[SRU][Q][PATCH 1/1] drm/dp: Add byte-by-byte fallback for broken USB-C adapters

[Stefan Bader]

On 26/12/2025 04:44, AceLan Kao wrote:
> From: "Chia-Lin Kao (AceLan)" <acelan.kao at canonical.com>
> 
> BugLink: https://bugs.launchpad.net/bugs/2133143
> 
> Some USB-C hubs and adapters have buggy firmware where multi-byte AUX
> reads consistently timeout, while single-byte reads from the same address
> work correctly.
> 
> Known affected devices that exhibit this issue:
> - Lenovo USB-C to VGA adapter (VIA VL817 chipset)
>    idVendor=17ef, idProduct=7217
> - Dell DA310 USB-C mobile adapter hub
>    idVendor=413c, idProduct=c010
> 
> Analysis of the failure pattern shows:
> - Single-byte probes to 0xf0000 (LTTPR) succeed
> - Single-byte probes to 0x00102 (TRAINING_AUX_RD_INTERVAL) succeed
> - Multi-byte reads from 0x00000 (DPCD capabilities) timeout with -ETIMEDOUT
> - Retrying does not help - the failure is consistent across all attempts
> 
> The issue appears to be a firmware bug in the AUX transaction handling
> that specifically affects multi-byte reads.
> 
> Add a fallback mechanism in drm_dp_dpcd_read_data() that attempts
> byte-by-byte reading when the normal multi-byte read fails. This
> workaround only activates for adapters that fail the standard read path,
> ensuring no impact on correctly functioning hardware.
> 
> Tested with:
> - Lenovo USB-C to VGA adapter (VIA VL817) - now works with fallback
> - Dell DA310 USB-C hub - now works with fallback
> - Dell/Analogix Slimport adapter - continues to work with normal path
> 
> Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao at canonical.com>
     Reviewed-by: Mario Limonciello (AMD) <superm1 at kernel.org>
     Link: 
https://patch.msgid.link/20251204024647.1462866-1-acelan.kao@canonical.com
     Signed-off-by: Mario Limonciello (AMD) <superm1 at kernel.org>

   (cherry picked from a8f49a0043011c3dd12998a6c700bb59d5365c20)
> Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao at canonical.com>
> ---

This is now upstream and should be picked into questing as such.

-Stefan

>   include/drm/display/drm_dp_helper.h | 57 +++++++++++++++++++----------
>   1 file changed, 37 insertions(+), 20 deletions(-)
> 
> diff --git a/include/drm/display/drm_dp_helper.h b/include/drm/display/drm_dp_helper.h
> index 87caa4f1fdb86..602c5a3a3cc28 100644
> --- a/include/drm/display/drm_dp_helper.h
> +++ b/include/drm/display/drm_dp_helper.h
> @@ -538,6 +538,22 @@ ssize_t drm_dp_dpcd_read(struct drm_dp_aux *aux, unsigned int offset,
>   ssize_t drm_dp_dpcd_write(struct drm_dp_aux *aux, unsigned int offset,
>   			  void *buffer, size_t size);
>   
> +/**
> + * drm_dp_dpcd_readb() - read a single byte from the DPCD
> + * @aux: DisplayPort AUX channel
> + * @offset: address of the register to read
> + * @valuep: location where the value of the register will be stored
> + *
> + * Returns the number of bytes transferred (1) on success, or a negative
> + * error code on failure. In most of the cases you should be using
> + * drm_dp_dpcd_read_byte() instead.
> + */
> +static inline ssize_t drm_dp_dpcd_readb(struct drm_dp_aux *aux,
> +					unsigned int offset, u8 *valuep)
> +{
> +	return drm_dp_dpcd_read(aux, offset, valuep, 1);
> +}
> +
>   /**
>    * drm_dp_dpcd_read_data() - read a series of bytes from the DPCD
>    * @aux: DisplayPort AUX channel (SST or MST)
> @@ -557,12 +573,29 @@ static inline int drm_dp_dpcd_read_data(struct drm_dp_aux *aux,
>   					void *buffer, size_t size)
>   {
>   	int ret;
> +	size_t i;
> +	u8 *buf = buffer;
>   
>   	ret = drm_dp_dpcd_read(aux, offset, buffer, size);
> -	if (ret < 0)
> -		return ret;
> -	if (ret < size)
> -		return -EPROTO;
> +	if (ret >= 0) {
> +		if (ret < size)
> +			return -EPROTO;
> +		return 0;
> +	}
> +
> +	/*
> +	 * Workaround for USB-C hubs/adapters with buggy firmware that fail
> +	 * multi-byte AUX reads but work with single-byte reads.
> +	 * Known affected devices:
> +	 * - Lenovo USB-C to VGA adapter (VIA VL817, idVendor=17ef, idProduct=7217)
> +	 * - Dell DA310 USB-C hub (idVendor=413c, idProduct=c010)
> +	 * Attempt byte-by-byte reading as a fallback.
> +	 */
> +	for (i = 0; i < size; i++) {
> +		ret = drm_dp_dpcd_readb(aux, offset + i, &buf[i]);
> +		if (ret < 0)
> +			return ret;
> +	}
>   
>   	return 0;
>   }
> @@ -596,22 +629,6 @@ static inline int drm_dp_dpcd_write_data(struct drm_dp_aux *aux,
>   	return 0;
>   }
>   
> -/**
> - * drm_dp_dpcd_readb() - read a single byte from the DPCD
> - * @aux: DisplayPort AUX channel
> - * @offset: address of the register to read
> - * @valuep: location where the value of the register will be stored
> - *
> - * Returns the number of bytes transferred (1) on success, or a negative
> - * error code on failure. In most of the cases you should be using
> - * drm_dp_dpcd_read_byte() instead.
> - */
> -static inline ssize_t drm_dp_dpcd_readb(struct drm_dp_aux *aux,
> -					unsigned int offset, u8 *valuep)
> -{
> -	return drm_dp_dpcd_read(aux, offset, valuep, 1);
> -}
> -
>   /**
>    * drm_dp_dpcd_writeb() - write a single byte to the DPCD
>    * @aux: DisplayPort AUX channel

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 52669 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260123/a24826b9/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260123/a24826b9/attachment-0001.sig>