From: sashiko-bot@kernel.org
To: "Nemesa Garg" <nemesa.garg@intel.com>
Cc: intel-xe@lists.freedesktop.org, intel-gfx@lists.freedesktop.org
Subject: Re: [PATCH] drm/i915/display: Limit SEL_FETCH clear to supported pipes
Date: Fri, 04 Sep 2026 06:45:58 +0000 [thread overview]
Message-ID: <20260904064558.6D59E1F00A3D@smtp.kernel.org> (raw)
In-Reply-To: <20260904062744.3010375-1-nemesa.garg@intel.com>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch adds a check to prevent unclaimed register accesses for uninstantiated SEL_FETCH registers, but incorrectly limits this check strictly to Display Ver 12, leaving Ver 13+ platforms vulnerable.
--
commit 5a2a4e5321d7248032644f135d53b64d20ede511
Author: Nemesa Garg <nemesa.garg@intel.com>
drm/i915/display: Limit SEL_FETCH clear to supported pipes
This patch adds checks to skip clearing SEL_FETCH_PLANE_CTL and
SEL_FETCH_CUR_CTL on pipes that do not implement these registers,
preventing unclaimed register accesses when disabling planes and cursors.
> diff --git a/drivers/gpu/drm/i915/display/intel_cursor.c b/drivers/gpu/drm/i915/display/intel_cursor.c
> index cce041e1da51d..de4359cbe306d 100644
> --- a/drivers/gpu/drm/i915/display/intel_cursor.c
> +++ b/drivers/gpu/drm/i915/display/intel_cursor.c
> @@ -545,6 +545,10 @@ static void i9xx_cursor_disable_sel_fetch_arm(struct intel_dsb *dsb,
> if (!HAS_PSR2_SEL_FETCH(display))
> return;
>
> + /* Display ver 12 only instantiates these registers for pipe A */
> + if (DISPLAY_VER(display) == 12 && pipe != PIPE_A)
> + return;
> +
[Severity: Medium]
Does this check leave Display Ver 13+ platforms vulnerable to the same issue?
Because PSR2 is only supported on transcoders A and B on newer platforms
(like Alderlake P), the SEL_FETCH registers for pipes C and D are not
instantiated.
With this check strictly limited to DISPLAY_VER(display) == 12, disabling a
cursor on pipe C or D on Ver 13+ will evaluate to false, bypass this
protection, and still cause an unclaimed register access.
> intel_de_write_dsb(display, dsb, SEL_FETCH_CUR_CTL(pipe), 0);
> }
>
> diff --git a/drivers/gpu/drm/i915/display/skl_universal_plane.c b/drivers/gpu/drm/i915/display/skl_universal_plane.c
> index 5cda1ab90e40f..252df30debc9b 100644
> --- a/drivers/gpu/drm/i915/display/skl_universal_plane.c
> +++ b/drivers/gpu/drm/i915/display/skl_universal_plane.c
> @@ -893,6 +893,10 @@ static void icl_plane_disable_sel_fetch_arm(struct intel_dsb *dsb,
> if (!HAS_PSR2_SEL_FETCH(display))
> return;
>
> + /* Display ver 12 only instantiates these registers for pipe A */
> + if (DISPLAY_VER(display) == 12 && pipe != PIPE_A)
> + return;
> +
[Severity: Medium]
Similarly for planes, does limiting this check to exactly Ver 12 allow
unclaimed register accesses on Ver 13+?
Disabling a plane on pipe C or D on a Display Ver 13+ platform will also bypass
this check and attempt to write to uninstantiated SEL_FETCH registers.
> intel_de_write_dsb(display, dsb, SEL_FETCH_PLANE_CTL(pipe, plane->id), 0);
> }
>
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260904062744.3010375-1-nemesa.garg@intel.com?part=1
next prev parent reply other threads:[~2026-09-04 6:46 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-04 6:27 [PATCH] drm/i915/display: Limit SEL_FETCH clear to supported pipes Nemesa Garg
2026-09-04 6:38 ` ✓ CI.KUnit: success for " Patchwork
2026-09-04 6:45 ` sashiko-bot [this message]
2026-09-04 7:10 ` [PATCH] " Jani Nikula
2026-09-07 4:10 ` Garg, Nemesa
2026-09-07 9:56 ` Jani Nikula
2026-09-07 13:21 ` Garg, Nemesa
2026-09-04 7:24 ` ✓ Xe.CI.BAT: success for " Patchwork
2026-09-04 8:20 ` ✗ i915.CI.BAT: failure " Patchwork
2026-09-04 17:22 ` ✓ Xe.CI.FULL: success " Patchwork
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260904064558.6D59E1F00A3D@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=intel-gfx@lists.freedesktop.org \
--cc=intel-xe@lists.freedesktop.org \
--cc=nemesa.garg@intel.com \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.