Re: [PATCH v11 21/21] drm/bridge: synopsys: dw-dp: Add audio support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] Sleeping functions executed in atomic context.
- [High] Concurrent execution of ALSA audio callbacks and hardware reset causes unprotected register accesses.
- [Medium] Unchecked `regmap_read()` return value leads to use of uninitialized stack variable.
--

--- Patch [21]: [PATCH v11 21/21] drm/bridge: synopsys: dw-dp: Add audio support ---
commit eb4fb1ad87ba9ac01c09edc96621a5ee17d9b830
Author: Sebastian Reichel <sebastian.reichel@collabora.com>
Subject: drm/bridge: synopsys: dw-dp: Add audio support

This commit implements audio support for the Synopsys DesignWare DisplayPort
controller.

> diff --git a/drivers/gpu/drm/bridge/synopsys/dw-dp.c b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> index b610abf76ef77..df149c52fce0f 100644
> --- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> +++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
[ ... ]
> @@ -1697,6 +1728,261 @@ static int dw_dp_link_enable(struct dw_dp *dp)
[ ... ]
> +static int dw_dp_audio_prepare(struct drm_bridge *bridge,
> +			       struct drm_connector *connector,
> +			       struct hdmi_codec_daifmt *daifmt,
> +			       struct hdmi_codec_params *params)
> +{
[ ... ]
> +	regmap_read(dp->regmap, DW_DP_CONFIG_REG1, &cfg1);
> +	supported_audio_interfaces = FIELD_GET(AUDIO_SELECT, cfg1);

[Severity: Medium]
Since regmap_read() can fail and return an error code, can this leave cfg1
uninitialized?

If the read fails (e.g. due to a temporary bus issue), FIELD_GET() might
extract bits from uninitialized stack memory, which could lead to rejecting
valid audio formats or accepting invalid ones.

[ ... ]
> +static int dw_dp_audio_mute_stream(struct drm_bridge *bridge,
> +				   struct drm_connector *connector,
> +				   bool enable, int direction)
> +{
> +	struct dw_dp *dp = bridge_to_dp(bridge);
> +
> +	dev_dbg(dp->dev, "audio %smute\n", enable ? "" : "un");
> +
> +	guard(mutex)(&dp->audio_lock);
> +
> +	dp->audio_muted = enable;
> +
> +	regmap_update_bits(dp->regmap, DW_DP_AUD_CONFIG1, AUDIO_MUTE,
> +			   FIELD_PREP(AUDIO_MUTE, enable));
> +
> +	return 0;
> +}

[Severity: High]
Can this ALSA audio callback conflict with a concurrent hardware reset?

While dw_dp_audio_mute_stream() takes dp->audio_lock before updating
DW_DP_AUD_CONFIG1, the DRM subsystem can concurrently call dw_dp_reset()
to reset the controller:

drivers/gpu/drm/bridge/synopsys/dw-dp.c:dw_dp_reset() {
	...
	regmap_update_bits(dp->regmap, DW_DP_SOFT_RESET_CTRL, CONTROLLER_RESET,
			   FIELD_PREP(CONTROLLER_RESET, 1));
	...
}

Since dw_dp_reset() does not acquire dp->audio_lock before asserting the
CONTROLLER_RESET, could dw_dp_audio_mute_stream() write to the IP while it
is held in reset, resulting in a bus hang or dropped register updates?

[ ... ]
> @@ -1735,6 +2021,14 @@ static void dw_dp_bridge_atomic_enable(struct drm_bridge *bridge,
>  		dev_err(dp->dev, "failed to enable video: %d\n", ret);
>  		return;
>  	}
> +
> +	scoped_guard(mutex, &dp->audio_lock) {
> +		if (dp->audio_interface != DW_DP_AUDIO_UNUSED) {
> +			ret = __dw_dp_audio_enable(dp);
> +			if (ret < 0)
> +				dev_err(dp->dev, "failed to restore audio: %d\n", ret);
> +		}
> +	}
>  }

[Severity: High]
Is it safe to acquire a sleeping mutex (dp->audio_lock) here? 

According to the DRM subsystem guidelines, bridge atomic enable callbacks
execute in an atomic context during non-blocking commits, where sleeping
functions are not allowed.

Additionally, __dw_dp_audio_enable() called from this block contains a sleep:

drivers/gpu/drm/bridge/synopsys/dw-dp.c:__dw_dp_audio_enable() {
	...
	/* Wait for inf switch */
	usleep_range(20, 40);
	...
}

Could this usleep_range() cause deadlocks or kernel warnings when invoked
from this atomic commit path?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260806-synopsys-dw-dp-improvements-v11-0-0d508505f383@collabora.com?part=21