* [PATCH] drm/sun4i: Fix dsi dcs long write function
@ 2020-08-28 11:24 Ondrej Jirman
2020-08-28 12:35 ` [linux-sunxi] " Jernej Škrabec
0 siblings, 1 reply; 3+ messages in thread
From: Ondrej Jirman @ 2020-08-28 11:24 UTC (permalink / raw)
To: linux-sunxi
Cc: Ondrej Jirman, Maxime Ripard, Chen-Yu Tsai, David Airlie,
Daniel Vetter, open list:DRM DRIVERS FOR ALLWINNER A10,
moderated list:ARM/Allwinner sunXi SoC support, open list
It's writing too much data. regmap_bulk_write expects number of
register sized chunks to write, not a byte sized length of the
bounce buffer. Bounce buffer needs to be padded too, so that
regmap_bulk_write will not read past the end of the buffer.
Signed-off-by: Ondrej Jirman <megous@megous.com>
---
drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
index 7f13f4d715bf..840fad1b68dd 100644
--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
@@ -889,7 +889,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi *dsi,
regmap_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(0),
sun6i_dsi_dcs_build_pkt_hdr(dsi, msg));
- bounce = kzalloc(msg->tx_len + sizeof(crc), GFP_KERNEL);
+ bounce = kzalloc(msg->tx_len + sizeof(crc) + 3, GFP_KERNEL);
if (!bounce)
return -ENOMEM;
@@ -900,7 +900,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi *dsi,
memcpy((u8 *)bounce + msg->tx_len, &crc, sizeof(crc));
len += sizeof(crc);
- regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, len);
+ regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, DIV_ROUND_UP(len, 4));
regmap_write(dsi->regs, SUN6I_DSI_CMD_CTL_REG, len + 4 - 1);
kfree(bounce);
--
2.28.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [linux-sunxi] [PATCH] drm/sun4i: Fix dsi dcs long write function
2020-08-28 11:24 [PATCH] drm/sun4i: Fix dsi dcs long write function Ondrej Jirman
@ 2020-08-28 12:35 ` Jernej Škrabec
2020-08-28 12:51 ` Ondřej Jirman
0 siblings, 1 reply; 3+ messages in thread
From: Jernej Škrabec @ 2020-08-28 12:35 UTC (permalink / raw)
To: linux-sunxi
Cc: Ondrej Jirman, Maxime Ripard, Chen-Yu Tsai, David Airlie,
Daniel Vetter, open list:DRM DRIVERS FOR ALLWINNER A10,
moderated list:ARM/Allwinner sunXi SoC support, open list,
megous
Dne petek, 28. avgust 2020 ob 13:24:44 CEST je Ondrej Jirman napisal(a):
> It's writing too much data. regmap_bulk_write expects number of
> register sized chunks to write, not a byte sized length of the
> bounce buffer. Bounce buffer needs to be padded too, so that
> regmap_bulk_write will not read past the end of the buffer.
>
> Signed-off-by: Ondrej Jirman <megous@megous.com>
Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller
support")
should be added. Fix will be then automatically picked into stable releases.
Small nit below.
> ---
> drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
> b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c index 7f13f4d715bf..840fad1b68dd
> 100644
> --- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
> +++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
> @@ -889,7 +889,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi
> *dsi, regmap_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(0),
> sun6i_dsi_dcs_build_pkt_hdr(dsi, msg));
>
> - bounce = kzalloc(msg->tx_len + sizeof(crc), GFP_KERNEL);
> + bounce = kzalloc(msg->tx_len + sizeof(crc) + 3, GFP_KERNEL);
It would be nicer to use ALIGN() macro, but I'm fine either way.
Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net>
Best regards,
Jernej
> if (!bounce)
> return -ENOMEM;
>
> @@ -900,7 +900,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi
> *dsi, memcpy((u8 *)bounce + msg->tx_len, &crc, sizeof(crc));
> len += sizeof(crc);
>
> - regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce,
len);
> + regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce,
> DIV_ROUND_UP(len, 4)); regmap_write(dsi->regs, SUN6I_DSI_CMD_CTL_REG, len +
> 4 - 1);
> kfree(bounce);
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [linux-sunxi] [PATCH] drm/sun4i: Fix dsi dcs long write function
2020-08-28 12:35 ` [linux-sunxi] " Jernej Škrabec
@ 2020-08-28 12:51 ` Ondřej Jirman
0 siblings, 0 replies; 3+ messages in thread
From: Ondřej Jirman @ 2020-08-28 12:51 UTC (permalink / raw)
To: Jernej Škrabec
Cc: linux-sunxi, Maxime Ripard, Chen-Yu Tsai, David Airlie,
Daniel Vetter, open list:DRM DRIVERS FOR ALLWINNER A10,
moderated list:ARM/Allwinner sunXi SoC support, open list
On Fri, Aug 28, 2020 at 02:35:26PM +0200, Jernej Škrabec wrote:
> Dne petek, 28. avgust 2020 ob 13:24:44 CEST je Ondrej Jirman napisal(a):
> > It's writing too much data. regmap_bulk_write expects number of
> > register sized chunks to write, not a byte sized length of the
> > bounce buffer. Bounce buffer needs to be padded too, so that
> > regmap_bulk_write will not read past the end of the buffer.
> >
> > Signed-off-by: Ondrej Jirman <megous@megous.com>
>
> Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller
> support")
It doesn't really fix anything user visible though, and will not help
the stable branch in any way. It just makes the code more correct.
Though now that you came up with the tag, copypasting it is not that much
work. ;) So I added it.
> should be added. Fix will be then automatically picked into stable releases.
>
> Small nit below.
>
> > ---
> > drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
> > b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c index 7f13f4d715bf..840fad1b68dd
> > 100644
> > --- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
> > +++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
> > @@ -889,7 +889,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi
> > *dsi, regmap_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(0),
> > sun6i_dsi_dcs_build_pkt_hdr(dsi, msg));
> >
> > - bounce = kzalloc(msg->tx_len + sizeof(crc), GFP_KERNEL);
> > + bounce = kzalloc(msg->tx_len + sizeof(crc) + 3, GFP_KERNEL);
>
> It would be nicer to use ALIGN() macro, but I'm fine either way.
Nice idea.
> Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net>
Thanks. :)
regards,
o.
> Best regards,
> Jernej
>
> > if (!bounce)
> > return -ENOMEM;
> >
> > @@ -900,7 +900,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi
> > *dsi, memcpy((u8 *)bounce + msg->tx_len, &crc, sizeof(crc));
> > len += sizeof(crc);
> >
> > - regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce,
> len);
> > + regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce,
> > DIV_ROUND_UP(len, 4)); regmap_write(dsi->regs, SUN6I_DSI_CMD_CTL_REG, len +
> > 4 - 1);
> > kfree(bounce);
>
>
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-08-28 12:51 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-08-28 11:24 [PATCH] drm/sun4i: Fix dsi dcs long write function Ondrej Jirman
2020-08-28 12:35 ` [linux-sunxi] " Jernej Škrabec
2020-08-28 12:51 ` Ondřej Jirman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).