Back merge 'drm-intel-fixes' into gvt-fixes

[linux-2.6-block.git] / drivers / gpu / drm / i915 / gvt / handlers.c

diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 8c5d5d005854217057e9bc347db5ce074cc46adb..ef5c1fdde5118c5d4be0f52d07d3338b3659622b 100644 (file)
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -900,11 +900,14 @@ static int dp_aux_ch_ctl_mmio_write(struct intel_vgpu *vgpu,
                }
 
                /*
-                * Write request format: (command + address) occupies
-                * 3 bytes, followed by (len + 1) bytes of data.
+                * Write request format: Headr (command + address + size) occupies
+                * 4 bytes, followed by (len + 1) bytes of data. See details at
+                * intel_dp_aux_transfer().
                 */
-               if (WARN_ON((len + 4) > AUX_BURST_SIZE))
+               if ((len + 1 + 4) > AUX_BURST_SIZE) {
+                       gvt_vgpu_err("dp_aux_header: len %d is too large\n", len);
                        return -EINVAL;
+               }
 
                /* unpack data from vreg to buf */
                for (t = 0; t < 4; t++) {
@@ -968,8 +971,10 @@ static int dp_aux_ch_ctl_mmio_write(struct intel_vgpu *vgpu,
                /*
                 * Read reply format: ACK (1 byte) plus (len + 1) bytes of data.
                 */
-               if (WARN_ON((len + 2) > AUX_BURST_SIZE))
+               if ((len + 2) > AUX_BURST_SIZE) {
+                       gvt_vgpu_err("dp_aux_header: len %d is too large\n", len);
                        return -EINVAL;
+               }
 
                /* read from virtual DPCD to vreg */
                /* first 4 bytes: [ACK][addr][addr+1][addr+2] */