[PATCH 02/11] video: Check that the mode fits in the reserved frame buffer

[Ana Bobillo <anabobillo3@gmail.com>]

From: Ana Bobillo <anabobillo3@gmail.com>

The video uclass reserves plat->size bytes for the frame buffer of each
video device when it is bound, but many drivers only learn the mode
when the device is probed, some of them from the display's EDID
(rk_vop, sunxi DE2 and the Tegra drivers). video_post_probe() works out
the frame buffer size from that mode and clears the frame buffer, and
the console then draws on it, without checking it against the
reservation. A display announcing a larger mode than the driver allows
for makes U-Boot write past the reserved memory, into the memory
reserved above it, which on ARM holds the MMU page tables.

Refuse to probe a video device whose frame buffer is larger than the
memory reserved for it. The following patches have the drivers skip
such modes, so that a smaller one is used instead.

Add a test which grows the sandbox display after its frame buffer has
been reserved.

Signed-off-by: Ana Bobillo <anabobillo3@gmail.com>
---
 drivers/video/video-uclass.c | 12 ++++++++++++
 test/dm/video.c              | 29 +++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/drivers/video/video-uclass.c b/drivers/video/video-uclass.c
index 22183d00d97..68712f6f039 100644
--- a/drivers/video/video-uclass.c
+++ b/drivers/video/video-uclass.c
@@ -640,6 +640,18 @@ static int video_post_probe(struct udevice *dev)
 
 	priv->fb_size = priv->line_length * priv->ysize;
 
+	/*
+	 * The mode can come from the display itself (e.g. its EDID), so check
+	 * that the frame buffer fits in the memory reserved for it before
+	 * anything is drawn
+	 */
+	if (plat->size && priv->fb_size > plat->size) {
+		log_err("Video device '%s': %dx%d needs %#x bytes but only %#x are reserved\n",
+			dev->name, priv->xsize, priv->ysize, priv->fb_size,
+			plat->size);
+		return -ENOSPC;
+	}
+
 	/*
 	 * Set up video handoff fields for passing video blob to next stage
 	 * NOTE:
diff --git a/test/dm/video.c b/test/dm/video.c
index cc854d0e042..8b62ac77657 100644
--- a/test/dm/video.c
+++ b/test/dm/video.c
@@ -15,6 +15,7 @@
 #include <video_console.h>
 #include <asm/test.h>
 #include <asm/sdl.h>
+#include <dm/device-internal.h>
 #include <dm/test.h>
 #include <dm/uclass-internal.h>
 #include <test/lib.h>
@@ -46,6 +47,34 @@ static int dm_test_video_base(struct unit_test_state *uts)
 }
 DM_TEST(dm_test_video_base, UTF_SCAN_PDATA | UTF_SCAN_FDT);
 
+/* Test that a mode larger than the reserved frame buffer is refused */
+static int dm_test_video_fb_size(struct unit_test_state *uts)
+{
+	struct video_uc_plat *uc_plat;
+	struct sandbox_sdl_plat *plat;
+	struct udevice *dev;
+	int line_length;
+
+	ut_assertok(uclass_find_first_device(UCLASS_VIDEO, &dev));
+	ut_assertnonnull(dev);
+	ut_assert(!device_active(dev));
+	uc_plat = dev_get_uclass_plat(dev);
+
+	/*
+	 * Change the mode after the frame buffer has been reserved, as drivers
+	 * do with a mode read from the display, so that it needs one line more
+	 * than the reserved memory holds
+	 */
+	plat = dev_get_plat(dev);
+	line_length = plat->xres * VNBYTES(plat->bpix);
+	plat->yres = uc_plat->size / line_length + 1;
+	ut_asserteq(-ENOSPC, device_probe(dev));
+	ut_assert(!device_active(dev));
+
+	return 0;
+}
+DM_TEST(dm_test_video_fb_size, UTF_SCAN_PDATA | UTF_SCAN_FDT);
+
 int video_compress_fb(struct unit_test_state *uts, struct udevice *dev,
 		      bool use_copy)
 {