drm/radeon: check PS, WS index

Theoretically, it would be possible for a buggy or malicious VBIOS to
overwrite past the bounds of the passed parameters (or its own
workspace); add bounds checking to prevent this from happening.

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3093
Signed-off-by: Alexander Richards <electrodeyt@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index ceb6d772ef94c83bef2fb171a15b252acef1d436..5bc3e6b41c34e2c42a2e5d152ee7eedbd94e8263 100644 (file)
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -60,6 +60,7 @@
 typedef struct {
        struct atom_context *ctx;
        uint32_t *ps, *ws;
+       int ps_size, ws_size;
        int ps_shift;
        uint16_t start;
        unsigned last_jump;
@@ -68,8 +69,8 @@ typedef struct {
 } atom_exec_context;
 
 int atom_debug = 0;
-static int atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t *params);
-int atom_execute_table(struct atom_context *ctx, int index, uint32_t *params);
+static int atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t *params, int params_size);
+int atom_execute_table(struct atom_context *ctx, int index, uint32_t *params, int params_size);
 
 static uint32_t atom_arg_mask[8] = {
        0xFFFFFFFF, 0x0000FFFF, 0x00FFFF00, 0xFFFF0000,
@@ -221,7 +222,10 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
                (*ptr)++;
                /* get_unaligned_le32 avoids unaligned accesses from atombios
                 * tables, noticed on a DEC Alpha. */
-               val = get_unaligned_le32((u32 *)&ctx->ps[idx]);
+               if (idx < ctx->ps_size)
+                       val = get_unaligned_le32((u32 *)&ctx->ps[idx]);
+               else
+                       pr_info("PS index out of range: %i > %i\n", idx, ctx->ps_size);
                if (print)
                        DEBUG("PS[0x%02X,0x%04X]", idx, val);
                break;
@@ -259,7 +263,10 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
                        val = gctx->reg_block;
                        break;
                default:
-                       val = ctx->ws[idx];
+                       if (idx < ctx->ws_size)
+                               val = ctx->ws[idx];
+                       else
+                               pr_info("WS index out of range: %i > %i\n", idx, ctx->ws_size);
                }
                break;
        case ATOM_ARG_ID:
@@ -494,6 +501,10 @@ static void atom_put_dst(atom_exec_context *ctx, int arg, uint8_t attr,
                idx = U8(*ptr);
                (*ptr)++;
                DEBUG("PS[0x%02X]", idx);
+               if (idx >= ctx->ps_size) {
+                       pr_info("PS index out of range: %i > %i\n", idx, ctx->ps_size);
+                       return;
+               }
                ctx->ps[idx] = cpu_to_le32(val);
                break;
        case ATOM_ARG_WS:
@@ -526,6 +537,10 @@ static void atom_put_dst(atom_exec_context *ctx, int arg, uint8_t attr,
                        gctx->reg_block = val;
                        break;
                default:
+                       if (idx >= ctx->ws_size) {
+                               pr_info("WS index out of range: %i > %i\n", idx, ctx->ws_size);
+                               return;
+                       }
                        ctx->ws[idx] = val;
                }
                break;
@@ -623,7 +638,7 @@ static void atom_op_calltable(atom_exec_context *ctx, int *ptr, int arg)
        else
                SDEBUG("   table: %d\n", idx);
        if (U16(ctx->ctx->cmd_table + 4 + 2 * idx))
-               r = atom_execute_table_locked(ctx->ctx, idx, ctx->ps + ctx->ps_shift);
+               r = atom_execute_table_locked(ctx->ctx, idx, ctx->ps + ctx->ps_shift, ctx->ps_size - ctx->ps_shift);
        if (r) {
                ctx->abort = true;
        }
@@ -1152,7 +1167,7 @@ static struct {
        atom_op_shr, ATOM_ARG_MC}, {
 atom_op_debug, 0},};
 
-static int atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t *params)
+static int atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t *params, int params_size)
 {
        int base = CU16(ctx->cmd_table + 4 + 2 * index);
        int len, ws, ps, ptr;
@@ -1174,12 +1189,16 @@ static int atom_execute_table_locked(struct atom_context *ctx, int index, uint32
        ectx.ps_shift = ps / 4;
        ectx.start = base;
        ectx.ps = params;
+       ectx.ps_size = params_size;
        ectx.abort = false;
        ectx.last_jump = 0;
-       if (ws)
+       if (ws) {
                ectx.ws = kcalloc(4, ws, GFP_KERNEL);
-       else
+               ectx.ws_size = ws;
+       } else {
                ectx.ws = NULL;
+               ectx.ws_size = 0;
+       }
 
        debug_depth++;
        while (1) {
@@ -1212,7 +1231,7 @@ free:
        return ret;
 }
 
-int atom_execute_table_scratch_unlocked(struct atom_context *ctx, int index, uint32_t *params)
+int atom_execute_table_scratch_unlocked(struct atom_context *ctx, int index, uint32_t *params, int params_size)
 {
        int r;
 
@@ -1228,16 +1247,16 @@ int atom_execute_table_scratch_unlocked(struct atom_context *ctx, int index, uin
        /* reset divmul */
        ctx->divmul[0] = 0;
        ctx->divmul[1] = 0;
-       r = atom_execute_table_locked(ctx, index, params);
+       r = atom_execute_table_locked(ctx, index, params, params_size);
        mutex_unlock(&ctx->mutex);
        return r;
 }
 
-int atom_execute_table(struct atom_context *ctx, int index, uint32_t *params)
+int atom_execute_table(struct atom_context *ctx, int index, uint32_t *params, int params_size)
 {
        int r;
        mutex_lock(&ctx->scratch_mutex);
-       r = atom_execute_table_scratch_unlocked(ctx, index, params);
+       r = atom_execute_table_scratch_unlocked(ctx, index, params, params_size);
        mutex_unlock(&ctx->scratch_mutex);
        return r;
 }
@@ -1335,7 +1354,7 @@ int atom_asic_init(struct atom_context *ctx)
 
        if (!CU16(ctx->cmd_table + 4 + 2 * ATOM_CMD_INIT))
                return 1;
-       ret = atom_execute_table(ctx, ATOM_CMD_INIT, ps);
+       ret = atom_execute_table(ctx, ATOM_CMD_INIT, ps, 16);
        if (ret)
                return ret;
 
@@ -1343,7 +1362,7 @@ int atom_asic_init(struct atom_context *ctx)
 
        if (rdev->family < CHIP_R600) {
                if (CU16(ctx->cmd_table + 4 + 2 * ATOM_CMD_SPDFANCNTL))
-                       atom_execute_table(ctx, ATOM_CMD_SPDFANCNTL, ps);
+                       atom_execute_table(ctx, ATOM_CMD_SPDFANCNTL, ps, 16);
        }
        return ret;
 }

diff --git a/drivers/gpu/drm/radeon/atom.h b/drivers/gpu/drm/radeon/atom.h
index 5de0563b63d2ef6bb6583c37ccb32a12b99dcc73..5bf06c0bd6ff3d3c41aedcd64c4bd3a381abd2e0 100644 (file)
--- a/drivers/gpu/drm/radeon/atom.h
+++ b/drivers/gpu/drm/radeon/atom.h
@@ -145,8 +145,8 @@ struct atom_context {
 extern int atom_debug;
 
 struct atom_context *atom_parse(struct card_info *, void *);
-int atom_execute_table(struct atom_context *, int, uint32_t *);
-int atom_execute_table_scratch_unlocked(struct atom_context *, int, uint32_t *);
+int atom_execute_table(struct atom_context *, int, uint32_t *, int);
+int atom_execute_table_scratch_unlocked(struct atom_context *, int, uint32_t *, int);
 int atom_asic_init(struct atom_context *);
 void atom_destroy(struct atom_context *);
 bool atom_parse_data_header(struct atom_context *ctx, int index, uint16_t *size,

diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index ade13173921b8f87aaf27f38075d1f74ec5a80e0..9b3a3a9d60e2033f9c9070cb52409b919265a8ba 100644 (file)
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -77,7 +77,7 @@ static void atombios_overscan_setup(struct drm_crtc *crtc,
                args.usOverscanTop = cpu_to_le16(radeon_crtc->v_border);
                break;
        }
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 static void atombios_scaler_setup(struct drm_crtc *crtc)
@@ -157,7 +157,7 @@ static void atombios_scaler_setup(struct drm_crtc *crtc)
                        break;
                }
        }
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
        if ((is_tv || is_cv)
            && rdev->family >= CHIP_RV515 && rdev->family <= CHIP_R580) {
                atom_rv515_force_tv_scaler(rdev, radeon_crtc);
@@ -178,7 +178,7 @@ static void atombios_lock_crtc(struct drm_crtc *crtc, int lock)
        args.ucCRTC = radeon_crtc->crtc_id;
        args.ucEnable = lock;
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 static void atombios_enable_crtc(struct drm_crtc *crtc, int state)
@@ -194,7 +194,7 @@ static void atombios_enable_crtc(struct drm_crtc *crtc, int state)
        args.ucCRTC = radeon_crtc->crtc_id;
        args.ucEnable = state;
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 static void atombios_enable_crtc_memreq(struct drm_crtc *crtc, int state)
@@ -210,7 +210,7 @@ static void atombios_enable_crtc_memreq(struct drm_crtc *crtc, int state)
        args.ucCRTC = radeon_crtc->crtc_id;
        args.ucEnable = state;
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 static const u32 vga_control_regs[6] =
@@ -242,7 +242,7 @@ static void atombios_blank_crtc(struct drm_crtc *crtc, int state)
        args.ucCRTC = radeon_crtc->crtc_id;
        args.ucBlanking = state;
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
        if (ASIC_IS_DCE8(rdev))
                WREG32(vga_control_regs[radeon_crtc->crtc_id], vga_control);
@@ -261,7 +261,7 @@ static void atombios_powergate_crtc(struct drm_crtc *crtc, int state)
        args.ucDispPipeId = radeon_crtc->crtc_id;
        args.ucEnable = state;
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void atombios_crtc_dpms(struct drm_crtc *crtc, int mode)
@@ -343,7 +343,7 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc,
        args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
        args.ucCRTC = radeon_crtc->crtc_id;
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 static void atombios_crtc_set_timing(struct drm_crtc *crtc,
@@ -389,7 +389,7 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc,
        args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
        args.ucCRTC = radeon_crtc->crtc_id;
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 static void atombios_disable_ss(struct radeon_device *rdev, int pll_id)
@@ -546,7 +546,7 @@ static void atombios_crtc_program_ss(struct radeon_device *rdev,
                args.lvds_ss.ucSpreadSpectrumStepSize_Delay |= (ss->delay & 7) << 4;
                args.lvds_ss.ucEnable = enable;
        }
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 union adjust_pixel_clock {
@@ -692,7 +692,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                                ADJUST_DISPLAY_CONFIG_SS_ENABLE;
 
                                atom_execute_table(rdev->mode_info.atom_context,
-                                                  index, (uint32_t *)&args);
+                                                  index, (uint32_t *)&args, sizeof(args));
                                adjusted_clock = le16_to_cpu(args.v1.usPixelClock) * 10;
                                break;
                        case 3:
@@ -725,7 +725,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                        args.v3.sInput.ucExtTransmitterID = 0;
 
                                atom_execute_table(rdev->mode_info.atom_context,
-                                                  index, (uint32_t *)&args);
+                                                  index, (uint32_t *)&args, sizeof(args));
                                adjusted_clock = le32_to_cpu(args.v3.sOutput.ulDispPllFreq) * 10;
                                if (args.v3.sOutput.ucRefDiv) {
                                        radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
@@ -809,7 +809,7 @@ static void atombios_crtc_set_disp_eng_pll(struct radeon_device *rdev,
                DRM_ERROR("Unknown table version %d %d\n", frev, crev);
                return;
        }
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 static void atombios_crtc_program_pll(struct drm_crtc *crtc,
@@ -949,7 +949,7 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc,
                return;
        }
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 static bool atombios_crtc_prepare_pll(struct drm_crtc *crtc, struct drm_display_mode *mode)

diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 009333645438099e1f83ba1c551d71438261dd3c..fca8b08535a5443c8e20c40453280e0ae5ca8d4d 100644 (file)
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -112,7 +112,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
        if (ASIC_IS_DCE4(rdev))
                args.v2.ucHPD_ID = chan->rec.hpd;
 
-       atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
        *ack = args.v1.ucReplyStatus;
 
@@ -354,7 +354,7 @@ static u8 radeon_dp_encoder_service(struct radeon_device *rdev,
        args.ucLaneNum = lane_num;
        args.ucStatus = 0;
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
        return args.ucStatus;
 }
 

diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 6e537c5bd2959dc75b70cb406569f3e2295bbe30..2bff0d9e20f530f7ea62a86d06530459c6d2ecb9 100644 (file)
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -119,12 +119,12 @@ atombios_set_backlight_level(struct radeon_encoder *radeon_encoder, u8 level)
                        index = GetIndexIntoMasterTable(COMMAND, LCD1OutputControl);
                        if (dig->backlight_level == 0) {
                                args.ucAction = ATOM_LCD_BLOFF;
-                               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
                        } else {
                                args.ucAction = ATOM_LCD_BL_BRIGHTNESS_CONTROL;
-                               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
                                args.ucAction = ATOM_LCD_BLON;
-                               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
                        }
                        break;
                case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
@@ -389,7 +389,7 @@ atombios_dac_setup(struct drm_encoder *encoder, int action)
        }
        args.usPixelClock = cpu_to_le16(radeon_encoder->pixel_clock / 10);
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
 }
 
@@ -445,7 +445,7 @@ atombios_tv_setup(struct drm_encoder *encoder, int action)
 
        args.sTVEncoder.usPixelClock = cpu_to_le16(radeon_encoder->pixel_clock / 10);
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
 }
 
@@ -546,7 +546,7 @@ atombios_dvo_setup(struct drm_encoder *encoder, int action)
                break;
        }
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 union lvds_encoder_control {
@@ -664,7 +664,7 @@ atombios_digital_setup(struct drm_encoder *encoder, int action)
                break;
        }
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 int
@@ -979,7 +979,7 @@ atombios_dig_encoder_setup2(struct drm_encoder *encoder, int action, int panel_m
                break;
        }
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
 }
 
@@ -1361,7 +1361,7 @@ atombios_dig_transmitter_setup2(struct drm_encoder *encoder, int action, uint8_t
                break;
        }
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void
@@ -1397,7 +1397,7 @@ atombios_set_edp_panel_power(struct drm_connector *connector, int action)
 
        args.v1.ucAction = action;
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
        /* wait for the panel to power up */
        if (action == ATOM_TRANSMITTER_ACTION_POWER_ON) {
@@ -1519,7 +1519,7 @@ atombios_external_encoder_setup(struct drm_encoder *encoder,
                DRM_ERROR("Unknown table version: %d, %d\n", frev, crev);
                return;
        }
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 static void
@@ -1554,7 +1554,7 @@ atombios_yuv_setup(struct drm_encoder *encoder, bool enable)
                args.ucEnable = ATOM_ENABLE;
        args.ucCRTC = radeon_crtc->crtc_id;
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
        WREG32(reg, temp);
 }
@@ -1618,10 +1618,10 @@ radeon_atom_encoder_dpms_avivo(struct drm_encoder *encoder, int mode)
                if (radeon_encoder->encoder_id == ENCODER_OBJECT_ID_INTERNAL_DDI) {
                        u32 reg = RREG32(RADEON_BIOS_3_SCRATCH);
                        WREG32(RADEON_BIOS_3_SCRATCH, reg & ~ATOM_S3_DFP2I_ACTIVE);
-                       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
                        WREG32(RADEON_BIOS_3_SCRATCH, reg);
                } else
-                       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
                if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
                        if (rdev->mode_info.bl_encoder) {
                                struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
@@ -1629,7 +1629,7 @@ radeon_atom_encoder_dpms_avivo(struct drm_encoder *encoder, int mode)
                                atombios_set_backlight_level(radeon_encoder, dig->backlight_level);
                        } else {
                                args.ucAction = ATOM_LCD_BLON;
-                               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
                        }
                }
                break;
@@ -1637,10 +1637,10 @@ radeon_atom_encoder_dpms_avivo(struct drm_encoder *encoder, int mode)
        case DRM_MODE_DPMS_SUSPEND:
        case DRM_MODE_DPMS_OFF:
                args.ucAction = ATOM_DISABLE;
-               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
                if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
                        args.ucAction = ATOM_LCD_BLOFF;
-                       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
                }
                break;
        }
@@ -1983,7 +1983,7 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
                return;
        }
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
        /* update scratch regs with new routing */
        radeon_atombios_encoder_crtc_scratch_regs(encoder, radeon_crtc->crtc_id);
@@ -2311,7 +2311,7 @@ atombios_dac_load_detect(struct drm_encoder *encoder, struct drm_connector *conn
                                args.sDacload.ucMisc = DAC_LOAD_MISC_YPrPb;
                }
 
-               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                return true;
        } else

diff --git a/drivers/gpu/drm/radeon/atombios_i2c.c b/drivers/gpu/drm/radeon/atombios_i2c.c
index ab4d21072191f949e6346bde18b298fedc9b9eb8..730f0b25312b722dc813e579bd0bf6362c6a10c1 100644 (file)
--- a/drivers/gpu/drm/radeon/atombios_i2c.c
+++ b/drivers/gpu/drm/radeon/atombios_i2c.c
@@ -78,7 +78,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
        args.ucSlaveAddr = slave_addr << 1;
        args.ucLineNumber = chan->rec.i2c_id;
 
-       atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
        /* error */
        if (args.ucStatus != HW_ASSISTED_I2C_STATUS_SUCCESS) {

diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 3596ea4a8b60f463a231682292bdc570e79b9c33..bb1f0a3371ab5de484a81ad040347c9a5a8d4e76 100644 (file)
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2852,7 +2852,7 @@ int radeon_atom_get_clock_dividers(struct radeon_device *rdev,
                args.v1.ucAction = clock_type;
                args.v1.ulClock = cpu_to_le32(clock);   /* 10 khz */
 
-               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                dividers->post_div = args.v1.ucPostDiv;
                dividers->fb_div = args.v1.ucFbDiv;
@@ -2866,7 +2866,7 @@ int radeon_atom_get_clock_dividers(struct radeon_device *rdev,
                        args.v2.ucAction = clock_type;
                        args.v2.ulClock = cpu_to_le32(clock);   /* 10 khz */
 
-                       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                        dividers->post_div = args.v2.ucPostDiv;
                        dividers->fb_div = le16_to_cpu(args.v2.usFbDiv);
@@ -2881,7 +2881,7 @@ int radeon_atom_get_clock_dividers(struct radeon_device *rdev,
                        if (clock_type == COMPUTE_ENGINE_PLL_PARAM) {
                                args.v3.ulClockParams = cpu_to_le32((clock_type << 24) | clock);
 
-                               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                                dividers->post_div = args.v3.ucPostDiv;
                                dividers->enable_post_div = (args.v3.ucCntlFlag &
@@ -2901,7 +2901,7 @@ int radeon_atom_get_clock_dividers(struct radeon_device *rdev,
                                if (strobe_mode)
                                        args.v5.ucInputFlag = ATOM_PLL_INPUT_FLAG_PLL_STROBE_MODE_EN;
 
-                               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                                dividers->post_div = args.v5.ucPostDiv;
                                dividers->enable_post_div = (args.v5.ucCntlFlag &
@@ -2920,7 +2920,7 @@ int radeon_atom_get_clock_dividers(struct radeon_device *rdev,
                /* fusion */
                args.v4.ulClock = cpu_to_le32(clock);   /* 10 khz */
 
-               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                dividers->post_divider = dividers->post_div = args.v4.ucPostDiv;
                dividers->real_clock = le32_to_cpu(args.v4.ulClock);
@@ -2931,7 +2931,7 @@ int radeon_atom_get_clock_dividers(struct radeon_device *rdev,
                args.v6_in.ulClock.ulComputeClockFlag = clock_type;
                args.v6_in.ulClock.ulClockFreq = cpu_to_le32(clock);    /* 10 khz */
 
-               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                dividers->whole_fb_div = le16_to_cpu(args.v6_out.ulFbDiv.usFbDiv);
                dividers->frac_fb_div = le16_to_cpu(args.v6_out.ulFbDiv.usFbDivFrac);
@@ -2972,7 +2972,7 @@ int radeon_atom_get_memory_pll_dividers(struct radeon_device *rdev,
                        if (strobe_mode)
                                args.ucInputFlag |= MPLL_INPUT_FLAG_STROBE_MODE_EN;
 
-                       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                        mpll_param->clkfrac = le16_to_cpu(args.ulFbDiv.usFbDivFrac);
                        mpll_param->clkf = le16_to_cpu(args.ulFbDiv.usFbDiv);
@@ -3005,7 +3005,7 @@ void radeon_atom_set_clock_gating(struct radeon_device *rdev, int enable)
 
        args.ucEnable = enable;
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 uint32_t radeon_atom_get_engine_clock(struct radeon_device *rdev)
@@ -3013,7 +3013,7 @@ uint32_t radeon_atom_get_engine_clock(struct radeon_device *rdev)
        GET_ENGINE_CLOCK_PS_ALLOCATION args;
        int index = GetIndexIntoMasterTable(COMMAND, GetEngineClock);
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
        return le32_to_cpu(args.ulReturnEngineClock);
 }
 
@@ -3022,7 +3022,7 @@ uint32_t radeon_atom_get_memory_clock(struct radeon_device *rdev)
        GET_MEMORY_CLOCK_PS_ALLOCATION args;
        int index = GetIndexIntoMasterTable(COMMAND, GetMemoryClock);
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
        return le32_to_cpu(args.ulReturnMemoryClock);
 }
 
@@ -3034,7 +3034,7 @@ void radeon_atom_set_engine_clock(struct radeon_device *rdev,
 
        args.ulTargetEngineClock = cpu_to_le32(eng_clock);      /* 10 khz */
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void radeon_atom_set_memory_clock(struct radeon_device *rdev,
@@ -3048,7 +3048,7 @@ void radeon_atom_set_memory_clock(struct radeon_device *rdev,
 
        args.ulTargetMemoryClock = cpu_to_le32(mem_clock);      /* 10 khz */
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void radeon_atom_set_engine_dram_timings(struct radeon_device *rdev,
@@ -3067,7 +3067,7 @@ void radeon_atom_set_engine_dram_timings(struct radeon_device *rdev,
        if (mem_clock)
                args.sReserved.ulClock = cpu_to_le32(mem_clock & SET_CLOCK_FREQ_MASK);
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void radeon_atom_update_memory_dll(struct radeon_device *rdev,
@@ -3078,7 +3078,7 @@ void radeon_atom_update_memory_dll(struct radeon_device *rdev,
 
        args = cpu_to_le32(mem_clock);  /* 10 khz */
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 void radeon_atom_set_ac_timing(struct radeon_device *rdev,
@@ -3090,7 +3090,7 @@ void radeon_atom_set_ac_timing(struct radeon_device *rdev,
 
        args.ulTargetMemoryClock = cpu_to_le32(tmp);    /* 10 khz */
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 union set_voltage {
@@ -3134,7 +3134,7 @@ void radeon_atom_set_voltage(struct radeon_device *rdev, u16 voltage_level, u8 v
                return;
        }
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 }
 
 int radeon_atom_get_max_vddc(struct radeon_device *rdev, u8 voltage_type,
@@ -3155,7 +3155,7 @@ int radeon_atom_get_max_vddc(struct radeon_device *rdev, u8 voltage_type,
                args.v2.ucVoltageMode = 0;
                args.v2.usVoltageLevel = 0;
 
-               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                *voltage = le16_to_cpu(args.v2.usVoltageLevel);
                break;
@@ -3164,7 +3164,7 @@ int radeon_atom_get_max_vddc(struct radeon_device *rdev, u8 voltage_type,
                args.v3.ucVoltageMode = ATOM_GET_VOLTAGE_LEVEL;
                args.v3.usVoltageLevel = cpu_to_le16(voltage_id);
 
-               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                *voltage = le16_to_cpu(args.v3.usVoltageLevel);
                break;
@@ -3200,7 +3200,7 @@ int radeon_atom_get_leakage_id_from_vbios(struct radeon_device *rdev,
                args.v3.ucVoltageMode = ATOM_GET_LEAKAGE_ID;
                args.v3.usVoltageLevel = 0;
 
-               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                *leakage_id = le16_to_cpu(args.v3.usVoltageLevel);
                break;
@@ -3327,7 +3327,7 @@ int radeon_atom_get_voltage_evv(struct radeon_device *rdev,
        args.in.ulSCLKFreq =
                cpu_to_le32(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].clk);
 
-       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+       atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
        *voltage = le16_to_cpu(args.evv_out.usVoltageLevel);
 
@@ -3353,7 +3353,7 @@ int radeon_atom_get_voltage_gpio_settings(struct radeon_device *rdev,
                args.v2.ucVoltageMode = SET_ASIC_VOLTAGE_MODE_GET_GPIOMASK;
                args.v2.usVoltageLevel = cpu_to_le16(voltage_level);
 
-               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                *gpio_mask = le32_to_cpu(*(u32 *)&args.v2);
 
@@ -3361,7 +3361,7 @@ int radeon_atom_get_voltage_gpio_settings(struct radeon_device *rdev,
                args.v2.ucVoltageMode = SET_ASIC_VOLTAGE_MODE_GET_GPIOVAL;
                args.v2.usVoltageLevel = cpu_to_le16(voltage_level);
 
-               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+               atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args));
 
                *gpio_value = le32_to_cpu(*(u32 *)&args.v2);
                break;