drm/i915/bios: Validate fp_timing terminator presence

Validate the LFP data block a bit hardwer by making sure the
fp_timing terminators (0xffff) are where we expect them to be.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220818192223.29881-2-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>

diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index 9c8eeca..a2900bd 100644 (file)
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -135,18 +135,6 @@ static u32 raw_block_offset(const void *bdb, enum bdb_block_id section_id)
        return block - bdb;
 }
 
-/* size of the block excluding the header */
-static u32 raw_block_size(const void *bdb, enum bdb_block_id section_id)
-{
-       const void *block;
-
-       block = find_raw_section(bdb, section_id);
-       if (!block)
-               return 0;
-
-       return get_blocksize(block);
-}
-
 struct bdb_block_entry {
        struct list_head node;
        enum bdb_block_id section_id;
@@ -231,9 +219,14 @@ static bool validate_lfp_data_ptrs(const void *bdb,
 {
        int fp_timing_size, dvo_timing_size, panel_pnp_id_size, panel_name_size;
        int data_block_size, lfp_data_size;
+       const void *data_block;
        int i;
 
-       data_block_size = raw_block_size(bdb, BDB_LVDS_LFP_DATA);
+       data_block = find_raw_section(bdb, BDB_LVDS_LFP_DATA);
+       if (!data_block)
+               return false;
+
+       data_block_size = get_blocksize(data_block);
        if (data_block_size == 0)
                return false;
 
@@ -261,21 +254,6 @@ static bool validate_lfp_data_ptrs(const void *bdb,
        if (16 * lfp_data_size > data_block_size)
                return false;
 
-       /*
-        * Except for vlv/chv machines all real VBTs seem to have 6
-        * unaccounted bytes in the fp_timing table. And it doesn't
-        * appear to be a really intentional hole as the fp_timing
-        * 0xffff terminator is always within those 6 missing bytes.
-        */
-       if (fp_timing_size + dvo_timing_size + panel_pnp_id_size != lfp_data_size &&
-           fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size != lfp_data_size)
-               return false;
-
-       if (ptrs->ptr[0].fp_timing.offset + fp_timing_size > ptrs->ptr[0].dvo_timing.offset ||
-           ptrs->ptr[0].dvo_timing.offset + dvo_timing_size != ptrs->ptr[0].panel_pnp_id.offset ||
-           ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size != lfp_data_size)
-               return false;
-
        /* make sure the table entries have uniform size */
        for (i = 1; i < 16; i++) {
                if (ptrs->ptr[i].fp_timing.table_size != fp_timing_size ||
@@ -289,6 +267,23 @@ static bool validate_lfp_data_ptrs(const void *bdb,
                        return false;
        }
 
+       /*
+        * Except for vlv/chv machines all real VBTs seem to have 6
+        * unaccounted bytes in the fp_timing table. And it doesn't
+        * appear to be a really intentional hole as the fp_timing
+        * 0xffff terminator is always within those 6 missing bytes.
+        */
+       if (fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size == lfp_data_size)
+               fp_timing_size += 6;
+
+       if (fp_timing_size + dvo_timing_size + panel_pnp_id_size != lfp_data_size)
+               return false;
+
+       if (ptrs->ptr[0].fp_timing.offset + fp_timing_size != ptrs->ptr[0].dvo_timing.offset ||
+           ptrs->ptr[0].dvo_timing.offset + dvo_timing_size != ptrs->ptr[0].panel_pnp_id.offset ||
+           ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size != lfp_data_size)
+               return false;
+
        /* make sure the tables fit inside the data block */
        for (i = 0; i < 16; i++) {
                if (ptrs->ptr[i].fp_timing.offset + fp_timing_size > data_block_size ||
@@ -300,6 +295,15 @@ static bool validate_lfp_data_ptrs(const void *bdb,
        if (ptrs->panel_name.offset + 16 * panel_name_size > data_block_size)
                return false;
 
+       /* make sure fp_timing terminators are present at expected locations */
+       for (i = 0; i < 16; i++) {
+               const u16 *t = data_block + ptrs->ptr[i].fp_timing.offset +
+                       fp_timing_size - 2;
+
+               if (*t != 0xffff)
+                       return false;
+       }
+
        return true;
 }