Re: [PATCH v9 13/38] phy: rockchip: usbdp: Limit DP lane count to muxed lanes
From: sashiko-bot@kernel.org
Date: 2026-07-01 23:59:42
Also in:
linux-phy
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] Incomplete fix: the added DP lane count validation is bypassed when updating voltages, leading to USB3 PHY corruption. -- commit e3930e8c2271673fb1869d7c43a33a65c3e10987 Author: Sebastian Reichel [off-list ref] phy: rockchip: usbdp: Limit DP lane count to muxed lanes This commit adds a check to limit the DisplayPort lane count to the number of muxed lanes. This ensures the DP controller cannot configure 4 lanes when the PHY is restricted to 2 lanes, protecting USB3 functionality. Link: https://lore.kernel.org/linux-phy/20260612165546.98E1F1F000E9@smtp.kernel.org/ (local)
quoted hunk ↗ jump to hunk
diff --git a/drivers/phy/rockchip/phy-rockchip-usbdp.c b/drivers/phy/rockchip/phy-rockchip-usbdp.c index da15178d7f16e..0cfd23a405cb0 100644 --- a/drivers/phy/rockchip/phy-rockchip-usbdp.c +++ b/drivers/phy/rockchip/phy-rockchip-usbdp.c@@ -1134,6 +1134,9 @@ static int rk_udphy_dp_phy_verify_link_rate(struct rk_udphy *udphy, static int rk_udphy_dp_phy_verify_lanes(struct rk_udphy *udphy, struct phy_configure_opts_dp *dp) { + if (dp->lanes > udphy->dp_lanes) + return -EINVAL; +
[Severity: High]
This is a pre-existing issue, but does this validation fully protect against
USB3 lane corruption?
This check is placed in rk_udphy_dp_phy_verify_lanes(), which is only
executed when dp->set_lanes is true.
If a Type-C mux switch reduces udphy->dp_lanes from 4 to 2, but an ongoing
DP link training loop subsequently calls phy_configure() with
dp->set_voltages = 1 and dp->set_lanes = 0, this new check is skipped.
The voltage configuration loop in rk_udphy_dp_phy_configure() will then
iterate using the stale udphy->lanes count:
drivers/phy/rockchip/phy-rockchip-usbdp.c:rk_udphy_dp_phy_configure() {
...
if (dp->set_voltages) {
for (i = 0; i < udphy->lanes; i++) {
...
}
Could this still write DP configurations into PMA registers corresponding to
lanes 2 and 3, which are actively assigned to USB3? Even after later commits
add a mutex to rk_udphy_dp_phy_configure(), udphy->lanes doesn't appear to be
clamped to match udphy->dp_lanes during voltage-only updates.
switch (dp->lanes) {
case 1:
case 2:-- Sashiko AI review · https://sashiko.dev/#/patchset/20260702-rockchip-usbdp-cleanup-v9-0-e31efbb62d2e@collabora.com?part=13