[PATCH 1/4] drm/vmwgfx: Add some checks to vmw_cursor_plane_atomic_update

[PATCH 1/4] drm/vmwgfx: Add some checks to vmw_cursor_plane_atomic_update

[Maaz Mombasawala]

In cases where old_state may not be present we hit a null dereference.
Add a check to fix this and also do an early return if there is no
new_state or crtc since there is nothing to do in that case.
This fixes igt test kms_cursor_legacy@torture-bo.

Signed-off-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
index c46f17ba7236..88b7185a8371 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
@@ -744,9 +744,14 @@ vmw_cursor_plane_atomic_update(struct drm_plane *plane,
 	struct vmw_bo *bo;
 	struct drm_plane_state *new_state =
 		drm_atomic_get_new_plane_state(state, plane);
+	if (!new_state)
+		return;
 	struct drm_plane_state *old_state =
 		drm_atomic_get_old_plane_state(state, plane);
-	struct drm_crtc *crtc = new_state->crtc ?: old_state->crtc;
+	struct drm_crtc *crtc = new_state->crtc ? new_state->crtc :
+		(old_state ? old_state->crtc : NULL);
+	if (!crtc)
+		return;
 	struct vmw_private *dev_priv = vmw_priv(plane->dev);
 	struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
 	struct vmw_plane_state *vps = vmw_plane_state_to_vps(new_state);
-- 
2.54.0

[PATCH 2/4] drm/vmwgfx: Check vrefresh in drm_mode_setcrtc.

[Maaz Mombasawala]

Add the mode_valid() callback in drm_mode_config_funcs to check for valid
mode during drm_mode_setcrtc. This is similar to the stdu connector
specific vmw_stdu_connector_mode_valid().
Both the mode_valid() callbacks also check if the vrefresh value is
correct.
This fixes igt test kms_invalid_mode@overflow-vrefresh.

Signed-off-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c  | 34 ++++++++++++++++++++++++++++
 drivers/gpu/drm/vmwgfx/vmwgfx_kms.h  |  9 ++++++++
 drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 12 +++-------
 3 files changed, 46 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 55730e29d3ae..c5a37ea47df0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1062,8 +1062,42 @@ vmw_kms_atomic_check_modeset(struct drm_device *dev,
 	return ret;
 }
 
+static enum drm_mode_status
+vmw_kms_config_mode_valid(struct drm_device *dev,
+			  const struct drm_display_mode *mode)
+{
+	enum drm_mode_status ret;
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	u64 assumed_cpp = dev_priv->assume_16bpp ? 2 : 4;
+	/* Align width and height to account for GPU tile over-alignment */
+	u64 required_mem = ALIGN(mode->hdisplay, GPU_TILE_SIZE) *
+			   ALIGN(mode->vdisplay, GPU_TILE_SIZE) *
+			   assumed_cpp;
+	required_mem = ALIGN(required_mem, PAGE_SIZE);
+
+	ret = drm_mode_validate_size(mode, dev_priv->texture_max_width,
+				     dev_priv->texture_max_height);
+	if (ret != MODE_OK)
+		return ret;
+
+	if (required_mem > dev_priv->max_primary_mem)
+		return MODE_MEM;
+
+	if (required_mem > dev_priv->max_mob_pages * PAGE_SIZE)
+		return MODE_MEM;
+
+	if (required_mem > dev_priv->max_mob_size)
+		return MODE_MEM;
+
+	if (!drm_mode_vrefresh(mode))
+		return MODE_BAD;
+
+	return MODE_OK;
+}
+
 static const struct drm_mode_config_funcs vmw_kms_funcs = {
 	.fb_create = vmw_kms_fb_create,
+	.mode_valid = vmw_kms_config_mode_valid,
 	.atomic_check = vmw_kms_atomic_check_modeset,
 	.atomic_commit = drm_atomic_helper_commit,
 };
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
index 445471fe9be6..ea12f6c77f2d 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -16,6 +16,15 @@
 #include <drm/drm_framebuffer.h>
 #include <drm/drm_probe_helper.h>
 
+/*
+ * Some renderers such as llvmpipe will align the width and height of their
+ * buffers to match their tile size. We need to keep this in mind when exposing
+ * modes to userspace so that this possible over-allocation will not exceed
+ * graphics memory. 64x64 pixels seems to be a reasonable upper bound for the
+ * tile size of current renderers.
+ */
+#define GPU_TILE_SIZE 64
+
 /**
  * struct vmw_du_update_plane - Closure structure for vmw_du_helper_plane_update
  * @plane: Plane which is being updated.
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index dcbacee97f61..17dc20b2ec64 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -45,15 +45,6 @@
 #define vmw_connector_to_stdu(x) \
 	container_of(x, struct vmw_screen_target_display_unit, base.connector)
 
-/*
- * Some renderers such as llvmpipe will align the width and height of their
- * buffers to match their tile size. We need to keep this in mind when exposing
- * modes to userspace so that this possible over-allocation will not exceed
- * graphics memory. 64x64 pixels seems to be a reasonable upper bound for the
- * tile size of current renderers.
- */
-#define GPU_TILE_SIZE 64
-
 enum stdu_content_type {
 	SAME_AS_DISPLAY = 0,
 	SEPARATE_SURFACE,
@@ -870,6 +861,9 @@ vmw_stdu_connector_mode_valid(struct drm_connector *connector,
 	if (required_mem > dev_priv->max_mob_size)
 		return MODE_MEM;
 
+	if (!drm_mode_vrefresh(mode))
+		return MODE_BAD;
+
 	return MODE_OK;
 }
 
-- 
2.54.0

[PATCH 3/4] drm/vmwgfx: Reserve ttm object before resv usage

[Maaz Mombasawala]

We hit dma_resv_assert_held warnings in several places, reserve the ttm
base object when it's being used to avoid them.

Signed-off-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_bo.c   |  2 ++
 drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c | 12 ++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
index 9c7a73c0b0dc..6817e0b8ce99 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
@@ -55,7 +55,9 @@ static void vmw_bo_free(struct ttm_buffer_object *bo)
 			/* Reserve and switch the backing mob. */
 			mutex_lock(&res->dev_priv->cmdbuf_mutex);
 			(void)vmw_resource_reserve(res, false, true);
+			ttm_bo_reserve(bo, false, false, NULL);
 			vmw_resource_mob_detach(res);
+			ttm_bo_unreserve(bo);
 			if (res->dirty)
 				res->func->dirty_free(res);
 			if (res->coherent)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c
index 5abd7f5ad2db..21cdfc6a1641 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c
@@ -131,6 +131,7 @@ crc_generate_worker(struct work_struct *work)
 	spin_unlock_irq(&du->vkms.crc_state_lock);
 
 	if (surf) {
+		int ret;
 		if (vmw_surface_sync(vmw, surf)) {
 			drm_warn(
 				crtc->dev,
@@ -138,7 +139,18 @@ crc_generate_worker(struct work_struct *work)
 			return;
 		}
 
+		ret = ttm_bo_reserve(&surf->res.guest_memory_bo->tbo, false, false, NULL);
+		if (ret != 0) {
+			drm_warn(&vmw->drm, "%s: failed reserve\n", __func__);
+			goto done;
+		}
+
 		compute_crc(crtc, surf, &crc32);
+
+		ttm_bo_unreserve(&surf->res.guest_memory_bo->tbo);
+
+done:
+
 		vmw_surface_unreference(&surf);
 	}
 
-- 
2.54.0

[PATCH 4/4] drm/vmwgfx: Change ttm refs for dumb buffers.

[Maaz Mombasawala]

Preserve a ttm reference during dumb buffer creation. This keeps the dumb
buffer valid for framebuffer usage and fixes all igt tests that use dumb
buffers.
One tricky case arises in the igt test vmw_prime@tri-map-dmabuf, in which
the gem buffer backing the dumb buffer is prime transferred and the
vmw_surface which is referenced from the prime handle. In this case a
reference to the gem object from the surface remains persistent and causes
a memleak.
Fix it by using a separate refcount_release() callback for the dumb buffer
surface which puts the gem reference.

Signed-off-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 31 ++++++++++++++++++++++---
 1 file changed, 28 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index b2d3927b5567..c600983aa571 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -2220,6 +2220,31 @@ static SVGA3dSurfaceFormat vmw_format_bpp_to_svga(struct vmw_private *vmw,
 	}
 }
 
+static void vmw_dumb_srf_refcount_release(struct ttm_base_object **p_base)
+{
+	struct ttm_base_object *base = *p_base;
+	struct ttm_prime_object *prime;
+	struct vmw_user_surface *user_srf;
+	struct vmw_surface *srf;
+	struct vmw_bo *vbo;
+
+	*p_base = NULL;
+	prime = container_of(base, struct ttm_prime_object, base);
+	WARN_ON_ONCE(prime->dma_buf != NULL);
+	mutex_destroy(&prime->mutex);
+
+	user_srf = container_of(base, struct vmw_user_surface, prime.base);
+	srf = &user_srf->srf;
+
+	vbo = srf->res.guest_memory_bo;
+	if (!vbo)
+		return;
+
+	BUG_ON(!vbo->is_dumb);
+
+	drm_gem_object_put(&vbo->tbo.base);
+}
+
 /**
  * vmw_dumb_create - Create a dumb kms buffer
  *
@@ -2327,12 +2352,12 @@ int vmw_dumb_create(struct drm_file *file_priv,
 	 */
 	struct vmw_user_surface *usurf = container_of(vbo->dumb_surface,
 						struct vmw_user_surface, srf);
-	usurf->prime.base.refcount_release = NULL;
+	usurf->prime.base.refcount_release = vmw_dumb_srf_refcount_release;
 err:
 	if (res)
 		vmw_resource_unreference(&res);
-
-	ttm_ref_object_base_unref(tfile, arg.rep.handle);
+	if (ret)
+		ttm_ref_object_base_unref(tfile, arg.rep.handle);
 
 	return ret;
 }
-- 
2.54.0

Re: [PATCH 1/4] drm/vmwgfx: Add some checks to vmw_cursor_plane_atomic_update

[Zack Rusin]

[-- Attachment #1: Type: text/plain, Size: 1766 bytes --]

On Wed, Apr 29, 2026 at 8:16 PM Maaz Mombasawala
<maaz.mombasawala@broadcom.com> wrote:
>
> In cases where old_state may not be present we hit a null dereference.
> Add a check to fix this and also do an early return if there is no
> new_state or crtc since there is nothing to do in that case.
> This fixes igt test kms_cursor_legacy@torture-bo.
>
> Signed-off-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
> index c46f17ba7236..88b7185a8371 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
> @@ -744,9 +744,14 @@ vmw_cursor_plane_atomic_update(struct drm_plane *plane,
>         struct vmw_bo *bo;
>         struct drm_plane_state *new_state =
>                 drm_atomic_get_new_plane_state(state, plane);
> +       if (!new_state)
> +               return;
>         struct drm_plane_state *old_state =
>                 drm_atomic_get_old_plane_state(state, plane);
> -       struct drm_crtc *crtc = new_state->crtc ?: old_state->crtc;
> +       struct drm_crtc *crtc = new_state->crtc ? new_state->crtc :
> +               (old_state ? old_state->crtc : NULL);
> +       if (!crtc)
> +               return;
>         struct vmw_private *dev_priv = vmw_priv(plane->dev);
>         struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
>         struct vmw_plane_state *vps = vmw_plane_state_to_vps(new_state);
> --
> 2.54.0
>

That's largely fine, but it will fail dim checkpatch because it mixes
declaration and code.

z

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5414 bytes --]

Re: [PATCH 2/4] drm/vmwgfx: Check vrefresh in drm_mode_setcrtc.

[Zack Rusin]

[-- Attachment #1: Type: text/plain, Size: 2221 bytes --]

On Wed, Apr 29, 2026 at 8:17 PM Maaz Mombasawala
<maaz.mombasawala@broadcom.com> wrote:
>
> Add the mode_valid() callback in drm_mode_config_funcs to check for valid
> mode during drm_mode_setcrtc. This is similar to the stdu connector
> specific vmw_stdu_connector_mode_valid().
> Both the mode_valid() callbacks also check if the vrefresh value is
> correct.
> This fixes igt test kms_invalid_mode@overflow-vrefresh.
>
> Signed-off-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_kms.c  | 34 ++++++++++++++++++++++++++++
>  drivers/gpu/drm/vmwgfx/vmwgfx_kms.h  |  9 ++++++++
>  drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 12 +++-------
>  3 files changed, 46 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
> index 55730e29d3ae..c5a37ea47df0 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
> @@ -1062,8 +1062,42 @@ vmw_kms_atomic_check_modeset(struct drm_device *dev,
>         return ret;
>  }
>
> +static enum drm_mode_status
> +vmw_kms_config_mode_valid(struct drm_device *dev,
> +                         const struct drm_display_mode *mode)
> +{
> +       enum drm_mode_status ret;
> +       struct vmw_private *dev_priv = vmw_priv(dev);
> +       u64 assumed_cpp = dev_priv->assume_16bpp ? 2 : 4;
> +       /* Align width and height to account for GPU tile over-alignment */
> +       u64 required_mem = ALIGN(mode->hdisplay, GPU_TILE_SIZE) *
> +                          ALIGN(mode->vdisplay, GPU_TILE_SIZE) *
> +                          assumed_cpp;
> +       required_mem = ALIGN(required_mem, PAGE_SIZE);
> +
> +       ret = drm_mode_validate_size(mode, dev_priv->texture_max_width,
> +                                    dev_priv->texture_max_height);
> +       if (ret != MODE_OK)
> +               return ret;
> +
> +       if (required_mem > dev_priv->max_primary_mem)
> +               return MODE_MEM;
> +
> +       if (required_mem > dev_priv->max_mob_pages * PAGE_SIZE)
> +               return MODE_MEM;

Hmm, how is this working without the gb support? Did you test other displays?

z

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5414 bytes --]

Re: [PATCH 4/4] drm/vmwgfx: Change ttm refs for dumb buffers.

[Zack Rusin]

[-- Attachment #1.1: Type: text/plain, Size: 2470 bytes --]

On Wed, Apr 29, 2026 at 8:17 PM Maaz Mombasawala
<maaz.mombasawala@broadcom.com> wrote:
>
> Preserve a ttm reference during dumb buffer creation. This keeps the dumb
> buffer valid for framebuffer usage and fixes all igt tests that use dumb
> buffers.
> One tricky case arises in the igt test vmw_prime@tri-map-dmabuf, in which
> the gem buffer backing the dumb buffer is prime transferred and the
> vmw_surface which is referenced from the prime handle. In this case a
> reference to the gem object from the surface remains persistent and causes
> a memleak.
> Fix it by using a separate refcount_release() callback for the dumb buffer
> surface which puts the gem reference.
>
> Signed-off-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 31 ++++++++++++++++++++++---
>  1 file changed, 28 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
> index b2d3927b5567..c600983aa571 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
> @@ -2220,6 +2220,31 @@ static SVGA3dSurfaceFormat vmw_format_bpp_to_svga(struct vmw_private *vmw,
>         }
>  }
>
> +static void vmw_dumb_srf_refcount_release(struct ttm_base_object **p_base)
> +{
> +       struct ttm_base_object *base = *p_base;
> +       struct ttm_prime_object *prime;
> +       struct vmw_user_surface *user_srf;
> +       struct vmw_surface *srf;
> +       struct vmw_bo *vbo;
> +
> +       *p_base = NULL;
> +       prime = container_of(base, struct ttm_prime_object, base);
> +       WARN_ON_ONCE(prime->dma_buf != NULL);
> +       mutex_destroy(&prime->mutex);
> +
> +       user_srf = container_of(base, struct vmw_user_surface, prime.base);
> +       srf = &user_srf->srf;
> +
> +       vbo = srf->res.guest_memory_bo;
> +       if (!vbo)
> +               return;
> +
> +       BUG_ON(!vbo->is_dumb);
> +
> +       drm_gem_object_put(&vbo->tbo.base);

Did you try running this with KASAN enabled? Because this put looks
unbalanced to me and should cause warnings. It looks like you're
undoing Ian's rework of the reference counting.

For this I'd try to keep gem reference counting as is. We don't want
to change ownership strcucture there. I think what we want is to
probably make sure that dumb buffers own
their surfaces. Can you try the attached patch?

z

[-- Attachment #1.2: 0001-drm-vmwgfx-Keep-dumb-buffer-surface-alive-for-PRIME-.patch --]
[-- Type: text/x-patch, Size: 3318 bytes --]

From dc0f06ec14ae5f1ffa753891dd2330d8cd86cba7 Mon Sep 17 00:00:00 2001
From: Zack Rusin <zack.rusin@broadcom.com>
Date: Thu, 30 Apr 2026 07:51:43 -0400
Subject: [PATCH] drm/vmwgfx: Keep dumb buffer surface alive for PRIME export

Dumb buffers backed by hidden vmwgfx surfaces need that surface
to remain lookupable for as long as the GEM BO can be kept alive
by a dma-buf export. Take an extra reference on the surface TTM base
object for the dumb BO lifetime, and release it from the dumb BO
teardown path, while still dropping the private surface handle from
the creating file. This lets PRIME users import or reference the
exported dumb buffer after the original GEM handle is closed without
leaking the file-owned surface handle.

Attempts to fix vmw_prime@tri-map-dmabuf

Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_bo.c      |  1 +
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.h     |  2 ++
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 18 ++++++++++++++++++
 3 files changed, 21 insertions(+)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
index 9c7a73c0b0dc..057c89079d8a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
@@ -66,6 +66,7 @@ static void vmw_bo_free(struct ttm_buffer_object *bo)
 					       0);
 			mutex_unlock(&res->dev_priv->cmdbuf_mutex);
 		}
+		vmw_dumb_surface_base_unreference(vbo->dumb_surface);
 		vmw_surface_unreference(&vbo->dumb_surface);
 	}
 	WARN_ON(!RB_EMPTY_ROOT(&vbo->res_tree));
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 57465f69c687..b5a2a448f8f2 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -1186,6 +1186,8 @@ u32 vmw_lookup_surface_handle_for_buffer(struct vmw_private *vmw,
 int vmw_dumb_create(struct drm_file *file_priv,
 		    struct drm_device *dev,
 		    struct drm_mode_create_dumb *args);
+void vmw_dumb_surface_base_reference(struct vmw_surface *srf);
+void vmw_dumb_surface_base_unreference(struct vmw_surface *srf);
 
 /*
  * Shader management - vmwgfx_shader.c
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index b2d3927b5567..9995c734f75b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -2220,6 +2220,23 @@ static SVGA3dSurfaceFormat vmw_format_bpp_to_svga(struct vmw_private *vmw,
 	}
 }
 
+void vmw_dumb_surface_base_reference(struct vmw_surface *srf)
+{
+	struct vmw_user_surface *user_srf =
+		container_of(srf, struct vmw_user_surface, srf);
+
+	kref_get(&user_srf->prime.base.refcount);
+}
+
+void vmw_dumb_surface_base_unreference(struct vmw_surface *srf)
+{
+	struct vmw_user_surface *user_srf =
+		container_of(srf, struct vmw_user_surface, srf);
+	struct ttm_base_object *base = &user_srf->prime.base;
+
+	ttm_base_object_unref(&base);
+}
+
 /**
  * vmw_dumb_create - Create a dumb kms buffer
  *
@@ -2328,6 +2345,7 @@ int vmw_dumb_create(struct drm_file *file_priv,
 	struct vmw_user_surface *usurf = container_of(vbo->dumb_surface,
 						struct vmw_user_surface, srf);
 	usurf->prime.base.refcount_release = NULL;
+	vmw_dumb_surface_base_reference(vbo->dumb_surface);
 err:
 	if (res)
 		vmw_resource_unreference(&res);
-- 
2.51.0


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5414 bytes --]

Re: [PATCH 2/4] drm/vmwgfx: Check vrefresh in drm_mode_setcrtc.

[Maaz Mombasawala]

On 4/30/26 4:38 AM, Zack Rusin wrote:

> 
> Hmm, how is this working without the gb support? Did you test other displays?
> 
> z

Aah, I did not test those, in that case the max_mob_pages and max_mob_size parameters
being 0 cause the display mode check to fail. Removing those gets this patch and the
test kms_invalid_mode@overflow-refresh working with both sou and ldu displays.
The function vmw_stdu_connector_mode_valid() should take care of mob related checks
anyways for stdu's.

-- 
Maaz Mombasawala <maaz.mombasawala@broadcom.com>