From: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
Make sure the LFP data table pointers sane. Sensible looking
table entries, evetything points correctly into the data block,
etc.
Signed-off-by: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
---
drivers/gpu/drm/i915/display/intel_bios.c | 82 ++++++++++++++++++++++-
1 file changed, 81 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index 777339f5dd79..29953996a474 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -153,6 +153,86 @@ static u32 block_offset(const void *bdb, enum bdb_block_id section_id)
return block - bdb;
}
+/* size of the block excluding the header */
+static u32 block_size(const void *bdb, enum bdb_block_id section_id)
+{
+ const void *block;
+
+ block = find_raw_section(bdb, section_id);
+ if (!block)
+ return 0;
+
+ return get_blocksize(block);
+}
+
+static bool validate_lfp_data_ptrs(const void *bdb,
+ const struct bdb_lvds_lfp_data_ptrs *ptrs)
+{
+ int fp_timing_size, dvo_timing_size, panel_pnp_id_size;
+ int data_block_size, lfp_data_size;
+ int i;
+
+ data_block_size = block_size(bdb, BDB_LVDS_LFP_DATA);
+ if (data_block_size == 0)
+ return false;
+
+ /* always 3 indicating the presence of fp_timing+dvo_timing+panel_pnp_id */
+ if (ptrs->lvds_entries != 3)
+ return false;
+
+ fp_timing_size = ptrs->ptr[0].fp_timing.table_size;
+ dvo_timing_size = ptrs->ptr[0].dvo_timing.table_size;
+ panel_pnp_id_size = ptrs->ptr[0].panel_pnp_id.table_size;
+
+ /* fp_timing has variable size */
+ if (fp_timing_size < 32 ||
+ dvo_timing_size != sizeof(struct lvds_dvo_timing) ||
+ panel_pnp_id_size != sizeof(struct lvds_pnp_id))
+ return false;
+
+ lfp_data_size = ptrs->ptr[1].fp_timing.offset - ptrs->ptr[0].fp_timing.offset;
+ if (16 * lfp_data_size > data_block_size)
+ return false;
+
+ /*
+ * Except for vlv/chv machines all real VBTs seem to have 6
+ * unaccounted bytes in the fp_timing table. And it doesn't
+ * appear to be a really intentional hole as the fp_timing
+ * 0xffff terminator is always within those 6 missing bytes.
+ */
+ if (fp_timing_size + dvo_timing_size + panel_pnp_id_size != lfp_data_size &&
+ fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size != lfp_data_size)
+ return false;
+
+ if (ptrs->ptr[0].fp_timing.offset + fp_timing_size > ptrs->ptr[0].dvo_timing.offset ||
+ ptrs->ptr[0].dvo_timing.offset + dvo_timing_size != ptrs->ptr[0].panel_pnp_id.offset ||
+ ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size != lfp_data_size)
+ return false;
+
+ /* make sure the table entries have uniform size */
+ for (i = 1; i < 16; i++) {
+ if (ptrs->ptr[i].fp_timing.table_size != fp_timing_size ||
+ ptrs->ptr[i].dvo_timing.table_size != dvo_timing_size ||
+ ptrs->ptr[i].panel_pnp_id.table_size != panel_pnp_id_size)
+ return false;
+
+ if (ptrs->ptr[i].fp_timing.offset - ptrs->ptr[i-1].fp_timing.offset != lfp_data_size ||
+ ptrs->ptr[i].dvo_timing.offset - ptrs->ptr[i-1].dvo_timing.offset != lfp_data_size ||
+ ptrs->ptr[i].panel_pnp_id.offset - ptrs->ptr[i-1].panel_pnp_id.offset != lfp_data_size)
+ return false;
+ }
+
+ /* make sure the tables fit inside the data block */
+ for (i = 0; i < 16; i++) {
+ if (ptrs->ptr[i].fp_timing.offset + fp_timing_size > data_block_size ||
+ ptrs->ptr[i].dvo_timing.offset + dvo_timing_size > data_block_size ||
+ ptrs->ptr[i].panel_pnp_id.offset + panel_pnp_id_size > data_block_size)
+ return false;
+ }
+
+ return true;
+}
+
/* make the data table offsets relative to the data block */
static bool fixup_lfp_data_ptrs(const void *bdb, void *ptrs_block)
{
@@ -173,7 +253,7 @@ static bool fixup_lfp_data_ptrs(const void *bdb, void *ptrs_block)
ptrs->ptr[i].panel_pnp_id.offset -= offset;
}
- return true;
+ return validate_lfp_data_ptrs(bdb, ptrs);
}
static const void *
--
2.34.1
