Guest-backed devices without cursor MOB support define cursor images with
SVGA_CMD_DEFINE_ALPHA_CURSOR. SVGA_REG_CURSOR_MAX_DIMENSION belongs to the
cursor MOB register class and reads as zero on devices that do not expose
that class. Applying this register to GB-only cursors rejects every
nonempty image submitted by KMS clients, leaving Xorg without a hardware
cursor.
The submission transport also limits the command size. A 96x96 image fits
the 40 KiB FIFO image limit, but exceeds the 32 KiB command-buffer limit
and causes a device command error when submitted through that transport.
Validate GB-only images against SVGA_MAX_CURSOR_CMD_DIMENSION and
SVGA_MAX_CURSOR_CMD_BYTES. For command-buffer submission, also bound the
whole command by SVGA_CB_MAX_COMMAND_SIZE, including its header. Calculate
the image byte count in 64 bits and keep the register-based dimension and
MOB size checks for MOB cursors.
Fixes: d5ed8749168a ("drm/vmwgfx: enforce cursor size limits for MOB cursors")
Cc: [email protected]
Reported-by: Yunfeng Li <[email protected]>
Closes:
https://patch.msgid.link/[email protected]
Assisted-by: LLM
Signed-off-by: Zack Rusin <[email protected]>
---
drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 23 ++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
b/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
index 942d07079ef7..14490ead99cd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
@@ -778,8 +778,27 @@ int vmw_cursor_plane_atomic_check(struct drm_plane *plane,
"surface not suitable for cursor\n");
return -EINVAL;
}
- } else if (update_type == VMW_CURSOR_UPDATE_GB_ONLY ||
- update_type == VMW_CURSOR_UPDATE_MOB) {
+ } else if (update_type == VMW_CURSOR_UPDATE_GB_ONLY) {
+ u64 image_size = (u64)new_state->crtc_w *
+ new_state->crtc_h * sizeof(u32);
+ u32 max_size = SVGA_MAX_CURSOR_CMD_BYTES;
+
+ /* The command-buffer limit includes the define-cursor header.
*/
+ if (vmw->cman)
+ max_size = min_t(u32, max_size,
+ SVGA_CB_MAX_COMMAND_SIZE -
+ sizeof(struct
vmw_svga_fifo_cmd_define_cursor));
+
+ if (!new_state->crtc_w || !new_state->crtc_h ||
+ new_state->crtc_w > SVGA_MAX_CURSOR_CMD_DIMENSION ||
+ new_state->crtc_h > SVGA_MAX_CURSOR_CMD_DIMENSION ||
+ image_size > max_size) {
+ drm_dbg_kms(&vmw->drm,
+ "Cursor dimensions (%u, %u) violate command
limits\n",
+ new_state->crtc_w, new_state->crtc_h);
+ return -EINVAL;
+ }
+ } else if (update_type == VMW_CURSOR_UPDATE_MOB) {
u32 cursor_max_dim =
vmw_read(vmw, SVGA_REG_CURSOR_MAX_DIMENSION);
--
2.53.0
