From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D3DABC64ED6 for ; Tue, 28 Feb 2023 15:43:51 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 593E910E057; Tue, 28 Feb 2023 15:43:50 +0000 (UTC) Received: from mail-oo1-xc30.google.com (mail-oo1-xc30.google.com [IPv6:2607:f8b0:4864:20::c30]) by gabe.freedesktop.org (Postfix) with ESMTPS id 6E1F310E057 for ; Tue, 28 Feb 2023 15:43:48 +0000 (UTC) Received: by mail-oo1-xc30.google.com with SMTP id l16-20020a4ad9d0000000b005254905810aso1614641oou.9 for ; Tue, 28 Feb 2023 07:43:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=LonH6h0XflHd2ZjJoaCMQxM+eselh1rFlXJtr2TdEH0=; b=WyJg6CTQHizjZtwa26KfNyODiFG3bpBQVCtLC6kZa2jQ93g3cNA0st7X5zv0Q0WEyz DssEP8HT6EafkjajKflc8sIiiF0dUns20WwxZRwoLYoYxJDiuQntnrgON6O0bmAB78gU eusnG6BYYBWBbE9LMTXMKE1W0CDyQP43ruj+RGcEzoFV8LOE3zN/x9BMvVl2JZ1quO1J YTTCzT58vDVD0zhGKokq3aPnJ1b01i5rGPvzR8ipxkTmzyihfnBoBJxmHS8DBHDCFkJT en235u700aMHlAZhuPqoO8i2/Fohbbk33SHXIvLNO4mmMkLm7loqL7m1EG3wa+b8ziGD udpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=LonH6h0XflHd2ZjJoaCMQxM+eselh1rFlXJtr2TdEH0=; b=ui82HI+8VTVRSlet9XrGFepS8uMn8YGrtlTpuPCIbMS6ForJtcvpMaTUBFYU2Er3Tp jx3J/AF64p0iiGFSHgi+sDjcDnCRqkDuvCmF6ZTGT+BwdYfq7YIt9QXAIFxbLbR7gwiS xw5SF7m5GewDbh+ZBptjtWVGzktBFNKO166nM/msOc8w/pFJJzvK0+5tczq5+sCV9DZg jQa8RU34dJsaruSoW8wl8pOIbxgYYBb+u9HG+4V0MtMMPbhhSeY9XJAgpmrEHdIT/Z/j dP2wAYdM+xiXwr5QT4LWNjtQUTjKSsUOq8txQFMVhyjqaQRhFm8WnBRVEyJ+i5WUMOoZ iOmw== X-Gm-Message-State: AO0yUKUoVre7JxpoZBTBYPwV2C6adCr0ISvHuKLTmLHqYthqt5uH/Wq5 0qraiSNheUrMXVa1rZW1G0YbqVB28Fws/N1PuJc= X-Google-Smtp-Source: AK7set8STQ1oztAalDc2bpQ9rNAMwQTUZCm2yzbWRYUjL7JbeIR+duZmjExm+N3PqFqj9f5vVh1ZzbL3mR9s5ouJdgQ= X-Received: by 2002:a4a:840f:0:b0:525:499e:ce2f with SMTP id l15-20020a4a840f000000b00525499ece2fmr795883oog.1.1677599027483; Tue, 28 Feb 2023 07:43:47 -0800 (PST) MIME-Version: 1.0 References: <20230227173800.2809727-1-robdclark@gmail.com> <44e67d88-fce6-a1c1-79a9-a937e64a32bb@collabora.com> In-Reply-To: From: Rob Clark Date: Tue, 28 Feb 2023 07:43:36 -0800 Message-ID: Subject: Re: [PATCH v3] drm/virtio: Add option to disable KMS support To: Thomas Zimmermann Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Rob Clark , Ryan Neph , open list , dri-devel@lists.freedesktop.org, Gurchetan Singh , Gerd Hoffmann , Dmitry Osipenko , David Airlie , "open list:VIRTIO GPU DRIVER" Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Tue, Feb 28, 2023 at 4:34 AM Thomas Zimmermann wro= te: > > Hi > > Am 27.02.23 um 19:15 schrieb Rob Clark: > > On Mon, Feb 27, 2023 at 9:57 AM Dmitry Osipenko > > wrote: > >> > >> On 2/27/23 20:38, Rob Clark wrote: > >> ... > >>> + if (IS_ENABLED(CONFIG_DRM_VIRTIO_GPU_KMS)) { > >>> + /* get display info */ > >>> + virtio_cread_le(vgdev->vdev, struct virtio_gpu_config, > >>> + num_scanouts, &num_scanouts); > >>> + vgdev->num_scanouts =3D min_t(uint32_t, num_scanouts, > >>> + VIRTIO_GPU_MAX_SCANOUTS); > >>> + if (!vgdev->num_scanouts) { > >>> + /* > >>> + * Having an EDID but no scanouts is non-sensic= al, > >>> + * but it is permitted to have no scanouts and = no > >>> + * EDID (in which case DRIVER_MODESET and > >>> + * DRIVER_ATOMIC are not advertised) > >>> + */ > >>> + if (vgdev->has_edid) { > >>> + DRM_ERROR("num_scanouts is zero\n"); > >>> + ret =3D -EINVAL; > >>> + goto err_scanouts; > >>> + } > >>> + dev->driver_features &=3D ~(DRIVER_MODESET | DR= IVER_ATOMIC); > >> > >> If it's now configurable by host, why do we need the > >> CONFIG_DRM_VIRTIO_GPU_KMS? > > > > Because a kernel config option makes it more obvious that > > modeset/atomic ioctls are blocked. Which makes it more obvious about > > where any potential security issues apply and where fixes need to get > > backported to. The config option is the only thing _I_ want, > > everything else is just a bonus to help other people's use-cases. > > I find this very vague. What's the security thread? The modeset ioctls are a big potential attack surface area. Which in the case of CrOS VM guests serves no legitimate purpose. (kms is unused in the guest, instead guest window surfaces are proxied to host for composition alongside host window surfaces.) There have been in the past potential security bugs (use-after-free, etc) found in the kms ioctls. We should assume that there will be more in the future. So it seems like simple common sense to want to block unused ioctls. > And if the config option is useful, shouldn't it be DRM-wide? The > modesetting ioctl calls are shared among all drivers. Maybe, if there is a use? The situation of compositing guest windows in the host seems a bit unique to virtgpu, which is why I went with a config option specific to virtgpu. BR, -R > Best regards > Thomas > > > > > BR, > > -R > > -- > Thomas Zimmermann > Graphics Driver Developer > SUSE Software Solutions Germany GmbH > Maxfeldstr. 5, 90409 N=C3=BCrnberg, Germany > (HRB 36809, AG N=C3=BCrnberg) > Gesch=C3=A4ftsf=C3=BChrer: Ivo Totev