linux.git/drivers/gpu/drm/amd/display/dc/bios, branch master Linux kernel source tree drm/amd/display: Validate GPIO pin LUT table size before iterating 2026-05-19T16:13:29+00:00 Harry Wentland harry.wentland@amd.com 2026-05-04T20:14:11+00:00 86d2b20644b11d21fe52c596e6e922b4590a3e3f [Why&How] The GPIO pin table parsers in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() derive an element count from the VBIOS table_header.structuresize field, then iterate over gpio_pin[] entries. However, GET_IMAGE() only validates that the table header itself fits within the BIOS image. If the VBIOS reports a structuresize larger than the actual mapped data, the loop reads past the end of the BIOS image, causing an out-of-bounds read. Fix this by calling bios_get_image() to validate that the full claimed structuresize is accessible within the BIOS image before entering the loop in both functions. Assisted-by: GitHub Copilot:claude-opus-4-6 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ba5e95b43b773ae1bf1f66ee6b31eb774e65afe3) Cc: stable@vger.kernel.org 
[Why&How]
The GPIO pin table parsers in get_gpio_i2c_info() and
bios_parser_get_gpio_pin_info() derive an element count from the VBIOS
table_header.structuresize field, then iterate over gpio_pin[] entries.
However, GET_IMAGE() only validates that the table header itself fits
within the BIOS image. If the VBIOS reports a structuresize larger than
the actual mapped data, the loop reads past the end of the BIOS image,
causing an out-of-bounds read.

Fix this by calling bios_get_image() to validate that the full claimed
structuresize is accessible within the BIOS image before entering the
loop in both functions.

Assisted-by: GitHub Copilot:claude-opus-4-6
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit ba5e95b43b773ae1bf1f66ee6b31eb774e65afe3)
Cc: stable@vger.kernel.org
drm/amd/display: Fix integer overflow in bios_get_image() 2026-05-19T16:13:07+00:00 Harry Wentland harry.wentland@amd.com 2026-05-04T15:14:45+00:00 cd86529ec61474a38c3837fb7823790a7c3f8cce [Why&How] The bounds check in bios_get_image() computes 'offset + size' using unsigned 32-bit arithmetic before comparing against bios_size. If a VBIOS image contains a near-UINT32_MAX offset the addition wraps to a small value, the comparison passes, and the function returns a wild pointer past the VBIOS mapping. Additionally, the comparison uses '<' (strict), which incorrectly rejects the valid exact-fit case where offset + size == bios_size. Fix both issues by restructuring the check to avoid the addition entirely: first reject if offset alone exceeds bios_size, then check size against the remaining space (bios_size - offset). This eliminates the overflow and correctly permits exact-fit accesses. Assisted-by: GitHub Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d40fb392af659c4a02b560319f226842f6ec1a95) Cc: stable@vger.kernel.org 
[Why&How]
The bounds check in bios_get_image() computes 'offset + size' using
unsigned 32-bit arithmetic before comparing against bios_size. If a
VBIOS image contains a near-UINT32_MAX offset the addition wraps to a
small value, the comparison passes, and the function returns a wild
pointer past the VBIOS mapping.

Additionally, the comparison uses '<' (strict), which incorrectly
rejects the valid exact-fit case where offset + size == bios_size.

Fix both issues by restructuring the check to avoid the addition
entirely: first reject if offset alone exceeds bios_size, then check
size against the remaining space (bios_size - offset). This eliminates
the overflow and correctly permits exact-fit accesses.

Assisted-by: GitHub Copilot:claude-opus-4.6
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit d40fb392af659c4a02b560319f226842f6ec1a95)
Cc: stable@vger.kernel.org
drm/amd/display: Read EDID from VBIOS embedded panel info 2026-04-29T14:41:40+00:00 Timur Kristóf timur.kristof@gmail.com 2026-04-28T11:40:44+00:00 9ea16f64189bf7b6ba50fc7f0325b3c1f836d105 Some board manufacturers hardcode the EDID for the embedded panel in the VBIOS. This EDID should be used when the panel doesn't have a DDC. For reference, see the legacy non-DC display code: amdgpu_atombios_encoder_get_lcd_info() This is necessary to support embedded connectors without DDC. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit eb105e63b474c11ef6a84a1c6b18100d851ff364) 
Some board manufacturers hardcode the EDID for the embedded
panel in the VBIOS. This EDID should be used when the panel
doesn't have a DDC.

For reference, see the legacy non-DC display code:
amdgpu_atombios_encoder_get_lcd_info()

This is necessary to support embedded connectors without DDC.

Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)")
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit eb105e63b474c11ef6a84a1c6b18100d851ff364)
drm/amd/display: Restore analog connector support 2026-04-24T15:08:15+00:00 Roman Li Roman.Li@amd.com 2026-04-15T21:45:10+00:00 4867cef03b58ca53651593842efcfd0587a707f2 [Why] The analog connector support was accidentally removed, causing a crash when connecting an analog monitor. [How] This patch restores the functions and pointers required for proper analog and DP bridge encoder support on legacy GPUs. V2: Restore the external encoder control functions. V3: - Restore BIOS parser external encoder DAC load detection - Restore stream initialization and source selection changes Fixes: e56e3cff2a1b ("drm/amd/display: Sync dcn42 with DC 3.2.373") Cc: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Roman Li <Roman.Li@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Tested-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit cea8349e4494d2892ea57eef3fe4a8987464a876) 
[Why]
The analog connector support was accidentally removed,
causing a crash when connecting an analog monitor.

[How]
This patch restores the functions and pointers required for proper analog
and DP bridge encoder support on legacy GPUs.

V2: Restore the external encoder control functions.

V3:
 - Restore BIOS parser external encoder DAC load detection
 - Restore stream initialization and source selection changes

Fixes: e56e3cff2a1b ("drm/amd/display: Sync dcn42 with DC 3.2.373")
Cc: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Roman Li <Roman.Li@amd.com>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Tested-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit cea8349e4494d2892ea57eef3fe4a8987464a876)
drm/amd/display: Fixed Silence complier warnings in dc 2026-03-30T19:12:15+00:00 Gaghik Khachatrian gaghik.khachatrian@amd.com 2026-03-09T21:18:25+00:00 f82480fafedf622541276d48a3b4fed20ce5d866 [Why] Resolve compiler warnings by marking unused parameters explicitly. [How] In .c and .h function definitions, keep parameter names in signatures and add a line with `(void)param;` in function body Preserved function signatures and avoids breaking code paths that may reference the parameter under conditional compilation. Reviewed-by: Dillon Varone <dillon.varone@amd.com> Reviewed-by: Austin Zheng <austin.zheng@amd.com> Signed-off-by: Gaghik Khachatrian <gaghik.khachatrian@amd.com> Signed-off-by: Chuanyu Tseng <chuanyu.tseng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[Why]
Resolve compiler warnings by marking unused parameters explicitly.

[How]
In .c and .h function definitions, keep parameter names
in signatures and add a line with `(void)param;` in function body

Preserved function signatures and avoids breaking code paths that
may reference the parameter under conditional compilation.

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Reviewed-by: Austin Zheng <austin.zheng@amd.com>
Signed-off-by: Gaghik Khachatrian <gaghik.khachatrian@amd.com>
Signed-off-by: Chuanyu Tseng <chuanyu.tseng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: bios_parser: fix GPIO I2C line off-by-one 2026-03-30T18:39:18+00:00 Pengpeng Hou pengpeng@iscas.ac.cn 2026-03-24T08:51:30+00:00 12fa1fd6dffff4eed15f1414eb7474127b2c5a24 get_gpio_i2c_info() computes the number of GPIO I2C assignment records present in the BIOS table and then uses bfI2C_LineMux as an array index into header->asGPIO_Info[]. The current check only rejects values strictly larger than the record count, so an index equal to count still falls through and reaches the fixed table one element past the end. Reject indices at or above the number of available records before using them as an array index. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
get_gpio_i2c_info() computes the number of GPIO I2C assignment records
present in the BIOS table and then uses bfI2C_LineMux as an array index
into header->asGPIO_Info[]. The current check only rejects values
strictly larger than the record count, so an index equal to count still
falls through and reaches the fixed table one element past the end.

Reject indices at or above the number of available records before using
them as an array index.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Sync dcn42 with DC 3.2.373 2026-03-11T17:58:07+00:00 Roman Li Roman.Li@amd.com 2026-03-05T17:56:09+00:00 e56e3cff2a1bb29545ddbec562e76c0419363a40 This patch provides a bulk merge to align driver support for DCN42 with Display Core version 3.2.373. It includes upgrade for: - clk_mgr - dml2/dml21 - optc - hubp - mpc - optc - hwseq Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Roman Li <Roman.Li@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
This patch provides a bulk merge to align driver
support for DCN42 with Display Core version 3.2.373.

It includes upgrade for:
- clk_mgr
- dml2/dml21
- optc
- hubp
- mpc
- optc
- hwseq

Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Roman Li <Roman.Li@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Enable dcn42 DC 2026-02-23T19:28:33+00:00 Roman Li Roman.Li@amd.com 2026-02-02T23:47:34+00:00 6b2dd7d37badd8bf076875397f9f39b494258ca7 Add support for DCN 4.2 in Display Core Signed-off-by: Roman Li <Roman.Li@amd.com> Acked-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
Add support for DCN 4.2 in Display Core

Signed-off-by: Roman Li <Roman.Li@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Implement DAC load detection on external DP bridge encoders 2026-02-23T19:28:32+00:00 Timur Kristóf timur.kristof@gmail.com 2026-01-26T21:08:36+00:00 213f95dca44e196269958a2580eda5e597d66437 Use the pre-existing implementation in the BIOS parser, but call the ExternalEncoderControl function for external encoders instead of the built-in DAC load detection function. Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
Use the pre-existing implementation in the BIOS parser, but call
the ExternalEncoderControl function for external encoders instead
of the built-in DAC load detection function.

Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Implement BIOS parser external encoder control 2026-02-23T19:28:32+00:00 Timur Kristóf timur.kristof@gmail.com 2026-01-26T21:08:29+00:00 ee5c4855f43c1af96c3f7e4412ce9492b00023fe The VBIOS has a function called ExternalEncoderControl which controls the DP bridge encoders that some GPUs use for analog and LVDS output. Fixup this old functionality. For reference, see the legacy non-DC amdgpu display code: amdgpu_atombios_encoder_setup_external_encoder() - Set same parameters for the ENABLE action as the SETUP action - Add missing enum values for DDC setup and DAC load detection - Fix the bits per color field - Clarify the code that sets the link rate - Expose the function so that it can be called by rest of DC A subsequent commit will call this function from DCE HWSS. Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
The VBIOS has a function called ExternalEncoderControl which
controls the DP bridge encoders that some GPUs use for analog
and LVDS output. Fixup this old functionality.

For reference, see the legacy non-DC amdgpu display code:
amdgpu_atombios_encoder_setup_external_encoder()

- Set same parameters for the ENABLE action as the SETUP action
- Add missing enum values for DDC setup and DAC load detection
- Fix the bits per color field
- Clarify the code that sets the link rate
- Expose the function so that it can be called by rest of DC

A subsequent commit will call this function from DCE HWSS.

Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>