| Message ID | 20200828112444.916455-1-megous@megous.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/sun4i: Fix dsi dcs long write function | expand |
Dne petek, 28. avgust 2020 ob 13:24:44 CEST je Ondrej Jirman napisal(a): > It's writing too much data. regmap_bulk_write expects number of > register sized chunks to write, not a byte sized length of the > bounce buffer. Bounce buffer needs to be padded too, so that > regmap_bulk_write will not read past the end of the buffer. > > Signed-off-by: Ondrej Jirman <megous@megous.com> Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller support") should be added. Fix will be then automatically picked into stable releases. Small nit below. > --- > drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c > b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c index 7f13f4d715bf..840fad1b68dd > 100644 > --- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c > +++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c > @@ -889,7 +889,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi > *dsi, regmap_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(0), > sun6i_dsi_dcs_build_pkt_hdr(dsi, msg)); > > - bounce = kzalloc(msg->tx_len + sizeof(crc), GFP_KERNEL); > + bounce = kzalloc(msg->tx_len + sizeof(crc) + 3, GFP_KERNEL); It would be nicer to use ALIGN() macro, but I'm fine either way. Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net> Best regards, Jernej > if (!bounce) > return -ENOMEM; > > @@ -900,7 +900,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi > *dsi, memcpy((u8 *)bounce + msg->tx_len, &crc, sizeof(crc)); > len += sizeof(crc); > > - regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, len); > + regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, > DIV_ROUND_UP(len, 4)); regmap_write(dsi->regs, SUN6I_DSI_CMD_CTL_REG, len + > 4 - 1); > kfree(bounce);
On Fri, Aug 28, 2020 at 02:35:26PM +0200, Jernej Škrabec wrote: > Dne petek, 28. avgust 2020 ob 13:24:44 CEST je Ondrej Jirman napisal(a): > > It's writing too much data. regmap_bulk_write expects number of > > register sized chunks to write, not a byte sized length of the > > bounce buffer. Bounce buffer needs to be padded too, so that > > regmap_bulk_write will not read past the end of the buffer. > > > > Signed-off-by: Ondrej Jirman <megous@megous.com> > > Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller > support") It doesn't really fix anything user visible though, and will not help the stable branch in any way. It just makes the code more correct. Though now that you came up with the tag, copypasting it is not that much work. ;) So I added it. > should be added. Fix will be then automatically picked into stable releases. > > Small nit below. > > > --- > > drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c > > b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c index 7f13f4d715bf..840fad1b68dd > > 100644 > > --- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c > > +++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c > > @@ -889,7 +889,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi > > *dsi, regmap_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(0), > > sun6i_dsi_dcs_build_pkt_hdr(dsi, msg)); > > > > - bounce = kzalloc(msg->tx_len + sizeof(crc), GFP_KERNEL); > > + bounce = kzalloc(msg->tx_len + sizeof(crc) + 3, GFP_KERNEL); > > It would be nicer to use ALIGN() macro, but I'm fine either way. Nice idea. > Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net> Thanks. :) regards, o. > Best regards, > Jernej > > > if (!bounce) > > return -ENOMEM; > > > > @@ -900,7 +900,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi > > *dsi, memcpy((u8 *)bounce + msg->tx_len, &crc, sizeof(crc)); > > len += sizeof(crc); > > > > - regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, > len); > > + regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, > > DIV_ROUND_UP(len, 4)); regmap_write(dsi->regs, SUN6I_DSI_CMD_CTL_REG, len + > > 4 - 1); > > kfree(bounce); > > > >
diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c index 7f13f4d715bf..840fad1b68dd 100644 --- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c @@ -889,7 +889,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi *dsi, regmap_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(0), sun6i_dsi_dcs_build_pkt_hdr(dsi, msg)); - bounce = kzalloc(msg->tx_len + sizeof(crc), GFP_KERNEL); + bounce = kzalloc(msg->tx_len + sizeof(crc) + 3, GFP_KERNEL); if (!bounce) return -ENOMEM; @@ -900,7 +900,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi *dsi, memcpy((u8 *)bounce + msg->tx_len, &crc, sizeof(crc)); len += sizeof(crc); - regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, len); + regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, DIV_ROUND_UP(len, 4)); regmap_write(dsi->regs, SUN6I_DSI_CMD_CTL_REG, len + 4 - 1); kfree(bounce);
It's writing too much data. regmap_bulk_write expects number of register sized chunks to write, not a byte sized length of the bounce buffer. Bounce buffer needs to be padded too, so that regmap_bulk_write will not read past the end of the buffer. Signed-off-by: Ondrej Jirman <megous@megous.com> --- drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)