queue-4.14/drm-rockchip-fix-for-mailbox-read-size.patch

   1 From 04ca94d0e54e79d87b11480e7353661f9ed9a493 Mon Sep 17 00:00:00 2001
   2 From: Damian Kos <dkos@cadence.com>
   3 Date: Tue, 6 Nov 2018 15:37:05 +0000
   4 Subject: drm/rockchip: fix for mailbox read size
   5
   6 [ Upstream commit fa68d4f8476bea4cdf441062b614b41bb85ef1da ]
   7
   8 Some of the functions (like cdn_dp_dpcd_read, cdn_dp_get_edid_block)
   9 allow to read 64KiB, but the cdn_dp_mailbox_read_receive, that is
  10 used by them, can read only up to 255 bytes at once. Normally, it's
  11 not a big issue as DPCD or EDID reads won't (hopefully) exceed that
  12 value.
  13 The real issue here is the revocation list read during the HDCP
  14 authentication process. (problematic use case:
  15 https://chromium.googlesource.com/chromiumos/third_party/kernel/+/chromeos-4.4/drivers/gpu/drm/rockchip/cdn-dp-reg.c#1152)
  16 The list can reach 127*5+4 bytes (num devs * 5 bytes per ID/Bksv +
  17 4 bytes of an additional info).
  18 In other words - CTSes with HDCP Repeater won't pass without this
  19 fix. Oh, and the driver will most likely stop working (best case
  20 scenario).
  21
  22 Signed-off-by: Damian Kos <dkos@cadence.com>
  23 Signed-off-by: Heiko Stuebner <heiko@sntech.de>
  24 Link: https://patchwork.freedesktop.org/patch/msgid/1541518625-25984-1-git-send-email-dkos@cadence.com
  25 Signed-off-by: Sasha Levin <sashal@kernel.org>
  26 ---
  27  drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 +-
  28  1 file changed, 1 insertion(+), 1 deletion(-)
  29
  30 diff --git a/drivers/gpu/drm/rockchip/cdn-dp-reg.c b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
  31 index b14d211f6c21..0ed7e91471f6 100644
  32 --- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c
  33 +++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
  34 @@ -147,7 +147,7 @@ static int cdn_dp_mailbox_validate_receive(struct cdn_dp_device *dp,
  35  }
  36
  37  static int cdn_dp_mailbox_read_receive(struct cdn_dp_device *dp,
  38 -                                      u8 *buff, u8 buff_size)
  39 +                                      u8 *buff, u16 buff_size)
  40  {
  41         u32 i;
  42         int ret;
  43 --
  44 2.19.1
  45