[PATCH v3 11/13] drm/vino: add the USB driver frontend

[Mike Lothian]

Vino drives DisplayLink DL3 docks as ordinary DRM devices, replacing the
out-of-tree EVDI module and the closed-source DisplayLinkManager daemon.

Add the probe and its lifecycle: bind the display *function* rather than a
product ID, so a dock that postdates this driver is still offered to it;
place the device by family; run bring-up and the presence and EDID worker
off the probe path; and tear down without leaving a DRM minor or a URB
behind.

DisplayLink's own udev rules match vendor 17e9 and then trigger on the
interface, with no product test anywhere. Reverse engineering the wire
protocol found the same split independently: interface protocol 0x03 is a
DL3 display function, and 0x00 is the older udl hardware, which is a
different driver's problem.

The presence worker absorbs a sink that drops and returns within a second
or two, because the dock does that on its own and the repair costs a
dock-wide re-activation. A sink that keeps flapping is not settling: the
dock reports the connector present while nothing drives it, and the panel
stays dark through a bring-up that reports success. Repair that one by
taking the connector away, so the compositor puts it back and the mode set
that answers re-drives the sink. The number of repairs is bounded, so a
dock that flaps as a matter of course cannot hold the driver in a loop of
re-activations, which would leave neither panel lit.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Mike Lothian <mike@xxxxxxxxxxxxxx>
---
 drivers/gpu/drm/vino/vino.rs | 1747 ++++++++++++++++++++++++++++++++++
 1 file changed, 1747 insertions(+)
 create mode 100644 drivers/gpu/drm/vino/vino.rs

diff --git a/drivers/gpu/drm/vino/vino.rs b/drivers/gpu/drm/vino/vino.rs
new file mode 100644
index 000000000000..0813faa43c03
--- /dev/null
+++ b/drivers/gpu/drm/vino/vino.rs
@@ -0,0 +1,1747 @@
+// SPDX-License-Identifier: GPL-2.0
+// SPDX-FileCopyrightText: Copyright (C) 2026 Mike Lothian
+
+//! DRM/KMS driver for DisplayLink DL3 docks.
+//!
+//! Vino drives the Dell Universal Dock D6000 using a clean-room implementation of its USB control,
+//! HDCP authentication and compressed video protocols. Each device owns its control session and
+//! exposes two atomic KMS pipelines backed by shmem GEM objects.
+
+use kernel::{
+    alloc::flags::GFP_KERNEL,
+    alloc::Flags,
+    device::{self, Core},
+    drm,
+    drm::display::hdcp as drm_hdcp,
+    error::code::{EBUSY, EINVAL, ENODEV, EPROTO, ETIMEDOUT},
+    prelude::*,
+    sync::{aref::ARef, new_mutex, Arc, Mutex},
+    time::{
+        delay::{fsleep, udelay},
+        Delta, Instant, Monotonic,
+    },
+    usb,
+    workqueue::{impl_has_work, new_work, Work, WorkItem},
+};
+
+/// Whether the load-time `debug` parameter requested verbose protocol and scanout diagnostics.
+pub(crate) fn debug_enabled() -> bool {
+    *crate::module_parameters::debug.value() != 0
+}
+
+/// Whether this one module load may disclose its ephemeral session material for a wire capture.
+///
+/// This is deliberately separate from ordinary debug logging: the values make a usbmon trace
+/// decryptable and must never appear during a normal load.
+fn trace_crypto_enabled() -> bool {
+    *crate::module_parameters::trace_crypto.value() != 0
+}
+
+/// Emit a driver diagnostic only when the load-time `debug` parameter is nonzero.
+macro_rules! vino_debug {
+    ($($arg:tt)*) => {
+        if crate::debug_enabled() {
+            kernel::pr_info!($($arg)*);
+        }
+    };
+}
+
+/// Device-prefixed counterpart to [`vino_debug`].
+macro_rules! vino_dev_debug {
+    ($dev:expr, $($arg:tt)*) => {
+        if crate::debug_enabled() {
+            kernel::dev_info!($dev, $($arg)*);
+        }
+    };
+}
+
+/// A byte slice on one line, as `08 0a 08 0a`.
+///
+/// `{:#04x?}` renders an array one element per line: the alternate flag asks the derived `Debug`
+/// for pretty output, which in a log line is unreadable.
+pub(crate) struct HexList<'a>(pub(crate) &'a [u8]);
+
+impl kernel::fmt::Display for HexList<'_> {
+    fn fmt(&self, f: &mut kernel::fmt::Formatter<'_>) -> kernel::fmt::Result {
+        for (i, byte) in self.0.iter().enumerate() {
+            write!(f, "{}{byte:02x}", if i == 0 { "" } else { " " })?;
+        }
+        Ok(())
+    }
+}
+
+/// DisplayLink vendor id.
+const VID_DISPLAYLINK: u16 = 0x17e9;
+/// Dell Universal Dock D6000 (DL3 family) product id.
+const PID_D6000: u16 = 0x6006;
+/// WAVLINK DL7400 and relatives: "Universal DP Quad Display Docking 16G", identity tail
+/// `NavaDock`, i.e. the Navarro platform on DL-7000 silicon.
+const PID_DL7400: u16 = 0x7000;
+
+/// Dock identification and the per-dock parameters the rest of the driver reads.
+mod profile;
+/// USB endpoint resolution and the I/O handle transfers go through.
+mod usb_link;
+
+pub(crate) use profile::{DockProfile, EP_CTRL_IN, EP_CTRL_OUT};
+pub(crate) use usb_link::{Endpoints, UsbLink, EP84_BUF};
+
+/// USB transfer timeout used during session setup.
+fn timeout() -> Delta {
+    Delta::from_millis(1000)
+}
+
+/// Short timeout for draining a per-message control reply after a runtime `send_cp`.
+///
+/// EP84 remains in lockstep with EP02, but not every message elicits a reply. A NAK or timeout
+/// therefore means that there is nothing to drain and must not stall scanout or keepalive work.
+pub(crate) fn cp_reply_timeout() -> Delta {
+    Delta::from_millis(8)
+}
+
+/// Time allowed for the downstream receiver to calculate H' during repeater authentication.
+///
+/// The dock acknowledges `AKE_No_Stored_km` before that calculation is complete, so an
+/// acknowledgment cannot be used as the readiness signal.
+// The DL7400's downstream receiver produces H' about 235--240 ms after AKE_No_Stored_km in the
+// working DLM transaction.  Wake just before that result instead of advancing after an arbitrary
+// shorter quiet window; `wait_per_connector_push(0x07)` below remains the actual completion gate.
+const HDCP_HPRIME_WAIT_US: i64 = 220_000;
+
+/// How long a connector's EDID fetch waits for the dock's asynchronous reply.
+///
+/// The `id=0x194` push follows the fetch acknowledgment by several messages, so the reply to the
+/// fetch itself proves nothing. Two seconds is what a cold downstream DDC read has been seen to
+/// take; a connector with nothing plugged into it spends the whole window and then reports no EDID,
+/// which is the correct answer for it.
+const EDID_REPLY_WAIT: Delta = Delta::from_secs(2);
+
+/// Wait until `anchor` is at least `target_us` old.
+fn hold_until(anchor: Instant<Monotonic>, target_us: i64) {
+    const SPIN_MARGIN_US: i64 = 400;
+    let now = anchor.elapsed().as_micros_ceil();
+    if now >= target_us {
+        return;
+    }
+    if target_us - now > SPIN_MARGIN_US {
+        fsleep(Delta::from_micros(target_us - now - SPIN_MARGIN_US));
+    }
+    let now = anchor.elapsed().as_micros_ceil();
+    if now < target_us {
+        udelay(Delta::from_micros(target_us - now));
+    }
+}
+
+mod ake;
+mod color;
+mod cp;
+mod crypto;
+mod firmware;
+mod hdcp;
+mod proto;
+mod rng;
+mod video;
+mod video_arm;
+
+/// The state a completed HDCP 2.2 AKE leaves for control-plane setup.
+struct Session {
+    ks: kernel::crypto::Secret<{ drm_hdcp::ENCRYPTED_SESSION_KEY_LEN }>,
+    riv: [u8; drm_hdcp::RIV_LEN],
+    /// Next inner sequence counter after the AKE messages sent by [`run_ake`].
+    next_ctr: u16,
+    /// Receiver key retained for each downstream repeater authentication.
+    rsa: kernel::crypto::akcipher::RsaPublicKey,
+    rxid_list: KVec<u8>,
+}
+
+/// Tally of one [`drain_ep84`](VinoDriver::drain_ep84) sweep.
+///
+/// An acknowledgment is counted only after its inner header decrypts successfully. A tagged
+/// frame which does not decrypt is counted separately as a rejection.
+#[derive(Default, Clone, Copy)]
+struct Ep84Drain {
+    reads: usize,
+    acks: usize,
+    rejects: usize,
+    /// Sticky EDID-readiness result across combined sweeps.
+    edid_ready: bool,
+    /// Inner counter echoed by a per-connector display-capability reply.
+    display_cap_ctr: Option<u16>,
+    /// Fresh per-connector `rrx` used by downstream repeater authentication.
+    per_connector_rrx: Option<[u8; drm_hdcp::RRX_LEN]>,
+    /// Bit `msg_id` is set for every downstream-HDCP push observed in this sweep.
+    per_connector_seen: u32,
+    per_connector_repeater: Option<bool>,
+    per_connector_hprime: Option<[u8; drm_hdcp::H_PRIME_LEN]>,
+    per_connector_lprime: Option<[u8; drm_hdcp::L_PRIME_LEN]>,
+    /// Navarro's receiver-list payload is nine authenticated list-header bytes followed by V'.
+    per_connector_v: Option<([u8; 9], [u8; drm_hdcp::V_PRIME_HALF_LEN])>,
+    per_connector_auth_status: Option<u8>,
+    per_connector_mprime: Option<[u8; drm_hdcp::H_PRIME_LEN]>,
+}
+
+impl Ep84Drain {
+    /// Fold another sweep's counts into this running total.
+    fn add(&mut self, o: Ep84Drain) {
+        self.reads += o.reads;
+        self.acks += o.acks;
+        self.rejects += o.rejects;
+        self.edid_ready |= o.edid_ready;
+        self.display_cap_ctr = self.display_cap_ctr.or(o.display_cap_ctr);
+        self.per_connector_rrx = self.per_connector_rrx.or(o.per_connector_rrx);
+        self.per_connector_seen |= o.per_connector_seen;
+        self.per_connector_repeater = self.per_connector_repeater.or(o.per_connector_repeater);
+        self.per_connector_hprime = self.per_connector_hprime.or(o.per_connector_hprime);
+        self.per_connector_lprime = self.per_connector_lprime.or(o.per_connector_lprime);
+        self.per_connector_v = self.per_connector_v.or(o.per_connector_v);
+        self.per_connector_auth_status = self
+            .per_connector_auth_status
+            .or(o.per_connector_auth_status);
+        self.per_connector_mprime = self.per_connector_mprime.or(o.per_connector_mprime);
+    }
+
+    fn observe_perhead(&mut self, push: cp::PerheadHdcpPush) {
+        if push.msg_id < 32 {
+            self.per_connector_seen |= 1u32 << push.msg_id;
+        }
+        match push.msg_id {
+            // AKE_Send_Cert: the first vendor payload byte is the repeater flag.
+            0x03 if push.payload_len >= 1 => {
+                self.per_connector_repeater = Some(push.payload[0] != 0);
+            }
+            0x06 if push.payload_len >= drm_hdcp::RRX_LEN => {
+                let mut v = [0u8; drm_hdcp::RRX_LEN];
+                v.copy_from_slice(&push.payload[..drm_hdcp::RRX_LEN]);
+                self.per_connector_rrx = Some(v);
+            }
+            0x07 if push.payload_len >= drm_hdcp::H_PRIME_LEN => {
+                let mut v = [0u8; drm_hdcp::H_PRIME_LEN];
+                v.copy_from_slice(&push.payload[..drm_hdcp::H_PRIME_LEN]);
+                self.per_connector_hprime = Some(v);
+            }
+            0x0a if push.payload_len >= drm_hdcp::L_PRIME_LEN => {
+                let mut v = [0u8; drm_hdcp::L_PRIME_LEN];
+                v.copy_from_slice(&push.payload[..drm_hdcp::L_PRIME_LEN]);
+                self.per_connector_lprime = Some(v);
+            }
+            // ReceiverID_List: RxInfo/seq/list header (9 bytes), V' (16 bytes), padding.
+            0x0c if push.payload_len >= 9 + drm_hdcp::V_PRIME_HALF_LEN => {
+                let mut list = [0u8; 9];
+                let mut vprime = [0u8; drm_hdcp::V_PRIME_HALF_LEN];
+                list.copy_from_slice(&push.payload[..9]);
+                vprime.copy_from_slice(&push.payload[9..9 + drm_hdcp::V_PRIME_HALF_LEN]);
+                self.per_connector_v = Some((list, vprime));
+            }
+            // DisplayLink prefixes ReceiverAuthStatus with one vendor status byte. The HDCP
+            // value is payload[1] (`00 04` in all four working DLM per-connector exchanges).
+            0x12 if push.payload_len >= 2 => {
+                self.per_connector_auth_status = Some(push.payload[1]);
+            }
+            0x11 if push.payload_len >= drm_hdcp::H_PRIME_LEN => {
+                let mut v = [0u8; drm_hdcp::H_PRIME_LEN];
+                v.copy_from_slice(&push.payload[..drm_hdcp::H_PRIME_LEN]);
+                self.per_connector_mprime = Some(v);
+            }
+            _ => {}
+        }
+    }
+
+    fn saw_perhead(&self, msg_id: u8) -> bool {
+        msg_id < 32 && self.per_connector_seen & (1u32 << msg_id) != 0
+    }
+}
+
+mod drm_sink;
+
+/// The USB driver itself. Stateless: everything per-binding lives in [`VinoBoundData`].
+/// Log what this device is, and what it exposes, before any protocol runs.
+///
+/// A DisplayLink generation is not identifiable from the USB IDs alone -- the DL3 protocol vino
+/// speaks does not apply to a DL-1x5 part, and the first sign of that is a control session timing
+/// out long after bind succeeded. Printing the descriptor and the endpoint inventory up front means
+/// a report from unfamiliar hardware carries what is needed to place it, without a debug build:
+/// `bcdDevice` is the vendor's revision, and the endpoint list distinguishes a full DL3 control
+/// device (bulk OUT 0x02 + bulk IN 0x84 + video 0x08) from a part that only has one bulk pipe.
+fn log_device_identity(
+    cdev: &device::Device<Core<'_>>,
+    intf: &usb::Interface<Core<'_>>,
+    ifnum: u8,
+) {
+    // The descriptor describes the whole device, so print it once rather than per interface.
+    if ifnum == 0 {
+        let dev: &usb::Device<Core<'_>> = intf.as_ref();
+        let vid = dev.vendor_id();
+        let pid = dev.product_id();
+        let bcd = dev.bcd_device();
+        let usb_bcd = dev.bcd_usb();
+        vino_dev_debug!(
+            cdev,
+            "USB {vid:04x}:{pid:04x} bcdDevice {:x}.{:02x} bcdUSB {:x}.{:02x} speed {}\n",
+            bcd >> 8,
+            bcd & 0xff,
+            usb_bcd >> 8,
+            usb_bcd & 0xff,
+            dev.speed_str()
+        );
+        // The USB core only caches these when the device answered the string requests.
+        match (dev.manufacturer(), dev.product()) {
+            (Some(m), Some(p)) => vino_dev_debug!(cdev, "{m} {p}\n"),
+            (None, Some(p)) => vino_dev_debug!(cdev, "{p}\n"),
+            (Some(m), None) => vino_dev_debug!(cdev, "{m} (no product string)\n"),
+            (None, None) => vino_dev_debug!(cdev, "no manufacturer/product strings\n"),
+        }
+    }
+    for ep in intf.cur_altsetting().endpoints() {
+        let dir = match ep.endpoint_dir() {
+            kernel::usb::ch9::Direction::In => "in",
+            kernel::usb::ch9::Direction::Out => "out",
+        };
+        let kind = match ep.endpoint_type() {
+            usb::EndpointType::Control => "control",
+            usb::EndpointType::Isoc => "isoc",
+            usb::EndpointType::Bulk => "bulk",
+            usb::EndpointType::Int => "int",
+        };
+        // bEndpointAddress as the descriptor carries it: number plus the direction bit.
+        let addr = ep.endpoint_number()
+            | match ep.endpoint_dir() {
+                kernel::usb::ch9::Direction::In => 0x80,
+                kernel::usb::ch9::Direction::Out => 0,
+            };
+        vino_dev_debug!(cdev, "  ep {addr:#04x} {kind}-{dir} maxp {}\n", ep.maxp());
+    }
+}
+
+struct VinoDriver;
+
+/// Per-bound-interface driver state.
+///
+/// Carries the DRM [`Registration`](drm::Registration), whose lifetime is tied to this bound
+/// device, so unbinding unregisters the card through the accepted registration teardown rather
+/// than a driver-local force-unplug.
+struct VinoBoundData {
+    _intf: ARef<usb::Interface>,
+    /// The registered DRM card, dropped on unbind.
+    ///
+    /// `None` only on idle non-control interfaces. On the control interface it owns the DRM
+    /// registration and provides `disconnect()` access to the device state.
+    registration: Option<drm::Registration<'static, drm_sink::VinoDrmDriver>>,
+    /// Owned handle to the deferred bring-up work (control interface only). `disconnect()` takes
+    /// the option under the mutex before synchronously cancelling the work and unplugging DRM.
+    /// The mutex itself is heap-pinned because kernel locks must not move after initialization.
+    bringup: Pin<KBox<Mutex<Option<Arc<BringUp>>>>>,
+    /// The `/sys/class/firmware/` upload interface, on the DFU interface only.
+    ///
+    /// Held here so it is unregistered when the interface unbinds: the upload callbacks reach the
+    /// dock through the I/O window, which closes at the same time.
+    _fw_upload: Option<kernel::firmware::upload::Registration<firmware::Upload>>,
+    /// Backing store for the name `_fw_upload` was registered under.
+    ///
+    /// `firmware_upload_register` keeps the pointer it is handed rather than copying the string,
+    /// so the name has to outlive the registration. Declared after it so it is dropped second.
+    _fw_upload_name: Option<KBox<kernel::str::CString>>,
+}
+
+/// Deferred bring-up work item.
+///
+/// The device's dedicated session queue keeps blocking authentication and steady-state control I/O
+/// out of the USB probe path and the shared system workqueues.
+#[pin_data]
+struct BringUp {
+    ddev: ARef<drm_sink::VinoDrmDevice>,
+    /// Which dock this is. The bring-up sequence differs by platform (see [`DockProfile`]), and
+    /// the work item runs long after `probe` has returned, so it carries the profile itself.
+    profile: &'static DockProfile,
+    #[pin]
+    work: Work<BringUp>,
+}
+
+impl_has_work! {
+    impl HasWork<Self> for BringUp { self.work }
+}
+
+impl BringUp {
+    fn new(
+        ddev: ARef<drm_sink::VinoDrmDevice>,
+        profile: &'static DockProfile,
+    ) -> Result<Arc<Self>> {
+        Arc::pin_init(
+            pin_init!(BringUp {
+                ddev,
+                profile,
+                work <- new_work!("vino::bring_up"),
+            }),
+            GFP_KERNEL,
+        )
+    }
+}
+
+/// How often one connector's sink has flapped, and how often vino has repaired it.
+///
+/// A sink that drops and returns within a second or two heals on its own, and a repair costs a
+/// dock-wide re-activation, so a single flap is absorbed. One that keeps flapping is not settling:
+/// after the dock is handed to another host and back it reports a connector present while nothing
+/// drives its sink, and the panel stays dark through a bring-up that reports success. Measured on a
+/// lit dock, no flap at all over seventy seconds; on one left dark that way, nine a minute on both
+/// connectors.
+#[derive(Copy, Clone)]
+struct FlapTracker {
+    seen: u32,
+    since: Option<Instant<Monotonic>>,
+    repairs: u32,
+}
+
+impl FlapTracker {
+    /// Flaps inside [`Self::WINDOW`] after which the sink is repaired rather than absorbed.
+    const REPAIR_COUNT: u32 = 3;
+    const WINDOW_MS: i64 = 60_000;
+    /// Repairs one connector may take before vino leaves it alone.
+    ///
+    /// A dock that flaps as a matter of course must not be able to hold vino in a loop of
+    /// re-activations: a bounded few and then silence is recoverable, an unbounded stream is worse
+    /// than the fault it is answering.
+    const REPAIR_LIMIT: u32 = 3;
+
+    const fn new() -> Self {
+        Self {
+            seen: 0,
+            since: None,
+            repairs: 0,
+        }
+    }
+
+    /// Record a flap that healed on its own, and say whether this is the one to repair on.
+    fn healed(&mut self, now: Instant<Monotonic>) -> bool {
+        if self
+            .since
+            .is_none_or(|t| (now - t).as_millis() >= Self::WINDOW_MS)
+        {
+            self.since = Some(now);
+            self.seen = 0;
+        }
+        self.seen += 1;
+        if self.seen < Self::REPAIR_COUNT || self.repairs >= Self::REPAIR_LIMIT {
+            return false;
+        }
+        self.seen = 0;
+        self.since = None;
+        self.repairs += 1;
+        true
+    }
+}
+
+impl WorkItem for BringUp {
+    type Pointer = Arc<BringUp>;
+
+    fn run(this: Arc<BringUp>) {
+        let profile = this.profile;
+        let data: &drm_sink::VinoDrmData = &this.ddev;
+        // Naming the interface needs no I/O token, so the retry loop below can log without
+        // holding one.
+        let cdev: &device::Device = data.io.interface().as_ref();
+        let ddev = &this.ddev;
+        // Establish the transport, authenticate the link and configure the encrypted control
+        // session before publishing the connectors. A transient failure must not leave an
+        // otherwise bound device inert until it is physically replugged.
+        // A dock can refuse a session outright: it answers every control request while NAKing the
+        // first EP02 bulk write until it times out. Back off to about half a minute before giving
+        // the device up.
+        const SESSION_ATTEMPTS: usize = 8;
+        let mut established = false;
+        for attempt in 1..=SESSION_ATTEMPTS {
+            if data.is_shutting_down() {
+                return;
+            }
+            // The token is taken per attempt and dropped before the backoff. Holding one across a
+            // sleep that reaches seconds means a device reset cannot quiesce the driver: the USB
+            // core's pre-reset waits for the last token, the reset that would recover a dock which
+            // has stopped answering waits behind this loop, and an unbind waits behind the reset.
+            let Ok(link) = UsbLink::open(&data.io, data.endpoints) else {
+                return;
+            };
+            let dev = &link;
+            let result = (|| -> Result {
+                VinoDriver::bring_up(dev, profile)?;
+                vino_dev_debug!(cdev, "plaintext session initialized\n");
+                let mut session = VinoDriver::run_ake(dev)?;
+                vino_dev_debug!(cdev, "HDCP AKE + LC + SKE complete\n");
+
+                let mut edid_out: Option<KVec<u8>> = None;
+                let mut edid_connectors: [Option<KVec<u8>>; VinoDriver::CP_SETUP_CONNECTORS] =
+                    core::array::from_fn(|_| None);
+                let mut video_keys = core::array::from_fn(|_| kernel::crypto::Secret::zeroed());
+                let mut connectors_present = [false; VinoDriver::CP_SETUP_CONNECTORS];
+                let mut discovery_deferred = [false; VinoDriver::CP_SETUP_CONNECTORS];
+                let mut stream_opened = 0u32;
+                let (n, wseq_end, ctr_end) = VinoDriver::send_cp_setup(
+                    dev,
+                    profile,
+                    &mut session,
+                    &mut edid_out,
+                    &mut edid_connectors,
+                    &mut video_keys,
+                    &mut connectors_present,
+                    &mut discovery_deferred,
+                    &mut stream_opened,
+                )?;
+                vino_dev_debug!(cdev, "encrypted control setup complete ({n} messages)\n");
+
+                // `send_cp_setup` only returns after an authenticated reply proves that the dock
+                // engaged the session. Publish it before connector state so runtime recovery can
+                // immediately finish any per-connector discovery transaction that was deferred.
+                let drm_dev: &drm_sink::VinoDrmDevice = ddev;
+                let data: &drm_sink::VinoDrmData = drm_dev;
+                data.set_cp_engaged(true);
+                data.publish_session(
+                    dev,
+                    &session.ks,
+                    &session.riv,
+                    wseq_end,
+                    ctr_end,
+                    profile.protocol.ep84_queue_depth,
+                );
+                // Only the connectors whose stream this burst actually opened have consumed their
+                // first sealed block. A connector with no sink yet is opened by whatever drives it
+                // later, and must still start its chain at block zero.
+                data.set_video_keys(video_keys, stream_opened);
+                // The silence watchdog cannot live on this thread: this is the thread it exists
+                // to notice has stopped running.
+                data.start_cp_watchdog(drm_dev);
+
+                // One line naming what setup found on every physical socket, including the ones
+                // this dock does not drive as distinct streams. Which socket a monitor is in is
+                // otherwise invisible from dmesg, and it decides whether a dark output is a sink
+                // problem at all: a connector vino never drives cannot light whatever is plugged
+                // into it. `cap` is the socket's DISPLAY-CAP push, `edid` its raw EDID; the pair
+                // distinguishes an empty socket from one whose sink cannot be read.
+                for connector in 0..usize::from(profile.topology.connectors) {
+                    vino_dev_debug!(
+                        cdev,
+                        "socket {} -- cap:{} edid:{} deferred:{} driven:{}\n",
+                        connector + 1,
+                        if connectors_present[connector] {
+                            "yes"
+                        } else {
+                            "no "
+                        },
+                        if edid_connectors[connector].is_some() {
+                            "yes"
+                        } else {
+                            "no "
+                        },
+                        if discovery_deferred[connector] {
+                            "yes"
+                        } else {
+                            "no "
+                        },
+                        if data.runtime_connector(connector) {
+                            "yes"
+                        } else {
+                            "no "
+                        },
+                    );
+                }
+
+                // Cache complete per-connector discovery results before emitting the single initial
+                // hotplug event. A timed-out connector remains absent and the keepalive's existing
+                // bounded re-engagement path retries it without discarding the live session.
+                for (connector, slot) in edid_connectors
+                    .into_iter()
+                    .enumerate()
+                    .take(usize::from(profile.topology.connectors))
+                {
+                    if discovery_deferred[connector] {
+                        continue;
+                    }
+                    let have_edid = slot.is_some();
+                    if let Some(blob) = slot {
+                        let n = blob.len();
+                        data.set_edid(connector, blob);
+                        vino_dev_debug!(
+                            cdev,
+                            "cached socket {socket} EDID ({n} bytes)\n",
+                            socket = connector + 1
+                        );
+                    }
+                    // A recovered EDID is the presence signal on both platforms. Publishing a
+                    // connector without one puts a fallback mode into an empty socket and makes
+                    // the dock lay out buffers for an output that does not exist.
+                    if have_edid {
+                        data.set_connected(connector);
+                        dev_info!(
+                            cdev,
+                            "socket {socket} monitor connected\n",
+                            socket = connector + 1
+                        );
+                    }
+                }
+
+                // Navarro normally receives each EDID on the fetch drain, exactly as DLM does, but
+                // after a dock re-enumeration a response can arrive seconds late. Publishing that
+                // partial topology lets userspace mode-set one connector while its sibling is still
+                // arriving, which resets this dock, so retry the deferred connectors before the
+                // single initial hotplug. They are interleaved: a connector that never answers must
+                // not hold up one that would. A normal setup sends no additional control messages.
+                if profile.protocol.per_connector_onehot {
+                    /// How long the deferred connectors are retried before the topology is
+                    /// published.
+                    const INITIAL_RECOVERY_MS: i64 = 6000;
+                    /// Extra time granted after a connector answers, for a sibling close behind it.
+                    const SIBLING_GRACE_MS: i64 = 1500;
+
+                    let mut pending: [bool; VinoDriver::CP_SETUP_CONNECTORS] =
+                        core::array::from_fn(|connector| {
+                            connector < usize::from(profile.topology.connectors)
+                                && discovery_deferred[connector]
+                                && data.runtime_connector(connector)
+                                && !data.connector_present(connector)
+                        });
+                    // One probe answers "is this socket empty?"; a re-engage is seven messages
+                    // carrying ~575 ms of mandated delay. A probe that cannot answer is not
+                    // evidence of absence, so only a definite negative stands a connector down.
+                    for connector in 0..VinoDriver::CP_SETUP_CONNECTORS {
+                        if pending[connector]
+                            && data.probe_connector_present(dev, connector as u8) == Some(false)
+                        {
+                            pending[connector] = false;
+                        }
+                    }
+
+                    let started = Instant::<Monotonic>::now();
+                    let mut give_up = started + Delta::from_millis(INITIAL_RECOVERY_MS);
+                    let expired = |give_up: Instant<Monotonic>| {
+                        (Instant::<Monotonic>::now() - give_up).as_millis() >= 0
+                    };
+                    let mut pass = 0u32;
+                    while pending.iter().any(|p| *p)
+                        && !data.is_shutting_down()
+                        && !expired(give_up)
+                    {
+                        pass += 1;
+                        for connector in 0..VinoDriver::CP_SETUP_CONNECTORS {
+                            // Tested per connector, not per pass: a re-engage the dock ignores
+                            // costs seconds, so a pass across four of them would run well past the
+                            // window before anything looked at it.
+                            if !pending[connector] || expired(give_up) {
+                                continue;
+                            }
+                            // Nothing to recover where the dock reports no presence: the connector
+                            // is offered and driven without an EDID, and re-engaging asserts the
+                            // closed bracket, which resets a sink that is already lit.
+                            if !data.reports_presence() {
+                                pending[connector] = false;
+                                continue;
+                            }
+                            if let Ok(true) = data.reengage_connector(dev, connector as u8) {
+                                data.set_connected(connector);
+                                pending[connector] = false;
+                                vino_dev_debug!(
+                                    cdev,
+                                    "socket {socket} monitor connected during initial \
+                                     recovery (pass {pass})\n",
+                                    socket = connector + 1
+                                );
+                                let grace = Instant::<Monotonic>::now()
+                                    + Delta::from_millis(SIBLING_GRACE_MS);
+                                if (grace - give_up).as_millis() > 0 {
+                                    give_up = grace;
+                                }
+                            }
+                        }
+                        fsleep(Delta::from_millis(250));
+                    }
+                    let waited = (Instant::<Monotonic>::now() - started).as_millis();
+                    for connector in 0..VinoDriver::CP_SETUP_CONNECTORS {
+                        if pending[connector] {
+                            dev_warn!(
+                                cdev,
+                                "socket {socket} never answered its EDID fetch \
+                                 ({pass} passes over {waited} ms); publishing without it\n",
+                                socket = connector + 1
+                            );
+                        }
+                    }
+                }
+                Ok(())
+            })();
+
+            drop(link);
+            match result {
+                Ok(()) => {
+                    established = true;
+                    break;
+                }
+                Err(e) if attempt < SESSION_ATTEMPTS => {
+                    let backoff = 250i64 << (attempt - 1).min(5);
+                    dev_warn!(
+                        cdev,
+                        "control-session attempt {attempt}/{SESSION_ATTEMPTS} failed \
+                         ({e:?}); retrying in {backoff} ms\n"
+                    );
+                    fsleep(Delta::from_millis(backoff));
+                }
+                Err(e) => dev_err!(
+                    cdev,
+                    "control session failed after {SESSION_ATTEMPTS} attempts ({e:?})\n"
+                ),
+            }
+        }
+        if !established {
+            return;
+        }
+        let Ok(link) = UsbLink::open(&data.io, data.endpoints) else {
+            return;
+        };
+        let dev = &link;
+        {
+            let drm_dev: &drm_sink::VinoDrmDevice = ddev;
+            // Ridge needs a bounded training interval before userspace can submit a mode set.
+            // Navarro's working transcript has already performed its fixed status sequence in
+            // `send_cp_setup`; another 1.3 seconds inserted ~84 messages before its first clear.
+            if data.cp_engaged() && !profile.protocol.per_connector_onehot {
+                let data: &drm_sink::VinoDrmData = drm_dev;
+                let start = Instant::<Monotonic>::now();
+                let window = Delta::from_millis(1300);
+                let mut polls = 0u32;
+                while Instant::<Monotonic>::now() - start < window && !data.is_shutting_down() {
+                    let _ = data.send_cp(dev, 0x14, 0, |ctr| cp::device_query_req(ctr, 0x000c));
+                    polls += 1;
+                    fsleep(Delta::from_millis(15));
+                }
+                vino_dev_debug!(cdev, "link ready after {polls} status polls\n");
+            }
+            // Whether userspace has been given a connector to drive. The hold below keeps the
+            // control link to itself until the mode set that answers this topology arrives, so it
+            // is only meaningful once there is one to answer. Arming it over an empty topology
+            // silences the link, and the downstream recovery below with it, for as long as the
+            // escape allows -- which is exactly the period a monitor still waking up needs to be
+            // asked for its EDID again.
+            let mut topology_published =
+                (0..data.connector_count()).any(|connector| data.connector_present(connector));
+            if data.dock_wide_modeset() && topology_published {
+                data.hold_cp_for_initial_modeset();
+            }
+            // This is the first point common to every generation at which KMS may touch the dock:
+            // encrypted setup and initial discovery are complete, Ella/Ridge have finished their
+            // pre-mode-set readiness interval, and Navarro's setup-to-first-mode-set hold is armed.
+            // Publish before hotplug so any atomic state userspace produces from that event sees
+            // it.
+            data.publish_kms_activation_ready(drm_dev);
+            drm_dev.hotplug_event();
+            vino_dev_debug!(cdev, "encrypted control session ready\n");
+
+            // The dock requires a continuous control dialogue for the lifetime of the session.
+            let data: &drm_sink::VinoDrmData = drm_dev;
+            vino_dev_debug!(cdev, "starting control keepalive\n");
+            let mut sent = 0u32;
+            // Heartbeats have an independent fixed cadence alongside the status queries.
+            const HEARTBEAT_PERIOD: Delta = Delta::from_secs(3);
+            let mut next_heartbeat = Instant::<Monotonic>::now() + HEARTBEAT_PERIOD;
+            // Probe downstream presence slowly and debounce transitions.
+            // How often status is queried is the dock's business, not this loop's: where video
+            // shares this endpoint each query is bytes queued against a frame and a reply the dock
+            // has to produce mid-scanout. See `DockProfile::status_period_ms`.
+            let status_period = Delta::from_millis(data.status_period_ms());
+            let mut next_status = Instant::<Monotonic>::now();
+            const PRESENCE_PERIOD: Delta = Delta::from_millis(1000);
+            let mut next_presence = Instant::<Monotonic>::now() + PRESENCE_PERIOD;
+            let mut connector_known = [false; VinoDriver::CP_SETUP_CONNECTORS];
+            // The presence probe's last verdict per connector, or `None` until it has answered
+            // once. Distinguishes "no monitor here" from "not asked yet", which the blind
+            // re-engage retry below needs and `connector_known` cannot express.
+            let mut connector_probed: [Option<bool>; VinoDriver::CP_SETUP_CONNECTORS] =
+                [None; VinoDriver::CP_SETUP_CONNECTORS];
+            // Whether this connector has ever had a monitor in this session. Standing the EDID
+            // recovery down means never asking that socket again, so it is only ever right for a
+            // sink that was there and went away. Applied to a socket that has not answered yet it
+            // is a guess about hardware the dock has not finished looking at, and a monitor still
+            // waking up loses its whole session to it.
+            let mut connector_ever_known = [false; VinoDriver::CP_SETUP_CONNECTORS];
+            // Blind sink re-engagements left for a socket that has never had a monitor; see the
+            // negative-probe branch below. Bounded because an engage is seven paced messages and
+            // an empty socket must not pay for them for the life of the session. Ten attempts
+            // at the four-second retry cadence is forty seconds of trying, which is what a D6000
+            // needs: fewer recovers its sink only sometimes.
+            const BLIND_ENGAGE_ATTEMPTS: u8 = 10;
+            let mut blind_engage_left = [BLIND_ENGAGE_ATTEMPTS; VinoDriver::CP_SETUP_CONNECTORS];
+            let mut connector_debounce = [0u8; VinoDriver::CP_SETUP_CONNECTORS];
+            // Floor on the gap between presence probes. A downstream event brings the probe
+            // forward; without a floor it would run once per loop iteration for as long as the
+            // dock keeps talking.
+            const PRESENCE_MIN_GAP: Delta = Delta::from_millis(50);
+            /// How long a connector must read absent before its monitor is called removed.
+            ///
+            /// A removal has to be debounced in TIME, not in probes: every `id=0x44` reply sets the
+            /// downstream-event flag, and a presence probe's own reply *is* an `id=0x44`, so the
+            /// watcher kept pulling itself forward to `PRESENCE_MIN_GAP` and "two consecutive
+            /// contrary reads" fired 132 ms after the first negative.
+            ///
+            /// Measured on a lit, idle DL-7400: the absent runs are 0.11 s to 2.29 s, twenty-nine
+            /// of them over three minutes, reaching 2.46 s around a mode change.
+            ///
+            /// The debounce is only half of it. Those blips are the dock really dropping the sink,
+            /// and letting the connector disappear is what repairs them: the compositor re-enables
+            /// the output and the resulting mode set relights the panel. Debouncing alone leaves
+            /// the connector dark for good, so this works only together with
+            /// `repair_flapped_connector`.
+            const PRESENCE_REMOVE_MS: i64 = 5000;
+            let mut connector_absent_since: [Option<Instant<Monotonic>>;
+                VinoDriver::CP_SETUP_CONNECTORS] = [None; VinoDriver::CP_SETUP_CONNECTORS];
+            // Whether a connector's current run of negative probes has lasted long enough to be
+            // acted on, starting the run if this is its first answer.
+            //
+            // Both the removal path and the EDID-recovery stand-down need this and for the same
+            // reason, so they share one notion of it.
+            let sustained_absent = |run: &mut Option<Instant<Monotonic>>| -> bool {
+                let since = *run.get_or_insert_with(Instant::<Monotonic>::now);
+                (Instant::<Monotonic>::now() - since).as_millis() >= PRESENCE_REMOVE_MS
+            };
+            // A recovered sink need not emit a uniquely identifiable event, so a connector whose
+            // discovery was deferred is retried at a bounded cadence until the probe answers.
+            const REENGAGE_RETRY: Delta = Delta::from_millis(4000);
+            let mut next_reengage = [Instant::<Monotonic>::now(); VinoDriver::CP_SETUP_CONNECTORS];
+            let mut flap = [FlapTracker::new(); VinoDriver::CP_SETUP_CONNECTORS];
+            /// Settling period after re-engagement during which a negative probe is ignored.
+            const PRESENCE_GRACE: Delta = Delta::from_millis(10_000);
+            let mut presence_grace = [Instant::<Monotonic>::now(); VinoDriver::CP_SETUP_CONNECTORS];
+            /// Quiet window a runtime arrival waits out before userspace is told.
+            ///
+            /// A mode set is dock-wide, so two connectors announced separately make the compositor
+            /// reconfigure the dock twice and it re-enumerates. Each arrival restarts the window
+            /// and one event covers the burst. A removal is announced immediately.
+            const HOTPLUG_COALESCE: Delta = Delta::from_millis(1500);
+            let mut hotplug_due: Option<Instant<Monotonic>> = None;
+            // When the current run of silent probes started; only read while `connector_silent >
+            // 0`.
+            for h in 0..data.connector_count() {
+                if !data.runtime_connector(h) {
+                    continue;
+                }
+                connector_known[h] = data.connector_present(h);
+                connector_ever_known[h] = connector_known[h];
+            }
+            // A normal hotplug commit claims this hold almost immediately. Keep a bounded escape
+            // for a userspace session which elects not to light either connector at all.
+            //
+            // Timed, not counted: an iteration of the hold is a push drain of up to eight
+            // one-millisecond reads, so counting iterations as milliseconds overstates the escape
+            // by three to nine times and leaves the link silent for a good fraction of a minute.
+            const INITIAL_MODESET_QUIET: Delta = Delta::from_millis(5000);
+            let mut initial_quiet_until: Option<Instant<Monotonic>> = None;
+            // The cold activation owns EP02 for several seconds. Deadlines which expire while it
+            // owns the link must be re-based when it releases it; otherwise the first post-close
+            // loop sends an overdue heartbeat and presence probes ahead of the status dialogue.
+            // DLM instead continues with status counters 184, 185, ... immediately after its
+            // closing markers.
+            let mut timeline_was_exclusive = false;
+            while !data.is_shutting_down() {
+                // The dock stopped answering and the session was abandoned. Take the outputs down
+                // rather than poll a link that cannot carry anything: userspace can move its
+                // windows off a connector that has disappeared, but not off one that is merely
+                // frozen. Recovery is a replug, which rebinds and starts a fresh session.
+                if !data.cp_link_alive() {
+                    data.drop_connectors_with_session(drm_dev);
+                    break;
+                }
+                if data.initial_modeset_quiet() {
+                    // Quiet means no unsolicited EP02 writes; DLM still has its one EP84 reader
+                    // continuously posted and reaped. Keep draining pushes while userspace is
+                    // preparing the first mode set so that transaction does not begin behind a
+                    // multi-second status backlog.
+                    data.drain_cp_pushes(dev, 8);
+                    let deadline = *initial_quiet_until
+                        .get_or_insert_with(|| Instant::<Monotonic>::now() + INITIAL_MODESET_QUIET);
+                    if (Instant::<Monotonic>::now() - deadline).as_millis() >= 0 {
+                        initial_quiet_until = None;
+                        data.release_initial_modeset_quiet();
+                        vino_dev_debug!(
+                            cdev,
+                            "no initial mode set after {} ms; releasing control keepalive\n",
+                            INITIAL_MODESET_QUIET.as_millis()
+                        );
+                    } else {
+                        fsleep(Delta::from_millis(1));
+                        continue;
+                    }
+                }
+                // Mode-set markers and video activation form one exclusive transaction.
+                if data.cp_timeline_exclusive() {
+                    timeline_was_exclusive = true;
+                    // The KMS worker owns EP02, but it releases `cp_link` between scheduled
+                    // writes. Reap asynchronous EP84 traffic in those gaps just as DLM's reader
+                    // thread does; request replies remain protected because `send_cp_reply`
+                    // holds the mutex until it sees the matching counter.
+                    data.drain_cp_pushes(dev, 8);
+                    fsleep(Delta::from_millis(1));
+                    continue;
+                }
+                if timeline_was_exclusive {
+                    let resumed = Instant::<Monotonic>::now();
+                    next_heartbeat = resumed + HEARTBEAT_PERIOD;
+                    next_presence = resumed + PRESENCE_PERIOD;
+                    timeline_was_exclusive = false;
+                }
+                if (Instant::<Monotonic>::now() - next_status).as_millis() >= 0 {
+                    if data
+                        .send_cp(dev, 0x14, 0, |ctr| cp::device_query_req(ctr, 0x000c))
+                        .is_ok()
+                    {
+                        sent += 1;
+                    }
+                    next_status = Instant::<Monotonic>::now() + status_period;
+                }
+                // Compare through the signed `Delta` returned by subtracting
+                // two instants.
+                let now = Instant::<Monotonic>::now();
+                if (now - next_heartbeat).as_millis() >= 0 {
+                    let _ = data.send_cp(dev, 0x16, 0, cp::heartbeat);
+                    // Advance from the previous deadline so a slow send does not cause drift.
+                    next_heartbeat = next_heartbeat + HEARTBEAT_PERIOD;
+                    if (now - next_heartbeat).as_millis() > 0 {
+                        next_heartbeat = now + HEARTBEAT_PERIOD; // fell far behind; resynchronise
+                    }
+                }
+                // Consume asynchronous pushes instead of leaving them for the next paired read.
+                const MAX_UNPAIRED_DRAIN: usize = 4;
+                data.drain_cp_pushes(dev, MAX_UNPAIRED_DRAIN);
+                // Recover a connector whose setup-time discovery was deferred or timed out. This is
+                // a recovery, not a poll: once the presence probe has answered for a connector that
+                // answer is authoritative and this stands down, or an empty socket costs seven
+                // unanswered CP messages every `REENGAGE_RETRY` for the life of the session.
+                {
+                    let now_r = Instant::<Monotonic>::now();
+                    for h in 0..data.connector_count() {
+                        let socket = h + 1;
+                        if !data.runtime_connector(h) {
+                            continue;
+                        }
+                        if connector_probed[h] == Some(false) {
+                            continue;
+                        }
+                        if connector_known[h] || (now_r - next_reengage[h]).as_millis() < 0 {
+                            continue;
+                        }
+                        // Where the dock says nothing about what is plugged in, this recovery has
+                        // no signal to act on and its cost is visible: `reengage_connector` asserts
+                        // the closed bracket first, so re-running it every `REENGAGE_RETRY` resets
+                        // a sink that is already lit and driven, and the panel flashes.
+                        if !data.reports_presence() {
+                            continue;
+                        }
+                        // A blanked connector's sink is idle because vino asked for it. Re-engaging
+                        // it here would also clear `self_blanked`, since `reengage_connector` does
+                        // so on entry, and the connector would then be torn down mid-blank.
+                        if data.is_self_blanked(h) {
+                            continue;
+                        }
+                        next_reengage[h] = Instant::<Monotonic>::now() + REENGAGE_RETRY;
+                        // Same trade as the initial recovery: one cheap probe instead of seven
+                        // paced messages. It also keeps an empty socket's retry from interleaving
+                        // ~575 ms of engage traffic into a mode-set transaction on another
+                        // connector, which is measurable as delayed activation, not merely as
+                        // noise.
+                        if data.probe_connector_present(dev, h as u8) == Some(false) {
+                            // Do not stand down on the first negative. A recovered EDID is this
+                            // dock's presence signal; the probe is a weaker one that reports a lit
+                            // sink absent for up to 2.5 s at a time. Latching here costs a monitor
+                            // slow to answer at bring-up its whole session: it is never asked for
+                            // an EDID again, and only re-enumerating the dock brings it back.
+                            //
+                            // So hold a negative to the same evidence a removal needs, and only
+                            // for a socket that has had a monitor in it. A socket that has never
+                            // answered goes on being probed: the re-engage is skipped either way
+                            // while the answer is negative, so that costs one probe message per
+                            // `REENGAGE_RETRY` and buys the case this whole path exists for -- a
+                            // panel that is still coming out of standby when the dock is first
+                            // asked about it.
+                            if connector_ever_known[h]
+                                && sustained_absent(&mut connector_absent_since[h])
+                            {
+                                connector_probed[h] = Some(false);
+                            }
+                            // A socket that has never had a monitor is where a negative answer is
+                            // worth least. This dock reports a connector absent precisely while its
+                            // EDID handler is not engaged for that connector, and engaging it is
+                            // what the call below does -- so waiting for a positive first is
+                            // waiting for the thing the re-engage produces. Spend a bounded number
+                            // of blind attempts there, and only while nothing on this dock is lit,
+                            // so a dock that is already driving a panel never has engage traffic
+                            // interleaved into its mode sets.
+                            let nothing_lit = !connector_known.iter().any(|&k| k);
+                            // Where one EDID handler serves every connector, engaging it for this
+                            // one takes it away from the connector that has it, and the fetch that
+                            // follows returns that connector's monitor -- which is then published
+                            // here as this socket's, so a single monitor appears to move between
+                            // sockets and each move tears its connector down. A negative answer is
+                            // the whole answer on such a dock: the engage the discovery path
+                            // already ran is what makes it truthful.
+                            if data.shared_edid_handler() {
+                                continue;
+                            }
+                            if connector_ever_known[h] || !nothing_lit || blind_engage_left[h] == 0
+                            {
+                                continue;
+                            }
+                            blind_engage_left[h] -= 1;
+                        }
+                        connector_absent_since[h] = None;
+                        vino_dev_debug!(
+                            cdev,
+                            "socket {socket} absent -- retrying the sink re-engage\n"
+                        );
+                        // A valid EDID proves presence even while the generic status reply still
+                        // reflects an unengaged EDID handler.
+                        match data.reengage_connector(dev, h as u8) {
+                            Ok(true) => {
+                                data.set_connected(h);
+                                connector_known[h] = true;
+                                connector_ever_known[h] = true;
+                                connector_debounce[h] = 0;
+                                presence_grace[h] = Instant::<Monotonic>::now() + PRESENCE_GRACE;
+                                vino_dev_debug!(
+                                    cdev,
+                                    "socket {socket} monitor connected after sink re-engagement\n"
+                                );
+                                hotplug_due = Some(Instant::<Monotonic>::now() + HOTPLUG_COALESCE);
+                            }
+                            Ok(false) => {}
+                            Err(e) => {
+                                vino_dev_debug!(
+                                    cdev,
+                                    "socket {socket} sink re-engagement failed ({e:?})\n"
+                                )
+                            }
+                        }
+                        next_presence = Instant::<Monotonic>::now();
+                    }
+                }
+                // A topology push brings presence probing forward.  Do not also cancel the
+                // absent-connector re-engage backoff here: Navarro emits an `id=0x44` reply for
+                // every ordinary presence probe, and `drain_cp_pushes` deliberately reports that as
+                // a downstream event.  Resetting `next_reengage` on each such reply turned two
+                // empty sockets into a continuous engage/EDID loop instead of the documented
+                // four-second retry cadence.  The probe below observes an actual arrival and then
+                // re-engages that specific connector immediately.
+                if data.take_downstream_event() {
+                    // Bring the probe forward, but never below `PRESENCE_MIN_GAP`.
+                    let soonest = Instant::<Monotonic>::now() + PRESENCE_MIN_GAP;
+                    if (next_presence - soonest).as_millis() > 0 {
+                        next_presence = soonest;
+                    }
+                }
+                let now_p = Instant::<Monotonic>::now();
+                if (now_p - next_presence).as_millis() >= 0 {
+                    next_presence = now_p + PRESENCE_PERIOD;
+                    for h in 0..data.connector_count() {
+                        let socket = h + 1;
+                        if !data.runtime_connector(h) {
+                            continue;
+                        }
+                        // A missing reply carries no status bit, so it is not evidence that this
+                        // monitor disappeared; wait for a decodable negative instead of tearing
+                        // down a live connector.
+                        let Some(present) = data.probe_connector_present(dev, h as u8) else {
+                            continue;
+                        };
+                        // Nothing this probe says about a connector vino blanked is news, in either
+                        // direction: the absence is vino's own doing, and this dock also flaps a
+                        // blanked sink back to *present*, which would re-engage it and clear
+                        // `self_blanked` -- leaving the next sustained negative free to tear the
+                        // connector down mid-blank. The flag is cleared by the wake, in
+                        // `atomic_enable`.
+                        if data.is_self_blanked(h) {
+                            connector_debounce[h] = 0;
+                            connector_absent_since[h] = None;
+                            continue;
+                        }
+                        // The probe has spoken for this connector, so the blind re-engage retry
+                        // above stands down for it -- but only a *positive* answer is authoritative
+                        // straight away. A negative one has to outlast `PRESENCE_REMOVE_MS`, and
+                        // has to be about a socket that has had a monitor in it, for the same
+                        // reasons it does above.
+                        if present {
+                            connector_probed[h] = Some(true);
+                            // The absent run is cleared below, not here: the "flap healed on its
+                            // own" line reads it with `take()` and would never fire again.
+                        } else if connector_ever_known[h]
+                            && sustained_absent(&mut connector_absent_since[h])
+                        {
+                            connector_probed[h] = Some(false);
+                        }
+                        if present == connector_known[h] {
+                            connector_debounce[h] = 0;
+                            // The sink came back before the removal deadline, so the connector was
+                            // never dropped and nothing downstream will re-drive this connector.
+                            // The dock has forgotten it, so vino has to put it back itself. Do not
+                            // re-drive the connector here. Most of these blips heal on their own --
+                            // the dock brings the sink back within a second or two -- and a repair
+                            // costs a full dock-wide re-activation, four seconds of cold
+                            // choreography for both panels. Firing one per flap puts the dock into
+                            // a permanent re-activation loop, one every five to fifteen seconds,
+                            // and neither panel stays lit. Absorbing the blip is the whole point; a
+                            // drop that does *not* heal still falls through to the timed removal
+                            // below.
+                            if present && connector_absent_since[h].take().is_some() {
+                                let now = Instant::<Monotonic>::now();
+                                if flap[h].healed(now) {
+                                    // Take the connector away so the compositor puts it back: the
+                                    // mode set that answers is what re-drives the sink, and it is
+                                    // the same repair a sustained absence gets below.
+                                    connector_known[h] = false;
+                                    connector_debounce[h] = 0;
+                                    next_reengage[h] = now + REENGAGE_RETRY;
+                                    data.set_disconnected(h);
+                                    dev_info!(
+                                        cdev,
+                                        "socket {socket} sink will not settle; dropping the connector so it is re-driven\n"
+                                    );
+                                    hotplug_due = None;
+                                    drm_dev.hotplug_event();
+                                    next_presence = Instant::<Monotonic>::now() + PRESENCE_PERIOD;
+                                    continue;
+                                }
+                                vino_dev_debug!(
+                                    cdev,
+                                    "socket {socket} sink flap healed on its own\n"
+                                );
+                            }
+                            continue;
+                        }
+                        // Inside the settling window after a recovery, a negative answer is not
+                        // evidence -- see `PRESENCE_GRACE`.
+                        if !present
+                            && (Instant::<Monotonic>::now() - presence_grace[h]).as_millis() < 0
+                        {
+                            connector_debounce[h] = 0;
+                            connector_absent_since[h] = None;
+                            continue;
+                        }
+                        if present {
+                            // Two consecutive contrary reads before announcing an arrival.
+                            connector_absent_since[h] = None;
+                            connector_debounce[h] = connector_debounce[h].saturating_add(1);
+                            if connector_debounce[h] < 2 {
+                                continue;
+                            }
+                        } else {
+                            // A removal must be sustained: the dock reports a lit sink absent for
+                            // seconds at a time. Counting probes instead of time does not work --
+                            // every `id=0x44` reply sets the downstream-event flag, and a probe's
+                            // own reply is one, so the watcher pulls itself forward and "two
+                            // contrary reads" fires 132 ms after the first negative.
+                            if !sustained_absent(&mut connector_absent_since[h]) {
+                                continue;
+                            }
+                            connector_absent_since[h] = None;
+                        }
+                        connector_debounce[h] = 0;
+                        if present {
+                            // An attempt that came back without an EDID has already answered, and
+                            // this path never read the deadline it set: the attempt clears the
+                            // debounce, two more probes rebuild it, and a socket the dock calls
+                            // present with nothing plugged into it re-engages every two seconds
+                            // for the life of the session. Seven paced control messages, on a dock
+                            // whose vendor sends one status query in the same interval and shares
+                            // the endpoint with its pixels.
+                            if (Instant::<Monotonic>::now() - next_reengage[h]).as_millis() < 0 {
+                                continue;
+                            }
+                            // Re-engage the downstream sink before accepting another mode set.
+                            match data.reengage_connector(dev, h as u8) {
+                                Ok(true) => {}
+                                Ok(false) => {
+                                    next_reengage[h] = Instant::<Monotonic>::now() + REENGAGE_RETRY;
+                                    continue;
+                                }
+                                Err(e) => {
+                                    vino_dev_debug!(
+                                        cdev,
+                                        "socket {socket} sink re-engagement failed ({e:?})\n"
+                                    );
+                                    next_reengage[h] = Instant::<Monotonic>::now() + REENGAGE_RETRY;
+                                    continue;
+                                }
+                            }
+                            data.set_connected(h);
+                            connector_known[h] = true;
+                            connector_ever_known[h] = true;
+                            flap[h] = FlapTracker::new();
+                            next_reengage[h] = Instant::<Monotonic>::now() + REENGAGE_RETRY;
+                            presence_grace[h] = Instant::<Monotonic>::now() + PRESENCE_GRACE;
+                            dev_info!(cdev, "socket {socket} monitor connected\n");
+                            // Same downstream readiness wait as a fresh bring-up before notifying
+                            // userspace, so KWin's mode-set lands on a settled downstream link.
+                            let rs = Instant::<Monotonic>::now();
+                            while (Instant::<Monotonic>::now() - rs).as_millis() < 1300
+                                && !data.is_shutting_down()
+                            {
+                                let _ = data
+                                    .send_cp(dev, 0x14, 0, |ctr| cp::device_query_req(ctr, 0x000c));
+                                fsleep(Delta::from_millis(15));
+                            }
+                            hotplug_due = Some(Instant::<Monotonic>::now() + HOTPLUG_COALESCE);
+                        } else {
+                            connector_known[h] = false;
+                            next_reengage[h] = Instant::<Monotonic>::now() + REENGAGE_RETRY;
+                            data.set_disconnected(h);
+                            dev_info!(cdev, "socket {socket} monitor disconnected\n");
+                            // This event also covers any arrival still waiting out its window.
+                            hotplug_due = None;
+                            drm_dev.hotplug_event();
+                        }
+                        // Re-baseline the heartbeat/presence deadlines skipped during the wait.
+                        next_presence = Instant::<Monotonic>::now() + PRESENCE_PERIOD;
+                    }
+                }
+                // Announce a settled burst of arrivals as one topology change.
+                if let Some(due) = hotplug_due {
+                    if (Instant::<Monotonic>::now() - due).as_millis() >= 0 {
+                        hotplug_due = None;
+                        // A monitor whose sink was not ready at bring-up is published here
+                        // instead, and the mode set answering it is still this session's first.
+                        // It needs the same quiet link a bring-up gives its own: the activation
+                        // is dock-wide, and the re-engage retries aimed at the sockets that are
+                        // genuinely empty are ~575 ms of paced traffic each, landing in the
+                        // middle of it otherwise.
+                        if data.dock_wide_modeset() && !topology_published {
+                            initial_quiet_until = None;
+                            data.hold_cp_for_initial_modeset();
+                        }
+                        topology_published = true;
+                        drm_dev.hotplug_event();
+                    }
+                }
+                // A dock that tears the link down over a silent video endpoint needs feeding even
+                // when the compositor has nothing to redraw.
+                data.send_video_keepalive(dev);
+                // A dock whose video shares this endpoint has its scanout workers stood down for
+                // the duration of every control message, and a worker that bails does not re-arm
+                // itself. Wake them here, where a device handle is in hand, so a connector with
+                // nothing else to trigger it still resumes.
+                if data.video_on_ctrl_pipe() {
+                    data.enqueue_scanout_all(drm_dev);
+                }
+                fsleep(Delta::from_millis(13));
+            }
+            vino_dev_debug!(cdev, "CP keepalive finished ({sent} polls)\n");
+        }
+    }
+}
+
+/// Control-session bring-up: plaintext init, link AKE, and the sealed per-connector setup.
+mod session;
+
+/// Which DisplayLink function an interface exposes, i.e. why this driver was offered it.
+///
+/// This is what the ID table carries. A table of product IDs cannot say anything useful about
+/// hardware nobody has tested, but the interface descriptor says what a function *is*, and that
+/// is stable across every dock in the family.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Function {
+    /// The DL3 display function: the control endpoints and every video endpoint.
+    Display,
+    /// The DFU interface, which carries the identity descriptor and firmware updates.
+    Dfu,
+}
+
+/// Vendor-specific class, which every DisplayLink display function uses.
+const CLASS_VENDOR: u8 = 0xff;
+/// Interface protocol of a DL3 display function. `0x00` is the old `udl` hardware, which is a
+/// different driver's problem, so keying on this excludes it for free.
+const PROTOCOL_DL3: u8 = 0x03;
+/// Application-specific class, subclass and protocol of a USB DFU runtime interface.
+const CLASS_DFU: (u8, u8, u8) = (0xfe, 0x01, 0x01);
+
+// DisplayLink's own udev rules match `17e9/*` and then trigger on the interface, with no product
+// test anywhere. Reverse engineering found the same split independently. Binding the *function*
+// rather than a list of tested products is what lets a dock nobody here owns come up; the
+// identity descriptor read in `probe` is the safety valve that keeps that honest.
+kernel::usb_device_table!(
+    USB_TABLE,
+    MODULE_USB_TABLE,
+    <VinoDriver as usb::Driver>::IdInfo,
+    [
+        (
+            usb::DeviceId::from_vendor_and_interface_info(
+                VID_DISPLAYLINK,
+                CLASS_VENDOR,
+                0x00,
+                PROTOCOL_DL3
+            ),
+            Function::Display
+        ),
+        (
+            usb::DeviceId::from_vendor_and_interface_info(
+                VID_DISPLAYLINK,
+                CLASS_DFU.0,
+                CLASS_DFU.1,
+                CLASS_DFU.2
+            ),
+            Function::Dfu
+        ),
+    ]
+);
+
+impl usb::Driver for VinoDriver {
+    type IdInfo = Function;
+    type Data<'bound> = VinoBoundData;
+    const ID_TABLE: usb::IdTable<Self::IdInfo> = &USB_TABLE;
+    // The dock goes on scanning out its last decoded frame for as long as it is powered, so a
+    // driver that simply stops talking leaves both monitors lit on a frozen desktop. Telling them
+    // to power down is the last thing this driver does, and it can only be done while the
+    // interface's endpoints still exist -- which by default they do not by the time any callback
+    // runs. `quiesce` cancels every outstanding transfer itself.
+    const SOFT_UNBIND: bool = true;
+
+    fn probe<'bound>(
+        intf: &'bound usb::Interface<Core<'_>>,
+        _id: &usb::DeviceId,
+        info: &'bound Self::IdInfo,
+        io: Arc<usb::IoWindow>,
+    ) -> impl PinInit<Self::Data<'bound>, Error> + 'bound {
+        let cdev: &device::Device<Core<'_>> = intf.as_ref();
+        // The control endpoints (0x02/0x84) and the whole HDCP session live on the display
+        // function -- drive bring-up only there so the preamble and AKE do not run once per
+        // interface and pollute the dock's state machine. An interface with no active alternate
+        // setting has no endpoints to drive.
+        let function = *info;
+        let ifnum = intf.number().ok_or(ENODEV)?;
+        log_device_identity(cdev, intf, ifnum);
+
+        // What this hardware *is*, asked of the hardware. `read_identity` walks the ordinary
+        // configuration descriptor: one standard control transfer, no session and no crypto, so
+        // it works at probe on either interface and long before the dock will talk to anyone.
+        let identity = io
+            .enter()
+            .and_then(|link| firmware::read_identity(&link))
+            .ok();
+        let identity_family = identity.as_ref().and_then(firmware::Identity::family);
+
+        // Writing firmware the dock does not need is a deliberate act: its DFU interface does
+        // not support upload, so there is no way to read the running image back and nothing to
+        // restore from if the write goes wrong.
+        let force = *crate::module_parameters::force_flash.value() != 0;
+        if function == Function::Dfu {
+            // Every DFU request is addressed to this interface. A failed check is not fatal: a
+            // dock runs perfectly well on the firmware it shipped with.
+            match (identity.as_ref().ok_or(ENODEV)).and_then(|id| {
+                let link = io.enter()?;
+                dev_info!(cdev, "{id} running firmware {}\n", id.version);
+                firmware::update_if_newer(&link, cdev, id, u16::from(ifnum), force)
+            }) {
+                Ok(()) => {}
+                Err(e) => dev_info!(cdev, "dock firmware check skipped ({e:?})\n"),
+            }
+        }
+        // The manual path: userspace writes an image and vino flashes it, whatever version it is.
+        // This is how a re-flash of the running version or a downgrade is done at all, since the
+        // automatic check refuses both. Published only on the DFU interface, and only for a dock
+        // whose family is recognised -- an image for another family is refused in `prepare`.
+        let mut fw_upload_name: Option<KBox<kernel::str::CString>> = None;
+        let fw_upload = if function == Function::Dfu {
+            match identity_family {
+                Some(family) => {
+                    let ctx = Arc::new(
+                        firmware::UploadCtx {
+                            window: io.clone(),
+                            cancelled: core::sync::atomic::AtomicBool::new(false),
+                            family,
+                        },
+                        GFP_KERNEL,
+                    )?;
+                    // Named per device, not `vino-dock`. The name becomes a device name inside
+                    // the shared `firmware` class, so a fixed one lets only the first dock
+                    // register and leaves the node saying nothing about which dock it flashes --
+                    // with two docks attached that is a route to flashing the wrong one.
+                    let name = kernel::str::CString::try_from_fmt(kernel::prelude::fmt!(
+                        "vino-dock-{}",
+                        cdev.name()
+                    ))
+                    .and_then(|n| KBox::new(n, GFP_KERNEL).map_err(Into::into));
+                    match name {
+                        Ok(name) => match kernel::firmware::upload::Registration::new(
+                            &THIS_MODULE,
+                            cdev,
+                            &name,
+                            ctx,
+                        ) {
+                            Ok(reg) => {
+                                dev_info!(
+                                    cdev,
+                                    "firmware upload available at /sys/class/firmware/{}\n",
+                                    &**name
+                                );
+                                fw_upload_name = Some(name);
+                                Some(reg)
+                            }
+                            Err(e) => {
+                                dev_warn!(cdev, "no firmware upload interface ({e:?})\n");
+                                None
+                            }
+                        },
+                        Err(e) => {
+                            dev_warn!(cdev, "no firmware upload interface ({e:?})\n");
+                            None
+                        }
+                    }
+                }
+                None => None,
+            }
+        } else {
+            None
+        };
+        if function == Function::Dfu {
+            vino_dev_debug!(
+                cdev,
+                "bound interface {ifnum} (idle -- control is the display function)\n"
+            );
+            return Ok(VinoBoundData {
+                _intf: intf.into(),
+                registration: None,
+                bringup: KBox::pin_init(new_mutex!(None), GFP_KERNEL)?,
+                _fw_upload: fw_upload,
+                _fw_upload_name: fw_upload_name,
+            });
+        }
+
+        // The DFU interface is probed independently of this one and writes firmware in its own
+        // probe, which reboots the dock. Establishing a control session against a dock that is
+        // about to drop off the bus only produces timeouts and a device that is torn down and
+        // rebuilt, so leave it alone: the dock re-enumerates on the new firmware and this probe
+        // runs again with nothing pending. The attempt limit is what stops that repeating.
+        if let Some(id) = identity.as_ref() {
+            if firmware::update_pending(cdev, id, force) {
+                dev_info!(
+                    cdev,
+                    "dock firmware update pending; the display function binds once it has run\n"
+                );
+                return Err(ENODEV);
+            }
+        }
+
+        // The safety valve for matching on the interface rather than on a product ID. A dock that
+        // answers with a family nobody here has driven is declined by name, so its owner gets a
+        // log line and a report to send instead of a driver guessing at its wire format -- and
+        // the way a dock rejects a guess is to reset itself. A dock that could not be *asked*
+        // falls back to the product-ID quirk table, because a transient descriptor read must not
+        // cost a working device its display.
+        let profile = match identity_family {
+            Some(family) => match profile::for_family(family) {
+                Some(profile) => profile,
+                None => {
+                    let id = identity.as_ref().ok_or(ENODEV)?;
+                    dev_info!(
+                        cdev,
+                        "{id} is not a family this driver drives yet; declining. \
+                         A report makes it supportable: Documentation/gpu/vino.rst\n"
+                    );
+                    return Err(ENODEV);
+                }
+            },
+            None => {
+                let usbdev: &usb::Device<Core<'_>> = intf.as_ref();
+                match profile::for_product(usbdev.product_id()) {
+                    Some(profile) => {
+                        dev_warn!(
+                            cdev,
+                            "identity descriptor unreadable; using the quirk entry for \
+                             {:04x}\n",
+                            usbdev.product_id()
+                        );
+                        profile
+                    }
+                    None => {
+                        dev_info!(
+                            cdev,
+                            "no identity descriptor and no quirk entry; declining. \
+                             A report makes it supportable: Documentation/gpu/vino.rst\n"
+                        );
+                        return Err(ENODEV);
+                    }
+                }
+            }
+        };
+        // One line per bind, naming the hardware the driver decided it is holding. On unfamiliar
+        // hardware this is what says whether the dock was recognised or fell back to a stranger's
+        // profile, so it stays out of the debug gate. The endpoint map that follows from it is a
+        // debug detail.
+        dev_info!(cdev, "{}\n", profile.name);
+        vino_dev_debug!(
+            cdev,
+            "video endpoints {}, 10-bit capable {}\n",
+            HexList(&profile.topology.video_endpoints),
+            profile.capabilities.hdr_capable
+        );
+        // Register the DRM/KMS device on the control interface. Keep a refcounted interface handle
+        // in the bound data while the DRM device retains the I/O window used by its workers.
+        let intf_ref: ARef<usb::Interface> = intf.into();
+
+        // Resolve the dock's endpoints against the display function's descriptor once, so every
+        // later transfer names a direction/type-checked endpoint instead of a bare address.
+        let (endpoints, connectors) = Endpoints::resolve(intf, profile)?;
+        if connectors != profile.topology.connectors {
+            dev_warn!(
+                cdev,
+                "{connectors} connector(s) backed by video endpoints, not the {} this \
+                 profile describes; driving what the device exposes\n",
+                profile.topology.connectors
+            );
+        }
+
+        // DRM device lifecycle: allocate an `UnregisteredDevice`, wire up the KMS pipeline on it
+        // while still unregistered, then register it. The `Registration` is stored in the bound
+        // data below, so the card is unregistered by the ordered unbind rather than by a
+        // driver-local force-unplug.
+        let unreg = drm::UnregisteredDevice::<drm_sink::VinoDrmDriver>::new(
+            intf,
+            // The ten-bit and cursor flags and the connector count have to arrive here, not in the
+            // profile block below: the KMS objects are built during this call, and they decide
+            // then whether to offer a 10-bit format, the HDR connector properties and a cursor
+            // plane, and how many connectors to build at all.
+            drm_sink::VinoDrmData::new(
+                io.clone(),
+                endpoints,
+                profile.capabilities.hdr_capable,
+                profile.capabilities.hw_cursor,
+                connectors,
+            ),
+            &THIS_MODULE,
+        )?;
+        // `Core` derefs to `Bound`; name the context explicitly so `as_ref()`
+        // resolves to the bound parent required by DRM registration.
+        let bound_intf: &usb::Interface<device::Bound> = intf;
+        let parent: &device::Device<device::Bound> = bound_intf.as_ref();
+        let registration = drm::Registration::new_static(parent, unreg, (), 0)?;
+        let ddev: ARef<drm_sink::VinoDrmDevice> = registration.device().into();
+        vino_dev_debug!(cdev, "DRM/KMS device registered\n");
+
+        // The session preamble, HDCP authentication and control setup use blocking USB transfers.
+        // Run them on the device's ordered session queue so probe can return immediately. The work
+        // item owns the DRM device, and the bound data retains a handle so quiesce can cancel or
+        // flush it before the I/O window closes.
+        // Gate video on what this platform's video path is known to accept.
+        {
+            let d: &drm_sink::VinoDrmData = &ddev;
+            // `force_video` exists to answer one question on a dock whose profile disables video:
+            // whether the platform actually requires its sealed stream-open, or whether correct
+            // record framing alone is enough. It is off by default because the way a dock rejects
+            // a malformed video write is to reset itself, taking the control session with it.
+            // This device's codec geometry, passed into every codec call made on its behalf.
+            // It is per device because two docks of different generations lay a strip's sixteen
+            // blocks over different pixels; see `video::haar::Geometry`.
+            d.set_codec_geometry(
+                profile.protocol.strip_blocks_x,
+                profile.protocol.interlaced_bands,
+                profile.protocol.band_parity_bit,
+                profile.protocol.connector_selector_shift,
+                profile.protocol.stream_id_mask,
+                profile.protocol.dock_buffers,
+                profile.protocol.code_tables,
+                profile.protocol.steady_record_sub_bit,
+            );
+            d.set_frame_delivery(profile.protocol.frame_delivery);
+            d.set_probe_bracket(profile.protocol.probe_bracket);
+            d.set_stream_pacing(profile.protocol.stream_pacing);
+            d.set_mode_limits(
+                profile.capabilities.pixel_budget,
+                profile.capabilities.max_refresh_hz,
+                profile.capabilities.max_connector_clock_khz,
+            );
+            d.set_mode_behaviour(profile);
+            d.set_video_on_ctrl_pipe(profile.topology.video_on_ctrl_pipe);
+            d.set_frame_period_ms(profile.protocol.frame_period_ms);
+            d.set_carrier_frames(profile.protocol.carrier_frames);
+            d.set_status_period_ms(profile.protocol.status_period_ms);
+            d.set_arm_burst(profile.protocol.arm_burst);
+            d.set_allocation(&profile.protocol.allocation);
+            d.set_reports_presence(profile.protocol.reports_presence);
+            d.set_shared_edid_handler(profile.quirks.shared_edid_handler);
+            d.set_split_full_packet_frame(profile.quirks.split_full_packet_frame);
+            d.set_video_stream_desc(
+                profile.protocol.layout_word,
+                profile.protocol.stream_marker_kind,
+                profile.protocol.code_tables,
+            );
+            d.set_sink_down_state(profile.protocol.sink_down_state);
+            d.set_post_mode_sink_states(profile.protocol.post_mode_sink_states);
+            d.set_pre_mode_sink_state(profile.protocol.pre_mode_sink_state);
+        }
+        let bringup = BringUp::new(ddev.clone(), profile)?;
+        let bringup_slot = KBox::pin_init(new_mutex!(Some(bringup.clone())), GFP_KERNEL)?;
+
+        let data: &drm_sink::VinoDrmData = &ddev;
+        data.session_queue().enqueue(bringup).map_err(|_| EBUSY)?;
+
+        Ok(VinoBoundData {
+            _intf: intf_ref,
+            registration: Some(registration),
+            bringup: bringup_slot,
+            // The upload interface lives on the DFU interface, not the control one.
+            _fw_upload: None,
+            _fw_upload_name: None,
+        })
+    }
+
+    fn pre_reset<'bound>(
+        _intf: &'bound usb::Interface<Core<'_>>,
+        data: Pin<&VinoBoundData>,
+    ) -> Result {
+        if let Some(reg) = data.registration.as_ref() {
+            let drm_data: &drm_sink::VinoDrmData = reg.device();
+            drm_data.stop_for_reset();
+        }
+        Ok(())
+    }
+
+    /// Ask the USB core to rebind this interface once the reset has completed.
+    ///
+    /// The only state that makes this dock usable is the content-protection session, and the reset
+    /// is what destroyed it. There is nothing to restore and no way to establish a new session
+    /// except through probe, so a driver that returns success here stays bound to a dock that will
+    /// never answer again. A non-zero return marks the interface for rebinding, which unbinds and
+    /// probes it afresh.
+    fn post_reset<'bound>(
+        intf: &'bound usb::Interface<Core<'_>>,
+        _data: Pin<&VinoBoundData>,
+    ) -> Result {
+        let dev: &device::Device<Core<'_>> = intf.as_ref();
+        dev_info!(dev, "reset complete; rebinding for a fresh session\n");
+        Err(ENODEV)
+    }
+
+    fn quiesce<'bound>(_intf: &'bound usb::Interface<Core<'_>>, data: Pin<&VinoBoundData>) {
+        if let Some(reg) = data.registration.as_ref() {
+            let drm_data: &drm_sink::VinoDrmData = reg.device();
+            // The last chance to tell the dock anything. This hook runs while the interface is
+            // still bound, whereas `disconnect()` runs after I/O has been revoked -- and the stop
+            // flag published below makes every control transfer refuse by design, because a
+            // transfer issued into a disconnect deadlocks `usb_hub_wq`. So the sinks are parked
+            // here, first, or not at all.
+            drm_data.park_sinks();
+            // Publish the producers' stop flag before waiting on anything. This is only the flag:
+            // the teardown that must not run until USB I/O is quiesced (vblank timers, the
+            // device's self-reference cycles) still happens in `shutdown()` further down.
+            drm_data.begin_shutdown();
+        }
+
+        // Take the sole driver-owned bring-up handle. The queued work holds its own Arc until it
+        // runs or is cancelled, while this local Arc keeps the embedded Work pinned and live
+        // throughout the `cancel_sync` below.
+        let bringup = data.bringup.lock().take();
+
+        // Flush the deferred bring-up before the interface is unbound: `cancel_sync` dequeues it
+        // if pending and blocks until it returns if already running, so no USB I/O races the
+        // unbind. Safe when the work already finished or never ran -- it then simply reports that
+        // nothing was pending. The reclaimed `Arc<BringUp>` (returned only if the work was still
+        // queued) is dropped here.
+        if let Some(work) = bringup.as_ref() {
+            drop(work.work.cancel_sync());
+        }
+
+        // `bringup` drops here, releasing its DRM reference before I/O is revoked.
+    }
+
+    fn disconnect<'bound>(intf: &'bound usb::Interface<Core<'_>>, data: Pin<&VinoBoundData>) {
+        let dev: &device::Device<Core<'_>> = intf.as_ref();
+
+        // Stop every producer. The DRM device itself is unregistered by `Registration`'s `Drop`
+        // when the bound data is released -- the accepted registration teardown already calls
+        // `drm_dev_unplug()`, so there is no driver-local force-unplug here any more.
+        //
+        // Take the device through the registration. `shutdown()` also breaks
+        // vblank self-references before registration teardown.
+        if let Some(reg) = data.registration.as_ref() {
+            let drm_data: &drm_sink::VinoDrmData = reg.device();
+            drm_data.shutdown();
+        }
+        dev_info!(dev, "disconnected\n");
+    }
+}
+
+kernel::module_usb_driver! {
+    type: VinoDriver,
+    name: "vino",
+    authors: ["Mike Lothian"],
+    description: "DisplayLink DL3 (Vino) open driver",
+    license: "GPL v2",
+    params: {
+        debug: u8 {
+            default: 0,
+            description: "Enable verbose Vino protocol and scanout diagnostics",
+        },
+        trace_crypto: u8 {
+            default: 0,
+            description: "Diagnostic: disclose one session's keys to decrypt a USB capture",
+        },
+        rtc_utc_offset_minutes: i32 {
+            default: 0,
+            description: "Minutes east of UTC, for a dock's real-time clock",
+        },
+        force_flash: u8 {
+            default: 0,
+            description: "Write the packaged dock firmware even if the dock is not older",
+        },
+        edid_override: u8 {
+            default: 0,
+            description: "Bitmask of connectors whose EDID comes from DRM's override",
+        },
+    },
+}
+
+#[cfg(CONFIG_DRM_VINO_KUNIT_TEST)]
+#[kunit_tests(vino_presence_flap)]
+mod tests {
+    use super::*;
+
+    /// Flaps `n` times `apart_ms` apart, and reports how many repairs that asked for.
+    fn flaps(n: u32, apart_ms: i64) -> u32 {
+        let mut tracker = FlapTracker::new();
+        let start = Instant::<Monotonic>::now();
+        let mut repairs = 0;
+        for i in 0..n {
+            if tracker.healed(start + Delta::from_millis(apart_ms * i64::from(i))) {
+                repairs += 1;
+            }
+        }
+        repairs
+    }
+
+    #[test]
+    fn a_blip_is_absorbed_and_sustained_flapping_is_repaired() {
+        // One flap, and a second a long way after it, are blips: the dock brings the sink back on
+        // its own and a repair would cost a dock-wide re-activation for nothing.
+        assert_eq!(flaps(1, 0), 0);
+        assert_eq!(flaps(2, 1_000), 0);
+        // Flaps spread wider than the window never accumulate, however many there are.
+        assert_eq!(flaps(20, FlapTracker::WINDOW_MS), 0);
+
+        // A sink that will not settle is repaired. Nine a minute is what a connector left dark by a
+        // warm plug produces, and it asks for a repair rather than being absorbed forever.
+        assert!(flaps(FlapTracker::REPAIR_COUNT, 1_000) > 0);
+        assert!(flaps(30, 6_500) > 0);
+    }
+
+    #[test]
+    fn a_flapping_dock_cannot_hold_vino_in_a_repair_loop() {
+        // The repair is a dock-wide re-activation. However long the flapping goes on, the number of
+        // them is bounded: a dock that flaps as a matter of course gets a few and then silence.
+        assert_eq!(flaps(10_000, 1_000), FlapTracker::REPAIR_LIMIT);
+    }
+
+    #[test]
+    fn a_connector_that_comes_back_starts_again() {
+        // The tracker is reset when a connector is re-established, so a dock that misbehaves once
+        // is still repairable the next time rather than having spent its budget for the session.
+        let mut tracker = FlapTracker::new();
+        let now = Instant::<Monotonic>::now();
+        for _ in 0..FlapTracker::REPAIR_LIMIT * FlapTracker::REPAIR_COUNT {
+            tracker.healed(now);
+        }
+        assert!(!tracker.healed(now));
+        tracker = FlapTracker::new();
+        for _ in 0..FlapTracker::REPAIR_COUNT - 1 {
+            assert!(!tracker.healed(now));
+        }
+        assert!(tracker.healed(now));
+    }
+}