Re: [PATCH v4] drm/omap: dsi: avoid sending bta sync all the time in writes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] Stack Use-After-Free due to race between IRQ handler and unregistering on-stack completion
- [Medium] Regression for command-mode panels due to missing DCS NOP and incorrect channel for BTA
- [Medium] Missing Error IRQ registration causes a 500ms stall on hardware transmission errors
--

commit 30f75c50c586dd648e75b97e7fe46e6f3d854488
Author: Andreas Kemnade <andreas@kemnade.info>
Subject: drm/omap: dsi: avoid sending bta sync all the time in writes

This patch avoids sending a BTA sync during writes if no ACKs are requested,
instead waiting for the packet to be sent to prevent FIFO overflows. It also
replaces the NOP sent between frames with a BTA sync during channel updates.

> diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
> index 27fe7bca9e2cf..3f22929c36e2a 100644
> --- a/drivers/gpu/drm/omapdrm/dss/dsi.c
> +++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
> @@ -2194,28 +2194,38 @@ static int dsi_vc_send_null(struct dsi_data *dsi, int vc, int channel)
>  static int dsi_vc_write_common(struct omap_dss_device *dssdev, int vc,
>  			       const struct mipi_dsi_msg *msg)
>  {
> +	DECLARE_COMPLETION_ONSTACK(completion);
>  	struct dsi_data *dsi = to_dsi_data(dssdev);
>  	int r;
>  
> +	/* wait for IRQ for packet transmission confirmation */
> +	r = dsi_register_isr_vc(dsi, vc, dsi_completion_handler,
> +				&completion, DSI_VC_IRQ_PACKET_SENT);

[Severity: Medium]
Will this stall for the full 500ms timeout if a hardware transmission error
occurs?

Since this is only registered for DSI_VC_IRQ_PACKET_SENT, an error interrupt
(like DSI_IRQ_HS_TX_TIMEOUT) wouldn't wake up the completion. Other functions
like dsi_vc_send_bta_sync() also register for DSI_IRQ_ERROR_MASK to handle
this case.

> +	if (r)
> +		return r;
> +
>  	if (mipi_dsi_packet_format_is_short(msg->type))
>  		r = dsi_vc_send_short(dsi, vc, msg);
>  	else
>  		r = dsi_vc_send_long(dsi, vc, msg);
>  
> -	if (r < 0)
> +	if ((!r) && wait_for_completion_timeout(&completion,
> +				msecs_to_jiffies(500)) == 0)
> +		r = -EIO;
> +
> +	dsi_unregister_isr_vc(dsi, vc, dsi_completion_handler,
> +			      &completion, DSI_VC_IRQ_PACKET_SENT);
> +	if (r)
>  		return r;

[Severity: High]
Could this lead to a stack use-after-free if the timeout is reached?

The wait_for_completion_timeout() can return 0 (timeout), after which
dsi_unregister_isr_vc() unregisters the ISR and the function returns,
destroying the on-stack completion. 

However, dsi_unregister_isr_vc() doesn't appear to synchronize with the IRQ
handler. If the hardware IRQ fires right after the timeout and the handler
executes from its lockless copy of the ISR table, could it call
dsi_completion_handler() with a dangling pointer to the destroyed stack
frame?

[ ... ]

> @@ -3268,13 +3263,13 @@ static int dsi_update_channel(struct omap_dss_device *dssdev, int vc)
>  	DSSDBG("dsi_update_channel: %d", vc);
>  
>  	/*
> -	 * Send NOP between the frames. If we don't send something here, the
> +	 * Transition to LP here. If we don't send something here, the
>  	 * updates stop working. This is probably related to DSI spec stating
>  	 * that the DSI host should transition to LP at least once per frame.
>  	 */
> -	r = _dsi_send_nop(dsi, VC_CMD, dsi->dsidev->channel);
> +	r = dsi_vc_send_bta_sync(dssdev, vc);

[Severity: Medium]
Will this break command-mode panels?

The original code explicitly sent a DCS NOP on VC_CMD (which is typically
configured for Low Power/CPU). This replaces it with a BTA sync on the vc
passed to the function, which is usually VC_VIDEO (configured as High
Speed/Video Port).

Is a BTA sync on a Video Port channel valid hardware behavior here? Also,
will panels that depend on receiving the DCS NOP payload to transition to
LP mode stop updating?

>  	if (r < 0) {
> -		DSSWARN("failed to send nop between frames: %d\n", r);
> +		DSSWARN("failed to send bta sync between frames: %d\n", r);
>  		goto err;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629-vm-upstr-v4-1-9f0c62d8808e@kemnade.info?part=1