[PATCH] drm/msm/dsi: avoid pinning the command buffer on every transfer

[PATCH] drm/msm/dsi: avoid pinning the command buffer on every transfer

[Michael McAllister]

The command buffer is already pinned by msm_gem_kernel_new() when it is
allocated. Calling msm_gem_get_and_pin_iova() to fetch its DMA address
adds another pin for each transfer, while teardown only drops the
allocation's lifetime pin. This leaves outstanding pins on the buffer.

Use msm_gem_get_iova() to retrieve the address without taking another
pin. The allocation's existing pin keeps the mapping valid until
msm_gem_kernel_put() releases the buffer.

Fixes: 7ad0e8cf6317 ("drm/msm: Count how many times iova memory is pinned")
Signed-off-by: Michael McAllister <me@michaelmcallister.org>
---
Hi,

I ran into this while testing display teardown on the Moto G10. The DSI
command buffer is already pinned for its lifetime, so this avoids taking
another pin every time we fetch its DMA address.

I tested this as part of the G10 display fixes on 7.2.9, including display
power cycling, suspend/resume and teardown with the compositor stopped.

Thanks,
Michael

 drivers/gpu/drm/msm/dsi/dsi_host.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index d92659d80f..64fc54dff4 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -1428,7 +1428,8 @@ int dsi_dma_base_get_6g(struct msm_dsi_host *msm_host, uint64_t *dma_base)
 	if (!dma_base)
 		return -EINVAL;
 
-	return msm_gem_get_and_pin_iova(msm_host->tx_gem_obj,
+	/* The command buffer stays pinned from allocation until teardown. */
+	return msm_gem_get_iova(msm_host->tx_gem_obj,
 				priv->kms->vm, dma_base);
 }
 

base-commit: 1e59855738454b14021b64115f0090eafc7526ae
-- 
2.39.5

Re: [PATCH] drm/msm/dsi: avoid pinning the command buffer on every transfer

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] drm/msm/dsi: double free in msm_dsi_tx_buf_free() [1]
--

commit da2da22a4a147766651afbdf0137d05a0c119858
Author: Michael McAllister <me@michaelmcallister.org>

drm/msm/dsi: avoid pinning the command buffer on every transfer

This commit replaces msm_gem_get_and_pin_iova() with msm_gem_get_iova() in
dsi_dma_base_get_6g() so that fetching the DSI command buffer's DMA address
does not take an additional pin on every transfer.

> diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
> index d92659d80f172..64fc54dff4839 100644
> --- a/drivers/gpu/drm/msm/dsi/dsi_host.c
> +++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
> @@ -1428,7 +1428,8 @@ int dsi_dma_base_get_6g(struct msm_dsi_host *msm_host, uint64_t *dma_base)
>  	if (!dma_base)
>  		return -EINVAL;
>  
> -	return msm_gem_get_and_pin_iova(msm_host->tx_gem_obj,
> +	/* The command buffer stays pinned from allocation until teardown. */
> +	return msm_gem_get_iova(msm_host->tx_gem_obj,
>  				priv->kms->vm, dma_base);
>  }

[Severity: Critical]
This problem wasn't introduced by this patch, but can msm_dsi_tx_buf_free()
double free msm_host->tx_buf across component unbind cycles [1]?

drivers/gpu/drm/msm/dsi/dsi_host.c:msm_dsi_tx_buf_free() {
	...
	if (msm_host->tx_gem_obj) {
		msm_gem_kernel_put(msm_host->tx_gem_obj, msm_host->vm);
		drm_gpuvm_put(msm_host->vm);
		msm_host->tx_gem_obj = NULL;
		msm_host->vm = NULL;
	}

	if (msm_host->tx_buf)
		dma_free_coherent(dev->dev, msm_host->tx_size, msm_host->tx_buf,
			msm_host->tx_buf_paddr);
}

msm_host persists across component bind and unbind cycles, and unlike
msm_host->tx_gem_obj, msm_host->tx_buf is not cleared after
dma_free_coherent().  If a later bind fails before reallocating the buffer,
the resulting unbind calls dma_free_coherent() on the stale msm_host->tx_buf
pointer a second time.

[1] https://sashiko.dev/#/bug/linux-6f5085d3-ef49-482c-86e4-a2438bc1b91f

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179422752570.88190.13452031230666113805.msm-dsi-pin-leak@michaelmcallister.org?part=1

Re: [PATCH] drm/msm/dsi: avoid pinning the command buffer on every transfer

[Dmitry Baryshkov]

On Mon, Nov 09, 2026 at 12:32:05PM +0000, Michael McAllister wrote:
> The command buffer is already pinned by msm_gem_kernel_new() when it is
> allocated. Calling msm_gem_get_and_pin_iova() to fetch its DMA address
> adds another pin for each transfer, while teardown only drops the
> allocation's lifetime pin. This leaves outstanding pins on the buffer.
> 
> Use msm_gem_get_iova() to retrieve the address without taking another
> pin. The allocation's existing pin keeps the mapping valid until
> msm_gem_kernel_put() releases the buffer.
> 
> Fixes: 7ad0e8cf6317 ("drm/msm: Count how many times iova memory is pinned")
> Signed-off-by: Michael McAllister <me@michaelmcallister.org>
> ---
> Hi,
> 
> I ran into this while testing display teardown on the Moto G10. The DSI
> command buffer is already pinned for its lifetime, so this avoids taking
> another pin every time we fetch its DMA address.
> 
> I tested this as part of the G10 display fixes on 7.2.9, including display
> power cycling, suspend/resume and teardown with the compositor stopped.

Sashiko reports a double-free and I think I'd tend to believe it.

-- 
With best wishes
Dmitry