aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c
diff options
context:
space:
mode:
authorBen Skeggs <bskeggs@redhat.com>2016-06-22 12:41:04 +1000
committerBen Skeggs <bskeggs@redhat.com>2016-07-14 11:53:25 +1000
commit2f96e8e3e0226d74ca62544d3c9f3558e55b6bb2 (patch)
tree8f324be15ad5387dc51f0b28d6fafbee850dfe20 /drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c
parentdrm/nouveau/bios: guard against out-of-bounds accesses to image (diff)
downloadlinux-dev-2f96e8e3e0226d74ca62544d3c9f3558e55b6bb2.tar.xz
linux-dev-2f96e8e3e0226d74ca62544d3c9f3558e55b6bb2.zip
drm/nouveau/bios: pointers beyond end of first image need special handling
Makes common the code that was previously used by the PMU table parsing, as it appears other tables need this too. Not much of an idea what this is all about... Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c')
-rw-r--r--drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c20
1 files changed, 2 insertions, 18 deletions
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c
index c268e5afe852..b4a308f3cf7b 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c
@@ -26,21 +26,6 @@
#include <subdev/bios/image.h>
#include <subdev/bios/pmu.h>
-static u32
-weirdo_pointer(struct nvkm_bios *bios, u32 data)
-{
- struct nvbios_image image;
- int idx = 0;
- if (nvbios_image(bios, idx++, &image)) {
- data -= image.size;
- while (nvbios_image(bios, idx++, &image)) {
- if (image.type == 0xe0)
- return image.base + data;
- }
- }
- return 0;
-}
-
u32
nvbios_pmuTe(struct nvkm_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len)
{
@@ -50,7 +35,7 @@ nvbios_pmuTe(struct nvkm_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len)
if (!bit_entry(bios, 'p', &bit_p)) {
if (bit_p.version == 2 && bit_p.length >= 4)
data = nvbios_rd32(bios, bit_p.offset + 0x00);
- if ((data = weirdo_pointer(bios, data))) {
+ if (data) {
*ver = nvbios_rd08(bios, data + 0x00); /* maybe? */
*hdr = nvbios_rd08(bios, data + 0x01);
*len = nvbios_rd08(bios, data + 0x02);
@@ -97,8 +82,7 @@ nvbios_pmuRm(struct nvkm_bios *bios, u8 type, struct nvbios_pmuR *info)
u32 data;
memset(info, 0x00, sizeof(*info));
while ((data = nvbios_pmuEp(bios, idx++, &ver, &hdr, &pmuE))) {
- if ( pmuE.type == type &&
- (data = weirdo_pointer(bios, pmuE.data))) {
+ if (pmuE.type == type && (data = pmuE.data)) {
info->init_addr_pmu = nvbios_rd32(bios, data + 0x08);
info->args_addr_pmu = nvbios_rd32(bios, data + 0x0c);
info->boot_addr = data + 0x30;