[PATCH v9 13/38] phy: rockchip: usbdp: Limit DP lane count to muxed lanes

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Incomplete fix: the added DP lane count validation is bypassed when updating voltages, leading to USB3 PHY corruption.
--

commit e3930e8c2271673fb1869d7c43a33a65c3e10987
Author: Sebastian Reichel <sebastian.reichel at collabora.com>

phy: rockchip: usbdp: Limit DP lane count to muxed lanes

This commit adds a check to limit the DisplayPort lane count to the number
of muxed lanes. This ensures the DP controller cannot configure 4 lanes
when the PHY is restricted to 2 lanes, protecting USB3 functionality.

Link: https://lore.kernel.org/linux-phy/20260612165546.98E1F1F000E9@smtp.kernel.org/

> diff --git a/drivers/phy/rockchip/phy-rockchip-usbdp.c b/drivers/phy/rockchip/phy-rockchip-usbdp.c
> index da15178d7f16e..0cfd23a405cb0 100644
> --- a/drivers/phy/rockchip/phy-rockchip-usbdp.c
> +++ b/drivers/phy/rockchip/phy-rockchip-usbdp.c
> @@ -1134,6 +1134,9 @@ static int rk_udphy_dp_phy_verify_link_rate(struct rk_udphy *udphy,
>  static int rk_udphy_dp_phy_verify_lanes(struct rk_udphy *udphy,
>  					struct phy_configure_opts_dp *dp)
>  {
> +	if (dp->lanes > udphy->dp_lanes)
> +		return -EINVAL;
> +

[Severity: High]
This is a pre-existing issue, but does this validation fully protect against
USB3 lane corruption?

This check is placed in rk_udphy_dp_phy_verify_lanes(), which is only
executed when dp->set_lanes is true. 

If a Type-C mux switch reduces udphy->dp_lanes from 4 to 2, but an ongoing
DP link training loop subsequently calls phy_configure() with
dp->set_voltages = 1 and dp->set_lanes = 0, this new check is skipped.

The voltage configuration loop in rk_udphy_dp_phy_configure() will then
iterate using the stale udphy->lanes count:

drivers/phy/rockchip/phy-rockchip-usbdp.c:rk_udphy_dp_phy_configure() {
    ...
    if (dp->set_voltages) {
        for (i = 0; i < udphy->lanes; i++) {
    ...
}

Could this still write DP configurations into PMA registers corresponding to
lanes 2 and 3, which are actively assigned to USB3? Even after later commits
add a mutex to rk_udphy_dp_phy_configure(), udphy->lanes doesn't appear to be
clamped to match udphy->dp_lanes during voltage-only updates.

>  	switch (dp->lanes) {
>  	case 1:
>  	case 2:

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702-rockchip-usbdp-cleanup-v9-0-e31efbb62d2e@collabora.com?part=13