[PATCH v2 0/7] drm/client: Simply client-buffer interface and implementation

[PATCH v2 0/7] drm/client: Simply client-buffer interface and implementation

[Thomas Zimmermann]

Streamline the client-buffer code and remove the drm_client_framebuffer_
functions. Makes the code easier to work with.

Also prepares for importing non-dumb-buffer objects. Most of the in-
kernel clients will use dumb-buffer allocation. In the case of the
per-driver fbdev_probe code, the client buffer can also wrap an object
that comes from a different memory region; for example gma500's stolen
memory area. This functionality is required to move forward with the
various per-driver implementations of fbdev_probe within the overall
DRM-client framework.

Tested with efidrm and virtio-gpu on Virt I/O hardware.

v2:
- fix possible NULL-pointer deref in delete
- avoid dependency on KMS helpers

Thomas Zimmermann (7):
  drm/client: Remove pitch from struct drm_client_buffer
  drm/client: Move dumb-buffer handling to
    drm_client_framebuffer_create()
  drm/client: Inline drm_client_buffer_addfb() and _rmfb()
  drm/client: Deprecate struct drm_client_buffer.gem
  drm/client: Remove drm_client_framebuffer_delete()
  drm/client: Create client buffers with drm_client_buffer_create_dumb()
  drm/client: Flush client buffers with drm_client_buffer_sync()

 drivers/gpu/drm/clients/drm_log.c |  10 +-
 drivers/gpu/drm/drm_client.c      | 193 ++++++++++++++----------------
 drivers/gpu/drm/drm_fbdev_dma.c   |   8 +-
 drivers/gpu/drm/drm_fbdev_shmem.c |   6 +-
 drivers/gpu/drm/drm_fbdev_ttm.c   |  10 +-
 include/drm/drm_client.h          |  20 +---
 6 files changed, 114 insertions(+), 133 deletions(-)


base-commit: c03916cb446b6eefe91538599775bb54bf98238c
-- 
2.51.1

[PATCH v2 1/7] drm/client: Remove pitch from struct drm_client_buffer

[Thomas Zimmermann]

Only the client-buffer setup uses the pitch field from struct
drm_client_buffer. Remove the field and pass the value among setup
helpers.

Clients that need the pitch should rather look at the framebuffer's
pitches[0] directly.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
---
 drivers/gpu/drm/drm_client.c | 14 +++++++-------
 include/drm/drm_client.h     |  5 -----
 2 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c
index fe9c6d7083ea..82b871d62313 100644
--- a/drivers/gpu/drm/drm_client.c
+++ b/drivers/gpu/drm/drm_client.c
@@ -188,7 +188,7 @@ static void drm_client_buffer_delete(struct drm_client_buffer *buffer)
 
 static struct drm_client_buffer *
 drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height,
-			 u32 format, u32 *handle)
+			 u32 format, u32 *handle, u32 *pitch)
 {
 	const struct drm_format_info *info = drm_format_info(format);
 	struct drm_mode_create_dumb dumb_args = { };
@@ -216,9 +216,9 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height,
 		goto err_delete;
 	}
 
-	buffer->pitch = dumb_args.pitch;
 	buffer->gem = obj;
 	*handle = dumb_args.handle;
+	*pitch = dumb_args.pitch;
 
 	return buffer;
 
@@ -353,7 +353,7 @@ static void drm_client_buffer_rmfb(struct drm_client_buffer *buffer)
 
 static int drm_client_buffer_addfb(struct drm_client_buffer *buffer,
 				   u32 width, u32 height, u32 format,
-				   u32 handle)
+				   u32 handle, u32 pitch)
 {
 	struct drm_client_dev *client = buffer->client;
 	struct drm_mode_fb_cmd2 fb_req = { };
@@ -363,7 +363,7 @@ static int drm_client_buffer_addfb(struct drm_client_buffer *buffer,
 	fb_req.height = height;
 	fb_req.pixel_format = format;
 	fb_req.handles[0] = handle;
-	fb_req.pitches[0] = buffer->pitch;
+	fb_req.pitches[0] = pitch;
 
 	ret = drm_mode_addfb2(client->dev, &fb_req, client->file);
 	if (ret)
@@ -399,15 +399,15 @@ struct drm_client_buffer *
 drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 height, u32 format)
 {
 	struct drm_client_buffer *buffer;
-	u32 handle;
+	u32 handle, pitch;
 	int ret;
 
 	buffer = drm_client_buffer_create(client, width, height, format,
-					  &handle);
+					  &handle, &pitch);
 	if (IS_ERR(buffer))
 		return buffer;
 
-	ret = drm_client_buffer_addfb(buffer, width, height, format, handle);
+	ret = drm_client_buffer_addfb(buffer, width, height, format, handle, pitch);
 
 	/*
 	 * The handle is only needed for creating the framebuffer, destroy it
diff --git a/include/drm/drm_client.h b/include/drm/drm_client.h
index 715b422952ee..c674464f7e74 100644
--- a/include/drm/drm_client.h
+++ b/include/drm/drm_client.h
@@ -173,11 +173,6 @@ struct drm_client_buffer {
 	 */
 	struct drm_client_dev *client;
 
-	/**
-	 * @pitch: Buffer pitch
-	 */
-	u32 pitch;
-
 	/**
 	 * @gem: GEM object backing this buffer
 	 *
-- 
2.51.1

[PATCH v2 2/7] drm/client: Move dumb-buffer handling to drm_client_framebuffer_create()

[Thomas Zimmermann]

Dumb-buffer creation within the client code is asymetrically balanced
across drm_client_buffer_create() and drm_client_framebuffer_create().
Put all dumb-buffer code into drm_client_framebuffer_create() and leave
client-buffer initialization to drm_client_buffer_create(). Clarifies
responsibility between these functions.

Apart form the architectural improvements, drm_client_buffer_create()
can now be exported if needed by clients. The client will be able to
initialize buffers that have been created from other interfaces than
dumb buffers.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
---
 drivers/gpu/drm/drm_client.c | 56 +++++++++++++++++++-----------------
 1 file changed, 29 insertions(+), 27 deletions(-)

diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c
index 82b871d62313..5ad82ab8b15f 100644
--- a/drivers/gpu/drm/drm_client.c
+++ b/drivers/gpu/drm/drm_client.c
@@ -188,11 +188,8 @@ static void drm_client_buffer_delete(struct drm_client_buffer *buffer)
 
 static struct drm_client_buffer *
 drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height,
-			 u32 format, u32 *handle, u32 *pitch)
+			 u32 format, u32 handle, u32 pitch)
 {
-	const struct drm_format_info *info = drm_format_info(format);
-	struct drm_mode_create_dumb dumb_args = { };
-	struct drm_device *dev = client->dev;
 	struct drm_client_buffer *buffer;
 	struct drm_gem_object *obj;
 	int ret;
@@ -203,28 +200,18 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height,
 
 	buffer->client = client;
 
-	dumb_args.width = width;
-	dumb_args.height = height;
-	dumb_args.bpp = drm_format_info_bpp(info, 0);
-	ret = drm_mode_create_dumb(dev, &dumb_args, client->file);
-	if (ret)
-		goto err_delete;
-
-	obj = drm_gem_object_lookup(client->file, dumb_args.handle);
+	obj = drm_gem_object_lookup(client->file, handle);
 	if (!obj)  {
 		ret = -ENOENT;
 		goto err_delete;
 	}
 
 	buffer->gem = obj;
-	*handle = dumb_args.handle;
-	*pitch = dumb_args.pitch;
 
 	return buffer;
 
 err_delete:
-	drm_client_buffer_delete(buffer);
-
+	kfree(buffer);
 	return ERR_PTR(ret);
 }
 
@@ -398,16 +385,30 @@ static int drm_client_buffer_addfb(struct drm_client_buffer *buffer,
 struct drm_client_buffer *
 drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 height, u32 format)
 {
+	const struct drm_format_info *info = drm_format_info(format);
+	struct drm_device *dev = client->dev;
+	struct drm_mode_create_dumb dumb_args = { };
 	struct drm_client_buffer *buffer;
-	u32 handle, pitch;
 	int ret;
 
+	dumb_args.width = width;
+	dumb_args.height = height;
+	dumb_args.bpp = drm_format_info_bpp(info, 0);
+	ret = drm_mode_create_dumb(dev, &dumb_args, client->file);
+	if (ret)
+		return ERR_PTR(ret);
+
 	buffer = drm_client_buffer_create(client, width, height, format,
-					  &handle, &pitch);
-	if (IS_ERR(buffer))
-		return buffer;
+					  dumb_args.handle, dumb_args.pitch);
+	if (IS_ERR(buffer)) {
+		ret = PTR_ERR(buffer);
+		goto err_drm_mode_destroy_dumb;
+	}
 
-	ret = drm_client_buffer_addfb(buffer, width, height, format, handle, pitch);
+	ret = drm_client_buffer_addfb(buffer, width, height, format,
+				      dumb_args.handle, dumb_args.pitch);
+	if (ret)
+		goto err_drm_client_buffer_delete;
 
 	/*
 	 * The handle is only needed for creating the framebuffer, destroy it
@@ -415,14 +416,15 @@ drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 heig
 	 * object as DMA-buf. The framebuffer and our buffer structure are still
 	 * holding references to the GEM object to prevent its destruction.
 	 */
-	drm_mode_destroy_dumb(client->dev, handle, client->file);
-
-	if (ret) {
-		drm_client_buffer_delete(buffer);
-		return ERR_PTR(ret);
-	}
+	drm_mode_destroy_dumb(client->dev, dumb_args.handle, client->file);
 
 	return buffer;
+
+err_drm_client_buffer_delete:
+	drm_client_buffer_delete(buffer);
+err_drm_mode_destroy_dumb:
+	drm_mode_destroy_dumb(client->dev, dumb_args.handle, client->file);
+	return ERR_PTR(ret);
 }
 EXPORT_SYMBOL(drm_client_framebuffer_create);
 
-- 
2.51.1

[PATCH v2 3/7] drm/client: Inline drm_client_buffer_addfb() and _rmfb()

[Thomas Zimmermann]

Creating and deleting a client buffer always creates and deletes
the underlying DRM framebuffer. Inline the helper functions into
their callers.

With the _addfb code being inlined into drm_client_buffer_create(),
clean up the function's error rollback to release the framebuffer's
handle and GEM buffer object as needed.

Move the _rmfb code into drm_client_buffer_delete() rather than its
current location in drm_client_framebuffer_delete(). The former is
now the inverse of drm_client_buffer_create(). Makes no difference
for cleaning up. Also prepares for the removal of
drm_client_framebuffer_delete().

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
---
 drivers/gpu/drm/drm_client.c | 93 ++++++++++++++++--------------------
 1 file changed, 40 insertions(+), 53 deletions(-)

diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c
index 5ad82ab8b15f..c4db4fc7ba69 100644
--- a/drivers/gpu/drm/drm_client.c
+++ b/drivers/gpu/drm/drm_client.c
@@ -178,6 +178,13 @@ EXPORT_SYMBOL(drm_client_release);
 
 static void drm_client_buffer_delete(struct drm_client_buffer *buffer)
 {
+	int ret;
+
+	ret = drm_mode_rmfb(buffer->client->dev, buffer->fb->base.id, buffer->client->file);
+	if (ret)
+		drm_err(buffer->client->dev,
+			"Error removing FB:%u (%d)\n", buffer->fb->base.id, ret);
+
 	if (buffer->gem) {
 		drm_gem_vunmap(buffer->gem, &buffer->map);
 		drm_gem_object_put(buffer->gem);
@@ -190,8 +197,21 @@ static struct drm_client_buffer *
 drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height,
 			 u32 format, u32 handle, u32 pitch)
 {
+	struct drm_mode_fb_cmd2 fb_req = {
+		.width = width,
+		.height = height,
+		.pixel_format = format,
+		.handles = {
+			handle,
+		},
+		.pitches = {
+			pitch,
+		},
+	};
+	struct drm_device *dev = client->dev;
 	struct drm_client_buffer *buffer;
 	struct drm_gem_object *obj;
+	struct drm_framebuffer *fb;
 	int ret;
 
 	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
@@ -206,10 +226,30 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height,
 		goto err_delete;
 	}
 
+	ret = drm_mode_addfb2(dev, &fb_req, client->file);
+	if (ret)
+		goto err_drm_gem_object_put;
+
+	fb = drm_framebuffer_lookup(dev, client->file, fb_req.fb_id);
+	if (drm_WARN_ON(dev, !fb)) {
+		ret = -ENOENT;
+		goto err_drm_mode_rmfb;
+	}
+
+	/* drop the reference we picked up in framebuffer lookup */
+	drm_framebuffer_put(fb);
+
+	strscpy(fb->comm, client->name, TASK_COMM_LEN);
+
 	buffer->gem = obj;
+	buffer->fb = fb;
 
 	return buffer;
 
+err_drm_mode_rmfb:
+	drm_mode_rmfb(dev, fb_req.fb_id, client->file);
+err_drm_gem_object_put:
+	drm_gem_object_put(obj);
 err_delete:
 	kfree(buffer);
 	return ERR_PTR(ret);
@@ -323,51 +363,6 @@ void drm_client_buffer_vunmap(struct drm_client_buffer *buffer)
 }
 EXPORT_SYMBOL(drm_client_buffer_vunmap);
 
-static void drm_client_buffer_rmfb(struct drm_client_buffer *buffer)
-{
-	int ret;
-
-	if (!buffer->fb)
-		return;
-
-	ret = drm_mode_rmfb(buffer->client->dev, buffer->fb->base.id, buffer->client->file);
-	if (ret)
-		drm_err(buffer->client->dev,
-			"Error removing FB:%u (%d)\n", buffer->fb->base.id, ret);
-
-	buffer->fb = NULL;
-}
-
-static int drm_client_buffer_addfb(struct drm_client_buffer *buffer,
-				   u32 width, u32 height, u32 format,
-				   u32 handle, u32 pitch)
-{
-	struct drm_client_dev *client = buffer->client;
-	struct drm_mode_fb_cmd2 fb_req = { };
-	int ret;
-
-	fb_req.width = width;
-	fb_req.height = height;
-	fb_req.pixel_format = format;
-	fb_req.handles[0] = handle;
-	fb_req.pitches[0] = pitch;
-
-	ret = drm_mode_addfb2(client->dev, &fb_req, client->file);
-	if (ret)
-		return ret;
-
-	buffer->fb = drm_framebuffer_lookup(client->dev, buffer->client->file, fb_req.fb_id);
-	if (WARN_ON(!buffer->fb))
-		return -ENOENT;
-
-	/* drop the reference we picked up in framebuffer lookup */
-	drm_framebuffer_put(buffer->fb);
-
-	strscpy(buffer->fb->comm, client->name, TASK_COMM_LEN);
-
-	return 0;
-}
-
 /**
  * drm_client_framebuffer_create - Create a client framebuffer
  * @client: DRM client
@@ -405,11 +400,6 @@ drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 heig
 		goto err_drm_mode_destroy_dumb;
 	}
 
-	ret = drm_client_buffer_addfb(buffer, width, height, format,
-				      dumb_args.handle, dumb_args.pitch);
-	if (ret)
-		goto err_drm_client_buffer_delete;
-
 	/*
 	 * The handle is only needed for creating the framebuffer, destroy it
 	 * again to solve a circular dependency should anybody export the GEM
@@ -420,8 +410,6 @@ drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 heig
 
 	return buffer;
 
-err_drm_client_buffer_delete:
-	drm_client_buffer_delete(buffer);
 err_drm_mode_destroy_dumb:
 	drm_mode_destroy_dumb(client->dev, dumb_args.handle, client->file);
 	return ERR_PTR(ret);
@@ -437,7 +425,6 @@ void drm_client_framebuffer_delete(struct drm_client_buffer *buffer)
 	if (!buffer)
 		return;
 
-	drm_client_buffer_rmfb(buffer);
 	drm_client_buffer_delete(buffer);
 }
 EXPORT_SYMBOL(drm_client_framebuffer_delete);
-- 
2.51.1

[PATCH v2 4/7] drm/client: Deprecate struct drm_client_buffer.gem

[Thomas Zimmermann]

The client buffer's framebuffer holds a reference and pointer on
each of its GEM buffer objects. Thus the field gem in the client-
buffer struct is not necessary. Deprecated the field and convert
the client-buffer helpers to use the framebuffer's objects.

In drm_client_buffer_delete(), do a possible vunmap before releasing
the framebuffer. Otherwise we'd eventually release the framebuffer
before unmaping its buffer objects.

v2:
- avoid dependency on CONFIG_DRM_KMS_HELPER

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
---
 drivers/gpu/drm/drm_client.c | 20 ++++++++++++--------
 include/drm/drm_client.h     |  9 +++------
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c
index c4db4fc7ba69..0aa56c4b912b 100644
--- a/drivers/gpu/drm/drm_client.c
+++ b/drivers/gpu/drm/drm_client.c
@@ -17,6 +17,7 @@
 #include <drm/drm_fourcc.h>
 #include <drm/drm_framebuffer.h>
 #include <drm/drm_gem.h>
+#include <drm/drm_gem_framebuffer_helper.h>
 #include <drm/drm_mode.h>
 #include <drm/drm_print.h>
 
@@ -178,17 +179,17 @@ EXPORT_SYMBOL(drm_client_release);
 
 static void drm_client_buffer_delete(struct drm_client_buffer *buffer)
 {
+	struct drm_gem_object *gem = buffer->fb->obj[0];
 	int ret;
 
+	drm_gem_vunmap(gem, &buffer->map);
+
 	ret = drm_mode_rmfb(buffer->client->dev, buffer->fb->base.id, buffer->client->file);
 	if (ret)
 		drm_err(buffer->client->dev,
 			"Error removing FB:%u (%d)\n", buffer->fb->base.id, ret);
 
-	if (buffer->gem) {
-		drm_gem_vunmap(buffer->gem, &buffer->map);
-		drm_gem_object_put(buffer->gem);
-	}
+	drm_gem_object_put(buffer->gem);
 
 	kfree(buffer);
 }
@@ -278,7 +279,7 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height,
 int drm_client_buffer_vmap_local(struct drm_client_buffer *buffer,
 				 struct iosys_map *map_copy)
 {
-	struct drm_gem_object *gem = buffer->gem;
+	struct drm_gem_object *gem = buffer->fb->obj[0];
 	struct iosys_map *map = &buffer->map;
 	int ret;
 
@@ -307,7 +308,7 @@ EXPORT_SYMBOL(drm_client_buffer_vmap_local);
  */
 void drm_client_buffer_vunmap_local(struct drm_client_buffer *buffer)
 {
-	struct drm_gem_object *gem = buffer->gem;
+	struct drm_gem_object *gem = buffer->fb->obj[0];
 	struct iosys_map *map = &buffer->map;
 
 	drm_gem_vunmap_locked(gem, map);
@@ -338,9 +339,10 @@ EXPORT_SYMBOL(drm_client_buffer_vunmap_local);
 int drm_client_buffer_vmap(struct drm_client_buffer *buffer,
 			   struct iosys_map *map_copy)
 {
+	struct drm_gem_object *gem = buffer->fb->obj[0];
 	int ret;
 
-	ret = drm_gem_vmap(buffer->gem, &buffer->map);
+	ret = drm_gem_vmap(gem, &buffer->map);
 	if (ret)
 		return ret;
 	*map_copy = buffer->map;
@@ -359,7 +361,9 @@ EXPORT_SYMBOL(drm_client_buffer_vmap);
  */
 void drm_client_buffer_vunmap(struct drm_client_buffer *buffer)
 {
-	drm_gem_vunmap(buffer->gem, &buffer->map);
+	struct drm_gem_object *gem = buffer->fb->obj[0];
+
+	drm_gem_vunmap(gem, &buffer->map);
 }
 EXPORT_SYMBOL(drm_client_buffer_vunmap);
 
diff --git a/include/drm/drm_client.h b/include/drm/drm_client.h
index c674464f7e74..b01fc2a21f09 100644
--- a/include/drm/drm_client.h
+++ b/include/drm/drm_client.h
@@ -176,12 +176,9 @@ struct drm_client_buffer {
 	/**
 	 * @gem: GEM object backing this buffer
 	 *
-	 * FIXME: The dependency on GEM here isn't required, we could
-	 * convert the driver handle to a dma-buf instead and use the
-	 * backend-agnostic dma-buf vmap support instead. This would
-	 * require that the handle2fd prime ioctl is reworked to pull the
-	 * fd_install step out of the driver backend hooks, to make that
-	 * final step optional for internal users.
+	 * FIXME: The DRM framebuffer holds a reference on its GEM
+	 * buffer objects. Do not use this field in new code and
+	 * update existing users.
 	 */
 	struct drm_gem_object *gem;
 
-- 
2.51.1

Re: [REGRESSION][ASAN] drm/client: Deprecate struct drm_client_buffer.gem

[Ian Forbes]

[-- Attachment #1: Type: text/plain, Size: 7296 bytes --]

On Mon, Oct 27, 2025 at 7:11 AM Thomas Zimmermann <tzimmermann@suse.de> wrote:
>
> The client buffer's framebuffer holds a reference and pointer on
> each of its GEM buffer objects. Thus the field gem in the client-
> buffer struct is not necessary. Deprecated the field and convert
> the client-buffer helpers to use the framebuffer's objects.
>
> In drm_client_buffer_delete(), do a possible vunmap before releasing
> the framebuffer. Otherwise we'd eventually release the framebuffer
> before unmaping its buffer objects.
>
> v2:
> - avoid dependency on CONFIG_DRM_KMS_HELPER
>
> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
> ---

This patch has caused a crash on vmwgfx with ASAN enabled.

[   22.286155] Console: switching to colour dummy device 80x25
[   22.359287] vmwgfx 0000:00:0f.0: vgaarb: deactivate vga console
[   22.388482] vmwgfx 0000:00:0f.0: [drm] FIFO at 0x00000000fb800000
size is 8192 KiB
[   22.390036] vmwgfx 0000:00:0f.0: [drm] VRAM at 0x00000000f0000000
size is 131072 KiB
[   22.391255] vmwgfx 0000:00:0f.0: [drm] Running on SVGA version 2.
[   22.392209] vmwgfx 0000:00:0f.0: [drm] Capabilities: rect copy,
cursor, cursor bypass, cursor bypass 2, 8bit emulation, alpha cursor,
3D, extended fifo, multimon, pitchlock, irq mask, display topology,
gmr, traces, gmr2, screen object 2, command buffers, command buffers
2, gbobject, dx, hp cmd queue, no bb restriction, cap2 register,
[   22.396463] vmwgfx 0000:00:0f.0: [drm] Capabilities2: grow otable,
intra surface copy, dx2, gb memsize 2, screendma reg, otable ptdepth2,
non ms to ms stretchblt, cursor mob, mshint, cb max size 4mb, dx3,
frame type, trace full fb, extra regs, lo staging,
[   22.400175] vmwgfx 0000:00:0f.0: [drm] DMA map mode: Caching DMA mappings.
[   22.400224] audit: type=1130 audit(1761925118.444:63): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=systemd-fsck@dev-disk-by\x2duuid-AFBE\x2d8A94 comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'
[   22.401320] vmwgfx 0000:00:0f.0: [drm] Legacy memory limits: VRAM =
4096 KiB, FIFO = 256 KiB, surface = 0 KiB
[   22.406225] vmwgfx 0000:00:0f.0: [drm] MOB limits: max mob size =
1048576 KiB, max mob pages = 524288
[   22.407602] vmwgfx 0000:00:0f.0: [drm] Max GMR ids is 64
[   22.408398] vmwgfx 0000:00:0f.0: [drm] Max number of GMR pages is 65536
[   22.409393] vmwgfx 0000:00:0f.0: [drm] Maximum display memory size
is 262144 KiB
[   22.419541] vmwgfx 0000:00:0f.0: [drm] Screen Target display unit initialized
[   22.422876] vmwgfx 0000:00:0f.0: [drm] Fifo max 0x00040000 min
0x00001000 cap 0x0000077f
[   22.426030] vmwgfx 0000:00:0f.0: [drm] Using command buffers with DMA pool.
[   22.427664] vmwgfx 0000:00:0f.0: [drm] Available shader model: SM_5_1X.
[   22.621336] [drm] Initialized vmwgfx 2.21.0 for 0000:00:0f.0 on minor 0
[   22.627782] fbcon: vmwgfxdrmfb (fb0) is primary device
[   22.640191] Console: switching to colour frame buffer device 160x50
[   22.641788] Oops: general protection fault, probably for
non-canonical address 0xdffffc000000001f: 0000 [#1] SMP KASAN NOPTI
[   22.641795] KASAN: null-ptr-deref in range
[0x00000000000000f8-0x00000000000000ff]
[   22.641802] CPU: 6 UID: 0 PID: 134 Comm: kworker/6:1 Not tainted
6.18.0-rc2+ #63 PREEMPT(lazy)
[   22.641809] Hardware name: VMware, Inc. VMware20,1/440BX Desktop
Reference Platform, BIOS VMW201.00V.24928539.B64.2508260915 08/26/2025
[   22.641812] Workqueue: events drm_fb_helper_damage_work
[   22.641824] RIP: 0010:drm_gem_lock+0x25/0x50
[   22.641831] Code: 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 b8
00 00 00 00 00 fc ff df 53 48 89 fb 48 81 c7 f8 00 00 00 48 89 fa 48
c1 ea 03 <80> 3c 02 00 75 0f 48 8b bb f8 00 00 00 31 f6 5b e9 16 2e 15
01 e8
[   22.641835] RSP: 0018:ffff88810638fb78 EFLAGS: 00010202
[   22.641838] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff9e694d16
[   22.641841] RDX: 000000000000001f RSI: ffff88810638fbf0 RDI: 00000000000000f8
[   22.641844] RBP: ffff88810638fbb0 R08: 0000000000000001 R09: ffffed1020c71f6d
[   22.641847] R10: ffff88810638fb6f R11: 0000000000000006 R12: 0000000000000000
[   22.641849] R13: ffff88810bfc6710 R14: ffff88810638fbf0 R15: ffff88810638fbf0
[   22.641852] FS:  0000000000000000(0000) GS:ffff8882b6b3b000(0000)
knlGS:0000000000000000
[   22.641855] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   22.641858] CR2: 00007f7357b568a1 CR3: 0000000106a70006 CR4: 00000000007706f0
[   22.641887] PKRU: 55555554
[   22.641889] Call Trace:
[   22.641891]  <TASK>
[   22.641894]  drm_client_buffer_vmap_local+0x78/0x140
[   22.641903]  drm_fbdev_ttm_helper_fb_dirty+0x20c/0x510 [drm_ttm_helper]
[   22.641913]  ? __pfx_drm_fbdev_ttm_helper_fb_dirty+0x10/0x10 [drm_ttm_helper]
[   22.641918]  ? __raw_spin_lock_irqsave+0x8c/0xf0
[   22.641924]  ? __pfx___raw_spin_lock_irqsave+0x10/0x10
[   22.641928]  ? __pfx_mutex_lock+0x10/0x10
[   22.641936]  drm_fb_helper_fb_dirty+0x29a/0x5e0
[   22.641942]  ? __pfx_drm_fb_helper_fb_dirty+0x10/0x10
[   22.641946]  ? _raw_spin_lock_irq+0x8a/0xe0
[   22.641950]  ? __pfx__raw_spin_lock_irq+0x10/0x10
[   22.641955]  process_one_work+0x668/0xeb0
[   22.641962]  worker_thread+0x5f6/0x1060
[   22.641967]  ? __kthread_parkme+0x8d/0x170
[   22.641972]  ? __pfx_worker_thread+0x10/0x10
[   22.641976]  kthread+0x36f/0x710
[   22.641980]  ? __pfx_kthread+0x10/0x10
[   22.641983]  ? __pfx__raw_spin_lock_irq+0x10/0x10
[   22.641987]  ? __pfx_kthread+0x10/0x10
[   22.641990]  ret_from_fork+0x1c9/0x260
[   22.641995]  ? __pfx_kthread+0x10/0x10
[   22.641999]  ret_from_fork_asm+0x1a/0x30
[   22.642004]  </TASK>
[   22.642006] Modules linked in: vfat(+) snd_ac97_codec(+) vmxnet3(+)
ac97_bus fat snd_seq snd_pcm gameport vmwgfx(+) snd_rawmidi
snd_seq_device snd_timer drm_ttm_helper snd i2c_piix4 ttm i2c_smbus
joydev soundcore loop nfnetlink vsock_loopback
vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock zram
vmw_vmci lz4hc_compress lz4_compress polyval_clmulni
ghash_clmulni_intel ata_generic pata_acpi serio_raw fuse
[   22.642056] ---[ end trace 0000000000000000 ]---
[   22.642059] RIP: 0010:drm_gem_lock+0x25/0x50
[   22.642063] Code: 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 b8
00 00 00 00 00 fc ff df 53 48 89 fb 48 81 c7 f8 00 00 00 48 89 fa 48
c1 ea 03 <80> 3c 02 00 75 0f 48 8b bb f8 00 00 00 31 f6 5b e9 16 2e 15
01 e8
[   22.642066] RSP: 0018:ffff88810638fb78 EFLAGS: 00010202
[   22.642069] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff9e694d16
[   22.642072] RDX: 000000000000001f RSI: ffff88810638fbf0 RDI: 00000000000000f8
[   22.642074] RBP: ffff88810638fbb0 R08: 0000000000000001 R09: ffffed1020c71f6d
[   22.642077] R10: ffff88810638fb6f R11: 0000000000000006 R12: 0000000000000000
[   22.642079] R13: ffff88810bfc6710 R14: ffff88810638fbf0 R15: ffff88810638fbf0
[   22.642082] FS:  0000000000000000(0000) GS:ffff8882b6b3b000(0000)
knlGS:0000000000000000
[   22.642085] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   22.642087] CR2: 00007f7357b568a1 CR3: 0000000106a70006 CR4: 00000000007706f0
[   22.642112] PKRU: 55555554

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5414 bytes --]

Re: [REGRESSION][ASAN] drm/client: Deprecate struct drm_client_buffer.gem

[Thomas Zimmermann]

Hi

Am 31.10.25 um 16:49 schrieb Ian Forbes:
> On Mon, Oct 27, 2025 at 7:11 AM Thomas Zimmermann <tzimmermann@suse.de> wrote:
>> The client buffer's framebuffer holds a reference and pointer on
>> each of its GEM buffer objects. Thus the field gem in the client-
>> buffer struct is not necessary. Deprecated the field and convert
>> the client-buffer helpers to use the framebuffer's objects.
>>
>> In drm_client_buffer_delete(), do a possible vunmap before releasing
>> the framebuffer. Otherwise we'd eventually release the framebuffer
>> before unmaping its buffer objects.
>>
>> v2:
>> - avoid dependency on CONFIG_DRM_KMS_HELPER
>>
>> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
>> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
>> ---
> This patch has caused a crash on vmwgfx with ASAN enabled.

I haven't tried, but I think we need to set obj[0] in struct 
drm_framebuffer near [1]. It's done in another case already [2].

Best regards
Thomas

[1] 
https://elixir.bootlin.com/linux/v6.17.6/source/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c#L555
[2] 
https://elixir.bootlin.com/linux/v6.17.6/source/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c#L638

>
> [   22.286155] Console: switching to colour dummy device 80x25
> [   22.359287] vmwgfx 0000:00:0f.0: vgaarb: deactivate vga console
> [   22.388482] vmwgfx 0000:00:0f.0: [drm] FIFO at 0x00000000fb800000
> size is 8192 KiB
> [   22.390036] vmwgfx 0000:00:0f.0: [drm] VRAM at 0x00000000f0000000
> size is 131072 KiB
> [   22.391255] vmwgfx 0000:00:0f.0: [drm] Running on SVGA version 2.
> [   22.392209] vmwgfx 0000:00:0f.0: [drm] Capabilities: rect copy,
> cursor, cursor bypass, cursor bypass 2, 8bit emulation, alpha cursor,
> 3D, extended fifo, multimon, pitchlock, irq mask, display topology,
> gmr, traces, gmr2, screen object 2, command buffers, command buffers
> 2, gbobject, dx, hp cmd queue, no bb restriction, cap2 register,
> [   22.396463] vmwgfx 0000:00:0f.0: [drm] Capabilities2: grow otable,
> intra surface copy, dx2, gb memsize 2, screendma reg, otable ptdepth2,
> non ms to ms stretchblt, cursor mob, mshint, cb max size 4mb, dx3,
> frame type, trace full fb, extra regs, lo staging,
> [   22.400175] vmwgfx 0000:00:0f.0: [drm] DMA map mode: Caching DMA mappings.
> [   22.400224] audit: type=1130 audit(1761925118.444:63): pid=1 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
> msg='unit=systemd-fsck@dev-disk-by\x2duuid-AFBE\x2d8A94 comm="systemd"
> exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
> res=success'
> [   22.401320] vmwgfx 0000:00:0f.0: [drm] Legacy memory limits: VRAM =
> 4096 KiB, FIFO = 256 KiB, surface = 0 KiB
> [   22.406225] vmwgfx 0000:00:0f.0: [drm] MOB limits: max mob size =
> 1048576 KiB, max mob pages = 524288
> [   22.407602] vmwgfx 0000:00:0f.0: [drm] Max GMR ids is 64
> [   22.408398] vmwgfx 0000:00:0f.0: [drm] Max number of GMR pages is 65536
> [   22.409393] vmwgfx 0000:00:0f.0: [drm] Maximum display memory size
> is 262144 KiB
> [   22.419541] vmwgfx 0000:00:0f.0: [drm] Screen Target display unit initialized
> [   22.422876] vmwgfx 0000:00:0f.0: [drm] Fifo max 0x00040000 min
> 0x00001000 cap 0x0000077f
> [   22.426030] vmwgfx 0000:00:0f.0: [drm] Using command buffers with DMA pool.
> [   22.427664] vmwgfx 0000:00:0f.0: [drm] Available shader model: SM_5_1X.
> [   22.621336] [drm] Initialized vmwgfx 2.21.0 for 0000:00:0f.0 on minor 0
> [   22.627782] fbcon: vmwgfxdrmfb (fb0) is primary device
> [   22.640191] Console: switching to colour frame buffer device 160x50
> [   22.641788] Oops: general protection fault, probably for
> non-canonical address 0xdffffc000000001f: 0000 [#1] SMP KASAN NOPTI
> [   22.641795] KASAN: null-ptr-deref in range
> [0x00000000000000f8-0x00000000000000ff]
> [   22.641802] CPU: 6 UID: 0 PID: 134 Comm: kworker/6:1 Not tainted
> 6.18.0-rc2+ #63 PREEMPT(lazy)
> [   22.641809] Hardware name: VMware, Inc. VMware20,1/440BX Desktop
> Reference Platform, BIOS VMW201.00V.24928539.B64.2508260915 08/26/2025
> [   22.641812] Workqueue: events drm_fb_helper_damage_work
> [   22.641824] RIP: 0010:drm_gem_lock+0x25/0x50
> [   22.641831] Code: 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 b8
> 00 00 00 00 00 fc ff df 53 48 89 fb 48 81 c7 f8 00 00 00 48 89 fa 48
> c1 ea 03 <80> 3c 02 00 75 0f 48 8b bb f8 00 00 00 31 f6 5b e9 16 2e 15
> 01 e8
> [   22.641835] RSP: 0018:ffff88810638fb78 EFLAGS: 00010202
> [   22.641838] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff9e694d16
> [   22.641841] RDX: 000000000000001f RSI: ffff88810638fbf0 RDI: 00000000000000f8
> [   22.641844] RBP: ffff88810638fbb0 R08: 0000000000000001 R09: ffffed1020c71f6d
> [   22.641847] R10: ffff88810638fb6f R11: 0000000000000006 R12: 0000000000000000
> [   22.641849] R13: ffff88810bfc6710 R14: ffff88810638fbf0 R15: ffff88810638fbf0
> [   22.641852] FS:  0000000000000000(0000) GS:ffff8882b6b3b000(0000)
> knlGS:0000000000000000
> [   22.641855] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   22.641858] CR2: 00007f7357b568a1 CR3: 0000000106a70006 CR4: 00000000007706f0
> [   22.641887] PKRU: 55555554
> [   22.641889] Call Trace:
> [   22.641891]  <TASK>
> [   22.641894]  drm_client_buffer_vmap_local+0x78/0x140
> [   22.641903]  drm_fbdev_ttm_helper_fb_dirty+0x20c/0x510 [drm_ttm_helper]
> [   22.641913]  ? __pfx_drm_fbdev_ttm_helper_fb_dirty+0x10/0x10 [drm_ttm_helper]
> [   22.641918]  ? __raw_spin_lock_irqsave+0x8c/0xf0
> [   22.641924]  ? __pfx___raw_spin_lock_irqsave+0x10/0x10
> [   22.641928]  ? __pfx_mutex_lock+0x10/0x10
> [   22.641936]  drm_fb_helper_fb_dirty+0x29a/0x5e0
> [   22.641942]  ? __pfx_drm_fb_helper_fb_dirty+0x10/0x10
> [   22.641946]  ? _raw_spin_lock_irq+0x8a/0xe0
> [   22.641950]  ? __pfx__raw_spin_lock_irq+0x10/0x10
> [   22.641955]  process_one_work+0x668/0xeb0
> [   22.641962]  worker_thread+0x5f6/0x1060
> [   22.641967]  ? __kthread_parkme+0x8d/0x170
> [   22.641972]  ? __pfx_worker_thread+0x10/0x10
> [   22.641976]  kthread+0x36f/0x710
> [   22.641980]  ? __pfx_kthread+0x10/0x10
> [   22.641983]  ? __pfx__raw_spin_lock_irq+0x10/0x10
> [   22.641987]  ? __pfx_kthread+0x10/0x10
> [   22.641990]  ret_from_fork+0x1c9/0x260
> [   22.641995]  ? __pfx_kthread+0x10/0x10
> [   22.641999]  ret_from_fork_asm+0x1a/0x30
> [   22.642004]  </TASK>
> [   22.642006] Modules linked in: vfat(+) snd_ac97_codec(+) vmxnet3(+)
> ac97_bus fat snd_seq snd_pcm gameport vmwgfx(+) snd_rawmidi
> snd_seq_device snd_timer drm_ttm_helper snd i2c_piix4 ttm i2c_smbus
> joydev soundcore loop nfnetlink vsock_loopback
> vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock zram
> vmw_vmci lz4hc_compress lz4_compress polyval_clmulni
> ghash_clmulni_intel ata_generic pata_acpi serio_raw fuse
> [   22.642056] ---[ end trace 0000000000000000 ]---
> [   22.642059] RIP: 0010:drm_gem_lock+0x25/0x50
> [   22.642063] Code: 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 b8
> 00 00 00 00 00 fc ff df 53 48 89 fb 48 81 c7 f8 00 00 00 48 89 fa 48
> c1 ea 03 <80> 3c 02 00 75 0f 48 8b bb f8 00 00 00 31 f6 5b e9 16 2e 15
> 01 e8
> [   22.642066] RSP: 0018:ffff88810638fb78 EFLAGS: 00010202
> [   22.642069] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff9e694d16
> [   22.642072] RDX: 000000000000001f RSI: ffff88810638fbf0 RDI: 00000000000000f8
> [   22.642074] RBP: ffff88810638fbb0 R08: 0000000000000001 R09: ffffed1020c71f6d
> [   22.642077] R10: ffff88810638fb6f R11: 0000000000000006 R12: 0000000000000000
> [   22.642079] R13: ffff88810bfc6710 R14: ffff88810638fbf0 R15: ffff88810638fbf0
> [   22.642082] FS:  0000000000000000(0000) GS:ffff8882b6b3b000(0000)
> knlGS:0000000000000000
> [   22.642085] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   22.642087] CR2: 00007f7357b568a1 CR3: 0000000106a70006 CR4: 00000000007706f0
> [   22.642112] PKRU: 55555554

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

Re: [REGRESSION][ASAN] drm/client: Deprecate struct drm_client_buffer.gem

[Thomas Zimmermann]

Hi

Am 31.10.25 um 16:49 schrieb Ian Forbes:
> On Mon, Oct 27, 2025 at 7:11 AM Thomas Zimmermann <tzimmermann@suse.de> wrote:
>> The client buffer's framebuffer holds a reference and pointer on
>> each of its GEM buffer objects. Thus the field gem in the client-
>> buffer struct is not necessary. Deprecated the field and convert
>> the client-buffer helpers to use the framebuffer's objects.
>>
>> In drm_client_buffer_delete(), do a possible vunmap before releasing
>> the framebuffer. Otherwise we'd eventually release the framebuffer
>> before unmaping its buffer objects.
>>
>> v2:
>> - avoid dependency on CONFIG_DRM_KMS_HELPER
>>
>> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
>> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
>> ---
> This patch has caused a crash on vmwgfx with ASAN enabled.

A possible fix is available at 
https://lore.kernel.org/dri-devel/20251104103611.167821-1-tzimmermann@suse.de/T/#u

Best regards
Thomas

>
> [   22.286155] Console: switching to colour dummy device 80x25
> [   22.359287] vmwgfx 0000:00:0f.0: vgaarb: deactivate vga console
> [   22.388482] vmwgfx 0000:00:0f.0: [drm] FIFO at 0x00000000fb800000
> size is 8192 KiB
> [   22.390036] vmwgfx 0000:00:0f.0: [drm] VRAM at 0x00000000f0000000
> size is 131072 KiB
> [   22.391255] vmwgfx 0000:00:0f.0: [drm] Running on SVGA version 2.
> [   22.392209] vmwgfx 0000:00:0f.0: [drm] Capabilities: rect copy,
> cursor, cursor bypass, cursor bypass 2, 8bit emulation, alpha cursor,
> 3D, extended fifo, multimon, pitchlock, irq mask, display topology,
> gmr, traces, gmr2, screen object 2, command buffers, command buffers
> 2, gbobject, dx, hp cmd queue, no bb restriction, cap2 register,
> [   22.396463] vmwgfx 0000:00:0f.0: [drm] Capabilities2: grow otable,
> intra surface copy, dx2, gb memsize 2, screendma reg, otable ptdepth2,
> non ms to ms stretchblt, cursor mob, mshint, cb max size 4mb, dx3,
> frame type, trace full fb, extra regs, lo staging,
> [   22.400175] vmwgfx 0000:00:0f.0: [drm] DMA map mode: Caching DMA mappings.
> [   22.400224] audit: type=1130 audit(1761925118.444:63): pid=1 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
> msg='unit=systemd-fsck@dev-disk-by\x2duuid-AFBE\x2d8A94 comm="systemd"
> exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
> res=success'
> [   22.401320] vmwgfx 0000:00:0f.0: [drm] Legacy memory limits: VRAM =
> 4096 KiB, FIFO = 256 KiB, surface = 0 KiB
> [   22.406225] vmwgfx 0000:00:0f.0: [drm] MOB limits: max mob size =
> 1048576 KiB, max mob pages = 524288
> [   22.407602] vmwgfx 0000:00:0f.0: [drm] Max GMR ids is 64
> [   22.408398] vmwgfx 0000:00:0f.0: [drm] Max number of GMR pages is 65536
> [   22.409393] vmwgfx 0000:00:0f.0: [drm] Maximum display memory size
> is 262144 KiB
> [   22.419541] vmwgfx 0000:00:0f.0: [drm] Screen Target display unit initialized
> [   22.422876] vmwgfx 0000:00:0f.0: [drm] Fifo max 0x00040000 min
> 0x00001000 cap 0x0000077f
> [   22.426030] vmwgfx 0000:00:0f.0: [drm] Using command buffers with DMA pool.
> [   22.427664] vmwgfx 0000:00:0f.0: [drm] Available shader model: SM_5_1X.
> [   22.621336] [drm] Initialized vmwgfx 2.21.0 for 0000:00:0f.0 on minor 0
> [   22.627782] fbcon: vmwgfxdrmfb (fb0) is primary device
> [   22.640191] Console: switching to colour frame buffer device 160x50
> [   22.641788] Oops: general protection fault, probably for
> non-canonical address 0xdffffc000000001f: 0000 [#1] SMP KASAN NOPTI
> [   22.641795] KASAN: null-ptr-deref in range
> [0x00000000000000f8-0x00000000000000ff]
> [   22.641802] CPU: 6 UID: 0 PID: 134 Comm: kworker/6:1 Not tainted
> 6.18.0-rc2+ #63 PREEMPT(lazy)
> [   22.641809] Hardware name: VMware, Inc. VMware20,1/440BX Desktop
> Reference Platform, BIOS VMW201.00V.24928539.B64.2508260915 08/26/2025
> [   22.641812] Workqueue: events drm_fb_helper_damage_work
> [   22.641824] RIP: 0010:drm_gem_lock+0x25/0x50
> [   22.641831] Code: 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 b8
> 00 00 00 00 00 fc ff df 53 48 89 fb 48 81 c7 f8 00 00 00 48 89 fa 48
> c1 ea 03 <80> 3c 02 00 75 0f 48 8b bb f8 00 00 00 31 f6 5b e9 16 2e 15
> 01 e8
> [   22.641835] RSP: 0018:ffff88810638fb78 EFLAGS: 00010202
> [   22.641838] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff9e694d16
> [   22.641841] RDX: 000000000000001f RSI: ffff88810638fbf0 RDI: 00000000000000f8
> [   22.641844] RBP: ffff88810638fbb0 R08: 0000000000000001 R09: ffffed1020c71f6d
> [   22.641847] R10: ffff88810638fb6f R11: 0000000000000006 R12: 0000000000000000
> [   22.641849] R13: ffff88810bfc6710 R14: ffff88810638fbf0 R15: ffff88810638fbf0
> [   22.641852] FS:  0000000000000000(0000) GS:ffff8882b6b3b000(0000)
> knlGS:0000000000000000
> [   22.641855] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   22.641858] CR2: 00007f7357b568a1 CR3: 0000000106a70006 CR4: 00000000007706f0
> [   22.641887] PKRU: 55555554
> [   22.641889] Call Trace:
> [   22.641891]  <TASK>
> [   22.641894]  drm_client_buffer_vmap_local+0x78/0x140
> [   22.641903]  drm_fbdev_ttm_helper_fb_dirty+0x20c/0x510 [drm_ttm_helper]
> [   22.641913]  ? __pfx_drm_fbdev_ttm_helper_fb_dirty+0x10/0x10 [drm_ttm_helper]
> [   22.641918]  ? __raw_spin_lock_irqsave+0x8c/0xf0
> [   22.641924]  ? __pfx___raw_spin_lock_irqsave+0x10/0x10
> [   22.641928]  ? __pfx_mutex_lock+0x10/0x10
> [   22.641936]  drm_fb_helper_fb_dirty+0x29a/0x5e0
> [   22.641942]  ? __pfx_drm_fb_helper_fb_dirty+0x10/0x10
> [   22.641946]  ? _raw_spin_lock_irq+0x8a/0xe0
> [   22.641950]  ? __pfx__raw_spin_lock_irq+0x10/0x10
> [   22.641955]  process_one_work+0x668/0xeb0
> [   22.641962]  worker_thread+0x5f6/0x1060
> [   22.641967]  ? __kthread_parkme+0x8d/0x170
> [   22.641972]  ? __pfx_worker_thread+0x10/0x10
> [   22.641976]  kthread+0x36f/0x710
> [   22.641980]  ? __pfx_kthread+0x10/0x10
> [   22.641983]  ? __pfx__raw_spin_lock_irq+0x10/0x10
> [   22.641987]  ? __pfx_kthread+0x10/0x10
> [   22.641990]  ret_from_fork+0x1c9/0x260
> [   22.641995]  ? __pfx_kthread+0x10/0x10
> [   22.641999]  ret_from_fork_asm+0x1a/0x30
> [   22.642004]  </TASK>
> [   22.642006] Modules linked in: vfat(+) snd_ac97_codec(+) vmxnet3(+)
> ac97_bus fat snd_seq snd_pcm gameport vmwgfx(+) snd_rawmidi
> snd_seq_device snd_timer drm_ttm_helper snd i2c_piix4 ttm i2c_smbus
> joydev soundcore loop nfnetlink vsock_loopback
> vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock zram
> vmw_vmci lz4hc_compress lz4_compress polyval_clmulni
> ghash_clmulni_intel ata_generic pata_acpi serio_raw fuse
> [   22.642056] ---[ end trace 0000000000000000 ]---
> [   22.642059] RIP: 0010:drm_gem_lock+0x25/0x50
> [   22.642063] Code: 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 b8
> 00 00 00 00 00 fc ff df 53 48 89 fb 48 81 c7 f8 00 00 00 48 89 fa 48
> c1 ea 03 <80> 3c 02 00 75 0f 48 8b bb f8 00 00 00 31 f6 5b e9 16 2e 15
> 01 e8
> [   22.642066] RSP: 0018:ffff88810638fb78 EFLAGS: 00010202
> [   22.642069] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff9e694d16
> [   22.642072] RDX: 000000000000001f RSI: ffff88810638fbf0 RDI: 00000000000000f8
> [   22.642074] RBP: ffff88810638fbb0 R08: 0000000000000001 R09: ffffed1020c71f6d
> [   22.642077] R10: ffff88810638fb6f R11: 0000000000000006 R12: 0000000000000000
> [   22.642079] R13: ffff88810bfc6710 R14: ffff88810638fbf0 R15: ffff88810638fbf0
> [   22.642082] FS:  0000000000000000(0000) GS:ffff8882b6b3b000(0000)
> knlGS:0000000000000000
> [   22.642085] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   22.642087] CR2: 00007f7357b568a1 CR3: 0000000106a70006 CR4: 00000000007706f0
> [   22.642112] PKRU: 55555554

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

[PATCH v2 5/7] drm/client: Remove drm_client_framebuffer_delete()

[Thomas Zimmermann]

Release client buffers with drm_client_buffer_delete() instead of
drm_client_framebuffer_delete(). The latter is just a tiny wrapper
around the former.

Move the test for !buffer into drm_client_buffer_delete(), although
all callers appear to always have a valid pointer.

v2:
- test for !buffer before deref-ing pointer (Jocelyn, Dan)

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
---
 drivers/gpu/drm/clients/drm_log.c |  4 ++--
 drivers/gpu/drm/drm_client.c      | 28 ++++++++++++----------------
 drivers/gpu/drm/drm_fbdev_dma.c   |  6 +++---
 drivers/gpu/drm/drm_fbdev_shmem.c |  4 ++--
 drivers/gpu/drm/drm_fbdev_ttm.c   |  8 ++++----
 include/drm/drm_client.h          |  2 +-
 6 files changed, 24 insertions(+), 28 deletions(-)

diff --git a/drivers/gpu/drm/clients/drm_log.c b/drivers/gpu/drm/clients/drm_log.c
index 24b08fdcb57a..c2ddc57b538e 100644
--- a/drivers/gpu/drm/clients/drm_log.c
+++ b/drivers/gpu/drm/clients/drm_log.c
@@ -272,7 +272,7 @@ static void drm_log_init_client(struct drm_log *dlog)
 
 err_failed_commit:
 	for (i = 0; i < n_modeset; i++)
-		drm_client_framebuffer_delete(dlog->scanout[i].buffer);
+		drm_client_buffer_delete(dlog->scanout[i].buffer);
 
 err_nomodeset:
 	kfree(dlog->scanout);
@@ -286,7 +286,7 @@ static void drm_log_free_scanout(struct drm_client_dev *client)
 
 	if (dlog->n_scanout) {
 		for (i = 0; i < dlog->n_scanout; i++)
-			drm_client_framebuffer_delete(dlog->scanout[i].buffer);
+			drm_client_buffer_delete(dlog->scanout[i].buffer);
 		dlog->n_scanout = 0;
 		kfree(dlog->scanout);
 		dlog->scanout = NULL;
diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c
index 0aa56c4b912b..b4e37bb2041b 100644
--- a/drivers/gpu/drm/drm_client.c
+++ b/drivers/gpu/drm/drm_client.c
@@ -177,11 +177,19 @@ void drm_client_release(struct drm_client_dev *client)
 }
 EXPORT_SYMBOL(drm_client_release);
 
-static void drm_client_buffer_delete(struct drm_client_buffer *buffer)
+/**
+ * drm_client_buffer_delete - Delete a client buffer
+ * @buffer: DRM client buffer
+ */
+void drm_client_buffer_delete(struct drm_client_buffer *buffer)
 {
-	struct drm_gem_object *gem = buffer->fb->obj[0];
+	struct drm_gem_object *gem;
 	int ret;
 
+	if (!buffer)
+		return;
+
+	gem = buffer->fb->obj[0];
 	drm_gem_vunmap(gem, &buffer->map);
 
 	ret = drm_mode_rmfb(buffer->client->dev, buffer->fb->base.id, buffer->client->file);
@@ -193,6 +201,7 @@ static void drm_client_buffer_delete(struct drm_client_buffer *buffer)
 
 	kfree(buffer);
 }
+EXPORT_SYMBOL(drm_client_buffer_delete);
 
 static struct drm_client_buffer *
 drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height,
@@ -376,7 +385,7 @@ EXPORT_SYMBOL(drm_client_buffer_vunmap);
  *
  * This function creates a &drm_client_buffer which consists of a
  * &drm_framebuffer backed by a dumb buffer.
- * Call drm_client_framebuffer_delete() to free the buffer.
+ * Call drm_client_buffer_delete() to free the buffer.
  *
  * Returns:
  * Pointer to a client buffer or an error pointer on failure.
@@ -420,19 +429,6 @@ drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 heig
 }
 EXPORT_SYMBOL(drm_client_framebuffer_create);
 
-/**
- * drm_client_framebuffer_delete - Delete a client framebuffer
- * @buffer: DRM client buffer (can be NULL)
- */
-void drm_client_framebuffer_delete(struct drm_client_buffer *buffer)
-{
-	if (!buffer)
-		return;
-
-	drm_client_buffer_delete(buffer);
-}
-EXPORT_SYMBOL(drm_client_framebuffer_delete);
-
 /**
  * drm_client_framebuffer_flush - Manually flush client framebuffer
  * @buffer: DRM client buffer (can be NULL)
diff --git a/drivers/gpu/drm/drm_fbdev_dma.c b/drivers/gpu/drm/drm_fbdev_dma.c
index c6196293e424..6216de1446c1 100644
--- a/drivers/gpu/drm/drm_fbdev_dma.c
+++ b/drivers/gpu/drm/drm_fbdev_dma.c
@@ -55,7 +55,7 @@ static void drm_fbdev_dma_fb_destroy(struct fb_info *info)
 	drm_fb_helper_fini(fb_helper);
 
 	drm_client_buffer_vunmap(fb_helper->buffer);
-	drm_client_framebuffer_delete(fb_helper->buffer);
+	drm_client_buffer_delete(fb_helper->buffer);
 	drm_client_release(&fb_helper->client);
 }
 
@@ -88,7 +88,7 @@ static void drm_fbdev_dma_shadowed_fb_destroy(struct fb_info *info)
 	vfree(shadow);
 
 	drm_client_buffer_vunmap(fb_helper->buffer);
-	drm_client_framebuffer_delete(fb_helper->buffer);
+	drm_client_buffer_delete(fb_helper->buffer);
 	drm_client_release(&fb_helper->client);
 }
 
@@ -324,7 +324,7 @@ int drm_fbdev_dma_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	fb_helper->buffer = NULL;
 	drm_client_buffer_vunmap(buffer);
 err_drm_client_buffer_delete:
-	drm_client_framebuffer_delete(buffer);
+	drm_client_buffer_delete(buffer);
 	return ret;
 }
 EXPORT_SYMBOL(drm_fbdev_dma_driver_fbdev_probe);
diff --git a/drivers/gpu/drm/drm_fbdev_shmem.c b/drivers/gpu/drm/drm_fbdev_shmem.c
index 51573058df6f..520c2218e5dc 100644
--- a/drivers/gpu/drm/drm_fbdev_shmem.c
+++ b/drivers/gpu/drm/drm_fbdev_shmem.c
@@ -63,7 +63,7 @@ static void drm_fbdev_shmem_fb_destroy(struct fb_info *info)
 	drm_fb_helper_fini(fb_helper);
 
 	drm_client_buffer_vunmap(fb_helper->buffer);
-	drm_client_framebuffer_delete(fb_helper->buffer);
+	drm_client_buffer_delete(fb_helper->buffer);
 	drm_client_release(&fb_helper->client);
 }
 
@@ -204,7 +204,7 @@ int drm_fbdev_shmem_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	fb_helper->buffer = NULL;
 	drm_client_buffer_vunmap(buffer);
 err_drm_client_buffer_delete:
-	drm_client_framebuffer_delete(buffer);
+	drm_client_buffer_delete(buffer);
 	return ret;
 }
 EXPORT_SYMBOL(drm_fbdev_shmem_driver_fbdev_probe);
diff --git a/drivers/gpu/drm/drm_fbdev_ttm.c b/drivers/gpu/drm/drm_fbdev_ttm.c
index ccf460fbc1f0..7f7c88461228 100644
--- a/drivers/gpu/drm/drm_fbdev_ttm.c
+++ b/drivers/gpu/drm/drm_fbdev_ttm.c
@@ -50,7 +50,7 @@ static void drm_fbdev_ttm_fb_destroy(struct fb_info *info)
 	fb_deferred_io_cleanup(info);
 	drm_fb_helper_fini(fb_helper);
 	vfree(shadow);
-	drm_client_framebuffer_delete(fb_helper->buffer);
+	drm_client_buffer_delete(fb_helper->buffer);
 
 	drm_client_release(&fb_helper->client);
 }
@@ -200,7 +200,7 @@ int drm_fbdev_ttm_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	screen_buffer = vzalloc(screen_size);
 	if (!screen_buffer) {
 		ret = -ENOMEM;
-		goto err_drm_client_framebuffer_delete;
+		goto err_drm_client_buffer_delete;
 	}
 
 	info = drm_fb_helper_alloc_info(fb_helper);
@@ -233,10 +233,10 @@ int drm_fbdev_ttm_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	drm_fb_helper_release_info(fb_helper);
 err_vfree:
 	vfree(screen_buffer);
-err_drm_client_framebuffer_delete:
+err_drm_client_buffer_delete:
 	fb_helper->fb = NULL;
 	fb_helper->buffer = NULL;
-	drm_client_framebuffer_delete(buffer);
+	drm_client_buffer_delete(buffer);
 	return ret;
 }
 EXPORT_SYMBOL(drm_fbdev_ttm_driver_fbdev_probe);
diff --git a/include/drm/drm_client.h b/include/drm/drm_client.h
index b01fc2a21f09..ffc4013b2e18 100644
--- a/include/drm/drm_client.h
+++ b/include/drm/drm_client.h
@@ -195,7 +195,7 @@ struct drm_client_buffer {
 
 struct drm_client_buffer *
 drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 height, u32 format);
-void drm_client_framebuffer_delete(struct drm_client_buffer *buffer);
+void drm_client_buffer_delete(struct drm_client_buffer *buffer);
 int drm_client_framebuffer_flush(struct drm_client_buffer *buffer, struct drm_rect *rect);
 int drm_client_buffer_vmap_local(struct drm_client_buffer *buffer,
 				 struct iosys_map *map_copy);
-- 
2.51.1

[PATCH v2 6/7] drm/client: Create client buffers with drm_client_buffer_create_dumb()

[Thomas Zimmermann]

Rename drm_client_framebuffer_create() to drm_client_buffer_create_dump()
and adapt callers. The new name reflects the function's purpose. Using
dumb buffers is the easiest way for creating a GEM buffer in a drivers-
independent way.

There's also drm_client_buffer_create(), which creates the client buffer
from a preexisting buffer object. This helper can be exported for drivers
that create their own GEM buffer object.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
---
 drivers/gpu/drm/clients/drm_log.c | 2 +-
 drivers/gpu/drm/drm_client.c      | 6 +++---
 drivers/gpu/drm/drm_fbdev_dma.c   | 2 +-
 drivers/gpu/drm/drm_fbdev_shmem.c | 2 +-
 drivers/gpu/drm/drm_fbdev_ttm.c   | 2 +-
 include/drm/drm_client.h          | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/clients/drm_log.c b/drivers/gpu/drm/clients/drm_log.c
index c2ddc57b538e..48636bb1a21e 100644
--- a/drivers/gpu/drm/clients/drm_log.c
+++ b/drivers/gpu/drm/clients/drm_log.c
@@ -204,7 +204,7 @@ static int drm_log_setup_modeset(struct drm_client_dev *client,
 	if (format == DRM_FORMAT_INVALID)
 		return -EINVAL;
 
-	scanout->buffer = drm_client_framebuffer_create(client, width, height, format);
+	scanout->buffer = drm_client_buffer_create_dumb(client, width, height, format);
 	if (IS_ERR(scanout->buffer)) {
 		drm_warn(client->dev, "drm_log can't create framebuffer %d %d %p4cc\n",
 			 width, height, &format);
diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c
index b4e37bb2041b..e7dfbdeca45a 100644
--- a/drivers/gpu/drm/drm_client.c
+++ b/drivers/gpu/drm/drm_client.c
@@ -377,7 +377,7 @@ void drm_client_buffer_vunmap(struct drm_client_buffer *buffer)
 EXPORT_SYMBOL(drm_client_buffer_vunmap);
 
 /**
- * drm_client_framebuffer_create - Create a client framebuffer
+ * drm_client_buffer_create_dumb - Create a client buffer backed by a dumb buffer
  * @client: DRM client
  * @width: Framebuffer width
  * @height: Framebuffer height
@@ -391,7 +391,7 @@ EXPORT_SYMBOL(drm_client_buffer_vunmap);
  * Pointer to a client buffer or an error pointer on failure.
  */
 struct drm_client_buffer *
-drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 height, u32 format)
+drm_client_buffer_create_dumb(struct drm_client_dev *client, u32 width, u32 height, u32 format)
 {
 	const struct drm_format_info *info = drm_format_info(format);
 	struct drm_device *dev = client->dev;
@@ -427,7 +427,7 @@ drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 heig
 	drm_mode_destroy_dumb(client->dev, dumb_args.handle, client->file);
 	return ERR_PTR(ret);
 }
-EXPORT_SYMBOL(drm_client_framebuffer_create);
+EXPORT_SYMBOL(drm_client_buffer_create_dumb);
 
 /**
  * drm_client_framebuffer_flush - Manually flush client framebuffer
diff --git a/drivers/gpu/drm/drm_fbdev_dma.c b/drivers/gpu/drm/drm_fbdev_dma.c
index 6216de1446c1..876bd8cfc5ea 100644
--- a/drivers/gpu/drm/drm_fbdev_dma.c
+++ b/drivers/gpu/drm/drm_fbdev_dma.c
@@ -281,7 +281,7 @@ int drm_fbdev_dma_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 
 	format = drm_driver_legacy_fb_format(dev, sizes->surface_bpp,
 					     sizes->surface_depth);
-	buffer = drm_client_framebuffer_create(client, sizes->surface_width,
+	buffer = drm_client_buffer_create_dumb(client, sizes->surface_width,
 					       sizes->surface_height, format);
 	if (IS_ERR(buffer))
 		return PTR_ERR(buffer);
diff --git a/drivers/gpu/drm/drm_fbdev_shmem.c b/drivers/gpu/drm/drm_fbdev_shmem.c
index 520c2218e5dc..46e43b60b3f9 100644
--- a/drivers/gpu/drm/drm_fbdev_shmem.c
+++ b/drivers/gpu/drm/drm_fbdev_shmem.c
@@ -147,7 +147,7 @@ int drm_fbdev_shmem_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 		    sizes->surface_bpp);
 
 	format = drm_driver_legacy_fb_format(dev, sizes->surface_bpp, sizes->surface_depth);
-	buffer = drm_client_framebuffer_create(client, sizes->surface_width,
+	buffer = drm_client_buffer_create_dumb(client, sizes->surface_width,
 					       sizes->surface_height, format);
 	if (IS_ERR(buffer))
 		return PTR_ERR(buffer);
diff --git a/drivers/gpu/drm/drm_fbdev_ttm.c b/drivers/gpu/drm/drm_fbdev_ttm.c
index 7f7c88461228..c7ad779ba590 100644
--- a/drivers/gpu/drm/drm_fbdev_ttm.c
+++ b/drivers/gpu/drm/drm_fbdev_ttm.c
@@ -187,7 +187,7 @@ int drm_fbdev_ttm_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 
 	format = drm_driver_legacy_fb_format(dev, sizes->surface_bpp,
 					     sizes->surface_depth);
-	buffer = drm_client_framebuffer_create(client, sizes->surface_width,
+	buffer = drm_client_buffer_create_dumb(client, sizes->surface_width,
 					       sizes->surface_height, format);
 	if (IS_ERR(buffer))
 		return PTR_ERR(buffer);
diff --git a/include/drm/drm_client.h b/include/drm/drm_client.h
index ffc4013b2e18..690ef04fccce 100644
--- a/include/drm/drm_client.h
+++ b/include/drm/drm_client.h
@@ -194,7 +194,7 @@ struct drm_client_buffer {
 };
 
 struct drm_client_buffer *
-drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 height, u32 format);
+drm_client_buffer_create_dumb(struct drm_client_dev *client, u32 width, u32 height, u32 format);
 void drm_client_buffer_delete(struct drm_client_buffer *buffer);
 int drm_client_framebuffer_flush(struct drm_client_buffer *buffer, struct drm_rect *rect);
 int drm_client_buffer_vmap_local(struct drm_client_buffer *buffer,
-- 
2.51.1

[PATCH v2 7/7] drm/client: Flush client buffers with drm_client_buffer_sync()

[Thomas Zimmermann]

Rename drm_client_framebuffer_flush() to drm_cient_buffer_flush() and
adapt its callers. The old name was left over from previous naming
conventions.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
 drivers/gpu/drm/clients/drm_log.c | 4 ++--
 drivers/gpu/drm/drm_client.c      | 8 ++++----
 include/drm/drm_client.h          | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/clients/drm_log.c b/drivers/gpu/drm/clients/drm_log.c
index 48636bb1a21e..19e55aa0ed74 100644
--- a/drivers/gpu/drm/clients/drm_log.c
+++ b/drivers/gpu/drm/clients/drm_log.c
@@ -100,7 +100,7 @@ static void drm_log_clear_line(struct drm_log_scanout *scanout, u32 line)
 		return;
 	iosys_map_memset(&map, r.y1 * fb->pitches[0], 0, height * fb->pitches[0]);
 	drm_client_buffer_vunmap_local(scanout->buffer);
-	drm_client_framebuffer_flush(scanout->buffer, &r);
+	drm_client_buffer_flush(scanout->buffer, &r);
 }
 
 static void drm_log_draw_line(struct drm_log_scanout *scanout, const char *s,
@@ -133,7 +133,7 @@ static void drm_log_draw_line(struct drm_log_scanout *scanout, const char *s,
 	if (scanout->line >= scanout->rows)
 		scanout->line = 0;
 	drm_client_buffer_vunmap_local(scanout->buffer);
-	drm_client_framebuffer_flush(scanout->buffer, &r);
+	drm_client_buffer_flush(scanout->buffer, &r);
 }
 
 static void drm_log_draw_new_line(struct drm_log_scanout *scanout,
diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c
index e7dfbdeca45a..504ec5bdfa2c 100644
--- a/drivers/gpu/drm/drm_client.c
+++ b/drivers/gpu/drm/drm_client.c
@@ -430,8 +430,8 @@ drm_client_buffer_create_dumb(struct drm_client_dev *client, u32 width, u32 heig
 EXPORT_SYMBOL(drm_client_buffer_create_dumb);
 
 /**
- * drm_client_framebuffer_flush - Manually flush client framebuffer
- * @buffer: DRM client buffer (can be NULL)
+ * drm_client_buffer_flush - Manually flush client buffer
+ * @buffer: DRM client buffer
  * @rect: Damage rectangle (if NULL flushes all)
  *
  * This calls &drm_framebuffer_funcs->dirty (if present) to flush buffer changes
@@ -440,7 +440,7 @@ EXPORT_SYMBOL(drm_client_buffer_create_dumb);
  * Returns:
  * Zero on success or negative error code on failure.
  */
-int drm_client_framebuffer_flush(struct drm_client_buffer *buffer, struct drm_rect *rect)
+int drm_client_buffer_flush(struct drm_client_buffer *buffer, struct drm_rect *rect)
 {
 	if (!buffer || !buffer->fb || !buffer->fb->funcs->dirty)
 		return 0;
@@ -460,4 +460,4 @@ int drm_client_framebuffer_flush(struct drm_client_buffer *buffer, struct drm_re
 	return buffer->fb->funcs->dirty(buffer->fb, buffer->client->file,
 					0, 0, NULL, 0);
 }
-EXPORT_SYMBOL(drm_client_framebuffer_flush);
+EXPORT_SYMBOL(drm_client_buffer_flush);
diff --git a/include/drm/drm_client.h b/include/drm/drm_client.h
index 690ef04fccce..5ecde0f6f591 100644
--- a/include/drm/drm_client.h
+++ b/include/drm/drm_client.h
@@ -196,7 +196,7 @@ struct drm_client_buffer {
 struct drm_client_buffer *
 drm_client_buffer_create_dumb(struct drm_client_dev *client, u32 width, u32 height, u32 format);
 void drm_client_buffer_delete(struct drm_client_buffer *buffer);
-int drm_client_framebuffer_flush(struct drm_client_buffer *buffer, struct drm_rect *rect);
+int drm_client_buffer_flush(struct drm_client_buffer *buffer, struct drm_rect *rect);
 int drm_client_buffer_vmap_local(struct drm_client_buffer *buffer,
 				 struct iosys_map *map_copy);
 void drm_client_buffer_vunmap_local(struct drm_client_buffer *buffer);
-- 
2.51.1

Re: [PATCH v2 7/7] drm/client: Flush client buffers with drm_client_buffer_sync()

[Jocelyn Falempe]

On 27/10/2025 13:09, Thomas Zimmermann wrote:
> Rename drm_client_framebuffer_flush() to drm_cient_buffer_flush() and
> adapt its callers. The old name was left over from previous naming
> conventions.

Thanks, it looks good to me.

Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>>
> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
> ---
>   drivers/gpu/drm/clients/drm_log.c | 4 ++--
>   drivers/gpu/drm/drm_client.c      | 8 ++++----
>   include/drm/drm_client.h          | 2 +-
>   3 files changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/gpu/drm/clients/drm_log.c b/drivers/gpu/drm/clients/drm_log.c
> index 48636bb1a21e..19e55aa0ed74 100644
> --- a/drivers/gpu/drm/clients/drm_log.c
> +++ b/drivers/gpu/drm/clients/drm_log.c
> @@ -100,7 +100,7 @@ static void drm_log_clear_line(struct drm_log_scanout *scanout, u32 line)
>   		return;
>   	iosys_map_memset(&map, r.y1 * fb->pitches[0], 0, height * fb->pitches[0]);
>   	drm_client_buffer_vunmap_local(scanout->buffer);
> -	drm_client_framebuffer_flush(scanout->buffer, &r);
> +	drm_client_buffer_flush(scanout->buffer, &r);
>   }
>   
>   static void drm_log_draw_line(struct drm_log_scanout *scanout, const char *s,
> @@ -133,7 +133,7 @@ static void drm_log_draw_line(struct drm_log_scanout *scanout, const char *s,
>   	if (scanout->line >= scanout->rows)
>   		scanout->line = 0;
>   	drm_client_buffer_vunmap_local(scanout->buffer);
> -	drm_client_framebuffer_flush(scanout->buffer, &r);
> +	drm_client_buffer_flush(scanout->buffer, &r);
>   }
>   
>   static void drm_log_draw_new_line(struct drm_log_scanout *scanout,
> diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c
> index e7dfbdeca45a..504ec5bdfa2c 100644
> --- a/drivers/gpu/drm/drm_client.c
> +++ b/drivers/gpu/drm/drm_client.c
> @@ -430,8 +430,8 @@ drm_client_buffer_create_dumb(struct drm_client_dev *client, u32 width, u32 heig
>   EXPORT_SYMBOL(drm_client_buffer_create_dumb);
>   
>   /**
> - * drm_client_framebuffer_flush - Manually flush client framebuffer
> - * @buffer: DRM client buffer (can be NULL)
> + * drm_client_buffer_flush - Manually flush client buffer
> + * @buffer: DRM client buffer
>    * @rect: Damage rectangle (if NULL flushes all)
>    *
>    * This calls &drm_framebuffer_funcs->dirty (if present) to flush buffer changes
> @@ -440,7 +440,7 @@ EXPORT_SYMBOL(drm_client_buffer_create_dumb);
>    * Returns:
>    * Zero on success or negative error code on failure.
>    */
> -int drm_client_framebuffer_flush(struct drm_client_buffer *buffer, struct drm_rect *rect)
> +int drm_client_buffer_flush(struct drm_client_buffer *buffer, struct drm_rect *rect)
>   {
>   	if (!buffer || !buffer->fb || !buffer->fb->funcs->dirty)
>   		return 0;
> @@ -460,4 +460,4 @@ int drm_client_framebuffer_flush(struct drm_client_buffer *buffer, struct drm_re
>   	return buffer->fb->funcs->dirty(buffer->fb, buffer->client->file,
>   					0, 0, NULL, 0);
>   }
> -EXPORT_SYMBOL(drm_client_framebuffer_flush);
> +EXPORT_SYMBOL(drm_client_buffer_flush);
> diff --git a/include/drm/drm_client.h b/include/drm/drm_client.h
> index 690ef04fccce..5ecde0f6f591 100644
> --- a/include/drm/drm_client.h
> +++ b/include/drm/drm_client.h
> @@ -196,7 +196,7 @@ struct drm_client_buffer {
>   struct drm_client_buffer *
>   drm_client_buffer_create_dumb(struct drm_client_dev *client, u32 width, u32 height, u32 format);
>   void drm_client_buffer_delete(struct drm_client_buffer *buffer);
> -int drm_client_framebuffer_flush(struct drm_client_buffer *buffer, struct drm_rect *rect);
> +int drm_client_buffer_flush(struct drm_client_buffer *buffer, struct drm_rect *rect);
>   int drm_client_buffer_vmap_local(struct drm_client_buffer *buffer,
>   				 struct iosys_map *map_copy);
>   void drm_client_buffer_vunmap_local(struct drm_client_buffer *buffer);

Re: [PATCH v2 0/7] drm/client: Simply client-buffer interface and implementation

[Francesco Valla]

[-- Attachment #1: Type: text/plain, Size: 1822 bytes --]

Hi Thomas,

On Monday, 27 October 2025 at 13:09:11 Thomas Zimmermann <tzimmermann@suse.de> wrote:
> Streamline the client-buffer code and remove the drm_client_framebuffer_
> functions. Makes the code easier to work with.
> 
> Also prepares for importing non-dumb-buffer objects. Most of the in-
> kernel clients will use dumb-buffer allocation. In the case of the
> per-driver fbdev_probe code, the client buffer can also wrap an object
> that comes from a different memory region; for example gma500's stolen
> memory area. This functionality is required to move forward with the
> various per-driver implementations of fbdev_probe within the overall
> DRM-client framework.
> 
> Tested with efidrm and virtio-gpu on Virt I/O hardware.
> 
> v2:
> - fix possible NULL-pointer deref in delete
> - avoid dependency on KMS helpers
> 
> Thomas Zimmermann (7):
>   drm/client: Remove pitch from struct drm_client_buffer
>   drm/client: Move dumb-buffer handling to
>     drm_client_framebuffer_create()
>   drm/client: Inline drm_client_buffer_addfb() and _rmfb()
>   drm/client: Deprecate struct drm_client_buffer.gem
>   drm/client: Remove drm_client_framebuffer_delete()
>   drm/client: Create client buffers with drm_client_buffer_create_dumb()
>   drm/client: Flush client buffers with drm_client_buffer_sync()
> 
>  drivers/gpu/drm/clients/drm_log.c |  10 +-
>  drivers/gpu/drm/drm_client.c      | 193 ++++++++++++++----------------
>  drivers/gpu/drm/drm_fbdev_dma.c   |   8 +-
>  drivers/gpu/drm/drm_fbdev_shmem.c |   6 +-
>  drivers/gpu/drm/drm_fbdev_ttm.c   |  10 +-
>  include/drm/drm_client.h          |  20 +---
>  6 files changed, 114 insertions(+), 133 deletions(-)
> 
> 
> base-commit: c03916cb446b6eefe91538599775bb54bf98238c
> 

Tested-by: Francesco Valla <francesco@valla.it>

Tested on a NXP i.MX93 FRDM.


[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 228 bytes --]