS in favor of regular atomic helpers to make the code more
modular. The simple-KMS helper mix up plane and CRTC state, so it is
obsolete and should go away [1]. Since it just split the simple-pipe
functions into per-plane and per-CRTC, no functional changes is
expected.

[1] https://lore.kernel.org/lkml/dae5089d-e214-4518-b927-5c4149babad8@suse.de/

Acked-by: Javier Martinez Canillas 
Signed-off-by: Ryosuke Yasuoka 
Link: https://lore.kernel.org/r/20250427101825.812766-1-ryasuoka@redhat.com
Signed-off-by: Jocelyn Falempe

drm/hyperv: Fix address space leak when Hyper-V DRM device is removed

2025-03-09T23:46:56+00:00

When a Hyper-V DRM device is probed, the driver allocates MMIO space for
the vram, and maps it cacheable. If the device removed, or in the error
path for device probing, the MMIO space is released but no unmap is done.
Consequently the kernel address space for the mapping is leaked.

Fix this by adding iounmap() calls in the device removal path, and in the
error path during device probing.

Fixes: f1f63cbb705d ("drm/hyperv: Fix an error handling path in hyperv_vmbus_probe()")
Fixes: a0ab5abced55 ("drm/hyperv : Removing the restruction of VRAM allocation with PCI bar size")
Signed-off-by: Michael Kelley 
Reviewed-by: Saurabh Sengar 
Tested-by: Saurabh Sengar 
Link: https://lore.kernel.org/r/20250210193441.2414-1-mhklinux@outlook.com
Signed-off-by: Wei Liu 
Message-ID: <20250210193441.2414-1-mhklinux@outlook.com>

drm: remove driver date from struct drm_driver and all drivers

2024-12-05T10:35:42+00:00

We stopped using the driver initialized date in commit 7fb8af6798e8
("drm: deprecate driver date") and (eventually) started returning "0"
for drm_version ioctl instead.

Finish the job, and remove the unused date member from struct
drm_driver, its initialization from drivers, along with the common
DRIVER_DATE macros.

v2: Also update drivers/accel (kernel test robot)

Reviewed-by: Javier Martinez Canillas 
Acked-by: Alex Deucher 
Acked-by: Simon Ser 
Acked-by: Jeffrey Hugo 
Acked-by: Lucas De Marchi 
Acked-by: Dmitry Baryshkov  # msm
Reviewed-by: Thomas Zimmermann 
Link: https://patchwork.freedesktop.org/patch/msgid/1f2bf2543aed270a06f6c707fd6ed1b78bf16712.1733322525.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula