Re: [PATCH v2 55/56] drm/i915/hdmi: Iterate through joiner candidates in mode_valid path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/i915/hdmi: TMDS modes bypass max dotclock and plane size checks
--

commit fcc107a6617c907f4675cb58944ba1cef59c27ff
Author: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
drm/i915/hdmi: Iterate through joiner candidates in mode_valid path

This commit updates the HDMI mode validation path to iterate through joiner
candidates, relaxing the dotclock ceiling when multiple pipes are joined.
The single-pipe validation checks were relocated from the main mode validation
function into the format-specific validation function.

> diff --git a/drivers/gpu/drm/i915/display/intel_hdmi.c b/drivers/gpu/drm/i915/display/intel_hdmi.c
> index 2ec7d2a5e7d4d..2c7c47a3c61d1 100644
> --- a/drivers/gpu/drm/i915/display/intel_hdmi.c
> +++ b/drivers/gpu/drm/i915/display/intel_hdmi.c
> @@ -2132,20 +2132,55 @@ intel_hdmi_mode_valid_format(struct intel_connector *connector,
[ ... ]
> +	status = intel_hdmi_tmds_mode_clock_valid(&connector->base, clock,
> +						  has_hdmi_sink, sink_format);
> +
> +	if (status == MODE_OK)
> +		return status;

[Severity: High]
Does this early return cause TMDS modes to bypass the max dotclock and plane
size limits? 

It looks like if a mode fits within the TMDS link bandwidth, the function
returns immediately, skipping the newly relocated intel_pfit_mode_valid(),
intel_mode_valid_max_plane_size(), and intel_dp_dotclk_valid() checks inside
the for_each_joiner_candidate() loop below.

[ ... ]
> @@ -2160,7 +2195,6 @@ intel_hdmi_mode_valid(struct drm_connector *_connector,
[ ... ]
>  	if ((mode->flags & DRM_MODE_FLAG_3D_MASK) == DRM_MODE_FLAG_3D_FRAME_PACKING)
>  		clock *= 2;
>  
> -	if (clock > max_dotclk)
> -		return MODE_CLOCK_HIGH;
> -

[Severity: High]
Since this overarching max_dotclk check was removed from the parent function
intel_hdmi_mode_valid(), and TMDS modes now return early in 
intel_hdmi_mode_valid_format() before reaching the new validation loop, could
this allow user-provided TMDS modes that exceed the display engine's max CDCLK
dotclock to pass validation?

[ ... ]
> @@ -2197,10 +2228,8 @@ intel_hdmi_mode_valid(struct drm_connector *_connector,
>  			status = intel_hdmi_mode_valid_format(connector, mode, clock, has_hdmi_sink,
>  							      INTEL_OUTPUT_FORMAT_YCBCR420);
>  	}
> -	if (status != MODE_OK)
> -		return status;
>  
> -	return intel_mode_valid_max_plane_size(display, mode, 1);
> +	return status;

[Severity: High]
Similarly, since intel_mode_valid_max_plane_size() is also removed here,
it seems TMDS modes might bypass plane width and panel fitter checks too,
potentially leading to atomic commit failures or hardware pipeline errors.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012035806.3361439-1-ankit.k.nautiyal@intel.com?part=55