Re: [PATCH v14 01/13] drm/msm: Do not validate SSPP when it is not ready

[Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>]

On Fri, Aug 01, 2025 at 11:07:25PM +0800, Jun Nie wrote:
> Current code will validate current plane and previous plane to
> confirm they can share a SSPP with multi-rect mode. The SSPP
> is already allocated for previous plane, while current plane
> is not associated with any SSPP yet. Null pointer is referenced
> when validating the SSPP of current plane. Skip SSPP validation
> for current plane.
> 
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
> Mem abort info:
>   ESR = 0x0000000096000004
>   EC = 0x25: DABT (current EL), IL = 32 bits
>   SET = 0, FnV = 0
>   EA = 0, S1PTW = 0
>   FSC = 0x04: level 0 translation fault
> Data abort info:
>   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
>   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
>   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> user pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000
> [0000000000000020] pgd=0000000000000000, p4d=0000000000000000
> Internal error: Oops: 0000000096000004 [#1]  SMP
> Modules linked in:
> CPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S                  6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT
> Tainted: [S]=CPU_OUT_OF_SPEC
> Hardware name: SM8650 EV1 rev1 4slam 2et (DT)
> pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
> pc : dpu_plane_is_multirect_capable+0x68/0x90
> lr : dpu_assign_plane_resources+0x288/0x410
> sp : ffff800093dcb770
> x29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000
> x26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800
> x23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080
> x20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff
> x17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200
> x14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000
> x11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950
> x8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000
> x5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438
> x2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000
> Call trace:
>  dpu_plane_is_multirect_capable+0x68/0x90 (P)
>  dpu_crtc_atomic_check+0x5bc/0x650
>  drm_atomic_helper_check_planes+0x13c/0x220
>  drm_atomic_helper_check+0x58/0xb8
>  msm_atomic_check+0xd8/0xf0
>  drm_atomic_check_only+0x4a8/0x968
>  drm_atomic_commit+0x50/0xd8
>  drm_atomic_helper_update_plane+0x140/0x188
>  __setplane_atomic+0xfc/0x148
>  drm_mode_setplane+0x164/0x378
>  drm_ioctl_kernel+0xc0/0x140
>  drm_ioctl+0x20c/0x500
>  __arm64_sys_ioctl+0xbc/0xf8
>  invoke_syscall+0x50/0x120
>  el0_svc_common.constprop.0+0x48/0xf8
>  do_el0_svc+0x28/0x40
>  el0_svc+0x30/0xd0
>  el0t_64_sync_handler+0x144/0x168
>  el0t_64_sync+0x198/0x1a0
> Code: b9402021 370fffc1 f9401441 3707ff81 (f94010a1)
> ---[ end trace 0000000000000000 ]---
> 
> Fixes: 3ed12a3664b36 ("drm/msm/dpu: allow sharing SSPP between planes")
> Signed-off-by: Jun Nie <jun.nie@linaro.org>
> ---
>  drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
> index 01171c535a27c8983aab6450d6f7a4316ae9c4ee..4371c8e1602126bdd0860c5de263db3dd2d3291a 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
> @@ -910,7 +910,8 @@ static int dpu_plane_atomic_check_nosspp(struct drm_plane *plane,
>  
>  static int dpu_plane_is_multirect_capable(struct dpu_hw_sspp *sspp,
>  					  struct dpu_sw_pipe_cfg *pipe_cfg,
> -					  const struct msm_format *fmt)
> +					  const struct msm_format *fmt,
> +					  bool validate_sspp)
>  {
>  	if (drm_rect_width(&pipe_cfg->src_rect) != drm_rect_width(&pipe_cfg->dst_rect) ||
>  	    drm_rect_height(&pipe_cfg->src_rect) != drm_rect_height(&pipe_cfg->dst_rect))
> @@ -922,6 +923,9 @@ static int dpu_plane_is_multirect_capable(struct dpu_hw_sspp *sspp,
>  	if (MSM_FORMAT_IS_YUV(fmt))
>  		return false;
>  
> +	if (!validate_sspp)
> +		return true;

if (!sspp)
	return true;

> +
>  	if (!test_bit(DPU_SSPP_SMART_DMA_V1, &sspp->cap->features) &&
>  	    !test_bit(DPU_SSPP_SMART_DMA_V2, &sspp->cap->features))
>  		return false;
> @@ -945,7 +949,7 @@ static int dpu_plane_is_multirect_parallel_capable(struct dpu_hw_sspp *sspp,
>  						   const struct msm_format *fmt,
>  						   uint32_t max_linewidth)
>  {
> -	return dpu_plane_is_multirect_capable(sspp, pipe_cfg, fmt) &&
> +	return dpu_plane_is_multirect_capable(sspp, pipe_cfg, fmt, true) &&
>  		dpu_plane_is_parallel_capable(pipe_cfg, fmt, max_linewidth);
>  }
>  
> @@ -1028,8 +1032,9 @@ static int dpu_plane_try_multirect_shared(struct dpu_plane_state *pstate,
>  	    prev_pipe->multirect_mode != DPU_SSPP_MULTIRECT_NONE)
>  		return false;
>  
> -	if (!dpu_plane_is_multirect_capable(pipe->sspp, pipe_cfg, fmt) ||
> -	    !dpu_plane_is_multirect_capable(prev_pipe->sspp, prev_pipe_cfg, prev_fmt))
> +	/* Do not validate SSPP of current plane when it is not ready */
> +	if (!dpu_plane_is_multirect_capable(pipe->sspp, pipe_cfg, fmt, false) ||
> +	    !dpu_plane_is_multirect_capable(prev_pipe->sspp, prev_pipe_cfg, prev_fmt, true))
>  		return false;
>  
>  	if (MSM_FORMAT_IS_UBWC(fmt))
> 
> -- 
> 2.34.1
> 

-- 
With best wishes
Dmitry