* [PATCH v4 0/3] Add eDP lane mapping support
@ 2026-05-29 4:05 Damon Ding
2026-05-29 4:05 ` [PATCH v4 1/3] dt-bindings: display: bridge: analogix-dp: Add data-lanes support for endpoint Damon Ding
` (2 more replies)
0 siblings, 3 replies; 8+ messages in thread
From: Damon Ding @ 2026-05-29 4:05 UTC (permalink / raw)
To: hjc, heiko, andy.yan, maarten.lankhorst, mripard, tzimmermann,
airlied, simona, robh, krzk+dt, conor+dt, andrzej.hajda,
neil.armstrong, rfoss
Cc: Laurent.pinchart, jonas, jernej.skrabec, nicolas.frattaroli,
cristian.ciocaltea, sebastian.reichel, dmitry.baryshkov,
luca.ceresoli, dianders, m.szyprowski, dri-devel, devicetree,
linux-arm-kernel, linux-rockchip, linux-kernel, Damon Ding
This series adds configurable eDP physical lane mapping support via
device tree data-lanes property.
Lane mapping is mainly used for below scenarios:
1. Correct PCB lane swap and differential line routing crossover
without hardware changes;
2. Adapt mismatched lane pin definitions between SoC and eDP panel;
3. Support multiple panel hardware variants on the same board
by configuring data-lanes in device tree only.
The series includes driver implementation and device tree binding
updates to support custom lane mapping configuration from endpoint
node, and keeps default linear lane order if no configuration is given.
Patch 1: Add endpoint data-lanes property to analogix-dp binding
Patch 2: Add validation for samsung,lane-count property as preparation
Patch 3: Implement lane mapping in analogix_dp driver
Damon Ding (3):
dt-bindings: display: bridge: analogix-dp: Add data-lanes support for
endpoint
drm/bridge: analogix_dp: Add validation for samsung,lane-count
property
drm/bridge: analogix_dp: Add support for optional data-lanes mapping
.../bindings/display/bridge/analogix,dp.yaml | 19 +++--
.../rockchip/rockchip,analogix-dp.yaml | 1 +
.../drm/bridge/analogix/analogix_dp_core.c | 69 ++++++++++++++++++-
.../drm/bridge/analogix/analogix_dp_core.h | 4 +-
.../gpu/drm/bridge/analogix/analogix_dp_reg.c | 15 ++--
.../gpu/drm/bridge/analogix/analogix_dp_reg.h | 4 ++
6 files changed, 96 insertions(+), 16 deletions(-)
---
Changes in v2:
- Add lane mapping application scenarios in commit message.
- Remove redundant deprecated property 'data-lanes' for eDP node.
- Update port@1 $ref to /schemas/graph.yaml#/$defs/port-base.
Changes in v3:
- Squash [PATCH v2 2/3] into [PATCH v2 1/3].
- Add unevaluatedProperties: false to both the port@1 and endpoint
nodes.
Changes in v4:
- Add validation for samsung,lane-count property as preparation.
--
2.34.1
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH v4 1/3] dt-bindings: display: bridge: analogix-dp: Add data-lanes support for endpoint
2026-05-29 4:05 [PATCH v4 0/3] Add eDP lane mapping support Damon Ding
@ 2026-05-29 4:05 ` Damon Ding
2026-05-29 4:46 ` sashiko-bot
2026-05-29 16:43 ` Conor Dooley
2026-05-29 4:05 ` [PATCH v4 2/3] drm/bridge: analogix_dp: Add validation for samsung,lane-count property Damon Ding
2026-05-29 4:05 ` [PATCH v4 3/3] drm/bridge: analogix_dp: Add support for optional data-lanes mapping Damon Ding
2 siblings, 2 replies; 8+ messages in thread
From: Damon Ding @ 2026-05-29 4:05 UTC (permalink / raw)
To: hjc, heiko, andy.yan, maarten.lankhorst, mripard, tzimmermann,
airlied, simona, robh, krzk+dt, conor+dt, andrzej.hajda,
neil.armstrong, rfoss
Cc: Laurent.pinchart, jonas, jernej.skrabec, nicolas.frattaroli,
cristian.ciocaltea, sebastian.reichel, dmitry.baryshkov,
luca.ceresoli, dianders, m.szyprowski, dri-devel, devicetree,
linux-arm-kernel, linux-rockchip, linux-kernel, Damon Ding
Add data-lanes property support to the port@1 endpoint for physical
lane mapping configuration.
Lane mapping is mainly used for below scenarios:
1. Correct PCB lane swap and differential line routing crossover
without hardware changes;
2. Adapt mismatched lane pin definitions between SoC and eDP panel;
3. Support multiple panel hardware variants on the same board
by configuring data-lanes in device tree only.
Additionally, add data-lanes setting in Rockchip eDP DT node example
to show actual lane mapping usage.
Signed-off-by: Damon Ding <damon.ding@rock-chips.com>
---
Changes in v2:
- Add lane mapping application scenarios in commit message.
- Remove redundant deprecated property 'data-lanes' for eDP node.
- Update port@1 $ref to /schemas/graph.yaml#/$defs/port-base.
Changes in v3:
- Squash data-lanes adjustment of Rockchip eDP DT example into this
commit.
- Add unevaluatedProperties: false to both the port@1 and endpoint
nodes.
---
.../bindings/display/bridge/analogix,dp.yaml | 19 ++++++++++++++-----
.../rockchip/rockchip,analogix-dp.yaml | 1 +
2 files changed, 15 insertions(+), 5 deletions(-)
diff --git a/Documentation/devicetree/bindings/display/bridge/analogix,dp.yaml b/Documentation/devicetree/bindings/display/bridge/analogix,dp.yaml
index 62f0521b0924..ecf206871cdd 100644
--- a/Documentation/devicetree/bindings/display/bridge/analogix,dp.yaml
+++ b/Documentation/devicetree/bindings/display/bridge/analogix,dp.yaml
@@ -42,13 +42,22 @@ properties:
properties:
port@0:
$ref: /schemas/graph.yaml#/properties/port
- description:
- Input node to receive pixel data.
+ description: Input node to receive pixel data.
port@1:
- $ref: /schemas/graph.yaml#/properties/port
- description:
- Port node with one endpoint connected to a dp-connector node.
+ $ref: /schemas/graph.yaml#/$defs/port-base
+ unevaluatedProperties: false
+ description: Port node with one endpoint connected to sink device node.
+ properties:
+ endpoint:
+ $ref: /schemas/media/video-interfaces.yaml#
+ unevaluatedProperties: false
+ properties:
+ data-lanes:
+ minItems: 1
+ maxItems: 4
+ items:
+ enum: [ 0, 1, 2, 3 ]
required:
- port@0
diff --git a/Documentation/devicetree/bindings/display/rockchip/rockchip,analogix-dp.yaml b/Documentation/devicetree/bindings/display/rockchip/rockchip,analogix-dp.yaml
index d99b23b88cc5..f690ee393fdb 100644
--- a/Documentation/devicetree/bindings/display/rockchip/rockchip,analogix-dp.yaml
+++ b/Documentation/devicetree/bindings/display/rockchip/rockchip,analogix-dp.yaml
@@ -117,6 +117,7 @@ examples:
reg = <1>;
edp_out_panel: endpoint {
+ data-lanes = <0 1>;
remote-endpoint = <&panel_in_edp>;
};
};
--
2.34.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH v4 2/3] drm/bridge: analogix_dp: Add validation for samsung,lane-count property
2026-05-29 4:05 [PATCH v4 0/3] Add eDP lane mapping support Damon Ding
2026-05-29 4:05 ` [PATCH v4 1/3] dt-bindings: display: bridge: analogix-dp: Add data-lanes support for endpoint Damon Ding
@ 2026-05-29 4:05 ` Damon Ding
2026-05-29 5:31 ` sashiko-bot
2026-05-29 4:05 ` [PATCH v4 3/3] drm/bridge: analogix_dp: Add support for optional data-lanes mapping Damon Ding
2 siblings, 1 reply; 8+ messages in thread
From: Damon Ding @ 2026-05-29 4:05 UTC (permalink / raw)
To: hjc, heiko, andy.yan, maarten.lankhorst, mripard, tzimmermann,
airlied, simona, robh, krzk+dt, conor+dt, andrzej.hajda,
neil.armstrong, rfoss
Cc: Laurent.pinchart, jonas, jernej.skrabec, nicolas.frattaroli,
cristian.ciocaltea, sebastian.reichel, dmitry.baryshkov,
luca.ceresoli, dianders, m.szyprowski, dri-devel, devicetree,
linux-arm-kernel, linux-rockchip, linux-kernel, Damon Ding
Add range check for samsung,lane-count to avoid invalid values.
Validation is only applied when the property exists to maintain
backward compatibility.
Suggested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Damon Ding <damon.ding@rock-chips.com>
---
drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
index 8cf6b73bceac..699a7f380c56 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
@@ -1238,6 +1238,7 @@ static int analogix_dp_dt_parse_pdata(struct analogix_dp_device *dp)
{
struct device_node *dp_node = dp->dev->of_node;
struct video_info *video_info = &dp->video_info;
+ int ret;
switch (dp->plat_data->dev_type) {
case RK3288_DP:
@@ -1260,8 +1261,16 @@ static int analogix_dp_dt_parse_pdata(struct analogix_dp_device *dp)
*/
of_property_read_u32(dp_node, "samsung,link-rate",
&video_info->max_link_rate);
- of_property_read_u32(dp_node, "samsung,lane-count",
- &video_info->max_lane_count);
+ ret = of_property_read_u32(dp_node, "samsung,lane-count",
+ &video_info->max_lane_count);
+ if (!ret) {
+ if (video_info->max_lane_count == 0 ||
+ video_info->max_lane_count > LANE_COUNT4) {
+ dev_err(dp->dev, "samsung,lane-count = %d is out of range\n",
+ video_info->max_lane_count);
+ return -EINVAL;
+ }
+ }
break;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH v4 3/3] drm/bridge: analogix_dp: Add support for optional data-lanes mapping
2026-05-29 4:05 [PATCH v4 0/3] Add eDP lane mapping support Damon Ding
2026-05-29 4:05 ` [PATCH v4 1/3] dt-bindings: display: bridge: analogix-dp: Add data-lanes support for endpoint Damon Ding
2026-05-29 4:05 ` [PATCH v4 2/3] drm/bridge: analogix_dp: Add validation for samsung,lane-count property Damon Ding
@ 2026-05-29 4:05 ` Damon Ding
2026-05-29 5:56 ` sashiko-bot
2 siblings, 1 reply; 8+ messages in thread
From: Damon Ding @ 2026-05-29 4:05 UTC (permalink / raw)
To: hjc, heiko, andy.yan, maarten.lankhorst, mripard, tzimmermann,
airlied, simona, robh, krzk+dt, conor+dt, andrzej.hajda,
neil.armstrong, rfoss
Cc: Laurent.pinchart, jonas, jernej.skrabec, nicolas.frattaroli,
cristian.ciocaltea, sebastian.reichel, dmitry.baryshkov,
luca.ceresoli, dianders, m.szyprowski, dri-devel, devicetree,
linux-arm-kernel, linux-rockchip, linux-kernel, Damon Ding
Parse the optional 'data-lanes' device tree property to support
custom physical lane mapping configuration.
If no valid configuration is found, fall back to the default
lane map (0, 1, 2, 3) automatically and keep the driver running.
Lane mapping is mainly used for below scenarios:
1. Correct PCB lane swap and differential line routing crossover
without hardware changes;
2. Adapt mismatched lane pin definitions between SoC and eDP panel;
3. Support multiple panel hardware variants on the same board
by configuring data-lanes in device tree only.
Signed-off-by: Damon Ding <damon.ding@rock-chips.com>
---
Changes in v2:
- Add lane mapping application scenarios in commit message.
---
.../drm/bridge/analogix/analogix_dp_core.c | 56 +++++++++++++++++++
.../drm/bridge/analogix/analogix_dp_core.h | 4 +-
.../gpu/drm/bridge/analogix/analogix_dp_reg.c | 15 +++--
.../gpu/drm/bridge/analogix/analogix_dp_reg.h | 4 ++
4 files changed, 70 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
index 699a7f380c56..b2e729850391 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
@@ -1234,6 +1234,59 @@ static const struct drm_bridge_funcs analogix_dp_bridge_funcs = {
.detect = analogix_dp_bridge_detect,
};
+static int analogix_dp_dt_parse_lanes_map(struct analogix_dp_device *dp)
+{
+ struct video_info *video_info = &dp->video_info;
+ struct device_node *endpoint;
+ u32 tmp[LANE_COUNT4];
+ u32 map[LANE_COUNT4] = {0, 1, 2, 3};
+ bool used[LANE_COUNT4] = {false};
+ int num_lanes;
+ int ret, i;
+
+ memcpy(video_info->lane_map, map, sizeof(map));
+
+ num_lanes = drm_of_get_data_lanes_count_ep(dp->dev->of_node, 1, 0, 1,
+ video_info->max_lane_count);
+ if (num_lanes < 0)
+ return -EINVAL;
+
+ endpoint = of_graph_get_endpoint_by_regs(dp->dev->of_node, 1, -1);
+ if (!endpoint)
+ return -EINVAL;
+
+ ret = of_property_read_u32_array(endpoint, "data-lanes", tmp, num_lanes);
+ of_node_put(endpoint);
+ if (ret)
+ return -EINVAL;
+
+ for (i = 0; i < num_lanes; i++) {
+ if (tmp[i] >= LANE_COUNT4) {
+ dev_dbg(dp->dev, "data-lanes[%d] = %u is out of range\n", i, tmp[i]);
+ return -EINVAL;
+ }
+
+ if (used[tmp[i]]) {
+ dev_dbg(dp->dev, "data-lanes[%d] = %u is duplicate\n", i, tmp[i]);
+ return -EINVAL;
+ }
+
+ used[tmp[i]] = true;
+ map[i] = tmp[i];
+ }
+
+ for (i = 0; i < LANE_COUNT4 && num_lanes < LANE_COUNT4; i++) {
+ if (!used[i])
+ map[num_lanes++] = i;
+ }
+
+ dev_dbg(dp->dev, "Using parsed lane map: <%u %u %u %u>\n", map[0], map[1], map[2], map[3]);
+
+ memcpy(video_info->lane_map, map, sizeof(map));
+
+ return 0;
+}
+
static int analogix_dp_dt_parse_pdata(struct analogix_dp_device *dp)
{
struct device_node *dp_node = dp->dev->of_node;
@@ -1274,6 +1327,9 @@ static int analogix_dp_dt_parse_pdata(struct analogix_dp_device *dp)
break;
}
+ if (analogix_dp_dt_parse_lanes_map(dp))
+ dev_dbg(dp->dev, "No valid data-lanes found, using default lane map\n");
+
return 0;
}
diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.h b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.h
index 17347448c6b0..634fad241e69 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.h
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.h
@@ -137,6 +137,8 @@ struct video_info {
int max_link_rate;
enum link_lane_count_type max_lane_count;
+
+ u32 lane_map[LANE_COUNT4];
};
struct link_train {
@@ -175,7 +177,7 @@ struct analogix_dp_device {
/* analogix_dp_reg.c */
void analogix_dp_enable_video_mute(struct analogix_dp_device *dp, bool enable);
void analogix_dp_stop_video(struct analogix_dp_device *dp);
-void analogix_dp_lane_swap(struct analogix_dp_device *dp, bool enable);
+void analogix_dp_lane_mapping(struct analogix_dp_device *dp);
void analogix_dp_init_analog_param(struct analogix_dp_device *dp);
void analogix_dp_init_interrupt(struct analogix_dp_device *dp);
void analogix_dp_reset(struct analogix_dp_device *dp);
diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c
index 38fd8d5014d2..45c7652645a1 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c
@@ -48,16 +48,15 @@ void analogix_dp_stop_video(struct analogix_dp_device *dp)
writel(reg, dp->reg_base + ANALOGIX_DP_VIDEO_CTL_1);
}
-void analogix_dp_lane_swap(struct analogix_dp_device *dp, bool enable)
+void analogix_dp_lane_mapping(struct analogix_dp_device *dp)
{
+ u32 *lane_map = dp->video_info.lane_map;
u32 reg;
- if (enable)
- reg = LANE3_MAP_LOGIC_LANE_0 | LANE2_MAP_LOGIC_LANE_1 |
- LANE1_MAP_LOGIC_LANE_2 | LANE0_MAP_LOGIC_LANE_3;
- else
- reg = LANE3_MAP_LOGIC_LANE_3 | LANE2_MAP_LOGIC_LANE_2 |
- LANE1_MAP_LOGIC_LANE_1 | LANE0_MAP_LOGIC_LANE_0;
+ reg = lane_map[0] << LANE0_MAP_SHIFT;
+ reg |= lane_map[1] << LANE1_MAP_SHIFT;
+ reg |= lane_map[2] << LANE2_MAP_SHIFT;
+ reg |= lane_map[3] << LANE3_MAP_SHIFT;
writel(reg, dp->reg_base + ANALOGIX_DP_LANE_MAP);
}
@@ -140,7 +139,7 @@ void analogix_dp_reset(struct analogix_dp_device *dp)
usleep_range(20, 30);
- analogix_dp_lane_swap(dp, 0);
+ analogix_dp_lane_mapping(dp);
writel(0x0, dp->reg_base + ANALOGIX_DP_SYS_CTL_1);
writel(0x40, dp->reg_base + ANALOGIX_DP_SYS_CTL_2);
diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.h b/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.h
index 12735139046c..ac914e37089b 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.h
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.h
@@ -209,6 +209,10 @@
#define LANE0_MAP_LOGIC_LANE_1 (0x1 << 0)
#define LANE0_MAP_LOGIC_LANE_2 (0x2 << 0)
#define LANE0_MAP_LOGIC_LANE_3 (0x3 << 0)
+#define LANE3_MAP_SHIFT (6)
+#define LANE2_MAP_SHIFT (4)
+#define LANE1_MAP_SHIFT (2)
+#define LANE0_MAP_SHIFT (0)
/* ANALOGIX_DP_ANALOG_CTL_1 */
#define TX_TERMINAL_CTRL_50_OHM (0x1 << 4)
--
2.34.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH v4 1/3] dt-bindings: display: bridge: analogix-dp: Add data-lanes support for endpoint
2026-05-29 4:05 ` [PATCH v4 1/3] dt-bindings: display: bridge: analogix-dp: Add data-lanes support for endpoint Damon Ding
@ 2026-05-29 4:46 ` sashiko-bot
2026-05-29 16:43 ` Conor Dooley
1 sibling, 0 replies; 8+ messages in thread
From: sashiko-bot @ 2026-05-29 4:46 UTC (permalink / raw)
To: Damon Ding; +Cc: conor+dt, devicetree, robh
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Device Tree Schema Validation Bypass for data-lanes property
--
commit cd3810bac14e15433ba605ad5fc1eeb8345f5c17
Author: Damon Ding <damon.ding@rock-chips.com>
dt-bindings: display: bridge: analogix-dp: Add data-lanes support for endpoint
This commit adds support for the data-lanes property to the port@1 endpoint
in the analogix-dp binding. It allows configuration of physical lane mappings
to handle scenarios like PCB lane swaps or mismatched pin definitions. The
patch also updates the rockchip eDP DT node example to demonstrate this usage.
> diff --git a/Documentation/devicetree/bindings/display/bridge/analogix,dp.yaml b/Documentation/devicetree/bindings/display/bridge/analogix,dp.yaml
> index 62f0521b09245..ecf206871cdde 100644
> --- a/Documentation/devicetree/bindings/display/bridge/analogix,dp.yaml
> +++ b/Documentation/devicetree/bindings/display/bridge/analogix,dp.yaml
[ ... ]
> port@1:
> - $ref: /schemas/graph.yaml#/properties/port
> - description:
> - Port node with one endpoint connected to a dp-connector node.
> + $ref: /schemas/graph.yaml#/$defs/port-base
> + unevaluatedProperties: false
> + description: Port node with one endpoint connected to sink device node.
> + properties:
> + endpoint:
[Severity: Low]
Will this literal "endpoint" property match nodes in existing device trees?
It looks like multiple existing device trees, such as rk3399-evb.dts and
rk3288-evb.dtsi, define the endpoint with a unit address as "endpoint@0".
Because these nodes do not perfectly match the literal name "endpoint",
wouldn't they bypass this constraint block entirely, meaning any data-lanes
configuration inside them will not be validated against the specified enum
or maxItems limits?
> + $ref: /schemas/media/video-interfaces.yaml#
> + unevaluatedProperties: false
> + properties:
> + data-lanes:
> + minItems: 1
> + maxItems: 4
> + items:
> + enum: [ 0, 1, 2, 3 ]
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260529040530.741336-1-damon.ding@rock-chips.com?part=1
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v4 2/3] drm/bridge: analogix_dp: Add validation for samsung,lane-count property
2026-05-29 4:05 ` [PATCH v4 2/3] drm/bridge: analogix_dp: Add validation for samsung,lane-count property Damon Ding
@ 2026-05-29 5:31 ` sashiko-bot
0 siblings, 0 replies; 8+ messages in thread
From: sashiko-bot @ 2026-05-29 5:31 UTC (permalink / raw)
To: Damon Ding; +Cc: robh, conor+dt, devicetree
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] The bounds check for `samsung,lane-count` incorrectly accepts invalid lane counts (like 3) and can be entirely bypassed with large values due to signed comparison, leaving a heap overflow vulnerability unfixed.
--
commit f84cb246760d7a4c631b55b3c7a41c458926dcf4
Author: Damon Ding <damon.ding@rock-chips.com>
drm/bridge: analogix_dp: Add validation for samsung,lane-count property
This patch adds a range check for the samsung,lane-count device tree property
to avoid invalid values. The validation is only applied when the property
exists to maintain backward compatibility.
> diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
> --- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
> +++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
[ ... ]
> @@ -1260,8 +1261,16 @@ static int analogix_dp_dt_parse_pdata(struct analogix_dp_device *dp)
> */
> of_property_read_u32(dp_node, "samsung,link-rate",
> &video_info->max_link_rate);
> - of_property_read_u32(dp_node, "samsung,lane-count",
> - &video_info->max_lane_count);
> + ret = of_property_read_u32(dp_node, "samsung,lane-count",
> + &video_info->max_lane_count);
> + if (!ret) {
> + if (video_info->max_lane_count == 0 ||
> + video_info->max_lane_count > LANE_COUNT4) {
[Severity: High]
This is a pre-existing issue, but does this bounds check effectively
prevent all invalid lane counts?
Since max_lane_count is defined as an enum link_lane_count_type, on ARM
architectures (following AAPCS) enums without negative values that fit in a
signed int are represented as signed int. If of_property_read_u32 writes
a large unsigned value like 0xFFFFFFFF into this enum, it is interpreted
as -1. The signed comparison -1 > 4 evaluates to false, which bypasses
the validation.
When this large value is cast back to u32 later in the driver, it could
allow dp->link_train.lane_count to remain at a malicious value read from
the sink's DPCD, eventually leading to a heap buffer overflow when
initializing the cr_loop array which is sized for only 4 elements.
Additionally, does this check inadvertently allow 3, which is an invalid
DisplayPort lane count?
Would it be safer to read the property into a local u32 variable, validate
it strictly, and only then assign it to video_info->max_lane_count?
> + dev_err(dp->dev, "samsung,lane-count = %d is out of range\n",
> + video_info->max_lane_count);
> + return -EINVAL;
> + }
> + }
> break;
> }
>
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260529040530.741336-1-damon.ding@rock-chips.com?part=2
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v4 3/3] drm/bridge: analogix_dp: Add support for optional data-lanes mapping
2026-05-29 4:05 ` [PATCH v4 3/3] drm/bridge: analogix_dp: Add support for optional data-lanes mapping Damon Ding
@ 2026-05-29 5:56 ` sashiko-bot
0 siblings, 0 replies; 8+ messages in thread
From: sashiko-bot @ 2026-05-29 5:56 UTC (permalink / raw)
To: Damon Ding; +Cc: devicetree, robh, conor+dt
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Incorrect physical-to-logical lane mapping programmed into hardware register.
- [Medium] Inconsistent endpoint resolution when validating and parsing the 'data-lanes' property.
--
commit b0396fb13d86cb1835c8181f73f2c91f756c7665
Author: Damon Ding <damon.ding@rock-chips.com>
drm/bridge: analogix_dp: Add support for optional data-lanes mapping
This commit parses the optional 'data-lanes' device tree property to support
custom physical lane mapping configurations. If no valid configuration is found,
it falls back to the default lane map automatically.
> diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
> index 699a7f380c56c..b2e729850391b 100644
> --- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
> +++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
[ ... ]
> @@ -1234,6 +1234,59 @@ static const struct drm_bridge_funcs analogix_dp_bridge_funcs = {
[ ... ]
> +static int analogix_dp_dt_parse_lanes_map(struct analogix_dp_device *dp)
> +{
[ ... ]
> + num_lanes = drm_of_get_data_lanes_count_ep(dp->dev->of_node, 1, 0, 1,
> + video_info->max_lane_count);
> + if (num_lanes < 0)
> + return -EINVAL;
> +
> + endpoint = of_graph_get_endpoint_by_regs(dp->dev->of_node, 1, -1);
[Severity: Medium]
Is there a risk of inconsistent endpoint resolution here?
The call to drm_of_get_data_lanes_count_ep() strictly searches for the
endpoint with reg = 0 under port 1. However,
of_graph_get_endpoint_by_regs(..., 1, -1) matches the first available
endpoint regardless of its reg value.
If a device tree defines multiple endpoints under port 1, could these calls
resolve to different endpoints? This might cause the driver to validate the
lane count against one endpoint but parse the mapping from another.
> + if (!endpoint)
> + return -EINVAL;
[ ... ]
> diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c
> index 38fd8d5014d29..45c7652645a13 100644
> --- a/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c
> +++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c
[ ... ]
> @@ -48,16 +48,15 @@ void analogix_dp_stop_video(struct analogix_dp_device *dp)
[ ... ]
> -void analogix_dp_lane_swap(struct analogix_dp_device *dp, bool enable)
> +void analogix_dp_lane_mapping(struct analogix_dp_device *dp)
> {
> + u32 *lane_map = dp->video_info.lane_map;
> u32 reg;
>
> - if (enable)
> - reg = LANE3_MAP_LOGIC_LANE_0 | LANE2_MAP_LOGIC_LANE_1 |
> - LANE1_MAP_LOGIC_LANE_2 | LANE0_MAP_LOGIC_LANE_3;
> - else
> - reg = LANE3_MAP_LOGIC_LANE_3 | LANE2_MAP_LOGIC_LANE_2 |
> - LANE1_MAP_LOGIC_LANE_1 | LANE0_MAP_LOGIC_LANE_0;
> + reg = lane_map[0] << LANE0_MAP_SHIFT;
> + reg |= lane_map[1] << LANE1_MAP_SHIFT;
> + reg |= lane_map[2] << LANE2_MAP_SHIFT;
> + reg |= lane_map[3] << LANE3_MAP_SHIFT;
[Severity: High]
Does this code program the hardware register with the correct mapping?
The data-lanes device tree property defines the physical lane for each
logical lane, meaning lane_map[i] holds the physical lane assigned to
logical lane i.
However, the hardware register ANALOGIX_DP_LANE_MAP appears to expect the
reverse mapping, where it is divided into bit fields per physical lane that
must be programmed with the desired logical lane.
Writing lane_map[0] << LANE0_MAP_SHIFT assigns the physical lane index into
the configuration field for Physical Lane 0. While this might work for
self-inverse mappings, could it produce a scrambled configuration for
non-symmetric mappings?
>
> writel(reg, dp->reg_base + ANALOGIX_DP_LANE_MAP);
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260529040530.741336-1-damon.ding@rock-chips.com?part=3
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v4 1/3] dt-bindings: display: bridge: analogix-dp: Add data-lanes support for endpoint
2026-05-29 4:05 ` [PATCH v4 1/3] dt-bindings: display: bridge: analogix-dp: Add data-lanes support for endpoint Damon Ding
2026-05-29 4:46 ` sashiko-bot
@ 2026-05-29 16:43 ` Conor Dooley
1 sibling, 0 replies; 8+ messages in thread
From: Conor Dooley @ 2026-05-29 16:43 UTC (permalink / raw)
To: Damon Ding
Cc: hjc, heiko, andy.yan, maarten.lankhorst, mripard, tzimmermann,
airlied, simona, robh, krzk+dt, conor+dt, andrzej.hajda,
neil.armstrong, rfoss, Laurent.pinchart, jonas, jernej.skrabec,
nicolas.frattaroli, cristian.ciocaltea, sebastian.reichel,
dmitry.baryshkov, luca.ceresoli, dianders, m.szyprowski,
dri-devel, devicetree, linux-arm-kernel, linux-rockchip,
linux-kernel
[-- Attachment #1: Type: text/plain, Size: 3497 bytes --]
On Fri, May 29, 2026 at 12:05:28PM +0800, Damon Ding wrote:
> Add data-lanes property support to the port@1 endpoint for physical
> lane mapping configuration.
>
> Lane mapping is mainly used for below scenarios:
> 1. Correct PCB lane swap and differential line routing crossover
> without hardware changes;
> 2. Adapt mismatched lane pin definitions between SoC and eDP panel;
> 3. Support multiple panel hardware variants on the same board
> by configuring data-lanes in device tree only.
>
> Additionally, add data-lanes setting in Rockchip eDP DT node example
> to show actual lane mapping usage.
>
> Signed-off-by: Damon Ding <damon.ding@rock-chips.com>
Not entirely sure if this is correct, but I'll leave that decision up to
the display folks who know the hardware.
pw-bot: not-applicable
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Cheers,
Conor.
>
> ---
>
> Changes in v2:
> - Add lane mapping application scenarios in commit message.
> - Remove redundant deprecated property 'data-lanes' for eDP node.
> - Update port@1 $ref to /schemas/graph.yaml#/$defs/port-base.
>
> Changes in v3:
> - Squash data-lanes adjustment of Rockchip eDP DT example into this
> commit.
> - Add unevaluatedProperties: false to both the port@1 and endpoint
> nodes.
> ---
> .../bindings/display/bridge/analogix,dp.yaml | 19 ++++++++++++++-----
> .../rockchip/rockchip,analogix-dp.yaml | 1 +
> 2 files changed, 15 insertions(+), 5 deletions(-)
>
> diff --git a/Documentation/devicetree/bindings/display/bridge/analogix,dp.yaml b/Documentation/devicetree/bindings/display/bridge/analogix,dp.yaml
> index 62f0521b0924..ecf206871cdd 100644
> --- a/Documentation/devicetree/bindings/display/bridge/analogix,dp.yaml
> +++ b/Documentation/devicetree/bindings/display/bridge/analogix,dp.yaml
> @@ -42,13 +42,22 @@ properties:
> properties:
> port@0:
> $ref: /schemas/graph.yaml#/properties/port
> - description:
> - Input node to receive pixel data.
> + description: Input node to receive pixel data.
>
> port@1:
> - $ref: /schemas/graph.yaml#/properties/port
> - description:
> - Port node with one endpoint connected to a dp-connector node.
> + $ref: /schemas/graph.yaml#/$defs/port-base
> + unevaluatedProperties: false
> + description: Port node with one endpoint connected to sink device node.
> + properties:
> + endpoint:
> + $ref: /schemas/media/video-interfaces.yaml#
> + unevaluatedProperties: false
> + properties:
> + data-lanes:
> + minItems: 1
> + maxItems: 4
> + items:
> + enum: [ 0, 1, 2, 3 ]
>
> required:
> - port@0
> diff --git a/Documentation/devicetree/bindings/display/rockchip/rockchip,analogix-dp.yaml b/Documentation/devicetree/bindings/display/rockchip/rockchip,analogix-dp.yaml
> index d99b23b88cc5..f690ee393fdb 100644
> --- a/Documentation/devicetree/bindings/display/rockchip/rockchip,analogix-dp.yaml
> +++ b/Documentation/devicetree/bindings/display/rockchip/rockchip,analogix-dp.yaml
> @@ -117,6 +117,7 @@ examples:
> reg = <1>;
>
> edp_out_panel: endpoint {
> + data-lanes = <0 1>;
> remote-endpoint = <&panel_in_edp>;
> };
> };
> --
> 2.34.1
>
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-05-29 16:43 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-29 4:05 [PATCH v4 0/3] Add eDP lane mapping support Damon Ding
2026-05-29 4:05 ` [PATCH v4 1/3] dt-bindings: display: bridge: analogix-dp: Add data-lanes support for endpoint Damon Ding
2026-05-29 4:46 ` sashiko-bot
2026-05-29 16:43 ` Conor Dooley
2026-05-29 4:05 ` [PATCH v4 2/3] drm/bridge: analogix_dp: Add validation for samsung,lane-count property Damon Ding
2026-05-29 5:31 ` sashiko-bot
2026-05-29 4:05 ` [PATCH v4 3/3] drm/bridge: analogix_dp: Add support for optional data-lanes mapping Damon Ding
2026-05-29 5:56 ` sashiko-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox