[PATCH 00/70] drm/crtc: Convert all drivers to atomic_create_state and remove reset

[PATCH 00/70] drm/crtc: Convert all drivers to atomic_create_state and remove reset

[Maxime Ripard]

This is a follow-up to the plane reset removal series, and part of a
larger effort to remove the reset hook from all KMS objects.

The CRTC reset hook is overloaded: it is called both at probe time to
create the initial software state and during suspend/resume to reset
hardware and software state. These two roles have different
requirements, and the reset hook is not fallible, making error
handling difficult for the initial state allocation path.

While reset has the semantics to reset both the software and hardware
state, the vast majority of implementations and all the helpers only
reset the software state, making them equivalent to
atomic_create_state in practice. The atomic_create_state hook makes
this explicit: it only allocates and initializes a pristine state
without any side effect, and returns the state pointer or an ERR_PTR
on failure.

This series converts all CRTC drivers tree-wide from the reset hook to
atomic_create_state, then removes the reset hook from struct
drm_crtc_funcs entirely. Two drivers (tilcdc and loongson) had actual
hardware reset logic mixed into their reset hook; those are moved to
CRTC creation instead. The conversions were done using a combination of
Coccinelle semantic patches and manual adjustments.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
---
Maxime Ripard (70):
      drm/adp: Switch to drm_atomic_helper_crtc_create_state
      drm/amdgpu: vkms: Switch to drm_atomic_helper_crtc_create_state
      drm/arm: hdlcd: Switch to drm_atomic_helper_crtc_create_state
      drm/armada: Switch to drm_atomic_helper_crtc_create_state
      drm/exynos: Switch to drm_atomic_helper_crtc_create_state
      drm/fsl-dcu: Switch to drm_atomic_helper_crtc_create_state
      drm/gud: Switch to drm_atomic_helper_crtc_create_state
      drm/hisilicon: hibmc: Switch to drm_atomic_helper_crtc_create_state
      drm/hisilicon: kirin: Switch to drm_atomic_helper_crtc_create_state
      drm/hyperv: Switch to drm_atomic_helper_crtc_create_state
      drm/imx: dc: Switch to drm_atomic_helper_crtc_create_state
      drm/imx: dcss: Switch to drm_atomic_helper_crtc_create_state
      drm/ingenic: Switch to drm_atomic_helper_crtc_create_state
      drm/kmb: Switch to drm_atomic_helper_crtc_create_state
      drm/logicvc: Switch to drm_atomic_helper_crtc_create_state
      drm/meson: Switch to drm_atomic_helper_crtc_create_state
      drm/msm: mdp4: Switch to drm_atomic_helper_crtc_create_state
      drm/mxs: mxsfb: Switch to drm_atomic_helper_crtc_create_state
      drm/qxl: Switch to drm_atomic_helper_crtc_create_state
      drm/renesas: shmobile: Switch to drm_atomic_helper_crtc_create_state
      drm/simple-kms: Remove unused reset_crtc hook
      drm/simple-kms: Switch to drm_atomic_helper_crtc_create_state
      drm/sitronix: st7571: Switch to drm_atomic_helper_crtc_create_state
      drm/sprd: Switch to drm_atomic_helper_crtc_create_state
      drm/sti: Switch to drm_atomic_helper_crtc_create_state
      drm/stm: Switch to drm_atomic_helper_crtc_create_state
      drm/sun4i: Switch to drm_atomic_helper_crtc_create_state
      drm/tests: Switch to drm_atomic_helper_crtc_create_state
      drm/tilcdc: Move hardware reset to CRTC creation
      drm/tilcdc: Switch to drm_atomic_helper_crtc_create_state
      drm/tiny: appletbdrm: Switch to drm_atomic_helper_crtc_create_state
      drm/tiny: bochs: Switch to drm_atomic_helper_crtc_create_state
      drm/tiny: cirrus: Switch to drm_atomic_helper_crtc_create_state
      drm/tiny: pixpaper: Switch to drm_atomic_helper_crtc_create_state
      drm/tiny: sharp: Switch to drm_atomic_helper_crtc_create_state
      drm/udl: Switch to drm_atomic_helper_crtc_create_state
      drm/vbox: Switch to drm_atomic_helper_crtc_create_state
      drm/verisilicon: Switch to drm_atomic_helper_crtc_create_state
      drm/virtio: Switch to drm_atomic_helper_crtc_create_state
      drm/xlnx: Switch to drm_atomic_helper_crtc_create_state
      drm/mipi-dbi: Switch to drm_atomic_helper_crtc_create_state
      drm/atomic-helper: Remove drm_atomic_helper_crtc_reset
      sysfb: Convert to create_state
      drm/amdgpu: dm: Convert to atomic_create_state
      drm/komeda: Convert to atomic_create_state
      drm/malidp: Convert to atomic_create_state
      drm/ast: Convert to atomic_create_state
      drm/atmel-hlcdc: Convert to atomic_create_state
      drm/imx: ipuv3: Convert to atomic_create_state
      drm/loongsoon: Move hardware reset to CRTC creation
      drm/loongson: Convert to atomic_create_state
      drm/mediatek: Convert to atomic_create_state
      drm/mgag200: Convert to atomic_create_state
      drm/msm: dpu1: Convert to atomic_create_state
      drm/msm: mdp5: Convert to atomic_create_state
      drm/mxsfb: lcdif: Convert to atomic_create_state
      drm/nouveau: Convert to atomic_create_state
      drm/omapdrm: Convert to atomic_create_state
      drm/rcar-du: Convert to atomic_create_state
      drm/rzg2l-du: Convert to atomic_create_state
      drm/rockchip: vop: Convert to atomic_create_state
      drm/rockchip: vop2: Convert to atomic_create_state
      drm/sitronix: st7920: Convert to atomic_create_state
      drm/solomon: ssd130x: Convert to atomic_create_state
      drm/tegra: Convert to atomic_create_state
      drm/vc4: Convert to atomic_create_state
      drm/vkms: Convert to atomic_create_state
      drm/vmwgfx: Convert to atomic_create_state
      drm/atomic-helper: Remove __drm_atomic_helper_crtc_reset
      drm/crtc: Remove reset

 drivers/gpu/drm/adp/adp_drv.c                      |  2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c           |  2 +-
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 17 ++++----
 drivers/gpu/drm/arm/display/komeda/komeda_crtc.c   | 18 ++++----
 drivers/gpu/drm/arm/hdlcd_crtc.c                   |  2 +-
 drivers/gpu/drm/arm/malidp_crtc.c                  | 18 ++++----
 drivers/gpu/drm/armada/armada_crtc.c               |  2 +-
 drivers/gpu/drm/ast/ast_mode.c                     | 18 ++++----
 drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c     | 19 ++++-----
 drivers/gpu/drm/drm_atomic_state_helper.c          | 45 --------------------
 drivers/gpu/drm/drm_mode_config.c                  |  4 +-
 drivers/gpu/drm/drm_simple_kms_helper.c            | 13 +-----
 drivers/gpu/drm/exynos/exynos_drm_crtc.c           |  2 +-
 drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c         |  2 +-
 drivers/gpu/drm/gud/gud_drv.c                      |  2 +-
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c     |  2 +-
 drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c    |  2 +-
 drivers/gpu/drm/hyperv/hyperv_drm_modeset.c        |  2 +-
 drivers/gpu/drm/imx/dc/dc-crtc.c                   |  2 +-
 drivers/gpu/drm/imx/dcss/dcss-crtc.c               |  2 +-
 drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c             | 18 ++++----
 drivers/gpu/drm/ingenic/ingenic-drm-drv.c          |  2 +-
 drivers/gpu/drm/kmb/kmb_crtc.c                     |  2 +-
 drivers/gpu/drm/logicvc/logicvc_crtc.c             |  2 +-
 drivers/gpu/drm/loongson/lsdc_crtc.c               | 26 ++++++------
 drivers/gpu/drm/mediatek/mtk_crtc.c                | 18 ++++----
 drivers/gpu/drm/meson/meson_crtc.c                 |  2 +-
 drivers/gpu/drm/mgag200/mgag200_drv.h              |  4 +-
 drivers/gpu/drm/mgag200/mgag200_mode.c             | 15 ++++---
 drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c           | 18 ++++----
 drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c          |  2 +-
 drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c          | 20 ++++-----
 drivers/gpu/drm/mxsfb/lcdif_kms.c                  | 17 ++++----
 drivers/gpu/drm/mxsfb/mxsfb_kms.c                  |  4 +-
 drivers/gpu/drm/nouveau/dispnv50/head.c            | 14 +++----
 drivers/gpu/drm/omapdrm/omap_crtc.c                | 17 ++++----
 drivers/gpu/drm/qxl/qxl_display.c                  |  2 +-
 drivers/gpu/drm/renesas/rcar-du/rcar_du_crtc.c     | 17 ++++----
 drivers/gpu/drm/renesas/rz-du/rzg2l_du_crtc.c      | 15 +++----
 drivers/gpu/drm/renesas/shmobile/shmob_drm_crtc.c  |  2 +-
 drivers/gpu/drm/rockchip/rockchip_drm_vop.c        | 18 ++++----
 drivers/gpu/drm/rockchip/rockchip_drm_vop2.c       | 18 ++++----
 drivers/gpu/drm/sitronix/st7571.c                  |  2 +-
 drivers/gpu/drm/sitronix/st7920.c                  | 10 +++--
 drivers/gpu/drm/solomon/ssd130x.c                  | 10 +++--
 drivers/gpu/drm/sprd/sprd_dpu.c                    |  2 +-
 drivers/gpu/drm/sti/sti_crtc.c                     |  2 +-
 drivers/gpu/drm/stm/ltdc.c                         |  4 +-
 drivers/gpu/drm/sun4i/sun4i_crtc.c                 |  2 +-
 drivers/gpu/drm/sysfb/drm_sysfb_helper.h           |  4 +-
 drivers/gpu/drm/sysfb/drm_sysfb_modeset.c          | 20 ++++-----
 drivers/gpu/drm/tegra/dc.c                         | 18 ++++----
 drivers/gpu/drm/tests/drm_kunit_helpers.c          |  2 +-
 drivers/gpu/drm/tilcdc/tilcdc_crtc.c               | 49 +++++++++-------------
 drivers/gpu/drm/tiny/appletbdrm.c                  |  2 +-
 drivers/gpu/drm/tiny/bochs.c                       |  2 +-
 drivers/gpu/drm/tiny/cirrus-qemu.c                 |  2 +-
 drivers/gpu/drm/tiny/pixpaper.c                    |  2 +-
 drivers/gpu/drm/tiny/sharp-memory.c                |  2 +-
 drivers/gpu/drm/udl/udl_modeset.c                  |  2 +-
 drivers/gpu/drm/vboxvideo/vbox_mode.c              |  2 +-
 drivers/gpu/drm/vc4/tests/vc4_mock_crtc.c          |  2 +-
 drivers/gpu/drm/vc4/vc4_crtc.c                     | 14 +++----
 drivers/gpu/drm/vc4/vc4_drv.h                      |  2 +-
 drivers/gpu/drm/vc4/vc4_txp.c                      |  2 +-
 drivers/gpu/drm/verisilicon/vs_crtc.c              |  2 +-
 drivers/gpu/drm/virtio/virtgpu_display.c           |  2 +-
 drivers/gpu/drm/vkms/vkms_crtc.c                   | 18 ++++----
 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c                | 22 ++++------
 drivers/gpu/drm/vmwgfx/vmwgfx_kms.h                |  2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c                |  2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c               |  2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c               |  2 +-
 drivers/gpu/drm/xlnx/zynqmp_kms.c                  |  2 +-
 include/drm/drm_atomic_state_helper.h              |  3 --
 include/drm/drm_crtc.h                             | 12 ------
 include/drm/drm_mipi_dbi.h                         |  2 +-
 include/drm/drm_simple_kms_helper.h                |  1 -
 78 files changed, 275 insertions(+), 385 deletions(-)
---
base-commit: 7ea58b9ddb52264a4ed36bccb975062ada32c62d
change-id: 20260709-drm-no-more-crtc-reset-14a4d5bc8d41

Best regards,
-- 
Maxime Ripard <mripard@kernel.org>

[PATCH 11/70] drm/imx: dc: Switch to drm_atomic_helper_crtc_create_state

[Maxime Ripard]

The imx dc crtc implementation uses the deprecated
drm_atomic_helper_crtc_reset() as its reset hook.

Switch to drm_atomic_helper_crtc_create_state() instead.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
---
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Frank Li <Frank.Li@nxp.com>
Cc: Liu Ying <victor.liu@nxp.com>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: imx@lists.linux.dev
---
 drivers/gpu/drm/imx/dc/dc-crtc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/imx/dc/dc-crtc.c b/drivers/gpu/drm/imx/dc/dc-crtc.c
index 764510ff90a4..0d64186a9901 100644
--- a/drivers/gpu/drm/imx/dc/dc-crtc.c
+++ b/drivers/gpu/drm/imx/dc/dc-crtc.c
@@ -96,11 +96,11 @@ static void dc_crtc_disable_vblank(struct drm_crtc *crtc)
 	/* nosync due to atomic context */
 	disable_irq_nosync(dc_crtc->irq_dec_framecomplete);
 }
 
 static const struct drm_crtc_funcs dc_crtc_funcs = {
-	.reset			= drm_atomic_helper_crtc_reset,
+	.atomic_create_state = drm_atomic_helper_crtc_create_state,
 	.destroy		= drm_crtc_cleanup,
 	.set_config		= drm_atomic_helper_set_config,
 	.page_flip		= drm_atomic_helper_page_flip,
 	.atomic_duplicate_state	= drm_atomic_helper_crtc_duplicate_state,
 	.atomic_destroy_state	= drm_atomic_helper_crtc_destroy_state,

-- 
2.55.0

Re: [PATCH 11/70] drm/imx: dc: Switch to drm_atomic_helper_crtc_create_state

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] CRTC atomic callbacks call sleeping functions in atomic context.
--

--- Patch [11]: [PATCH 11/70] drm/imx: dc: Switch to drm_atomic_helper_crtc_create_state ---
commit 81ac70d774e55256bc7f69e9538e45aed1e198c8
Author: Maxime Ripard <mripard@kernel.org>

drm/imx: dc: Switch to drm_atomic_helper_crtc_create_state

The imx dc crtc implementation uses the deprecated
drm_atomic_helper_crtc_reset() as its reset hook. Switch to
drm_atomic_helper_crtc_create_state() instead.

> diff --git a/drivers/gpu/drm/imx/dc/dc-crtc.c b/drivers/gpu/drm/imx/dc/dc-crtc.c
> index 764510ff90a4a..0d64186a99018 100644
> --- a/drivers/gpu/drm/imx/dc/dc-crtc.c
> +++ b/drivers/gpu/drm/imx/dc/dc-crtc.c
> @@ -98,7 +98,7 @@ static void dc_crtc_disable_vblank(struct drm_crtc *crtc)
>  }
>  
>  static const struct drm_crtc_funcs dc_crtc_funcs = {
> -	.reset			= drm_atomic_helper_crtc_reset,
> +	.atomic_create_state = drm_atomic_helper_crtc_create_state,

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing the CRTC
implementation in this file, I noticed that several atomic callbacks might be
calling sleeping functions.

For example, does dc_crtc_atomic_enable() call pm_runtime_resume_and_get(),
which can sleep?

Additionally, it looks like dc_crtc_atomic_enable(), dc_crtc_atomic_flush(),
and dc_crtc_atomic_disable() all use DC_CRTC_WAIT_FOR_COMPLETION_TIMEOUT(),
which waits for a completion and puts the task to sleep.

According to DRM subsystem guidelines, CRTC atomic enable, disable, and update
callbacks run in an atomic context where sleeping is forbidden. Could this
cause scheduling while atomic panics or warnings during non-blocking commits
and page flips?

>  	.destroy		= drm_crtc_cleanup,
>  	.set_config		= drm_atomic_helper_set_config,
>  	.page_flip		= drm_atomic_helper_page_flip,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260821-drm-no-more-crtc-reset-v1-0-fb793475c05a@kernel.org?part=11

[PATCH 12/70] drm/imx: dcss: Switch to drm_atomic_helper_crtc_create_state

[Maxime Ripard]

The imx dcss crtc implementation uses the deprecated
drm_atomic_helper_crtc_reset() as its reset hook.

Switch to drm_atomic_helper_crtc_create_state() instead.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
---
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Frank Li <Frank.Li@nxp.com>
Cc: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: imx@lists.linux.dev
---
 drivers/gpu/drm/imx/dcss/dcss-crtc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/imx/dcss/dcss-crtc.c b/drivers/gpu/drm/imx/dcss/dcss-crtc.c
index ab41759a9f52..5e9ee3f09d51 100644
--- a/drivers/gpu/drm/imx/dcss/dcss-crtc.c
+++ b/drivers/gpu/drm/imx/dcss/dcss-crtc.c
@@ -43,11 +43,11 @@ static void dcss_disable_vblank(struct drm_crtc *crtc)
 
 static const struct drm_crtc_funcs dcss_crtc_funcs = {
 	.set_config = drm_atomic_helper_set_config,
 	.destroy = drm_crtc_cleanup,
 	.page_flip = drm_atomic_helper_page_flip,
-	.reset = drm_atomic_helper_crtc_reset,
+	.atomic_create_state = drm_atomic_helper_crtc_create_state,
 	.atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state,
 	.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
 	.enable_vblank = dcss_enable_vblank,
 	.disable_vblank = dcss_disable_vblank,
 };

-- 
2.55.0

[PATCH 18/70] drm/mxs: mxsfb: Switch to drm_atomic_helper_crtc_create_state

[Maxime Ripard]

The mxsfb crtc implementation uses the deprecated
drm_atomic_helper_crtc_reset() as its reset hook.

Switch to drm_atomic_helper_crtc_create_state() instead.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
---
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Frank Li <Frank.Li@nxp.com>
Cc: Marek Vasut <marex@denx.de>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Stefan Agner <stefan@agner.ch>
Cc: imx@lists.linux.dev
---
 drivers/gpu/drm/mxsfb/mxsfb_kms.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/mxsfb/mxsfb_kms.c b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
index d8ebebc5314b..36ea285182b4 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_kms.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
@@ -482,22 +482,22 @@ static const struct drm_crtc_helper_funcs mxsfb_crtc_helper_funcs = {
 	.atomic_enable = mxsfb_crtc_atomic_enable,
 	.atomic_disable = mxsfb_crtc_atomic_disable,
 };
 
 static const struct drm_crtc_funcs mxsfb_crtc_funcs = {
-	.reset = drm_atomic_helper_crtc_reset,
+	.atomic_create_state = drm_atomic_helper_crtc_create_state,
 	.destroy = drm_crtc_cleanup,
 	.set_config = drm_atomic_helper_set_config,
 	.page_flip = drm_atomic_helper_page_flip,
 	.atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state,
 	.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
 	.enable_vblank = mxsfb_crtc_enable_vblank,
 	.disable_vblank = mxsfb_crtc_disable_vblank,
 };
 
 static const struct drm_crtc_funcs mxsfb_crtc_with_crc_funcs = {
-	.reset = drm_atomic_helper_crtc_reset,
+	.atomic_create_state = drm_atomic_helper_crtc_create_state,
 	.destroy = drm_crtc_cleanup,
 	.set_config = drm_atomic_helper_set_config,
 	.page_flip = drm_atomic_helper_page_flip,
 	.atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state,
 	.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,

-- 
2.55.0

Re: [PATCH 18/70] drm/mxs: mxsfb: Switch to drm_atomic_helper_crtc_create_state

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free in DRM cleanup paths on driver unbind due to devm_kzalloc allocated driver private data.
--

--- Patch [18]: [PATCH 18/70] drm/mxs: mxsfb: Switch to drm_atomic_helper_crtc_create_state ---
commit 176787b6391787b0d414456f33f183b472ea7c41
Author: Maxime Ripard <mripard@kernel.org>

drm/mxs: mxsfb: Switch to drm_atomic_helper_crtc_create_state

This commit replaces the deprecated drm_atomic_helper_crtc_reset() hook
with drm_atomic_helper_crtc_create_state() for the mxsfb CRTC implementation.

> diff --git a/drivers/gpu/drm/mxsfb/mxsfb_kms.c b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
> index d8ebebc5314bb..36ea285182b48 100644
> --- a/drivers/gpu/drm/mxsfb/mxsfb_kms.c
> +++ b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
> @@ -484,7 +484,7 @@ static const struct drm_crtc_helper_funcs mxsfb_crtc_helper_funcs = {
>  };
>  
>  static const struct drm_crtc_funcs mxsfb_crtc_funcs = {
> -	.reset = drm_atomic_helper_crtc_reset,
> +	.atomic_create_state = drm_atomic_helper_crtc_create_state,
>  	.destroy = drm_crtc_cleanup,
>  	.set_config = drm_atomic_helper_set_config,
>  	.page_flip = drm_atomic_helper_page_flip,

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing the mxsfb
driver, I noticed a potential use-after-free during driver unbind.

The driver private structure is allocated with devm_kzalloc() in mxsfb_load()
in drivers/gpu/drm/mxsfb/mxsfb_drv.c:

    mxsfb = devm_kzalloc(&pdev->dev, sizeof(*mxsfb), GFP_KERNEL);

And the DRM device is allocated independently via drm_dev_alloc() in
mxsfb_probe():

    drm = drm_dev_alloc(&mxsfb_driver, &pdev->dev);

During driver unbind, mxsfb_remove() calls drm_dev_put(drm). If user space
currently holds an open file descriptor for the DRM device, the DRM device's
refcount is > 0 and it will not be freed immediately.

When mxsfb_remove() returns, devres cleanup will free the mxsfb_drm_private
structure. Later, when user space closes the file descriptor,
drm_dev_release() will trigger drmm_mode_config_cleanup(). 

Since drmm_mode_config_cleanup() will access CRTCs and planes embedded
within the already-freed mxsfb_drm_private structure, could this result in
a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260821-drm-no-more-crtc-reset-v1-0-fb793475c05a@kernel.org?part=18

[PATCH 49/70] drm/imx: ipuv3: Convert to atomic_create_state

[Maxime Ripard]

The ipuv3 crtc implementation provides a custom reset hook. However,
this hook only allocates the state, initializes it with
__drm_atomic_helper_crtc_reset(), and frees the previous state. It
does not perform any hardware reset.

Since this is exactly what the atomic_create_state hook is meant to
do, minus the old state cleanup which the caller handles, convert the
implementation to use atomic_create_state with
__drm_atomic_helper_crtc_state_init() instead.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
---
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Frank Li <Frank.Li@nxp.com>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Philipp Zabel <p.zabel@pengutronix.de>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: imx@lists.linux.dev
---
 drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
index 1405e50ee56b..f4fe1842cfae 100644
--- a/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
@@ -105,23 +105,21 @@ static void ipu_crtc_atomic_disable(struct drm_crtc *crtc,
 		crtc->state->event = NULL;
 	}
 	spin_unlock_irq(&crtc->dev->event_lock);
 }
 
-static void imx_drm_crtc_reset(struct drm_crtc *crtc)
+static struct drm_crtc_state *imx_drm_crtc_create_state(struct drm_crtc *crtc)
 {
 	struct imx_crtc_state *state;
 
-	if (crtc->state)
-		__drm_atomic_helper_crtc_destroy_state(crtc->state);
-
-	kfree(to_imx_crtc_state(crtc->state));
-	crtc->state = NULL;
-
 	state = kzalloc_obj(*state);
-	if (state)
-		__drm_atomic_helper_crtc_reset(crtc, &state->base);
+	if (!state)
+		return ERR_PTR(-ENOMEM);
+
+	__drm_atomic_helper_crtc_state_init(&state->base, crtc);
+
+	return &state->base;
 }
 
 static struct drm_crtc_state *imx_drm_crtc_duplicate_state(struct drm_crtc *crtc)
 {
 	struct imx_crtc_state *state;
@@ -162,11 +160,11 @@ static void ipu_disable_vblank(struct drm_crtc *crtc)
 }
 
 static const struct drm_crtc_funcs ipu_crtc_funcs = {
 	.set_config = drm_atomic_helper_set_config,
 	.page_flip = drm_atomic_helper_page_flip,
-	.reset = imx_drm_crtc_reset,
+	.atomic_create_state = imx_drm_crtc_create_state,
 	.atomic_duplicate_state = imx_drm_crtc_duplicate_state,
 	.atomic_destroy_state = imx_drm_crtc_destroy_state,
 	.enable_vblank = ipu_enable_vblank,
 	.disable_vblank = ipu_disable_vblank,
 };

-- 
2.55.0

Re: [PATCH 49/70] drm/imx: ipuv3: Convert to atomic_create_state

[Philipp Zabel]

On Fr, 2026-08-21 at 16:39 +0200, Maxime Ripard wrote:
> The ipuv3 crtc implementation provides a custom reset hook. However,
> this hook only allocates the state, initializes it with
> __drm_atomic_helper_crtc_reset(), and frees the previous state. It
> does not perform any hardware reset.
> 
> Since this is exactly what the atomic_create_state hook is meant to
> do, minus the old state cleanup which the caller handles, convert the
> implementation to use atomic_create_state with
> __drm_atomic_helper_crtc_state_init() instead.
> 
> Signed-off-by: Maxime Ripard <mripard@kernel.org>

Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>

regards
Philipp

[PATCH 56/70] drm/mxsfb: lcdif: Convert to atomic_create_state

[Maxime Ripard]

The lcdif crtc implementation provides a custom reset hook. However,
this hook only allocates the state, initializes it with
__drm_atomic_helper_crtc_reset(), and frees the previous state. It
does not perform any hardware reset.

Since this is exactly what the atomic_create_state hook is meant to
do, minus the old state cleanup which the caller handles, convert the
implementation to use atomic_create_state with
__drm_atomic_helper_crtc_state_init() instead.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
---
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Frank Li <Frank.Li@nxp.com>
Cc: Marek Vasut <marex@denx.de>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Stefan Agner <stefan@agner.ch>
Cc: imx@lists.linux.dev
---
 drivers/gpu/drm/mxsfb/lcdif_kms.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/mxsfb/lcdif_kms.c b/drivers/gpu/drm/mxsfb/lcdif_kms.c
index 79e0f483ca20..5f0fbec3a390 100644
--- a/drivers/gpu/drm/mxsfb/lcdif_kms.c
+++ b/drivers/gpu/drm/mxsfb/lcdif_kms.c
@@ -594,22 +594,21 @@ static void lcdif_crtc_atomic_destroy_state(struct drm_crtc *crtc,
 {
 	__drm_atomic_helper_crtc_destroy_state(state);
 	kfree(to_lcdif_crtc_state(state));
 }
 
-static void lcdif_crtc_reset(struct drm_crtc *crtc)
+static struct drm_crtc_state *lcdif_crtc_create_state(struct drm_crtc *crtc)
 {
 	struct lcdif_crtc_state *state;
 
-	if (crtc->state)
-		lcdif_crtc_atomic_destroy_state(crtc, crtc->state);
-
-	crtc->state = NULL;
-
 	state = kzalloc_obj(*state);
-	if (state)
-		__drm_atomic_helper_crtc_reset(crtc, &state->base);
+	if (!state)
+		return ERR_PTR(-ENOMEM);
+
+	__drm_atomic_helper_crtc_state_init(&state->base, crtc);
+
+	return &state->base;
 }
 
 static struct drm_crtc_state *
 lcdif_crtc_atomic_duplicate_state(struct drm_crtc *crtc)
 {
@@ -657,11 +656,11 @@ static const struct drm_crtc_helper_funcs lcdif_crtc_helper_funcs = {
 	.atomic_enable = lcdif_crtc_atomic_enable,
 	.atomic_disable = lcdif_crtc_atomic_disable,
 };
 
 static const struct drm_crtc_funcs lcdif_crtc_funcs = {
-	.reset = lcdif_crtc_reset,
+	.atomic_create_state = lcdif_crtc_create_state,
 	.destroy = drm_crtc_cleanup,
 	.set_config = drm_atomic_helper_set_config,
 	.page_flip = drm_atomic_helper_page_flip,
 	.atomic_duplicate_state = lcdif_crtc_atomic_duplicate_state,
 	.atomic_destroy_state = lcdif_crtc_atomic_destroy_state,

-- 
2.55.0

Re: [PATCH 00/70] drm/crtc: Convert all drivers to atomic_create_state and remove reset

[Thomas Zimmermann]

Hi Maxime

Am 21.08.26 um 16:38 schrieb Maxime Ripard:
> This is a follow-up to the plane reset removal series, and part of a
> larger effort to remove the reset hook from all KMS objects.
>
> The CRTC reset hook is overloaded: it is called both at probe time to
> create the initial software state and during suspend/resume to reset
> hardware and software state. These two roles have different
> requirements, and the reset hook is not fallible, making error
> handling difficult for the initial state allocation path.
>
> While reset has the semantics to reset both the software and hardware
> state, the vast majority of implementations and all the helpers only
> reset the software state, making them equivalent to
> atomic_create_state in practice. The atomic_create_state hook makes
> this explicit: it only allocates and initializes a pristine state
> without any side effect, and returns the state pointer or an ERR_PTR
> on failure.
>
> This series converts all CRTC drivers tree-wide from the reset hook to
> atomic_create_state, then removes the reset hook from struct
> drm_crtc_funcs entirely. Two drivers (tilcdc and loongson) had actual
> hardware reset logic mixed into their reset hook; those are moved to
> CRTC creation instead. The conversions were done using a combination of
> Coccinelle semantic patches and manual adjustments.
>
> Signed-off-by: Maxime Ripard <mripard@kernel.org>

I've gone through the series and it looks good to me; except for patch 50.

Feel free to add

Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>

to the series with the exception of patch 50.

Best regards
Thomas


> ---
> Maxime Ripard (70):
>        drm/adp: Switch to drm_atomic_helper_crtc_create_state
>        drm/amdgpu: vkms: Switch to drm_atomic_helper_crtc_create_state
>        drm/arm: hdlcd: Switch to drm_atomic_helper_crtc_create_state
>        drm/armada: Switch to drm_atomic_helper_crtc_create_state
>        drm/exynos: Switch to drm_atomic_helper_crtc_create_state
>        drm/fsl-dcu: Switch to drm_atomic_helper_crtc_create_state
>        drm/gud: Switch to drm_atomic_helper_crtc_create_state
>        drm/hisilicon: hibmc: Switch to drm_atomic_helper_crtc_create_state
>        drm/hisilicon: kirin: Switch to drm_atomic_helper_crtc_create_state
>        drm/hyperv: Switch to drm_atomic_helper_crtc_create_state
>        drm/imx: dc: Switch to drm_atomic_helper_crtc_create_state
>        drm/imx: dcss: Switch to drm_atomic_helper_crtc_create_state
>        drm/ingenic: Switch to drm_atomic_helper_crtc_create_state
>        drm/kmb: Switch to drm_atomic_helper_crtc_create_state
>        drm/logicvc: Switch to drm_atomic_helper_crtc_create_state
>        drm/meson: Switch to drm_atomic_helper_crtc_create_state
>        drm/msm: mdp4: Switch to drm_atomic_helper_crtc_create_state
>        drm/mxs: mxsfb: Switch to drm_atomic_helper_crtc_create_state
>        drm/qxl: Switch to drm_atomic_helper_crtc_create_state
>        drm/renesas: shmobile: Switch to drm_atomic_helper_crtc_create_state
>        drm/simple-kms: Remove unused reset_crtc hook
>        drm/simple-kms: Switch to drm_atomic_helper_crtc_create_state
>        drm/sitronix: st7571: Switch to drm_atomic_helper_crtc_create_state
>        drm/sprd: Switch to drm_atomic_helper_crtc_create_state
>        drm/sti: Switch to drm_atomic_helper_crtc_create_state
>        drm/stm: Switch to drm_atomic_helper_crtc_create_state
>        drm/sun4i: Switch to drm_atomic_helper_crtc_create_state
>        drm/tests: Switch to drm_atomic_helper_crtc_create_state
>        drm/tilcdc: Move hardware reset to CRTC creation
>        drm/tilcdc: Switch to drm_atomic_helper_crtc_create_state
>        drm/tiny: appletbdrm: Switch to drm_atomic_helper_crtc_create_state
>        drm/tiny: bochs: Switch to drm_atomic_helper_crtc_create_state
>        drm/tiny: cirrus: Switch to drm_atomic_helper_crtc_create_state
>        drm/tiny: pixpaper: Switch to drm_atomic_helper_crtc_create_state
>        drm/tiny: sharp: Switch to drm_atomic_helper_crtc_create_state
>        drm/udl: Switch to drm_atomic_helper_crtc_create_state
>        drm/vbox: Switch to drm_atomic_helper_crtc_create_state
>        drm/verisilicon: Switch to drm_atomic_helper_crtc_create_state
>        drm/virtio: Switch to drm_atomic_helper_crtc_create_state
>        drm/xlnx: Switch to drm_atomic_helper_crtc_create_state
>        drm/mipi-dbi: Switch to drm_atomic_helper_crtc_create_state
>        drm/atomic-helper: Remove drm_atomic_helper_crtc_reset
>        sysfb: Convert to create_state
>        drm/amdgpu: dm: Convert to atomic_create_state
>        drm/komeda: Convert to atomic_create_state
>        drm/malidp: Convert to atomic_create_state
>        drm/ast: Convert to atomic_create_state
>        drm/atmel-hlcdc: Convert to atomic_create_state
>        drm/imx: ipuv3: Convert to atomic_create_state
>        drm/loongsoon: Move hardware reset to CRTC creation
>        drm/loongson: Convert to atomic_create_state
>        drm/mediatek: Convert to atomic_create_state
>        drm/mgag200: Convert to atomic_create_state
>        drm/msm: dpu1: Convert to atomic_create_state
>        drm/msm: mdp5: Convert to atomic_create_state
>        drm/mxsfb: lcdif: Convert to atomic_create_state
>        drm/nouveau: Convert to atomic_create_state
>        drm/omapdrm: Convert to atomic_create_state
>        drm/rcar-du: Convert to atomic_create_state
>        drm/rzg2l-du: Convert to atomic_create_state
>        drm/rockchip: vop: Convert to atomic_create_state
>        drm/rockchip: vop2: Convert to atomic_create_state
>        drm/sitronix: st7920: Convert to atomic_create_state
>        drm/solomon: ssd130x: Convert to atomic_create_state
>        drm/tegra: Convert to atomic_create_state
>        drm/vc4: Convert to atomic_create_state
>        drm/vkms: Convert to atomic_create_state
>        drm/vmwgfx: Convert to atomic_create_state
>        drm/atomic-helper: Remove __drm_atomic_helper_crtc_reset
>        drm/crtc: Remove reset
>
>   drivers/gpu/drm/adp/adp_drv.c                      |  2 +-
>   drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c           |  2 +-
>   .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 17 ++++----
>   drivers/gpu/drm/arm/display/komeda/komeda_crtc.c   | 18 ++++----
>   drivers/gpu/drm/arm/hdlcd_crtc.c                   |  2 +-
>   drivers/gpu/drm/arm/malidp_crtc.c                  | 18 ++++----
>   drivers/gpu/drm/armada/armada_crtc.c               |  2 +-
>   drivers/gpu/drm/ast/ast_mode.c                     | 18 ++++----
>   drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c     | 19 ++++-----
>   drivers/gpu/drm/drm_atomic_state_helper.c          | 45 --------------------
>   drivers/gpu/drm/drm_mode_config.c                  |  4 +-
>   drivers/gpu/drm/drm_simple_kms_helper.c            | 13 +-----
>   drivers/gpu/drm/exynos/exynos_drm_crtc.c           |  2 +-
>   drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c         |  2 +-
>   drivers/gpu/drm/gud/gud_drv.c                      |  2 +-
>   drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c     |  2 +-
>   drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c    |  2 +-
>   drivers/gpu/drm/hyperv/hyperv_drm_modeset.c        |  2 +-
>   drivers/gpu/drm/imx/dc/dc-crtc.c                   |  2 +-
>   drivers/gpu/drm/imx/dcss/dcss-crtc.c               |  2 +-
>   drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c             | 18 ++++----
>   drivers/gpu/drm/ingenic/ingenic-drm-drv.c          |  2 +-
>   drivers/gpu/drm/kmb/kmb_crtc.c                     |  2 +-
>   drivers/gpu/drm/logicvc/logicvc_crtc.c             |  2 +-
>   drivers/gpu/drm/loongson/lsdc_crtc.c               | 26 ++++++------
>   drivers/gpu/drm/mediatek/mtk_crtc.c                | 18 ++++----
>   drivers/gpu/drm/meson/meson_crtc.c                 |  2 +-
>   drivers/gpu/drm/mgag200/mgag200_drv.h              |  4 +-
>   drivers/gpu/drm/mgag200/mgag200_mode.c             | 15 ++++---
>   drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c           | 18 ++++----
>   drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c          |  2 +-
>   drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c          | 20 ++++-----
>   drivers/gpu/drm/mxsfb/lcdif_kms.c                  | 17 ++++----
>   drivers/gpu/drm/mxsfb/mxsfb_kms.c                  |  4 +-
>   drivers/gpu/drm/nouveau/dispnv50/head.c            | 14 +++----
>   drivers/gpu/drm/omapdrm/omap_crtc.c                | 17 ++++----
>   drivers/gpu/drm/qxl/qxl_display.c                  |  2 +-
>   drivers/gpu/drm/renesas/rcar-du/rcar_du_crtc.c     | 17 ++++----
>   drivers/gpu/drm/renesas/rz-du/rzg2l_du_crtc.c      | 15 +++----
>   drivers/gpu/drm/renesas/shmobile/shmob_drm_crtc.c  |  2 +-
>   drivers/gpu/drm/rockchip/rockchip_drm_vop.c        | 18 ++++----
>   drivers/gpu/drm/rockchip/rockchip_drm_vop2.c       | 18 ++++----
>   drivers/gpu/drm/sitronix/st7571.c                  |  2 +-
>   drivers/gpu/drm/sitronix/st7920.c                  | 10 +++--
>   drivers/gpu/drm/solomon/ssd130x.c                  | 10 +++--
>   drivers/gpu/drm/sprd/sprd_dpu.c                    |  2 +-
>   drivers/gpu/drm/sti/sti_crtc.c                     |  2 +-
>   drivers/gpu/drm/stm/ltdc.c                         |  4 +-
>   drivers/gpu/drm/sun4i/sun4i_crtc.c                 |  2 +-
>   drivers/gpu/drm/sysfb/drm_sysfb_helper.h           |  4 +-
>   drivers/gpu/drm/sysfb/drm_sysfb_modeset.c          | 20 ++++-----
>   drivers/gpu/drm/tegra/dc.c                         | 18 ++++----
>   drivers/gpu/drm/tests/drm_kunit_helpers.c          |  2 +-
>   drivers/gpu/drm/tilcdc/tilcdc_crtc.c               | 49 +++++++++-------------
>   drivers/gpu/drm/tiny/appletbdrm.c                  |  2 +-
>   drivers/gpu/drm/tiny/bochs.c                       |  2 +-
>   drivers/gpu/drm/tiny/cirrus-qemu.c                 |  2 +-
>   drivers/gpu/drm/tiny/pixpaper.c                    |  2 +-
>   drivers/gpu/drm/tiny/sharp-memory.c                |  2 +-
>   drivers/gpu/drm/udl/udl_modeset.c                  |  2 +-
>   drivers/gpu/drm/vboxvideo/vbox_mode.c              |  2 +-
>   drivers/gpu/drm/vc4/tests/vc4_mock_crtc.c          |  2 +-
>   drivers/gpu/drm/vc4/vc4_crtc.c                     | 14 +++----
>   drivers/gpu/drm/vc4/vc4_drv.h                      |  2 +-
>   drivers/gpu/drm/vc4/vc4_txp.c                      |  2 +-
>   drivers/gpu/drm/verisilicon/vs_crtc.c              |  2 +-
>   drivers/gpu/drm/virtio/virtgpu_display.c           |  2 +-
>   drivers/gpu/drm/vkms/vkms_crtc.c                   | 18 ++++----
>   drivers/gpu/drm/vmwgfx/vmwgfx_kms.c                | 22 ++++------
>   drivers/gpu/drm/vmwgfx/vmwgfx_kms.h                |  2 +-
>   drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c                |  2 +-
>   drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c               |  2 +-
>   drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c               |  2 +-
>   drivers/gpu/drm/xlnx/zynqmp_kms.c                  |  2 +-
>   include/drm/drm_atomic_state_helper.h              |  3 --
>   include/drm/drm_crtc.h                             | 12 ------
>   include/drm/drm_mipi_dbi.h                         |  2 +-
>   include/drm/drm_simple_kms_helper.h                |  1 -
>   78 files changed, 275 insertions(+), 385 deletions(-)
> ---
> base-commit: 7ea58b9ddb52264a4ed36bccb975062ada32c62d
> change-id: 20260709-drm-no-more-crtc-reset-14a4d5bc8d41
>
> Best regards,

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, (HRB 36809, AG Nürnberg)