Commit 4e78d602 authored by Ville Syrjälä's avatar Ville Syrjälä
Browse files

drm/i915/bios: Validate fp_timing terminator presence 



Validate the LFP data block a bit hardwer by making sure the
fp_timing terminators (0xffff) are where we expect them to be.

Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220818192223.29881-2-ville.syrjala@linux.intel.com


Reviewed-by: default avatarJani Nikula <jani.nikula@intel.com>
parent 9aa32034

drivers/gpu/drm/i915/display/intel_bios.c

+32 −28
Original line number Diff line number Diff line
@@ -135,18 +135,6 @@ static u32 raw_block_offset(const void *bdb, enum bdb_block_id section_id) 
	return block - bdb;

}



/* size of the block excluding the header */

static u32 raw_block_size(const void *bdb, enum bdb_block_id section_id)

{

	const void *block;



	block = find_raw_section(bdb, section_id);

	if (!block)

		return 0;



	return get_blocksize(block);

}



struct bdb_block_entry {

	struct list_head node;

	enum bdb_block_id section_id;
@@ -231,9 +219,14 @@ static bool validate_lfp_data_ptrs(const void *bdb, 
{

	int fp_timing_size, dvo_timing_size, panel_pnp_id_size, panel_name_size;

	int data_block_size, lfp_data_size;

	const void *data_block;

	int i;



	data_block_size = raw_block_size(bdb, BDB_LVDS_LFP_DATA);

	data_block = find_raw_section(bdb, BDB_LVDS_LFP_DATA);

	if (!data_block)

		return false;



	data_block_size = get_blocksize(data_block);

	if (data_block_size == 0)

		return false;
@@ -261,21 +254,6 @@ static bool validate_lfp_data_ptrs(const void *bdb, 
	if (16 * lfp_data_size > data_block_size)

		return false;



	/*

	 * Except for vlv/chv machines all real VBTs seem to have 6

	 * unaccounted bytes in the fp_timing table. And it doesn't

	 * appear to be a really intentional hole as the fp_timing

	 * 0xffff terminator is always within those 6 missing bytes.

	 */

	if (fp_timing_size + dvo_timing_size + panel_pnp_id_size != lfp_data_size &&

	    fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size != lfp_data_size)

		return false;



	if (ptrs->ptr[0].fp_timing.offset + fp_timing_size > ptrs->ptr[0].dvo_timing.offset ||

	    ptrs->ptr[0].dvo_timing.offset + dvo_timing_size != ptrs->ptr[0].panel_pnp_id.offset ||

	    ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size != lfp_data_size)

		return false;



	/* make sure the table entries have uniform size */

	for (i = 1; i < 16; i++) {

		if (ptrs->ptr[i].fp_timing.table_size != fp_timing_size ||
@@ -289,6 +267,23 @@ static bool validate_lfp_data_ptrs(const void *bdb, 
			return false;

	}



	/*

	 * Except for vlv/chv machines all real VBTs seem to have 6

	 * unaccounted bytes in the fp_timing table. And it doesn't

	 * appear to be a really intentional hole as the fp_timing

	 * 0xffff terminator is always within those 6 missing bytes.

	 */

	if (fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size == lfp_data_size)

		fp_timing_size += 6;



	if (fp_timing_size + dvo_timing_size + panel_pnp_id_size != lfp_data_size)

		return false;



	if (ptrs->ptr[0].fp_timing.offset + fp_timing_size != ptrs->ptr[0].dvo_timing.offset ||

	    ptrs->ptr[0].dvo_timing.offset + dvo_timing_size != ptrs->ptr[0].panel_pnp_id.offset ||

	    ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size != lfp_data_size)

		return false;



	/* make sure the tables fit inside the data block */

	for (i = 0; i < 16; i++) {

		if (ptrs->ptr[i].fp_timing.offset + fp_timing_size > data_block_size ||
@@ -300,6 +295,15 @@ static bool validate_lfp_data_ptrs(const void *bdb, 
	if (ptrs->panel_name.offset + 16 * panel_name_size > data_block_size)

		return false;



	/* make sure fp_timing terminators are present at expected locations */

	for (i = 0; i < 16; i++) {

		const u16 *t = data_block + ptrs->ptr[i].fp_timing.offset +

			fp_timing_size - 2;



		if (*t != 0xffff)

			return false;

	}



	return true;

}