From e00f2235386484cc1920dd99d17beac2a8dc4a95 Mon Sep 17 00:00:00 2001 From: Ben Skeggs Date: Sun, 10 Aug 2014 04:10:26 +1000 Subject: [PATCH] drm/nv50-/disp: audit and version SOR_HDMI_PWR method The full object interfaces are about to be exposed to userspace, so we need to check for any security-related issues and version the structs to make it easier to handle any changes we may need in the future. Signed-off-by: Ben Skeggs --- .../gpu/drm/nouveau/core/engine/disp/hdminv84.c | 31 ++++++++++++++--- .../gpu/drm/nouveau/core/engine/disp/hdminva3.c | 33 ++++++++++++++---- .../gpu/drm/nouveau/core/engine/disp/hdminvd0.c | 30 ++++++++++++++--- drivers/gpu/drm/nouveau/core/engine/disp/nv50.c | 4 +++ drivers/gpu/drm/nouveau/core/engine/disp/nv50.h | 8 ++--- drivers/gpu/drm/nouveau/core/engine/disp/nv84.c | 1 - drivers/gpu/drm/nouveau/core/engine/disp/nv94.c | 1 - drivers/gpu/drm/nouveau/core/engine/disp/nva3.c | 1 - drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c | 1 - drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c | 3 -- drivers/gpu/drm/nouveau/core/include/core/class.h | 6 ---- drivers/gpu/drm/nouveau/nv50_display.c | 39 +++++++++++++++------- drivers/gpu/drm/nouveau/nvif/class.h | 8 +++++ 13 files changed, 121 insertions(+), 45 deletions(-) diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/hdminv84.c b/drivers/gpu/drm/nouveau/core/engine/disp/hdminv84.c index 7fdade6..fa276de 100644 --- a/drivers/gpu/drm/nouveau/core/engine/disp/hdminv84.c +++ b/drivers/gpu/drm/nouveau/core/engine/disp/hdminv84.c @@ -22,17 +22,38 @@ * Authors: Ben Skeggs */ -#include -#include +#include +#include +#include #include "nv50.h" int -nv84_hdmi_ctrl(struct nv50_disp_priv *priv, int head, int or, u32 data) +nv84_hdmi_ctrl(NV50_DISP_MTHD_V1) { const u32 hoff = (head * 0x800); + union { + struct nv50_disp_sor_hdmi_pwr_v0 v0; + } *args = data; + u32 ctrl; + int ret; - if (!(data & NV84_DISP_SOR_HDMI_PWR_STATE_ON)) { + nv_ioctl(object, "disp sor hdmi ctrl size %d\n", size); + if (nvif_unpack(args->v0, 0, 0, false)) { + nv_ioctl(object, "disp sor hdmi ctrl vers %d state %d " + "max_ac_packet %d rekey %d\n", + args->v0.version, args->v0.state, + args->v0.max_ac_packet, args->v0.rekey); + if (args->v0.max_ac_packet > 0x1f || args->v0.rekey > 0x7f) + return -EINVAL; + ctrl = 0x40000000 * !!args->v0.state; + ctrl |= args->v0.max_ac_packet << 16; + ctrl |= args->v0.rekey; + ctrl |= 0x1f000000; /* ??? */ + } else + return ret; + + if (!(ctrl & 0x40000000)) { nv_mask(priv, 0x6165a4 + hoff, 0x40000000, 0x00000000); nv_mask(priv, 0x616520 + hoff, 0x00000001, 0x00000000); nv_mask(priv, 0x616500 + hoff, 0x00000001, 0x00000000); @@ -65,6 +86,6 @@ nv84_hdmi_ctrl(struct nv50_disp_priv *priv, int head, int or, u32 data) nv_mask(priv, 0x61733c, 0x00100000, 0x00000000); /* !RESETF */ /* HDMI_CTRL */ - nv_mask(priv, 0x6165a4 + hoff, 0x5f1f007f, data | 0x1f000000 /* ??? */); + nv_mask(priv, 0x6165a4 + hoff, 0x5f1f007f, ctrl); return 0; } diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/hdminva3.c b/drivers/gpu/drm/nouveau/core/engine/disp/hdminva3.c index db8c6fd..57eeed1 100644 --- a/drivers/gpu/drm/nouveau/core/engine/disp/hdminva3.c +++ b/drivers/gpu/drm/nouveau/core/engine/disp/hdminva3.c @@ -22,17 +22,38 @@ * Authors: Ben Skeggs */ -#include -#include +#include +#include +#include #include "nv50.h" int -nva3_hdmi_ctrl(struct nv50_disp_priv *priv, int head, int or, u32 data) +nva3_hdmi_ctrl(NV50_DISP_MTHD_V1) { - const u32 soff = (or * 0x800); + const u32 soff = outp->or * 0x800; + union { + struct nv50_disp_sor_hdmi_pwr_v0 v0; + } *args = data; + u32 ctrl; + int ret; - if (!(data & NV84_DISP_SOR_HDMI_PWR_STATE_ON)) { + nv_ioctl(object, "disp sor hdmi ctrl size %d\n", size); + if (nvif_unpack(args->v0, 0, 0, false)) { + nv_ioctl(object, "disp sor hdmi ctrl vers %d state %d " + "max_ac_packet %d rekey %d\n", + args->v0.version, args->v0.state, + args->v0.max_ac_packet, args->v0.rekey); + if (args->v0.max_ac_packet > 0x1f || args->v0.rekey > 0x7f) + return -EINVAL; + ctrl = 0x40000000 * !!args->v0.state; + ctrl |= args->v0.max_ac_packet << 16; + ctrl |= args->v0.rekey; + ctrl |= 0x1f000000; /* ??? */ + } else + return ret; + + if (!(ctrl & 0x40000000)) { nv_mask(priv, 0x61c5a4 + soff, 0x40000000, 0x00000000); nv_mask(priv, 0x61c520 + soff, 0x00000001, 0x00000000); nv_mask(priv, 0x61c500 + soff, 0x00000001, 0x00000000); @@ -65,6 +86,6 @@ nva3_hdmi_ctrl(struct nv50_disp_priv *priv, int head, int or, u32 data) nv_mask(priv, 0x61733c, 0x00100000, 0x00000000); /* !RESETF */ /* HDMI_CTRL */ - nv_mask(priv, 0x61c5a4 + soff, 0x5f1f007f, data | 0x1f000000 /* ??? */); + nv_mask(priv, 0x61c5a4 + soff, 0x5f1f007f, ctrl); return 0; } diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/hdminvd0.c b/drivers/gpu/drm/nouveau/core/engine/disp/hdminvd0.c index 5151bb2..3106d29 100644 --- a/drivers/gpu/drm/nouveau/core/engine/disp/hdminvd0.c +++ b/drivers/gpu/drm/nouveau/core/engine/disp/hdminvd0.c @@ -22,17 +22,37 @@ * Authors: Ben Skeggs */ -#include -#include +#include +#include +#include #include "nv50.h" int -nvd0_hdmi_ctrl(struct nv50_disp_priv *priv, int head, int or, u32 data) +nvd0_hdmi_ctrl(NV50_DISP_MTHD_V1) { const u32 hoff = (head * 0x800); + union { + struct nv50_disp_sor_hdmi_pwr_v0 v0; + } *args = data; + u32 ctrl; + int ret; - if (!(data & NV84_DISP_SOR_HDMI_PWR_STATE_ON)) { + nv_ioctl(object, "disp sor hdmi ctrl size %d\n", size); + if (nvif_unpack(args->v0, 0, 0, false)) { + nv_ioctl(object, "disp sor hdmi ctrl vers %d state %d " + "max_ac_packet %d rekey %d\n", + args->v0.version, args->v0.state, + args->v0.max_ac_packet, args->v0.rekey); + if (args->v0.max_ac_packet > 0x1f || args->v0.rekey > 0x7f) + return -EINVAL; + ctrl = 0x40000000 * !!args->v0.state; + ctrl |= args->v0.max_ac_packet << 16; + ctrl |= args->v0.rekey; + } else + return ret; + + if (!(ctrl & 0x40000000)) { nv_mask(priv, 0x616798 + hoff, 0x40000000, 0x00000000); nv_mask(priv, 0x6167a4 + hoff, 0x00000001, 0x00000000); nv_mask(priv, 0x616714 + hoff, 0x00000001, 0x00000000); @@ -54,7 +74,7 @@ nvd0_hdmi_ctrl(struct nv50_disp_priv *priv, int head, int or, u32 data) nv_mask(priv, 0x6167a4 + hoff, 0x00000001, 0x00000001); /* HDMI_CTRL */ - nv_mask(priv, 0x616798 + hoff, 0x401f007f, data); + nv_mask(priv, 0x616798 + hoff, 0x401f007f, ctrl); /* NFI, audio doesn't work without it though.. */ nv_mask(priv, 0x616548 + hoff, 0x00000070, 0x00000000); diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c index 9381b16..bb5caa7 100644 --- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c +++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c @@ -909,6 +909,10 @@ nv50_disp_base_mthd(struct nouveau_object *object, u32 mthd, if (!priv->sor.hda_eld) return -ENODEV; return priv->sor.hda_eld(object, priv, data, size, head, outp); + case NV50_DISP_MTHD_V1_SOR_HDMI_PWR: + if (!priv->sor.hdmi) + return -ENODEV; + return priv->sor.hdmi(object, priv, data, size, head, outp); default: break; } diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.h b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.h index a09875f..a9c8e19 100644 --- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.h +++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.h @@ -48,7 +48,7 @@ struct nv50_disp_priv { int nr; int (*power)(NV50_DISP_MTHD_V1); int (*hda_eld)(NV50_DISP_MTHD_V1); - int (*hdmi)(struct nv50_disp_priv *, int head, int sor, u32); + int (*hdmi)(NV50_DISP_MTHD_V1); u32 lvdsconf; } sor; struct { @@ -73,9 +73,9 @@ int nv50_dac_sense(NV50_DISP_MTHD_V1); int nva3_hda_eld(NV50_DISP_MTHD_V1); int nvd0_hda_eld(NV50_DISP_MTHD_V1); -int nv84_hdmi_ctrl(struct nv50_disp_priv *, int, int, u32); -int nva3_hdmi_ctrl(struct nv50_disp_priv *, int, int, u32); -int nvd0_hdmi_ctrl(struct nv50_disp_priv *, int, int, u32); +int nv84_hdmi_ctrl(NV50_DISP_MTHD_V1); +int nva3_hdmi_ctrl(NV50_DISP_MTHD_V1); +int nvd0_hdmi_ctrl(NV50_DISP_MTHD_V1); int nv50_sor_mthd(struct nouveau_object *, u32, void *, u32); int nv50_sor_power(NV50_DISP_MTHD_V1); diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv84.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv84.c index 81a0e8d..49cbecf 100644 --- a/drivers/gpu/drm/nouveau/core/engine/disp/nv84.c +++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv84.c @@ -215,7 +215,6 @@ nv84_disp_sclass[] = { struct nouveau_omthds nv84_disp_base_omthds[] = { { HEAD_MTHD(NV50_DISP_SCANOUTPOS) , nv50_disp_base_scanoutpos }, - { SOR_MTHD(NV84_DISP_SOR_HDMI_PWR) , nv50_sor_mthd }, { SOR_MTHD(NV50_DISP_SOR_LVDS_SCRIPT) , nv50_sor_mthd }, { PIOR_MTHD(NV50_DISP_PIOR_PWR) , nv50_pior_mthd }, { PIOR_MTHD(NV50_DISP_PIOR_TMDS_PWR) , nv50_pior_mthd }, diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv94.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv94.c index ca8bab4..7234237 100644 --- a/drivers/gpu/drm/nouveau/core/engine/disp/nv94.c +++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv94.c @@ -74,7 +74,6 @@ nv94_disp_sclass[] = { static struct nouveau_omthds nv94_disp_base_omthds[] = { { HEAD_MTHD(NV50_DISP_SCANOUTPOS) , nv50_disp_base_scanoutpos }, - { SOR_MTHD(NV84_DISP_SOR_HDMI_PWR) , nv50_sor_mthd }, { SOR_MTHD(NV50_DISP_SOR_LVDS_SCRIPT) , nv50_sor_mthd }, { SOR_MTHD(NV94_DISP_SOR_DP_PWR) , nv50_sor_mthd }, { PIOR_MTHD(NV50_DISP_PIOR_PWR) , nv50_pior_mthd }, diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nva3.c b/drivers/gpu/drm/nouveau/core/engine/disp/nva3.c index ca42d79..4886233 100644 --- a/drivers/gpu/drm/nouveau/core/engine/disp/nva3.c +++ b/drivers/gpu/drm/nouveau/core/engine/disp/nva3.c @@ -46,7 +46,6 @@ nva3_disp_sclass[] = { static struct nouveau_omthds nva3_disp_base_omthds[] = { { HEAD_MTHD(NV50_DISP_SCANOUTPOS) , nv50_disp_base_scanoutpos }, - { SOR_MTHD(NV84_DISP_SOR_HDMI_PWR) , nv50_sor_mthd }, { SOR_MTHD(NV50_DISP_SOR_LVDS_SCRIPT) , nv50_sor_mthd }, { SOR_MTHD(NV94_DISP_SOR_DP_PWR) , nv50_sor_mthd }, { PIOR_MTHD(NV50_DISP_PIOR_PWR) , nv50_pior_mthd }, diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c b/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c index 77fe8cc..7f035f3 100644 --- a/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c +++ b/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c @@ -712,7 +712,6 @@ nvd0_disp_base_ofuncs = { struct nouveau_omthds nvd0_disp_base_omthds[] = { { HEAD_MTHD(NV50_DISP_SCANOUTPOS) , nvd0_disp_base_scanoutpos }, - { SOR_MTHD(NV84_DISP_SOR_HDMI_PWR) , nv50_sor_mthd }, { SOR_MTHD(NV50_DISP_SOR_LVDS_SCRIPT) , nv50_sor_mthd }, { SOR_MTHD(NV94_DISP_SOR_DP_PWR) , nv50_sor_mthd }, { PIOR_MTHD(NV50_DISP_PIOR_PWR) , nv50_pior_mthd }, diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c index be7e235..5f2d71c 100644 --- a/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c +++ b/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c @@ -84,9 +84,6 @@ nv50_sor_mthd(struct nouveau_object *object, u32 mthd, void *args, u32 size) } switch (mthd & ~0x3f) { - case NV84_DISP_SOR_HDMI_PWR: - ret = priv->sor.hdmi(priv, head, or, data); - break; case NV50_DISP_SOR_LVDS_SCRIPT: priv->sor.lvdsconf = data & NV50_DISP_SOR_LVDS_SCRIPT_ID; ret = 0; diff --git a/drivers/gpu/drm/nouveau/core/include/core/class.h b/drivers/gpu/drm/nouveau/core/include/core/class.h index 234e117..e54d9cc 100644 --- a/drivers/gpu/drm/nouveau/core/include/core/class.h +++ b/drivers/gpu/drm/nouveau/core/include/core/class.h @@ -59,12 +59,6 @@ struct nv04_display_scanoutpos { #define NV50_DISP_SOR_MTHD_LINK 0x00000004 #define NV50_DISP_SOR_MTHD_OR 0x00000003 -#define NV84_DISP_SOR_HDMI_PWR 0x00012000 -#define NV84_DISP_SOR_HDMI_PWR_STATE 0x40000000 -#define NV84_DISP_SOR_HDMI_PWR_STATE_OFF 0x00000000 -#define NV84_DISP_SOR_HDMI_PWR_STATE_ON 0x40000000 -#define NV84_DISP_SOR_HDMI_PWR_MAX_AC_PACKET 0x001f0000 -#define NV84_DISP_SOR_HDMI_PWR_REKEY 0x0000007f #define NV50_DISP_SOR_LVDS_SCRIPT 0x00013000 #define NV50_DISP_SOR_LVDS_SCRIPT_ID 0x0000ffff #define NV94_DISP_SOR_DP_PWR 0x00016000 diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c index 543ddb9..e83ed52 100644 --- a/drivers/gpu/drm/nouveau/nv50_display.c +++ b/drivers/gpu/drm/nouveau/nv50_display.c @@ -1717,25 +1717,32 @@ nv50_hdmi_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode) { struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder); struct nouveau_crtc *nv_crtc = nouveau_crtc(encoder->crtc); - struct nouveau_connector *nv_connector; struct nv50_disp *disp = nv50_disp(encoder->dev); - const u32 moff = (nv_crtc->index << 3) | nv_encoder->or; - u32 rekey = 56; /* binary driver, and tegra constant */ + struct { + struct nv50_disp_mthd_v1 base; + struct nv50_disp_sor_hdmi_pwr_v0 pwr; + } args = { + .base.version = 1, + .base.method = NV50_DISP_MTHD_V1_SOR_HDMI_PWR, + .base.hasht = nv_encoder->dcb->hasht, + .base.hashm = (0xf0ff & nv_encoder->dcb->hashm) | + (0x0100 << nv_crtc->index), + .pwr.state = 1, + .pwr.rekey = 56, /* binary driver, and tegra, constant */ + }; + struct nouveau_connector *nv_connector; u32 max_ac_packet; - u32 data; nv_connector = nouveau_encoder_connector_get(nv_encoder); if (!drm_detect_hdmi_monitor(nv_connector->edid)) return; max_ac_packet = mode->htotal - mode->hdisplay; - max_ac_packet -= rekey; + max_ac_packet -= args.pwr.rekey; max_ac_packet -= 18; /* constant from tegra */ - max_ac_packet /= 32; - - data = NV84_DISP_SOR_HDMI_PWR_STATE_ON | (max_ac_packet << 16) | rekey; - nvif_exec(disp->disp, NV84_DISP_SOR_HDMI_PWR + moff, &data, sizeof(data)); + args.pwr.max_ac_packet = max_ac_packet / 32; + nvif_mthd(disp->disp, 0, &args, sizeof(args)); nv50_audio_mode_set(encoder, mode); } @@ -1744,12 +1751,20 @@ nv50_hdmi_disconnect(struct drm_encoder *encoder, struct nouveau_crtc *nv_crtc) { struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder); struct nv50_disp *disp = nv50_disp(encoder->dev); - const u32 moff = (nv_crtc->index << 3) | nv_encoder->or; - u32 data = 0; + struct { + struct nv50_disp_mthd_v1 base; + struct nv50_disp_sor_hdmi_pwr_v0 pwr; + } args = { + .base.version = 1, + .base.method = NV50_DISP_MTHD_V1_SOR_HDMI_PWR, + .base.hasht = nv_encoder->dcb->hasht, + .base.hashm = (0xf0ff & nv_encoder->dcb->hashm) | + (0x0100 << nv_crtc->index), + }; nv50_audio_disconnect(encoder); - nvif_exec(disp->disp, NV84_DISP_SOR_HDMI_PWR + moff, &data, sizeof(data)); + nvif_mthd(disp->disp, 0, &args, sizeof(args)); } /****************************************************************************** diff --git a/drivers/gpu/drm/nouveau/nvif/class.h b/drivers/gpu/drm/nouveau/nvif/class.h index 84d2926..abc6efa 100644 --- a/drivers/gpu/drm/nouveau/nvif/class.h +++ b/drivers/gpu/drm/nouveau/nvif/class.h @@ -352,4 +352,12 @@ struct nv50_disp_sor_hda_eld_v0 { __u8 data[]; }; +struct nv50_disp_sor_hdmi_pwr_v0 { + __u8 version; + __u8 state; + __u8 max_ac_packet; + __u8 rekey; + __u8 pad04[4]; +}; + #endif -- 2.7.4