mtk_crtc_update_output() finds the private data of the display
controller (mmsys) that a CRTC belongs to with
priv->all_drm_private[drm_crtc_index(crtc)]
but all_drm_private[] has one entry per mmsys (mmsys_dev_num entries),
not one per CRTC. mtk_crtc_create() gets the right entry from its
priv_data_index argument, and the two only agree when every mmsys
drives exactly one CRTC and the CRTCs are created in mmsys order.
When a CRTC with connector routes sits on an mmsys that drives more
than one CRTC, the lookup reads past the end of all_drm_private[] (or
picks another mmsys' data), and the route component taken from that
data's ddp_comp[] array is bogus. On an MT8189 board with connector
routes on the external display path (CRTC 1 on the only mmsys), the
first HDMI hotplug oopsed in the compositor's atomic commit.
With the route tables currently in the tree (only MT8188 VDOSYS0, whose
main path is always CRTC 0 and all_drm_private[0]) the two indices
happen to match, so nothing in-tree hits this yet. It triggers as soon
as routes are used on a path that is not the first CRTC of the first
mmsys.
Remember the mmsys private data mtk_crtc_create() used for the CRTC and
use it in mtk_crtc_update_output().
Fixes: 01389b324c97 ("drm/mediatek: Add connector dynamic selection capability")
Assisted-by: LLM
Signed-off-by: zoan37 <[email protected]>
---
Notes:
Testing: on an MT8189 Chromebook (Lenovo IdeaPad Slim 3 Chromebook,
"quigon") running next-20261008 with the not yet merged MT8189 display
support and a local change that puts the connector routes
({1, DVO1}, {1, DSI0}) on the external path. Without this patch the
first HDMI hotplug oopsed in the compositor's commit; with a
functionally identical patch (the field had another name), HDMI
(DSI0 -> IT61620 bridge, 3840x2160@30) and USB-C DisplayPort (DVO1)
both come up on CRTC 1. Not tested on MT8188, the only in-tree user of
connector routes, where the looked-up entry does not change. This exact
patch was compile-tested (W=1) on next-20261008.
drivers/gpu/drm/mediatek/mtk_crtc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_crtc.c
b/drivers/gpu/drm/mediatek/mtk_crtc.c
index 2920f3198ef6..b54f8565d2fa 100644
--- a/drivers/gpu/drm/mediatek/mtk_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_crtc.c
@@ -59,6 +59,7 @@ struct mtk_crtc {
#endif
struct device *mmsys_dev;
+ struct mtk_drm_private *mmsys_priv;
struct device *dma_dev;
struct mtk_mutex *mutex;
unsigned int ddp_comp_nr;
@@ -696,7 +697,7 @@ static void mtk_crtc_update_output(struct drm_crtc *crtc,
if (!mtk_crtc->num_conn_routes)
return;
- priv = ((struct mtk_drm_private
*)crtc->dev->dev_private)->all_drm_private[crtc_index];
+ priv = mtk_crtc->mmsys_priv;
dev = priv->dev;
dev_dbg(dev, "connector change:%d, encoder mask:0x%x for crtc:%d\n",
@@ -1055,6 +1056,7 @@ int mtk_crtc_create(struct drm_device *drm_dev, const
unsigned int *path,
mtk_crtc->ddp_comp_nr = path_len;
mtk_crtc->mmsys_dev = priv->mmsys_dev;
+ mtk_crtc->mmsys_priv = priv;
mtk_crtc->mutex = mtk_mutex_get(priv->mutex_dev);
if (IS_ERR(mtk_crtc->mutex)) {
--
2.43.0
