[PATCH AUTOSEL 6.19-6.18] drm/amd/display: Correct FIXED_VS Link Rate Toggle Condition

Sasha Levin
2026-02-14T01:06:29Z

From: Jing Zhou <Jing.Zhou@amd.com>

[ Upstream commit 531fe6e0fee85a1bdb5b8223a706fff654ed0a61 ]

[WHY&HOW]
The condition is only perform toggle if FIXED_VS LTTPR reports
no IEEE OUI.
The literal "\x0,\x0,\x0" contains commas changes the
bytes being compared to {0x00,0x2C,0X00}.
The correct literal should be "\x00\x00\x00" without commas.

Reviewed-by: Charlene Liu <charlene.liu@amd.com>
Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
Signed-off-by: Jing Zhou <Jing.Zhou@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

Good - the nontransparent path at line 118 doesn't have the OUI check
(it uses the older unconditional logic), so it's not affected. Only the
transparent path (line 274) has the buggy memcmp.

Now I have all the information needed for a comprehensive analysis.

---

## Comprehensive Analysis

### 1. COMMIT MESSAGE ANALYSIS

The commit message is clear and well-explained:
- **Subject**: "drm/amd/display: Correct FIXED_VS Link Rate Toggle
Condition"
- **Why**: The C string literal `"\x0,\x0,\x0"` contains comma
characters that change the bytes being compared from the intended
`{0x00, 0x00, 0x00}` to `{0x00, 0x2C, 0x00}`.
- **How**: Replace the buggy literal with the correct `"\x00\x00\x00"`.
- **Trust indicators**: Reviewed-by: Charlene Liu, Reviewed-by: Wenjing
Liu, Tested-by: Dan Wheeler, Signed-off-by: Alex Deucher (AMD GPU
maintainer). This has strong review coverage.

### 2. CODE CHANGE ANALYSIS

The change is a single-line fix:

```273:274:drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_trainin
g_fixed_vs_pe_retimer.c
// Only perform toggle if FIXED_VS LTTPR reports no IEEE OUI
if (memcmp("\x0,\x0,\x0",
&link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) {
```

Changed to `"\x00\x00\x00"`.

**The Bug Mechanism in Detail:**

In C, the hex escape sequence `\xN` consumes as many hexadecimal digits
as follow. However, a comma (`,`) is NOT a hex digit, so `\x0`
terminates at the comma. The result:
- `\x0` = byte 0x00
- `,` = byte 0x2C (ASCII comma)
- `\x0` = byte 0x00
- `,` = byte 0x2C (ASCII comma)
- `\x0` = byte 0x00

The string is 5 bytes `{0x00, 0x2C, 0x00, 0x2C, 0x00}` plus null
terminator. Since `memcmp` compares only 3 bytes, the comparison is
against `{0x00, 0x2C, 0x00}` — NOT the intended `{0x00, 0x00, 0x00}`.

**Consequence**: The condition was supposed to check if the LTTPR
reports NO IEEE OUI (all zeros), and if so, perform a link rate toggle
workaround. Because of the bug, the comparison almost never matches, so
the workaround is effectively **disabled**. This breaks DisplayPort link
training on systems with FIXED_VS retimer chips that report no IEEE OUI,
potentially causing **display link failures** (no display output or
degraded link quality).

### 3. BUG ORIGIN AND AFFECTED VERSIONS

The bug was introduced in commit `7c6518c1c7319` ("drm/amd/display:
Update FIXED_VS Link Rate Toggle Workaround Usage"), first appearing in
v6.15-rc1. This commit has already been **backported** to:
- **stable/linux-6.14.y** (as `caa4938c5c92f`) — confirmed buggy
- **stable/linux-6.15.y** through **stable/linux-6.19.y** — all contain
the same bug
- **stable/linux-6.12.y** — NOT affected (doesn't have the OUI check at
all, uses older 128b/132b logic)

### 4. CLASSIFICATION

This is a clear **bug fix**:
- Fixes an incorrect byte comparison that breaks a hardware workaround
- No new features, no new APIs
- Pure correction of a string literal typo

### 5. SCOPE AND RISK ASSESSMENT

- **Lines changed**: 1 (single string literal correction)
- **Files touched**: 1
- **Complexity**: Trivially low
- **Risk of regression**: Near zero — this is fixing a byte comparison
to match the original intent
- **Subsystem**: AMD display driver (DisplayPort link training for
retimer devices)

### 6. USER IMPACT

- **Who is affected**: Users with AMD GPU systems that have FIXED_VS
LTTPR (Link Training Tunable PHY Repeater) chips with no IEEE OUI.
These are vendor-specific retimer chips commonly found in laptops and
USB4/Thunderbolt dock setups.
- **Severity**: The link rate toggle workaround is completely disabled,
potentially causing DisplayPort link training failures (no display,
display flickering, or link instability).
- **Real-world impact**: This directly affects display functionality — a
critical user-facing issue.

### 7. DEPENDENCY CHECK

The fix has **zero dependencies** beyond the buggy commit that's already
present in stable trees:
- The `lttpr_ieee_oui` field exists in stable (added by `7c6518c1c7319`
itself)
- The fix is a pure string literal correction on the same line
introduced by the bug
- No context changes needed — the fix will apply cleanly to any stable
tree that has the buggy commit

### 8. SUMMARY

This is a textbook stable backport candidate:
- **Obviously correct**: Changing `"\x0,\x0,\x0"` to `"\x00\x00\x00"` is
a trivially verifiable fix
- **Fixes a real bug**: The commas in the hex escape create the wrong
byte sequence, disabling a necessary hardware workaround
- **Important issue**: Affects display link training — can cause display
failures
- **Small and contained**: Single character-level fix in one file, one
line
- **No new features**: Pure bug fix
- **Already tested**: Has Tested-by tag from AMD's test team, plus two
Reviewed-by tags
- **Buggy code exists in stable**: Confirmed present in 6.14.y through
6.19.y

**YES**

.../dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c
index ce174ce5579c0..6a7c4a59ff4c7 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c
@@ -271,7 +271,7 @@ enum link_training_result dp_perform_fixed_vs_pe_training_sequence(
rate = get_dpcd_link_rate(&lt_settings->link_settings);

// Only perform toggle if FIXED_VS LTTPR reports no IEEE OUI
- if (memcmp("\x0,\x0,\x0", &link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) {
+ if (memcmp("\x00\x00\x00", &link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) {
/* Vendor specific: Toggle link rate */
toggle_rate = (rate == 0x6) ? 0xA : 0x6;

--
2.51.0