On Tue Oct 27, 2026 at 2:17 PM PDT, Zack Rusin wrote:
> Guest-backed devices without cursor MOB support define cursor images with
> SVGA_CMD_DEFINE_ALPHA_CURSOR. SVGA_REG_CURSOR_MAX_DIMENSION belongs to the
> cursor MOB register class and reads as zero on devices that do not expose
> that class. Applying this register to GB-only cursors rejects every
> nonempty image submitted by KMS clients, leaving Xorg without a hardware
> cursor.
>
> The submission transport also limits the command size. A 96x96 image fits
> the 40 KiB FIFO image limit, but exceeds the 32 KiB command-buffer limit
> and causes a device command error when submitted through that transport.
>
> Validate GB-only images against SVGA_MAX_CURSOR_CMD_DIMENSION and
> SVGA_MAX_CURSOR_CMD_BYTES. For command-buffer submission, also bound the
> whole command by SVGA_CB_MAX_COMMAND_SIZE, including its header. Calculate
> the image byte count in 64 bits and keep the register-based dimension and
> MOB size checks for MOB cursors.
>
> Fixes: d5ed8749168a ("drm/vmwgfx: enforce cursor size limits for MOB cursors")
> Cc: [email protected]
> Reported-by: Yunfeng Li <[email protected]>
> Closes:
> https://patch.msgid.link/[email protected]
> Assisted-by: LLM
> Signed-off-by: Zack Rusin <[email protected]>
> ---
> drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 23 ++++++++++++++++++--
> 1 file changed, 21 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
> b/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
> index 942d07079ef7..14490ead99cd 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
> @@ -778,8 +778,27 @@ int vmw_cursor_plane_atomic_check(struct drm_plane
> *plane,
> "surface not suitable for cursor\n");
> return -EINVAL;
> }
> - } else if (update_type == VMW_CURSOR_UPDATE_GB_ONLY ||
> - update_type == VMW_CURSOR_UPDATE_MOB) {
> + } else if (update_type == VMW_CURSOR_UPDATE_GB_ONLY) {
> + u64 image_size = (u64)new_state->crtc_w *
> + new_state->crtc_h * sizeof(u32);
> + u32 max_size = SVGA_MAX_CURSOR_CMD_BYTES;
> +
> + /* The command-buffer limit includes the define-cursor header.
> */
> + if (vmw->cman)
> + max_size = min_t(u32, max_size,
> + SVGA_CB_MAX_COMMAND_SIZE -
> + sizeof(struct
> vmw_svga_fifo_cmd_define_cursor));
> +
> + if (!new_state->crtc_w || !new_state->crtc_h ||
> + new_state->crtc_w > SVGA_MAX_CURSOR_CMD_DIMENSION ||
> + new_state->crtc_h > SVGA_MAX_CURSOR_CMD_DIMENSION ||
> + image_size > max_size) {
We should have a separate message for image_size > max_size.
> + drm_dbg_kms(&vmw->drm,
> + "Cursor dimensions (%u, %u) violate command
> limits\n",
> + new_state->crtc_w, new_state->crtc_h);
> + return -EINVAL;
> + }
> + } else if (update_type == VMW_CURSOR_UPDATE_MOB) {
> u32 cursor_max_dim =
> vmw_read(vmw, SVGA_REG_CURSOR_MAX_DIMENSION);
>
--
Maaz Mombasawala <[email protected]>
