1. 29 Mar, 2022 2 commits
  2. 28 Mar, 2022 9 commits
  3. 25 Mar, 2022 3 commits
    • Cong Liu's avatar
      drm/qxl: fix qxl can't use in arm64 · 59ab4ee0
      Cong Liu authored
      qxl use ioremap to map ram_header and rom, in the arm64 implementation,
      the device is mapped as DEVICE_nGnRE, it can not support unaligned
      access. and qxl is a virtual device, it can be treated more like RAM
      than actual MMIO registers. use ioremap_wc() replace it.
      Signed-off-by: default avatarCong Liu <liucong2@kylinos.cn>
      Acked-by: default avatarChristian König <christian.koenig@amd.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20220324104928.2959545-1-liucong2@kylinos.cnSigned-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
      59ab4ee0
    • Rob Clark's avatar
      drm/virtio: Remove restriction of non-zero blob_flags · ec3cbb30
      Rob Clark authored
      With native userspace drivers in guest, a lot of GEM objects need to be
      neither shared nor mappable.  And in fact making everything mappable
      and/or sharable results in unreasonably high fd usage in host VMM.
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      Reviewed-by: default avatarChia-I Wu <olvaffe@gmail.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20220219170301.545432-1-robdclark@gmail.comSigned-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
      ec3cbb30
    • Liu Zixian's avatar
      drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes · 194d250c
      Liu Zixian authored
      drm_cvt_mode may return NULL and we should check it.
      
      This bug is found by syzkaller:
      
      FAULT_INJECTION stacktrace:
      [  168.567394] FAULT_INJECTION: forcing a failure.
      name failslab, interval 1, probability 0, space 0, times 1
      [  168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1
      [  168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
      [  168.567408] Call trace:
      [  168.567414]  dump_backtrace+0x0/0x310
      [  168.567418]  show_stack+0x28/0x38
      [  168.567423]  dump_stack+0xec/0x15c
      [  168.567427]  should_fail+0x3ac/0x3d0
      [  168.567437]  __should_failslab+0xb8/0x120
      [  168.567441]  should_failslab+0x28/0xc0
      [  168.567445]  kmem_cache_alloc_trace+0x50/0x640
      [  168.567454]  drm_mode_create+0x40/0x90
      [  168.567458]  drm_cvt_mode+0x48/0xc78
      [  168.567477]  virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu]
      [  168.567485]  drm_helper_probe_single_connector_modes+0x3a4/0xd80
      [  168.567492]  drm_mode_getconnector+0x2e0/0xa70
      [  168.567496]  drm_ioctl_kernel+0x11c/0x1d8
      [  168.567514]  drm_ioctl+0x558/0x6d0
      [  168.567522]  do_vfs_ioctl+0x160/0xf30
      [  168.567525]  ksys_ioctl+0x98/0xd8
      [  168.567530]  __arm64_sys_ioctl+0x50/0xc8
      [  168.567536]  el0_svc_common+0xc8/0x320
      [  168.567540]  el0_svc_handler+0xf8/0x160
      [  168.567544]  el0_svc+0x10/0x218
      
      KASAN stacktrace:
      [  168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu]
      [  168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425
      [  168.567566]
      [  168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1
      [  168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
      [  168.567575] Call trace:
      [  168.567578]  dump_backtrace+0x0/0x310
      [  168.567582]  show_stack+0x28/0x38
      [  168.567586]  dump_stack+0xec/0x15c
      [  168.567591]  kasan_report+0x244/0x2f0
      [  168.567594]  __asan_load4+0x58/0xb0
      [  168.567607]  virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu]
      [  168.567612]  drm_helper_probe_single_connector_modes+0x3a4/0xd80
      [  168.567617]  drm_mode_getconnector+0x2e0/0xa70
      [  168.567621]  drm_ioctl_kernel+0x11c/0x1d8
      [  168.567624]  drm_ioctl+0x558/0x6d0
      [  168.567628]  do_vfs_ioctl+0x160/0xf30
      [  168.567632]  ksys_ioctl+0x98/0xd8
      [  168.567636]  __arm64_sys_ioctl+0x50/0xc8
      [  168.567641]  el0_svc_common+0xc8/0x320
      [  168.567645]  el0_svc_handler+0xf8/0x160
      [  168.567649]  el0_svc+0x10/0x218
      Signed-off-by: default avatarLiu Zixian <liuzixian4@huawei.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/20220322091730.1653-1-liuzixian4@huawei.comSigned-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
      194d250c
  4. 24 Mar, 2022 15 commits
  5. 23 Mar, 2022 7 commits
  6. 21 Mar, 2022 4 commits
    • Ville Syrjälä's avatar
      drm/tilcdc: Use drm_mode_copy() · 6185587b
      Ville Syrjälä authored
      struct drm_display_mode embeds a list head, so overwriting
      the full struct with another one will corrupt the list
      (if the destination mode is on a list). Use drm_mode_copy()
      instead which explicitly preserves the list head of
      the destination mode.
      
      Even if we know the destination mode is not on any list
      using drm_mode_copy() seems decent as it sets a good
      example. Bad examples of not using it might eventually
      get copied into code where preserving the list head
      actually matters.
      
      Obviously one case not covered here is when the mode
      itself is embedded in a larger structure and the whole
      structure is copied. But if we are careful when copying
      into modes embedded in structures I think we can be a
      little more reassured that bogus list heads haven't been
      propagated in.
      
      @is_mode_copy@
      @@
      drm_mode_copy(...)
      {
      ...
      }
      
      @depends on !is_mode_copy@
      struct drm_display_mode *mode;
      expression E, S;
      @@
      (
      - *mode = E
      + drm_mode_copy(mode, &E)
      |
      - memcpy(mode, E, S)
      + drm_mode_copy(mode, E)
      )
      
      @depends on !is_mode_copy@
      struct drm_display_mode mode;
      expression E;
      @@
      (
      - mode = E
      + drm_mode_copy(&mode, &E)
      |
      - memcpy(&mode, E, S)
      + drm_mode_copy(&mode, E)
      )
      
      @@
      struct drm_display_mode *mode;
      @@
      - &*mode
      + mode
      
      Cc: Jyri Sarha <jyri.sarha@iki.fi>
      Cc: Tomi Valkeinen <tomba@kernel.org>
      Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220218100403.7028-17-ville.syrjala@linux.intel.comReviewed-by: default avatarTomi Valkeinen <tomi.valkeinen@ideasonboard.com>
      6185587b
    • Ville Syrjälä's avatar
      drm/gma500: Use drm_mode_copy() · cc436b1c
      Ville Syrjälä authored
      struct drm_display_mode embeds a list head, so overwriting
      the full struct with another one will corrupt the list
      (if the destination mode is on a list). Use drm_mode_copy()
      instead which explicitly preserves the list head of
      the destination mode.
      
      Even if we know the destination mode is not on any list
      using drm_mode_copy() seems decent as it sets a good
      example. Bad examples of not using it might eventually
      get copied into code where preserving the list head
      actually matters.
      
      Obviously one case not covered here is when the mode
      itself is embedded in a larger structure and the whole
      structure is copied. But if we are careful when copying
      into modes embedded in structures I think we can be a
      little more reassured that bogus list heads haven't been
      propagated in.
      
      @is_mode_copy@
      @@
      drm_mode_copy(...)
      {
      ...
      }
      
      @depends on !is_mode_copy@
      struct drm_display_mode *mode;
      expression E, S;
      @@
      (
      - *mode = E
      + drm_mode_copy(mode, &E)
      |
      - memcpy(mode, E, S)
      + drm_mode_copy(mode, E)
      )
      
      @depends on !is_mode_copy@
      struct drm_display_mode mode;
      expression E;
      @@
      (
      - mode = E
      + drm_mode_copy(&mode, &E)
      |
      - memcpy(&mode, E, S)
      + drm_mode_copy(&mode, E)
      )
      
      @@
      struct drm_display_mode *mode;
      @@
      - &*mode
      + mode
      
      Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
      Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220218100403.7028-8-ville.syrjala@linux.intel.comAcked-by: default avatarPatrik Jakobsson <patrik.r.jakobsson@gmail.com>
      cc436b1c
    • Zack Rusin's avatar
      drm/vmwgfx: Disable command buffers on svga3 without gbobjects · 6f6f9788
      Zack Rusin authored
      With very limited vram on svga3 it's difficult to handle all the surface
      migrations. Without gbobjects, i.e. the ability to store surfaces in
      guest mobs, there's no reason to support intermediate svga2 features,
      especially because we can fall back to fb traces and svga3 will never
      support those in-between features.
      
      On svga3 we wither want to use fb traces or screen targets
      (i.e. gbobjects), nothing in between. This fixes presentation on a lot
      of fusion/esxi tech previews where the exposed svga3 caps haven't been
      finalized yet.
      Signed-off-by: default avatarZack Rusin <zackr@vmware.com>
      Fixes: 2cd80dbd ("drm/vmwgfx: Add basic support for SVGA3")
      Cc: <stable@vger.kernel.org> # v5.14+
      Reviewed-by: default avatarMartin Krastev <krastevm@vmware.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220318174332.440068-5-zack@kde.org
      6f6f9788
    • Zack Rusin's avatar
      drm/vmwgfx: validate the screen formats · 8bb75aeb
      Zack Rusin authored
      The kms code wasn't validating the modifiers and was letting through
      unsupported formats. rgb8 was never properly supported and has no
      matching svga screen target format so remove it.
      This fixes format/modifier failures in kms_addfb_basic from IGT.
      Signed-off-by: default avatarZack Rusin <zackr@vmware.com>
      Reviewed-by: default avatarMartin Krastev <krastevm@vmware.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220318174332.440068-4-zack@kde.org
      8bb75aeb