Re: [PATCH 2/3] Input: synaptics-rmi4: Support drm_panel_follower

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Concurrent I2C accesses can wedge the hardware during panel power-on because `page_mutex` is not held during the startup delay.
--

commit 31e9aa4b11936c658845014c2ef2567c8d7947f3
Author: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Input: synaptics-rmi4: Support drm_panel_follower

Many RMI4 implementations are present on in-cell panels with very tight power
sequencing requirements, normally handled by the DRM panel driver in Linux.
This commit adds support for drm_panel_follower to handle that dependency.

> diff --git a/drivers/input/rmi4/rmi_i2c.c b/drivers/input/rmi4/rmi_i2c.c
> index e11d0acb9b96d..84877030aefe9 100644
> --- a/drivers/input/rmi4/rmi_i2c.c
> +++ b/drivers/input/rmi4/rmi_i2c.c
[ ... ]
> @@ -187,17 +191,99 @@ static void rmi_i2c_regulator_bulk_disable(void *data)
[ ... ]
> +static int rmi_i2c_panel_prepared(struct drm_panel_follower *follower)
> +{
> +	struct rmi_i2c_xport *rmi_i2c = container_of(follower,
> +						    struct rmi_i2c_xport,
> +						    panel_follower);
> +	int error;
> +
> +	error = regulator_bulk_enable(ARRAY_SIZE(rmi_i2c->supplies),
> +				      rmi_i2c->supplies);
> +	if (error)
> +		return error;
> +	rmi_i2c->powered = true;
> +
> +	msleep(rmi_i2c->startup_delay);
> +
> +	/* The page-select register is reset when the sensor loses power. */
> +	mutex_lock(&rmi_i2c->page_mutex);

[Severity: High]
Can concurrent I2C accesses wedge the hardware during panel power-on because
page_mutex is not held during this startup delay?

The drm_panel_follower subsystem calls rmi_i2c_panel_prepared()
asynchronously when the display panel turns on. Since userspace is not
frozen during this event, a process reading a world-readable RMI sysfs
attribute (such as update_status, which calls
rmi_f34v7_check_command_status() then rmi_read_block()) or interacting
with /dev/rmi0 can invoke rmi_i2c_read_block().

Because rmi_i2c->powered is set to true before the msleep(), and page_mutex
is not held during the delay, a concurrent rmi_i2c_read_block() can acquire
page_mutex and issue an i2c_transfer() to the sensor while it is still in
the middle of its hardware boot sequence.

Does this early I2C access violate the strict timing requirements and leave
the touchscreen completely unresponsive until a reboot or driver reload?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911-topic-rmi4_panel_follower-v1-0-c1b2cf1cdb62@oss.qualcomm.com?part=2