| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20200421161610.1501827-9-adrian.ratiu@collabora.com>
Date: Tue, 21 Apr 2020 19:16:10 +0300
From: Adrian Ratiu <adrian.ratiu@...labora.com>
To: linux-arm-kernel@...ts.infradead.org, devicetree@...r.kernel.org,
linux-rockchip@...ts.infradead.org
Cc: Jernej Skrabec <jernej.skrabec@...l.net>,
Heiko Stuebner <heiko@...ech.de>,
Jonas Karlman <jonas@...boo.se>, linux-kernel@...r.kernel.org,
dri-devel@...ts.freedesktop.org,
Andrzej Hajda <a.hajda@...sung.com>,
Laurent Pinchart <Laurent.pinchart@...asonboard.com>,
kernel@...labora.com, linux-stm32@...md-mailman.stormreply.com,
linux-imx@....com, Adrian Pop <pop.adrian61@...il.com>,
Arnaud Ferraris <arnaud.ferraris@...labora.com>
Subject: [PATCH v7 8/8] drm: bridge: dw-mipi-dsi: fix bad register field offsets
According to the DSI Host Registers sections available in the IMX,
STM and RK ref manuals for 1.01, 1.30 and 1.31, the register fields
are smaller or bigger than what's coded in the driver, leading to
r/w in reserved spaces which might cause undefined behaviours.
Tested-by: Adrian Pop <pop.adrian61@...il.com>
Tested-by: Arnaud Ferraris <arnaud.ferraris@...labora.com>
Signed-off-by: Adrian Ratiu <adrian.ratiu@...labora.com>
---
New in v6.
---
drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 46 +++++++++----------
1 file changed, 23 insertions(+), 23 deletions(-)
diff --git a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
index b45a6d19addcc..b6fef4062a0a8 100644
--- a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
@@ -316,7 +316,7 @@ struct dw_mipi_dsi_variant {
static const struct dw_mipi_dsi_variant dw_mipi_dsi_v130_v131_layout = {
.cfg_dpi_color_coding = REG_FIELD(DSI_DPI_COLOR_CODING, 0, 3),
.cfg_dpi_18loosely_en = REG_FIELD(DSI_DPI_COLOR_CODING, 8, 8),
- .cfg_dpi_vid = REG_FIELD(DSI_DPI_VCID, 0, 2),
+ .cfg_dpi_vid = REG_FIELD(DSI_DPI_VCID, 0, 1),
.cfg_dpi_vsync_active_low = REG_FIELD(DSI_DPI_CFG_POL, 1, 1),
.cfg_dpi_hsync_active_low = REG_FIELD(DSI_DPI_CFG_POL, 2, 2),
.cfg_cmd_mode_ack_rqst_en = REG_FIELD(DSI_CMD_MODE_CFG, 1, 1),
@@ -325,29 +325,29 @@ static const struct dw_mipi_dsi_variant dw_mipi_dsi_v130_v131_layout = {
.cfg_cmd_mode_dcs_sw_sr_en = REG_FIELD(DSI_CMD_MODE_CFG, 16, 18),
.cfg_cmd_mode_dcs_lw_en = REG_FIELD(DSI_CMD_MODE_CFG, 19, 19),
.cfg_cmd_mode_max_rd_pkt_size = REG_FIELD(DSI_CMD_MODE_CFG, 24, 24),
- .cfg_cmd_mode_en = REG_FIELD(DSI_MODE_CFG, 0, 31),
- .cfg_cmd_pkt_status = REG_FIELD(DSI_CMD_PKT_STATUS, 0, 31),
- .cfg_vid_mode_en = REG_FIELD(DSI_MODE_CFG, 0, 31),
+ .cfg_cmd_mode_en = REG_FIELD(DSI_MODE_CFG, 0, 0),
+ .cfg_cmd_pkt_status = REG_FIELD(DSI_CMD_PKT_STATUS, 0, 6),
+ .cfg_vid_mode_en = REG_FIELD(DSI_MODE_CFG, 0, 0),
.cfg_vid_mode_type = REG_FIELD(DSI_VID_MODE_CFG, 0, 1),
.cfg_vid_mode_low_power = REG_FIELD(DSI_VID_MODE_CFG, 8, 13),
.cfg_vid_mode_vpg_en = REG_FIELD(DSI_VID_MODE_CFG, 16, 16),
.cfg_vid_mode_vpg_horiz = REG_FIELD(DSI_VID_MODE_CFG, 24, 24),
- .cfg_vid_pkt_size = REG_FIELD(DSI_VID_PKT_SIZE, 0, 10),
- .cfg_vid_hsa_time = REG_FIELD(DSI_VID_HSA_TIME, 0, 31),
- .cfg_vid_hbp_time = REG_FIELD(DSI_VID_HBP_TIME, 0, 31),
- .cfg_vid_hline_time = REG_FIELD(DSI_VID_HLINE_TIME, 0, 31),
- .cfg_vid_vsa_time = REG_FIELD(DSI_VID_VSA_LINES, 0, 31),
- .cfg_vid_vbp_time = REG_FIELD(DSI_VID_VBP_LINES, 0, 31),
- .cfg_vid_vfp_time = REG_FIELD(DSI_VID_VFP_LINES, 0, 31),
- .cfg_vid_vactive_time = REG_FIELD(DSI_VID_VACTIVE_LINES, 0, 31),
+ .cfg_vid_pkt_size = REG_FIELD(DSI_VID_PKT_SIZE, 0, 13),
+ .cfg_vid_hsa_time = REG_FIELD(DSI_VID_HSA_TIME, 0, 11),
+ .cfg_vid_hbp_time = REG_FIELD(DSI_VID_HBP_TIME, 0, 11),
+ .cfg_vid_hline_time = REG_FIELD(DSI_VID_HLINE_TIME, 0, 14),
+ .cfg_vid_vsa_time = REG_FIELD(DSI_VID_VSA_LINES, 0, 9),
+ .cfg_vid_vbp_time = REG_FIELD(DSI_VID_VBP_LINES, 0, 9),
+ .cfg_vid_vfp_time = REG_FIELD(DSI_VID_VFP_LINES, 0, 9),
+ .cfg_vid_vactive_time = REG_FIELD(DSI_VID_VACTIVE_LINES, 0, 13),
.cfg_phy_txrequestclkhs = REG_FIELD(DSI_LPCLK_CTRL, 0, 0),
- .cfg_phy_bta_time = REG_FIELD(DSI_BTA_TO_CNT, 0, 31),
- .cfg_phy_max_rd_time = REG_FIELD(DSI_PHY_TMR_CFG, 0, 15),
+ .cfg_phy_bta_time = REG_FIELD(DSI_BTA_TO_CNT, 0, 15),
+ .cfg_phy_max_rd_time = REG_FIELD(DSI_PHY_TMR_CFG, 0, 14),
.cfg_phy_lp2hs_time = REG_FIELD(DSI_PHY_TMR_CFG, 16, 23),
.cfg_phy_hs2lp_time = REG_FIELD(DSI_PHY_TMR_CFG, 24, 31),
- .cfg_phy_max_rd_time_v131 = REG_FIELD(DSI_PHY_TMR_RD_CFG, 0, 15),
- .cfg_phy_lp2hs_time_v131 = REG_FIELD(DSI_PHY_TMR_CFG, 0, 15),
- .cfg_phy_hs2lp_time_v131 = REG_FIELD(DSI_PHY_TMR_CFG, 16, 31),
+ .cfg_phy_max_rd_time_v131 = REG_FIELD(DSI_PHY_TMR_RD_CFG, 0, 14),
+ .cfg_phy_lp2hs_time_v131 = REG_FIELD(DSI_PHY_TMR_CFG, 0, 9),
+ .cfg_phy_hs2lp_time_v131 = REG_FIELD(DSI_PHY_TMR_CFG, 16, 25),
.cfg_phy_clklp2hs_time = REG_FIELD(DSI_PHY_TMR_LPCLK_CFG, 0, 15),
.cfg_phy_clkhs2lp_time = REG_FIELD(DSI_PHY_TMR_LPCLK_CFG, 16, 31),
.cfg_phy_testclr = REG_FIELD(DSI_PHY_TST_CTRL0, 0, 0),
@@ -361,11 +361,11 @@ static const struct dw_mipi_dsi_variant dw_mipi_dsi_v130_v131_layout = {
.cfg_pckhdl_cfg = REG_FIELD(DSI_PCKHDL_CFG, 0, 4),
.cfg_hstx_timeout_counter = REG_FIELD(DSI_TO_CNT_CFG, 16, 31),
.cfg_lprx_timeout_counter = REG_FIELD(DSI_TO_CNT_CFG, 0, 15),
- .cfg_int_stat0 = REG_FIELD(DSI_INT_ST0, 0, 31),
- .cfg_int_stat1 = REG_FIELD(DSI_INT_ST1, 0, 31),
- .cfg_int_mask0 = REG_FIELD(DSI_INT_MSK0, 0, 31),
- .cfg_int_mask1 = REG_FIELD(DSI_INT_MSK1, 0, 31),
- .cfg_gen_hdr = REG_FIELD(DSI_GEN_HDR, 0, 31),
+ .cfg_int_stat0 = REG_FIELD(DSI_INT_ST0, 0, 20),
+ .cfg_int_stat1 = REG_FIELD(DSI_INT_ST1, 0, 12),
+ .cfg_int_mask0 = REG_FIELD(DSI_INT_MSK0, 0, 20),
+ .cfg_int_mask1 = REG_FIELD(DSI_INT_MSK1, 0, 12),
+ .cfg_gen_hdr = REG_FIELD(DSI_GEN_HDR, 0, 23),
.cfg_gen_payload = REG_FIELD(DSI_GEN_PLD_DATA, 0, 31),
};
@@ -382,7 +382,7 @@ static const struct dw_mipi_dsi_variant dw_mipi_dsi_v101_layout = {
.cfg_cmd_mode_gen_lw_en = REG_FIELD(DSI_CMD_MODE_CFG, 11, 11),
.cfg_cmd_mode_dcs_lw_en = REG_FIELD(DSI_CMD_MODE_CFG, 12, 12),
.cfg_cmd_mode_ack_rqst_en = REG_FIELD(DSI_CMD_MODE_CFG_V101, 13, 13),
- .cfg_cmd_pkt_status = REG_FIELD(DSI_CMD_PKT_STATUS_V101, 0, 14),
+ .cfg_cmd_pkt_status = REG_FIELD(DSI_CMD_PKT_STATUS_V101, 0, 6),
.cfg_vid_mode_en = REG_FIELD(DSI_VID_MODE_CFG_V101, 0, 0),
.cfg_vid_mode_type = REG_FIELD(DSI_VID_MODE_CFG_V101, 1, 2),
.cfg_vid_mode_low_power = REG_FIELD(DSI_VID_MODE_CFG_V101, 3, 8),
--
2.26.0
Powered by blists - more mailing lists