drm/msm/dp: fix NULL pointer deref in msm_dp_snapshot() for unmapped MST streams

drivers/gpu/drm/msm/dp/dp_ctrl.c

@@ -3139,6 +3139,16 @@ int msm_dp_ctrl_get_stream_cnt(struct msm_dp_ctrl *msm_dp_ctrl)
 	return ctrl->num_pixel_clks;
 }
 
+bool msm_dp_ctrl_stream_clks_on(struct msm_dp_ctrl *msm_dp_ctrl,
+				 enum msm_dp_stream_id stream_id)
+{
+	struct msm_dp_ctrl_private *ctrl;
+
+	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
+
+	return ctrl->stream_clks_on[stream_id];
+}
+
 struct msm_dp_ctrl *msm_dp_ctrl_get(struct device *dev, struct msm_dp_link *link,
 			struct msm_dp_panel *panel,	struct drm_dp_aux *aux,
 			struct phy *phy,

drivers/gpu/drm/msm/dp/dp_ctrl.h

@@ -52,6 +52,8 @@ void msm_dp_ctrl_disable_irq(struct msm_dp_ctrl *msm_dp_ctrl);
 
 void msm_dp_ctrl_reinit_phy(struct msm_dp_ctrl *msm_dp_ctrl);
 int msm_dp_ctrl_get_stream_cnt(struct msm_dp_ctrl *dp_ctrl);
+bool msm_dp_ctrl_stream_clks_on(struct msm_dp_ctrl *dp_ctrl,
+				 enum msm_dp_stream_id stream_id);
 int msm_dp_ctrl_mst_send_act(struct msm_dp_ctrl *msm_dp_ctrl);
 void msm_dp_ctrl_mst_stream_channel_slot_setup(struct msm_dp_ctrl *msm_dp_ctrl);
 void msm_dp_ctrl_set_mst_channel_info(struct msm_dp_ctrl *msm_dp_ctrl,

drivers/gpu/drm/msm/dp/dp_display.c

@@ -977,18 +977,19 @@ void msm_dp_snapshot(struct msm_disp_state *disp_state, struct msm_dp *dp)
 				    msm_dp_display->aux_base, "dp_aux");
 	msm_disp_snapshot_add_block(disp_state, msm_dp_display->link_len,
 				    msm_dp_display->link_base, "dp_link");
-	msm_disp_snapshot_add_block(disp_state, msm_dp_display->mst2link_len,
-				    msm_dp_display->mst2link_base, "dp_mst2link");
-	msm_disp_snapshot_add_block(disp_state, msm_dp_display->mst3link_len,
-				    msm_dp_display->mst3link_base, "dp_mst3link");
-	msm_disp_snapshot_add_block(disp_state, msm_dp_display->pixel_len,
-				    msm_dp_display->pixel_base[0], "dp_p0");
-	msm_disp_snapshot_add_block(disp_state, msm_dp_display->pixel_len,
-				    msm_dp_display->pixel_base[1], "dp_p1");
-	msm_disp_snapshot_add_block(disp_state, msm_dp_display->pixel_len,
-				    msm_dp_display->pixel_base[2], "dp_p2");
-	msm_disp_snapshot_add_block(disp_state, msm_dp_display->pixel_len,
-				    msm_dp_display->pixel_base[3], "dp_p3");
+	if (msm_dp_display->mst2link_base)
+		msm_disp_snapshot_add_block(disp_state, msm_dp_display->mst2link_len,
+					    msm_dp_display->mst2link_base, "dp_mst2link");
+	if (msm_dp_display->mst3link_base)
+		msm_disp_snapshot_add_block(disp_state, msm_dp_display->mst3link_len,
+					    msm_dp_display->mst3link_base, "dp_mst3link");
+
+	for (int i = 0; i < DP_STREAM_MAX; i++) {
+		if (!msm_dp_ctrl_stream_clks_on(msm_dp_display->ctrl, i))
+			continue;
+		msm_disp_snapshot_add_block(disp_state, msm_dp_display->pixel_len,
+					    msm_dp_display->pixel_base[i], "dp_p%d", i);
+	}
 }
 
 void msm_dp_display_set_psr(struct msm_dp *msm_dp_display, bool enter)
@@ -1320,28 +1321,34 @@ static int msm_dp_display_get_io(struct msm_dp_display_private *display)
 	}
 
 	display->pixel_base[0] = msm_dp_ioremap(pdev, 3, &display->pixel_len);
-	if (IS_ERR(display->pixel_base[0])) {
-		DRM_ERROR("unable to remap p0 region: %pe\n", display->pixel_base[0]);
+	if (IS_ERR(display->pixel_base[0]))
 		return PTR_ERR(display->pixel_base[0]);
-	}
 
-	for (i = DP_STREAM_1; i < display->max_stream; i++) {
-		/* pixels clk reg index start from 3*/
+	for (i = DP_STREAM_1; i < DP_STREAM_MAX; i++) {
 		display->pixel_base[i] = msm_dp_ioremap(pdev, i + 3, &display->pixel_len);
 		if (IS_ERR(display->pixel_base[i])) {
-			DRM_DEBUG_DP("unable to remap p%d region: %pe\n", i,
-				     display->pixel_base[i]);
-			break;
+			int ret = PTR_ERR(display->pixel_base[i]);
+
+			if (ret == -EINVAL) {
+				/* optional resource not present in DT */
+				display->pixel_base[i] = NULL;
+				break;
+			}
+			return ret;
 		}
 	}
 
 	display->mst2link_base = msm_dp_ioremap(pdev, 7, &display->mst2link_len);
-	if (IS_ERR(display->mst2link_base))
-		DRM_DEBUG_DP("unable to remap link region: %pe\n", display->mst2link_base);
+	if (IS_ERR(display->mst2link_base)) {
+		DRM_DEBUG_DP("unable to remap mst2link region: %pe\n", display->mst2link_base);
+		display->mst2link_base = NULL;
+	}
 
 	display->mst3link_base = msm_dp_ioremap(pdev, 8, &display->mst3link_len);
-	if (IS_ERR(display->mst3link_base))
-		DRM_DEBUG_DP("unable to remap link region: %pe\n", display->mst3link_base);
+	if (IS_ERR(display->mst3link_base)) {
+		DRM_DEBUG_DP("unable to remap mst3link region: %pe\n", display->mst3link_base);
+		display->mst3link_base = NULL;
+	}
 
 	return 0;
 }

drivers/gpu/drm/msm/dp/dp_panel.c

@@ -75,8 +75,8 @@ static inline void msm_dp_write_pn(struct msm_dp_panel_private *panel,
 				   u32 offset, u32 data)
 {
 	/*
-	 * To make sure interface reg writes happens before any other operation,
-	 * this function uses writel() instread of writel_relaxed()
+	 * Use writel() instead of writel_relaxed() to ensure the interface
+	 * register write reaches the hardware before subsequent operations.
 	 */
 	writel(data, panel->pixel_base + offset);
 }
@@ -85,8 +85,8 @@ static inline u32 msm_dp_read_pn(struct msm_dp_panel_private *panel,
 				 u32 offset)
 {
 	/*
-	 * To make sure interface reg writes happens before any other operation,
-	 * this function uses writel() instread of writel_relaxed()
+	 * Only reads a configuration register: no DMA or memory ordering is
+	 * required, so readl_relaxed() is sufficient.
 	 */
 	return readl_relaxed(panel->pixel_base + offset);
 }
@@ -414,14 +414,14 @@ static void msm_dp_panel_tpg_enable(struct msm_dp_panel *msm_dp_panel,
 	msm_dp_write_pn(panel, MMSS_DP_INTF_POLARITY_CTL, 0);
 
 	msm_dp_write_pn(panel, MMSS_DP_TPG_MAIN_CONTROL,
-			DP_TPG_CHECKERED_RECT_PATTERN);
+				DP_TPG_CHECKERED_RECT_PATTERN);
 	msm_dp_write_pn(panel, MMSS_DP_TPG_VIDEO_CONFIG,
-			DP_TPG_VIDEO_CONFIG_BPP_8BIT |
-			DP_TPG_VIDEO_CONFIG_RGB);
+				DP_TPG_VIDEO_CONFIG_BPP_8BIT |
+				DP_TPG_VIDEO_CONFIG_RGB);
 	msm_dp_write_pn(panel, MMSS_DP_BIST_ENABLE,
-			DP_BIST_ENABLE_DPBIST_EN);
+				DP_BIST_ENABLE_DPBIST_EN);
 	msm_dp_write_pn(panel, MMSS_DP_TIMING_ENGINE_EN,
-			DP_TIMING_ENGINE_EN_EN);
+				DP_TIMING_ENGINE_EN_EN);
 	drm_dbg_dp(panel->drm_dev, "%s: enabled tpg\n", __func__);
 }