1 files changed, 33 insertions, 5 deletions

diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index b8f106d9ecf8..3ac20153705a 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -55,7 +55,12 @@
 struct opregion_header {
         u8 signature[16];
         u32 size;
-        u32 opregion_ver;
+        struct {
+                u8 rsvd;
+                u8 revision;
+                u8 minor;
+                u8 major;
+        }  __packed over;
         u8 bios_ver[32];
         u8 vbios_ver[16];
         u8 driver_ver[16];
@@ -119,7 +124,8 @@ struct opregion_asle {
         u64 fdss;
         u32 fdsp;
         u32 stat;
-        u64 rvda;       /* Physical address of raw vbt data */
+        u64 rvda;       /* Physical (2.0) or relative from opregion (2.1+)
+                         * address of raw VBT data. */
         u32 rvds;       /* Size of raw vbt data */
         u8 rsvd[58];
 } __packed;
@@ -925,6 +931,11 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
         opregion->header = base;
         opregion->lid_state = base + ACPI_CLID;
 
+        DRM_DEBUG_DRIVER("ACPI OpRegion version %u.%u.%u\n",
+                         opregion->header->over.major,
+                         opregion->header->over.minor,
+                         opregion->header->over.revision);
+
         mboxes = opregion->header->mboxes;
         if (mboxes & MBOX_ACPI) {
                 DRM_DEBUG_DRIVER("Public ACPI methods supported\n");
@@ -953,11 +964,26 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
         if (dmi_check_system(intel_no_opregion_vbt))
                 goto out;
 
-        if (opregion->header->opregion_ver >= 2 && opregion->asle &&
+        if (opregion->header->over.major >= 2 && opregion->asle &&
             opregion->asle->rvda && opregion->asle->rvds) {
-                opregion->rvda = memremap(opregion->asle->rvda,
-                                          opregion->asle->rvds,
+                resource_size_t rvda = opregion->asle->rvda;
+
+                /*
+                 * opregion 2.0: rvda is the physical VBT address.
+                 *
+                 * opregion 2.1+: rvda is unsigned, relative offset from
+                 * opregion base, and should never point within opregion.
+                 */
+                if (opregion->header->over.major > 2 ||
+                    opregion->header->over.minor >= 1) {
+                        WARN_ON(rvda < OPREGION_SIZE);
+
+                        rvda += asls;
+                }
+
+                opregion->rvda = memremap(rvda, opregion->asle->rvds,
                                           MEMREMAP_WB);
+
                 vbt = opregion->rvda;
                 vbt_size = opregion->asle->rvds;
                 if (intel_bios_is_valid_vbt(vbt, vbt_size)) {
@@ -967,6 +993,8 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
                         goto out;
                 } else {
                         DRM_DEBUG_KMS("Invalid VBT in ACPI OpRegion (RVDA)\n");
+                        memunmap(opregion->rvda);
+                        opregion->rvda = NULL;
                 }
         }