[FlareCoding]

Summary

A gfxfb present (GFXFB_PRESENT, which asks for a buffer to replace what an output shows from its next vertical blank) can name the regions of its buffer that changed since the buffer was created or last presented, so a display that shows a copy of each buffer can copy only those.

Changes

• Let a copying display copy only what changed: gfxfb_present_args gains regions, region_count (at most GFXFB_MAX_FLUSH_RECTS, 0 for the whole buffer) and reserved, and display::present() receives the regions, or null and 0 for a present naming none.
• Hand a display only regions it can copy: before checking control (which lets one open file at a time create and present buffers), gfxfb refuses with EINVAL a set reserved field, more than GFXFB_MAX_FLUSH_RECTS regions, regions it cannot read, and a region with a zero width or height or not wholly inside the presented buffer. It checks a copy of the regions on the unprivileged heap, failing with ENOMEM when no memory is left for it.
• Tests: regions reaching the display in order up to the buffer's far edges, a count of 0 passing no list, 256 regions accepted and 257 refused with every region readable, and the check made against the presented buffer. Refusals of a set reserved field, of regions the kernel cannot read and of single regions, including sums that wrap and fields of 0x10001, come before control and leave it as it was, and an empty region's does so too while a file's buffer creation is still running.
• Boots: in QEMU on x86_64 and aarch64, the desktop came up as on pr/gfxfb-events 45cd6b9, on virtio-gpu and on the firmware's framebuffer. No program presents a buffer, so no boot names a region.

---

Note

Medium Risk
User/kernel ABI change on GFXFB_PRESENT plus new uaccess validation on a hot graphics path; incorrect bounds checks could allow bad copies, though region checks run before queuing to hardware.

Overview
GFXFB_PRESENT can name dirty regions so displays that copy buffers can update only what changed instead of the full framebuffer.

gfxfb_present_args grows with regions, region_count (≤ GFXFB_MAX_FLUSH_RECTS, 0 = whole buffer), and reserved. display::present() now takes the validated region list (or null/0 for full-buffer presents). The kernel copies regions from userland onto the unprivileged heap, returns ENOMEM if that fails, and rejects invalid rects before the single-client control check—including empty rects, out-of-bounds geometry (without coordinate+size wrap), unreadable user memory, non-zero reserved, and counts over the cap.

Accepted presents forward regions through queue_present; the heap copy is freed when present() returns, so drivers that need them later must copy. virtio-gpu and boot_display still refuse presents; ABI/docs and gfxfb.test.cpp cover delivery, limits, validation ordering vs control, and creation hooks.

^{Reviewed by Cursor Bugbot for commit 08f0c02. Bugbot is set up for automated code reviews on this repo. Configure here.}