On Fri, Aug 01, 2025 at 11:07:25PM +0800, Jun Nie wrote:
> Current code will validate current plane and previous plane to
> confirm they can share a SSPP with multi-rect mode. The SSPP
> is already allocated for previous plane, while current plane
> is not associated with any SSPP yet. Null pointer is referenced
> when validating the SSPP of current plane. Skip SSPP validation
> for current plane.
>
> Unable to handle kernel NULL pointer dereference at virtual address
> 0000000000000020
> Mem abort info:
> ESR = 0x0000000096000004
> EC = 0x25: DABT (current EL), IL = 32 bits
> SET = 0, FnV = 0
> EA = 0, S1PTW = 0
> FSC = 0x04: level 0 translation fault
> Data abort info:
> ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> user pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000
> [0000000000000020] pgd=0000000000000000, p4d=0000000000000000
> Internal error: Oops: 0000000096000004 [#1] SMP
> Modules linked in:
> CPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S
> 6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT
> Tainted: [S]=CPU_OUT_OF_SPEC
> Hardware name: SM8650 EV1 rev1 4slam 2et (DT)
> pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
> pc : dpu_plane_is_multirect_capable+0x68/0x90
> lr : dpu_assign_plane_resources+0x288/0x410
> sp : ffff800093dcb770
> x29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000
> x26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800
> x23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080
> x20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff
> x17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200
> x14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000
> x11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950
> x8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000
> x5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438
> x2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000
> Call trace:
> dpu_plane_is_multirect_capable+0x68/0x90 (P)
> dpu_crtc_atomic_check+0x5bc/0x650
> drm_atomic_helper_check_planes+0x13c/0x220
> drm_atomic_helper_check+0x58/0xb8
> msm_atomic_check+0xd8/0xf0
> drm_atomic_check_only+0x4a8/0x968
> drm_atomic_commit+0x50/0xd8
> drm_atomic_helper_update_plane+0x140/0x188
> __setplane_atomic+0xfc/0x148
> drm_mode_setplane+0x164/0x378
> drm_ioctl_kernel+0xc0/0x140
> drm_ioctl+0x20c/0x500
> __arm64_sys_ioctl+0xbc/0xf8
> invoke_syscall+0x50/0x120
> el0_svc_common.constprop.0+0x48/0xf8
> do_el0_svc+0x28/0x40
> el0_svc+0x30/0xd0
> el0t_64_sync_handler+0x144/0x168
> el0t_64_sync+0x198/0x1a0
> Code: b9402021 370fffc1 f9401441 3707ff81 (f94010a1)
> ---[ end trace 0000000000000000 ]---
>
> Fixes: 3ed12a3664b36 ("drm/msm/dpu: allow sharing SSPP between planes")
> Signed-off-by: Jun Nie <jun....@linaro.org>
> ---
> drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 13 +++++++++----
> 1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
> b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
> index
> 01171c535a27c8983aab6450d6f7a4316ae9c4ee..4371c8e1602126bdd0860c5de263db3dd2d3291a
> 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
> @@ -910,7 +910,8 @@ static int dpu_plane_atomic_check_nosspp(struct drm_plane
> *plane,
>
> static int dpu_plane_is_multirect_capable(struct dpu_hw_sspp *sspp,
> struct dpu_sw_pipe_cfg *pipe_cfg,
> - const struct msm_format *fmt)
> + const struct msm_format *fmt,
> + bool validate_sspp)
> {
> if (drm_rect_width(&pipe_cfg->src_rect) !=
> drm_rect_width(&pipe_cfg->dst_rect) ||
> drm_rect_height(&pipe_cfg->src_rect) !=
> drm_rect_height(&pipe_cfg->dst_rect))
> @@ -922,6 +923,9 @@ static int dpu_plane_is_multirect_capable(struct
> dpu_hw_sspp *sspp,
> if (MSM_FORMAT_IS_YUV(fmt))
> return false;
>
> + if (!validate_sspp)
> + return true;
if (!sspp)
return true;
> +
> if (!test_bit(DPU_SSPP_SMART_DMA_V1, &sspp->cap->features) &&
> !test_bit(DPU_SSPP_SMART_DMA_V2, &sspp->cap->features))
> return false;
> @@ -945,7 +949,7 @@ static int dpu_plane_is_multirect_parallel_capable(struct
> dpu_hw_sspp *sspp,
> const struct msm_format *fmt,
> uint32_t max_linewidth)
> {
> - return dpu_plane_is_multirect_capable(sspp, pipe_cfg, fmt) &&
> + return dpu_plane_is_multirect_capable(sspp, pipe_cfg, fmt, true) &&
> dpu_plane_is_parallel_capable(pipe_cfg, fmt, max_linewidth);
> }
>
> @@ -1028,8 +1032,9 @@ static int dpu_plane_try_multirect_shared(struct
> dpu_plane_state *pstate,
> prev_pipe->multirect_mode != DPU_SSPP_MULTIRECT_NONE)
> return false;
>
> - if (!dpu_plane_is_multirect_capable(pipe->sspp, pipe_cfg, fmt) ||
> - !dpu_plane_is_multirect_capable(prev_pipe->sspp, prev_pipe_cfg,
> prev_fmt))
> + /* Do not validate SSPP of current plane when it is not ready */
> + if (!dpu_plane_is_multirect_capable(pipe->sspp, pipe_cfg, fmt, false) ||
> + !dpu_plane_is_multirect_capable(prev_pipe->sspp, prev_pipe_cfg,
> prev_fmt, true))
> return false;
>
> if (MSM_FORMAT_IS_UBWC(fmt))
>
> --
> 2.34.1
>
--
With best wishes
Dmitry
