Re: drm/i915/bdw: Provide the BDW specific HDMI buffer translation table

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Damien Lespiau,

The patch a26aa8baee6c: "drm/i915/bdw: Provide the BDW specific HDMI
buffer translation table" from Aug 1, 2014, leads to the following
static checker warning:

	drivers/gpu/drm/i915/intel_ddi.c:225 intel_prepare_ddi_buffers()
	error: buffer overflow 'ddi_translations_hdmi' 24 <= 31

drivers/gpu/drm/i915/intel_ddi.c
   155  static void intel_prepare_ddi_buffers(struct drm_device *dev, enum port port)
   156  {
   157          struct drm_i915_private *dev_priv = dev->dev_private;
   158          u32 reg;
   159          int i, n_hdmi_entries, hdmi_800mV_0dB;
   160          int hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift;
                    ^^^^^^^^^^
The static checker thinks this is a number between 0-15.  I didn't check
if that was correct.

   161          const u32 *ddi_translations_fdi;

[ snip ]

   186                  ddi_translations_hdmi = bdw_ddi_translations_hdmi;
   187                  n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
limit is the size of the array.

   188                  hdmi_800mV_0dB = 7;
   189          }
   190  
   191          switch (port) {
   192          case PORT_A:
   193                  ddi_translations = ddi_translations_edp;
   194                  break;
   195          case PORT_B:
   196          case PORT_C:
   197                  ddi_translations = ddi_translations_dp;
   198                  break;
   199          case PORT_D:
   200                  if (intel_dp_is_edp(dev, PORT_D))
   201                          ddi_translations = ddi_translations_edp;
   202                  else
   203                          ddi_translations = ddi_translations_dp;
   204                  break;
   205          case PORT_E:
   206                  ddi_translations = ddi_translations_fdi;
   207                  break;
   208          default:
   209                  BUG();
   210          }
   211  
   212          for (i = 0, reg = DDI_BUF_TRANS(port);
   213               i < ARRAY_SIZE(hsw_ddi_translations_fdi); i++) {
   214                  I915_WRITE(reg, ddi_translations[i]);
   215                  reg += 4;
   216          }
   217  
   218          /* Choose a good default if VBT is badly populated */
   219          if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN ||
   220              hdmi_level >= n_hdmi_entries)
                                  ^^^^^^^^^^^^^^
We cap it at the size of the array which is either 20 or 24.  The static
checker thinks it's already capped at 15 so this is not a problem.

Should this be n_hdmi_entries / 2 or something?  Maybe a - 1 in there?

   221                  hdmi_level = hdmi_800mV_0dB;
   222  
   223          /* Entry 9 is for HDMI: */
   224          for (i = 0; i < 2; i++) {
   225                  I915_WRITE(reg, ddi_translations_hdmi[hdmi_level * 2 + i]);
                                                              ^^^^^^^^^^^^^^^^^^
The static checker thinks "15 * 2 + 1 = 31" so we are beyond the size
of the largest array (either 20 or 24).

   226                  reg += 4;
   227          }
   228  }

regards,
dan carpenter