[PATCH v4 2/6] drm/msm: Block VM_BIND for shared VMs
From: Rob Clark
Date: Wed Jul 08 2026 - 13:38:50 EST
We already block MSM_PARAM_EN_VM_BIND where per-process VMs are not
supported. But in error paths when we actually try to create the VM
(allocation failures, etc) we could still end up with a shared-VM.
Since we need to create the VM lazily, for backwards compat, there
isn't really a better place to return an error. But this isn't to
happen in practice. Just block VM_BIND ioctls in this case so we
aren't giving userspace a way to manage the shared VM.
Signed-off-by: Rob Clark <robin.clark@xxxxxxxxxxxxxxxx>
---
drivers/gpu/drm/msm/msm_gem_vma.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
index 3ed05ab0eeef..06a3f2aa3ef0 100644
--- a/drivers/gpu/drm/msm/msm_gem_vma.c
+++ b/drivers/gpu/drm/msm/msm_gem_vma.c
@@ -954,7 +954,7 @@ msm_gem_vm_close(struct drm_gpuvm *gpuvm)
static struct msm_vm_bind_job *
-vm_bind_job_create(struct drm_device *dev, struct drm_file *file,
+vm_bind_job_create(struct drm_device *dev, struct drm_file *file, struct drm_gpuvm *vm,
struct msm_gpu_submitqueue *queue, uint32_t nr_ops)
{
struct msm_vm_bind_job *job;
@@ -971,7 +971,7 @@ vm_bind_job_create(struct drm_device *dev, struct drm_file *file,
return ERR_PTR(ret);
}
- job->vm = msm_context_vm(dev, queue->ctx);
+ job->vm = vm;
job->queue = queue;
INIT_LIST_HEAD(&job->vm_ops);
@@ -1430,6 +1430,7 @@ msm_ioctl_vm_bind(struct drm_device *dev, void *data, struct drm_file *file)
struct msm_drm_private *priv = dev->dev_private;
struct drm_msm_vm_bind *args = data;
struct msm_context *ctx = file->driver_priv;
+ struct drm_gpuvm *vm = msm_context_vm(dev, ctx);
struct msm_vm_bind_job *job = NULL;
struct msm_gpu *gpu = priv->gpu;
struct msm_gpu_submitqueue *queue;
@@ -1448,7 +1449,7 @@ msm_ioctl_vm_bind(struct drm_device *dev, void *data, struct drm_file *file)
* Maybe we could allow just UNMAP ops? OTOH userspace should just
* immediately close the device file and all will be torn down.
*/
- if (to_msm_vm(msm_context_vm(dev, ctx))->unusable)
+ if (to_msm_vm(vm)->unusable)
return UERR(EPIPE, dev, "context is unusable");
/*
@@ -1456,7 +1457,7 @@ msm_ioctl_vm_bind(struct drm_device *dev, void *data, struct drm_file *file)
* place, if you haven't opted in to VM_BIND context. But it is
* cleaner / less confusing, to check this case directly.
*/
- if (!msm_context_is_vmbind(ctx))
+ if (to_msm_vm(vm)->managed)
return UERR(EINVAL, dev, "context does not support vmbind");
if (args->flags & ~MSM_VM_BIND_FLAGS)
@@ -1479,7 +1480,7 @@ msm_ioctl_vm_bind(struct drm_device *dev, void *data, struct drm_file *file)
}
}
- job = vm_bind_job_create(dev, file, queue, args->nr_ops);
+ job = vm_bind_job_create(dev, file, vm, queue, args->nr_ops);
if (IS_ERR(job)) {
ret = PTR_ERR(job);
goto out_post_unlock;
--
2.55.0