[PATCH RESEND] drm/mediatek: dsi: Fix handling of long packet reads

[PATCH RESEND] drm/mediatek: dsi: Fix handling of long packet reads

[Ben Grisdale via B4 Relay]

From: Ben Grisdale <bengris32@protonmail.ch>

mtk_dsi_host_transfer() decides where the payload starts in the
received data based on the byte count returned by mtk_dsi_recv_cnt(),
treating anything longer than 2 bytes as a long packet.

This breaks long read responses with a 1 or 2 byte payload: they are
treated as short packets, so the word count from the packet header is
copied into rx_buf instead of the payload.

Fix this by checking the packet's data type instead of inferring it
from the length.

Fixes: 21898816831f ("drm/mediatek: add dsi transfer function")
Cc: stable@vger.kernel.org
Signed-off-by: Ben Grisdale <bengris32@protonmail.ch>
---
 drivers/gpu/drm/mediatek/mtk_dsi.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
index f82506e10fd5..de4414b51abb 100644
--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
@@ -165,6 +165,10 @@
 	(type == MIPI_DSI_GENERIC_READ_REQUEST_2_PARAM) || \
 	(type == MIPI_DSI_DCS_READ))
 
+#define MTK_DSI_IS_LONG_RESP(type) \
+	(((type) == MIPI_DSI_RX_GENERIC_LONG_READ_RESPONSE) || \
+	((type) == MIPI_DSI_RX_DCS_LONG_READ_RESPONSE))
+
 struct mtk_phy_timing {
 	u32 lpx;
 	u32 da_hs_prepare;
@@ -1171,7 +1175,7 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host,
 
 	recv_cnt = mtk_dsi_recv_cnt(read_data[0], read_data);
 
-	if (recv_cnt > 2)
+	if (MTK_DSI_IS_LONG_RESP(read_data[0]))
 		src_addr = &read_data[4];
 	else
 		src_addr = &read_data[1];

---
base-commit: 2efb7a11f1aa4d2dc285fe2680cca22cb9f72f64
change-id: 20261019-mtk-dsi-long-read-45bc8e49d08b

Best regards,
--
Ben Grisdale <bengris32@protonmail.ch>
-- 
Ben Grisdale <bengris32@protonmail.ch>

Re: [PATCH RESEND] drm/mediatek: dsi: Fix handling of long packet reads

[CK Hu (胡俊光)]

On Thu, 2026-11-05 at 14:35 +0000, Ben Grisdale via B4 Relay wrote:
> From: Ben Grisdale <bengris32@protonmail.ch>
> 
> mtk_dsi_host_transfer() decides where the payload starts in the
> received data based on the byte count returned by mtk_dsi_recv_cnt(),
> treating anything longer than 2 bytes as a long packet.
> 
> This breaks long read responses with a 1 or 2 byte payload: they are
> treated as short packets, so the word count from the packet header is
> copied into rx_buf instead of the payload.
> 
> Fix this by checking the packet's data type instead of inferring it
> from the length.

Reviewed-by: CK Hu <ck.hu@mediatek.com>

> 
> Fixes: 21898816831f ("drm/mediatek: add dsi transfer function")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ben Grisdale <bengris32@protonmail.ch>
> ---