Re: [PATCH 2/7] ASoC: codecs: wsa884x: Accept temperatures across the full trim range

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] ASoC: wsa884x: unsigned cache corrupts negative temp in wsa884x_get_temp()
--

commit 9c63fc2fea2dd9c9655f1be7d3c6ce519dba204c
Author: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>

ASoC: codecs: wsa884x: Accept temperatures across the full trim range

This commit expands the valid temperature threshold range in wsa884x_get_temp()
from 5..45 degC to the full two-point trim range of -10..150 degC
(WSA884X_T1_TEMP..WSA884X_T2_TEMP) so that valid speaker temperatures are not
rejected with -EAGAIN.

> diff --git a/sound/soc/codecs/wsa884x.c b/sound/soc/codecs/wsa884x.c
> index a367c94bfb4d6..f0857c0588d51 100644
> --- a/sound/soc/codecs/wsa884x.c
> +++ b/sound/soc/codecs/wsa884x.c
> @@ -720,10 +720,11 @@
>  
>  /*
>   * Device will report senseless data in many cases, so discard any measurements
> - * outside of valid range.
> + * outside of the two-point trim range. Do not narrow this to ambient: a
> + * speaker that has been playing easily runs well above 45 degC.
>   */
> -#define WSA884X_LOW_TEMP_THRESHOLD	5
> -#define WSA884X_HIGH_TEMP_THRESHOLD	45
> +#define WSA884X_LOW_TEMP_THRESHOLD	WSA884X_T1_TEMP
> +#define WSA884X_HIGH_TEMP_THRESHOLD	WSA884X_T2_TEMP
>  
>  struct wsa884x_priv {
>  	struct regmap *regmap;
> @@ -1929,8 +1930,8 @@ static int wsa884x_get_temp(struct wsa884x_priv *wsa884x, long *temp)
>  	dev_dbg(wsa884x->dev, "Measured temp %ld (dmeas=%d, d1=%d, d2=%d)\n",
>  		val, dmeas, d1, d2);
>  
> -	if ((val > WSA884X_LOW_TEMP_THRESHOLD) &&
> -	    (val < WSA884X_HIGH_TEMP_THRESHOLD)) {
> +	if (val >= WSA884X_LOW_TEMP_THRESHOLD &&
> +	    val <= WSA884X_HIGH_TEMP_THRESHOLD) {
>  		wsa884x->temperature = val;
>  		*temp = val * 1000;
>  		ret = 0;

[Severity: Medium]
With WSA884X_LOW_TEMP_THRESHOLD lowered to WSA884X_T1_TEMP (-10L),
wsa884x_get_temp() in sound/soc/codecs/wsa884x.c now accepts negative
temperatures in the range [-10, -1] degC.

However, struct wsa884x_priv still declares the cached temperature field as
unsigned:

struct wsa884x_priv {
	...
	struct mutex sp_lock;
	unsigned int temperature;
	bool pa_on;
};

When wsa884x_hwmon_read() -> wsa884x_get_temp() is called while the power
amplifier is off (wsa884x->pa_on is false) and the measured val is negative,
storing val into wsa884x->temperature wraps around modulo 2^32.

If the speaker power amplifier is subsequently enabled via wsa884x_spkr_event()
(setting wsa884x->pa_on = true on SND_SOC_DAPM_POST_PMU) and a hwmon consumer
reads the temperature again, wsa884x_get_temp() returns the cached reading:

	if (wsa884x->pa_on) {
		/*
		 * Reading temperature is possible only when Power Amplifier is
		 * off. Report last cached data.
		 */
		*temp = wsa884x->temperature * 1000;
		return 0;
	}

Because wsa884x->temperature is unsigned int, wsa884x->temperature * 1000 is
evaluated using 32-bit unsigned arithmetic and then zero-extended to long *temp
on 64-bit platforms, reporting ~4.29 billion millidegrees C instead of a
negative temperature.

Should temperature in struct wsa884x_priv be changed to a signed type such as
int or long?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261023171316.819857-1-srinivas.kandagatla@oss.qualcomm.com?part=2