Re: [PATCH v10 06/21] drm/bridge: synopsys: dw-dp: Fix AUX transfer timeout race condition

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Introduction of sleeping functions in an atomic context path.
--

--- Patch [6]: [PATCH v10 06/21] drm/bridge: synopsys: dw-dp: Fix AUX transfer timeout race condition ---
commit d9773e559779aae316ddae4c1be0ff35a50eceda
Author: Sebastian Reichel <sebastian.reichel@collabora.com>

drm/bridge: synopsys: dw-dp: Fix AUX transfer timeout race condition

This commit fixes a potential race condition when an AUX transfer times
out and the interrupt fires immediately after. It re-initializes the
completion before sending the AUX command and handles pending interrupts
and timeouts by resetting the AUX controller.

> diff --git a/drivers/gpu/drm/bridge/synopsys/dw-dp.c b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> index 535af11e617c4..a7830e178f4e1 100644
> --- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> +++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
[ ... ]
> @@ -1492,6 +1494,12 @@ static ssize_t dw_dp_aux_transfer(struct drm_dp_aux *aux,
>  	status = wait_for_completion_timeout(&dp->complete, timeout);
>  	if (!status) {
>  		dev_err(dp->dev, "timeout waiting for AUX reply\n");
> +		regmap_update_bits(dp->regmap, DW_DP_SOFT_RESET_CTRL,
> +				   AUX_RESET, FIELD_PREP(AUX_RESET, 1));
> +		usleep_range(10, 20);
> +		regmap_update_bits(dp->regmap, DW_DP_SOFT_RESET_CTRL,
> +				   AUX_RESET, FIELD_PREP(AUX_RESET, 0));
> +		synchronize_irq(dp->irq);

[Severity: Medium]
Does this introduce sleeping functions into an atomic context path?

The dw_dp_aux_transfer() function is called during DPCD read operations,
which can be reached from the bridge's atomic enable callback:

dw_dp_bridge_atomic_enable()
  dw_dp_link_enable()
    dw_dp_link_train()
      drm_dp_dpcd_read()
        dw_dp_aux_transfer()

Encoder and bridge atomic enable/disable callbacks execute in an atomic
context where sleeping is forbidden. While wait_for_completion_timeout()
was already present in this path, calling usleep_range() and
synchronize_irq() introduces additional sleeping functions into a path
that may be executed during atomic commits.

>  		return -ETIMEDOUT;
>  	}
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260806-synopsys-dw-dp-improvements-v10-0-d84a26c303d6@collabora.com?part=6