Re: [bug report] phy: qcom: qmp-usbc: Add QCS615 USB/DP PHY config and DP mode support

[Xiangxu Yin <xiangxu.yin@oss.qualcomm.com>]

On 2/17/2026 11:27 PM, Konrad Dybcio wrote:
> On 2/6/26 2:39 PM, Dan Carpenter wrote:
>> [ Smatch checking is paused while we raise funding.  #SadFace
>>   https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]
>>
>> Hello Xiangxu Yin,
>>
>> Commit 81791c45c8e0 ("phy: qcom: qmp-usbc: Add QCS615 USB/DP PHY
>> config and DP mode support") from Dec 15, 2025 (linux-next), leads to
>> the following Smatch static checker warning:
>>
>> 	drivers/phy/qualcomm/phy-qcom-qmp-usbc.c:803 qmp_v2_configure_dp_swing()
>> 	index hardmax out of bounds '(*cfg->swing_tbl)[v_level]' size=4 max='4' rl='0-4'
>>
>> drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
>>     777 static int qmp_v2_configure_dp_swing(struct qmp_usbc *qmp)
>>     778 {
>>     779         const struct qmp_phy_cfg *cfg = qmp->cfg;
>>     780         const struct phy_configure_opts_dp *dp_opts = &qmp->dp_opts;
>>     781         void __iomem *tx = qmp->dp_tx;
>>     782         void __iomem *tx2 = qmp->dp_tx2;
>>     783         unsigned int v_level = 0, p_level = 0;
>>     784         u8 voltage_swing_cfg, pre_emphasis_cfg;
>>     785         int i;
>>     786 
>>     787         if (dp_opts->lanes > 4) {
>>     788                 dev_err(qmp->dev, "Invalid lane_num(%d)\n", dp_opts->lanes);
>>     789                 return -EINVAL;
>>     790         }
>>     791 
>>     792         for (i = 0; i < dp_opts->lanes; i++) {
>>     793                 v_level = max(v_level, dp_opts->voltage[i]);
>>     794                 p_level = max(p_level, dp_opts->pre[i]);
>>     795         }
>>     796 
>>     797         if (v_level > 4 || p_level > 4) {
>>
>> These should be >= 4 instead of >.
>>
>>     798                 dev_err(qmp->dev, "Invalid v(%d) | p(%d) level)\n",
>>     799                         v_level, p_level);
>>     800                 return -EINVAL;
>>     801         }
>>     802 
>> --> 803         voltage_swing_cfg = (*cfg->swing_tbl)[v_level][p_level];
>>                                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>> This is a 4x4 array.
> Thanks Dan for the report
>
> Xiangxu, are you planning to send a patch to address that?
>
> Konrad


Thanks for the notice, Dan & Konrad.

I just got back from a long leave and will submit the relevant patches as soon as possible.