Re: [PATCH v4 6/7] drm/i915/display: Program and enable the DP symbol based timing generator

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/i915/display: invalid CMTG MMIO write in intel_set_transcoder_timings()
--

commit d5e98872efc6064e978436ee34bbcfdf86c29006
Author: Arun R Murthy <arun.r.murthy@intel.com>

drm/i915/display: Program and enable the DP symbol based timing generator

This commit programs and enables the DP link layer symbol based timing
generator, including the 128-bit Data M/N registers, HACT/HTOTAL/CHUNK_SIZE
timing registers, and TRANSCONF configuration and state readout.

> diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
> index 15117b715e1d5..d450b34b8035a 100644
> --- a/drivers/gpu/drm/i915/display/intel_display.c
> +++ b/drivers/gpu/drm/i915/display/intel_display.c

[ ... ]

> @@ -2936,6 +2996,17 @@ void intel_set_transcoder_timings(const struct intel_crtc_state *crtc_state,
>  		intel_de_write(display, DP_MIN_HBLANK_CTL(transcoder),
>  			       crtc_state->min_hblank);
>  	}
> +
> +	if (crtc_state->dp_symbol_tg.enable) {
> +		const struct intel_dp_symbol_tg *tg = &crtc_state->dp_symbol_tg;
> +
> +		intel_de_write(display, TRANS_LLSYM_HACT(display, transcoder),
> +			       TRANS_LLSYM_HACT_VAL(tg->hactive - 1));
> +		intel_de_write(display, TRANS_LLSYM_HTOTAL(display, transcoder),
> +			       TRANS_LLSYM_HTOTAL_VAL(tg->htotal - 1));
> +		intel_de_write(display, TRANS_LLSYM_CHUNK_SIZE(display, transcoder),
> +			       TRANS_LLSYM_CHUNK_SIZE_VAL(tg->chunk_size));
> +	}
>  }

[Severity: Medium]
Can this write to non-existent CMTG MMIO registers when
intel_set_transcoder_timings() is called for TRANSCODER_CMTG0 or
TRANSCODER_CMTG1?

During modeset and DC state restore on display version 35,
hsw_configure_cpu_transcoder() and intel_cmtg_restore() call
intel_cmtg_set_timings() -> intel_set_transcoder_timings(crtc_state,
cmtg_transcoder) when cpu_transcoder is TRANSCODER_A or TRANSCODER_B on an
eDP output:

drivers/gpu/drm/i915/display/intel_cmtg.c:intel_cmtg_set_timings() {
	enum transcoder cmtg_transcoder = to_cmtg_transcoder(crtc_state->cpu_transcoder);
	...
	if (type == LRR)
		intel_set_transcoder_timings_lrr(crtc_state, cmtg_transcoder);
	else
		intel_set_transcoder_timings(crtc_state, cmtg_transcoder);
}

When an eDP panel operates at a 128b/132b UHBR link rate without MSO
splitter, intel_dp_compute_symbol_tg() sets crtc_state->dp_symbol_tg.enable
to true.

Just above this block in intel_set_transcoder_timings(), the
DP_MIN_HBLANK_CTL write checks that transcoder is not a CMTG transcoder:

	if (DISPLAY_VER(display) >= 30 &&
	    transcoder != TRANSCODER_CMTG0 &&
	    transcoder != TRANSCODER_CMTG1) {
		intel_de_write(display, DP_MIN_HBLANK_CTL(transcoder),
			       crtc_state->min_hblank);
	}

Without a similar check on transcoder here, _MMIO_TRANS2() translates
TRANS_LLSYM_HACT, TRANS_LLSYM_HTOTAL, and TRANS_LLSYM_CHUNK_SIZE using the
CMTG base offset and writes to unclaimed register offsets 0x6f0dc..0x6f0e4
(or 0x6f1dc..0x6f1e4).

Should this block also check transcoder != TRANSCODER_CMTG0 &&
transcoder != TRANSCODER_CMTG1 before writing the TRANS_LLSYM_* registers?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103-vlk-64036-dp-symbol-tg-v4-0-6cf8a588b54c@intel.com?part=6