Skip to content

Commit 4d49e77

Browse files
committed
drm/dp_mst: Verify request type in the corresponding down message reply
After receiving the response for an MST down request message, the response should be accepted/parsed only if the response type matches that of the request. Ensure this by checking if the request type code stored both in the request and the reply match, dropping the reply in case of a mismatch. This fixes the topology detection for an MST hub, as described in the Closes link below, where the hub sends an incorrect reply message after a CLEAR_PAYLOAD_TABLE -> LINK_ADDRESS down request message sequence. Cc: Lyude Paul <lyude@redhat.com> Cc: <stable@vger.kernel.org> Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12804 Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241203160223.2926014-3-imre.deak@intel.com
1 parent a6fa67d commit 4d49e77

File tree

1 file changed

+31
-0
lines changed

1 file changed

+31
-0
lines changed

drivers/gpu/drm/display/drm_dp_mst_topology.c

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3941,6 +3941,34 @@ drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up,
39413941
return true;
39423942
}
39433943

3944+
static int get_msg_request_type(u8 data)
3945+
{
3946+
return data & 0x7f;
3947+
}
3948+
3949+
static bool verify_rx_request_type(struct drm_dp_mst_topology_mgr *mgr,
3950+
const struct drm_dp_sideband_msg_tx *txmsg,
3951+
const struct drm_dp_sideband_msg_rx *rxmsg)
3952+
{
3953+
const struct drm_dp_sideband_msg_hdr *hdr = &rxmsg->initial_hdr;
3954+
const struct drm_dp_mst_branch *mstb = txmsg->dst;
3955+
int tx_req_type = get_msg_request_type(txmsg->msg[0]);
3956+
int rx_req_type = get_msg_request_type(rxmsg->msg[0]);
3957+
char rad_str[64];
3958+
3959+
if (tx_req_type == rx_req_type)
3960+
return true;
3961+
3962+
drm_dp_mst_rad_to_str(mstb->rad, mstb->lct, rad_str, sizeof(rad_str));
3963+
drm_dbg_kms(mgr->dev,
3964+
"Got unexpected MST reply, mstb: %p seqno: %d lct: %d rad: %s rx_req_type: %s (%02x) != tx_req_type: %s (%02x)\n",
3965+
mstb, hdr->seqno, mstb->lct, rad_str,
3966+
drm_dp_mst_req_type_str(rx_req_type), rx_req_type,
3967+
drm_dp_mst_req_type_str(tx_req_type), tx_req_type);
3968+
3969+
return false;
3970+
}
3971+
39443972
static int drm_dp_mst_handle_down_rep(struct drm_dp_mst_topology_mgr *mgr)
39453973
{
39463974
struct drm_dp_sideband_msg_tx *txmsg;
@@ -3970,6 +3998,9 @@ static int drm_dp_mst_handle_down_rep(struct drm_dp_mst_topology_mgr *mgr)
39703998
goto out_clear_reply;
39713999
}
39724000

4001+
if (!verify_rx_request_type(mgr, txmsg, msg))
4002+
goto out_clear_reply;
4003+
39734004
drm_dp_sideband_parse_reply(mgr, msg, &txmsg->reply);
39744005

39754006
if (txmsg->reply.reply_type == DP_SIDEBAND_REPLY_NAK) {

0 commit comments

Comments
 (0)