Re: [PATCH] drm/msm/dsi: fix race between cmd transfer and host power off

[Dmitry Baryshkov]

On Wed, Mar 18, 2026 at 11:56:35AM +0100, Cédric Bellegarde wrote:
> The transfer function dsi_host_transfer() guards against the DSI host
> being inactive by checking msm_host->power_on. However, power_on is
> cleared at the end of msm_dsi_host_power_off(), after clocks have
> already been disabled. This creates a window where a concurrent DCS
> command (e.g. a brightness update from the backlight driver) can pass
> the power_on check, call xfer_prepare()/xfer_restore(), and toggle
> link clocks that are already being torn down, leaving
> disp_cc_mdss_byte0_clk stuck in the 'on' state.
> 
> Checking enabled instead of power_on closes the race by rejecting
> transfers as soon as the bridge starts tearing down, before any clocks
> are touched.

Thanks, but it is not correct. The transfer callback is documented as
requiring to power up the host if it is not on at the time it is
called. Could you please implement corresponding logic?

> 
> 
> Signed-off-by: Cédric Bellegarde <cedric.bellegarde@xxxxxxxxxxxx>
> ---
>  drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
> index 4d75529c0e85..f66f138cfba0 100644
> --- a/drivers/gpu/drm/msm/dsi/dsi_host.c
> +++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
> @@ -1652,7 +1652,7 @@ static ssize_t dsi_host_transfer(struct mipi_dsi_host *host,
>  	struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
>  	int ret;
>  
> -	if (!msg || !msm_host->power_on)
> +	if (!msg || !msm_host->enabled)
>  		return -EINVAL;
>  
>  	mutex_lock(&msm_host->cmd_mutex);
> -- 
> 2.53.0
> 

-- 
With best wishes
Dmitry