* [PATCH v6 01/29] drm/msm/dp: move link-level teardown from display_disable to display_unprepare
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 02/29] drm/msm/dp: refactor msm_dp_ctrl_config_msa() to take panel Yongxing Mou
` (27 subsequent siblings)
28 siblings, 0 replies; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
msm_dp_display_disable() currently mixes stream-level shutdown
(disable VSC SDP, off pixel clk, clear power_on) with link-level
teardown (PSM config when sink_count==0, off_link, PHY re-init or
host PHY exit).
For DP MST the same link is shared across multiple streams, so
disabling one stream must not tear down the link. Move the
link-level steps into msm_dp_display_unprepare() so that
display_disable() handles only the per-stream sequence, mirroring
the split already present on the prepare path
(display_prepare_link vs display_set_mode / display_enable).
SST behaviour is unchanged: atomic_post_disable() still calls
display_disable() followed by display_unprepare() in the same
order, and the cached dp->panel used inside unprepare is the same
panel that was previously passed in.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_display.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index bc646d172abe..a7b0196bb1c7 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -722,20 +722,6 @@ static int msm_dp_display_disable(struct msm_dp_display_private *dp,
msm_dp_ctrl_off_pixel_clk(dp->ctrl);
- /* dongle is still connected but sinks are disconnected */
- if (dp->link->sink_count == 0)
- msm_dp_link_psm_config(dp->link, &msm_dp_panel->link_info, true);
-
- msm_dp_ctrl_off_link(dp->ctrl, msm_dp_panel);
-
- if (dp->link->sink_count == 0)
- /* re-init the PHY so that we can listen to Dongle disconnect */
- msm_dp_ctrl_reinit_phy(dp->ctrl);
- else
- msm_dp_display_host_phy_exit(dp);
-
- msm_dp_display->power_on = false;
-
drm_dbg_dp(dp->drm_dev, "sink count: %d\n", dp->link->sink_count);
return 0;
}
@@ -1465,6 +1451,20 @@ static void msm_dp_display_unprepare(struct msm_dp_display_private *dp)
{
struct msm_dp *msm_dp_display = &dp->msm_dp_display;
+ /* dongle is still connected but sinks are disconnected */
+ if (dp->link->sink_count == 0)
+ msm_dp_link_psm_config(dp->link, &dp->panel->link_info, true);
+
+ msm_dp_ctrl_off_link(dp->ctrl, dp->panel);
+
+ if (dp->link->sink_count == 0)
+ /* re-init the PHY so that we can listen to Dongle disconnect */
+ msm_dp_ctrl_reinit_phy(dp->ctrl);
+ else
+ msm_dp_display_host_phy_exit(dp);
+
+ msm_dp_display->power_on = false;
+
pm_runtime_put_sync(&msm_dp_display->pdev->dev);
drm_dbg_dp(dp->drm_dev, "type=%d Done\n", msm_dp_display->connector_type);
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* [PATCH v6 02/29] drm/msm/dp: refactor msm_dp_ctrl_config_msa() to take panel
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 01/29] drm/msm/dp: move link-level teardown from display_disable to display_unprepare Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 03/29] drm/msm/dp: drop redundant config_ctrl_link() from msm_dp_ctrl_on_stream() Yongxing Mou
` (26 subsequent siblings)
28 siblings, 0 replies; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou
Replace the (rate, stream_rate_khz, is_ycbcr_420) parameter triple with
(panel, rate); both values are already derivable from panel->msm_dp_mode.
This lets config_msa() use panel->stream_id when writing
SOFTWARE_MVID/NVID for MST streams, added by a later patch.
No functional change.
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 59070f399e2d..1ed713b957c6 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -2463,14 +2463,14 @@ static int msm_dp_ctrl_link_retrain(struct msm_dp_ctrl_private *ctrl,
}
static void msm_dp_ctrl_config_msa(struct msm_dp_ctrl_private *ctrl,
- u32 rate, u32 stream_rate_khz,
- bool is_ycbcr_420)
+ struct msm_dp_panel *panel, u32 rate)
{
u32 pixel_m, pixel_n;
u32 mvid, nvid, pixel_div, dispcc_input_rate;
u32 const nvid_fixed = DP_LINK_CONSTANT_N_VALUE;
u32 const link_rate_hbr2 = 540000;
u32 const link_rate_hbr3 = 810000;
+ u32 stream_rate_khz = panel->msm_dp_mode.drm_mode.clock;
unsigned long den, num;
switch (rate) {
@@ -2516,7 +2516,7 @@ static void msm_dp_ctrl_config_msa(struct msm_dp_ctrl_private *ctrl,
nvid = temp;
}
- if (is_ycbcr_420)
+ if (panel->msm_dp_mode.out_fmt_is_yuv_420)
mvid /= 2;
if (link_rate_hbr2 == rate)
@@ -2573,15 +2573,13 @@ int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *
bool mainlink_ready = false;
struct msm_dp_ctrl_private *ctrl;
unsigned long pixel_rate;
- unsigned long pixel_rate_orig;
if (!msm_dp_ctrl)
return -EINVAL;
ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
- pixel_rate_orig = panel->msm_dp_mode.drm_mode.clock;
- pixel_rate = pixel_rate_orig;
+ pixel_rate = panel->msm_dp_mode.drm_mode.clock;
if (msm_dp_ctrl->wide_bus_en || panel->msm_dp_mode.out_fmt_is_yuv_420)
pixel_rate >>= 1;
@@ -2604,10 +2602,8 @@ int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *
msm_dp_ctrl_configure_source_params(ctrl, panel);
- msm_dp_ctrl_config_msa(ctrl,
- ctrl->link->link_params.rate,
- pixel_rate_orig,
- panel->msm_dp_mode.out_fmt_is_yuv_420);
+ msm_dp_ctrl_config_msa(ctrl, panel,
+ ctrl->link->link_params.rate);
msm_dp_panel_clear_dsc_dto(panel);
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* [PATCH v6 03/29] drm/msm/dp: drop redundant config_ctrl_link() from msm_dp_ctrl_on_stream()
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 01/29] drm/msm/dp: move link-level teardown from display_disable to display_unprepare Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 02/29] drm/msm/dp: refactor msm_dp_ctrl_config_msa() to take panel Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 04/29] drm/msm/dp: introduce stream_id for each DP panel Yongxing Mou
` (25 subsequent siblings)
28 siblings, 0 replies; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou
REG_DP_CONFIGURATION_CTRL contains link-wide state and is already
programmed during link training.
Calling config_ctrl_link() from msm_dp_ctrl_on_stream() rewrites the
same configuration and is unnecessary. Remove the redundant call.
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 1ed713b957c6..e7bb9558c0b4 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -2598,7 +2598,6 @@ int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *
msm_dp_ctrl_lane_mapping(ctrl);
msm_dp_setup_peripheral_flush(ctrl);
- msm_dp_ctrl_config_ctrl_link(ctrl, panel);
msm_dp_ctrl_configure_source_params(ctrl, panel);
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* [PATCH v6 04/29] drm/msm/dp: introduce stream_id for each DP panel
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (2 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 03/29] drm/msm/dp: drop redundant config_ctrl_link() from msm_dp_ctrl_on_stream() Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 05/29] drm/msm/dp: add support for programming p1/p2/p3 register blocks Yongxing Mou
` (24 subsequent siblings)
28 siblings, 0 replies; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
With MST, each DP controller can handle multiple streams. There shall be
one dp_panel for each stream but the dp_display object shall be shared
among them. To represent this abstraction, add a stream_id field to
struct msm_dp_panel and introduce the msm_dp_stream_id enum. For SST,
the field is initialized to DP_STREAM_0.
In the MST path, each panel will be assigned an actual stream_id at
stream-enable time by the MST layer (added in later patches).
Use the stream ID to control the pixel clock of that respective stream by
extending the clock handles and state tracking of the DP pixel clock to
an array of max supported streams. The maximum streams currently is 4.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 70 +++++++++++++++++++++++--------------
drivers/gpu/drm/msm/dp/dp_ctrl.h | 2 +-
drivers/gpu/drm/msm/dp/dp_display.c | 2 +-
drivers/gpu/drm/msm/dp/dp_panel.c | 1 +
drivers/gpu/drm/msm/dp/dp_panel.h | 11 ++++++
5 files changed, 57 insertions(+), 29 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index e7bb9558c0b4..67f1da46b973 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -126,7 +126,8 @@ struct msm_dp_ctrl_private {
unsigned int num_link_clks;
struct clk_bulk_data *link_clks;
- struct clk *pixel_clk;
+ struct clk *pixel_clk[DP_STREAM_MAX];
+ unsigned int num_pixel_clks;
union phy_configure_opts phy_opts;
@@ -138,7 +139,7 @@ struct msm_dp_ctrl_private {
bool core_clks_on;
bool link_clks_on;
- bool stream_clks_on;
+ bool stream_clks_on[DP_STREAM_MAX];
};
static inline u32 msm_dp_read_ahb(const struct msm_dp_ctrl_private *ctrl, u32 offset)
@@ -1750,7 +1751,7 @@ int msm_dp_ctrl_core_clk_enable(struct msm_dp_ctrl *msm_dp_ctrl)
drm_dbg_dp(ctrl->drm_dev, "enable core clocks \n");
drm_dbg_dp(ctrl->drm_dev, "stream_clks:%s link_clks:%s core_clks:%s\n",
- str_on_off(ctrl->stream_clks_on),
+ str_on_off(ctrl->stream_clks_on[DP_STREAM_0]),
str_on_off(ctrl->link_clks_on),
str_on_off(ctrl->core_clks_on));
@@ -1769,7 +1770,7 @@ void msm_dp_ctrl_core_clk_disable(struct msm_dp_ctrl *msm_dp_ctrl)
drm_dbg_dp(ctrl->drm_dev, "disable core clocks \n");
drm_dbg_dp(ctrl->drm_dev, "stream_clks:%s link_clks:%s core_clks:%s\n",
- str_on_off(ctrl->stream_clks_on),
+ str_on_off(ctrl->stream_clks_on[DP_STREAM_0]),
str_on_off(ctrl->link_clks_on),
str_on_off(ctrl->core_clks_on));
}
@@ -1800,7 +1801,7 @@ static int msm_dp_ctrl_link_clk_enable(struct msm_dp_ctrl *msm_dp_ctrl)
drm_dbg_dp(ctrl->drm_dev, "enable link clocks\n");
drm_dbg_dp(ctrl->drm_dev, "stream_clks:%s link_clks:%s core_clks:%s\n",
- str_on_off(ctrl->stream_clks_on),
+ str_on_off(ctrl->stream_clks_on[DP_STREAM_0]),
str_on_off(ctrl->link_clks_on),
str_on_off(ctrl->core_clks_on));
@@ -1819,7 +1820,7 @@ static void msm_dp_ctrl_link_clk_disable(struct msm_dp_ctrl *msm_dp_ctrl)
drm_dbg_dp(ctrl->drm_dev, "disabled link clocks\n");
drm_dbg_dp(ctrl->drm_dev, "stream_clks:%s link_clks:%s core_clks:%s\n",
- str_on_off(ctrl->stream_clks_on),
+ str_on_off(ctrl->stream_clks_on[DP_STREAM_0]),
str_on_off(ctrl->link_clks_on),
str_on_off(ctrl->core_clks_on));
}
@@ -2190,38 +2191,39 @@ static bool msm_dp_ctrl_send_phy_test_pattern(struct msm_dp_ctrl_private *ctrl)
return success;
}
-static int msm_dp_ctrl_on_pixel_clk(struct msm_dp_ctrl_private *ctrl, unsigned long pixel_rate)
+static int msm_dp_ctrl_on_pixel_clk(struct msm_dp_ctrl_private *ctrl, unsigned long pixel_rate,
+ enum msm_dp_stream_id stream_id)
{
int ret;
- ret = clk_set_rate(ctrl->pixel_clk, pixel_rate * 1000);
+ ret = clk_set_rate(ctrl->pixel_clk[stream_id], pixel_rate * 1000);
if (ret) {
DRM_ERROR("Failed to set pixel clock rate. ret=%d\n", ret);
return ret;
}
- if (WARN_ON_ONCE(ctrl->stream_clks_on))
- return 0;
+ if (WARN_ON_ONCE(ctrl->stream_clks_on[stream_id]))
+ return -EINVAL;
- ret = clk_prepare_enable(ctrl->pixel_clk);
+ ret = clk_prepare_enable(ctrl->pixel_clk[stream_id]);
if (ret) {
DRM_ERROR("Failed to start pixel clocks. ret=%d\n", ret);
return ret;
}
- ctrl->stream_clks_on = true;
+ ctrl->stream_clks_on[stream_id] = true;
return ret;
}
-void msm_dp_ctrl_off_pixel_clk(struct msm_dp_ctrl *msm_dp_ctrl)
+void msm_dp_ctrl_off_pixel_clk(struct msm_dp_ctrl *msm_dp_ctrl, enum msm_dp_stream_id stream_id)
{
struct msm_dp_ctrl_private *ctrl;
ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
- if (ctrl->stream_clks_on) {
- clk_disable_unprepare(ctrl->pixel_clk);
- ctrl->stream_clks_on = false;
+ if (ctrl->stream_clks_on[stream_id]) {
+ clk_disable_unprepare(ctrl->pixel_clk[stream_id]);
+ ctrl->stream_clks_on[stream_id] = false;
}
}
@@ -2242,7 +2244,7 @@ static int msm_dp_ctrl_process_phy_test_request(struct msm_dp_ctrl_private *ctrl
* running. Add the global reset just before disabling the
* link clocks and core clocks.
*/
- msm_dp_ctrl_off_pixel_clk(&ctrl->msm_dp_ctrl);
+ msm_dp_ctrl_off_pixel_clk(&ctrl->msm_dp_ctrl, panel->stream_id);
msm_dp_ctrl_off_link(&ctrl->msm_dp_ctrl, panel);
ret = msm_dp_ctrl_on_link(&ctrl->msm_dp_ctrl, panel);
@@ -2252,7 +2254,7 @@ static int msm_dp_ctrl_process_phy_test_request(struct msm_dp_ctrl_private *ctrl
}
pixel_rate = panel->msm_dp_mode.drm_mode.clock;
- ret = msm_dp_ctrl_on_pixel_clk(ctrl, pixel_rate);
+ ret = msm_dp_ctrl_on_pixel_clk(ctrl, pixel_rate, panel->stream_id);
if (ret)
return ret;
@@ -2546,9 +2548,8 @@ int msm_dp_ctrl_prepare_stream_on(struct msm_dp_ctrl *msm_dp_ctrl,
ctrl->link->link_params.rate,
ctrl->link->link_params.num_lanes);
- drm_dbg_dp(ctrl->drm_dev,
- "core_clk_on=%d link_clk_on=%d stream_clk_on=%d\n",
- ctrl->core_clks_on, ctrl->link_clks_on, ctrl->stream_clks_on);
+ drm_dbg_dp(ctrl->drm_dev, "core_clk_on=%d link_clk_on=%d\n",
+ ctrl->core_clks_on, ctrl->link_clks_on);
if (!ctrl->link_clks_on) { /* link clk is off */
ret = msm_dp_ctrl_enable_mainlink_clocks(ctrl, panel);
@@ -2586,7 +2587,7 @@ int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *
drm_dbg_dp(ctrl->drm_dev, "pixel_rate=%lu\n", pixel_rate);
- ret = msm_dp_ctrl_on_pixel_clk(ctrl, pixel_rate);
+ ret = msm_dp_ctrl_on_pixel_clk(ctrl, pixel_rate, panel->stream_id);
if (ret)
return ret;
@@ -2643,8 +2644,6 @@ void msm_dp_ctrl_off_link(struct msm_dp_ctrl *msm_dp_ctrl,
ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
phy = ctrl->phy;
- msm_dp_panel_disable_vsc_sdp(panel);
-
msm_dp_ctrl_mainlink_disable(ctrl);
msm_dp_ctrl_reset(&ctrl->msm_dp_ctrl, panel);
@@ -2714,6 +2713,13 @@ static const char *ctrl_clks[] = {
"ctrl_link_iface",
};
+static const char * const pixel_clks[] = {
+ "stream_pixel",
+ "stream_1_pixel",
+ "stream_2_pixel",
+ "stream_3_pixel",
+};
+
static int msm_dp_ctrl_clk_init(struct msm_dp_ctrl *msm_dp_ctrl)
{
struct msm_dp_ctrl_private *ctrl;
@@ -2747,9 +2753,19 @@ static int msm_dp_ctrl_clk_init(struct msm_dp_ctrl *msm_dp_ctrl)
if (rc)
return rc;
- ctrl->pixel_clk = devm_clk_get(dev, "stream_pixel");
- if (IS_ERR(ctrl->pixel_clk))
- return PTR_ERR(ctrl->pixel_clk);
+ ctrl->pixel_clk[0] = devm_clk_get(dev, pixel_clks[0]);
+ if (IS_ERR(ctrl->pixel_clk[0]))
+ return PTR_ERR(ctrl->pixel_clk[0]);
+ ctrl->num_pixel_clks = 1;
+
+ for (i = DP_STREAM_1; i < DP_STREAM_MAX; i++) {
+ ctrl->pixel_clk[i] = devm_clk_get_optional(dev, pixel_clks[i]);
+ if (IS_ERR(ctrl->pixel_clk[i]))
+ return PTR_ERR(ctrl->pixel_clk[i]);
+ if (!ctrl->pixel_clk[i])
+ break;
+ ctrl->num_pixel_clks++;
+ }
return 0;
}
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.h b/drivers/gpu/drm/msm/dp/dp_ctrl.h
index 5902cf7e746a..be0d89d60914 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.h
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.h
@@ -24,7 +24,7 @@ int msm_dp_ctrl_prepare_stream_on(struct msm_dp_ctrl *msm_dp_ctrl,
bool force_link_train);
void msm_dp_ctrl_off_link(struct msm_dp_ctrl *msm_dp_ctrl,
struct msm_dp_panel *panel);
-void msm_dp_ctrl_off_pixel_clk(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_off_pixel_clk(struct msm_dp_ctrl *msm_dp_ctrl, enum msm_dp_stream_id stream_id);
void msm_dp_ctrl_push_idle(struct msm_dp_ctrl *msm_dp_ctrl);
irqreturn_t msm_dp_ctrl_isr(struct msm_dp_ctrl *msm_dp_ctrl,
struct msm_dp_panel *panel);
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index a7b0196bb1c7..fb6607f65ded 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -720,7 +720,7 @@ static int msm_dp_display_disable(struct msm_dp_display_private *dp,
msm_dp_panel_disable_vsc_sdp(msm_dp_panel);
- msm_dp_ctrl_off_pixel_clk(dp->ctrl);
+ msm_dp_ctrl_off_pixel_clk(dp->ctrl, msm_dp_panel->stream_id);
drm_dbg_dp(dp->drm_dev, "sink count: %d\n", dp->link->sink_count);
return 0;
diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c b/drivers/gpu/drm/msm/dp/dp_panel.c
index e76dad0f6663..745ee6976897 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.c
+++ b/drivers/gpu/drm/msm/dp/dp_panel.c
@@ -723,6 +723,7 @@ struct msm_dp_panel *msm_dp_panel_get(struct device *dev, struct drm_dp_aux *aux
msm_dp_panel = &panel->msm_dp_panel;
msm_dp_panel->max_bw_code = DP_LINK_BW_8_1;
+ msm_dp_panel->stream_id = DP_STREAM_0;
return msm_dp_panel;
}
diff --git a/drivers/gpu/drm/msm/dp/dp_panel.h b/drivers/gpu/drm/msm/dp/dp_panel.h
index 4519ac374220..50a721401751 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.h
+++ b/drivers/gpu/drm/msm/dp/dp_panel.h
@@ -27,6 +27,15 @@ struct msm_dp_panel_psr {
u8 capabilities;
};
+/* stream id */
+enum msm_dp_stream_id {
+ DP_STREAM_0,
+ DP_STREAM_1,
+ DP_STREAM_2,
+ DP_STREAM_3,
+ DP_STREAM_MAX,
+};
+
struct msm_dp_panel {
/* dpcd raw data */
u8 dpcd[DP_RECEIVER_CAP_SIZE];
@@ -40,6 +49,8 @@ struct msm_dp_panel {
bool vsc_sdp_supported;
u32 hw_revision;
+ enum msm_dp_stream_id stream_id;
+
u32 max_bw_code;
};
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* [PATCH v6 05/29] drm/msm/dp: add support for programming p1/p2/p3 register blocks
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (3 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 04/29] drm/msm/dp: introduce stream_id for each DP panel Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:39 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 06/29] drm/msm/dp: add MST stream register definitions Yongxing Mou
` (23 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
Add support for additional pixel register blocks (p1, p2, p3) to enable
4‑stream MST pixel clocks. Introduce the helper functions msm_dp_read_pn
and msm_dp_write_pn for pixel register programming. All pixel clocks
share the same register layout but use different base addresses.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 10 +++++
drivers/gpu/drm/msm/dp/dp_ctrl.h | 2 +
drivers/gpu/drm/msm/dp/dp_display.c | 40 ++++++++++++-----
drivers/gpu/drm/msm/dp/dp_panel.c | 90 ++++++++++++++++++-------------------
drivers/gpu/drm/msm/dp/dp_panel.h | 2 +-
5 files changed, 87 insertions(+), 57 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 67f1da46b973..c0f5226dc383 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -2770,6 +2770,16 @@ static int msm_dp_ctrl_clk_init(struct msm_dp_ctrl *msm_dp_ctrl)
return 0;
}
+bool msm_dp_ctrl_stream_clks_on(struct msm_dp_ctrl *msm_dp_ctrl,
+ enum msm_dp_stream_id stream_id)
+{
+ struct msm_dp_ctrl_private *ctrl;
+
+ ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+ return ctrl->stream_clks_on[stream_id];
+}
+
struct msm_dp_ctrl *msm_dp_ctrl_get(struct device *dev, struct msm_dp_link *link,
struct drm_dp_aux *aux,
struct phy *phy,
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.h b/drivers/gpu/drm/msm/dp/dp_ctrl.h
index be0d89d60914..bf593f4a4480 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.h
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.h
@@ -55,4 +55,6 @@ void msm_dp_ctrl_enable_irq(struct msm_dp_ctrl *msm_dp_ctrl);
void msm_dp_ctrl_disable_irq(struct msm_dp_ctrl *msm_dp_ctrl);
void msm_dp_ctrl_reinit_phy(struct msm_dp_ctrl *msm_dp_ctrl);
+bool msm_dp_ctrl_stream_clks_on(struct msm_dp_ctrl *dp_ctrl,
+ enum msm_dp_stream_id stream_id);
#endif /* _DP_CTRL_H_ */
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index fb6607f65ded..3dce9334d0c2 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -85,8 +85,8 @@ struct msm_dp_display_private {
void __iomem *link_base;
size_t link_len;
- void __iomem *p0_base;
- size_t p0_len;
+ void __iomem *pixel_base[DP_STREAM_MAX];
+ size_t pixel_len;
};
struct msm_dp_desc {
@@ -562,7 +562,7 @@ static int msm_dp_init_sub_modules(struct msm_dp_display_private *dp)
goto error_link;
}
- dp->panel = msm_dp_panel_get(dev, dp->aux, dp->link, dp->link_base, dp->p0_base);
+ dp->panel = msm_dp_panel_get(dev, dp->aux, dp->link, dp->link_base, dp->pixel_base[0]);
if (IS_ERR(dp->panel)) {
rc = PTR_ERR(dp->panel);
DRM_ERROR("failed to initialize panel, rc = %d\n", rc);
@@ -843,8 +843,13 @@ void msm_dp_snapshot(struct msm_disp_state *disp_state, struct msm_dp *dp)
msm_dp_display->aux_base, "dp_aux");
msm_disp_snapshot_add_block(disp_state, msm_dp_display->link_len,
msm_dp_display->link_base, "dp_link");
- msm_disp_snapshot_add_block(disp_state, msm_dp_display->p0_len,
- msm_dp_display->p0_base, "dp_p0");
+
+ for (int i = 0; i < DP_STREAM_MAX; i++) {
+ if (!msm_dp_ctrl_stream_clks_on(msm_dp_display->ctrl, i))
+ continue;
+ msm_disp_snapshot_add_block(disp_state, msm_dp_display->pixel_len,
+ msm_dp_display->pixel_base[i], "dp_p%d", i);
+ }
}
void msm_dp_display_set_psr(struct msm_dp *msm_dp_display, bool enter)
@@ -1124,6 +1129,7 @@ static void __iomem *msm_dp_ioremap(struct platform_device *pdev, int idx, size_
static int msm_dp_display_get_io(struct msm_dp_display_private *display)
{
struct platform_device *pdev = display->msm_dp_display.pdev;
+ int i;
display->ahb_base = msm_dp_ioremap(pdev, 0, &display->ahb_len);
if (IS_ERR(display->ahb_base))
@@ -1153,8 +1159,8 @@ static int msm_dp_display_get_io(struct msm_dp_display_private *display)
display->aux_len = DP_DEFAULT_AUX_SIZE;
display->link_base = display->ahb_base + DP_DEFAULT_LINK_OFFSET;
display->link_len = DP_DEFAULT_LINK_SIZE;
- display->p0_base = display->ahb_base + DP_DEFAULT_P0_OFFSET;
- display->p0_len = DP_DEFAULT_P0_SIZE;
+ display->pixel_base[0] = display->ahb_base + DP_DEFAULT_P0_OFFSET;
+ display->pixel_len = DP_DEFAULT_P0_SIZE;
return 0;
}
@@ -1165,10 +1171,22 @@ static int msm_dp_display_get_io(struct msm_dp_display_private *display)
return PTR_ERR(display->link_base);
}
- display->p0_base = msm_dp_ioremap(pdev, 3, &display->p0_len);
- if (IS_ERR(display->p0_base)) {
- DRM_ERROR("unable to remap p0 region: %pe\n", display->p0_base);
- return PTR_ERR(display->p0_base);
+ display->pixel_base[0] = msm_dp_ioremap(pdev, 3, &display->pixel_len);
+ if (IS_ERR(display->pixel_base[0]))
+ return PTR_ERR(display->pixel_base[0]);
+
+ for (i = DP_STREAM_1; i < DP_STREAM_MAX; i++) {
+ display->pixel_base[i] = msm_dp_ioremap(pdev, i + 3, &display->pixel_len);
+ if (IS_ERR(display->pixel_base[i])) {
+ int ret = PTR_ERR(display->pixel_base[i]);
+
+ if (ret == -EINVAL) {
+ /* optional resource not present in DT */
+ display->pixel_base[i] = NULL;
+ break;
+ }
+ return ret;
+ }
}
return 0;
diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c b/drivers/gpu/drm/msm/dp/dp_panel.c
index 745ee6976897..7b5fc5bb16de 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.c
+++ b/drivers/gpu/drm/msm/dp/dp_panel.c
@@ -25,7 +25,7 @@ struct msm_dp_panel_private {
struct drm_dp_aux *aux;
struct msm_dp_link *link;
void __iomem *link_base;
- void __iomem *p0_base;
+ void __iomem *pixel_base;
bool panel_on;
};
@@ -44,24 +44,24 @@ static inline void msm_dp_write_link(struct msm_dp_panel_private *panel,
writel(data, panel->link_base + offset);
}
-static inline void msm_dp_write_p0(struct msm_dp_panel_private *panel,
- u32 offset, u32 data)
+static inline void msm_dp_write_pn(struct msm_dp_panel_private *panel,
+ u32 offset, u32 data)
{
/*
- * To make sure interface reg writes happens before any other operation,
- * this function uses writel() instread of writel_relaxed()
+ * Use writel() instead of writel_relaxed() to ensure the interface
+ * register write reaches the hardware before subsequent operations.
*/
- writel(data, panel->p0_base + offset);
+ writel(data, panel->pixel_base + offset);
}
-static inline u32 msm_dp_read_p0(struct msm_dp_panel_private *panel,
- u32 offset)
+static inline u32 msm_dp_read_pn(struct msm_dp_panel_private *panel,
+ u32 offset)
{
/*
- * To make sure interface reg writes happens before any other operation,
- * this function uses writel() instread of writel_relaxed()
+ * Only reads a configuration register: no DMA or memory ordering is
+ * required, so readl_relaxed() is sufficient.
*/
- return readl_relaxed(panel->p0_base + offset);
+ return readl_relaxed(panel->pixel_base + offset);
}
static void msm_dp_panel_read_psr_cap(struct msm_dp_panel_private *panel)
@@ -367,34 +367,34 @@ static void msm_dp_panel_tpg_enable(struct msm_dp_panel *msm_dp_panel,
display_hctl = (hsync_end_x << 16) | hsync_start_x;
- msm_dp_write_p0(panel, MMSS_DP_INTF_HSYNC_CTL, hsync_ctl);
- msm_dp_write_p0(panel, MMSS_DP_INTF_VSYNC_PERIOD_F0, vsync_period *
+ msm_dp_write_pn(panel, MMSS_DP_INTF_HSYNC_CTL, hsync_ctl);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_VSYNC_PERIOD_F0, vsync_period *
hsync_period);
- msm_dp_write_p0(panel, MMSS_DP_INTF_VSYNC_PULSE_WIDTH_F0, v_sync_width *
+ msm_dp_write_pn(panel, MMSS_DP_INTF_VSYNC_PULSE_WIDTH_F0, v_sync_width *
hsync_period);
- msm_dp_write_p0(panel, MMSS_DP_INTF_VSYNC_PERIOD_F1, 0);
- msm_dp_write_p0(panel, MMSS_DP_INTF_VSYNC_PULSE_WIDTH_F1, 0);
- msm_dp_write_p0(panel, MMSS_DP_INTF_DISPLAY_HCTL, display_hctl);
- msm_dp_write_p0(panel, MMSS_DP_INTF_ACTIVE_HCTL, 0);
- msm_dp_write_p0(panel, MMSS_INTF_DISPLAY_V_START_F0, display_v_start);
- msm_dp_write_p0(panel, MMSS_DP_INTF_DISPLAY_V_END_F0, display_v_end);
- msm_dp_write_p0(panel, MMSS_INTF_DISPLAY_V_START_F1, 0);
- msm_dp_write_p0(panel, MMSS_DP_INTF_DISPLAY_V_END_F1, 0);
- msm_dp_write_p0(panel, MMSS_DP_INTF_ACTIVE_V_START_F0, 0);
- msm_dp_write_p0(panel, MMSS_DP_INTF_ACTIVE_V_END_F0, 0);
- msm_dp_write_p0(panel, MMSS_DP_INTF_ACTIVE_V_START_F1, 0);
- msm_dp_write_p0(panel, MMSS_DP_INTF_ACTIVE_V_END_F1, 0);
- msm_dp_write_p0(panel, MMSS_DP_INTF_POLARITY_CTL, 0);
-
- msm_dp_write_p0(panel, MMSS_DP_TPG_MAIN_CONTROL,
- DP_TPG_CHECKERED_RECT_PATTERN);
- msm_dp_write_p0(panel, MMSS_DP_TPG_VIDEO_CONFIG,
- DP_TPG_VIDEO_CONFIG_BPP_8BIT |
- DP_TPG_VIDEO_CONFIG_RGB);
- msm_dp_write_p0(panel, MMSS_DP_BIST_ENABLE,
- DP_BIST_ENABLE_DPBIST_EN);
- msm_dp_write_p0(panel, MMSS_DP_TIMING_ENGINE_EN,
- DP_TIMING_ENGINE_EN_EN);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_VSYNC_PERIOD_F1, 0);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_VSYNC_PULSE_WIDTH_F1, 0);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_DISPLAY_HCTL, display_hctl);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_ACTIVE_HCTL, 0);
+ msm_dp_write_pn(panel, MMSS_INTF_DISPLAY_V_START_F0, display_v_start);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_DISPLAY_V_END_F0, display_v_end);
+ msm_dp_write_pn(panel, MMSS_INTF_DISPLAY_V_START_F1, 0);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_DISPLAY_V_END_F1, 0);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_ACTIVE_V_START_F0, 0);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_ACTIVE_V_END_F0, 0);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_ACTIVE_V_START_F1, 0);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_ACTIVE_V_END_F1, 0);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_POLARITY_CTL, 0);
+
+ msm_dp_write_pn(panel, MMSS_DP_TPG_MAIN_CONTROL,
+ DP_TPG_CHECKERED_RECT_PATTERN);
+ msm_dp_write_pn(panel, MMSS_DP_TPG_VIDEO_CONFIG,
+ DP_TPG_VIDEO_CONFIG_BPP_8BIT |
+ DP_TPG_VIDEO_CONFIG_RGB);
+ msm_dp_write_pn(panel, MMSS_DP_BIST_ENABLE,
+ DP_BIST_ENABLE_DPBIST_EN);
+ msm_dp_write_pn(panel, MMSS_DP_TIMING_ENGINE_EN,
+ DP_TIMING_ENGINE_EN_EN);
drm_dbg_dp(panel->drm_dev, "%s: enabled tpg\n", __func__);
}
@@ -403,9 +403,9 @@ static void msm_dp_panel_tpg_disable(struct msm_dp_panel *msm_dp_panel)
struct msm_dp_panel_private *panel =
container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
- msm_dp_write_p0(panel, MMSS_DP_TPG_MAIN_CONTROL, 0x0);
- msm_dp_write_p0(panel, MMSS_DP_BIST_ENABLE, 0x0);
- msm_dp_write_p0(panel, MMSS_DP_TIMING_ENGINE_EN, 0x0);
+ msm_dp_write_pn(panel, MMSS_DP_TPG_MAIN_CONTROL, 0x0);
+ msm_dp_write_pn(panel, MMSS_DP_BIST_ENABLE, 0x0);
+ msm_dp_write_pn(panel, MMSS_DP_TIMING_ENGINE_EN, 0x0);
}
void msm_dp_panel_tpg_config(struct msm_dp_panel *msm_dp_panel, bool enable)
@@ -439,7 +439,7 @@ void msm_dp_panel_clear_dsc_dto(struct msm_dp_panel *msm_dp_panel)
struct msm_dp_panel_private *panel =
container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
- msm_dp_write_p0(panel, MMSS_DP_DSC_DTO, 0x0);
+ msm_dp_write_pn(panel, MMSS_DP_DSC_DTO, 0x0);
}
static void msm_dp_panel_send_vsc_sdp(struct msm_dp_panel_private *panel, struct dp_sdp *vsc_sdp)
@@ -629,7 +629,7 @@ int msm_dp_panel_timing_cfg(struct msm_dp_panel *msm_dp_panel, bool wide_bus_en)
msm_dp_write_link(panel, REG_DP_HSYNC_VSYNC_WIDTH_POLARITY, width_blanking);
msm_dp_write_link(panel, REG_DP_ACTIVE_HOR_VER, msm_dp_active);
- reg = msm_dp_read_p0(panel, MMSS_DP_INTF_CONFIG);
+ reg = msm_dp_read_pn(panel, MMSS_DP_INTF_CONFIG);
if (wide_bus_en)
reg |= DP_INTF_CONFIG_DATABUS_WIDEN;
else
@@ -637,7 +637,7 @@ int msm_dp_panel_timing_cfg(struct msm_dp_panel *msm_dp_panel, bool wide_bus_en)
drm_dbg_dp(panel->drm_dev, "wide_bus_en=%d reg=%#x\n", wide_bus_en, reg);
- msm_dp_write_p0(panel, MMSS_DP_INTF_CONFIG, reg);
+ msm_dp_write_pn(panel, MMSS_DP_INTF_CONFIG, reg);
if (msm_dp_panel->msm_dp_mode.out_fmt_is_yuv_420)
msm_dp_panel_setup_vsc_sdp_yuv_420(msm_dp_panel);
@@ -701,7 +701,7 @@ int msm_dp_panel_init_panel_info(struct msm_dp_panel *msm_dp_panel,
struct msm_dp_panel *msm_dp_panel_get(struct device *dev, struct drm_dp_aux *aux,
struct msm_dp_link *link,
void __iomem *link_base,
- void __iomem *p0_base)
+ void __iomem *pixel_base)
{
struct msm_dp_panel_private *panel;
struct msm_dp_panel *msm_dp_panel;
@@ -719,7 +719,7 @@ struct msm_dp_panel *msm_dp_panel_get(struct device *dev, struct drm_dp_aux *aux
panel->aux = aux;
panel->link = link;
panel->link_base = link_base;
- panel->p0_base = p0_base;
+ panel->pixel_base = pixel_base;
msm_dp_panel = &panel->msm_dp_panel;
msm_dp_panel->max_bw_code = DP_LINK_BW_8_1;
diff --git a/drivers/gpu/drm/msm/dp/dp_panel.h b/drivers/gpu/drm/msm/dp/dp_panel.h
index 50a721401751..218a09a2fa65 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.h
+++ b/drivers/gpu/drm/msm/dp/dp_panel.h
@@ -102,5 +102,5 @@ static inline bool is_lane_count_valid(u32 lane_count)
struct msm_dp_panel *msm_dp_panel_get(struct device *dev, struct drm_dp_aux *aux,
struct msm_dp_link *link,
void __iomem *link_base,
- void __iomem *p0_base);
+ void __iomem *pixel_base);
#endif /* _DP_PANEL_H_ */
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 05/29] drm/msm/dp: add support for programming p1/p2/p3 register blocks
2026-08-31 8:17 ` [PATCH v6 05/29] drm/msm/dp: add support for programming p1/p2/p3 register blocks Yongxing Mou
@ 2026-08-31 8:39 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 8:39 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] NULL pointer dereference when an optional pixel register block is missing from the device tree.
--
commit 8cc66577964ef75238881b3b8e6ae294ad3ae4f2
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
drm/msm/dp: add support for programming p1/p2/p3 register blocks
Add support for additional pixel register blocks (p1, p2, p3) to enable
4-stream MST pixel clocks. Introduce the helper functions msm_dp_read_pn
and msm_dp_write_pn for pixel register programming.
> diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
> index fb6607f65dedc..3dce9334d0c25 100644
> --- a/drivers/gpu/drm/msm/dp/dp_display.c
> +++ b/drivers/gpu/drm/msm/dp/dp_display.c
[ ... ]
> @@ -843,8 +843,13 @@ void msm_dp_snapshot(struct msm_disp_state *disp_state, struct msm_dp *dp)
> msm_dp_display->aux_base, "dp_aux");
> msm_disp_snapshot_add_block(disp_state, msm_dp_display->link_len,
> msm_dp_display->link_base, "dp_link");
> - msm_disp_snapshot_add_block(disp_state, msm_dp_display->p0_len,
> - msm_dp_display->p0_base, "dp_p0");
> +
> + for (int i = 0; i < DP_STREAM_MAX; i++) {
> + if (!msm_dp_ctrl_stream_clks_on(msm_dp_display->ctrl, i))
> + continue;
> + msm_disp_snapshot_add_block(disp_state, msm_dp_display->pixel_len,
> + msm_dp_display->pixel_base[i], "dp_p%d", i);
[Severity: High]
Can this dereference a NULL pointer? If a device tree defines an MST stream's
pixel clock but omits its memory region (e.g., p1), msm_dp_display_get_io()
catches the -EINVAL and explicitly sets msm_dp_display->pixel_base[i] = NULL.
However, the driver later successfully discovers the clock in msm_dp_ctrl_get(),
meaning msm_dp_ctrl_stream_clks_on() will return true for the stream.
When this happens, this block passes the NULL pixel_base[i] to
msm_disp_snapshot_add_block(), which unconditionally dereferences it during
readl_relaxed().
> + }
> }
>
> void msm_dp_display_set_psr(struct msm_dp *msm_dp_display, bool enter)
[ ... ]
> @@ -1165,10 +1171,22 @@ static int msm_dp_display_get_io(struct msm_dp_display_private *display)
> return PTR_ERR(display->link_base);
> }
>
> - display->p0_base = msm_dp_ioremap(pdev, 3, &display->p0_len);
> - if (IS_ERR(display->p0_base)) {
> - DRM_ERROR("unable to remap p0 region: %pe\n", display->p0_base);
> - return PTR_ERR(display->p0_base);
> + display->pixel_base[0] = msm_dp_ioremap(pdev, 3, &display->pixel_len);
> + if (IS_ERR(display->pixel_base[0]))
> + return PTR_ERR(display->pixel_base[0]);
> +
> + for (i = DP_STREAM_1; i < DP_STREAM_MAX; i++) {
> + display->pixel_base[i] = msm_dp_ioremap(pdev, i + 3, &display->pixel_len);
> + if (IS_ERR(display->pixel_base[i])) {
> + int ret = PTR_ERR(display->pixel_base[i]);
> +
> + if (ret == -EINVAL) {
> + /* optional resource not present in DT */
> + display->pixel_base[i] = NULL;
> + break;
> + }
> + return ret;
> + }
> }
>
> return 0;
[ ... ]
> diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c b/drivers/gpu/drm/msm/dp/dp_panel.c
> index 745ee69768979..7b5fc5bb16def 100644
> --- a/drivers/gpu/drm/msm/dp/dp_panel.c
> +++ b/drivers/gpu/drm/msm/dp/dp_panel.c
[ ... ]
> -static inline void msm_dp_write_p0(struct msm_dp_panel_private *panel,
> - u32 offset, u32 data)
> +static inline void msm_dp_write_pn(struct msm_dp_panel_private *panel,
> + u32 offset, u32 data)
> {
> /*
> - * To make sure interface reg writes happens before any other operation,
> - * this function uses writel() instread of writel_relaxed()
> + * Use writel() instead of writel_relaxed() to ensure the interface
> + * register write reaches the hardware before subsequent operations.
> */
> - writel(data, panel->p0_base + offset);
> + writel(data, panel->pixel_base + offset);
[Severity: High]
Does this code also cause a NULL pointer dereference? As noted above, if an
optional pixel register block is missing from the device tree, pixel_base can
be NULL, which would cause this unconditional writel() to crash upon stream
enablement.
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=5
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 06/29] drm/msm/dp: add MST stream register definitions
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (4 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 05/29] drm/msm/dp: add support for programming p1/p2/p3 register blocks Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 07/29] drm/msm/dp: add stream-aware link register accessors Yongxing Mou
` (22 subsequent siblings)
28 siblings, 0 replies; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou
Add the stream-1 (DP1) and MST-link register definitions together with
msm_dp_stream_reg(), a helper that translates stream-0 register offsets
into their stream-specific equivalents.
Keeping the register definitions and translation helper together ensures
that all supported mappings are defined in one place.
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_panel.c | 65 +++++++++++++++++++++++++++++++++++++++
drivers/gpu/drm/msm/dp/dp_panel.h | 2 ++
drivers/gpu/drm/msm/dp/dp_reg.h | 56 +++++++++++++++++++++++++++++++++
3 files changed, 123 insertions(+)
diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c b/drivers/gpu/drm/msm/dp/dp_panel.c
index 7b5fc5bb16de..504d7542d30a 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.c
+++ b/drivers/gpu/drm/msm/dp/dp_panel.c
@@ -29,6 +29,71 @@ struct msm_dp_panel_private {
bool panel_on;
};
+u32 msm_dp_stream_reg(enum msm_dp_stream_id id, u32 reg)
+{
+ bool is_s1 = (id == DP_STREAM_1);
+
+ if (id == DP_STREAM_0)
+ return reg;
+
+ switch (reg) {
+ case REG_DP_STATE_CTRL:
+ return is_s1 ? REG_DP_STATE_CTRL : REG_DP_MSTLINK_STATE_CTRL;
+ case REG_DP_CONFIGURATION_CTRL:
+ return is_s1 ? REG_DP1_CONFIGURATION_CTRL : REG_DP_MSTLINK_CONFIGURATION_CTRL;
+ case REG_DP_SOFTWARE_MVID:
+ return is_s1 ? REG_DP1_SOFTWARE_MVID : REG_DP_MSTLINK_SOFTWARE_MVID;
+ case REG_DP_SOFTWARE_NVID:
+ return is_s1 ? REG_DP1_SOFTWARE_NVID : REG_DP_MSTLINK_SOFTWARE_NVID;
+ case REG_DP_TOTAL_HOR_VER:
+ return is_s1 ? REG_DP1_TOTAL_HOR_VER : REG_DP_MSTLINK_TOTAL_HOR_VER;
+ case REG_DP_START_HOR_VER_FROM_SYNC:
+ return is_s1 ? REG_DP1_START_HOR_VER_FROM_SYNC
+ : REG_DP_MSTLINK_START_HOR_VER_FROM_SYNC;
+ case REG_DP_HSYNC_VSYNC_WIDTH_POLARITY:
+ return is_s1 ? REG_DP1_HSYNC_VSYNC_WIDTH_POLARITY
+ : REG_DP_MSTLINK_HSYNC_VSYNC_WIDTH_POLARITY;
+ case REG_DP_ACTIVE_HOR_VER:
+ return is_s1 ? REG_DP1_ACTIVE_HOR_VER : REG_DP_MSTLINK_ACTIVE_HOR_VER;
+ case REG_DP_MISC1_MISC0:
+ return is_s1 ? REG_DP1_MISC1_MISC0 : REG_DP_MSTLINK_MISC1_MISC0;
+ case REG_DP_DP0_TIMESLOT_1_32:
+ return is_s1 ? REG_DP_DP1_TIMESLOT_1_32 : REG_DP_MSTLINK_TIMESLOT_1_32;
+ case REG_DP_DP0_TIMESLOT_33_63:
+ return is_s1 ? REG_DP_DP1_TIMESLOT_33_63 : REG_DP_MSTLINK_TIMESLOT_33_63;
+ case REG_DP_DP0_RG:
+ return is_s1 ? REG_DP_DP1_RG : REG_DP_MSTLINK_DP_RG;
+ case MMSS_DP_SDP_CFG:
+ return is_s1 ? MMSS_DP1_SDP_CFG : MMSS_DP_MSTLINK_SDP_CFG;
+ case MMSS_DP_SDP_CFG2:
+ return is_s1 ? MMSS_DP1_SDP_CFG2 : MMSS_DP_MSTLINK_SDP_CFG2;
+ case MMSS_DP_SDP_CFG3:
+ return is_s1 ? MMSS_DP1_SDP_CFG3 : MMSS_DP_MSTLINK_SDP_CFG3;
+ case MMSS_DP_GENERIC0_0:
+ return is_s1 ? MMSS_DP1_GENERIC0_0 : MMSS_DP_MSTLINK_GENERIC0_0;
+ case MMSS_DP_GENERIC0_1:
+ return is_s1 ? MMSS_DP1_GENERIC0_1 : MMSS_DP_MSTLINK_GENERIC0_1;
+ case MMSS_DP_GENERIC0_2:
+ return is_s1 ? MMSS_DP1_GENERIC0_2 : MMSS_DP_MSTLINK_GENERIC0_2;
+ case MMSS_DP_GENERIC0_3:
+ return is_s1 ? MMSS_DP1_GENERIC0_3 : MMSS_DP_MSTLINK_GENERIC0_3;
+ case MMSS_DP_GENERIC0_4:
+ return is_s1 ? MMSS_DP1_GENERIC0_4 : MMSS_DP_MSTLINK_GENERIC0_4;
+ case MMSS_DP_GENERIC0_5:
+ return is_s1 ? MMSS_DP1_GENERIC0_5 : MMSS_DP_MSTLINK_GENERIC0_5;
+ case MMSS_DP_GENERIC0_6:
+ return is_s1 ? MMSS_DP1_GENERIC0_6 : MMSS_DP_MSTLINK_GENERIC0_6;
+ case MMSS_DP_GENERIC0_7:
+ return is_s1 ? MMSS_DP1_GENERIC0_7 : MMSS_DP_MSTLINK_GENERIC0_7;
+ case MMSS_DP_GENERIC0_8:
+ return is_s1 ? MMSS_DP1_GENERIC0_8 : MMSS_DP_MSTLINK_GENERIC0_8;
+ case MMSS_DP_GENERIC0_9:
+ return is_s1 ? MMSS_DP1_GENERIC0_9 : MMSS_DP_MSTLINK_GENERIC0_9;
+ default:
+ return reg;
+ }
+}
+
static inline u32 msm_dp_read_link(struct msm_dp_panel_private *panel, u32 offset)
{
return readl_relaxed(panel->link_base + offset);
diff --git a/drivers/gpu/drm/msm/dp/dp_panel.h b/drivers/gpu/drm/msm/dp/dp_panel.h
index 218a09a2fa65..75b23c106a99 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.h
+++ b/drivers/gpu/drm/msm/dp/dp_panel.h
@@ -99,6 +99,8 @@ static inline bool is_lane_count_valid(u32 lane_count)
lane_count == 4);
}
+u32 msm_dp_stream_reg(enum msm_dp_stream_id id, u32 reg);
+
struct msm_dp_panel *msm_dp_panel_get(struct device *dev, struct drm_dp_aux *aux,
struct msm_dp_link *link,
void __iomem *link_base,
diff --git a/drivers/gpu/drm/msm/dp/dp_reg.h b/drivers/gpu/drm/msm/dp/dp_reg.h
index dda4b642c81b..265da58e064c 100644
--- a/drivers/gpu/drm/msm/dp/dp_reg.h
+++ b/drivers/gpu/drm/msm/dp/dp_reg.h
@@ -302,6 +302,35 @@
#define MMSS_DP_VSCEXT_8 (0x000002F0)
#define MMSS_DP_VSCEXT_9 (0x000002F4)
+/* Stream 1 (DP1) registers, relative to link_base. */
+#define REG_DP1_CONFIGURATION_CTRL (0x00000400)
+#define REG_DP_DP0_TIMESLOT_1_32 (0x00000404)
+#define REG_DP_DP0_TIMESLOT_33_63 (0x00000408)
+#define REG_DP_DP1_TIMESLOT_1_32 (0x0000040C)
+#define REG_DP_DP1_TIMESLOT_33_63 (0x00000410)
+#define REG_DP1_SOFTWARE_MVID (0x00000414)
+#define REG_DP1_SOFTWARE_NVID (0x00000418)
+#define REG_DP1_TOTAL_HOR_VER (0x0000041c)
+#define REG_DP1_START_HOR_VER_FROM_SYNC (0x00000420)
+#define REG_DP1_HSYNC_VSYNC_WIDTH_POLARITY (0x00000424)
+#define REG_DP1_ACTIVE_HOR_VER (0x00000428)
+#define REG_DP1_MISC1_MISC0 (0x0000042c)
+#define MMSS_DP1_GENERIC0_0 (0x00000490)
+#define MMSS_DP1_GENERIC0_1 (0x00000494)
+#define MMSS_DP1_GENERIC0_2 (0x00000498)
+#define MMSS_DP1_GENERIC0_3 (0x0000049c)
+#define MMSS_DP1_GENERIC0_4 (0x000004a0)
+#define MMSS_DP1_GENERIC0_5 (0x000004a4)
+#define MMSS_DP1_GENERIC0_6 (0x000004a8)
+#define MMSS_DP1_GENERIC0_7 (0x000004ac)
+#define MMSS_DP1_GENERIC0_8 (0x000004b0)
+#define MMSS_DP1_GENERIC0_9 (0x000004b4)
+#define MMSS_DP1_SDP_CFG (0x000004e0)
+#define MMSS_DP1_SDP_CFG2 (0x000004e4)
+#define MMSS_DP1_SDP_CFG3 (0x000004e8)
+#define REG_DP_DP0_RG (0x000004f8)
+#define REG_DP_DP1_RG (0x000004fc)
+
#define MMSS_DP_BIST_ENABLE (0x00000000)
#define DP_BIST_ENABLE_DPBIST_EN (0x00000001)
@@ -334,6 +363,33 @@
#define DP_TPG_VIDEO_CONFIG_BPP_8BIT (0x00000001)
#define DP_TPG_VIDEO_CONFIG_RGB (0x00000004)
+/* Streams 2/3 registers, relative to mst2link_base / mst3link_base. */
+#define REG_DP_MSTLINK_STATE_CTRL (0x00000000)
+#define REG_DP_MSTLINK_CONFIGURATION_CTRL (0x00000034)
+#define REG_DP_MSTLINK_TIMESLOT_1_32 (0x00000038)
+#define REG_DP_MSTLINK_TIMESLOT_33_63 (0x0000003c)
+#define REG_DP_MSTLINK_SOFTWARE_MVID (0x00000040)
+#define REG_DP_MSTLINK_SOFTWARE_NVID (0x00000044)
+#define REG_DP_MSTLINK_TOTAL_HOR_VER (0x00000048)
+#define REG_DP_MSTLINK_START_HOR_VER_FROM_SYNC (0x0000004c)
+#define REG_DP_MSTLINK_HSYNC_VSYNC_WIDTH_POLARITY (0x00000050)
+#define REG_DP_MSTLINK_ACTIVE_HOR_VER (0x00000054)
+#define REG_DP_MSTLINK_MISC1_MISC0 (0x00000058)
+#define MMSS_DP_MSTLINK_GENERIC0_0 (0x000000bc)
+#define MMSS_DP_MSTLINK_GENERIC0_1 (0x000000c0)
+#define MMSS_DP_MSTLINK_GENERIC0_2 (0x000000c4)
+#define MMSS_DP_MSTLINK_GENERIC0_3 (0x000000c8)
+#define MMSS_DP_MSTLINK_GENERIC0_4 (0x000000cc)
+#define MMSS_DP_MSTLINK_GENERIC0_5 (0x000000d0)
+#define MMSS_DP_MSTLINK_GENERIC0_6 (0x000000d4)
+#define MMSS_DP_MSTLINK_GENERIC0_7 (0x000000d8)
+#define MMSS_DP_MSTLINK_GENERIC0_8 (0x000000dc)
+#define MMSS_DP_MSTLINK_GENERIC0_9 (0x000000e0)
+#define MMSS_DP_MSTLINK_SDP_CFG (0x0000010c)
+#define MMSS_DP_MSTLINK_SDP_CFG2 (0x00000110)
+#define MMSS_DP_MSTLINK_SDP_CFG3 (0x00000114)
+#define REG_DP_MSTLINK_DP_RG (0x0000011C)
+
#define MMSS_DP_ASYNC_FIFO_CONFIG (0x00000088)
#define REG_DP_PHY_AUX_INTERRUPT_CLEAR (0x0000004C)
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* [PATCH v6 07/29] drm/msm/dp: add stream-aware link register accessors
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (5 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 06/29] drm/msm/dp: add MST stream register definitions Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 08/29] drm/msm/dp: add support to send ACT packets for MST Yongxing Mou
` (21 subsequent siblings)
28 siblings, 0 replies; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
DisplayPort MST uses multiple stream-specific register spaces. Streams
0 and 1 share the primary link register block with different register
offsets, while streams 2 and 3 use dedicated MST link register blocks.
Add stream-aware register access helpers that translate stream-specific
register offsets and route accesses to the appropriate register space
based on the stream id.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 64 +++++++++++++++++++++++++++++++++----
drivers/gpu/drm/msm/dp/dp_ctrl.h | 4 ++-
drivers/gpu/drm/msm/dp/dp_display.c | 38 ++++++++++++++++++++--
drivers/gpu/drm/msm/dp/dp_panel.c | 37 +++++++++++++++++++--
drivers/gpu/drm/msm/dp/dp_panel.h | 2 ++
5 files changed, 133 insertions(+), 12 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index c0f5226dc383..e1614bc49a7c 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -117,6 +117,8 @@ struct msm_dp_ctrl_private {
struct msm_dp_link *link;
void __iomem *ahb_base;
void __iomem *link_base;
+ void __iomem *mst2link_base;
+ void __iomem *mst3link_base;
struct phy *phy;
@@ -172,6 +174,49 @@ static inline void msm_dp_write_link(struct msm_dp_ctrl_private *ctrl,
writel(data, ctrl->link_base + offset);
}
+static inline u32 msm_dp_read_stream_link(struct msm_dp_ctrl_private *ctrl,
+ enum msm_dp_stream_id stream_id, u32 offset)
+{
+ offset = msm_dp_stream_reg(stream_id, offset);
+ switch (stream_id) {
+ case DP_STREAM_0:
+ case DP_STREAM_1:
+ return readl_relaxed(ctrl->link_base + offset);
+ case DP_STREAM_2:
+ return readl_relaxed(ctrl->mst2link_base + offset);
+ case DP_STREAM_3:
+ return readl_relaxed(ctrl->mst3link_base + offset);
+ default:
+ DRM_ERROR("error stream_id\n");
+ return 0;
+ }
+}
+
+static inline void msm_dp_write_stream_link(struct msm_dp_ctrl_private *ctrl,
+ enum msm_dp_stream_id stream_id, u32 offset, u32 data)
+{
+ /*
+ * To make sure link reg writes happens before any other operation,
+ * this function uses writel() instread of writel_relaxed()
+ */
+ offset = msm_dp_stream_reg(stream_id, offset);
+ switch (stream_id) {
+ case DP_STREAM_0:
+ case DP_STREAM_1:
+ writel(data, ctrl->link_base + offset);
+ break;
+ case DP_STREAM_2:
+ writel(data, ctrl->mst2link_base + offset);
+ break;
+ case DP_STREAM_3:
+ writel(data, ctrl->mst3link_base + offset);
+ break;
+ default:
+ DRM_ERROR("error stream_id\n");
+ break;
+ }
+}
+
static int msm_dp_aux_link_configure(struct drm_dp_aux *aux,
struct msm_dp_link_info *link)
{
@@ -397,7 +442,8 @@ static void msm_dp_ctrl_config_ctrl_streams(struct msm_dp_ctrl_private *ctrl,
* RMW: called from atomic_enable(), serialized by the DRM atomic framework.
* Clear stream-specific fields before OR-ing to avoid bit accumulation.
*/
- config = msm_dp_read_link(ctrl, REG_DP_CONFIGURATION_CTRL);
+ config = msm_dp_read_stream_link(ctrl, msm_dp_panel->stream_id,
+ REG_DP_CONFIGURATION_CTRL);
config &= ~(DP_CONFIGURATION_CTRL_RGB_YUV_MASK |
DP_CONFIGURATION_CTRL_BPC_MASK |
DP_CONFIGURATION_CTRL_SEND_VSC);
@@ -415,7 +461,7 @@ static void msm_dp_ctrl_config_ctrl_streams(struct msm_dp_ctrl_private *ctrl,
drm_dbg_dp(ctrl->drm_dev, "stream DP_CONFIGURATION_CTRL=0x%x\n", config);
- msm_dp_write_link(ctrl, REG_DP_CONFIGURATION_CTRL, config);
+ msm_dp_write_stream_link(ctrl, msm_dp_panel->stream_id, REG_DP_CONFIGURATION_CTRL, config);
}
static void msm_dp_ctrl_config_ctrl_link(struct msm_dp_ctrl_private *ctrl,
@@ -472,7 +518,7 @@ static void msm_dp_ctrl_config_misc1_misc0(struct msm_dp_ctrl_private *ctrl,
msm_dp_panel->msm_dp_mode.bpp);
colorimetry_cfg = msm_dp_link_get_colorimetry_config(ctrl->link);
- misc_val = msm_dp_read_link(ctrl, REG_DP_MISC1_MISC0);
+ misc_val = msm_dp_read_stream_link(ctrl, msm_dp_panel->stream_id, REG_DP_MISC1_MISC0);
/* clear bpp bits */
misc_val &= ~(0x07 << DP_MISC0_TEST_BITS_DEPTH_SHIFT);
@@ -482,7 +528,7 @@ static void msm_dp_ctrl_config_misc1_misc0(struct msm_dp_ctrl_private *ctrl,
misc_val |= DP_MISC0_SYNCHRONOUS_CLK;
drm_dbg_dp(ctrl->drm_dev, "misc settings = 0x%x\n", misc_val);
- msm_dp_write_link(ctrl, REG_DP_MISC1_MISC0, misc_val);
+ msm_dp_write_stream_link(ctrl, msm_dp_panel->stream_id, REG_DP_MISC1_MISC0, misc_val);
}
static void msm_dp_ctrl_configure_source_params(struct msm_dp_ctrl_private *ctrl,
@@ -2528,8 +2574,8 @@ static void msm_dp_ctrl_config_msa(struct msm_dp_ctrl_private *ctrl,
nvid *= 3;
drm_dbg_dp(ctrl->drm_dev, "mvid=0x%x, nvid=0x%x\n", mvid, nvid);
- msm_dp_write_link(ctrl, REG_DP_SOFTWARE_MVID, mvid);
- msm_dp_write_link(ctrl, REG_DP_SOFTWARE_NVID, nvid);
+ msm_dp_write_stream_link(ctrl, panel->stream_id, REG_DP_SOFTWARE_MVID, mvid);
+ msm_dp_write_stream_link(ctrl, panel->stream_id, REG_DP_SOFTWARE_NVID, nvid);
}
int msm_dp_ctrl_prepare_stream_on(struct msm_dp_ctrl *msm_dp_ctrl,
@@ -2784,7 +2830,9 @@ struct msm_dp_ctrl *msm_dp_ctrl_get(struct device *dev, struct msm_dp_link *link
struct drm_dp_aux *aux,
struct phy *phy,
void __iomem *ahb_base,
- void __iomem *link_base)
+ void __iomem *link_base,
+ void __iomem *mst2link_base,
+ void __iomem *mst3link_base)
{
struct msm_dp_ctrl_private *ctrl;
int ret;
@@ -2823,6 +2871,8 @@ struct msm_dp_ctrl *msm_dp_ctrl_get(struct device *dev, struct msm_dp_link *link
ctrl->phy = phy;
ctrl->ahb_base = ahb_base;
ctrl->link_base = link_base;
+ ctrl->mst2link_base = mst2link_base;
+ ctrl->mst3link_base = mst3link_base;
ret = msm_dp_ctrl_clk_init(&ctrl->msm_dp_ctrl);
if (ret) {
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.h b/drivers/gpu/drm/msm/dp/dp_ctrl.h
index bf593f4a4480..80d9258501b4 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.h
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.h
@@ -35,7 +35,9 @@ struct msm_dp_ctrl *msm_dp_ctrl_get(struct device *dev,
struct drm_dp_aux *aux,
struct phy *phy,
void __iomem *ahb_base,
- void __iomem *link_base);
+ void __iomem *link_base,
+ void __iomem *mst2link_base,
+ void __iomem *mst3link_base);
void msm_dp_ctrl_reset(struct msm_dp_ctrl *msm_dp_ctrl,
struct msm_dp_panel *panel);
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 3dce9334d0c2..d0fc4ff508dc 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -85,6 +85,12 @@ struct msm_dp_display_private {
void __iomem *link_base;
size_t link_len;
+ void __iomem *mst2link_base;
+ size_t mst2link_len;
+
+ void __iomem *mst3link_base;
+ size_t mst3link_len;
+
void __iomem *pixel_base[DP_STREAM_MAX];
size_t pixel_len;
};
@@ -562,7 +568,8 @@ static int msm_dp_init_sub_modules(struct msm_dp_display_private *dp)
goto error_link;
}
- dp->panel = msm_dp_panel_get(dev, dp->aux, dp->link, dp->link_base, dp->pixel_base[0]);
+ dp->panel = msm_dp_panel_get(dev, dp->aux, dp->link, dp->link_base,
+ dp->mst2link_base, dp->mst3link_base, dp->pixel_base[0]);
if (IS_ERR(dp->panel)) {
rc = PTR_ERR(dp->panel);
DRM_ERROR("failed to initialize panel, rc = %d\n", rc);
@@ -571,7 +578,8 @@ static int msm_dp_init_sub_modules(struct msm_dp_display_private *dp)
}
dp->ctrl = msm_dp_ctrl_get(dev, dp->link, dp->aux,
- phy, dp->ahb_base, dp->link_base);
+ phy, dp->ahb_base, dp->link_base,
+ dp->mst2link_base, dp->mst3link_base);
if (IS_ERR(dp->ctrl)) {
rc = PTR_ERR(dp->ctrl);
DRM_ERROR("failed to initialize ctrl, rc = %d\n", rc);
@@ -843,6 +851,12 @@ void msm_dp_snapshot(struct msm_disp_state *disp_state, struct msm_dp *dp)
msm_dp_display->aux_base, "dp_aux");
msm_disp_snapshot_add_block(disp_state, msm_dp_display->link_len,
msm_dp_display->link_base, "dp_link");
+ if (msm_dp_display->mst2link_base)
+ msm_disp_snapshot_add_block(disp_state, msm_dp_display->mst2link_len,
+ msm_dp_display->mst2link_base, "dp_mst2link");
+ if (msm_dp_display->mst3link_base)
+ msm_disp_snapshot_add_block(disp_state, msm_dp_display->mst3link_len,
+ msm_dp_display->mst3link_base, "dp_mst3link");
for (int i = 0; i < DP_STREAM_MAX; i++) {
if (!msm_dp_ctrl_stream_clks_on(msm_dp_display->ctrl, i))
@@ -1189,6 +1203,26 @@ static int msm_dp_display_get_io(struct msm_dp_display_private *display)
}
}
+ display->mst2link_base = msm_dp_ioremap(pdev, 7, &display->mst2link_len);
+ if (IS_ERR(display->mst2link_base)) {
+ int ret = PTR_ERR(display->mst2link_base);
+
+ if (ret != -EINVAL)
+ return ret;
+ /* optional resource not present in DT */
+ display->mst2link_base = NULL;
+ }
+
+ display->mst3link_base = msm_dp_ioremap(pdev, 8, &display->mst3link_len);
+ if (IS_ERR(display->mst3link_base)) {
+ int ret = PTR_ERR(display->mst3link_base);
+
+ if (ret != -EINVAL)
+ return ret;
+ /* optional resource not present in DT */
+ display->mst3link_base = NULL;
+ }
+
return 0;
}
diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c b/drivers/gpu/drm/msm/dp/dp_panel.c
index 504d7542d30a..d3468b73fdc3 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.c
+++ b/drivers/gpu/drm/msm/dp/dp_panel.c
@@ -25,6 +25,8 @@ struct msm_dp_panel_private {
struct drm_dp_aux *aux;
struct msm_dp_link *link;
void __iomem *link_base;
+ void __iomem *mst2link_base;
+ void __iomem *mst3link_base;
void __iomem *pixel_base;
bool panel_on;
};
@@ -96,7 +98,19 @@ u32 msm_dp_stream_reg(enum msm_dp_stream_id id, u32 reg)
static inline u32 msm_dp_read_link(struct msm_dp_panel_private *panel, u32 offset)
{
- return readl_relaxed(panel->link_base + offset);
+ offset = msm_dp_stream_reg(panel->msm_dp_panel.stream_id, offset);
+ switch (panel->msm_dp_panel.stream_id) {
+ case DP_STREAM_0:
+ case DP_STREAM_1:
+ return readl_relaxed(panel->link_base + offset);
+ case DP_STREAM_2:
+ return readl_relaxed(panel->mst2link_base + offset);
+ case DP_STREAM_3:
+ return readl_relaxed(panel->mst3link_base + offset);
+ default:
+ DRM_ERROR("error stream_id\n");
+ return 0;
+ }
}
static inline void msm_dp_write_link(struct msm_dp_panel_private *panel,
@@ -106,7 +120,22 @@ static inline void msm_dp_write_link(struct msm_dp_panel_private *panel,
* To make sure link reg writes happens before any other operation,
* this function uses writel() instread of writel_relaxed()
*/
- writel(data, panel->link_base + offset);
+ offset = msm_dp_stream_reg(panel->msm_dp_panel.stream_id, offset);
+ switch (panel->msm_dp_panel.stream_id) {
+ case DP_STREAM_0:
+ case DP_STREAM_1:
+ writel(data, panel->link_base + offset);
+ break;
+ case DP_STREAM_2:
+ writel(data, panel->mst2link_base + offset);
+ break;
+ case DP_STREAM_3:
+ writel(data, panel->mst3link_base + offset);
+ break;
+ default:
+ DRM_ERROR("error stream_id\n");
+ break;
+ }
}
static inline void msm_dp_write_pn(struct msm_dp_panel_private *panel,
@@ -766,6 +795,8 @@ int msm_dp_panel_init_panel_info(struct msm_dp_panel *msm_dp_panel,
struct msm_dp_panel *msm_dp_panel_get(struct device *dev, struct drm_dp_aux *aux,
struct msm_dp_link *link,
void __iomem *link_base,
+ void __iomem *mst2link_base,
+ void __iomem *mst3link_base,
void __iomem *pixel_base)
{
struct msm_dp_panel_private *panel;
@@ -785,6 +816,8 @@ struct msm_dp_panel *msm_dp_panel_get(struct device *dev, struct drm_dp_aux *aux
panel->link = link;
panel->link_base = link_base;
panel->pixel_base = pixel_base;
+ panel->mst2link_base = mst2link_base;
+ panel->mst3link_base = mst3link_base;
msm_dp_panel = &panel->msm_dp_panel;
msm_dp_panel->max_bw_code = DP_LINK_BW_8_1;
diff --git a/drivers/gpu/drm/msm/dp/dp_panel.h b/drivers/gpu/drm/msm/dp/dp_panel.h
index 75b23c106a99..dc046fec24fc 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.h
+++ b/drivers/gpu/drm/msm/dp/dp_panel.h
@@ -104,5 +104,7 @@ u32 msm_dp_stream_reg(enum msm_dp_stream_id id, u32 reg);
struct msm_dp_panel *msm_dp_panel_get(struct device *dev, struct drm_dp_aux *aux,
struct msm_dp_link *link,
void __iomem *link_base,
+ void __iomem *mst2link_base,
+ void __iomem *mst3link_base,
void __iomem *pixel_base);
#endif /* _DP_PANEL_H_ */
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* [PATCH v6 08/29] drm/msm/dp: add support to send ACT packets for MST
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (6 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 07/29] drm/msm/dp: add stream-aware link register accessors Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:49 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 09/29] drm/msm/dp: add support to enable MST in mainlink control Yongxing Mou
` (20 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
Whenever virtual channel slot allocation changes, the DP
source must send the action control trigger sequence to notify
the sink about the same. This would be applicable during the
start and stop of the pixel stream. Add the infrastructure
to be able to send ACT packets for the DP controller when
operating in MST mode.
Add REG_DP_MST_ACT, the ACT trigger register used by this sequence.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 44 ++++++++++++++++++++++++++++++++++++-
drivers/gpu/drm/msm/dp/dp_ctrl.h | 5 ++++-
drivers/gpu/drm/msm/dp/dp_display.c | 3 ++-
drivers/gpu/drm/msm/dp/dp_display.h | 1 +
drivers/gpu/drm/msm/dp/dp_reg.h | 1 +
5 files changed, 51 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index e1614bc49a7c..65d22505c2b6 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -142,6 +142,7 @@ struct msm_dp_ctrl_private {
bool core_clks_on;
bool link_clks_on;
bool stream_clks_on[DP_STREAM_MAX];
+ bool mst_active;
};
static inline u32 msm_dp_read_ahb(const struct msm_dp_ctrl_private *ctrl, u32 offset)
@@ -244,6 +245,37 @@ static int msm_dp_aux_link_configure(struct drm_dp_aux *aux,
return err;
}
+int msm_dp_ctrl_mst_send_act(struct msm_dp_ctrl *msm_dp_ctrl,
+ struct msm_dp_panel *panel)
+{
+ struct msm_dp_ctrl_private *ctrl;
+ const struct drm_display_mode *mode;
+ u32 frame_time_ms;
+
+ ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+ if (!ctrl->mst_active)
+ return 0;
+
+ mode = &panel->msm_dp_mode.drm_mode;
+ frame_time_ms = DIV_ROUND_UP((u64)mode->htotal * mode->vtotal,
+ mode->clock) + 1;
+
+ msm_dp_write_link(ctrl, REG_DP_MST_ACT, 0x1);
+ /* make sure ACT signal is performed */
+ wmb();
+
+ msleep(frame_time_ms);
+
+ /* Hardware clears this bit after sending 4 ACT headers */
+ if (msm_dp_read_link(ctrl, REG_DP_MST_ACT)) {
+ drm_dbg_dp(ctrl->drm_dev, "MST ACT trigger complete failed\n");
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
/*
* NOTE: resetting DP controller will also clear any pending HPD related interrupts
*/
@@ -2614,7 +2646,8 @@ int msm_dp_ctrl_prepare_stream_on(struct msm_dp_ctrl *msm_dp_ctrl,
return ret;
}
-int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *panel)
+int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *panel,
+ bool mst_active)
{
int ret = 0;
bool mainlink_ready = false;
@@ -2626,6 +2659,8 @@ int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *
ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+ ctrl->mst_active = mst_active;
+
pixel_rate = panel->msm_dp_mode.drm_mode.clock;
if (msm_dp_ctrl->wide_bus_en || panel->msm_dp_mode.out_fmt_is_yuv_420)
@@ -2657,6 +2692,10 @@ int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *
msm_dp_write_link(ctrl, REG_DP_STATE_CTRL, DP_STATE_CTRL_SEND_VIDEO);
+ ret = msm_dp_ctrl_mst_send_act(msm_dp_ctrl, panel);
+ if (ret)
+ return ret;
+
ret = msm_dp_ctrl_wait4video_ready(ctrl);
if (ret)
return ret;
@@ -2694,6 +2733,8 @@ void msm_dp_ctrl_off_link(struct msm_dp_ctrl *msm_dp_ctrl,
msm_dp_ctrl_reset(&ctrl->msm_dp_ctrl, panel);
+ ctrl->mst_active = false;
+
msm_dp_ctrl_link_clk_disable(&ctrl->msm_dp_ctrl);
phy_power_off(phy);
@@ -2873,6 +2914,7 @@ struct msm_dp_ctrl *msm_dp_ctrl_get(struct device *dev, struct msm_dp_link *link
ctrl->link_base = link_base;
ctrl->mst2link_base = mst2link_base;
ctrl->mst3link_base = mst3link_base;
+ ctrl->mst_active = false;
ret = msm_dp_ctrl_clk_init(&ctrl->msm_dp_ctrl);
if (ret) {
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.h b/drivers/gpu/drm/msm/dp/dp_ctrl.h
index 80d9258501b4..41a69447001c 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.h
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.h
@@ -18,7 +18,8 @@ struct phy;
int msm_dp_ctrl_on_link(struct msm_dp_ctrl *msm_dp_ctrl,
struct msm_dp_panel *panel);
-int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *panel);
+int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *panel,
+ bool mst_active);
int msm_dp_ctrl_prepare_stream_on(struct msm_dp_ctrl *msm_dp_ctrl,
struct msm_dp_panel *panel,
bool force_link_train);
@@ -59,4 +60,6 @@ void msm_dp_ctrl_disable_irq(struct msm_dp_ctrl *msm_dp_ctrl);
void msm_dp_ctrl_reinit_phy(struct msm_dp_ctrl *msm_dp_ctrl);
bool msm_dp_ctrl_stream_clks_on(struct msm_dp_ctrl *dp_ctrl,
enum msm_dp_stream_id stream_id);
+int msm_dp_ctrl_mst_send_act(struct msm_dp_ctrl *msm_dp_ctrl,
+ struct msm_dp_panel *panel);
#endif /* _DP_CTRL_H_ */
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index d0fc4ff508dc..52c13823e8d7 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -672,7 +672,7 @@ static int msm_dp_display_enable(struct msm_dp_display_private *dp,
return 0;
}
- rc = msm_dp_ctrl_on_stream(dp->ctrl, msm_dp_panel);
+ rc = msm_dp_ctrl_on_stream(dp->ctrl, msm_dp_panel, msm_dp_display->mst_active);
if (!rc)
msm_dp_display->power_on = true;
@@ -1497,6 +1497,7 @@ void msm_dp_display_atomic_disable(struct msm_dp *dp)
msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
msm_dp_ctrl_push_idle(msm_dp_display->ctrl);
+ msm_dp_ctrl_mst_send_act(msm_dp_display->ctrl, msm_dp_display->panel);
}
static void msm_dp_display_unprepare(struct msm_dp_display_private *dp)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.h b/drivers/gpu/drm/msm/dp/dp_display.h
index 83117e7619f3..472429d09200 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.h
+++ b/drivers/gpu/drm/msm/dp/dp_display.h
@@ -19,6 +19,7 @@ struct msm_dp {
struct drm_bridge *bridge;
bool audio_enabled;
bool power_on;
+ bool mst_active;
unsigned int connector_type;
bool is_edp;
diff --git a/drivers/gpu/drm/msm/dp/dp_reg.h b/drivers/gpu/drm/msm/dp/dp_reg.h
index 265da58e064c..9263e61c794c 100644
--- a/drivers/gpu/drm/msm/dp/dp_reg.h
+++ b/drivers/gpu/drm/msm/dp/dp_reg.h
@@ -330,6 +330,7 @@
#define MMSS_DP1_SDP_CFG3 (0x000004e8)
#define REG_DP_DP0_RG (0x000004f8)
#define REG_DP_DP1_RG (0x000004fc)
+#define REG_DP_MST_ACT (0x00000500)
#define MMSS_DP_BIST_ENABLE (0x00000000)
#define DP_BIST_ENABLE_DPBIST_EN (0x00000001)
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 08/29] drm/msm/dp: add support to send ACT packets for MST
2026-08-31 8:17 ` [PATCH v6 08/29] drm/msm/dp: add support to send ACT packets for MST Yongxing Mou
@ 2026-08-31 8:49 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 8:49 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] Calling a sleeping function msleep() from an atomic context during DRM atomic commits.
- [High] Build/link error on 32-bit platforms due to 64-bit division using DIV_ROUND_UP.
- [Medium] Incorrect memory barrier used to flush MMIO posted write.
--
commit c7be0c8d679031927a088cf466f79335ab3bce4b
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
drm/msm/dp: add support to send ACT packets for MST
This commit adds the infrastructure to send action control trigger (ACT)
sequences for the DP controller when operating in MST mode. This is used
to notify the sink whenever virtual channel slot allocation changes during
the start and stop of the pixel stream.
> diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
> index e1614bc49a7ca..65d22505c2b67 100644
> --- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
> +++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
[ ... ]
> @@ -244,6 +245,37 @@ static int msm_dp_aux_link_configure(struct drm_dp_aux *aux,
> return err;
> }
>
> +int msm_dp_ctrl_mst_send_act(struct msm_dp_ctrl *msm_dp_ctrl,
> + struct msm_dp_panel *panel)
> +{
> + struct msm_dp_ctrl_private *ctrl;
> + const struct drm_display_mode *mode;
> + u32 frame_time_ms;
> +
> + ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
> +
> + if (!ctrl->mst_active)
> + return 0;
> +
> + mode = &panel->msm_dp_mode.drm_mode;
> + frame_time_ms = DIV_ROUND_UP((u64)mode->htotal * mode->vtotal,
> + mode->clock) + 1;
[Severity: High]
Does this cause a build error on 32-bit platforms due to a 64-bit division?
The macro DIV_ROUND_UP() performs a division using the / operator. Because
the numerator is explicitly cast to a 64-bit unsigned integer, this attempts a
64-bit division, which can fail to link on 32-bit architectures (e.g., ARM32)
with an undefined reference to __udivdi3.
Should this use DIV_ROUND_UP_ULL() or div_u64() instead when performing 64-bit
division?
> +
> + msm_dp_write_link(ctrl, REG_DP_MST_ACT, 0x1);
> + /* make sure ACT signal is performed */
> + wmb();
[Severity: Medium]
Is this the correct way to flush an MMIO posted write?
wmb() only enforces CPU memory ordering; it does not flush posted MMIO writes
to the hardware. The ACT signal write may sit in the bus fabric's posted write
buffer while the CPU goes to sleep. This reduces the effective hardware wait
time and could cause the hardware timeout check to fail incorrectly.
Should a dummy read from the same device (e.g., msm_dp_read_link()) be used
instead to ensure the write is flushed?
> +
> + msleep(frame_time_ms);
[Severity: High]
Is it safe to use a sleeping function here?
msm_dp_ctrl_mst_send_act() is invoked from the bridge's atomic disable callback
(msm_dp_display_atomic_disable) and atomic enable callback
(msm_dp_ctrl_on_stream). The DRM subsystem guidelines explicitly dictate that
DRM atomic enable/disable callbacks run in an atomic context where sleeping
functions are strictly forbidden.
Calling msleep() here can cause kernel warnings, system instability, and
potential deadlocks. Should a non-sleeping delay function like udelay() or
ndelay() be used instead?
> +
> + /* Hardware clears this bit after sending 4 ACT headers */
> + if (msm_dp_read_link(ctrl, REG_DP_MST_ACT)) {
> + drm_dbg_dp(ctrl->drm_dev, "MST ACT trigger complete failed\n");
> + return -EINVAL;
> + }
> +
> + return 0;
> +}
[ ... ]
> diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
> index d0fc4ff508dc6..52c13823e8d7d 100644
> --- a/drivers/gpu/drm/msm/dp/dp_display.c
> +++ b/drivers/gpu/drm/msm/dp/dp_display.c
[ ... ]
> @@ -1497,6 +1497,7 @@ void msm_dp_display_atomic_disable(struct msm_dp *dp)
> msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
>
> msm_dp_ctrl_push_idle(msm_dp_display->ctrl);
> + msm_dp_ctrl_mst_send_act(msm_dp_display->ctrl, msm_dp_display->panel);
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=8
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 09/29] drm/msm/dp: add support to enable MST in mainlink control
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (7 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 08/29] drm/msm/dp: add support to send ACT packets for MST Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 9:01 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 10/29] drm/msm/dp: no need to update tu calculation for mst Yongxing Mou
` (19 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar, Dmitry Baryshkov
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
Add support to program the MST enable bit in the mainlink control
register when an MST session is active or being disabled.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 16 ++++++++++++++++
drivers/gpu/drm/msm/dp/dp_reg.h | 4 ++++
2 files changed, 20 insertions(+)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 65d22505c2b6..cd6ae0d5372c 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -276,6 +276,19 @@ int msm_dp_ctrl_mst_send_act(struct msm_dp_ctrl *msm_dp_ctrl,
return 0;
}
+static void msm_dp_ctrl_mst_config(struct msm_dp_ctrl_private *ctrl, bool enable)
+{
+ u32 mainlink_ctrl;
+
+ mainlink_ctrl = msm_dp_read_link(ctrl, REG_DP_MAINLINK_CTRL);
+ if (enable)
+ mainlink_ctrl |= DP_MAINLINK_CTRL_MST_EN;
+ else
+ mainlink_ctrl &= ~DP_MAINLINK_CTRL_MST_EN;
+
+ msm_dp_write_link(ctrl, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
+}
+
/*
* NOTE: resetting DP controller will also clear any pending HPD related interrupts
*/
@@ -2680,6 +2693,8 @@ int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *
msm_dp_ctrl_lane_mapping(ctrl);
msm_dp_setup_peripheral_flush(ctrl);
+ if (ctrl->mst_active)
+ msm_dp_ctrl_mst_config(ctrl, true);
msm_dp_ctrl_configure_source_params(ctrl, panel);
@@ -2730,6 +2745,7 @@ void msm_dp_ctrl_off_link(struct msm_dp_ctrl *msm_dp_ctrl,
phy = ctrl->phy;
msm_dp_ctrl_mainlink_disable(ctrl);
+ msm_dp_ctrl_mst_config(ctrl, false);
msm_dp_ctrl_reset(&ctrl->msm_dp_ctrl, panel);
diff --git a/drivers/gpu/drm/msm/dp/dp_reg.h b/drivers/gpu/drm/msm/dp/dp_reg.h
index 9263e61c794c..cc74b1ed628e 100644
--- a/drivers/gpu/drm/msm/dp/dp_reg.h
+++ b/drivers/gpu/drm/msm/dp/dp_reg.h
@@ -128,6 +128,10 @@
#define DP_MAINLINK_FLUSH_MODE_UPDATE_SDP FIELD_PREP(DP_MAINLINK_CTRL_FLUSH_MODE_MASK, 1)
#define DP_MAINLINK_FLUSH_MODE_SDE_PERIPH_UPDATE FIELD_PREP(DP_MAINLINK_CTRL_FLUSH_MODE_MASK, 3)
#define DP_MAINLINK_FB_BOUNDARY_SEL (0x02000000)
+#define DP_MAINLINK_CTRL_ECF_MODE BIT(26)
+#define DP_MAINLINK_CTRL_MST_ACTIVE BIT(8)
+#define DP_MAINLINK_CTRL_MST_EN (DP_MAINLINK_CTRL_ECF_MODE | \
+ DP_MAINLINK_CTRL_MST_ACTIVE)
#define REG_DP_STATE_CTRL (0x00000004)
#define DP_STATE_CTRL_LINK_TRAINING_PATTERN1 (0x00000001)
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 09/29] drm/msm/dp: add support to enable MST in mainlink control
2026-08-31 8:17 ` [PATCH v6 09/29] drm/msm/dp: add support to enable MST in mainlink control Yongxing Mou
@ 2026-08-31 9:01 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 9:01 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] Sleeping function msleep() is called in an atomic commit context via msm_dp_ctrl_mst_send_act().
--
commit 10a0de5e53b18299bcdd23065b77d3e1f1d02df3
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
drm/msm/dp: add support to enable MST in mainlink control
This commit adds support to program the MST enable bit in the mainlink control
register when an MST session is active or being disabled.
> diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
> index 65d22505c2b67..cd6ae0d5372c9 100644
> --- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
> +++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
> @@ -276,6 +276,19 @@ int msm_dp_ctrl_mst_send_act(struct msm_dp_ctrl *msm_dp_ctrl,
[Severity: High]
This isn't a bug introduced by this patch, but it is a pre-existing High
severity issue that persists through the end of the series.
Does this code call a sleeping function from an atomic context?
Looking at msm_dp_ctrl_mst_send_act(), it executes a sleeping delay:
int msm_dp_ctrl_mst_send_act(...)
{
...
msleep(frame_time_ms);
...
}
Calling a sleeping function like msleep() from an atomic context causes kernel
warnings (might_sleep()), system instability, and potential deadlocks on hot
paths.
This appears to be triggered on an atomic commit path:
msm_dp_display_atomic_enable() (an encoder/bridge atomic enable callback)
calls msm_dp_display_enable(), which calls msm_dp_ctrl_on_stream(), which in
turn calls msm_dp_ctrl_mst_send_act().
A similar path exists during disable:
msm_dp_display_atomic_disable() -> msm_dp_ctrl_mst_send_act().
The DRM Subsystem Details explicitly define encoder atomic enable/disable
callbacks as atomic context paths where sleeping is strictly forbidden. Only
non-sleeping delays (udelay, ndelay) are safe.
Checking the final state of the series (commit 48ec7f7903ee) confirms this bug
is not resolved later; dpu_encoder_mst_atomic_disable() still calls
msm_dp_mst_stream_disable(), which reaches msm_dp_ctrl_mst_send_act() and
sleeps.
> return 0;
> }
>
> +static void msm_dp_ctrl_mst_config(struct msm_dp_ctrl_private *ctrl, bool enable)
> +{
> + u32 mainlink_ctrl;
> +
> + mainlink_ctrl = msm_dp_read_link(ctrl, REG_DP_MAINLINK_CTRL);
> + if (enable)
> + mainlink_ctrl |= DP_MAINLINK_CTRL_MST_EN;
> + else
> + mainlink_ctrl &= ~DP_MAINLINK_CTRL_MST_EN;
> +
> + msm_dp_write_link(ctrl, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
> +}
[ ... ]
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=9
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 10/29] drm/msm/dp: no need to update tu calculation for mst
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (8 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 09/29] drm/msm/dp: add support to enable MST in mainlink control Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 9:06 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 11/29] drm/msm/dp: always program MST_FIFO_CONSTANT_FILL for MST use cases Yongxing Mou
` (18 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar, Dmitry Baryshkov
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
DP stream is transmitted in transfer units only for SST
case, there is no need to calculate and program TU parameters
for MST case. Skip the TU programming for MST cases.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index cd6ae0d5372c..77506e840883 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -2703,7 +2703,8 @@ int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *
msm_dp_panel_clear_dsc_dto(panel);
- msm_dp_ctrl_setup_tr_unit(ctrl, panel);
+ if (!ctrl->mst_active)
+ msm_dp_ctrl_setup_tr_unit(ctrl, panel);
msm_dp_write_link(ctrl, REG_DP_STATE_CTRL, DP_STATE_CTRL_SEND_VIDEO);
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 10/29] drm/msm/dp: no need to update tu calculation for mst
2026-08-31 8:17 ` [PATCH v6 10/29] drm/msm/dp: no need to update tu calculation for mst Yongxing Mou
@ 2026-08-31 9:06 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 9:06 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] If memory allocation fails during TU calculation, the function returns early without initializing its output parameters, leading to uninitialized stack memory being written to hardware registers.
- [High] Calling sleeping and blocking functions from an atomic context causes system instability and deadlocks.
--
commit 17eb62d850306afdfafe9f15909840906306ec84
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
drm/msm/dp: no need to update tu calculation for mst
This commit skips the calculation and programming of TU parameters for MST
cases, as the DP stream is transmitted in transfer units only for SST.
> diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
> index cd6ae0d5372c9..77506e8408832 100644
> --- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
> +++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
> @@ -2703,7 +2703,8 @@ int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *
>
> msm_dp_panel_clear_dsc_dto(panel);
>
> - msm_dp_ctrl_setup_tr_unit(ctrl, panel);
> + if (!ctrl->mst_active)
> + msm_dp_ctrl_setup_tr_unit(ctrl, panel);
[Severity: High]
This isn't a bug introduced by this patch, but can we write uninitialized
stack memory to MMIO link registers if memory allocation fails?
Looking at msm_dp_ctrl_setup_tr_unit() in drivers/gpu/drm/msm/dp/dp_ctrl.c,
it allocates tu_calc_table on the stack and passes it down for initialization:
drivers/gpu/drm/msm/dp/dp_ctrl.c:msm_dp_ctrl_setup_tr_unit() {
struct msm_dp_vc_tu_mapping_table tu_calc_table;
msm_dp_ctrl_calc_tu_parameters(ctrl, panel, &tu_calc_table);
msm_dp_tu |= tu_calc_table.tu_size_minus1;
...
}
However, if _dp_ctrl_calc_tu() fails to allocate memory, it returns early
without initializing its output parameter:
drivers/gpu/drm/msm/dp/dp_ctrl.c:_dp_ctrl_calc_tu() {
...
tu = kzalloc_obj(*tu);
if (!tu)
return;
...
}
Will this cause msm_dp_ctrl_setup_tr_unit() to use the uninitialized
tu_calc_table stack memory and program it into hardware registers like
REG_DP_VALID_BOUNDARY and REG_DP_TU, potentially leading to display
corruption or kernel panics?
[Severity: High]
This is a pre-existing issue, but does msm_dp_ctrl_on_stream() violate
atomic context constraints by calling sleeping or blocking functions?
The DRM guidelines state that encoder/bridge atomic enable callbacks, such as
msm_dp_display_atomic_enable(), execute in a non-sleeping atomic context.
However, msm_dp_display_atomic_enable() calls msm_dp_ctrl_on_stream(), which
appears to trigger several functions that can sleep or block:
- msm_dp_ctrl_mst_send_act() in drivers/gpu/drm/msm/dp/dp_ctrl.c directly
sleeps:
msleep(frame_time_ms);
- msm_dp_ctrl_wait4video_ready() uses a blocking completion wait:
if (!wait_for_completion_timeout(&ctrl->video_comp,
WAIT_FOR_VIDEO_READY_TIMEOUT_JIFFIES)) {
- msm_dp_ctrl_setup_tr_unit() triggers a memory allocation that can sleep to
reclaim memory:
tu = kzalloc_obj(*tu);
Could these calls cause system deadlocks or lockups when the stream is
activated during atomic commits?
>
> msm_dp_write_link(ctrl, REG_DP_STATE_CTRL, DP_STATE_CTRL_SEND_VIDEO);
>
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=10
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 11/29] drm/msm/dp: always program MST_FIFO_CONSTANT_FILL for MST use cases
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (9 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 10/29] drm/msm/dp: no need to update tu calculation for mst Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 12/29] drm/msm/dp: add support for sending VCPF packets in DP controller Yongxing Mou
` (17 subsequent siblings)
28 siblings, 0 replies; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar, Dmitry Baryshkov
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
As per the hardware programming guide, MST_FIFO_CONSTANT_FILL must
always be programmed when operating in MST mode. Ensure the register
is configured accordingly.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 2 ++
drivers/gpu/drm/msm/dp/dp_panel.c | 12 ++++++++++++
drivers/gpu/drm/msm/dp/dp_panel.h | 2 ++
3 files changed, 16 insertions(+)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 77506e840883..9a0c9737e6d0 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -584,6 +584,8 @@ static void msm_dp_ctrl_configure_source_params(struct msm_dp_ctrl_private *ctrl
msm_dp_ctrl_config_misc1_misc0(ctrl, panel);
msm_dp_panel_timing_cfg(panel, ctrl->msm_dp_ctrl.wide_bus_en);
+
+ msm_dp_panel_mst_async_fifo(panel, ctrl->mst_active);
}
/*
diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c b/drivers/gpu/drm/msm/dp/dp_panel.c
index d3468b73fdc3..bc7bad5ca3b1 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.c
+++ b/drivers/gpu/drm/msm/dp/dp_panel.c
@@ -741,6 +741,18 @@ int msm_dp_panel_timing_cfg(struct msm_dp_panel *msm_dp_panel, bool wide_bus_en)
return 0;
}
+void msm_dp_panel_mst_async_fifo(struct msm_dp_panel *msm_dp_panel, bool mst_en)
+{
+ struct msm_dp_panel_private *panel;
+
+ panel = container_of(msm_dp_panel, struct msm_dp_panel_private, msm_dp_panel);
+
+ if (mst_en)
+ msm_dp_write_pn(panel, MMSS_DP_ASYNC_FIFO_CONFIG, 0x01);
+ else
+ msm_dp_write_pn(panel, MMSS_DP_ASYNC_FIFO_CONFIG, 0x00);
+}
+
int msm_dp_panel_init_panel_info(struct msm_dp_panel *msm_dp_panel,
const struct drm_display_mode *adjusted_mode,
u32 bpp)
diff --git a/drivers/gpu/drm/msm/dp/dp_panel.h b/drivers/gpu/drm/msm/dp/dp_panel.h
index dc046fec24fc..04938b9d2091 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.h
+++ b/drivers/gpu/drm/msm/dp/dp_panel.h
@@ -72,6 +72,8 @@ void msm_dp_panel_clear_dsc_dto(struct msm_dp_panel *msm_dp_panel);
void msm_dp_panel_enable_vsc_sdp(struct msm_dp_panel *msm_dp_panel, struct dp_sdp *vsc_sdp);
void msm_dp_panel_disable_vsc_sdp(struct msm_dp_panel *msm_dp_panel);
+void msm_dp_panel_mst_async_fifo(struct msm_dp_panel *msm_dp_panel, bool mst_en);
+
/**
* is_link_rate_valid() - validates the link rate
* @bw_code: link rate requested by the sink
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* [PATCH v6 12/29] drm/msm/dp: add support for sending VCPF packets in DP controller
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (10 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 11/29] drm/msm/dp: always program MST_FIFO_CONSTANT_FILL for MST use cases Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 9:12 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 13/29] drm/msm/dp: add support for MST channel slot allocation Yongxing Mou
` (16 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar, Dmitry Baryshkov
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
The VC Payload Fill (VCPF) sequence is inserted by the DP controller
when stream symbols are absent, typically before a stream is disabled.
Add support for triggering the VCPF sequence in the MSM DP controller.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 57 +++++++++++++++++++++++++++++++++++++
drivers/gpu/drm/msm/dp/dp_ctrl.h | 1 +
drivers/gpu/drm/msm/dp/dp_display.c | 2 +-
drivers/gpu/drm/msm/dp/dp_reg.h | 8 ++++++
4 files changed, 67 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 9a0c9737e6d0..109a84167599 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -65,6 +65,11 @@
(PSR_UPDATE_MASK | PSR_CAPTURE_MASK | PSR_EXIT_MASK | \
PSR_UPDATE_ERROR_MASK | PSR_WAKE_ERROR_MASK)
+#define DP_INTERRUPT_STATUS5 \
+ (DP_INTR_DP0_VCPF_SENT | DP_INTR_DP1_VCPF_SENT)
+#define DP_INTERRUPT_STATUS5_MASK \
+ (DP_INTERRUPT_STATUS5 << DP_INTERRUPT_STATUS_MASK_SHIFT)
+
#define DP_CTRL_INTR_READY_FOR_VIDEO BIT(0)
#define DP_CTRL_INTR_IDLE_PATTERN_SENT BIT(3)
@@ -351,6 +356,8 @@ void msm_dp_ctrl_enable_irq(struct msm_dp_ctrl *msm_dp_ctrl)
DP_INTERRUPT_STATUS1_MASK);
msm_dp_write_ahb(ctrl, REG_DP_INTR_STATUS2,
DP_INTERRUPT_STATUS2_MASK);
+ msm_dp_write_ahb(ctrl, REG_DP_INTR_STATUS5,
+ DP_INTERRUPT_STATUS5_MASK);
}
void msm_dp_ctrl_disable_irq(struct msm_dp_ctrl *msm_dp_ctrl)
@@ -360,6 +367,7 @@ void msm_dp_ctrl_disable_irq(struct msm_dp_ctrl *msm_dp_ctrl)
msm_dp_write_ahb(ctrl, REG_DP_INTR_STATUS, 0x00);
msm_dp_write_ahb(ctrl, REG_DP_INTR_STATUS2, 0x00);
+ msm_dp_write_ahb(ctrl, REG_DP_INTR_STATUS5, 0x00);
}
static u32 msm_dp_ctrl_get_psr_interrupt(struct msm_dp_ctrl_private *ctrl)
@@ -379,6 +387,20 @@ static void msm_dp_ctrl_config_psr_interrupt(struct msm_dp_ctrl_private *ctrl)
msm_dp_write_ahb(ctrl, REG_DP_INTR_MASK4, DP_INTERRUPT_MASK4);
}
+static u32 msm_dp_ctrl_get_mst_interrupt(struct msm_dp_ctrl_private *ctrl)
+{
+ u32 intr, intr_ack;
+
+ intr = msm_dp_read_ahb(ctrl, REG_DP_INTR_STATUS5);
+ intr &= ~DP_INTERRUPT_STATUS5_MASK;
+ intr_ack = (intr & DP_INTERRUPT_STATUS5)
+ << DP_INTERRUPT_STATUS_ACK_SHIFT;
+ msm_dp_write_ahb(ctrl, REG_DP_INTR_STATUS5,
+ intr_ack | DP_INTERRUPT_STATUS5_MASK);
+
+ return intr;
+}
+
static void msm_dp_ctrl_psr_mainlink_enable(struct msm_dp_ctrl_private *ctrl)
{
u32 val;
@@ -478,6 +500,34 @@ void msm_dp_ctrl_push_idle(struct msm_dp_ctrl *msm_dp_ctrl)
drm_dbg_dp(ctrl->drm_dev, "mainlink off\n");
}
+/* Must be called with msm_dp_mst::mst_lock held */
+void msm_dp_ctrl_push_vcpf(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *msm_dp_panel)
+{
+ struct msm_dp_ctrl_private *ctrl;
+ u32 state = 0x0;
+
+ ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+ if (!ctrl->mst_active)
+ state |= DP_STATE_CTRL_PUSH_IDLE;
+ else if (msm_dp_panel->stream_id == DP_STREAM_0)
+ state |= DP_STATE_CTRL_DP0_PUSH_VCPF;
+ else if (msm_dp_panel->stream_id == DP_STREAM_1)
+ state |= DP_STATE_CTRL_DP1_PUSH_VCPF;
+ else
+ state |= DP_MSTLINK_PUSH_VCPF;
+
+ reinit_completion(&ctrl->idle_comp);
+
+ msm_dp_write_stream_link(ctrl, msm_dp_panel->stream_id, REG_DP_STATE_CTRL, state);
+
+ if (!wait_for_completion_timeout(&ctrl->idle_comp,
+ IDLE_PATTERN_COMPLETION_TIMEOUT_JIFFIES))
+ pr_warn("PUSH_VCPF pattern timedout\n");
+
+ drm_dbg_dp(ctrl->drm_dev, "vcpf sent\n");
+}
+
static void msm_dp_ctrl_config_ctrl_streams(struct msm_dp_ctrl_private *ctrl,
struct msm_dp_panel *msm_dp_panel)
{
@@ -2801,6 +2851,13 @@ irqreturn_t msm_dp_ctrl_isr(struct msm_dp_ctrl *msm_dp_ctrl,
ret = IRQ_HANDLED;
}
+ isr = msm_dp_ctrl_get_mst_interrupt(ctrl);
+ if (isr & (DP_INTR_DP0_VCPF_SENT | DP_INTR_DP1_VCPF_SENT)) {
+ drm_dbg_dp(ctrl->drm_dev, "vcpf sent\n");
+ complete(&ctrl->idle_comp);
+ ret = IRQ_HANDLED;
+ }
+
/* DP aux isr */
isr = msm_dp_ctrl_get_aux_interrupt(ctrl);
if (isr)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.h b/drivers/gpu/drm/msm/dp/dp_ctrl.h
index 41a69447001c..84ea37d8db2e 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.h
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.h
@@ -27,6 +27,7 @@ void msm_dp_ctrl_off_link(struct msm_dp_ctrl *msm_dp_ctrl,
struct msm_dp_panel *panel);
void msm_dp_ctrl_off_pixel_clk(struct msm_dp_ctrl *msm_dp_ctrl, enum msm_dp_stream_id stream_id);
void msm_dp_ctrl_push_idle(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_push_vcpf(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *panel);
irqreturn_t msm_dp_ctrl_isr(struct msm_dp_ctrl *msm_dp_ctrl,
struct msm_dp_panel *panel);
void msm_dp_ctrl_handle_sink_request(struct msm_dp_ctrl *msm_dp_ctrl,
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 52c13823e8d7..00c9b55925f9 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -1496,7 +1496,7 @@ void msm_dp_display_atomic_disable(struct msm_dp *dp)
msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
- msm_dp_ctrl_push_idle(msm_dp_display->ctrl);
+ msm_dp_ctrl_push_vcpf(msm_dp_display->ctrl, msm_dp_display->panel);
msm_dp_ctrl_mst_send_act(msm_dp_display->ctrl, msm_dp_display->panel);
}
diff --git a/drivers/gpu/drm/msm/dp/dp_reg.h b/drivers/gpu/drm/msm/dp/dp_reg.h
index cc74b1ed628e..e37a05c2963a 100644
--- a/drivers/gpu/drm/msm/dp/dp_reg.h
+++ b/drivers/gpu/drm/msm/dp/dp_reg.h
@@ -42,6 +42,9 @@
#define DP_INTR_FRAME_END BIT(6)
#define DP_INTR_CRC_UPDATED BIT(9)
+#define DP_INTR_DP0_VCPF_SENT BIT(0)
+#define DP_INTR_DP1_VCPF_SENT BIT(3)
+
#define REG_DP_INTR_STATUS3 (0x00000028)
#define REG_DP_INTR_STATUS4 (0x0000002C)
@@ -58,6 +61,8 @@
#define PSR_UPDATE_ERROR_MASK (0x00000008)
#define PSR_WAKE_ERROR_MASK (0x00000010)
+#define REG_DP_INTR_STATUS5 (0x00000034)
+
#define REG_DP_DP_HPD_CTRL (0x00000000)
#define DP_DP_HPD_CTRL_HPD_EN (0x00000001)
@@ -143,6 +148,8 @@
#define DP_STATE_CTRL_LINK_TEST_CUSTOM_PATTERN (0x00000040)
#define DP_STATE_CTRL_SEND_VIDEO (0x00000080)
#define DP_STATE_CTRL_PUSH_IDLE (0x00000100)
+#define DP_STATE_CTRL_DP0_PUSH_VCPF BIT(12)
+#define DP_STATE_CTRL_DP1_PUSH_VCPF BIT(14)
#define REG_DP_CONFIGURATION_CTRL (0x00000008)
#define DP_CONFIGURATION_CTRL_SYNC_ASYNC_CLK (0x00000001)
@@ -370,6 +377,7 @@
/* Streams 2/3 registers, relative to mst2link_base / mst3link_base. */
#define REG_DP_MSTLINK_STATE_CTRL (0x00000000)
+#define DP_MSTLINK_PUSH_VCPF BIT(12)
#define REG_DP_MSTLINK_CONFIGURATION_CTRL (0x00000034)
#define REG_DP_MSTLINK_TIMESLOT_1_32 (0x00000038)
#define REG_DP_MSTLINK_TIMESLOT_33_63 (0x0000003c)
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 12/29] drm/msm/dp: add support for sending VCPF packets in DP controller
2026-08-31 8:17 ` [PATCH v6 12/29] drm/msm/dp: add support for sending VCPF packets in DP controller Yongxing Mou
@ 2026-08-31 9:12 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 9:12 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
New issues:
- [Medium] Deterministic timeout during VCPF push for MST streams 2 and 3 due to unhandled interrupts.
Pre-existing issues:
- [High] `msm_dp_ctrl_push_vcpf` calls a sleeping function (`wait_for_completion_timeout`) from the atomic disable path.
--
commit 507d49b6852332d2246a4d09ccd9c56c895bd874
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
drm/msm/dp: add support for sending VCPF packets in DP controller
The VC Payload Fill (VCPF) sequence is inserted by the DP controller
when stream symbols are absent, typically before a stream is disabled.
Add support for triggering the VCPF sequence in the MSM DP controller.
> diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
> index 9a0c9737e6d00..109a841675997 100644
> --- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
> +++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
[ ... ]
> @@ -478,6 +500,34 @@ void msm_dp_ctrl_push_idle(struct msm_dp_ctrl *msm_dp_ctrl)
> drm_dbg_dp(ctrl->drm_dev, "mainlink off\n");
> }
>
> +/* Must be called with msm_dp_mst::mst_lock held */
> +void msm_dp_ctrl_push_vcpf(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *msm_dp_panel)
> +{
> + struct msm_dp_ctrl_private *ctrl;
> + u32 state = 0x0;
> +
> + ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
> +
> + if (!ctrl->mst_active)
> + state |= DP_STATE_CTRL_PUSH_IDLE;
> + else if (msm_dp_panel->stream_id == DP_STREAM_0)
> + state |= DP_STATE_CTRL_DP0_PUSH_VCPF;
> + else if (msm_dp_panel->stream_id == DP_STREAM_1)
> + state |= DP_STATE_CTRL_DP1_PUSH_VCPF;
> + else
> + state |= DP_MSTLINK_PUSH_VCPF;
> +
> + reinit_completion(&ctrl->idle_comp);
> +
> + msm_dp_write_stream_link(ctrl, msm_dp_panel->stream_id, REG_DP_STATE_CTRL, state);
> +
> + if (!wait_for_completion_timeout(&ctrl->idle_comp,
> + IDLE_PATTERN_COMPLETION_TIMEOUT_JIFFIES))
> + pr_warn("PUSH_VCPF pattern timedout\n");
[Severity: High]
This is a pre-existing issue, but wait_for_completion_timeout() is a
sleeping function, and it is being invoked from an atomic context.
The DRM atomic commit tail framework calls the bridge's atomic_disable
callback (msm_dp_display_atomic_disable()), which directly calls this
function. Since the atomic_disable callback is an atomic context path
where sleeping is strictly forbidden, could this cause kernel warnings
or potential deadlocks during display teardown?
[Severity: Medium]
Will this wait result in a deterministic timeout for MST streams 2 and 3?
When the stream is assigned to DP_STREAM_2 or DP_STREAM_3, the hardware is
triggered to send VCPF via DP_MSTLINK_PUSH_VCPF, and the code blocks here.
However, looking at the interrupt handler in this patch:
isr = msm_dp_ctrl_get_mst_interrupt(ctrl);
if (isr & (DP_INTR_DP0_VCPF_SENT | DP_INTR_DP1_VCPF_SENT)) {
drm_dbg_dp(ctrl->drm_dev, "vcpf sent\n");
complete(&ctrl->idle_comp);
ret = IRQ_HANDLED;
}
The ISR only checks for stream 0 and 1 completion events. DP2 and DP3
are ignored. Since the interrupt for DP2/DP3 is neither unmasked in
DP_INTERRUPT_STATUS5_MASK nor handled in msm_dp_ctrl_isr(), the
completion won't happen.
Does this cause an unnecessary 30ms delay and a timeout warning every time
a secondary MST stream is disabled?
[ ... ]
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=12
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 13/29] drm/msm/dp: add support for MST channel slot allocation
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (11 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 12/29] drm/msm/dp: add support for sending VCPF packets in DP controller Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 9:11 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 14/29] drm/msm/dp: replace power_on with active_stream_cnt Yongxing Mou
` (15 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
DP MST streams share 64 MTP slots in a time-multiplexed manner. Add
support for calculating the rate governor, slot allocation, and slot
reservation in the DP controller.
Each MST stream can reserve its slots by calling
msm_dp_display_set_stream_info() from its bridge callbacks.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 187 ++++++++++++++++++++++++++++++++++++
drivers/gpu/drm/msm/dp/dp_ctrl.h | 4 +
drivers/gpu/drm/msm/dp/dp_display.c | 13 +++
drivers/gpu/drm/msm/dp/dp_display.h | 2 +
4 files changed, 206 insertions(+)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 109a84167599..73aabd219125 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -78,6 +78,7 @@
#define MR_LINK_PRBS7 0x100
#define MR_LINK_CUSTOM80 0x200
#define MR_LINK_TRAINING4 0x40
+#define DP_MAX_TIME_SLOTS 64
enum {
DP_TRAINING_NONE,
@@ -114,6 +115,12 @@ struct msm_dp_vc_tu_mapping_table {
u8 tu_size_minus1;
};
+struct msm_dp_mst_ch_slot_info {
+ u32 start_slot;
+ u32 tot_slots;
+ u32 pbn;
+};
+
struct msm_dp_ctrl_private {
struct msm_dp_ctrl msm_dp_ctrl;
struct drm_device *drm_dev;
@@ -148,6 +155,8 @@ struct msm_dp_ctrl_private {
bool link_clks_on;
bool stream_clks_on[DP_STREAM_MAX];
bool mst_active;
+
+ struct msm_dp_mst_ch_slot_info mst_ch_info[DP_STREAM_MAX];
};
static inline u32 msm_dp_read_ahb(const struct msm_dp_ctrl_private *ctrl, u32 offset)
@@ -294,6 +303,37 @@ static void msm_dp_ctrl_mst_config(struct msm_dp_ctrl_private *ctrl, bool enable
msm_dp_write_link(ctrl, REG_DP_MAINLINK_CTRL, mainlink_ctrl);
}
+static void msm_dp_ctrl_mst_update_timeslot(struct msm_dp_ctrl_private *ctrl,
+ enum msm_dp_stream_id stream_id, u32 ch_start_slot,
+ u32 tot_slot_cnt)
+{
+ u32 slot_reg_1 = 0, slot_reg_2 = 0;
+
+ drm_dbg_dp(ctrl->drm_dev, "stream_id %d, start_slot %d, tot_slot %d\n",
+ stream_id, ch_start_slot, tot_slot_cnt);
+
+ if (ch_start_slot && tot_slot_cnt) {
+ u64 mask = GENMASK_ULL(ch_start_slot + tot_slot_cnt - 2, ch_start_slot - 1);
+
+ slot_reg_1 = mask & 0xFFFFFFFF;
+ slot_reg_2 = (mask >> 32) & 0xFFFFFFFF;
+ }
+
+ msm_dp_write_stream_link(ctrl, stream_id, REG_DP_DP0_TIMESLOT_1_32, slot_reg_1);
+ msm_dp_write_stream_link(ctrl, stream_id, REG_DP_DP0_TIMESLOT_33_63, slot_reg_2);
+}
+
+static void msm_dp_ctrl_update_rg(struct msm_dp_ctrl_private *ctrl,
+ enum msm_dp_stream_id stream_id, u32 x_int, u32 y_frac_enum)
+{
+ u32 rg = y_frac_enum | (x_int << 16);
+
+ drm_dbg_dp(ctrl->drm_dev, "stream_id: %d x_int:%d y_frac_enum:%d rg:%d\n",
+ stream_id, x_int, y_frac_enum, rg);
+
+ msm_dp_write_stream_link(ctrl, stream_id, REG_DP_DP0_RG, rg);
+}
+
/*
* NOTE: resetting DP controller will also clear any pending HPD related interrupts
*/
@@ -2675,6 +2715,117 @@ static void msm_dp_ctrl_config_msa(struct msm_dp_ctrl_private *ctrl,
msm_dp_write_stream_link(ctrl, panel->stream_id, REG_DP_SOFTWARE_NVID, nvid);
}
+/*
+ * Calculate MST Rate Governor parameters x_int and y_frac_enum.
+ *
+ * The RG paces symbol delivery per MTP via: M = x_int + y_frac_enum/256
+ * where M is the target symbol count per MTP across all lanes.
+ *
+ * min_slot_cnt = (pclk * bpp/8) / (lclk * lanes) * 64 -- slots at 1.0x BW
+ * max_slot_cnt = pbn * 54 / (lclk * lanes) -- slots at PBN limit
+ * raw_target_sc = (min + max) / 2 -- midpoint (~1.003x)
+ *
+ * Quantize raw_target_sc to 1/(256*lanes) steps, then:
+ * M = Chosen_TARGET_Slot_Count * lanes
+ * x_int = INT(M)
+ * y_frac_enum = CEIL(256 * MOD(M, 1))
+ */
+static void msm_dp_ctrl_mst_calculate_rg(struct msm_dp_ctrl_private *ctrl,
+ struct msm_dp_panel *panel,
+ u32 *p_x_int, u32 *p_y_frac_enum)
+{
+ u64 min_slot_cnt, max_slot_cnt;
+ u64 raw_target_sc, target_sc_fixp;
+ u64 ts_denom, ts_enum, ts_int;
+ u64 pclk = panel->msm_dp_mode.drm_mode.clock;
+ u64 lclk = 0;
+ u64 lanes = ctrl->link->link_params.num_lanes;
+ u64 bpp = panel->msm_dp_mode.bpp;
+ u64 pbn = ctrl->mst_ch_info[panel->stream_id].pbn;
+ u64 numerator, denominator, temp, temp1, temp2;
+ u32 x_int = 0, y_frac_enum = 0;
+ u64 target_strm_sym, ts_int_fixp, ts_frac_fixp, y_frac_enum_fixp;
+
+ lclk = ctrl->link->link_params.rate;
+
+ /* min_slot_cnt */
+ numerator = pclk * bpp * 64 * 1000;
+ denominator = lclk * lanes * 8 * 1000;
+ min_slot_cnt = drm_fixp_from_fraction(numerator, denominator);
+
+ /* max_slot_cnt */
+ numerator = pbn * 54 * 1000;
+ denominator = lclk * lanes;
+ max_slot_cnt = drm_fixp_from_fraction(numerator, denominator);
+
+ /* raw_target_sc */
+ numerator = max_slot_cnt + min_slot_cnt;
+ denominator = drm_fixp_from_fraction(2, 1);
+ raw_target_sc = drm_fixp_div(numerator, denominator);
+
+ /* target_sc */
+ temp = drm_fixp_from_fraction(256 * lanes, 1);
+ numerator = drm_fixp_mul(raw_target_sc, temp);
+ denominator = drm_fixp_from_fraction(256 * lanes, 1);
+ target_sc_fixp = drm_fixp_div(numerator, denominator);
+
+ ts_enum = 256 * lanes;
+ ts_denom = drm_fixp_from_fraction(256 * lanes, 1);
+ ts_int = drm_fixp2int(target_sc_fixp);
+
+ temp = drm_fixp2int_ceil(raw_target_sc);
+ if (temp != ts_int) {
+ temp = drm_fixp_from_fraction(ts_int, 1);
+ temp1 = raw_target_sc - temp;
+ temp2 = drm_fixp_mul(temp1, ts_denom);
+ ts_enum = drm_fixp2int(temp2);
+ }
+
+ /* target_strm_sym */
+ ts_int_fixp = drm_fixp_from_fraction(ts_int, 1);
+ ts_frac_fixp = drm_fixp_from_fraction(ts_enum, drm_fixp2int(ts_denom));
+ temp = ts_int_fixp + ts_frac_fixp;
+ temp1 = drm_fixp_from_fraction(lanes, 1);
+ target_strm_sym = drm_fixp_mul(temp, temp1);
+
+ /* x_int */
+ x_int = drm_fixp2int(target_strm_sym);
+
+ /* y_enum_frac */
+ temp = drm_fixp_from_fraction(x_int, 1);
+ temp1 = target_strm_sym - temp;
+ temp2 = drm_fixp_from_fraction(256, 1);
+ y_frac_enum_fixp = drm_fixp_mul(temp1, temp2);
+
+ temp1 = drm_fixp2int(y_frac_enum_fixp);
+ temp2 = drm_fixp2int_ceil(y_frac_enum_fixp);
+
+ y_frac_enum = (u32)((temp1 == temp2) ? temp1 : temp1 + 1);
+
+ *p_x_int = x_int;
+ *p_y_frac_enum = y_frac_enum;
+
+ drm_dbg_dp(ctrl->drm_dev, "MST lane_cnt:%llu, rate:%llu x_int:%d, y_frac:%d\n",
+ lanes, lclk, x_int, y_frac_enum);
+}
+
+static void msm_dp_ctrl_mst_stream_setup(struct msm_dp_ctrl_private *ctrl,
+ struct msm_dp_panel *panel)
+{
+ u32 x_int, y_frac_enum;
+
+ if (!ctrl->mst_active)
+ return;
+
+ drm_dbg_dp(ctrl->drm_dev, "MST stream channel allocation\n");
+
+ msm_dp_ctrl_mst_timeslot_setup(&ctrl->msm_dp_ctrl);
+
+ msm_dp_ctrl_mst_calculate_rg(ctrl, panel, &x_int, &y_frac_enum);
+
+ msm_dp_ctrl_update_rg(ctrl, panel->stream_id, x_int, y_frac_enum);
+}
+
int msm_dp_ctrl_prepare_stream_on(struct msm_dp_ctrl *msm_dp_ctrl,
struct msm_dp_panel *panel,
bool force_link_train)
@@ -2758,6 +2909,8 @@ int msm_dp_ctrl_on_stream(struct msm_dp_ctrl *msm_dp_ctrl, struct msm_dp_panel *
if (!ctrl->mst_active)
msm_dp_ctrl_setup_tr_unit(ctrl, panel);
+ msm_dp_ctrl_mst_stream_setup(ctrl, panel);
+
msm_dp_write_link(ctrl, REG_DP_STATE_CTRL, DP_STATE_CTRL_SEND_VIDEO);
ret = msm_dp_ctrl_mst_send_act(msm_dp_ctrl, panel);
@@ -2809,6 +2962,40 @@ void msm_dp_ctrl_off_link(struct msm_dp_ctrl *msm_dp_ctrl,
phy_power_off(phy);
}
+void msm_dp_ctrl_set_mst_channel_info(struct msm_dp_ctrl *msm_dp_ctrl,
+ enum msm_dp_stream_id stream_id,
+ u32 start_slot, u32 tot_slots, u32 pbn)
+{
+ struct msm_dp_ctrl_private *ctrl;
+
+ if (!msm_dp_ctrl || stream_id >= DP_STREAM_MAX) {
+ DRM_ERROR("invalid input\n");
+ return;
+ }
+
+ ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+ ctrl->mst_ch_info[stream_id].start_slot = start_slot;
+ ctrl->mst_ch_info[stream_id].tot_slots = tot_slots;
+ ctrl->mst_ch_info[stream_id].pbn = pbn;
+}
+
+void msm_dp_ctrl_mst_timeslot_setup(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+ struct msm_dp_ctrl_private *ctrl;
+ int i;
+
+ ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+ if (!ctrl->mst_active)
+ return;
+
+ for (i = DP_STREAM_0; i < ctrl->num_pixel_clks; i++) {
+ msm_dp_ctrl_mst_update_timeslot(ctrl, i, ctrl->mst_ch_info[i].start_slot,
+ ctrl->mst_ch_info[i].tot_slots);
+ }
+}
+
irqreturn_t msm_dp_ctrl_isr(struct msm_dp_ctrl *msm_dp_ctrl,
struct msm_dp_panel *panel)
{
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.h b/drivers/gpu/drm/msm/dp/dp_ctrl.h
index 84ea37d8db2e..e8b445c552f7 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.h
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.h
@@ -63,4 +63,8 @@ bool msm_dp_ctrl_stream_clks_on(struct msm_dp_ctrl *dp_ctrl,
enum msm_dp_stream_id stream_id);
int msm_dp_ctrl_mst_send_act(struct msm_dp_ctrl *msm_dp_ctrl,
struct msm_dp_panel *panel);
+void msm_dp_ctrl_mst_timeslot_setup(struct msm_dp_ctrl *msm_dp_ctrl);
+void msm_dp_ctrl_set_mst_channel_info(struct msm_dp_ctrl *msm_dp_ctrl,
+ enum msm_dp_stream_id stream_id,
+ u32 start_slot, u32 tot_slots, u32 pbn);
#endif /* _DP_CTRL_H_ */
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 00c9b55925f9..6f79328c8b79 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -734,6 +734,18 @@ static int msm_dp_display_disable(struct msm_dp_display_private *dp,
return 0;
}
+int msm_dp_display_set_stream_info(struct msm_dp *msm_dp_display, struct msm_dp_panel *panel,
+ u32 start_slot, u32 num_slots, u32 pbn)
+{
+ struct msm_dp_display_private *dp;
+
+ dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+ msm_dp_ctrl_set_mst_channel_info(dp->ctrl, panel->stream_id, start_slot, num_slots, pbn);
+
+ return 0;
+}
+
/**
* msm_dp_display_mode_valid - callback to determine if specified mode is valid
* @dp: Pointer to dp display structure
@@ -1497,6 +1509,7 @@ void msm_dp_display_atomic_disable(struct msm_dp *dp)
msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
msm_dp_ctrl_push_vcpf(msm_dp_display->ctrl, msm_dp_display->panel);
+ msm_dp_ctrl_mst_timeslot_setup(msm_dp_display->ctrl);
msm_dp_ctrl_mst_send_act(msm_dp_display->ctrl, msm_dp_display->panel);
}
diff --git a/drivers/gpu/drm/msm/dp/dp_display.h b/drivers/gpu/drm/msm/dp/dp_display.h
index 472429d09200..317c19b809ec 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.h
+++ b/drivers/gpu/drm/msm/dp/dp_display.h
@@ -43,5 +43,7 @@ void msm_dp_display_atomic_enable(struct msm_dp *dp_display,
enum drm_mode_status msm_dp_display_mode_valid(struct msm_dp *dp,
const struct drm_display_info *info,
const struct drm_display_mode *mode);
+int msm_dp_display_set_stream_info(struct msm_dp *msm_dp_display, struct msm_dp_panel *panel,
+ u32 start_slot, u32 num_slots, u32 pbn);
#endif /* _DP_DISPLAY_H_ */
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 13/29] drm/msm/dp: add support for MST channel slot allocation
2026-08-31 8:17 ` [PATCH v6 13/29] drm/msm/dp: add support for MST channel slot allocation Yongxing Mou
@ 2026-08-31 9:11 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 9:11 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [High] Calling a sleeping function (`msleep`) from an atomic commit callback violates DRM display guidelines.
- [Medium] Incorrect initialization of `ts_enum` causes an off-by-one error, artificially increasing the target symbol count when `raw_target_sc` is an exact integer.
- [Medium] The fixed-point math intended to quantize `raw_target_sc` is a mathematical no-op, defeating its documented purpose.
- [Medium] Potential division by zero kernel panic if DP link parameters (`lanes` or `lclk`) are zero.
--
commit 104a5d3e2340f37c5f0003fb078fcd9efe33ba4d
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
drm/msm/dp: add support for MST channel slot allocation
DP MST streams share 64 MTP slots in a time-multiplexed manner. Add
support for calculating the rate governor, slot allocation, and slot
reservation in the DP controller.
> diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
> index 109a841675997..73aabd219125d 100644
> --- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
> +++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
[ ... ]
> @@ -2675,6 +2715,117 @@ static void msm_dp_ctrl_config_msa(struct msm_dp_ctrl_private *ctrl,
> msm_dp_write_stream_link(ctrl, panel->stream_id, REG_DP_SOFTWARE_NVID, nvid);
> }
>
> +/*
> + * Calculate MST Rate Governor parameters x_int and y_frac_enum.
> + *
> + * The RG paces symbol delivery per MTP via: M = x_int + y_frac_enum/256
[ ... ]
> +static void msm_dp_ctrl_mst_calculate_rg(struct msm_dp_ctrl_private *ctrl,
> + struct msm_dp_panel *panel,
> + u32 *p_x_int, u32 *p_y_frac_enum)
> +{
> + u64 min_slot_cnt, max_slot_cnt;
[ ... ]
> + lclk = ctrl->link->link_params.rate;
> +
> + /* min_slot_cnt */
> + numerator = pclk * bpp * 64 * 1000;
> + denominator = lclk * lanes * 8 * 1000;
> + min_slot_cnt = drm_fixp_from_fraction(numerator, denominator);
[Severity: Medium]
Is there a risk of a division by zero kernel panic here if the DP link
parameters fall back to zero?
In msm_dp_ctrl_mst_calculate_rg(), the denominator is computed directly
from lclk and lanes. If link training fails completely or a buggy DP sink
causes the driver to fall back to a state with zero lanes or zero link clock,
passing this zero denominator to drm_fixp_from_fraction() could trigger a
panic inside div64_u64_rem().
Should these link parameters be validated before attempting this division?
> +
> + /* max_slot_cnt */
> + numerator = pbn * 54 * 1000;
> + denominator = lclk * lanes;
> + max_slot_cnt = drm_fixp_from_fraction(numerator, denominator);
> +
> + /* raw_target_sc */
> + numerator = max_slot_cnt + min_slot_cnt;
> + denominator = drm_fixp_from_fraction(2, 1);
> + raw_target_sc = drm_fixp_div(numerator, denominator);
> +
> + /* target_sc */
> + temp = drm_fixp_from_fraction(256 * lanes, 1);
> + numerator = drm_fixp_mul(raw_target_sc, temp);
> + denominator = drm_fixp_from_fraction(256 * lanes, 1);
> + target_sc_fixp = drm_fixp_div(numerator, denominator);
[Severity: Medium]
Does this fixed-point math actually quantize the target symbol count as
intended?
The code computes target_sc_fixp by multiplying raw_target_sc by
(256 * lanes) and then dividing it by the exact same fixed-point constant.
Because drm_fixp operations preserve the fixed-point fractional precision and
do not implicitly coerce to integers, this division restores the unquantized
raw value, acting as a mathematical no-op.
To correctly quantize raw_target_sc into 1/(256*lanes) steps, does the
numerator need to be converted to an integer before the division?
> +
> + ts_enum = 256 * lanes;
> + ts_denom = drm_fixp_from_fraction(256 * lanes, 1);
> + ts_int = drm_fixp2int(target_sc_fixp);
> +
> + temp = drm_fixp2int_ceil(raw_target_sc);
> + if (temp != ts_int) {
[Severity: Medium]
Will this initialization of ts_enum cause an off-by-one error when
raw_target_sc evaluates to an exact integer?
If raw_target_sc is an exact integer, temp != ts_int evaluates to false,
skipping the recalculation block. Because ts_enum was initially set to
256 * lanes instead of 0, ts_frac_fixp subsequently evaluates to exactly 1.0
in fixed-point space.
This extraneous 1.0 adds an extra target slot, which when multiplied by lanes,
artificially increases the final target_strm_sym count and causes the rate
governor to pace symbols faster than mathematically intended.
> + temp = drm_fixp_from_fraction(ts_int, 1);
> + temp1 = raw_target_sc - temp;
> + temp2 = drm_fixp_mul(temp1, ts_denom);
> + ts_enum = drm_fixp2int(temp2);
> + }
[ ... ]
> diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
> index 00c9b55925f93..6f79328c8b790 100644
> --- a/drivers/gpu/drm/msm/dp/dp_display.c
> +++ b/drivers/gpu/drm/msm/dp/dp_display.c
[ ... ]
> @@ -1497,6 +1509,7 @@ void msm_dp_display_atomic_disable(struct msm_dp *dp)
> msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
>
> msm_dp_ctrl_push_vcpf(msm_dp_display->ctrl, msm_dp_display->panel);
> + msm_dp_ctrl_mst_timeslot_setup(msm_dp_display->ctrl);
> msm_dp_ctrl_mst_send_act(msm_dp_display->ctrl, msm_dp_display->panel);
> }
[Severity: High]
Can this call chain lead to sleeping in an atomic context?
The atomic modesetting core calls the atomic disable hooks which leads to
msm_dp_display_atomic_disable(). This function unconditionally calls
msm_dp_ctrl_mst_send_act().
Looking at msm_dp_ctrl_mst_send_act() in dp_ctrl.c:
int msm_dp_ctrl_mst_send_act(...) {
...
msm_dp_write_link(ctrl, REG_DP_MST_ACT, 0x1);
wmb();
msleep(frame_time_ms);
...
}
Since DRM encoder and bridge atomic callbacks run in atomic context during
non-blocking commits, sleeping here with msleep() violates the atomic
context contract and could lead to system instability, deadlocks, and
kernel warnings.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=13
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 14/29] drm/msm/dp: replace power_on with active_stream_cnt
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (12 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 13/29] drm/msm/dp: add support for MST channel slot allocation Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 9:18 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 15/29] drm/msm/dp: factor out _helper variants of bridge ops accepting a panel Yongxing Mou
` (14 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
The power_on boolean cannot represent DP MST, where multiple streams
share a single link and its associated resources.
Replace power_on with active_stream_cnt and use it to track the lifetime
of the shared link. Link initialization is performed when enabling the
first stream, while link teardown is deferred until the last stream is
disabled.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_audio.c | 2 +-
drivers/gpu/drm/msm/dp/dp_display.c | 38 ++++++++++++++++++-------------------
drivers/gpu/drm/msm/dp/dp_display.h | 2 +-
3 files changed, 20 insertions(+), 22 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_audio.c b/drivers/gpu/drm/msm/dp/dp_audio.c
index df222943ae57..8118130a3220 100644
--- a/drivers/gpu/drm/msm/dp/dp_audio.c
+++ b/drivers/gpu/drm/msm/dp/dp_audio.c
@@ -284,7 +284,7 @@ int msm_dp_audio_prepare(struct drm_bridge *bridge,
* such cases check for connection status and bail out if not
* connected.
*/
- if (!msm_dp_display->power_on)
+ if (!msm_dp_display->active_stream_cnt)
goto end;
audio = msm_dp_audio_get_data(msm_dp_display);
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 6f79328c8b79..9c5563dcb856 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -645,16 +645,16 @@ static int msm_dp_display_prepare_link(struct msm_dp_display_private *dp)
if (dp->link->sink_count == 0)
return -ENOTCONN;
- if (!msm_dp_display->power_on) {
+ if (!msm_dp_display->active_stream_cnt) {
msm_dp_display_host_phy_init(dp);
force_link_train = true;
- }
- rc = msm_dp_ctrl_on_link(dp->ctrl, dp->panel);
- if (rc) {
- DRM_ERROR("Failed link training (rc=%d)\n", rc);
- // TODO: schedule drm_connector_set_link_status_property()
- return rc;
+ rc = msm_dp_ctrl_on_link(dp->ctrl, dp->panel);
+ if (rc) {
+ DRM_ERROR("Failed link training (rc=%d)\n", rc);
+ // TODO: schedule drm_connector_set_link_status_property()
+ return rc;
+ }
}
return msm_dp_ctrl_prepare_stream_on(dp->ctrl, dp->panel, force_link_train);
@@ -667,14 +667,10 @@ static int msm_dp_display_enable(struct msm_dp_display_private *dp,
struct msm_dp *msm_dp_display = &dp->msm_dp_display;
drm_dbg_dp(dp->drm_dev, "sink_count=%d\n", dp->link->sink_count);
- if (msm_dp_display->power_on) {
- drm_dbg_dp(dp->drm_dev, "Link already setup, return\n");
- return 0;
- }
rc = msm_dp_ctrl_on_stream(dp->ctrl, msm_dp_panel, msm_dp_display->mst_active);
- if (!rc)
- msm_dp_display->power_on = true;
+
+ msm_dp_display->active_stream_cnt++;
return rc;
}
@@ -723,13 +719,12 @@ static int msm_dp_display_disable(struct msm_dp_display_private *dp,
{
struct msm_dp *msm_dp_display = &dp->msm_dp_display;
- if (!msm_dp_display->power_on)
- return 0;
-
msm_dp_panel_disable_vsc_sdp(msm_dp_panel);
msm_dp_ctrl_off_pixel_clk(dp->ctrl, msm_dp_panel->stream_id);
+ msm_dp_display->active_stream_cnt--;
+
drm_dbg_dp(dp->drm_dev, "sink count: %d\n", dp->link->sink_count);
return 0;
}
@@ -851,10 +846,10 @@ void msm_dp_snapshot(struct msm_disp_state *disp_state, struct msm_dp *dp)
* if we are reading registers we need the link clocks to be on
* however till DP cable is connected this will not happen as we
* do not know the resolution to power up with. Hence check the
- * power_on status before dumping DP registers to avoid crash due
+ * active_stream_cnt status before dumping DP registers to avoid crash due
* to unclocked access
*/
- if (!dp->power_on)
+ if (!dp->active_stream_cnt)
return;
msm_disp_snapshot_add_block(disp_state, msm_dp_display->ahb_len,
@@ -1517,6 +1512,11 @@ static void msm_dp_display_unprepare(struct msm_dp_display_private *dp)
{
struct msm_dp *msm_dp_display = &dp->msm_dp_display;
+ if (msm_dp_display->active_stream_cnt) {
+ drm_dbg_dp(dp->drm_dev, "stream still active, return\n");
+ return;
+ }
+
/* dongle is still connected but sinks are disconnected */
if (dp->link->sink_count == 0)
msm_dp_link_psm_config(dp->link, &dp->panel->link_info, true);
@@ -1529,8 +1529,6 @@ static void msm_dp_display_unprepare(struct msm_dp_display_private *dp)
else
msm_dp_display_host_phy_exit(dp);
- msm_dp_display->power_on = false;
-
pm_runtime_put_sync(&msm_dp_display->pdev->dev);
drm_dbg_dp(dp->drm_dev, "type=%d Done\n", msm_dp_display->connector_type);
diff --git a/drivers/gpu/drm/msm/dp/dp_display.h b/drivers/gpu/drm/msm/dp/dp_display.h
index 317c19b809ec..7bd510cecb44 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.h
+++ b/drivers/gpu/drm/msm/dp/dp_display.h
@@ -18,7 +18,7 @@ struct msm_dp {
struct drm_bridge *next_bridge;
struct drm_bridge *bridge;
bool audio_enabled;
- bool power_on;
+ u32 active_stream_cnt;
bool mst_active;
unsigned int connector_type;
bool is_edp;
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 14/29] drm/msm/dp: replace power_on with active_stream_cnt
2026-08-31 8:17 ` [PATCH v6 14/29] drm/msm/dp: replace power_on with active_stream_cnt Yongxing Mou
@ 2026-08-31 9:18 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 9:18 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Unconditional decrement of `active_stream_cnt` and unclocked register accesses on failure paths cause integer underflow and system crashes.
--
commit d23a7dcc5ef73b43d129d8cbcecd19ea680c25fc
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
Subject: drm/msm/dp: replace power_on with active_stream_cnt
This commit replaces the boolean power_on state with an active_stream_cnt
tracker to better support DP MST configurations. Link initialization is
performed when the first stream is enabled, and link teardown is deferred
until the last stream is disabled.
> diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
> index 6f79328c8b790..9c5563dcb856e 100644
> --- a/drivers/gpu/drm/msm/dp/dp_display.c
> +++ b/drivers/gpu/drm/msm/dp/dp_display.c
[ ... ]
> @@ -723,13 +719,12 @@ static int msm_dp_display_disable(struct msm_dp_display_private *dp,
> {
> struct msm_dp *msm_dp_display = &dp->msm_dp_display;
>
> - if (!msm_dp_display->power_on)
> - return 0;
> -
> msm_dp_panel_disable_vsc_sdp(msm_dp_panel);
>
> msm_dp_ctrl_off_pixel_clk(dp->ctrl, msm_dp_panel->stream_id);
>
> + msm_dp_display->active_stream_cnt--;
[Severity: Critical]
If msm_dp_display_prepare_link() fails early (such as when sink_count == 0),
the DP link clocks remain off and the stream is not initialized. Because DRM
core atomic enable callbacks return void, the teardown path will still execute.
Will removing this check cause a regression by unconditionally executing
hardware accesses and decrementing the stream count?
If msm_dp_display_disable() is called when the stream failed to enable, it
results in:
msm_dp_display_disable()
-> msm_dp_panel_disable_vsc_sdp()
-> msm_dp_read_link(panel, MMSS_DP_SDP_CFG)
Reading this register while link clocks are disabled triggers a synchronous
external abort (kernel panic).
Furthermore, does this allow active_stream_cnt to underflow? If it wraps to
UINT_MAX, the subsequent call to msm_dp_display_unprepare() would evaluate
active_stream_cnt as true and bypass the PHY teardown and
pm_runtime_put_sync() steps.
> +
> drm_dbg_dp(dp->drm_dev, "sink count: %d\n", dp->link->sink_count);
> return 0;
> }
[ ... ]
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=14
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 15/29] drm/msm/dp: factor out _helper variants of bridge ops accepting a panel
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (13 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 14/29] drm/msm/dp: replace power_on with active_stream_cnt Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 9:21 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 16/29] drm/msm/dp: add link_ready to manage link-level operations Yongxing Mou
` (13 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar, Dmitry Baryshkov
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
The atomic bridge callbacks (set_mode / enable / disable /
post_disable) on dp_display currently hard-code dp->panel. For
DP MST every stream has its own msm_dp_panel that the MST
encoder owns, so the same enable/disable sequence needs to be
invokable against an arbitrary panel.
Introduce *_helper variants that take struct msm_dp_panel * and
reduce the existing atomic_* callbacks to thin wrappers that
pass dp->panel. No SST-path behaviour change.
Also drop the static qualifier from msm_dp_display_prepare_link()
and msm_dp_display_unprepare() and change them to take
struct msm_dp * so the upcoming MST encoder code can drive
link-level prepare/unprepare uniformly through the public API.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_display.c | 100 +++++++++++++++++++++++++-----------
drivers/gpu/drm/msm/dp/dp_display.h | 12 +++++
2 files changed, 82 insertions(+), 30 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 9c5563dcb856..6103fa67f3ee 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -625,12 +625,14 @@ static int msm_dp_display_set_mode(struct msm_dp *msm_dp_display,
return 0;
}
-static int msm_dp_display_prepare_link(struct msm_dp_display_private *dp)
+int msm_dp_display_prepare_link(struct msm_dp *msm_dp_display)
{
- struct msm_dp *msm_dp_display = &dp->msm_dp_display;
+ struct msm_dp_display_private *dp;
int rc = 0;
bool force_link_train = false;
+ dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
drm_dbg_dp(dp->drm_dev, "sink_count=%d\n", dp->link->sink_count);
if (msm_dp_display->is_edp)
@@ -1448,69 +1450,98 @@ int msm_dp_modeset_init(struct msm_dp *msm_dp_display, struct drm_device *dev,
return 0;
}
-void msm_dp_display_atomic_pre_enable(struct msm_dp *msm_dp_display,
- struct drm_atomic_commit *state)
+int msm_dp_display_set_mode_helper(struct msm_dp *msm_dp_display,
+ struct drm_atomic_commit *state,
+ struct drm_encoder *drm_encoder,
+ struct msm_dp_panel *msm_dp_panel)
{
- struct msm_dp_display_private *dp;
struct drm_crtc *crtc;
struct drm_crtc_state *crtc_state;
- dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
-
- crtc = drm_atomic_get_new_crtc_for_encoder(state, msm_dp_display->bridge->encoder);
+ crtc = drm_atomic_get_new_crtc_for_encoder(state, drm_encoder);
if (!crtc)
- return;
+ return 0;
crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
- /*
- * The DPU encoder's .atomic_enable() reads the mode's YUV420 / wide bus
- * state and runs before the bridge's .atomic_enable(), so the mode must
- * be programmed here, in .atomic_pre_enable().
- */
- msm_dp_display_set_mode(msm_dp_display, &crtc_state->adjusted_mode, dp->panel);
+ return msm_dp_display_set_mode(msm_dp_display, &crtc_state->adjusted_mode, msm_dp_panel);
}
-void msm_dp_display_atomic_enable(struct msm_dp *msm_dp_display,
- struct drm_atomic_commit *state)
+void msm_dp_display_atomic_pre_enable(struct msm_dp *msm_dp_display,
+ struct drm_atomic_commit *state)
{
int rc = 0;
struct msm_dp_display_private *dp;
dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
- rc = msm_dp_display_prepare_link(dp);
+ rc = msm_dp_display_set_mode_helper(msm_dp_display, state,
+ msm_dp_display->bridge->encoder, dp->panel);
if (rc) {
- DRM_ERROR("DP display prepare failed, rc=%d\n", rc);
+ DRM_ERROR("Failed to perform a mode set, rc=%d\n", rc);
return;
}
- rc = msm_dp_display_enable(dp, dp->panel);
+ rc = msm_dp_display_prepare_link(msm_dp_display);
+ if (rc)
+ DRM_ERROR("DP display prepare failed, rc=%d\n", rc);
+}
+
+void msm_dp_display_enable_helper(struct msm_dp *msm_dp_display, struct msm_dp_panel *msm_dp_panel)
+{
+ int rc = 0;
+ struct msm_dp_display_private *dp;
+
+ dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+ rc = msm_dp_display_enable(dp, msm_dp_panel);
if (rc)
DRM_ERROR("DP display enable failed, rc=%d\n", rc);
rc = msm_dp_display_post_enable(msm_dp_display);
if (rc) {
DRM_ERROR("DP display post enable failed, rc=%d\n", rc);
- msm_dp_display_disable(dp, dp->panel);
+ msm_dp_display_disable(dp, msm_dp_panel);
}
drm_dbg_dp(msm_dp_display->drm_dev, "type=%d Done\n", msm_dp_display->connector_type);
}
+void msm_dp_display_atomic_enable(struct msm_dp *msm_dp_display,
+ struct drm_atomic_commit *state)
+{
+ struct msm_dp_display_private *dp;
+
+ dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+ msm_dp_display_enable_helper(msm_dp_display, dp->panel);
+}
+
+void msm_dp_display_disable_helper(struct msm_dp *msm_dp_display,
+ struct msm_dp_panel *msm_dp_panel)
+{
+ struct msm_dp_display_private *dp;
+
+ dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+ msm_dp_ctrl_push_vcpf(dp->ctrl, msm_dp_panel);
+ msm_dp_ctrl_mst_timeslot_setup(dp->ctrl);
+ msm_dp_ctrl_mst_send_act(dp->ctrl, msm_dp_panel);
+}
+
void msm_dp_display_atomic_disable(struct msm_dp *dp)
{
struct msm_dp_display_private *msm_dp_display;
msm_dp_display = container_of(dp, struct msm_dp_display_private, msm_dp_display);
- msm_dp_ctrl_push_vcpf(msm_dp_display->ctrl, msm_dp_display->panel);
- msm_dp_ctrl_mst_timeslot_setup(msm_dp_display->ctrl);
- msm_dp_ctrl_mst_send_act(msm_dp_display->ctrl, msm_dp_display->panel);
+ msm_dp_display_disable_helper(dp, msm_dp_display->panel);
}
-static void msm_dp_display_unprepare(struct msm_dp_display_private *dp)
+void msm_dp_display_unprepare(struct msm_dp *msm_dp_display)
{
- struct msm_dp *msm_dp_display = &dp->msm_dp_display;
+ struct msm_dp_display_private *dp;
+
+ dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
if (msm_dp_display->active_stream_cnt) {
drm_dbg_dp(dp->drm_dev, "stream still active, return\n");
@@ -1530,11 +1561,9 @@ static void msm_dp_display_unprepare(struct msm_dp_display_private *dp)
msm_dp_display_host_phy_exit(dp);
pm_runtime_put_sync(&msm_dp_display->pdev->dev);
-
- drm_dbg_dp(dp->drm_dev, "type=%d Done\n", msm_dp_display->connector_type);
}
-void msm_dp_display_atomic_post_disable(struct msm_dp *dp)
+void msm_dp_display_atomic_post_disable_helper(struct msm_dp *dp, struct msm_dp_panel *msm_dp_panel)
{
struct msm_dp_display_private *msm_dp_display;
@@ -1545,7 +1574,18 @@ void msm_dp_display_atomic_post_disable(struct msm_dp *dp)
msm_dp_display_audio_notify_disable(msm_dp_display);
- msm_dp_display_disable(msm_dp_display, msm_dp_display->panel);
+ msm_dp_display_disable(msm_dp_display, msm_dp_panel);
+
+ drm_dbg_dp(dp->drm_dev, "type=%d Done\n", dp->connector_type);
+}
+
+void msm_dp_display_atomic_post_disable(struct msm_dp *msm_dp_display)
+{
+ struct msm_dp_display_private *dp;
+
+ dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+ msm_dp_display_atomic_post_disable_helper(msm_dp_display, dp->panel);
msm_dp_display_unprepare(msm_dp_display);
}
diff --git a/drivers/gpu/drm/msm/dp/dp_display.h b/drivers/gpu/drm/msm/dp/dp_display.h
index 7bd510cecb44..9ecd5025fe4a 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.h
+++ b/drivers/gpu/drm/msm/dp/dp_display.h
@@ -45,5 +45,17 @@ enum drm_mode_status msm_dp_display_mode_valid(struct msm_dp *dp,
const struct drm_display_mode *mode);
int msm_dp_display_set_stream_info(struct msm_dp *msm_dp_display, struct msm_dp_panel *panel,
u32 start_slot, u32 num_slots, u32 pbn);
+void msm_dp_display_enable_helper(struct msm_dp *msm_dp_display,
+ struct msm_dp_panel *msm_dp_panel);
+void msm_dp_display_disable_helper(struct msm_dp *msm_dp_display,
+ struct msm_dp_panel *msm_dp_panel);
+void msm_dp_display_atomic_post_disable_helper(struct msm_dp *msm_dp_display,
+ struct msm_dp_panel *msm_dp_panel);
+int msm_dp_display_set_mode_helper(struct msm_dp *msm_dp_display,
+ struct drm_atomic_commit *state,
+ struct drm_encoder *drm_encoder,
+ struct msm_dp_panel *msm_dp_panel);
+int msm_dp_display_prepare_link(struct msm_dp *msm_dp_display);
+void msm_dp_display_unprepare(struct msm_dp *dp);
#endif /* _DP_DISPLAY_H_ */
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 15/29] drm/msm/dp: factor out _helper variants of bridge ops accepting a panel
2026-08-31 8:17 ` [PATCH v6 15/29] drm/msm/dp: factor out _helper variants of bridge ops accepting a panel Yongxing Mou
@ 2026-08-31 9:21 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 9:21 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [Critical] Unclocked register access and system crash in atomic_disable if link preparation fails.
- [High] Sleeping function called from atomic context in the atomic_post_disable path.
--
commit e10b321045ec4e6478af1b4a9b441fca4e712881
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
Subject: drm/msm/dp: factor out _helper variants of bridge ops accepting a panel
This commit factors out helper variants of DP bridge operations to accept
arbitrary panels, facilitating MST support. It updates the atomic callbacks
to act as thin wrappers around these helpers and modifies prepare/unprepare
functions to use the generic msm_dp structure.
> diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
> index 9c5563dcb856e..6103fa67f3ee9 100644
> --- a/drivers/gpu/drm/msm/dp/dp_display.c
> +++ b/drivers/gpu/drm/msm/dp/dp_display.c
[ ... ]
> +void msm_dp_display_disable_helper(struct msm_dp *msm_dp_display,
> + struct msm_dp_panel *msm_dp_panel)
> +{
> + struct msm_dp_display_private *dp;
> +
> + dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
> +
> + msm_dp_ctrl_push_vcpf(dp->ctrl, msm_dp_panel);
> + msm_dp_ctrl_mst_timeslot_setup(dp->ctrl);
> + msm_dp_ctrl_mst_send_act(dp->ctrl, msm_dp_panel);
> +}
[Severity: Critical]
This isn't a bug introduced by this patch, but does this sequence
unconditionally write to hardware registers without ensuring the link
is prepared?
If msm_dp_display_prepare_link() fails earlier in the atomic commit path,
the hardware clocks and power domains are not enabled. Because the
atomic_pre_enable() callback returns void, the DRM core still considers
the display enabled.
On a subsequent disable, msm_dp_display_atomic_disable() unconditionally
calls this helper. Accessing hardware MMIO registers like REG_DP_STATE_CTRL
via msm_dp_ctrl_push_vcpf() when the clocks are disabled causes a
synchronous external abort (kernel panic).
Could we add a link readiness check to safely skip these MMIO writes if the
display is not powered on?
[ ... ]
> -static void msm_dp_display_unprepare(struct msm_dp_display_private *dp)
> +void msm_dp_display_unprepare(struct msm_dp *msm_dp_display)
> {
[ ... ]
> if (msm_dp_display->active_stream_cnt) {
> drm_dbg_dp(dp->drm_dev, "stream still active, return\n");
> @@ -1530,11 +1561,9 @@ static void msm_dp_display_unprepare(struct msm_dp_display_private *dp)
> msm_dp_display_host_phy_exit(dp);
>
> pm_runtime_put_sync(&msm_dp_display->pdev->dev);
[Severity: High]
This is a pre-existing issue, but does this call chain execute sleeping
operations from an atomic context?
The atomic_post_disable() callback executes in an atomic context where
sleeping is explicitly forbidden. However, it calls
msm_dp_display_unprepare(), which in turn calls pm_runtime_put_sync().
This synchronous put operation suspends the device via:
pm_runtime_put_sync() -> msm_dp_pm_runtime_suspend() -> disable_irq()
Since disable_irq() can sleep, this causes kernel warnings and potential
deadlocks during the atomic modeset.
Should this synchronous power management operation be deferred or handled
outside of the atomic disable path?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=15
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 16/29] drm/msm/dp: add link_ready to manage link-level operations
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (14 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 15/29] drm/msm/dp: factor out _helper variants of bridge ops accepting a panel Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 9:26 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 17/29] drm/msm/dp: add msm_dp_display_get_panel() to initialize DP panel Yongxing Mou
` (12 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
In MST mode, multiple streams share the same DP link. Track a link_ready
state so msm_dp_display_prepare_link() runs only once per link and
repeated calls are skipped.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_display.c | 33 +++++++++++++++++++++++++--------
drivers/gpu/drm/msm/dp/dp_display.h | 1 +
2 files changed, 26 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 6103fa67f3ee..90e3d2c4ef47 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -638,6 +638,10 @@ int msm_dp_display_prepare_link(struct msm_dp *msm_dp_display)
if (msm_dp_display->is_edp)
msm_dp_hpd_plug_handle(dp);
+ /* Serialized by modeset lock or mst_lock. */
+ if (msm_dp_display->link_ready)
+ return 0;
+
rc = pm_runtime_resume_and_get(&msm_dp_display->pdev->dev);
if (rc) {
DRM_ERROR("failed to pm_runtime_resume\n");
@@ -659,7 +663,11 @@ int msm_dp_display_prepare_link(struct msm_dp *msm_dp_display)
}
}
- return msm_dp_ctrl_prepare_stream_on(dp->ctrl, dp->panel, force_link_train);
+ rc = msm_dp_ctrl_prepare_stream_on(dp->ctrl, dp->panel, force_link_train);
+ if (!rc)
+ msm_dp_display->link_ready = true;
+
+ return rc;
}
static int msm_dp_display_enable(struct msm_dp_display_private *dp,
@@ -1493,14 +1501,16 @@ void msm_dp_display_enable_helper(struct msm_dp *msm_dp_display, struct msm_dp_p
dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
- rc = msm_dp_display_enable(dp, msm_dp_panel);
- if (rc)
- DRM_ERROR("DP display enable failed, rc=%d\n", rc);
+ if (msm_dp_display->link_ready) {
+ rc = msm_dp_display_enable(dp, msm_dp_panel);
+ if (rc)
+ DRM_ERROR("DP display enable failed, rc=%d\n", rc);
- rc = msm_dp_display_post_enable(msm_dp_display);
- if (rc) {
- DRM_ERROR("DP display post enable failed, rc=%d\n", rc);
- msm_dp_display_disable(dp, msm_dp_panel);
+ rc = msm_dp_display_post_enable(msm_dp_display);
+ if (rc) {
+ DRM_ERROR("DP display post enable failed, rc=%d\n", rc);
+ msm_dp_display_disable(dp, msm_dp_panel);
+ }
}
drm_dbg_dp(msm_dp_display->drm_dev, "type=%d Done\n", msm_dp_display->connector_type);
@@ -1543,6 +1553,11 @@ void msm_dp_display_unprepare(struct msm_dp *msm_dp_display)
dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+ if (!msm_dp_display->link_ready) {
+ drm_dbg_dp(dp->drm_dev, "Link already setup, return\n");
+ return;
+ }
+
if (msm_dp_display->active_stream_cnt) {
drm_dbg_dp(dp->drm_dev, "stream still active, return\n");
return;
@@ -1561,6 +1576,8 @@ void msm_dp_display_unprepare(struct msm_dp *msm_dp_display)
msm_dp_display_host_phy_exit(dp);
pm_runtime_put_sync(&msm_dp_display->pdev->dev);
+
+ msm_dp_display->link_ready = false;
}
void msm_dp_display_atomic_post_disable_helper(struct msm_dp *dp, struct msm_dp_panel *msm_dp_panel)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.h b/drivers/gpu/drm/msm/dp/dp_display.h
index 9ecd5025fe4a..51eace1d1346 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.h
+++ b/drivers/gpu/drm/msm/dp/dp_display.h
@@ -20,6 +20,7 @@ struct msm_dp {
bool audio_enabled;
u32 active_stream_cnt;
bool mst_active;
+ bool link_ready;
unsigned int connector_type;
bool is_edp;
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 16/29] drm/msm/dp: add link_ready to manage link-level operations
2026-08-31 8:17 ` [PATCH v6 16/29] drm/msm/dp: add link_ready to manage link-level operations Yongxing Mou
@ 2026-08-31 9:26 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 9:26 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] PM runtime reference and PHY state are leaked when msm_dp_display_prepare_link() fails after acquiring resources.
- [High] active_stream_cnt unconditionally underflows to UINT_MAX when display disable is called after a failed link preparation.
- [Low] Logically inverted debug message for !link_ready condition.
--
commit 229804790247809bb388c425e9b3744dffd08236
Author: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
drm/msm/dp: add link_ready to manage link-level operations
In MST mode, multiple streams share the same DP link. Track a link_ready
state so msm_dp_display_prepare_link() runs only once per link and
repeated calls are skipped.
> diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
> index 6103fa67f3ee9..90e3d2c4ef478 100644
> --- a/drivers/gpu/drm/msm/dp/dp_display.c
> +++ b/drivers/gpu/drm/msm/dp/dp_display.c
> @@ -638,6 +638,10 @@ int msm_dp_display_prepare_link(struct msm_dp *msm_dp_display)
> if (msm_dp_display->is_edp)
> msm_dp_hpd_plug_handle(dp);
>
> + /* Serialized by modeset lock or mst_lock. */
> + if (msm_dp_display->link_ready)
> + return 0;
> +
> rc = pm_runtime_resume_and_get(&msm_dp_display->pdev->dev);
> if (rc) {
> DRM_ERROR("failed to pm_runtime_resume\n");
> @@ -659,7 +663,11 @@ int msm_dp_display_prepare_link(struct msm_dp *msm_dp_display)
> }
> }
>
> - return msm_dp_ctrl_prepare_stream_on(dp->ctrl, dp->panel, force_link_train);
> + rc = msm_dp_ctrl_prepare_stream_on(dp->ctrl, dp->panel, force_link_train);
> + if (!rc)
> + msm_dp_display->link_ready = true;
> +
> + return rc;
> }
[Severity: High]
Is there a leak of the PM runtime reference here?
If msm_dp_display_prepare_link() fails after acquiring the PM reference
but before setting link_ready to true:
drivers/gpu/drm/msm/dp/dp_display.c:msm_dp_display_prepare_link() {
...
rc = pm_runtime_resume_and_get(&msm_dp_display->pdev->dev);
...
if (dp->link->sink_count == 0)
return -ENOTCONN;
...
}
It appears the new early return in msm_dp_display_unprepare() will skip
dropping the PM reference and exiting the PHY on error paths:
drivers/gpu/drm/msm/dp/dp_display.c:msm_dp_display_unprepare() {
...
if (!msm_dp_display->link_ready) {
drm_dbg_dp(dp->drm_dev, "Link already setup, return\n");
return;
}
...
pm_runtime_put_sync(&msm_dp_display->pdev->dev);
...
}
[ ... ]
> @@ -1493,14 +1501,16 @@ void msm_dp_display_enable_helper(struct msm_dp *msm_dp_display, struct msm_dp_p
>
> dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
>
> - rc = msm_dp_display_enable(dp, msm_dp_panel);
> - if (rc)
> - DRM_ERROR("DP display enable failed, rc=%d\n", rc);
> + if (msm_dp_display->link_ready) {
> + rc = msm_dp_display_enable(dp, msm_dp_panel);
> + if (rc)
> + DRM_ERROR("DP display enable failed, rc=%d\n", rc);
>
> - rc = msm_dp_display_post_enable(msm_dp_display);
> - if (rc) {
> - DRM_ERROR("DP display post enable failed, rc=%d\n", rc);
> - msm_dp_display_disable(dp, msm_dp_panel);
> + rc = msm_dp_display_post_enable(msm_dp_display);
> + if (rc) {
> + DRM_ERROR("DP display post enable failed, rc=%d\n", rc);
> + msm_dp_display_disable(dp, msm_dp_panel);
> + }
> }
>
> drm_dbg_dp(msm_dp_display->drm_dev, "type=%d Done\n", msm_dp_display->connector_type);
[Severity: High]
Can active_stream_cnt underflow during teardown?
If msm_dp_display_prepare_link() fails, link_ready remains false. The call
to msm_dp_display_enable() above is skipped, and active_stream_cnt is not
incremented.
However, during teardown, msm_dp_display_disable() is called without checking
link_ready:
drivers/gpu/drm/msm/dp/dp_display.c:msm_dp_display_disable() {
...
msm_dp_display->active_stream_cnt--;
...
}
Will this decrement an already zero active_stream_cnt, breaking subsequent
modesets that check if (!msm_dp_display->active_stream_cnt)?
[ ... ]
> @@ -1543,6 +1553,11 @@ void msm_dp_display_unprepare(struct msm_dp *msm_dp_display)
>
> dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
>
> + if (!msm_dp_display->link_ready) {
> + drm_dbg_dp(dp->drm_dev, "Link already setup, return\n");
> + return;
> + }
> +
[Severity: Low]
Is this debug message logically inverted? It prints "Link already setup, return"
when the condition explicitly checks that the link is NOT ready
(!msm_dp_display->link_ready).
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=16
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 17/29] drm/msm/dp: add msm_dp_display_get_panel() to initialize DP panel
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (15 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 16/29] drm/msm/dp: add link_ready to manage link-level operations Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 9:28 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 18/29] drm/msm/dp: introduce dp_mst_drm module Yongxing Mou
` (11 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
Add an API msm_dp_display_get_panel() to initialize and return a DP
panel to be used by DP MST module. Since some of the fields of
DP panel are private, dp_display module needs to initialize these
parts and return the panel back.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 9 +++++++++
drivers/gpu/drm/msm/dp/dp_ctrl.h | 1 +
drivers/gpu/drm/msm/dp/dp_display.c | 27 +++++++++++++++++++++++++++
drivers/gpu/drm/msm/dp/dp_display.h | 2 ++
4 files changed, 39 insertions(+)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 73aabd219125..c4936e8ba48f 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -3130,6 +3130,15 @@ bool msm_dp_ctrl_stream_clks_on(struct msm_dp_ctrl *msm_dp_ctrl,
return ctrl->stream_clks_on[stream_id];
}
+int msm_dp_ctrl_get_stream_cnt(struct msm_dp_ctrl *msm_dp_ctrl)
+{
+ struct msm_dp_ctrl_private *ctrl;
+
+ ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+ return ctrl->num_pixel_clks;
+}
+
struct msm_dp_ctrl *msm_dp_ctrl_get(struct device *dev, struct msm_dp_link *link,
struct drm_dp_aux *aux,
struct phy *phy,
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.h b/drivers/gpu/drm/msm/dp/dp_ctrl.h
index e8b445c552f7..111300784edd 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.h
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.h
@@ -61,6 +61,7 @@ void msm_dp_ctrl_disable_irq(struct msm_dp_ctrl *msm_dp_ctrl);
void msm_dp_ctrl_reinit_phy(struct msm_dp_ctrl *msm_dp_ctrl);
bool msm_dp_ctrl_stream_clks_on(struct msm_dp_ctrl *dp_ctrl,
enum msm_dp_stream_id stream_id);
+int msm_dp_ctrl_get_stream_cnt(struct msm_dp_ctrl *dp_ctrl);
int msm_dp_ctrl_mst_send_act(struct msm_dp_ctrl *msm_dp_ctrl,
struct msm_dp_panel *panel);
void msm_dp_ctrl_mst_timeslot_setup(struct msm_dp_ctrl *msm_dp_ctrl);
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 90e3d2c4ef47..6952f83db006 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -529,6 +529,33 @@ static int msm_dp_irq_hpd_handle(struct msm_dp_display_private *dp)
return rc;
}
+struct msm_dp_panel *msm_dp_display_get_panel(struct msm_dp *msm_dp_display,
+ enum msm_dp_stream_id stream_id)
+{
+ struct msm_dp_display_private *dp;
+ struct msm_dp_panel *dp_panel;
+
+ dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+ if (stream_id >= msm_dp_ctrl_get_stream_cnt(dp->ctrl)) {
+ DRM_ERROR("invalid stream_id %d\n", stream_id);
+ return NULL;
+ }
+
+ dp_panel = msm_dp_panel_get(&dp->msm_dp_display.pdev->dev, dp->aux, dp->link,
+ dp->link_base, dp->mst2link_base, dp->mst3link_base,
+ dp->pixel_base[stream_id]);
+
+ if (IS_ERR(dp_panel)) {
+ DRM_ERROR("failed to initialize panel\n");
+ return NULL;
+ }
+
+ dp_panel->stream_id = stream_id;
+
+ return dp_panel;
+}
+
static void msm_dp_display_deinit_sub_modules(struct msm_dp_display_private *dp)
{
msm_dp_audio_put(dp->audio);
diff --git a/drivers/gpu/drm/msm/dp/dp_display.h b/drivers/gpu/drm/msm/dp/dp_display.h
index 51eace1d1346..4d4349068c2f 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.h
+++ b/drivers/gpu/drm/msm/dp/dp_display.h
@@ -59,4 +59,6 @@ int msm_dp_display_set_mode_helper(struct msm_dp *msm_dp_display,
int msm_dp_display_prepare_link(struct msm_dp *msm_dp_display);
void msm_dp_display_unprepare(struct msm_dp *dp);
+struct msm_dp_panel *msm_dp_display_get_panel(struct msm_dp *msm_dp_display,
+ enum msm_dp_stream_id stream_id);
#endif /* _DP_DISPLAY_H_ */
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 17/29] drm/msm/dp: add msm_dp_display_get_panel() to initialize DP panel
2026-08-31 8:17 ` [PATCH v6 17/29] drm/msm/dp: add msm_dp_display_get_panel() to initialize DP panel Yongxing Mou
@ 2026-08-31 9:28 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 9:28 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] msm_dp_display_get_panel() blindly allocates a duplicate panel structure for a given stream ID, leading to desynchronized internal state.
- [High] Missing NULL pointer check for optional pixel_base resource leads to a kernel panic during stream setup.
--
commit 09c5d687d7add705558b0ff0b93169b01fc6922e
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
drm/msm/dp: add msm_dp_display_get_panel() to initialize DP panel
This commit adds the msm_dp_display_get_panel API to initialize and
return a DP panel structure for use by the DP MST module.
> diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
> index 90e3d2c4ef478..6952f83db0065 100644
> --- a/drivers/gpu/drm/msm/dp/dp_display.c
> +++ b/drivers/gpu/drm/msm/dp/dp_display.c
[ ... ]
> @@ -529,6 +529,33 @@ static int msm_dp_irq_hpd_handle(struct msm_dp_display_private *dp)
> return rc;
> }
>
> +struct msm_dp_panel *msm_dp_display_get_panel(struct msm_dp *msm_dp_display,
> + enum msm_dp_stream_id stream_id)
> +{
> + struct msm_dp_display_private *dp;
> + struct msm_dp_panel *dp_panel;
> +
> + dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
> +
> + if (stream_id >= msm_dp_ctrl_get_stream_cnt(dp->ctrl)) {
> + DRM_ERROR("invalid stream_id %d\n", stream_id);
> + return NULL;
> + }
> +
> + dp_panel = msm_dp_panel_get(&dp->msm_dp_display.pdev->dev, dp->aux, dp->link,
> + dp->link_base, dp->mst2link_base, dp->mst3link_base,
> + dp->pixel_base[stream_id]);
[Severity: High]
Does this inadvertently create a duplicate panel structure that lacks
initialized state?
When an MST stream is enabled, this dynamically allocates a new panel struct
where link_info is zeroed. Since the primary panel usually populates dpcd and
link_info (via msm_dp_panel_read_link_caps()), bandwidth calculations in
msm_dp_panel_get_supported_bpp() will evaluate to 0 for this secondary panel.
Will this permanently degrade the display to the minimum 18bpp fallback?
[Severity: High]
Can dp->pixel_base[stream_id] be NULL here?
The pixel_base memory regions are explicitly handled as optional in
msm_dp_display_get_io(). If the device tree specifies a pixel clock but
omits the corresponding register region, passing dp->pixel_base[stream_id]
as NULL to msm_dp_panel_get() stores a NULL panel->pixel_base.
When the display pipeline attempts to configure the panel timings later
(e.g., via msm_dp_write_pn()), could it dereference this NULL pointer and
cause a panic?
> +
> + if (IS_ERR(dp_panel)) {
> + DRM_ERROR("failed to initialize panel\n");
> + return NULL;
> + }
> +
> + dp_panel->stream_id = stream_id;
> +
> + return dp_panel;
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=17
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 18/29] drm/msm/dp: introduce dp_mst_drm module
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (16 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 17/29] drm/msm/dp: add msm_dp_display_get_panel() to initialize DP panel Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 9:37 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 19/29] drm/msm/dp: add MST connector creation and topology callbacks Yongxing Mou
` (10 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
Add the dp_mst_drm module and the core MST manager data structures.
Introduce the MST manager object, per-stream encoder state and the
initialization path for creating a DRM MST topology manager associated
with a DP controller.
Also add the registration hooks used to initialize the MST manager
during DP device setup.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/Makefile | 3 +-
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 12 +++++++-
drivers/gpu/drm/msm/dp/dp_display.c | 19 ++++++++++++
drivers/gpu/drm/msm/dp/dp_display.h | 4 +++
drivers/gpu/drm/msm/dp/dp_mst_drm.c | 54 +++++++++++++++++++++++++++++++++
drivers/gpu/drm/msm/dp/dp_mst_drm.h | 12 ++++++++
drivers/gpu/drm/msm/msm_drv.h | 12 ++++++++
7 files changed, 114 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/Makefile b/drivers/gpu/drm/msm/Makefile
index d0c3a4c6703b..31a15636958c 100644
--- a/drivers/gpu/drm/msm/Makefile
+++ b/drivers/gpu/drm/msm/Makefile
@@ -145,7 +145,8 @@ msm-display-$(CONFIG_DRM_MSM_DP)+= dp/dp_aux.o \
dp/dp_link.o \
dp/dp_panel.o \
dp/dp_audio.o \
- dp/dp_utils.o
+ dp/dp_utils.o \
+ dp/dp_mst_drm.o
msm-display-$(CONFIG_DRM_MSM_HDMI_HDCP) += hdmi/hdmi_hdcp.o
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
index da3556eb6ecc..66cabac0a726 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
@@ -655,7 +655,7 @@ static int _dpu_kms_initialize_displayport(struct drm_device *dev,
struct msm_display_info info;
bool yuv_supported;
int rc;
- int i;
+ int i, stream_cnt;
for (i = 0; i < ARRAY_SIZE(priv->kms->dp); i++) {
if (!priv->kms->dp[i])
@@ -678,6 +678,16 @@ static int _dpu_kms_initialize_displayport(struct drm_device *dev,
DPU_ERROR("modeset_init failed for DP, rc = %d\n", rc);
return rc;
}
+
+ stream_cnt = msm_dp_get_mst_max_stream(priv->kms->dp[i]);
+
+ if (stream_cnt > 1) {
+ rc = msm_dp_mst_register(priv->kms->dp[i]);
+ if (rc) {
+ DPU_ERROR("dp_mst_init failed for DP, rc = %d\n", rc);
+ return rc;
+ }
+ }
}
return 0;
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 6952f83db006..c015af868801 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -27,6 +27,7 @@
#include "dp_drm.h"
#include "dp_audio.h"
#include "dp_debug.h"
+#include "dp_mst_drm.h"
static bool psr_enabled = false;
module_param(psr_enabled, bool, 0);
@@ -1270,6 +1271,24 @@ static int msm_dp_display_get_io(struct msm_dp_display_private *display)
return 0;
}
+int msm_dp_get_mst_max_stream(struct msm_dp *msm_dp_display)
+{
+ struct msm_dp_display_private *dp;
+
+ dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+ return msm_dp_ctrl_get_stream_cnt(dp->ctrl);
+}
+
+int msm_dp_mst_register(struct msm_dp *msm_dp_display)
+{
+ struct msm_dp_display_private *dp;
+
+ dp = container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+ return msm_dp_mst_mgr_init(msm_dp_display, msm_dp_ctrl_get_stream_cnt(dp->ctrl), dp->aux);
+}
+
static int msm_dp_display_probe(struct platform_device *pdev)
{
int rc = 0;
diff --git a/drivers/gpu/drm/msm/dp/dp_display.h b/drivers/gpu/drm/msm/dp/dp_display.h
index 4d4349068c2f..ca2faf478c95 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.h
+++ b/drivers/gpu/drm/msm/dp/dp_display.h
@@ -24,6 +24,8 @@ struct msm_dp {
unsigned int connector_type;
bool is_edp;
+ void *msm_dp_mst;
+
struct msm_dp_audio *msm_dp_audio;
bool psr_supported;
};
@@ -59,6 +61,8 @@ int msm_dp_display_set_mode_helper(struct msm_dp *msm_dp_display,
int msm_dp_display_prepare_link(struct msm_dp *msm_dp_display);
void msm_dp_display_unprepare(struct msm_dp *dp);
+int msm_dp_get_mst_max_stream(struct msm_dp *msm_dp_display);
+int msm_dp_mst_register(struct msm_dp *msm_dp_display);
struct msm_dp_panel *msm_dp_display_get_panel(struct msm_dp *msm_dp_display,
enum msm_dp_stream_id stream_id);
#endif /* _DP_DISPLAY_H_ */
diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.c b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
new file mode 100644
index 000000000000..648d3ec72a1d
--- /dev/null
+++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include <drm/drm_edid.h>
+#include <drm/drm_fixed.h>
+#include <drm/drm_atomic_helper.h>
+#include <drm/display/drm_dp_mst_helper.h>
+
+#include "dp_mst_drm.h"
+#include "dp_panel.h"
+
+struct msm_dp_mst_encoder {
+ struct drm_encoder *enc;
+ int stream_id;
+ struct msm_dp_panel *dp_panel;
+};
+
+struct msm_dp_mst {
+ struct drm_dp_mst_topology_mgr mst_mgr;
+ struct msm_dp_mst_encoder mst_encoders[DP_STREAM_MAX];
+ struct msm_dp *msm_dp;
+ struct drm_dp_aux *dp_aux;
+ u32 max_streams;
+};
+
+int msm_dp_mst_mgr_init(struct msm_dp *dp_display, u32 max_streams, struct drm_dp_aux *drm_aux)
+{
+ struct drm_device *dev = dp_display->drm_dev;
+ struct msm_dp_mst *mst;
+ int ret;
+
+ mst = devm_kzalloc(dev->dev, sizeof(*mst), GFP_KERNEL);
+ if (!mst)
+ return -ENOMEM;
+
+ mst->msm_dp = dp_display;
+ mst->max_streams = max_streams;
+ mst->dp_aux = drm_aux;
+
+ ret = drm_dp_mst_topology_mgr_init(&mst->mst_mgr, dev,
+ drm_aux,
+ 16,
+ max_streams,
+ dp_display->connector->base.id);
+ if (ret) {
+ drm_err(dev, "[MST] topology manager init failed\n");
+ return ret;
+ }
+
+ dp_display->msm_dp_mst = mst;
+ return 0;
+}
diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.h b/drivers/gpu/drm/msm/dp/dp_mst_drm.h
new file mode 100644
index 000000000000..e54d49cf3499
--- /dev/null
+++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ * Copyright (c) 2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef _DP_MST_DRM_H_
+#define _DP_MST_DRM_H_
+
+#include "dp_display.h"
+
+int msm_dp_mst_mgr_init(struct msm_dp *dp_display, u32 max_streams, struct drm_dp_aux *drm_aux);
+
+#endif /* _DP_MST_DRM_H_ */
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index eb4bbae8557b..8e98f7eb8724 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -357,6 +357,8 @@ void msm_dp_snapshot(struct msm_disp_state *disp_state, struct msm_dp *dp_displa
bool msm_dp_needs_periph_flush(const struct msm_dp *dp_display,
const struct drm_display_mode *mode);
bool msm_dp_wide_bus_available(const struct msm_dp *dp_display);
+int msm_dp_get_mst_max_stream(struct msm_dp *dp_display);
+int msm_dp_mst_register(struct msm_dp *dp_display);
#else
static inline int __init msm_dp_register(void)
@@ -389,6 +391,16 @@ static inline bool msm_dp_wide_bus_available(const struct msm_dp *dp_display)
return false;
}
+static inline int msm_dp_get_mst_max_stream(struct msm_dp *dp_display)
+{
+ return -EINVAL;
+}
+
+static inline int msm_dp_mst_register(struct msm_dp *dp_display)
+{
+ return -EINVAL;
+}
+
#endif
#ifdef CONFIG_DRM_MSM_MDP4
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 18/29] drm/msm/dp: introduce dp_mst_drm module
2026-08-31 8:17 ` [PATCH v6 18/29] drm/msm/dp: introduce dp_mst_drm module Yongxing Mou
@ 2026-08-31 9:37 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 9:37 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing teardown for DRM MST topology manager via drm_dp_mst_topology_mgr_destroy(), leading to leaked internal resources (workqueues, mutexes, payload arrays) and a Use-After-Free vulnerability.
--
commit 27699c490812d953e1c2e18da505fffee4442084
Author: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
drm/msm/dp: introduce dp_mst_drm module
This commit introduces the core MST manager data structures and the
initialization path for creating a DRM MST topology manager associated
with a DP controller. It also adds the registration hooks used to
initialize the MST manager during DP device setup.
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
[ ... ]
> @@ -678,6 +678,16 @@ static int _dpu_kms_initialize_displayport(struct drm_device *dev,
> DPU_ERROR("modeset_init failed for DP, rc = %d\n", rc);
> return rc;
> }
> +
> + stream_cnt = msm_dp_get_mst_max_stream(priv->kms->dp[i]);
> +
> + if (stream_cnt > 1) {
> + rc = msm_dp_mst_register(priv->kms->dp[i]);
> + if (rc) {
> + DPU_ERROR("dp_mst_init failed for DP, rc = %d\n", rc);
> + return rc;
[Severity: High]
If `msm_dp_mst_register()` fails on a subsequent DP port after successfully
registering a prior one in this loop, does returning early here leak the
successfully initialized MST managers from the previous iterations?
> + }
> + }
> }
>
> return 0;
[ ... ]
> diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.c b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
[ ... ]
> @@ -0,0 +1,54 @@
[ ... ]
> +int msm_dp_mst_mgr_init(struct msm_dp *dp_display, u32 max_streams, struct drm_dp_aux *drm_aux)
> +{
> + struct drm_device *dev = dp_display->drm_dev;
> + struct msm_dp_mst *mst;
> + int ret;
> +
> + mst = devm_kzalloc(dev->dev, sizeof(*mst), GFP_KERNEL);
> + if (!mst)
> + return -ENOMEM;
> +
> + mst->msm_dp = dp_display;
> + mst->max_streams = max_streams;
> + mst->dp_aux = drm_aux;
> +
> + ret = drm_dp_mst_topology_mgr_init(&mst->mst_mgr, dev,
> + drm_aux,
> + 16,
> + max_streams,
> + dp_display->connector->base.id);
[Severity: High]
Does this leak the MST topology manager resources?
`drm_dp_mst_topology_mgr_init()` creates non-devres-managed resources like
workqueues (`delayed_destroy_wq`) and background worker threads. Since `mst`
is allocated with `devm_kzalloc()`, it will be freed automatically upon
device unbind or probe failure.
Without a paired teardown action (e.g. via `devm_add_action_or_reset()`
calling `drm_dp_mst_topology_mgr_destroy()`), won't the active workqueues
and threads be left running?
Can this lead to a Use-After-Free when those background threads later
dereference the freed `mst` memory?
> + if (ret) {
> + drm_err(dev, "[MST] topology manager init failed\n");
> + return ret;
> + }
> +
> + dp_display->msm_dp_mst = mst;
> + return 0;
> +}
[ ... ]
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=18
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 19/29] drm/msm/dp: add MST connector creation and topology callbacks
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (17 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 18/29] drm/msm/dp: introduce dp_mst_drm module Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 20/29] drm/msm/dpu: pass msm_display_info to dpu_encoder_get_intf() Yongxing Mou
` (9 subsequent siblings)
28 siblings, 0 replies; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
Register the add_connector topology callback with the DRM MST manager
to create DRM connectors dynamically for MST ports as they appear.
Each MST port is represented by a DRM connector. The connectors are
attached to all available MST stream encoders, allowing encoder
assignment to be determined dynamically rather than being permanently
associated with a specific stream.
This enables MST sink ports to be exposed as DRM connectors.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_mst_drm.c | 240 ++++++++++++++++++++++++++++++++++++
1 file changed, 240 insertions(+)
diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.c b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
index 648d3ec72a1d..94a717ba7c82 100644
--- a/drivers/gpu/drm/msm/dp/dp_mst_drm.c
+++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
@@ -7,10 +7,20 @@
#include <drm/drm_fixed.h>
#include <drm/drm_atomic_helper.h>
#include <drm/display/drm_dp_mst_helper.h>
+#include <linux/pm_runtime.h>
#include "dp_mst_drm.h"
#include "dp_panel.h"
+#define to_dp_mst_connector(x) \
+ container_of((x), struct msm_dp_mst_connector, connector)
+
+struct msm_dp_mst_connector {
+ struct drm_connector connector;
+ struct drm_dp_mst_port *mst_port;
+ struct msm_dp_mst *dp_mst;
+};
+
struct msm_dp_mst_encoder {
struct drm_encoder *enc;
int stream_id;
@@ -25,6 +35,235 @@ struct msm_dp_mst {
u32 max_streams;
};
+static void dp_mst_connector_destroy(struct drm_connector *connector)
+{
+ struct msm_dp_mst_connector *mst_conn = to_dp_mst_connector(connector);
+
+ drm_connector_cleanup(connector);
+ drm_dp_mst_put_port_malloc(mst_conn->mst_port);
+ kfree(mst_conn);
+}
+
+static const struct drm_connector_funcs msm_dp_drm_mst_connector_funcs = {
+ .reset = drm_atomic_helper_connector_reset,
+ .destroy = dp_mst_connector_destroy,
+ .fill_modes = drm_helper_probe_single_connector_modes,
+ .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+ .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+};
+
+/* DP MST Connector OPs */
+static int
+msm_dp_mst_connector_detect(struct drm_connector *connector,
+ struct drm_modeset_acquire_ctx *ctx,
+ bool force)
+{
+ struct msm_dp_mst_connector *mst_conn = to_dp_mst_connector(connector);
+ struct msm_dp_mst *mst = mst_conn->dp_mst;
+ struct msm_dp *dp_display = mst->msm_dp;
+ struct device *dev = dp_display->drm_dev->dev;
+ enum drm_connector_status status = connector_status_disconnected;
+ int ret;
+
+ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ return status;
+
+ if (dp_display->mst_active)
+ status = drm_dp_mst_detect_port(connector,
+ ctx, &mst->mst_mgr, mst_conn->mst_port);
+
+ pm_runtime_put_autosuspend(dev);
+
+ return status;
+}
+
+static int msm_dp_mst_connector_get_modes(struct drm_connector *connector)
+{
+ struct msm_dp_mst_connector *mst_conn = to_dp_mst_connector(connector);
+ struct msm_dp_mst *mst = mst_conn->dp_mst;
+ const struct drm_edid *drm_edid;
+ int rc;
+
+ drm_edid = drm_dp_mst_edid_read(connector, &mst->mst_mgr, mst_conn->mst_port);
+ drm_edid_connector_update(connector, drm_edid);
+
+ rc = drm_edid_connector_add_modes(connector);
+
+ drm_edid_free(drm_edid);
+
+ return rc;
+}
+
+static enum drm_mode_status msm_dp_mst_connector_mode_valid(struct drm_connector *connector,
+ const struct drm_display_mode *mode)
+{
+ struct msm_dp_mst_connector *mst_conn;
+ struct drm_dp_mst_port *mst_port;
+ struct msm_dp *dp_display;
+ int required_pbn;
+
+ if (drm_connector_is_unregistered(connector))
+ return 0;
+
+ mst_conn = to_dp_mst_connector(connector);
+ mst_port = mst_conn->mst_port;
+ dp_display = mst_conn->dp_mst->msm_dp;
+
+ /* Use minimum possible bpp (6bpc RGB, 8b10b) to avoid rejecting modes
+ * that would be feasible at the actual link bpp. mode_valid must not
+ * depend on negotiated parameters.
+ */
+ required_pbn = drm_dp_calc_pbn_mode(mode->clock, (6 * 3) << 4);
+
+ if (required_pbn > mst_port->full_pbn) {
+ drm_dbg_dp(dp_display->drm_dev, "mode:%s not supported.\n", mode->name);
+ return MODE_CLOCK_HIGH;
+ }
+
+ return msm_dp_display_mode_valid(dp_display, &connector->display_info, mode);
+}
+
+static int msm_dp_mst_connector_atomic_check(struct drm_connector *connector,
+ struct drm_atomic_commit *state)
+{
+ struct msm_dp_mst_connector *mst_conn = to_dp_mst_connector(connector);
+ struct msm_dp_mst *mst = mst_conn->dp_mst;
+
+ return drm_dp_atomic_release_time_slots(state, &mst->mst_mgr, mst_conn->mst_port);
+}
+
+static int msm_dp_mst_encoder_stream_id(struct msm_dp_mst *mst,
+ struct drm_encoder *enc)
+{
+ int i;
+
+ for (i = 0; i < mst->max_streams; i++) {
+ if (mst->mst_encoders[i].enc == enc)
+ return mst->mst_encoders[i].stream_id;
+ }
+ return -1;
+}
+
+static struct drm_encoder *
+msm_dp_mst_atomic_best_encoder(struct drm_connector *connector, struct drm_atomic_commit *state)
+{
+ struct msm_dp_mst_connector *mst_conn = to_dp_mst_connector(connector);
+ struct msm_dp_mst *mst = mst_conn->dp_mst;
+ struct drm_connector_state *conn_state;
+ struct drm_connector *iter;
+ struct drm_connector_list_iter conn_iter;
+ u32 stream_mask = 0;
+ u32 i;
+
+ conn_state = drm_atomic_get_new_connector_state(state, connector);
+ if (!conn_state)
+ return NULL;
+
+ if (conn_state->best_encoder)
+ return conn_state->best_encoder;
+
+ drm_connector_list_iter_begin(connector->dev, &conn_iter);
+ drm_for_each_connector_iter(iter, &conn_iter) {
+ struct drm_connector_state *peer_state;
+ int stream_id;
+
+ if (iter == connector ||
+ iter->funcs != &msm_dp_drm_mst_connector_funcs ||
+ to_dp_mst_connector(iter)->dp_mst != mst)
+ continue;
+
+ peer_state = drm_atomic_get_new_connector_state(state, iter) ?: iter->state;
+ if (!peer_state || !peer_state->crtc || !peer_state->best_encoder)
+ continue;
+
+ stream_id = msm_dp_mst_encoder_stream_id(mst, peer_state->best_encoder);
+ if (stream_id >= 0 && stream_id < mst->max_streams)
+ stream_mask |= BIT(stream_id);
+ }
+ drm_connector_list_iter_end(&conn_iter);
+
+ for (i = 0; i < mst->max_streams; i++) {
+ if (!(stream_mask & BIT(i))) {
+ conn_state->best_encoder = mst->mst_encoders[i].enc;
+ return mst->mst_encoders[i].enc;
+ }
+ }
+
+ return NULL;
+}
+
+/* DRM MST callbacks */
+static const struct drm_connector_helper_funcs msm_dp_drm_mst_connector_helper_funcs = {
+ .get_modes = msm_dp_mst_connector_get_modes,
+ .detect_ctx = msm_dp_mst_connector_detect,
+ .mode_valid = msm_dp_mst_connector_mode_valid,
+ .atomic_best_encoder = msm_dp_mst_atomic_best_encoder,
+ .atomic_check = msm_dp_mst_connector_atomic_check,
+};
+
+static struct drm_connector *
+msm_dp_mst_add_connector(struct drm_dp_mst_topology_mgr *mgr,
+ struct drm_dp_mst_port *port, const char *pathprop)
+{
+ struct msm_dp_mst *mst = container_of(mgr, struct msm_dp_mst, mst_mgr);
+ struct drm_device *dev = mst->msm_dp->drm_dev;
+ struct msm_dp_mst_connector *mst_conn;
+ struct drm_connector *connector;
+ int rc, i;
+
+ mst_conn = kzalloc_obj(*mst_conn);
+ if (!mst_conn)
+ return NULL;
+
+ connector = &mst_conn->connector;
+ rc = drm_connector_dynamic_init(dev, connector,
+ &msm_dp_drm_mst_connector_funcs,
+ DRM_MODE_CONNECTOR_DisplayPort, NULL);
+ if (rc)
+ goto err_free;
+
+ mst_conn->dp_mst = mst;
+
+ drm_connector_helper_add(connector, &msm_dp_drm_mst_connector_helper_funcs);
+ connector->funcs->reset(connector);
+
+ /* add all encoders as possible encoders */
+ for (i = 0; i < mst->max_streams; i++) {
+ rc = drm_connector_attach_encoder(connector, mst->mst_encoders[i].enc);
+ if (rc) {
+ drm_err(dev, "[MST] failed to attach encoder:%u to conn:%d rc:%d\n",
+ mst->mst_encoders[i].enc->base.id,
+ connector->base.id, rc);
+ goto err_connector;
+ }
+ }
+
+ mst_conn->mst_port = port;
+ drm_dp_mst_get_port_malloc(port);
+
+ drm_object_attach_property(&connector->base,
+ dev->mode_config.path_property, 0);
+ drm_object_attach_property(&connector->base,
+ dev->mode_config.tile_property, 0);
+ drm_connector_set_path_property(connector, pathprop);
+
+ drm_dbg_kms(dev, "[MST] add_connector done conn:%d max_streams:%u\n",
+ connector->base.id, mst->max_streams);
+
+ return connector;
+
+err_connector:
+ drm_connector_cleanup(connector);
+err_free:
+ kfree(mst_conn);
+ return NULL;
+}
+
+static const struct drm_dp_mst_topology_cbs msm_dp_mst_drm_cbs = {
+ .add_connector = msm_dp_mst_add_connector,
+};
+
int msm_dp_mst_mgr_init(struct msm_dp *dp_display, u32 max_streams, struct drm_dp_aux *drm_aux)
{
struct drm_device *dev = dp_display->drm_dev;
@@ -35,6 +274,7 @@ int msm_dp_mst_mgr_init(struct msm_dp *dp_display, u32 max_streams, struct drm_d
if (!mst)
return -ENOMEM;
+ mst->mst_mgr.cbs = &msm_dp_mst_drm_cbs;
mst->msm_dp = dp_display;
mst->max_streams = max_streams;
mst->dp_aux = drm_aux;
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* [PATCH v6 20/29] drm/msm/dpu: pass msm_display_info to dpu_encoder_get_intf()
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (18 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 19/29] drm/msm/dp: add MST connector creation and topology callbacks Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 21/29] drm/msm/dpu: use stream_id to select MST interfaces Yongxing Mou
` (8 subsequent siblings)
28 siblings, 0 replies; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
Derive the controller ID from disp_info->h_tile_instance[index] instead
of passing it separately to dpu_encoder_get_intf().
This removes a redundant argument and keeps all interface selection
parameters in msm_display_info.
No functional change.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
index 1f20695f81e3..91cbb0ca521b 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
@@ -1437,15 +1437,16 @@ static void dpu_encoder_virt_atomic_disable(struct drm_encoder *drm_enc,
static struct dpu_hw_intf *dpu_encoder_get_intf(const struct dpu_mdss_cfg *catalog,
struct dpu_rm *dpu_rm,
- enum dpu_intf_type type, u32 controller_id)
+ struct msm_display_info *disp_info, int index)
{
int i = 0;
+ u32 controller_id = disp_info->h_tile_instance[index];
- if (type == INTF_WB)
+ if (disp_info->intf_type == INTF_WB)
return NULL;
for (i = 0; i < catalog->intf_count; i++) {
- if (catalog->intf[i].type == type
+ if (catalog->intf[i].type == disp_info->intf_type
&& catalog->intf[i].controller_id == controller_id) {
return dpu_rm_get_intf(dpu_rm, catalog->intf[i].id);
}
@@ -2674,8 +2675,7 @@ static int dpu_encoder_setup_display(struct dpu_encoder_virt *dpu_enc,
i, controller_id, phys_params.split_role);
phys_params.hw_intf = dpu_encoder_get_intf(dpu_kms->catalog, &dpu_kms->rm,
- disp_info->intf_type,
- controller_id);
+ disp_info, i);
if (disp_info->intf_type == INTF_WB && controller_id < WB_MAX)
phys_params.hw_wb = dpu_rm_get_wb(&dpu_kms->rm, controller_id);
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* [PATCH v6 21/29] drm/msm/dpu: use stream_id to select MST interfaces
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (19 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 20/29] drm/msm/dpu: pass msm_display_info to dpu_encoder_get_intf() Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 22/29] drm/msm/dpu: add per-stream MST encoders Yongxing Mou
` (7 subsequent siblings)
28 siblings, 0 replies; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
For MST, multiple streams can share the same DP controller, making
(controller_id, intf_type) insufficient to uniquely identify a DPU
interface.
Add stream_id to msm_display_info and use it to select the matching
interface for a stream.
For DSI, eDP and SST configurations, stream_id remains zero and
behavior is unchanged.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 7 ++++---
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h | 2 ++
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
index 91cbb0ca521b..004d5fc460a8 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
@@ -1439,17 +1439,18 @@ static struct dpu_hw_intf *dpu_encoder_get_intf(const struct dpu_mdss_cfg *catal
struct dpu_rm *dpu_rm,
struct msm_display_info *disp_info, int index)
{
- int i = 0;
+ int i = 0, cnt = 0;
u32 controller_id = disp_info->h_tile_instance[index];
+ int stream_id = disp_info->stream_id;
if (disp_info->intf_type == INTF_WB)
return NULL;
for (i = 0; i < catalog->intf_count; i++) {
if (catalog->intf[i].type == disp_info->intf_type
- && catalog->intf[i].controller_id == controller_id) {
+ && catalog->intf[i].controller_id == controller_id
+ && cnt++ == stream_id)
return dpu_rm_get_intf(dpu_rm, catalog->intf[i].id);
- }
}
return NULL;
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h
index 4942097e7613..9972e209bd58 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h
@@ -28,6 +28,7 @@
* @h_tile_instance: Controller instance used per tile. Number of elements is
* based on num_of_h_tiles
* @is_cmd_mode Boolean to indicate if the CMD mode is requested
+ * @stream_id stream id for which the interface needs to be acquired
* @vsync_source: Source of the TE signal for DSI CMD devices
*/
struct msm_display_info {
@@ -35,6 +36,7 @@ struct msm_display_info {
uint32_t num_of_h_tiles;
uint32_t h_tile_instance[MAX_H_TILES_PER_DISPLAY];
bool is_cmd_mode;
+ int stream_id;
enum dpu_vsync_source vsync_source;
};
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* [PATCH v6 22/29] drm/msm/dpu: add per-stream MST encoders
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (20 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 21/29] drm/msm/dpu: use stream_id to select MST interfaces Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 9:47 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 23/29] drm/msm/dp: add atomic stream handling for MST Yongxing Mou
` (6 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
Unlike SST, where a DP controller is represented by a single encoder,
MST requires an encoder instance for each stream.
Create one DRM encoder per MST stream, associate it with a stream ID,
and initialize it with MST-specific encoder helper callbacks.
This establishes the per-stream encoder infrastructure required for DP
MST support.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 23 ++++++++++++++++++++++-
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 15 +++++++++++++++
drivers/gpu/drm/msm/dp/dp_mst_drm.c | 20 ++++++++++++++++++++
drivers/gpu/drm/msm/dp/dp_mst_drm.h | 2 ++
drivers/gpu/drm/msm/msm_drv.h | 9 +++++++++
5 files changed, 68 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
index 004d5fc460a8..533109b4365c 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
@@ -2744,6 +2744,24 @@ static const struct drm_encoder_helper_funcs dpu_encoder_helper_funcs = {
.atomic_enable = dpu_encoder_virt_atomic_enable,
};
+static void dpu_encoder_mst_atomic_enable(struct drm_encoder *enc,
+ struct drm_atomic_commit *state)
+{
+ dpu_encoder_virt_atomic_enable(enc, state);
+}
+
+static void dpu_encoder_mst_atomic_disable(struct drm_encoder *enc,
+ struct drm_atomic_commit *state)
+{
+ dpu_encoder_virt_atomic_disable(enc, state);
+}
+
+static const struct drm_encoder_helper_funcs dpu_mst_encoder_helper_funcs = {
+ .atomic_mode_set = dpu_encoder_virt_atomic_mode_set,
+ .atomic_enable = dpu_encoder_mst_atomic_enable,
+ .atomic_disable = dpu_encoder_mst_atomic_disable,
+};
+
static const struct drm_encoder_funcs dpu_encoder_funcs = {
.debugfs_init = dpu_encoder_debugfs_init,
};
@@ -2769,7 +2787,10 @@ struct drm_encoder *dpu_encoder_init(struct drm_device *dev,
if (IS_ERR(dpu_enc))
return ERR_CAST(dpu_enc);
- drm_encoder_helper_add(&dpu_enc->base, &dpu_encoder_helper_funcs);
+ if (drm_enc_mode == DRM_MODE_ENCODER_DPMST)
+ drm_encoder_helper_add(&dpu_enc->base, &dpu_mst_encoder_helper_funcs);
+ else
+ drm_encoder_helper_add(&dpu_enc->base, &dpu_encoder_helper_funcs);
spin_lock_init(&dpu_enc->enc_spinlock);
dpu_enc->enabled = false;
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
index 66cabac0a726..d6182cec06d5 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
@@ -688,6 +688,21 @@ static int _dpu_kms_initialize_displayport(struct drm_device *dev,
return rc;
}
}
+
+ for (int stream_id = 0; stream_cnt > 1 && stream_id < stream_cnt; stream_id++) {
+ info.stream_id = stream_id;
+ encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_DPMST, &info);
+ if (IS_ERR(encoder)) {
+ DPU_ERROR("encoder init failed for dp mst display\n");
+ return PTR_ERR(encoder);
+ }
+
+ rc = msm_dp_mst_attach_encoder(priv->kms->dp[i], stream_id, encoder);
+ if (rc) {
+ DPU_ERROR("dp_mst attach_encoder failed, rc = %d\n", rc);
+ return rc;
+ }
+ }
}
return 0;
diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.c b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
index 94a717ba7c82..93536b6936cb 100644
--- a/drivers/gpu/drm/msm/dp/dp_mst_drm.c
+++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
@@ -145,6 +145,26 @@ static int msm_dp_mst_encoder_stream_id(struct msm_dp_mst *mst,
return -1;
}
+int msm_dp_mst_attach_encoder(struct msm_dp *dp_display, unsigned int stream_id,
+ struct drm_encoder *encoder)
+{
+ struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+ struct msm_dp_panel *dp_panel;
+
+ dp_panel = msm_dp_display_get_panel(dp_display, stream_id);
+ if (!dp_panel) {
+ drm_err(dp_display->drm_dev,
+ "[MST] failed to allocate panel for stream %d\n", stream_id);
+ return -ENOMEM;
+ }
+
+ mst->mst_encoders[stream_id].enc = encoder;
+ mst->mst_encoders[stream_id].stream_id = stream_id;
+ mst->mst_encoders[stream_id].dp_panel = dp_panel;
+
+ return 0;
+}
+
static struct drm_encoder *
msm_dp_mst_atomic_best_encoder(struct drm_connector *connector, struct drm_atomic_commit *state)
{
diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.h b/drivers/gpu/drm/msm/dp/dp_mst_drm.h
index e54d49cf3499..89f73b1db2e7 100644
--- a/drivers/gpu/drm/msm/dp/dp_mst_drm.h
+++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.h
@@ -8,5 +8,7 @@
#include "dp_display.h"
int msm_dp_mst_mgr_init(struct msm_dp *dp_display, u32 max_streams, struct drm_dp_aux *drm_aux);
+int msm_dp_mst_attach_encoder(struct msm_dp *dp_display, unsigned int stream_id,
+ struct drm_encoder *encoder);
#endif /* _DP_MST_DRM_H_ */
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 8e98f7eb8724..6c6a1546478d 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -359,6 +359,8 @@ bool msm_dp_needs_periph_flush(const struct msm_dp *dp_display,
bool msm_dp_wide_bus_available(const struct msm_dp *dp_display);
int msm_dp_get_mst_max_stream(struct msm_dp *dp_display);
int msm_dp_mst_register(struct msm_dp *dp_display);
+int msm_dp_mst_attach_encoder(struct msm_dp *dp_display, unsigned int stream_id,
+ struct drm_encoder *encoder);
#else
static inline int __init msm_dp_register(void)
@@ -401,6 +403,13 @@ static inline int msm_dp_mst_register(struct msm_dp *dp_display)
return -EINVAL;
}
+static inline int msm_dp_mst_attach_encoder(struct msm_dp *dp_display,
+ unsigned int stream_id,
+ struct drm_encoder *encoder)
+{
+ return -EINVAL;
+}
+
#endif
#ifdef CONFIG_DRM_MSM_MDP4
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 22/29] drm/msm/dpu: add per-stream MST encoders
2026-08-31 8:17 ` [PATCH v6 22/29] drm/msm/dpu: add per-stream MST encoders Yongxing Mou
@ 2026-08-31 9:47 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 9:47 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
New issues:
- [High] Memory leak of `msm_dp_panel` structures during DRM aggregate device bind/unbind.
Pre-existing issues:
- [High] Acquiring a mutex within encoder atomic enable/disable callbacks, which run in atomic context.
--
commit e97742ad149cc1b791cf840c7db48478057e92d2
Author: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
drm/msm/dpu: add per-stream MST encoders
Unlike SST, where a DP controller is represented by a single encoder,
MST requires an encoder instance for each stream.
Create one DRM encoder per MST stream, associate it with a stream ID,
and initialize it with MST-specific encoder helper callbacks.
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
> index 004d5fc460a87..533109b4365c3 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
> @@ -2744,6 +2744,24 @@ static const struct drm_encoder_helper_funcs dpu_encoder_helper_funcs = {
> .atomic_enable = dpu_encoder_virt_atomic_enable,
> };
>
> +static void dpu_encoder_mst_atomic_enable(struct drm_encoder *enc,
> + struct drm_atomic_commit *state)
> +{
> + dpu_encoder_virt_atomic_enable(enc, state);
[Severity: High]
This is a pre-existing issue, but does calling
dpu_encoder_virt_atomic_enable() here violate atomic context rules?
According to subsystem guidelines, atomic_enable callbacks run in an atomic
context where sleeping is forbidden. However,
dpu_encoder_virt_atomic_enable() acquires a sleepable mutex:
static void dpu_encoder_virt_atomic_enable(...)
{
...
mutex_lock(&dpu_enc->enc_lock);
...
}
Could this lead to kernel warnings, system instability, or potential deadlocks?
> +}
> +
> +static void dpu_encoder_mst_atomic_disable(struct drm_encoder *enc,
> + struct drm_atomic_commit *state)
> +{
> + dpu_encoder_virt_atomic_disable(enc, state);
> +}
> +
[ ... ]
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
> index 66cabac0a7264..d6182cec06d58 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
> @@ -688,6 +688,21 @@ static int _dpu_kms_initialize_displayport(struct drm_device *dev,
> return rc;
> }
> }
> +
> + for (int stream_id = 0; stream_cnt > 1 && stream_id < stream_cnt; stream_id++) {
> + info.stream_id = stream_id;
> + encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_DPMST, &info);
> + if (IS_ERR(encoder)) {
> + DPU_ERROR("encoder init failed for dp mst display\n");
> + return PTR_ERR(encoder);
> + }
> +
> + rc = msm_dp_mst_attach_encoder(priv->kms->dp[i], stream_id, encoder);
> + if (rc) {
> + DPU_ERROR("dp_mst attach_encoder failed, rc = %d\n", rc);
> + return rc;
[Severity: High]
If this loop fails on stream_id > 0, do the panels allocated in previous
iterations leak?
Additionally, because the panel allocation in msm_dp_mst_attach_encoder() is
tied to the independent DP device's lifetime, it appears these panels will
also leak on aggregate unbind, as well as on KMS initialization failures
causing probe deferral.
> + }
> + }
> }
>
> return 0;
[ ... ]
> diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.c b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
> index 94a717ba7c827..93536b6936cbd 100644
> --- a/drivers/gpu/drm/msm/dp/dp_mst_drm.c
> +++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
> @@ -145,6 +145,26 @@ static int msm_dp_mst_encoder_stream_id(struct msm_dp_mst *mst,
> return -1;
> }
>
> +int msm_dp_mst_attach_encoder(struct msm_dp *dp_display, unsigned int stream_id,
> + struct drm_encoder *encoder)
> +{
> + struct msm_dp_mst *mst = dp_display->msm_dp_mst;
> + struct msm_dp_panel *dp_panel;
> +
> + dp_panel = msm_dp_display_get_panel(dp_display, stream_id);
> + if (!dp_panel) {
[Severity: High]
Does this allocation leak during DRM aggregate device unbind?
msm_dp_display_get_panel() uses devm_kzalloc tied to the DP component
device (pdev->dev). Because the DP component device outlives the DRM bind
cycle, its devm allocations are not freed on DRM unbind.
Could repeatedly binding and unbinding the DRM aggregate device (e.g., via
sysfs) permanently leak this msm_dp_panel?
> + drm_err(dp_display->drm_dev,
> + "[MST] failed to allocate panel for stream %d\n", stream_id);
> + return -ENOMEM;
> + }
> +
> + mst->mst_encoders[stream_id].enc = encoder;
> + mst->mst_encoders[stream_id].stream_id = stream_id;
> + mst->mst_encoders[stream_id].dp_panel = dp_panel;
> +
> + return 0;
> +}
> +
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=22
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 23/29] drm/msm/dp: add atomic stream handling for MST
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (21 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 22/29] drm/msm/dpu: add per-stream MST encoders Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 9:48 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 24/29] drm/msm/dp: add HPD callback for dp MST Yongxing Mou
` (5 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
Add the atomic check, enable and disable operations for MST streams.
Reserve VC payload bandwidth based on the negotiated link parameters,
and update the MST payload when enabling or disabling each DP stream.
Serialize stream updates that access the shared MST link state.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 11 ++
drivers/gpu/drm/msm/dp/dp_mst_drm.c | 162 ++++++++++++++++++++++++++++
drivers/gpu/drm/msm/msm_drv.h | 19 ++++
3 files changed, 192 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
index 533109b4365c..00b0da33f446 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
@@ -2747,16 +2747,27 @@ static const struct drm_encoder_helper_funcs dpu_encoder_helper_funcs = {
static void dpu_encoder_mst_atomic_enable(struct drm_encoder *enc,
struct drm_atomic_commit *state)
{
+ msm_dp_mst_stream_enable(enc, state);
dpu_encoder_virt_atomic_enable(enc, state);
}
static void dpu_encoder_mst_atomic_disable(struct drm_encoder *enc,
struct drm_atomic_commit *state)
{
+ msm_dp_mst_stream_disable(enc, state);
dpu_encoder_virt_atomic_disable(enc, state);
+ msm_dp_mst_stream_post_disable(enc, state);
+}
+
+static int dpu_encoder_mst_atomic_check(struct drm_encoder *enc,
+ struct drm_crtc_state *crtc_state,
+ struct drm_connector_state *conn_state)
+{
+ return msm_dp_mst_stream_atomic_check(enc, crtc_state, conn_state);
}
static const struct drm_encoder_helper_funcs dpu_mst_encoder_helper_funcs = {
+ .atomic_check = dpu_encoder_mst_atomic_check,
.atomic_mode_set = dpu_encoder_virt_atomic_mode_set,
.atomic_enable = dpu_encoder_mst_atomic_enable,
.atomic_disable = dpu_encoder_mst_atomic_disable,
diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.c b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
index 93536b6936cb..03f9c95ca686 100644
--- a/drivers/gpu/drm/msm/dp/dp_mst_drm.c
+++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
@@ -33,6 +33,9 @@ struct msm_dp_mst {
struct msm_dp *msm_dp;
struct drm_dp_aux *dp_aux;
u32 max_streams;
+ /* Serializes concurrent stream link-state access across streams. */
+ struct mutex mst_lock;
+ struct msm_dp_link_info link_info;
};
static void dp_mst_connector_destroy(struct drm_connector *connector)
@@ -133,6 +136,18 @@ static int msm_dp_mst_connector_atomic_check(struct drm_connector *connector,
return drm_dp_atomic_release_time_slots(state, &mst->mst_mgr, mst_conn->mst_port);
}
+static struct msm_dp_panel *msm_dp_mst_panel_from_encoder(struct msm_dp_mst *mst,
+ struct drm_encoder *enc)
+{
+ int i;
+
+ for (i = 0; i < mst->max_streams; i++) {
+ if (mst->mst_encoders[i].enc == enc)
+ return mst->mst_encoders[i].dp_panel;
+ }
+ return NULL;
+}
+
static int msm_dp_mst_encoder_stream_id(struct msm_dp_mst *mst,
struct drm_encoder *enc)
{
@@ -145,6 +160,152 @@ static int msm_dp_mst_encoder_stream_id(struct msm_dp_mst *mst,
return -1;
}
+void msm_dp_mst_stream_enable(struct drm_encoder *encoder,
+ struct drm_atomic_commit *state)
+{
+ struct drm_connector *connector =
+ drm_atomic_get_new_connector_for_encoder(state, encoder);
+ struct msm_dp_mst_connector *mst_conn = to_dp_mst_connector(connector);
+ struct msm_dp_mst *mst = mst_conn->dp_mst;
+ struct msm_dp *dp_display = mst->msm_dp;
+ struct msm_dp_panel *panel = msm_dp_mst_panel_from_encoder(mst, encoder);
+ struct drm_dp_mst_port *port = mst_conn->mst_port;
+ struct drm_dp_mst_topology_state *mst_state =
+ drm_atomic_get_new_mst_topology_state(state, &mst->mst_mgr);
+ struct drm_dp_mst_atomic_payload *payload =
+ drm_atomic_get_mst_payload_state(mst_state, port);
+ int rc;
+
+ guard(mutex)(&mst->mst_lock);
+
+ drm_connector_get(connector);
+ panel->connector = connector;
+
+ rc = msm_dp_display_set_mode_helper(dp_display, state, encoder, panel);
+ if (rc) {
+ drm_err(dp_display->drm_dev,
+ "[MST] stream:%u set_mode failed rc=%d\n", panel->stream_id, rc);
+ return;
+ }
+
+ rc = msm_dp_display_prepare_link(dp_display);
+ if (rc) {
+ drm_err(dp_display->drm_dev,
+ "[MST] stream:%u prepare_link failed rc=%d\n", panel->stream_id, rc);
+ msm_dp_display_unprepare(dp_display);
+ return;
+ }
+
+ drm_dp_mst_update_slots(mst_state, DP_CAP_ANSI_8B10B);
+
+ rc = drm_dp_add_payload_part1(&mst->mst_mgr, mst_state, payload);
+ if (rc)
+ return;
+
+ msm_dp_display_set_stream_info(mst->msm_dp, panel,
+ payload->vc_start_slot,
+ payload->time_slots, payload->pbn);
+ drm_dbg_kms(dp_display->drm_dev,
+ "[MST] stream:%u timeslots vc_start:%d slots:%d pbn:%d\n",
+ panel->stream_id, payload->vc_start_slot,
+ payload->time_slots, payload->pbn);
+
+ msm_dp_display_enable_helper(dp_display, panel);
+
+ drm_dp_check_act_status(&mst->mst_mgr);
+
+ drm_dp_add_payload_part2(&mst->mst_mgr, payload);
+}
+
+void msm_dp_mst_stream_disable(struct drm_encoder *encoder,
+ struct drm_atomic_commit *state)
+{
+ struct drm_connector *connector = drm_atomic_get_old_connector_for_encoder(state, encoder);
+ struct msm_dp_mst_connector *mst_conn = to_dp_mst_connector(connector);
+ struct msm_dp_mst *mst = mst_conn->dp_mst;
+ struct msm_dp_panel *panel = msm_dp_mst_panel_from_encoder(mst, encoder);
+ struct drm_dp_mst_topology_state *old_mst_state =
+ drm_atomic_get_old_mst_topology_state(state, &mst->mst_mgr);
+ struct drm_dp_mst_topology_state *new_mst_state =
+ drm_atomic_get_new_mst_topology_state(state, &mst->mst_mgr);
+ struct drm_dp_mst_atomic_payload *old_payload =
+ drm_atomic_get_mst_payload_state(old_mst_state, mst_conn->mst_port);
+ struct drm_dp_mst_atomic_payload *new_payload =
+ drm_atomic_get_mst_payload_state(new_mst_state, mst_conn->mst_port);
+
+ guard(mutex)(&mst->mst_lock);
+
+ drm_dp_remove_payload_part1(&mst->mst_mgr, new_mst_state, new_payload);
+
+ drm_dp_remove_payload_part2(&mst->mst_mgr, new_mst_state, old_payload, new_payload);
+
+ msm_dp_display_set_stream_info(mst->msm_dp, panel, 0, 0, 0);
+ drm_dbg_kms(mst->msm_dp->drm_dev,
+ "[MST] stream:%u timeslots vc_start:%d slots:%d pbn:%d\n",
+ panel->stream_id, new_payload->vc_start_slot,
+ new_payload->time_slots, new_payload->pbn);
+
+ msm_dp_display_disable_helper(mst->msm_dp, panel);
+
+ drm_dp_check_act_status(&mst->mst_mgr);
+}
+
+void msm_dp_mst_stream_post_disable(struct drm_encoder *encoder,
+ struct drm_atomic_commit *state)
+{
+ struct drm_connector *connector = drm_atomic_get_old_connector_for_encoder(state, encoder);
+ struct msm_dp_mst_connector *mst_conn = to_dp_mst_connector(connector);
+ struct msm_dp_mst *mst = mst_conn->dp_mst;
+ struct msm_dp_panel *panel = msm_dp_mst_panel_from_encoder(mst, encoder);
+
+ guard(mutex)(&mst->mst_lock);
+
+ msm_dp_display_atomic_post_disable_helper(mst->msm_dp, panel);
+
+ if (!mst->msm_dp->mst_active)
+ msm_dp_display_unprepare(mst->msm_dp);
+
+ panel->connector = NULL;
+
+ drm_connector_put(connector);
+}
+
+int msm_dp_mst_stream_atomic_check(struct drm_encoder *enc,
+ struct drm_crtc_state *crtc_state,
+ struct drm_connector_state *conn_state)
+{
+ struct msm_dp_mst_connector *mst_conn = to_dp_mst_connector(conn_state->connector);
+ struct msm_dp_mst *mst = mst_conn->dp_mst;
+ struct drm_dp_mst_topology_state *mst_state;
+ int bpp, pbn, slots;
+
+ if (!conn_state->crtc)
+ return 0;
+
+ if (!drm_atomic_crtc_needs_modeset(crtc_state) || !crtc_state->active)
+ return 0;
+
+ bpp = (conn_state->connector->display_info.bpc * 3) ?: 24; /* fallback: assume 8bpc */
+ pbn = drm_dp_calc_pbn_mode(crtc_state->mode.clock, bpp << 4);
+
+ mst_state = drm_atomic_get_mst_topology_state(crtc_state->state, &mst->mst_mgr);
+ if (IS_ERR(mst_state))
+ return PTR_ERR(mst_state);
+
+ if (!dfixed_trunc(mst_state->pbn_div)) {
+ mst_state->pbn_div =
+ drm_dp_get_vc_payload_bw(mst->link_info.rate,
+ mst->link_info.num_lanes);
+ }
+
+ slots = drm_dp_atomic_find_time_slots(crtc_state->state, &mst->mst_mgr,
+ mst_conn->mst_port, pbn);
+ if (slots < 0)
+ return slots;
+
+ return 0;
+}
+
int msm_dp_mst_attach_encoder(struct msm_dp *dp_display, unsigned int stream_id,
struct drm_encoder *encoder)
{
@@ -309,6 +470,7 @@ int msm_dp_mst_mgr_init(struct msm_dp *dp_display, u32 max_streams, struct drm_d
return ret;
}
+ mutex_init(&mst->mst_lock);
dp_display->msm_dp_mst = mst;
return 0;
}
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 6c6a1546478d..e9a7c9332707 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -361,6 +361,12 @@ int msm_dp_get_mst_max_stream(struct msm_dp *dp_display);
int msm_dp_mst_register(struct msm_dp *dp_display);
int msm_dp_mst_attach_encoder(struct msm_dp *dp_display, unsigned int stream_id,
struct drm_encoder *encoder);
+void msm_dp_mst_stream_enable(struct drm_encoder *enc, struct drm_atomic_commit *state);
+void msm_dp_mst_stream_disable(struct drm_encoder *enc, struct drm_atomic_commit *state);
+void msm_dp_mst_stream_post_disable(struct drm_encoder *enc, struct drm_atomic_commit *state);
+int msm_dp_mst_stream_atomic_check(struct drm_encoder *enc,
+ struct drm_crtc_state *crtc_state,
+ struct drm_connector_state *conn_state);
#else
static inline int __init msm_dp_register(void)
@@ -410,6 +416,19 @@ static inline int msm_dp_mst_attach_encoder(struct msm_dp *dp_display,
return -EINVAL;
}
+static inline void msm_dp_mst_stream_enable(struct drm_encoder *enc,
+ struct drm_atomic_commit *state) {}
+static inline void msm_dp_mst_stream_disable(struct drm_encoder *enc,
+ struct drm_atomic_commit *state) {}
+static inline void msm_dp_mst_stream_post_disable(struct drm_encoder *enc,
+ struct drm_atomic_commit *state) {}
+static inline int msm_dp_mst_stream_atomic_check(struct drm_encoder *enc,
+ struct drm_crtc_state *cs,
+ struct drm_connector_state *cos)
+{
+ return -EINVAL;
+}
+
#endif
#ifdef CONFIG_DRM_MSM_MDP4
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 23/29] drm/msm/dp: add atomic stream handling for MST
2026-08-31 8:17 ` [PATCH v6 23/29] drm/msm/dp: add atomic stream handling for MST Yongxing Mou
@ 2026-08-31 9:48 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 9:48 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] Acquiring a sleeping mutex lock and calling sleeping polling functions inside the encoder `atomic_enable` and `atomic_disable` callbacks causes sleep-in-atomic bugs.
- [High] Premature call to `drm_dp_remove_payload_part2()` before hardware update and ACT check in `msm_dp_mst_stream_disable()`.
- [High] Early error returns in `msm_dp_mst_stream_enable()` corrupt internal stream tracking and MST manager state.
--
commit c8eb7290bc454899af65ca1c4ce4e1f847647c68
Author: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
drm/msm/dp: add atomic stream handling for MST
This patch adds atomic check, enable, and disable operations for MST
streams in the MSM DP driver. It reserves VC payload bandwidth, updates
payloads when toggling streams, and uses a mutex to serialize link state.
> diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.c b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
> index 93536b6936cbd..03f9c95ca6860 100644
> --- a/drivers/gpu/drm/msm/dp/dp_mst_drm.c
> +++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
[ ... ]
> @@ -145,6 +160,152 @@ static int msm_dp_mst_encoder_stream_id(struct msm_dp_mst *mst,
> return -1;
> }
>
> +void msm_dp_mst_stream_enable(struct drm_encoder *encoder,
> + struct drm_atomic_commit *state)
> +{
[ ... ]
> + struct drm_dp_mst_atomic_payload *payload =
> + drm_atomic_get_mst_payload_state(mst_state, port);
> + int rc;
> +
> + guard(mutex)(&mst->mst_lock);
[Severity: High]
Does this acquire a sleeping mutex from an atomic context?
The DRM subsystem guidelines designate encoder atomic_enable and
atomic_disable callbacks as executing in an atomic context where sleeping
is strictly forbidden. A userspace modeset targeting an MST stream will
invoke msm_dp_mst_stream_enable() via dpu_encoder_mst_atomic_enable().
Can this lead to kernel warnings, priority inversion, and potential
system deadlocks?
> +
> + drm_connector_get(connector);
> + panel->connector = connector;
> +
> + rc = msm_dp_display_set_mode_helper(dp_display, state, encoder, panel);
> + if (rc) {
> + drm_err(dp_display->drm_dev,
> + "[MST] stream:%u set_mode failed rc=%d\n", panel->stream_id, rc);
> + return;
> + }
> +
> + rc = msm_dp_display_prepare_link(dp_display);
> + if (rc) {
> + drm_err(dp_display->drm_dev,
> + "[MST] stream:%u prepare_link failed rc=%d\n", panel->stream_id, rc);
> + msm_dp_display_unprepare(dp_display);
> + return;
> + }
[Severity: High]
Are these early returns going to cause state corruption when the disable
path runs?
If msm_dp_display_prepare_link() fails, msm_dp_mst_stream_enable() returns
early before completing payload allocation. Since the atomic_enable
callback returns void, the DRM core still registers the encoder as active.
When atomic_disable is later called, msm_dp_mst_stream_disable() will
unconditionally decrement payload counts that were never incremented.
Could this lead to integer underflows in the MST topology manager state?
> +
> + drm_dp_mst_update_slots(mst_state, DP_CAP_ANSI_8B10B);
> +
> + rc = drm_dp_add_payload_part1(&mst->mst_mgr, mst_state, payload);
> + if (rc)
> + return;
[Severity: High]
Will this early return also cause similar underflow issues in the MST
manager state if drm_dp_add_payload_part1() fails? The atomic_disable
path will still run later and unconditionally decrement the payload count.
> +
> + msm_dp_display_set_stream_info(mst->msm_dp, panel,
> + payload->vc_start_slot,
> + payload->time_slots, payload->pbn);
> + drm_dbg_kms(dp_display->drm_dev,
> + "[MST] stream:%u timeslots vc_start:%d slots:%d pbn:%d\n",
> + panel->stream_id, payload->vc_start_slot,
> + payload->time_slots, payload->pbn);
> +
> + msm_dp_display_enable_helper(dp_display, panel);
> +
> + drm_dp_check_act_status(&mst->mst_mgr);
[Severity: High]
Is it safe to call drm_dp_check_act_status() from within the atomic_enable
path?
This is a hardware polling function that can sleep for up to 3 seconds.
Since msm_dp_mst_stream_enable() runs in an atomic context, will this
cause sleep-in-atomic bugs?
> +
> + drm_dp_add_payload_part2(&mst->mst_mgr, payload);
> +}
> +
> +void msm_dp_mst_stream_disable(struct drm_encoder *encoder,
> + struct drm_atomic_commit *state)
> +{
[ ... ]
> + struct drm_dp_mst_atomic_payload *new_payload =
> + drm_atomic_get_mst_payload_state(new_mst_state, mst_conn->mst_port);
> +
> + guard(mutex)(&mst->mst_lock);
[Severity: High]
Does this acquire a sleeping mutex from an atomic context?
Similar to the enable path, msm_dp_mst_stream_disable() is called during
encoder atomic_disable callbacks, which strictly forbid sleeping.
> +
> + drm_dp_remove_payload_part1(&mst->mst_mgr, new_mst_state, new_payload);
> +
> + drm_dp_remove_payload_part2(&mst->mst_mgr, new_mst_state, old_payload, new_payload);
[Severity: High]
Is this call to drm_dp_remove_payload_part2() premature?
This API call frees the VCPI slots in the software topology manager before
msm_dp_display_disable_helper() executes and the Allocation Change Trigger
is acknowledged by the sink.
Could this allow concurrent atomic commits to reallocate the same slots
while the hardware is still executing the removal sequence, leading to
topological corruption?
> +
> + msm_dp_display_set_stream_info(mst->msm_dp, panel, 0, 0, 0);
> + drm_dbg_kms(mst->msm_dp->drm_dev,
> + "[MST] stream:%u timeslots vc_start:%d slots:%d pbn:%d\n",
> + panel->stream_id, new_payload->vc_start_slot,
> + new_payload->time_slots, new_payload->pbn);
> +
> + msm_dp_display_disable_helper(mst->msm_dp, panel);
> +
> + drm_dp_check_act_status(&mst->mst_mgr);
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=23
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 24/29] drm/msm/dp: add HPD callback for dp MST
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (22 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 23/29] drm/msm/dp: add atomic stream handling for MST Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 10:00 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 25/29] drm/msm/dp: wire MST helpers into atomic check and commit paths Yongxing Mou
` (4 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
Add HPD callback for the MST module which shall be invoked from the
dp_display's HPD handler to perform MST specific operations in case
of HPD. In MST case, route the HPD messages to MST module.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_display.c | 26 +++++++++++++++++-----
drivers/gpu/drm/msm/dp/dp_mst_drm.c | 44 +++++++++++++++++++++++++++++++++++++
drivers/gpu/drm/msm/dp/dp_mst_drm.h | 1 +
3 files changed, 66 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index c015af868801..22b925277462 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -416,6 +416,9 @@ static int msm_dp_hpd_plug_handle(struct msm_dp_display_private *dp)
dp->msm_dp_display.connector_type,
dp->link->sink_count);
+ if (dp->plugged && dp->msm_dp_display.mst_active)
+ return 0;
+
guard(mutex)(&dp->plugged_lock);
ret = pm_runtime_resume_and_get(&pdev->dev);
@@ -506,12 +509,18 @@ static int msm_dp_irq_hpd_handle(struct msm_dp_display_private *dp)
{
u32 sink_request;
int rc = 0;
+ struct msm_dp *msm_dp_display = &dp->msm_dp_display;
/* irq_hpd can happen at either connected or disconnected state */
drm_dbg_dp(dp->drm_dev, "Before, type=%d, sink_count=%d\n",
dp->msm_dp_display.connector_type,
dp->link->sink_count);
+ if (msm_dp_display->mst_active) {
+ msm_dp_mst_display_hpd_irq(&dp->msm_dp_display);
+ return 0;
+ }
+
/* check for any test request issued by sink */
rc = msm_dp_link_process_request(dp->link);
if (!rc) {
@@ -1056,10 +1065,16 @@ static irqreturn_t msm_dp_display_irq_thread(int irq, void *dev_id)
drm_bridge_hpd_notify(dp->msm_dp_display.bridge,
connector_status_connected);
- /* Send HPD as connected and distinguish it in the notifier */
- if (hpd_isr_status & DP_DP_IRQ_HPD_INT_MASK)
- drm_bridge_hpd_notify(dp->msm_dp_display.bridge,
- connector_status_connected);
+ /* Temporary until DRM IRQ support is finalized, then switch to
+ * drm_bridge_hpd_notify().
+ */
+ if (hpd_isr_status & DP_DP_IRQ_HPD_INT_MASK) {
+ if (dp->msm_dp_display.mst_active)
+ msm_dp_irq_hpd_handle(dp);
+ else
+ drm_bridge_hpd_notify(dp->msm_dp_display.bridge,
+ connector_status_connected);
+ }
ret = IRQ_HANDLED;
@@ -1717,7 +1732,8 @@ void msm_dp_bridge_hpd_notify(struct drm_bridge *bridge,
msm_dp_hpd_plug_handle(dp);
}
} else {
- msm_dp_hpd_unplug_handle(dp);
+ if (hpd_link_status == ISR_DISCONNECTED)
+ msm_dp_hpd_unplug_handle(dp);
}
pm_runtime_put_sync(&msm_dp_display->pdev->dev);
diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.c b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
index 03f9c95ca686..2e625a7db981 100644
--- a/drivers/gpu/drm/msm/dp/dp_mst_drm.c
+++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
@@ -35,6 +35,8 @@ struct msm_dp_mst {
u32 max_streams;
/* Serializes concurrent stream link-state access across streams. */
struct mutex mst_lock;
+ /* Serializes HPD IRQ handling between IRQ handler and poll_hpd_irq. */
+ struct mutex hpd_irq_lock;
struct msm_dp_link_info link_info;
};
@@ -326,6 +328,39 @@ int msm_dp_mst_attach_encoder(struct msm_dp *dp_display, unsigned int stream_id,
return 0;
}
+void msm_dp_mst_display_hpd_irq(struct msm_dp *dp_display)
+{
+ int rc;
+ struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+ u8 ack[8] = {};
+ u8 esi[4];
+ unsigned int esi_res = DP_SINK_COUNT_ESI + 1;
+ bool handled;
+
+ guard(mutex)(&mst->hpd_irq_lock);
+
+ rc = drm_dp_dpcd_read_data(mst->dp_aux, DP_SINK_COUNT_ESI, esi, 4);
+ if (rc < 0) {
+ DRM_ERROR("DPCD sink status read failed, rlen=%d\n", rc);
+ return;
+ }
+
+ drm_dbg_dp(dp_display->drm_dev, "MST HPD IRQ: esi=%*ph\n", 4, esi);
+
+ rc = drm_dp_mst_hpd_irq_handle_event(&mst->mst_mgr, esi, ack, &handled);
+
+ if (handled) {
+ rc = drm_dp_dpcd_write_byte(mst->dp_aux, esi_res, ack[1]);
+ if (rc < 0) {
+ DRM_ERROR("DPCD esi_res failed. rc=%d\n", rc);
+ return;
+ }
+
+ drm_dp_mst_hpd_irq_send_new_request(&mst->mst_mgr);
+ }
+ drm_dbg_dp(dp_display->drm_dev, "MST display hpd_irq handled:%d rc:%d\n", handled, rc);
+}
+
static struct drm_encoder *
msm_dp_mst_atomic_best_encoder(struct drm_connector *connector, struct drm_atomic_commit *state)
{
@@ -441,8 +476,16 @@ msm_dp_mst_add_connector(struct drm_dp_mst_topology_mgr *mgr,
return NULL;
}
+static void msm_dp_mst_poll_hpd_irq(struct drm_dp_mst_topology_mgr *mgr)
+{
+ struct msm_dp_mst *mst = container_of(mgr, struct msm_dp_mst, mst_mgr);
+
+ msm_dp_mst_display_hpd_irq(mst->msm_dp);
+}
+
static const struct drm_dp_mst_topology_cbs msm_dp_mst_drm_cbs = {
.add_connector = msm_dp_mst_add_connector,
+ .poll_hpd_irq = msm_dp_mst_poll_hpd_irq,
};
int msm_dp_mst_mgr_init(struct msm_dp *dp_display, u32 max_streams, struct drm_dp_aux *drm_aux)
@@ -471,6 +514,7 @@ int msm_dp_mst_mgr_init(struct msm_dp *dp_display, u32 max_streams, struct drm_d
}
mutex_init(&mst->mst_lock);
+ mutex_init(&mst->hpd_irq_lock);
dp_display->msm_dp_mst = mst;
return 0;
}
diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.h b/drivers/gpu/drm/msm/dp/dp_mst_drm.h
index 89f73b1db2e7..8546214cbca1 100644
--- a/drivers/gpu/drm/msm/dp/dp_mst_drm.h
+++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.h
@@ -10,5 +10,6 @@
int msm_dp_mst_mgr_init(struct msm_dp *dp_display, u32 max_streams, struct drm_dp_aux *drm_aux);
int msm_dp_mst_attach_encoder(struct msm_dp *dp_display, unsigned int stream_id,
struct drm_encoder *encoder);
+void msm_dp_mst_display_hpd_irq(struct msm_dp *dp_display);
#endif /* _DP_MST_DRM_H_ */
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 24/29] drm/msm/dp: add HPD callback for dp MST
2026-08-31 8:17 ` [PATCH v6 24/29] drm/msm/dp: add HPD callback for dp MST Yongxing Mou
@ 2026-08-31 10:00 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 10:00 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Critical] Use-After-Free of `mst` structure in MST HPD IRQ handler after DRM component unbind.
- [High] MST HPD IRQ handler reads ESI exactly once (no loop) and ignores link status updates (ESI[3]), breaking link recovery.
- [Medium] TOCTOU data race on `dp->plugged` and `mst_active` causes dropped hotplug events.
--
commit 72fee25edd59966ac66b4a97ac13198745881f5c
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
drm/msm/dp: add HPD callback for dp MST
This patch adds HPD callback handling for the MST module, which is invoked from
the dp_display's HPD handler. It routes HPD messages to the MST module when
MST is active.
> diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
> index c015af8688013..22b9252774620 100644
> --- a/drivers/gpu/drm/msm/dp/dp_display.c
> +++ b/drivers/gpu/drm/msm/dp/dp_display.c
> @@ -416,6 +416,9 @@ static int msm_dp_hpd_plug_handle(struct msm_dp_display_private *dp)
> dp->msm_dp_display.connector_type,
> dp->link->sink_count);
>
> + if (dp->plugged && dp->msm_dp_display.mst_active)
> + return 0;
> +
> guard(mutex)(&dp->plugged_lock);
[Severity: Medium]
Could reading dp->plugged and mst_active outside of dp->plugged_lock cause a
race condition?
If a rapid plug/unplug sequence occurs, msm_dp_hpd_plug_handle() and
msm_dp_hpd_unplug_handle() could execute concurrently. If the unplug handler
holds the lock, the plug handler might see dp->plugged as true and return
early, skipping initialization. After the unplug handler finishes and sets
dp->plugged to false, the display would be physically plugged in but
uninitialized in software.
>
> ret = pm_runtime_resume_and_get(&pdev->dev);
[ ... ]
> @@ -506,12 +509,18 @@ static int msm_dp_irq_hpd_handle(struct msm_dp_display_private *dp)
> {
> u32 sink_request;
> int rc = 0;
> + struct msm_dp *msm_dp_display = &dp->msm_dp_display;
>
> /* irq_hpd can happen at either connected or disconnected state */
> drm_dbg_dp(dp->drm_dev, "Before, type=%d, sink_count=%d\n",
> dp->msm_dp_display.connector_type,
> dp->link->sink_count);
>
> + if (msm_dp_display->mst_active) {
> + msm_dp_mst_display_hpd_irq(&dp->msm_dp_display);
> + return 0;
> + }
> +
[Severity: High]
Does returning early here when MST is active bypass standard DP link loss and
test request processing?
In SST mode, msm_dp_link_process_request() handles DP link service IRQ
vectors (like link loss). When mst_active is true, this path is entirely
skipped, and it does not appear that msm_dp_mst_display_hpd_irq() handles
link status updates.
> /* check for any test request issued by sink */
> rc = msm_dp_link_process_request(dp->link);
> if (!rc) {
[ ... ]
> diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.c b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
> index 03f9c95ca6860..2e625a7db9819 100644
> --- a/drivers/gpu/drm/msm/dp/dp_mst_drm.c
> +++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
[ ... ]
> @@ -326,6 +328,39 @@ int msm_dp_mst_attach_encoder(struct msm_dp *dp_display, unsigned int stream_id,
> return 0;
> }
>
> +void msm_dp_mst_display_hpd_irq(struct msm_dp *dp_display)
> +{
> + int rc;
> + struct msm_dp_mst *mst = dp_display->msm_dp_mst;
> + u8 ack[8] = {};
> + u8 esi[4];
> + unsigned int esi_res = DP_SINK_COUNT_ESI + 1;
> + bool handled;
> +
> + guard(mutex)(&mst->hpd_irq_lock);
[Severity: Critical]
Can this dereference a freed mst pointer if the DRM master is unbound?
The mst structure is allocated with devm_kzalloc(dev->dev, ...) during
initialization. If the DRM master module is unloaded, devres will free this
memory.
However, if the DP IRQ was requested on the component device and remains
active, and mst_active isn't cleared, an incoming HPD interrupt could be
routed here, causing a use-after-free when locking mst->hpd_irq_lock.
> +
> + rc = drm_dp_dpcd_read_data(mst->dp_aux, DP_SINK_COUNT_ESI, esi, 4);
> + if (rc < 0) {
> + DRM_ERROR("DPCD sink status read failed, rlen=%d\n", rc);
> + return;
> + }
> +
> + drm_dbg_dp(dp_display->drm_dev, "MST HPD IRQ: esi=%*ph\n", 4, esi);
> +
> + rc = drm_dp_mst_hpd_irq_handle_event(&mst->mst_mgr, esi, ack, &handled);
> +
> + if (handled) {
> + rc = drm_dp_dpcd_write_byte(mst->dp_aux, esi_res, ack[1]);
[Severity: High]
Does this logic ignore link status updates and subsequent ESI messages?
The DP specification requires reading the ESI repeatedly until all status bits
are clear. This function reads the ESI exactly once, ignoring any subsequent
messages.
Additionally, this function only passes esi to
drm_dp_mst_hpd_irq_handle_event(). Because the legacy link processing in
msm_dp_irq_hpd_handle() is completely bypassed when mst_active is true,
esi[3] (DP_LINK_SERVICE_IRQ_VECTOR_ESI0) is entirely ignored. This means
the source could fail to detect link loss during MST operation and fail to
retrain the link.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=24
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 25/29] drm/msm/dp: wire MST helpers into atomic check and commit paths
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (23 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 24/29] drm/msm/dp: add HPD callback for dp MST Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 26/29] drm/msm/dp: mark the SST bridge disconnected when mst is active Yongxing Mou
` (3 subsequent siblings)
28 siblings, 0 replies; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar, Dmitry Baryshkov
Call drm_dp_mst_atomic_check() from msm_atomic_check() so MST-specific
state, such as connector and topology changes, is validated as part of
the atomic check.
Hook the MST helpers into atomic_commit_setup() and
atomic_commit_tail() to support non-blocking atomic commits for
DisplayPort MST, and ensure MST commits properly wait for dependencies.
For SST, non-blocking commits are already handled via commit_tail(),
which waits for dependencies in the DRM core.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
drivers/gpu/drm/msm/msm_atomic.c | 14 +++++++++++++-
drivers/gpu/drm/msm/msm_drv.h | 1 +
drivers/gpu/drm/msm/msm_kms.c | 1 +
3 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
index a8babf1dbe0d..e70e5088cfe5 100644
--- a/drivers/gpu/drm/msm/msm_atomic.c
+++ b/drivers/gpu/drm/msm/msm_atomic.c
@@ -4,6 +4,7 @@
* Author: Rob Clark <robdclark@gmail.com>
*/
+#include <drm/display/drm_dp_mst_helper.h>
#include <drm/drm_atomic_uapi.h>
#include <drm/drm_vblank.h>
@@ -207,7 +208,11 @@ int msm_atomic_check(struct drm_device *dev, struct drm_atomic_commit *state)
if (ret)
return ret;
- return drm_atomic_helper_check(dev, state);
+ ret = drm_atomic_helper_check(dev, state);
+ if (ret)
+ return ret;
+
+ return drm_dp_mst_atomic_check(state);
}
void msm_atomic_commit_tail(struct drm_atomic_commit *state)
@@ -221,6 +226,8 @@ void msm_atomic_commit_tail(struct drm_atomic_commit *state)
trace_msm_atomic_commit_tail_start(async, crtc_mask);
+ drm_dp_mst_atomic_wait_for_dependencies(state);
+
kms->funcs->enable_commit(kms);
/*
@@ -322,3 +329,8 @@ void msm_atomic_commit_tail(struct drm_atomic_commit *state)
trace_msm_atomic_commit_tail_finish(async, crtc_mask);
}
+
+int msm_atomic_commit_setup(struct drm_atomic_commit *state)
+{
+ return drm_dp_mst_atomic_setup_commit(state);
+}
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index e9a7c9332707..fd0675797fd1 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -211,6 +211,7 @@ int msm_atomic_init_pending_timer(struct msm_pending_timer *timer,
struct msm_kms *kms, int crtc_idx);
void msm_atomic_destroy_pending_timer(struct msm_pending_timer *timer);
void msm_atomic_commit_tail(struct drm_atomic_commit *state);
+int msm_atomic_commit_setup(struct drm_atomic_commit *state);
int msm_atomic_check(struct drm_device *dev, struct drm_atomic_commit *state);
struct drm_atomic_commit *msm_atomic_state_alloc(struct drm_device *dev);
diff --git a/drivers/gpu/drm/msm/msm_kms.c b/drivers/gpu/drm/msm/msm_kms.c
index e5d0ea629448..33ab30300e16 100644
--- a/drivers/gpu/drm/msm/msm_kms.c
+++ b/drivers/gpu/drm/msm/msm_kms.c
@@ -29,6 +29,7 @@ static const struct drm_mode_config_funcs mode_config_funcs = {
static const struct drm_mode_config_helper_funcs mode_config_helper_funcs = {
.atomic_commit_tail = msm_atomic_commit_tail,
+ .atomic_commit_setup = msm_atomic_commit_setup,
};
static irqreturn_t msm_irq(int irq, void *arg)
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* [PATCH v6 26/29] drm/msm/dp: mark the SST bridge disconnected when mst is active
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (24 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 25/29] drm/msm/dp: wire MST helpers into atomic check and commit paths Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 10:00 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 27/29] drm/msm/dp: enable MST on capable sinks Yongxing Mou
` (2 subsequent siblings)
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar, Dmitry Baryshkov
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
The bridge detect function is only applicable for SST. In MST mode,
connector detection is handled by MST bridges. Skip detection for the
SST bridge when MST is active, matching the behavior of other DP MST
implementations.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_display.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 22b925277462..f350c1d03b06 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -959,6 +959,10 @@ enum drm_connector_status msm_dp_bridge_detect(struct drm_bridge *bridge,
priv = container_of(dp, struct msm_dp_display_private, msm_dp_display);
guard(mutex)(&priv->plugged_lock);
+
+ if (dp->mst_active)
+ return status;
+
ret = pm_runtime_resume_and_get(&dp->pdev->dev);
if (ret) {
DRM_ERROR("failed to pm_runtime_resume\n");
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 26/29] drm/msm/dp: mark the SST bridge disconnected when mst is active
2026-08-31 8:17 ` [PATCH v6 26/29] drm/msm/dp: mark the SST bridge disconnected when mst is active Yongxing Mou
@ 2026-08-31 10:00 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 10:00 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] PM runtime reference leak in msm_dp_bridge_detect when called repeatedly while the display is already connected.
--
commit 17d7f7fedae42b8cc437cd2008aeec3429a04725
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
Subject: drm/msm/dp: mark the SST bridge disconnected when mst is active
The bridge detect function is only applicable for SST. In MST mode,
connector detection is handled by MST bridges. Skip detection for the
SST bridge when MST is active, matching the behavior of other DP MST
implementations.
> diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
> index 22b9252774620..f350c1d03b06d 100644
> --- a/drivers/gpu/drm/msm/dp/dp_display.c
> +++ b/drivers/gpu/drm/msm/dp/dp_display.c
> @@ -959,6 +959,10 @@ enum drm_connector_status msm_dp_bridge_detect(struct drm_bridge *bridge,
> priv = container_of(dp, struct msm_dp_display_private, msm_dp_display);
>
> guard(mutex)(&priv->plugged_lock);
> +
> + if (dp->mst_active)
> + return status;
> +
> ret = pm_runtime_resume_and_get(&dp->pdev->dev);
[Severity: High]
This is a pre-existing issue, but is it possible that this unconditionally
acquired PM reference leaks when the display is already connected?
If userspace repeatedly polls the connector while it is already connected,
msm_dp_bridge_detect() takes a PM reference here without checking if the
driver already holds one.
> if (ret) {
> DRM_ERROR("failed to pm_runtime_resume\n");
[ ... ]
> status = connector_status_connected;
> priv->plugged = true;
>
> if (drm_dp_read_sink_count_cap(connector, dpcd, &desc)) {
> int sink_count = drm_dp_read_sink_count(priv->aux);
>
> drm_dbg_dp(dp->drm_dev, "sink_count = %d\n", sink_count);
>
> if (sink_count <= 0)
> status = connector_status_disconnected;
> }
>
> end:
> /*
> * If we detected the DPRX, leave the controller on so that it doesn't
> * lose the state.
> */
> if (!priv->plugged) {
> if (phy_deinit) {
> msm_dp_aux_enable_xfers(priv->aux, false);
> msm_dp_display_host_phy_exit(priv);
> }
>
> pm_runtime_put_sync(&dp->pdev->dev);
> }
Because pm_runtime_put_sync() is only called when priv->plugged is false,
does this mean that if priv->plugged was already true, the PM runtime usage
counter will increment on every poll and never be released?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=26
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 27/29] drm/msm/dp: enable MST on capable sinks
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (25 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 26/29] drm/msm/dp: mark the SST bridge disconnected when mst is active Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 10:04 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 28/29] drm/msm/dp: mark the SST bridge disconnected when an MST-capable sink is present Yongxing Mou
2026-08-31 8:17 ` [PATCH v6 29/29] drm/msm/dp: mark the SST connector disconnected when MST is enabled Yongxing Mou
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
MST topology discovery requires the sink to operate in MST mode.
Enable MST on sinks that advertise MST capability and are connected
to a multi-stream capable DP controller.
Once MST is enabled, downstream sink discovery and EDID retrieval are
handled through the MST topology rather than the primary DP connector.
Activate the MST topology manager on connect and disable it on
disconnect to track the sink topology lifecycle.
Snapshot the negotiated link parameters when MST is enabled so
subsequent MST payload allocation can derive bandwidth information
from a stable link configuration.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_display.c | 59 ++++++++++++++++++++++++++++++++-----
drivers/gpu/drm/msm/dp/dp_display.h | 2 ++
drivers/gpu/drm/msm/dp/dp_mst_drm.c | 18 +++++++++++
drivers/gpu/drm/msm/dp/dp_mst_drm.h | 1 +
4 files changed, 73 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index f350c1d03b06..dbc0e82d333a 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -14,6 +14,7 @@
#include <linux/string_choices.h>
#include <drm/display/drm_dp_aux_bus.h>
#include <drm/display/drm_hdmi_audio_helper.h>
+#include <drm/display/drm_dp_mst_helper.h>
#include <drm/drm_edid.h>
#include "msm_drv.h"
@@ -269,6 +270,29 @@ static int msm_dp_display_lttpr_init(struct msm_dp_display_private *dp, u8 *dpcd
return lttpr_count;
}
+static void msm_dp_display_mst_enable(struct msm_dp_display_private *dp)
+{
+ struct msm_dp *msm_dp = &dp->msm_dp_display;
+ int ret;
+
+ /* Clear any pre-existing MST state before enabling MST. */
+ ret = drm_dp_dpcd_write_byte(dp->aux, DP_MSTM_CTRL, 0);
+ if (ret < 0) {
+ DRM_ERROR("failed to clear DP_MSTM_CTRL, ret=%d\n", ret);
+ return;
+ }
+
+ ret = drm_dp_dpcd_write_byte(dp->aux, DP_MSTM_CTRL,
+ DP_MST_EN | DP_UP_REQ_EN | DP_UPSTREAM_IS_SRC);
+ if (ret < 0) {
+ DRM_ERROR("sink MST enablement failed\n");
+ return;
+ }
+
+ msm_dp->mst_active = true;
+ msm_dp_mst_display_set_mgr_state(msm_dp, true);
+}
+
static int msm_dp_display_process_hpd_high(struct msm_dp_display_private *dp)
{
struct drm_connector *connector = dp->msm_dp_display.connector;
@@ -287,14 +311,17 @@ static int msm_dp_display_process_hpd_high(struct msm_dp_display_private *dp)
if (rc)
goto end;
- drm_edid = drm_edid_read_ddc(connector, &dp->aux->ddc);
- drm_edid_connector_update(connector, drm_edid);
+ if (msm_dp_ctrl_get_stream_cnt(dp->ctrl) <= 1 ||
+ !drm_dp_read_mst_cap(dp->aux, dp->panel->dpcd)) {
+ drm_edid = drm_edid_read_ddc(connector, &dp->aux->ddc);
+ drm_edid_connector_update(connector, drm_edid);
- if (!drm_edid) {
- DRM_ERROR("panel edid read failed\n");
- /* check edid read fail is due to unplug */
- if (!msm_dp_aux_is_link_connected(dp->aux))
- return -ETIMEDOUT;
+ if (!drm_edid) {
+ DRM_ERROR("panel edid read failed\n");
+ /* check edid read fail is due to unplug */
+ if (!msm_dp_aux_is_link_connected(dp->aux))
+ return -ETIMEDOUT;
+ }
}
msm_dp_link_process_request(dp->link);
@@ -316,6 +343,10 @@ static int msm_dp_display_process_hpd_high(struct msm_dp_display_private *dp)
*/
msm_dp_link_psm_config(dp->link, &dp->panel->link_info, false);
+ if (msm_dp_ctrl_get_stream_cnt(dp->ctrl) > 1 &&
+ drm_dp_read_mst_cap(dp->aux, dp->panel->dpcd))
+ msm_dp_display_mst_enable(dp);
+
msm_dp_link_reset_phy_params_vx_px(dp->link);
end:
@@ -490,6 +521,11 @@ static int msm_dp_hpd_unplug_handle(struct msm_dp_display_private *dp)
dp->panel->dpcd,
dp->panel->downstream_ports);
+ if (dp->msm_dp_display.mst_active) {
+ msm_dp_mst_display_set_mgr_state(&dp->msm_dp_display, false);
+ dp->msm_dp_display.mst_active = false;
+ }
+
/* signal the disconnect event early to ensure proper teardown */
msm_dp_display_handle_plugged_change(&dp->msm_dp_display, false);
@@ -566,6 +602,15 @@ struct msm_dp_panel *msm_dp_display_get_panel(struct msm_dp *msm_dp_display,
return dp_panel;
}
+void msm_dp_display_get_link_info(struct msm_dp *msm_dp_display,
+ struct msm_dp_link_info *link_info)
+{
+ struct msm_dp_display_private *dp =
+ container_of(msm_dp_display, struct msm_dp_display_private, msm_dp_display);
+
+ memcpy(link_info, &dp->panel->link_info, sizeof(*link_info));
+}
+
static void msm_dp_display_deinit_sub_modules(struct msm_dp_display_private *dp)
{
msm_dp_audio_put(dp->audio);
diff --git a/drivers/gpu/drm/msm/dp/dp_display.h b/drivers/gpu/drm/msm/dp/dp_display.h
index ca2faf478c95..96b53d5b6090 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.h
+++ b/drivers/gpu/drm/msm/dp/dp_display.h
@@ -65,4 +65,6 @@ int msm_dp_get_mst_max_stream(struct msm_dp *msm_dp_display);
int msm_dp_mst_register(struct msm_dp *msm_dp_display);
struct msm_dp_panel *msm_dp_display_get_panel(struct msm_dp *msm_dp_display,
enum msm_dp_stream_id stream_id);
+void msm_dp_display_get_link_info(struct msm_dp *msm_dp_display,
+ struct msm_dp_link_info *link_info);
#endif /* _DP_DISPLAY_H_ */
diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.c b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
index 2e625a7db981..b2905c894ce5 100644
--- a/drivers/gpu/drm/msm/dp/dp_mst_drm.c
+++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.c
@@ -328,6 +328,24 @@ int msm_dp_mst_attach_encoder(struct msm_dp *dp_display, unsigned int stream_id,
return 0;
}
+int msm_dp_mst_display_set_mgr_state(struct msm_dp *dp_display, bool state)
+{
+ struct msm_dp_mst *mst = dp_display->msm_dp_mst;
+ int rc;
+
+ rc = drm_dp_mst_topology_mgr_set_mst(&mst->mst_mgr, state);
+ if (rc < 0) {
+ drm_err(dp_display->drm_dev,
+ "[MST] failed to set topology mgr state to %d rc:%d\n", state, rc);
+ }
+
+ if (state)
+ msm_dp_display_get_link_info(dp_display, &mst->link_info);
+
+ drm_dbg_kms(dp_display->drm_dev, "[MST] set_mgr_state state:%d\n", state);
+ return rc;
+}
+
void msm_dp_mst_display_hpd_irq(struct msm_dp *dp_display)
{
int rc;
diff --git a/drivers/gpu/drm/msm/dp/dp_mst_drm.h b/drivers/gpu/drm/msm/dp/dp_mst_drm.h
index 8546214cbca1..4a5707dd50a9 100644
--- a/drivers/gpu/drm/msm/dp/dp_mst_drm.h
+++ b/drivers/gpu/drm/msm/dp/dp_mst_drm.h
@@ -10,6 +10,7 @@
int msm_dp_mst_mgr_init(struct msm_dp *dp_display, u32 max_streams, struct drm_dp_aux *drm_aux);
int msm_dp_mst_attach_encoder(struct msm_dp *dp_display, unsigned int stream_id,
struct drm_encoder *encoder);
+int msm_dp_mst_display_set_mgr_state(struct msm_dp *dp_display, bool state);
void msm_dp_mst_display_hpd_irq(struct msm_dp *dp_display);
#endif /* _DP_MST_DRM_H_ */
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 27/29] drm/msm/dp: enable MST on capable sinks
2026-08-31 8:17 ` [PATCH v6 27/29] drm/msm/dp: enable MST on capable sinks Yongxing Mou
@ 2026-08-31 10:04 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 10:04 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Implicit boolean evaluation of enum drm_dp_mst_mode leads to incorrectly enabling MST on SST-only sinks.
--
commit c042ac1b2a4e178e7b21389f0bc30a1309bea2b3
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
drm/msm/dp: enable MST on capable sinks
MST topology discovery requires the sink to operate in MST mode.
Enable MST on sinks that advertise MST capability and are connected
to a multi-stream capable DP controller.
> diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
> index f350c1d03b06d..dbc0e82d333a5 100644
> --- a/drivers/gpu/drm/msm/dp/dp_display.c
> +++ b/drivers/gpu/drm/msm/dp/dp_display.c
[ ... ]
> @@ -287,14 +311,17 @@ static int msm_dp_display_process_hpd_high(struct msm_dp_display_private *dp)
> if (rc)
> goto end;
>
> - drm_edid = drm_edid_read_ddc(connector, &dp->aux->ddc);
> - drm_edid_connector_update(connector, drm_edid);
> + if (msm_dp_ctrl_get_stream_cnt(dp->ctrl) <= 1 ||
> + !drm_dp_read_mst_cap(dp->aux, dp->panel->dpcd)) {
^^^^
[Severity: High]
Does this implicit boolean evaluation of the return value correctly handle
SST-only sinks with sideband messaging?
The drm_dp_read_mst_cap() function returns an enum drm_dp_mst_mode. If a sink
returns DRM_DP_SST_SIDEBAND_MSG (which has a value of 2), the ! negation will
evaluate to false. Will this cause the driver to incorrectly skip the necessary
SST EDID read block here?
> + drm_edid = drm_edid_read_ddc(connector, &dp->aux->ddc);
> + drm_edid_connector_update(connector, drm_edid);
>
> - if (!drm_edid) {
> - DRM_ERROR("panel edid read failed\n");
> - /* check edid read fail is due to unplug */
> - if (!msm_dp_aux_is_link_connected(dp->aux))
> - return -ETIMEDOUT;
> + if (!drm_edid) {
> + DRM_ERROR("panel edid read failed\n");
> + /* check edid read fail is due to unplug */
> + if (!msm_dp_aux_is_link_connected(dp->aux))
> + return -ETIMEDOUT;
> + }
> }
>
> msm_dp_link_process_request(dp->link);
> @@ -316,6 +343,10 @@ static int msm_dp_display_process_hpd_high(struct msm_dp_display_private *dp)
> */
> msm_dp_link_psm_config(dp->link, &dp->panel->link_info, false);
>
> + if (msm_dp_ctrl_get_stream_cnt(dp->ctrl) > 1 &&
> + drm_dp_read_mst_cap(dp->aux, dp->panel->dpcd))
> + msm_dp_display_mst_enable(dp);
^^^^
[Severity: High]
Similarly, will this cause DRM_DP_SST_SIDEBAND_MSG to be treated as fully
MST capable?
Since drm_dp_read_mst_cap() returns 2 for DRM_DP_SST_SIDEBAND_MSG, this
condition evaluates to true. Could this lead to incorrectly executing
msm_dp_display_mst_enable() to enable MST features on an SST sink, improperly
writing DP_MST_EN to DP_MSTM_CTRL?
> +
> msm_dp_link_reset_phy_params_vx_px(dp->link);
>
> end:
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=27
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 28/29] drm/msm/dp: mark the SST bridge disconnected when an MST-capable sink is present
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (26 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 27/29] drm/msm/dp: enable MST on capable sinks Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 10:26 ` sashiko-bot
2026-08-31 8:17 ` [PATCH v6 29/29] drm/msm/dp: mark the SST connector disconnected when MST is enabled Yongxing Mou
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou,
Abhinav Kumar
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
When a DP cable is already attached at boot, msm_dp_bridge_detect()
runs from the connector notify path before MST has been activated on
the sink. The DPCD capability read at that point already indicates
that the sink supports MST.
Return connector_status_disconnected from the SST bridge whenever the
controller supports multi-stream (stream_cnt > 1) and the sink reports
MST capability, so that connector detection is handled by MST
connectors instead of the SST bridge.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_display.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index dbc0e82d333a..d2b2c7141db0 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -1052,6 +1052,10 @@ enum drm_connector_status msm_dp_bridge_detect(struct drm_bridge *bridge,
status = connector_status_disconnected;
}
+ /* Mark SST connector as disconnected in DP boot-up case*/
+ if (msm_dp_ctrl_get_stream_cnt(priv->ctrl) > 1 && drm_dp_read_mst_cap(priv->aux, dpcd))
+ status = connector_status_disconnected;
+
end:
/*
* If we detected the DPRX, leave the controller on so that it doesn't
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 28/29] drm/msm/dp: mark the SST bridge disconnected when an MST-capable sink is present
2026-08-31 8:17 ` [PATCH v6 28/29] drm/msm/dp: mark the SST bridge disconnected when an MST-capable sink is present Yongxing Mou
@ 2026-08-31 10:26 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 10:26 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
New issues:
- [High] Implicit boolean evaluation of drm_dp_read_mst_cap() enum return breaks SST sinks with sideband messaging capability.
- [High] Returning disconnected for MST sinks at boot permanently prevents the MST topology manager from initializing.
Pre-existing issues:
- [High] Unbalanced PM runtime usage count leak on repeated detect calls when the device is plugged in.
--
commit ac2f3880eed108e9f4e8a766ece65af66ffa5cf7
Author: Abhinav Kumar <quic_abhinavk@quicinc.com>
drm/msm/dp: mark the SST bridge disconnected when an MST-capable sink is present
When a DP cable is already attached at boot, msm_dp_bridge_detect()
runs from the connector notify path before MST has been activated on
the sink. This commit forces a disconnected status for SST bridges if
the sink supports MST.
> diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
> index dbc0e82d333a5..d2b2c7141db0f 100644
> --- a/drivers/gpu/drm/msm/dp/dp_display.c
> +++ b/drivers/gpu/drm/msm/dp/dp_display.c
> @@ -1052,6 +1052,10 @@ enum drm_connector_status msm_dp_bridge_detect(struct drm_bridge *bridge,
> status = connector_status_disconnected;
> }
>
> + /* Mark SST connector as disconnected in DP boot-up case*/
> + if (msm_dp_ctrl_get_stream_cnt(priv->ctrl) > 1 && drm_dp_read_mst_cap(priv->aux, dpcd))
[Severity: High]
Does evaluating drm_dp_read_mst_cap() as a boolean prevent SST sinks that
support single-stream sideband messaging from being detected?
drm_dp_read_mst_cap() returns an enum drm_dp_mst_mode. If a sink returns
DRM_DP_SST_SIDEBAND_MSG (which is 2), this condition evaluates to true,
taking the MST disconnection path for an SST sink. Could this cause these
displays to fail detection and remain blank?
[Severity: High]
Does returning connector_status_disconnected at boot prevent the MST
topology manager from initializing?
When msm_dp_bridge_detect() returns connector_status_disconnected for MST
sinks, the DRM core invokes the driver's .hpd_notify with disconnected.
The driver's msm_dp_bridge_hpd_notify() ignores disconnected events if it
thinks it is already disconnected, and skips calling
msm_dp_hpd_plug_handle().
Since msm_dp_hpd_plug_handle() is skipped, msm_dp_display_mst_enable() is
never reached and the MST topology manager is not initialized until a
physical replug generates an HPD interrupt. Could this result in MST
displays connected at boot remaining undetected?
> + status = connector_status_disconnected;
> +
> end:
> /*
> * If we detected the DPRX, leave the controller on so that it doesn't
[Severity: High]
This isn't a bug introduced by this patch, but does this function leak PM
runtime usage counts on repeated detect calls when the device is plugged in?
A PM runtime reference is acquired unconditionally at the start of the
function:
ret = pm_runtime_resume_and_get(&dp->pdev->dev);
However, if the link is connected, priv->plugged is set to true, which
bypasses the pm_runtime_put_sync() call at the end:
if (!priv->plugged) {
...
pm_runtime_put_sync(&dp->pdev->dev);
}
If userspace continuously polls (e.g., via DRM_IOCTL_MODE_GETCONNECTOR)
while the device is plugged in, won't this repeatedly leak references,
eventually preventing suspend? Unplugging would only drop one reference.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=28
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v6 29/29] drm/msm/dp: mark the SST connector disconnected when MST is enabled
2026-08-31 8:17 [PATCH v6 00/29] drm/msm/dp: Add MST support for MSM chipsets Yongxing Mou
` (27 preceding siblings ...)
2026-08-31 8:17 ` [PATCH v6 28/29] drm/msm/dp: mark the SST bridge disconnected when an MST-capable sink is present Yongxing Mou
@ 2026-08-31 8:17 ` Yongxing Mou
2026-08-31 10:15 ` sashiko-bot
28 siblings, 1 reply; 48+ messages in thread
From: Yongxing Mou @ 2026-08-31 8:17 UTC (permalink / raw)
To: Rob Clark, Dmitry Baryshkov, Abhinav Kumar, Sean Paul,
Marijn Suijten, David Airlie, Simona Vetter, Jessica Zhang,
Jessica Zhang
Cc: linux-arm-msm, dri-devel, freedreno, linux-kernel, Yongxing Mou
When MST becomes active, the initial HPD plug notification updates the
SST connector state to connected.
However, the subsequent SST connector detect path reports disconnected
while MST is enabled. This connected -> disconnected transition is then
observed by the polling logic and may result in an unnecessary hotplug
event.
Set the SST connector state to disconnected immediately after MST is
initialized so that the detect path does not introduce a transient
state change.
Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
---
drivers/gpu/drm/msm/dp/dp_display.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index d2b2c7141db0..d207ec3ca8bf 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -290,6 +290,10 @@ static void msm_dp_display_mst_enable(struct msm_dp_display_private *dp)
}
msm_dp->mst_active = true;
+
+ scoped_guard(mutex, &msm_dp->connector->dev->mode_config.mutex)
+ msm_dp->connector->status = connector_status_disconnected;
+
msm_dp_mst_display_set_mgr_state(msm_dp, true);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 48+ messages in thread* Re: [PATCH v6 29/29] drm/msm/dp: mark the SST connector disconnected when MST is enabled
2026-08-31 8:17 ` [PATCH v6 29/29] drm/msm/dp: mark the SST connector disconnected when MST is enabled Yongxing Mou
@ 2026-08-31 10:15 ` sashiko-bot
0 siblings, 0 replies; 48+ messages in thread
From: sashiko-bot @ 2026-08-31 10:15 UTC (permalink / raw)
To: Yongxing Mou; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Acquiring `mode_config.mutex` in `msm_dp_display_mst_enable()` introduces an AB-BA lock inversion with `plugged_lock`, leading to a hard deadlock.
--
commit 48ec7f7903ee88df5ef42da3519327d574e9dc29
Author: Yongxing Mou <yongxing.mou@oss.qualcomm.com>
drm/msm/dp: mark the SST connector disconnected when MST is enabled
This commit sets the SST connector state to disconnected immediately after
MST is initialized. This is intended to prevent the detect path from
introducing a transient connected to disconnected state change that could
result in an unnecessary hotplug event.
> diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
> index d2b2c7141db0f..d207ec3ca8bf2 100644
> --- a/drivers/gpu/drm/msm/dp/dp_display.c
> +++ b/drivers/gpu/drm/msm/dp/dp_display.c
> @@ -290,6 +290,10 @@ static void msm_dp_display_mst_enable(struct msm_dp_display_private *dp)
> }
>
> msm_dp->mst_active = true;
> +
> + scoped_guard(mutex, &msm_dp->connector->dev->mode_config.mutex)
> + msm_dp->connector->status = connector_status_disconnected;
[Severity: High]
Does acquiring mode_config.mutex here in msm_dp_display_mst_enable() introduce
an AB-BA lock inversion with plugged_lock?
During a userspace probe (like xrandr), the DRM core holds mode_config.mutex
and calls down to the bridge detect function in
drivers/gpu/drm/msm/dp/dp_display.c, which establishes this lock ordering:
Thread 1 (probe):
drm_helper_probe_single_connector_modes() (acquires mode_config.mutex)
-> drm_bridge_connector_detect()
-> msm_dp_bridge_detect() (acquires plugged_lock)
However, on a hotplug event, the IRQ thread handles the plug event and calls
into the driver with plugged_lock held, before calling this function:
Thread 2 (hotplug):
drm_bridge_connector_handle_hpd() (unlocks mode_config.mutex)
-> drm_bridge_connector_hpd_notify()
-> msm_dp_bridge_hpd_notify()
-> msm_dp_hpd_plug_handle() (acquires plugged_lock)
-> msm_dp_display_mst_enable() (acquires mode_config.mutex here)
If a DP cable is physically plugged in while a background process or
desktop environment concurrently probes display connectors, can these threads
deadlock?
> +
> msm_dp_mst_display_set_mgr_state(msm_dp, true);
> }
>
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-msm-dp-mst-v6-0-c91d35d6fb9e@oss.qualcomm.com?part=29
^ permalink raw reply [flat|nested] 48+ messages in thread