Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider: - [High] Sleeping functions executed in atomic context. - [High] Concurrent execution of ALSA audio callbacks and hardware reset causes unprotected register accesses. - [Medium] Unchecked `regmap_read()` return value leads to use of uninitialized stack variable. --
--- Patch [21]: [PATCH v11 21/21] drm/bridge: synopsys: dw-dp: Add audio support --- commit eb4fb1ad87ba9ac01c09edc96621a5ee17d9b830 Author: Sebastian Reichel <[email protected]> Subject: drm/bridge: synopsys: dw-dp: Add audio support This commit implements audio support for the Synopsys DesignWare DisplayPort controller. > diff --git a/drivers/gpu/drm/bridge/synopsys/dw-dp.c > b/drivers/gpu/drm/bridge/synopsys/dw-dp.c > index b610abf76ef77..df149c52fce0f 100644 > --- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c > +++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c [ ... ] > @@ -1697,6 +1728,261 @@ static int dw_dp_link_enable(struct dw_dp *dp) [ ... ] > +static int dw_dp_audio_prepare(struct drm_bridge *bridge, > + struct drm_connector *connector, > + struct hdmi_codec_daifmt *daifmt, > + struct hdmi_codec_params *params) > +{ [ ... ] > + regmap_read(dp->regmap, DW_DP_CONFIG_REG1, &cfg1); > + supported_audio_interfaces = FIELD_GET(AUDIO_SELECT, cfg1); [Severity: Medium] Since regmap_read() can fail and return an error code, can this leave cfg1 uninitialized? If the read fails (e.g. due to a temporary bus issue), FIELD_GET() might extract bits from uninitialized stack memory, which could lead to rejecting valid audio formats or accepting invalid ones. [ ... ] > +static int dw_dp_audio_mute_stream(struct drm_bridge *bridge, > + struct drm_connector *connector, > + bool enable, int direction) > +{ > + struct dw_dp *dp = bridge_to_dp(bridge); > + > + dev_dbg(dp->dev, "audio %smute\n", enable ? "" : "un"); > + > + guard(mutex)(&dp->audio_lock); > + > + dp->audio_muted = enable; > + > + regmap_update_bits(dp->regmap, DW_DP_AUD_CONFIG1, AUDIO_MUTE, > + FIELD_PREP(AUDIO_MUTE, enable)); > + > + return 0; > +} [Severity: High] Can this ALSA audio callback conflict with a concurrent hardware reset? While dw_dp_audio_mute_stream() takes dp->audio_lock before updating DW_DP_AUD_CONFIG1, the DRM subsystem can concurrently call dw_dp_reset() to reset the controller: drivers/gpu/drm/bridge/synopsys/dw-dp.c:dw_dp_reset() { ... regmap_update_bits(dp->regmap, DW_DP_SOFT_RESET_CTRL, CONTROLLER_RESET, FIELD_PREP(CONTROLLER_RESET, 1)); ... } Since dw_dp_reset() does not acquire dp->audio_lock before asserting the CONTROLLER_RESET, could dw_dp_audio_mute_stream() write to the IP while it is held in reset, resulting in a bus hang or dropped register updates? [ ... ] > @@ -1735,6 +2021,14 @@ static void dw_dp_bridge_atomic_enable(struct > drm_bridge *bridge, > dev_err(dp->dev, "failed to enable video: %d\n", ret); > return; > } > + > + scoped_guard(mutex, &dp->audio_lock) { > + if (dp->audio_interface != DW_DP_AUDIO_UNUSED) { > + ret = __dw_dp_audio_enable(dp); > + if (ret < 0) > + dev_err(dp->dev, "failed to restore audio: > %d\n", ret); > + } > + } > } [Severity: High] Is it safe to acquire a sleeping mutex (dp->audio_lock) here? According to the DRM subsystem guidelines, bridge atomic enable callbacks execute in an atomic context during non-blocking commits, where sleeping functions are not allowed. Additionally, __dw_dp_audio_enable() called from this block contains a sleep: drivers/gpu/drm/bridge/synopsys/dw-dp.c:__dw_dp_audio_enable() { ... /* Wait for inf switch */ usleep_range(20, 40); ... } Could this usleep_range() cause deadlocks or kernel warnings when invoked from this atomic commit path? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/20260806-synopsys-dw-dp-improvements-v11-0-0d508505f...@collabora.com?part=21
