lkml.org 
[lkml]   [2019]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 027/205] drm/rockchip: fix for mailbox read size
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit fa68d4f8476bea4cdf441062b614b41bb85ef1da ]

    Some of the functions (like cdn_dp_dpcd_read, cdn_dp_get_edid_block)
    allow to read 64KiB, but the cdn_dp_mailbox_read_receive, that is
    used by them, can read only up to 255 bytes at once. Normally, it's
    not a big issue as DPCD or EDID reads won't (hopefully) exceed that
    value.
    The real issue here is the revocation list read during the HDCP
    authentication process. (problematic use case:
    https://chromium.googlesource.com/chromiumos/third_party/kernel/+/chromeos-4.4/drivers/gpu/drm/rockchip/cdn-dp-reg.c#1152)
    The list can reach 127*5+4 bytes (num devs * 5 bytes per ID/Bksv +
    4 bytes of an additional info).
    In other words - CTSes with HDCP Repeater won't pass without this
    fix. Oh, and the driver will most likely stop working (best case
    scenario).

    Signed-off-by: Damian Kos <dkos@cadence.com>
    Signed-off-by: Heiko Stuebner <heiko@sntech.de>
    Link: https://patchwork.freedesktop.org/patch/msgid/1541518625-25984-1-git-send-email-dkos@cadence.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/gpu/drm/rockchip/cdn-dp-reg.c b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
    index b14d211f6c21..0ed7e91471f6 100644
    --- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c
    +++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
    @@ -147,7 +147,7 @@ static int cdn_dp_mailbox_validate_receive(struct cdn_dp_device *dp,
    }

    static int cdn_dp_mailbox_read_receive(struct cdn_dp_device *dp,
    - u8 *buff, u8 buff_size)
    + u8 *buff, u16 buff_size)
    {
    u32 i;
    int ret;
    --
    2.19.1


    \
     
     \ /
      Last update: 2019-02-11 16:33    [W:5.000 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site