Re: [PATCH v2] drm/virtio: do not enforce blob_alignment in cross-domain contexts

[Dmitry Osipenko <dmitry.osipenko@collabora.com>]

On 10/10/26 22:40, Dmitry Osipenko wrote:
> On 10/8/26 23:59, Val Packett wrote:
>>
>> On 10/8/26 4:33 AM, Dmitry Osipenko wrote:
>>> On 10/6/26 18:42, Val Packett wrote:
>>>> VIRTIO_GPU_F_BLOB_ALIGNMENT is designed for GPU rendering context types,
>>>> however VIRTIO_GPU_CAPSET_CROSS_DOMAIN is not one of those. Resources
>>>> created under cross-domain contexts are arbitrary shared system memory
>>>> files, which includes unusual things like Wayland keymaps received
>>>> from the host compositor. Do not enforce alignment requirements there.
>>>>
>>>> Fixes: 47248e0d8264 ("drm/virtio: honor blob_alignment requirements")
>>>> Signed-off-by: Val Packett <val@invisiblethingslab.com>
>>>> ---
>>>>
>>>> v2: also check has_virgl_3d to prevent dereferencing NULL vfpriv
>>>> v1: https://lore.kernel.org/all/20261006004044.2242154-1-
>>>> val@invisiblethingslab.com/
>>>>
>>>> ~val
>>>>
>>>> ---
>>>>   drivers/gpu/drm/virtio/virtgpu_ioctl.c | 4 +++-
>>>>   1 file changed, 3 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/
>>>> drm/virtio/virtgpu_ioctl.c
>>>> index 3ddd5481d6bc..4d5ae062834d 100644
>>>> --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
>>>> +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
>>>> @@ -551,7 +551,9 @@ static int verify_blob(struct virtio_gpu_device
>>>> *vgdev,
>>>>       params->blob_flags = rc_blob->blob_flags;
>>>>       params->blob_hints = rc_blob->blob_hints;
>>>>   -    if (vgdev->has_blob_alignment &&
>>>> +    if (vgdev->has_blob_alignment && vgdev->has_virgl_3d &&
>>>> +        (vfpriv->context_init &
>>>> VIRTIO_GPU_CONTEXT_INIT_CAPSET_ID_MASK) !=
>>>> +        VIRTIO_GPU_CAPSET_CROSS_DOMAIN &&
>>>>           !IS_ALIGNED(params->size, vgdev->blob_alignment))
>>>>           return -EINVAL;
>>>>   
>>> What userspace has this problem and why it re-purposes virtio-gpu to act
>>> as udmabuf for arbitrary data that never reaches host?
>>
>> Sorry, what do you mean by that?
>>
>> This is not related to data that "never reaches host" at all! The error
>> I referred to in the patch message literally says "received *from* the
>> host"…??
>>
>> Guest userspace is any of the cross-domain proxies:
>>
>> * https://codeberg.org/drakulix/wl-cross-domain-proxy
>> * https://github.com/talex5/wayland-proxy-virtwl
>> * https://github.com/google/sommelier-rs (or old C++ version)
>>
>> VIRTIO_GPU_CAPSET_CROSS_DOMAIN "repurposes virtio-gpu" to act as a
>> cross-VM UNIX socket transport that supports fd passing. By referring to
>> virtio-gpu resources in the send command the guest can make the device
>> send the resources' corresponding host fds to the host Wayland
>> compositor. It can refer to resources from other contexts, in order to
>> present drm/venus/etc rendered buffers on Wayland surfaces. (i.e. the
>> host would send the actual dma-buf from virglrenderer) But the resources
>> created on the cross-domain context itself are system memory buffers,
>> generally used for software rendering and miscellaneous Wayland "stuff"
>> like keymaps which are sent *from* the host, and exposed to Wayland
>> clients in the guest. Socket receive handling in rutabaga-gfx stores
>> incoming fds and returns their IDs to the guest, then the guest does a
>> CREATE_BLOB with matching blob_id, which creates a virtio-gpu resource
>> from the incoming buffer, so the guest can just MAP_BLOB it. These are
>> the blobs that are not aligned to anything because they're just
>> arbitrary memfds on the host.
> 
> RE "These are the blobs that are not aligned to anything because they're
> just arbitrary memfds on the host." I'll appreciate confirmation from
> people more familiar with Sommelier internals like Gurchetan, Yiwei or Ryan.
> 
> In a case it is a correct claim, might be better to remove the
> blob_alignment check entirely and let blob sharing fail naturally if
> alignment is wrong.
> 

Reproduced the bug with Sommelier.

Driver always implicitly rounds up BO size up to PAGE_SIZE for both
guest and host blobs [1][2], hence need to retain this old behavior to
fix the problem properly.

Please send v2

[1]
https://elixir.bootlin.com/linux/v7.2.10/source/drivers/gpu/drm/virtio/virtgpu_object.c#L217
[2]
https://elixir.bootlin.com/linux/v7.2.10/source/drivers/gpu/drm/virtio/virtgpu_vram.c#L210

--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
@@ -539,9 +539,15 @@ static int verify_blob(struct virtio_gpu_device *vgdev,
        params->blob_flags = rc_blob->blob_flags;
        params->blob_hints = rc_blob->blob_hints;

-       if (vgdev->has_blob_alignment &&
-           !IS_ALIGNED(params->size, vgdev->blob_alignment))
-               return -EINVAL;
+       /*
+        * Blob sizes always implicitly rounded up to PAGE_SIZE by the
+        * driver, userspace may be unaware of the host's alignment.
+        * Round up to the larger of the host and guest page sizes.
+        */
+       if (vgdev->has_blob_alignment)
+               params->size = ALIGN(params->size,
+                                    max_t(u32, vgdev->blob_alignment,
PAGE_SIZE));

        return 0;
 }



-- 
Best regards,
Dmitry