Skip to content

Commit 6d49c27

Browse files
kerneltoastkerneltoast
committed
drm/vmwgfx: Remove explicit and broken vblank handling
jira VULN-8161 cve CVE-2023-5633 commit-author Zack Rusin <zackr@vmware.com> commit 2e10cdc The explicit vblank handling was never finished. The driver never had the full implementation of vblank and what was there is emulated by DRM when the driver doesn't pretend to be implementing it itself. Let DRM handle the vblank emulation and stop pretending the driver is doing anything special with vblank. In the future it would make sense to implement helpers for full vblank handling because vkms and amdgpu_vkms already have that code. Exporting it to common helpers and having all three drivers share it would make sense (that would be largely just to allow more of igt to run). Signed-off-by: Zack Rusin <zackr@vmware.com> Reviewed-by: Maaz Mombasawala <mombasawalam@vmware.com> Reviewed-by: Martin Krastev <krastevm@vmware.com> Reviewed-by: Michael Banack <banackm@vmware.com> Link: https://patchwork.freedesktop.org/patch/msgid/20221022040236.616490-15-zack@kde.org (cherry picked from commit 2e10cdc) Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
1 parent 2c9df1e commit 6d49c27

File tree

5 files changed

+1
-101
lines changed

5 files changed

+1
-101
lines changed

‎drivers/gpu/drm/vmwgfx/vmwgfx_drv.h‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1208,9 +1208,6 @@ int vmw_kms_write_svga(struct vmw_private *vmw_priv,
12081208
bool vmw_kms_validate_mode_vram(struct vmw_private *dev_priv,
12091209
uint32_t pitch,
12101210
uint32_t height);
1211-
u32 vmw_get_vblank_counter(struct drm_crtc *crtc);
1212-
int vmw_enable_vblank(struct drm_crtc *crtc);
1213-
void vmw_disable_vblank(struct drm_crtc *crtc);
12141211
int vmw_kms_present(struct vmw_private *dev_priv,
12151212
struct drm_file *file_priv,
12161213
struct vmw_framebuffer *vfb,

‎drivers/gpu/drm/vmwgfx/vmwgfx_kms.c‎

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@
3131
#include <drm/drm_fourcc.h>
3232
#include <drm/drm_rect.h>
3333
#include <drm/drm_sysfs.h>
34-
#include <drm/drm_vblank.h>
3534

3635
#include "vmwgfx_kms.h"
3736

@@ -982,15 +981,6 @@ void vmw_du_crtc_atomic_begin(struct drm_crtc *crtc,
982981
void vmw_du_crtc_atomic_flush(struct drm_crtc *crtc,
983982
struct drm_atomic_state *state)
984983
{
985-
struct drm_pending_vblank_event *event = crtc->state->event;
986-
987-
if (event) {
988-
crtc->state->event = NULL;
989-
990-
spin_lock_irq(&crtc->dev->event_lock);
991-
drm_crtc_send_vblank_event(crtc, event);
992-
spin_unlock_irq(&crtc->dev->event_lock);
993-
}
994984
}
995985

996986

@@ -2308,30 +2298,6 @@ bool vmw_kms_validate_mode_vram(struct vmw_private *dev_priv,
23082298
dev_priv->max_primary_mem : dev_priv->vram_size);
23092299
}
23102300

2311-
2312-
/*
2313-
* Function called by DRM code called with vbl_lock held.
2314-
*/
2315-
u32 vmw_get_vblank_counter(struct drm_crtc *crtc)
2316-
{
2317-
return 0;
2318-
}
2319-
2320-
/*
2321-
* Function called by DRM code called with vbl_lock held.
2322-
*/
2323-
int vmw_enable_vblank(struct drm_crtc *crtc)
2324-
{
2325-
return -EINVAL;
2326-
}
2327-
2328-
/*
2329-
* Function called by DRM code called with vbl_lock held.
2330-
*/
2331-
void vmw_disable_vblank(struct drm_crtc *crtc)
2332-
{
2333-
}
2334-
23352301
/**
23362302
* vmw_du_update_layout - Update the display unit with topology from resolution
23372303
* plugin and generate DRM uevent

‎drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@
2828
#include <drm/drm_atomic.h>
2929
#include <drm/drm_atomic_helper.h>
3030
#include <drm/drm_fourcc.h>
31-
#include <drm/drm_vblank.h>
3231

3332
#include "vmwgfx_kms.h"
3433

@@ -235,9 +234,6 @@ static const struct drm_crtc_funcs vmw_legacy_crtc_funcs = {
235234
.atomic_duplicate_state = vmw_du_crtc_duplicate_state,
236235
.atomic_destroy_state = vmw_du_crtc_destroy_state,
237236
.set_config = drm_atomic_helper_set_config,
238-
.get_vblank_counter = vmw_get_vblank_counter,
239-
.enable_vblank = vmw_enable_vblank,
240-
.disable_vblank = vmw_disable_vblank,
241237
};
242238

243239

@@ -507,10 +503,6 @@ int vmw_kms_ldu_init_display(struct vmw_private *dev_priv)
507503
dev_priv->ldu_priv->last_num_active = 0;
508504
dev_priv->ldu_priv->fb = NULL;
509505

510-
ret = drm_vblank_init(dev, num_display_units);
511-
if (ret != 0)
512-
goto err_free;
513-
514506
vmw_kms_create_implicit_placement_property(dev_priv);
515507

516508
for (i = 0; i < num_display_units; ++i) {

‎drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c‎

Lines changed: 1 addition & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@
2929
#include <drm/drm_atomic_helper.h>
3030
#include <drm/drm_damage_helper.h>
3131
#include <drm/drm_fourcc.h>
32-
#include <drm/drm_vblank.h>
3332

3433
#include "vmwgfx_kms.h"
3534

@@ -320,9 +319,6 @@ static const struct drm_crtc_funcs vmw_screen_object_crtc_funcs = {
320319
.atomic_destroy_state = vmw_du_crtc_destroy_state,
321320
.set_config = drm_atomic_helper_set_config,
322321
.page_flip = drm_atomic_helper_page_flip,
323-
.get_vblank_counter = vmw_get_vblank_counter,
324-
.enable_vblank = vmw_enable_vblank,
325-
.disable_vblank = vmw_disable_vblank,
326322
};
327323

328324
/*
@@ -730,7 +726,6 @@ vmw_sou_primary_plane_atomic_update(struct drm_plane *plane,
730726
struct drm_plane_state *old_state = drm_atomic_get_old_plane_state(state, plane);
731727
struct drm_plane_state *new_state = drm_atomic_get_new_plane_state(state, plane);
732728
struct drm_crtc *crtc = new_state->crtc;
733-
struct drm_pending_vblank_event *event = NULL;
734729
struct vmw_fence_obj *fence = NULL;
735730
int ret;
736731

@@ -754,24 +749,6 @@ vmw_sou_primary_plane_atomic_update(struct drm_plane *plane,
754749
return;
755750
}
756751

757-
/* For error case vblank event is send from vmw_du_crtc_atomic_flush */
758-
event = crtc->state->event;
759-
if (event && fence) {
760-
struct drm_file *file_priv = event->base.file_priv;
761-
762-
ret = vmw_event_fence_action_queue(file_priv,
763-
fence,
764-
&event->base,
765-
&event->event.vbl.tv_sec,
766-
&event->event.vbl.tv_usec,
767-
true);
768-
769-
if (unlikely(ret != 0))
770-
DRM_ERROR("Failed to queue event on fence.\n");
771-
else
772-
crtc->state->event = NULL;
773-
}
774-
775752
if (fence)
776753
vmw_fence_obj_unreference(&fence);
777754
}
@@ -947,7 +924,7 @@ static int vmw_sou_init(struct vmw_private *dev_priv, unsigned unit)
947924
int vmw_kms_sou_init_display(struct vmw_private *dev_priv)
948925
{
949926
struct drm_device *dev = &dev_priv->drm;
950-
int i, ret;
927+
int i;
951928

952929
/* Screen objects won't work if GMR's aren't available */
953930
if (!dev_priv->has_gmr)
@@ -957,12 +934,6 @@ int vmw_kms_sou_init_display(struct vmw_private *dev_priv)
957934
return -ENOSYS;
958935
}
959936

960-
ret = -ENOMEM;
961-
962-
ret = drm_vblank_init(dev, VMWGFX_NUM_DISPLAY_UNITS);
963-
if (unlikely(ret != 0))
964-
return ret;
965-
966937
for (i = 0; i < VMWGFX_NUM_DISPLAY_UNITS; ++i)
967938
vmw_sou_init(dev_priv, i);
968939

‎drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@
2929
#include <drm/drm_atomic_helper.h>
3030
#include <drm/drm_damage_helper.h>
3131
#include <drm/drm_fourcc.h>
32-
#include <drm/drm_vblank.h>
3332

3433
#include "vmwgfx_kms.h"
3534
#include "vmw_surface_cache.h"
@@ -925,9 +924,6 @@ static const struct drm_crtc_funcs vmw_stdu_crtc_funcs = {
925924
.atomic_destroy_state = vmw_du_crtc_destroy_state,
926925
.set_config = drm_atomic_helper_set_config,
927926
.page_flip = drm_atomic_helper_page_flip,
928-
.get_vblank_counter = vmw_get_vblank_counter,
929-
.enable_vblank = vmw_enable_vblank,
930-
.disable_vblank = vmw_disable_vblank,
931927
};
932928

933929

@@ -1591,7 +1587,6 @@ vmw_stdu_primary_plane_atomic_update(struct drm_plane *plane,
15911587
struct vmw_plane_state *vps = vmw_plane_state_to_vps(new_state);
15921588
struct drm_crtc *crtc = new_state->crtc;
15931589
struct vmw_screen_target_display_unit *stdu;
1594-
struct drm_pending_vblank_event *event;
15951590
struct vmw_fence_obj *fence = NULL;
15961591
struct vmw_private *dev_priv;
15971592
int ret;
@@ -1640,23 +1635,6 @@ vmw_stdu_primary_plane_atomic_update(struct drm_plane *plane,
16401635
return;
16411636
}
16421637

1643-
/* In case of error, vblank event is send in vmw_du_crtc_atomic_flush */
1644-
event = crtc->state->event;
1645-
if (event && fence) {
1646-
struct drm_file *file_priv = event->base.file_priv;
1647-
1648-
ret = vmw_event_fence_action_queue(file_priv,
1649-
fence,
1650-
&event->base,
1651-
&event->event.vbl.tv_sec,
1652-
&event->event.vbl.tv_usec,
1653-
true);
1654-
if (ret)
1655-
DRM_ERROR("Failed to queue event on fence.\n");
1656-
else
1657-
crtc->state->event = NULL;
1658-
}
1659-
16601638
if (fence)
16611639
vmw_fence_obj_unreference(&fence);
16621640
}
@@ -1883,10 +1861,6 @@ int vmw_kms_stdu_init_display(struct vmw_private *dev_priv)
18831861
if (!(dev_priv->capabilities & SVGA_CAP_GBOBJECTS))
18841862
return -ENOSYS;
18851863

1886-
ret = drm_vblank_init(dev, VMWGFX_NUM_DISPLAY_UNITS);
1887-
if (unlikely(ret != 0))
1888-
return ret;
1889-
18901864
dev_priv->active_display_unit = vmw_du_screen_target;
18911865

18921866
for (i = 0; i < VMWGFX_NUM_DISPLAY_UNITS; ++i) {

0 commit comments

Comments
 (0)