On 10/31/26 10:39, Hugo Sales wrote:
amdgpu_atif_query_backlight_caps() stores the firmware's number_of_points
as data_points but copies only the 99 points that luminance_data[] holds.
number_of_points is a u8, so a firmware table that claims more makes the
custom curve code in amdgpu_dm index past the array, and
dm_query_extended_brightness_caps() copy past the end of the
data_points[] buffer it fills
Clamp the count to ATIF_QBTC_MAX_DATA_POINTS and warn, since a table
that claims more is a firmware bug
Fixes: f729e63743f0 ("drm/amd: Pass luminance data to amdgpu_dm_backlight_caps")
Signed-off-by: Hugo Sales <[email protected]>
---
The other ATIF checks log at debug level because they make the call fail
and the driver falls back to its defaults. Here the driver keeps going
with a truncated curve, so this one warns
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 63088c072087a..4874ee864b807 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -406,7 +406,11 @@ int amdgpu_atif_query_backlight_caps(struct amdgpu_atif
*atif)
characteristics.max_input_signal;
atif->backlight_caps.ac_level = characteristics.ac_level;
atif->backlight_caps.dc_level = characteristics.dc_level;
- atif->backlight_caps.data_points = characteristics.number_of_points;
+ if (characteristics.number_of_points > ATIF_QBTC_MAX_DATA_POINTS)
+ pr_warn(FW_BUG "ATIF: backlight curve has %u points, using the first
%u\n",
+ characteristics.number_of_points,
ATIF_QBTC_MAX_DATA_POINTS);
+ atif->backlight_caps.data_points = min_t(u8,
characteristics.number_of_points,
+ ATIF_QBTC_MAX_DATA_POINTS);
memcpy(atif->backlight_caps.luminance_data,
characteristics.data_points,
sizeof(atif->backlight_caps.luminance_data));
Reviewed-by: Mario Limonciello <[email protected]>
Thanks; this makes sense. I'll get this applied to amd-staging-drm-next.
I would like to know though; did you see this in the wild? If so I'd
like to hear more about the system that had it and the system firmware
on it.
What model?
What APU?
What system firmware version?
What AGESA version?
Some systems will publish this to SMBIOS and you'll see it from "dmesg |
grep AGESA".
If it's a problem in AMD AGESA I would like to get it fixed for a future
AGESA release.
