kernel/git/next/linux-next.git/drivers/gpu/drm/tiny, branch master

Merge drm/drm-next into drm-misc-next

2026-09-07T11:44:24+00:00

Backmerging to get drm-misc-next up to v7.3-rc2. Requested for commit 3a2c4d55e32a ("treewide: refresh kmalloc_obj() conversions"). Signed-off-by: Thomas Zimmermann

Merge drm/drm-fixes into drm-misc-fixes

2026-09-01T07:38:51+00:00

Let's start the 7.3 drm-misc-fixes cycle. Signed-off-by: Maxime Ripard

drm/tiny: sharp: Switch to drm_atomic_helper_crtc_create_state

2026-08-31T13:11:12+00:00

The sharp crtc implementation uses the deprecated drm_atomic_helper_crtc_reset() as its reset hook. Switch to drm_atomic_helper_crtc_create_state() instead. Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260821-drm-no-more-crtc-reset-v1-35-fb793475c05a@kernel.org Signed-off-by: Maxime Ripard

drm/tiny: pixpaper: Switch to drm_atomic_helper_crtc_create_state

2026-08-31T13:11:11+00:00

The pixpaper crtc implementation uses the deprecated drm_atomic_helper_crtc_reset() as its reset hook. Switch to drm_atomic_helper_crtc_create_state() instead. Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260821-drm-no-more-crtc-reset-v1-34-fb793475c05a@kernel.org Signed-off-by: Maxime Ripard

drm/tiny: cirrus: Switch to drm_atomic_helper_crtc_create_state

2026-08-31T13:11:11+00:00

The cirrus crtc implementation uses the deprecated drm_atomic_helper_crtc_reset() as its reset hook. Switch to drm_atomic_helper_crtc_create_state() instead. Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260821-drm-no-more-crtc-reset-v1-33-fb793475c05a@kernel.org Signed-off-by: Maxime Ripard

drm/tiny: bochs: Switch to drm_atomic_helper_crtc_create_state

2026-08-31T13:11:10+00:00

The bochs crtc implementation uses the deprecated drm_atomic_helper_crtc_reset() as its reset hook. Switch to drm_atomic_helper_crtc_create_state() instead. Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260821-drm-no-more-crtc-reset-v1-32-fb793475c05a@kernel.org Signed-off-by: Maxime Ripard

drm/tiny: appletbdrm: Switch to drm_atomic_helper_crtc_create_state

2026-08-31T13:11:10+00:00

The appletbdrm crtc implementation uses the deprecated drm_atomic_helper_crtc_reset() as its reset hook. Switch to drm_atomic_helper_crtc_create_state() instead. Acked-by: Aditya Garg Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260821-drm-no-more-crtc-reset-v1-31-fb793475c05a@kernel.org Signed-off-by: Maxime Ripard

Merge drm/drm-next into drm-misc-next

2026-08-31T07:01:06+00:00

Getting drm-misc-next up to v7.3-rc1. In exynos, there was a conflict in exynos_dbi_bind(). The merge resolves it to the state of commit 3cc8eee9f346 ("drm/exynos: remove dependency on DRM simple helpers"). Signed-off-by: Thomas Zimmermann

drm/cirrus-qemu: Validate BAR0 size during probe

2026-08-26T06:54:58+00:00

The `cirrus-qemu` driver relies on `CIRRUS_VRAM_SIZE` (4 MB) to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches `CIRRUS_VRAM_SIZE`. If a PCI device with a BAR0 smaller than 4 MB is bound to the driver, the mapped VRAM will be smaller than expected. Because validation checks assume 4 MB VRAM, framebuffers larger than the mapped memory can be created. When the display plane is updated (e.g. during release), `cirrus_primary_plane_helper_atomic_update()` copies the framebuffer to VRAM using `drm_fb_memcpy()`. Writing past the end of the mapped I/O memory causes a supervisor write page fault: BUG: unable to handle page fault for address: ffffc9000389c000 ... RIP: 0010:memcpy_toio+0x7c/0xe0 arch/x86/lib/iomem.c:110 ... Call Trace: iosys_map_memcpy_to include/linux/iosys-map.h:285 [inline] drm_fb_memcpy+0x325/0x5d0 drivers/gpu/drm/drm_format_helper.c:442 cirrus_primary_plane_helper_atomic_update+0x98a/0xb00 drivers/gpu/drm/tiny/cirrus-qemu.c:358 drm_atomic_helper_commit_planes+0x626/0xea0 drivers/gpu/drm/drm_atomic_helper.c:3038 drm_atomic_helper_commit_tail+0x60/0x510 drivers/gpu/drm/drm_atomic_helper.c:1989 commit_tail+0x2b1/0x3c0 drivers/gpu/drm/drm_atomic_helper.c:2074 drm_atomic_helper_commit+0xa77/0xb10 drivers/gpu/drm/drm_atomic_helper.c:2312 Fix this by validating in `cirrus_pci_probe()` that the PCI BAR0 resource is not less than `CIRRUS_VRAM_SIZE`, returning `-ENODEV` if it is less. Fixes: ab3e023b1b4c ("drm/cirrus: rewrite and modernize driver.") Assisted-by: Gemini:gemini-3.6-flash Gemini:gemini-3.1-pro-preview syzbot Reported-by: syzbot+2442951a6abb004df963@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2442951a6abb004df963 Link: https://syzkaller.appspot.com/ai_job?id=ba262a3a-bccf-4ad8-a1b0-583c55d34fd6 Signed-off-by: Slawomir Stepien Signed-off-by: Thomas Zimmermann Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260825120729.493611-1-sst@poczta.fm

drm/appletbdrm: Convert to atomic_create_state

2026-08-21T14:20:26+00:00

The plane reset implementation creates a custom state subclass, but only initializes a pristine state without resetting any hardware. This is equivalent to what atomic_create_state expects. Convert to it. The conversion was done using the following Coccinelle semantic patch: @@ identifier funcs; symbol drm_atomic_helper_plane_reset; symbol drm_atomic_helper_plane_create_state; @@ struct drm_plane_funcs funcs = { ..., - .reset = drm_atomic_helper_plane_reset, + .atomic_create_state = drm_atomic_helper_plane_create_state, ..., }; @match_struct_reset@ identifier funcs, reset_func; @@ struct drm_plane_funcs funcs = { ..., .reset = reset_func, ..., }; @reset_uses_helpers depends on match_struct_reset@ identifier match_struct_reset.reset_func; @@ void reset_func(...) { <+... ( __drm_atomic_helper_plane_reset(...); | __drm_gem_reset_shadow_plane(...); ) ...+> } @match_struct_destroy@ identifier funcs, destroy_func; @@ struct drm_plane_funcs funcs = { ..., .atomic_destroy_state = destroy_func, ..., }; @script:python renamed_func@ old_name << match_struct_reset.reset_func; new_name; @@ if old_name.endswith("_reset"): coccinelle.new_name = old_name.replace("_reset", "_create_state") else: coccinelle.new_name = old_name @update_struct depends on match_struct_reset && reset_uses_helpers@ identifier match_struct_reset.funcs, match_struct_reset.reset_func; identifier renamed_func.new_name; @@ struct drm_plane_funcs funcs = { ..., - .reset = reset_func, + .atomic_create_state = new_name, ..., }; @drop_destroy depends on update_struct && match_struct_destroy@ identifier match_struct_reset.reset_func; identifier match_struct_destroy.destroy_func; identifier container_func; identifier P; symbol drm_atomic_helper_plane_destroy_state; symbol __drm_atomic_helper_plane_destroy_state; @@ void reset_func(struct drm_plane *P) { ... ( - if (P->state) { - <+... ( - drm_atomic_helper_plane_destroy_state(P, P->state); | - __drm_atomic_helper_plane_destroy_state(P->state); | - P->funcs->atomic_destroy_state(P, P->state); | - destroy_func(P, P->state); ) - ...+> - } | - drm_WARN_ON_ONCE(P->dev, P->state); | - WARN_ON(P->state); ) ... ( - kfree(P->state); | - kfree(container_func(P->state)); | // kfree is optional ) ( - P->state = NULL; | // plane->state clearing is optional ) ... } @drop_destroy_mtk depends on update_struct@ identifier P; symbol __drm_atomic_helper_plane_destroy_state; symbol to_mtk_plane_state; @@ void mtk_plane_reset(struct drm_plane *P) { ... - if (P->state) { - __drm_atomic_helper_plane_destroy_state(P->state); - ... - } else { ... - } ... } @transform_nv50_wndw depends on update_struct@ identifier S; @@ void nv50_wndw_reset(...) { ... - if (WARN_ON(!(S = kzalloc_obj(*S)))) + S = kzalloc_obj(*S); + if (WARN_ON(!S)) return; ... } @transform_kzalloc depends on update_struct@ identifier match_struct_reset.reset_func; identifier P, S; statement ST; statement list STL; @@ void reset_func(struct drm_plane *P) { <... S = kzalloc_obj(*S); ( - if (S) - { - STL - } + if (!S) return; + + STL | - if (S) ST + if (!S) return; + + ST ) ...> } @transform_body depends on update_struct@ identifier match_struct_reset.reset_func; identifier renamed_func.new_name; identifier S, P; expression PS; @@ - void reset_func(struct drm_plane *P) + struct drm_plane_state *new_name(struct drm_plane *P) { ... S = kzalloc_obj(*S); ... ( if (!S) { ... - return; + return ERR_PTR(-ENOMEM); } | if (WARN_ON(!S)) { ... - return; + return ERR_PTR(-ENOMEM); } | if (S == NULL) { ... - return; + return ERR_PTR(-ENOMEM); } ) ... ( - __drm_atomic_helper_plane_reset(P, PS); + __drm_atomic_helper_plane_state_init(PS, P); | - __drm_gem_reset_shadow_plane(P, PS); + __drm_gem_shadow_plane_state_init(P, PS); ) ... } @update_early_return depends on update_struct@ identifier match_struct_reset.reset_func; identifier renamed_func.new_name; identifier P; expression PS; @@ struct drm_plane_state *new_name(struct drm_plane *P) { <+... - return; + return ERR_PTR(-EINVAL); ...+> } @update_return_plane depends on update_struct@ identifier match_struct_reset.reset_func; identifier renamed_func.new_name; identifier P; expression PS; @@ struct drm_plane_state *new_name(struct drm_plane *P) { ... __drm_atomic_helper_plane_state_init(PS, P); ... + + return PS; } @update_return_shadow depends on update_struct@ identifier renamed_func.new_name; identifier P; expression PS; @@ struct drm_plane_state *new_name(struct drm_plane *P) { ... __drm_gem_shadow_plane_state_init(P, PS); ... + + return &PS->base; } Acked-by: Aditya Garg Link: https://patch.msgid.link/20260814-drm-no-more-plane-reset-v2-10-82d2963dd134@kernel.org Signed-off-by: Maxime Ripard