diff options
-rw-r--r-- | drivers/gpu/drm/i915/gvt/display.h | 2 | ||||
-rw-r--r-- | drivers/gpu/drm/i915/gvt/handlers.c | 13 |
2 files changed, 10 insertions, 5 deletions
diff --git a/drivers/gpu/drm/i915/gvt/display.h b/drivers/gpu/drm/i915/gvt/display.h index b46b86892d58..ea7c1c525b8c 100644 --- a/drivers/gpu/drm/i915/gvt/display.h +++ b/drivers/gpu/drm/i915/gvt/display.h | |||
@@ -67,7 +67,7 @@ | |||
67 | #define AUX_NATIVE_REPLY_NAK (0x1 << 4) | 67 | #define AUX_NATIVE_REPLY_NAK (0x1 << 4) |
68 | #define AUX_NATIVE_REPLY_DEFER (0x2 << 4) | 68 | #define AUX_NATIVE_REPLY_DEFER (0x2 << 4) |
69 | 69 | ||
70 | #define AUX_BURST_SIZE 16 | 70 | #define AUX_BURST_SIZE 20 |
71 | 71 | ||
72 | /* DPCD addresses */ | 72 | /* DPCD addresses */ |
73 | #define DPCD_REV 0x000 | 73 | #define DPCD_REV 0x000 |
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c index 9be639aa3b55..dea751e76196 100644 --- a/drivers/gpu/drm/i915/gvt/handlers.c +++ b/drivers/gpu/drm/i915/gvt/handlers.c | |||
@@ -898,11 +898,14 @@ static int dp_aux_ch_ctl_mmio_write(struct intel_vgpu *vgpu, | |||
898 | } | 898 | } |
899 | 899 | ||
900 | /* | 900 | /* |
901 | * Write request format: (command + address) occupies | 901 | * Write request format: Headr (command + address + size) occupies |
902 | * 3 bytes, followed by (len + 1) bytes of data. | 902 | * 4 bytes, followed by (len + 1) bytes of data. See details at |
903 | * intel_dp_aux_transfer(). | ||
903 | */ | 904 | */ |
904 | if (WARN_ON((len + 4) > AUX_BURST_SIZE)) | 905 | if ((len + 1 + 4) > AUX_BURST_SIZE) { |
906 | gvt_vgpu_err("dp_aux_header: len %d is too large\n", len); | ||
905 | return -EINVAL; | 907 | return -EINVAL; |
908 | } | ||
906 | 909 | ||
907 | /* unpack data from vreg to buf */ | 910 | /* unpack data from vreg to buf */ |
908 | for (t = 0; t < 4; t++) { | 911 | for (t = 0; t < 4; t++) { |
@@ -966,8 +969,10 @@ static int dp_aux_ch_ctl_mmio_write(struct intel_vgpu *vgpu, | |||
966 | /* | 969 | /* |
967 | * Read reply format: ACK (1 byte) plus (len + 1) bytes of data. | 970 | * Read reply format: ACK (1 byte) plus (len + 1) bytes of data. |
968 | */ | 971 | */ |
969 | if (WARN_ON((len + 2) > AUX_BURST_SIZE)) | 972 | if ((len + 2) > AUX_BURST_SIZE) { |
973 | gvt_vgpu_err("dp_aux_header: len %d is too large\n", len); | ||
970 | return -EINVAL; | 974 | return -EINVAL; |
975 | } | ||
971 | 976 | ||
972 | /* read from virtual DPCD to vreg */ | 977 | /* read from virtual DPCD to vreg */ |
973 | /* first 4 bytes: [ACK][addr][addr+1][addr+2] */ | 978 | /* first 4 bytes: [ACK][addr][addr+1][addr+2] */ |