Commit bacda5a9 authored by Jani Nikula's avatar Jani Nikula Committed by Luis Henriques

drm/i915/bios: handle MIPI Sequence Block v3+ gracefully

commit cd67d226 upstream.

The VBT MIPI Sequence Block version 3 has forward incompatible changes:

First, the block size in the header has been specified reserved, and the
actual size is a separate 32-bit value within the block. The current
find_section() function to will only look at the size in the block
header, and, depending on what's in that now reserved size field,
continue looking for other sections in the wrong place.

Fix this by taking the new block size field into account. This will
ensure that the lookups for other sections will work properly, as long
as the new 32-bit size does not go beyond the opregion VBT mailbox size.

Second, the contents of the block have been completely
changed. Gracefully refuse parsing the yet unknown data version.

Cc: Deepak M <m.deepak@intel.com>
Reviewed-by: default avatarDeepak M <m.deepak@intel.com>
Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent 7d70db1c
...@@ -41,7 +41,7 @@ find_section(struct bdb_header *bdb, int section_id) ...@@ -41,7 +41,7 @@ find_section(struct bdb_header *bdb, int section_id)
{ {
u8 *base = (u8 *)bdb; u8 *base = (u8 *)bdb;
int index = 0; int index = 0;
u16 total, current_size; u32 total, current_size;
u8 current_id; u8 current_id;
/* skip to first section */ /* skip to first section */
...@@ -56,6 +56,10 @@ find_section(struct bdb_header *bdb, int section_id) ...@@ -56,6 +56,10 @@ find_section(struct bdb_header *bdb, int section_id)
current_size = *((u16 *)(base + index)); current_size = *((u16 *)(base + index));
index += 2; index += 2;
/* The MIPI Sequence Block v3+ has a separate size field. */
if (current_id == BDB_MIPI_SEQUENCE && *(base + index) >= 3)
current_size = *((const u32 *)(base + index + 1));
if (index + current_size > total) if (index + current_size > total)
return NULL; return NULL;
...@@ -793,6 +797,12 @@ parse_mipi(struct drm_i915_private *dev_priv, struct bdb_header *bdb) ...@@ -793,6 +797,12 @@ parse_mipi(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
return; return;
} }
/* Fail gracefully for forward incompatible sequence block. */
if (sequence->version >= 3) {
DRM_ERROR("Unable to parse MIPI Sequence Block v3+\n");
return;
}
DRM_DEBUG_DRIVER("Found MIPI sequence block\n"); DRM_DEBUG_DRIVER("Found MIPI sequence block\n");
block_size = get_blocksize(sequence); block_size = get_blocksize(sequence);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment