tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

drm/radeon: check PS, WS index

Theoretically, it would be possible for a buggy or malicious VBIOS to
overwrite past the bounds of the passed parameters (or its own
workspace); add bounds checking to prevent this from happening.

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3093
Signed-off-by: Alexander Richards <electrodeyt@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

authored by

Alexander Richards and committed by
Alex Deucher f7a16fa3 4630d503

+93 -74
+33 -14
drivers/gpu/drm/radeon/atom.c
··· 60 60 typedef struct { 61 61 struct atom_context *ctx; 62 62 uint32_t *ps, *ws; 63 + int ps_size, ws_size; 63 64 int ps_shift; 64 65 uint16_t start; 65 66 unsigned last_jump; ··· 69 68 } atom_exec_context; 70 69 71 70 int atom_debug = 0; 72 - static int atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t *params); 73 - int atom_execute_table(struct atom_context *ctx, int index, uint32_t *params); 71 + static int atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t *params, int params_size); 72 + int atom_execute_table(struct atom_context *ctx, int index, uint32_t *params, int params_size); 74 73 75 74 static uint32_t atom_arg_mask[8] = { 76 75 0xFFFFFFFF, 0x0000FFFF, 0x00FFFF00, 0xFFFF0000, ··· 222 221 (*ptr)++; 223 222 /* get_unaligned_le32 avoids unaligned accesses from atombios 224 223 * tables, noticed on a DEC Alpha. */ 225 - val = get_unaligned_le32((u32 *)&ctx->ps[idx]); 224 + if (idx < ctx->ps_size) 225 + val = get_unaligned_le32((u32 *)&ctx->ps[idx]); 226 + else 227 + pr_info("PS index out of range: %i > %i\n", idx, ctx->ps_size); 226 228 if (print) 227 229 DEBUG("PS[0x%02X,0x%04X]", idx, val); 228 230 break; ··· 263 259 val = gctx->reg_block; 264 260 break; 265 261 default: 266 - val = ctx->ws[idx]; 262 + if (idx < ctx->ws_size) 263 + val = ctx->ws[idx]; 264 + else 265 + pr_info("WS index out of range: %i > %i\n", idx, ctx->ws_size); 267 266 } 268 267 break; 269 268 case ATOM_ARG_ID: ··· 501 494 idx = U8(*ptr); 502 495 (*ptr)++; 503 496 DEBUG("PS[0x%02X]", idx); 497 + if (idx >= ctx->ps_size) { 498 + pr_info("PS index out of range: %i > %i\n", idx, ctx->ps_size); 499 + return; 500 + } 504 501 ctx->ps[idx] = cpu_to_le32(val); 505 502 break; 506 503 case ATOM_ARG_WS: ··· 537 526 gctx->reg_block = val; 538 527 break; 539 528 default: 529 + if (idx >= ctx->ws_size) { 530 + pr_info("WS index out of range: %i > %i\n", idx, ctx->ws_size); 531 + return; 532 + } 540 533 ctx->ws[idx] = val; 541 534 } 542 535 break; ··· 638 623 else 639 624 SDEBUG(" table: %d\n", idx); 640 625 if (U16(ctx->ctx->cmd_table + 4 + 2 * idx)) 641 - r = atom_execute_table_locked(ctx->ctx, idx, ctx->ps + ctx->ps_shift); 626 + r = atom_execute_table_locked(ctx->ctx, idx, ctx->ps + ctx->ps_shift, ctx->ps_size - ctx->ps_shift); 642 627 if (r) { 643 628 ctx->abort = true; 644 629 } ··· 1167 1152 atom_op_shr, ATOM_ARG_MC}, { 1168 1153 atom_op_debug, 0},}; 1169 1154 1170 - static int atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t *params) 1155 + static int atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t *params, int params_size) 1171 1156 { 1172 1157 int base = CU16(ctx->cmd_table + 4 + 2 * index); 1173 1158 int len, ws, ps, ptr; ··· 1189 1174 ectx.ps_shift = ps / 4; 1190 1175 ectx.start = base; 1191 1176 ectx.ps = params; 1177 + ectx.ps_size = params_size; 1192 1178 ectx.abort = false; 1193 1179 ectx.last_jump = 0; 1194 - if (ws) 1180 + if (ws) { 1195 1181 ectx.ws = kcalloc(4, ws, GFP_KERNEL); 1196 - else 1182 + ectx.ws_size = ws; 1183 + } else { 1197 1184 ectx.ws = NULL; 1185 + ectx.ws_size = 0; 1186 + } 1198 1187 1199 1188 debug_depth++; 1200 1189 while (1) { ··· 1231 1212 return ret; 1232 1213 } 1233 1214 1234 - int atom_execute_table_scratch_unlocked(struct atom_context *ctx, int index, uint32_t *params) 1215 + int atom_execute_table_scratch_unlocked(struct atom_context *ctx, int index, uint32_t *params, int params_size) 1235 1216 { 1236 1217 int r; 1237 1218 ··· 1247 1228 /* reset divmul */ 1248 1229 ctx->divmul[0] = 0; 1249 1230 ctx->divmul[1] = 0; 1250 - r = atom_execute_table_locked(ctx, index, params); 1231 + r = atom_execute_table_locked(ctx, index, params, params_size); 1251 1232 mutex_unlock(&ctx->mutex); 1252 1233 return r; 1253 1234 } 1254 1235 1255 - int atom_execute_table(struct atom_context *ctx, int index, uint32_t *params) 1236 + int atom_execute_table(struct atom_context *ctx, int index, uint32_t *params, int params_size) 1256 1237 { 1257 1238 int r; 1258 1239 mutex_lock(&ctx->scratch_mutex); 1259 - r = atom_execute_table_scratch_unlocked(ctx, index, params); 1240 + r = atom_execute_table_scratch_unlocked(ctx, index, params, params_size); 1260 1241 mutex_unlock(&ctx->scratch_mutex); 1261 1242 return r; 1262 1243 } ··· 1354 1335 1355 1336 if (!CU16(ctx->cmd_table + 4 + 2 * ATOM_CMD_INIT)) 1356 1337 return 1; 1357 - ret = atom_execute_table(ctx, ATOM_CMD_INIT, ps); 1338 + ret = atom_execute_table(ctx, ATOM_CMD_INIT, ps, 16); 1358 1339 if (ret) 1359 1340 return ret; 1360 1341 ··· 1362 1343 1363 1344 if (rdev->family < CHIP_R600) { 1364 1345 if (CU16(ctx->cmd_table + 4 + 2 * ATOM_CMD_SPDFANCNTL)) 1365 - atom_execute_table(ctx, ATOM_CMD_SPDFANCNTL, ps); 1346 + atom_execute_table(ctx, ATOM_CMD_SPDFANCNTL, ps, 16); 1366 1347 } 1367 1348 return ret; 1368 1349 }
+2 -2
drivers/gpu/drm/radeon/atom.h
··· 145 145 extern int atom_debug; 146 146 147 147 struct atom_context *atom_parse(struct card_info *, void *); 148 - int atom_execute_table(struct atom_context *, int, uint32_t *); 149 - int atom_execute_table_scratch_unlocked(struct atom_context *, int, uint32_t *); 148 + int atom_execute_table(struct atom_context *, int, uint32_t *, int); 149 + int atom_execute_table_scratch_unlocked(struct atom_context *, int, uint32_t *, int); 150 150 int atom_asic_init(struct atom_context *); 151 151 void atom_destroy(struct atom_context *); 152 152 bool atom_parse_data_header(struct atom_context *ctx, int index, uint16_t *size,
+14 -14
drivers/gpu/drm/radeon/atombios_crtc.c
··· 77 77 args.usOverscanTop = cpu_to_le16(radeon_crtc->v_border); 78 78 break; 79 79 } 80 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 80 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 81 81 } 82 82 83 83 static void atombios_scaler_setup(struct drm_crtc *crtc) ··· 157 157 break; 158 158 } 159 159 } 160 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 160 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 161 161 if ((is_tv || is_cv) 162 162 && rdev->family >= CHIP_RV515 && rdev->family <= CHIP_R580) { 163 163 atom_rv515_force_tv_scaler(rdev, radeon_crtc); ··· 178 178 args.ucCRTC = radeon_crtc->crtc_id; 179 179 args.ucEnable = lock; 180 180 181 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 181 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 182 182 } 183 183 184 184 static void atombios_enable_crtc(struct drm_crtc *crtc, int state) ··· 194 194 args.ucCRTC = radeon_crtc->crtc_id; 195 195 args.ucEnable = state; 196 196 197 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 197 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 198 198 } 199 199 200 200 static void atombios_enable_crtc_memreq(struct drm_crtc *crtc, int state) ··· 210 210 args.ucCRTC = radeon_crtc->crtc_id; 211 211 args.ucEnable = state; 212 212 213 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 213 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 214 214 } 215 215 216 216 static const u32 vga_control_regs[6] = ··· 242 242 args.ucCRTC = radeon_crtc->crtc_id; 243 243 args.ucBlanking = state; 244 244 245 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 245 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 246 246 247 247 if (ASIC_IS_DCE8(rdev)) 248 248 WREG32(vga_control_regs[radeon_crtc->crtc_id], vga_control); ··· 261 261 args.ucDispPipeId = radeon_crtc->crtc_id; 262 262 args.ucEnable = state; 263 263 264 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 264 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 265 265 } 266 266 267 267 void atombios_crtc_dpms(struct drm_crtc *crtc, int mode) ··· 343 343 args.susModeMiscInfo.usAccess = cpu_to_le16(misc); 344 344 args.ucCRTC = radeon_crtc->crtc_id; 345 345 346 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 346 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 347 347 } 348 348 349 349 static void atombios_crtc_set_timing(struct drm_crtc *crtc, ··· 389 389 args.susModeMiscInfo.usAccess = cpu_to_le16(misc); 390 390 args.ucCRTC = radeon_crtc->crtc_id; 391 391 392 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 392 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 393 393 } 394 394 395 395 static void atombios_disable_ss(struct radeon_device *rdev, int pll_id) ··· 546 546 args.lvds_ss.ucSpreadSpectrumStepSize_Delay |= (ss->delay & 7) << 4; 547 547 args.lvds_ss.ucEnable = enable; 548 548 } 549 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 549 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 550 550 } 551 551 552 552 union adjust_pixel_clock { ··· 692 692 ADJUST_DISPLAY_CONFIG_SS_ENABLE; 693 693 694 694 atom_execute_table(rdev->mode_info.atom_context, 695 - index, (uint32_t *)&args); 695 + index, (uint32_t *)&args, sizeof(args)); 696 696 adjusted_clock = le16_to_cpu(args.v1.usPixelClock) * 10; 697 697 break; 698 698 case 3: ··· 725 725 args.v3.sInput.ucExtTransmitterID = 0; 726 726 727 727 atom_execute_table(rdev->mode_info.atom_context, 728 - index, (uint32_t *)&args); 728 + index, (uint32_t *)&args, sizeof(args)); 729 729 adjusted_clock = le32_to_cpu(args.v3.sOutput.ulDispPllFreq) * 10; 730 730 if (args.v3.sOutput.ucRefDiv) { 731 731 radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV; ··· 809 809 DRM_ERROR("Unknown table version %d %d\n", frev, crev); 810 810 return; 811 811 } 812 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 812 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 813 813 } 814 814 815 815 static void atombios_crtc_program_pll(struct drm_crtc *crtc, ··· 949 949 return; 950 950 } 951 951 952 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 952 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 953 953 } 954 954 955 955 static bool atombios_crtc_prepare_pll(struct drm_crtc *crtc, struct drm_display_mode *mode)
+2 -2
drivers/gpu/drm/radeon/atombios_dp.c
··· 112 112 if (ASIC_IS_DCE4(rdev)) 113 113 args.v2.ucHPD_ID = chan->rec.hpd; 114 114 115 - atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args); 115 + atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 116 116 117 117 *ack = args.v1.ucReplyStatus; 118 118 ··· 354 354 args.ucLaneNum = lane_num; 355 355 args.ucStatus = 0; 356 356 357 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 357 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 358 358 return args.ucStatus; 359 359 } 360 360
+19 -19
drivers/gpu/drm/radeon/atombios_encoders.c
··· 119 119 index = GetIndexIntoMasterTable(COMMAND, LCD1OutputControl); 120 120 if (dig->backlight_level == 0) { 121 121 args.ucAction = ATOM_LCD_BLOFF; 122 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 122 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 123 123 } else { 124 124 args.ucAction = ATOM_LCD_BL_BRIGHTNESS_CONTROL; 125 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 125 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 126 126 args.ucAction = ATOM_LCD_BLON; 127 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 127 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 128 128 } 129 129 break; 130 130 case ENCODER_OBJECT_ID_INTERNAL_UNIPHY: ··· 389 389 } 390 390 args.usPixelClock = cpu_to_le16(radeon_encoder->pixel_clock / 10); 391 391 392 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 392 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 393 393 394 394 } 395 395 ··· 445 445 446 446 args.sTVEncoder.usPixelClock = cpu_to_le16(radeon_encoder->pixel_clock / 10); 447 447 448 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 448 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 449 449 450 450 } 451 451 ··· 546 546 break; 547 547 } 548 548 549 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 549 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 550 550 } 551 551 552 552 union lvds_encoder_control { ··· 664 664 break; 665 665 } 666 666 667 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 667 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 668 668 } 669 669 670 670 int ··· 979 979 break; 980 980 } 981 981 982 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 982 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 983 983 984 984 } 985 985 ··· 1361 1361 break; 1362 1362 } 1363 1363 1364 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 1364 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 1365 1365 } 1366 1366 1367 1367 void ··· 1397 1397 1398 1398 args.v1.ucAction = action; 1399 1399 1400 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 1400 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 1401 1401 1402 1402 /* wait for the panel to power up */ 1403 1403 if (action == ATOM_TRANSMITTER_ACTION_POWER_ON) { ··· 1519 1519 DRM_ERROR("Unknown table version: %d, %d\n", frev, crev); 1520 1520 return; 1521 1521 } 1522 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 1522 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 1523 1523 } 1524 1524 1525 1525 static void ··· 1554 1554 args.ucEnable = ATOM_ENABLE; 1555 1555 args.ucCRTC = radeon_crtc->crtc_id; 1556 1556 1557 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 1557 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 1558 1558 1559 1559 WREG32(reg, temp); 1560 1560 } ··· 1618 1618 if (radeon_encoder->encoder_id == ENCODER_OBJECT_ID_INTERNAL_DDI) { 1619 1619 u32 reg = RREG32(RADEON_BIOS_3_SCRATCH); 1620 1620 WREG32(RADEON_BIOS_3_SCRATCH, reg & ~ATOM_S3_DFP2I_ACTIVE); 1621 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 1621 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 1622 1622 WREG32(RADEON_BIOS_3_SCRATCH, reg); 1623 1623 } else 1624 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 1624 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 1625 1625 if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) { 1626 1626 if (rdev->mode_info.bl_encoder) { 1627 1627 struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv; ··· 1629 1629 atombios_set_backlight_level(radeon_encoder, dig->backlight_level); 1630 1630 } else { 1631 1631 args.ucAction = ATOM_LCD_BLON; 1632 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 1632 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 1633 1633 } 1634 1634 } 1635 1635 break; ··· 1637 1637 case DRM_MODE_DPMS_SUSPEND: 1638 1638 case DRM_MODE_DPMS_OFF: 1639 1639 args.ucAction = ATOM_DISABLE; 1640 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 1640 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 1641 1641 if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) { 1642 1642 args.ucAction = ATOM_LCD_BLOFF; 1643 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 1643 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 1644 1644 } 1645 1645 break; 1646 1646 } ··· 1983 1983 return; 1984 1984 } 1985 1985 1986 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 1986 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 1987 1987 1988 1988 /* update scratch regs with new routing */ 1989 1989 radeon_atombios_encoder_crtc_scratch_regs(encoder, radeon_crtc->crtc_id); ··· 2311 2311 args.sDacload.ucMisc = DAC_LOAD_MISC_YPrPb; 2312 2312 } 2313 2313 2314 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 2314 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 2315 2315 2316 2316 return true; 2317 2317 } else
+1 -1
drivers/gpu/drm/radeon/atombios_i2c.c
··· 78 78 args.ucSlaveAddr = slave_addr << 1; 79 79 args.ucLineNumber = chan->rec.i2c_id; 80 80 81 - atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args); 81 + atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 82 82 83 83 /* error */ 84 84 if (args.ucStatus != HW_ASSISTED_I2C_STATUS_SUCCESS) {
+22 -22
drivers/gpu/drm/radeon/radeon_atombios.c
··· 2852 2852 args.v1.ucAction = clock_type; 2853 2853 args.v1.ulClock = cpu_to_le32(clock); /* 10 khz */ 2854 2854 2855 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 2855 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 2856 2856 2857 2857 dividers->post_div = args.v1.ucPostDiv; 2858 2858 dividers->fb_div = args.v1.ucFbDiv; ··· 2866 2866 args.v2.ucAction = clock_type; 2867 2867 args.v2.ulClock = cpu_to_le32(clock); /* 10 khz */ 2868 2868 2869 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 2869 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 2870 2870 2871 2871 dividers->post_div = args.v2.ucPostDiv; 2872 2872 dividers->fb_div = le16_to_cpu(args.v2.usFbDiv); ··· 2881 2881 if (clock_type == COMPUTE_ENGINE_PLL_PARAM) { 2882 2882 args.v3.ulClockParams = cpu_to_le32((clock_type << 24) | clock); 2883 2883 2884 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 2884 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 2885 2885 2886 2886 dividers->post_div = args.v3.ucPostDiv; 2887 2887 dividers->enable_post_div = (args.v3.ucCntlFlag & ··· 2901 2901 if (strobe_mode) 2902 2902 args.v5.ucInputFlag = ATOM_PLL_INPUT_FLAG_PLL_STROBE_MODE_EN; 2903 2903 2904 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 2904 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 2905 2905 2906 2906 dividers->post_div = args.v5.ucPostDiv; 2907 2907 dividers->enable_post_div = (args.v5.ucCntlFlag & ··· 2920 2920 /* fusion */ 2921 2921 args.v4.ulClock = cpu_to_le32(clock); /* 10 khz */ 2922 2922 2923 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 2923 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 2924 2924 2925 2925 dividers->post_divider = dividers->post_div = args.v4.ucPostDiv; 2926 2926 dividers->real_clock = le32_to_cpu(args.v4.ulClock); ··· 2931 2931 args.v6_in.ulClock.ulComputeClockFlag = clock_type; 2932 2932 args.v6_in.ulClock.ulClockFreq = cpu_to_le32(clock); /* 10 khz */ 2933 2933 2934 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 2934 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 2935 2935 2936 2936 dividers->whole_fb_div = le16_to_cpu(args.v6_out.ulFbDiv.usFbDiv); 2937 2937 dividers->frac_fb_div = le16_to_cpu(args.v6_out.ulFbDiv.usFbDivFrac); ··· 2972 2972 if (strobe_mode) 2973 2973 args.ucInputFlag |= MPLL_INPUT_FLAG_STROBE_MODE_EN; 2974 2974 2975 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 2975 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 2976 2976 2977 2977 mpll_param->clkfrac = le16_to_cpu(args.ulFbDiv.usFbDivFrac); 2978 2978 mpll_param->clkf = le16_to_cpu(args.ulFbDiv.usFbDiv); ··· 3005 3005 3006 3006 args.ucEnable = enable; 3007 3007 3008 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3008 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3009 3009 } 3010 3010 3011 3011 uint32_t radeon_atom_get_engine_clock(struct radeon_device *rdev) ··· 3013 3013 GET_ENGINE_CLOCK_PS_ALLOCATION args; 3014 3014 int index = GetIndexIntoMasterTable(COMMAND, GetEngineClock); 3015 3015 3016 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3016 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3017 3017 return le32_to_cpu(args.ulReturnEngineClock); 3018 3018 } 3019 3019 ··· 3022 3022 GET_MEMORY_CLOCK_PS_ALLOCATION args; 3023 3023 int index = GetIndexIntoMasterTable(COMMAND, GetMemoryClock); 3024 3024 3025 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3025 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3026 3026 return le32_to_cpu(args.ulReturnMemoryClock); 3027 3027 } 3028 3028 ··· 3034 3034 3035 3035 args.ulTargetEngineClock = cpu_to_le32(eng_clock); /* 10 khz */ 3036 3036 3037 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3037 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3038 3038 } 3039 3039 3040 3040 void radeon_atom_set_memory_clock(struct radeon_device *rdev, ··· 3048 3048 3049 3049 args.ulTargetMemoryClock = cpu_to_le32(mem_clock); /* 10 khz */ 3050 3050 3051 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3051 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3052 3052 } 3053 3053 3054 3054 void radeon_atom_set_engine_dram_timings(struct radeon_device *rdev, ··· 3067 3067 if (mem_clock) 3068 3068 args.sReserved.ulClock = cpu_to_le32(mem_clock & SET_CLOCK_FREQ_MASK); 3069 3069 3070 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3070 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3071 3071 } 3072 3072 3073 3073 void radeon_atom_update_memory_dll(struct radeon_device *rdev, ··· 3078 3078 3079 3079 args = cpu_to_le32(mem_clock); /* 10 khz */ 3080 3080 3081 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3081 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3082 3082 } 3083 3083 3084 3084 void radeon_atom_set_ac_timing(struct radeon_device *rdev, ··· 3090 3090 3091 3091 args.ulTargetMemoryClock = cpu_to_le32(tmp); /* 10 khz */ 3092 3092 3093 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3093 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3094 3094 } 3095 3095 3096 3096 union set_voltage { ··· 3134 3134 return; 3135 3135 } 3136 3136 3137 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3137 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3138 3138 } 3139 3139 3140 3140 int radeon_atom_get_max_vddc(struct radeon_device *rdev, u8 voltage_type, ··· 3155 3155 args.v2.ucVoltageMode = 0; 3156 3156 args.v2.usVoltageLevel = 0; 3157 3157 3158 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3158 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3159 3159 3160 3160 *voltage = le16_to_cpu(args.v2.usVoltageLevel); 3161 3161 break; ··· 3164 3164 args.v3.ucVoltageMode = ATOM_GET_VOLTAGE_LEVEL; 3165 3165 args.v3.usVoltageLevel = cpu_to_le16(voltage_id); 3166 3166 3167 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3167 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3168 3168 3169 3169 *voltage = le16_to_cpu(args.v3.usVoltageLevel); 3170 3170 break; ··· 3200 3200 args.v3.ucVoltageMode = ATOM_GET_LEAKAGE_ID; 3201 3201 args.v3.usVoltageLevel = 0; 3202 3202 3203 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3203 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3204 3204 3205 3205 *leakage_id = le16_to_cpu(args.v3.usVoltageLevel); 3206 3206 break; ··· 3327 3327 args.in.ulSCLKFreq = 3328 3328 cpu_to_le32(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].clk); 3329 3329 3330 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3330 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3331 3331 3332 3332 *voltage = le16_to_cpu(args.evv_out.usVoltageLevel); 3333 3333 ··· 3353 3353 args.v2.ucVoltageMode = SET_ASIC_VOLTAGE_MODE_GET_GPIOMASK; 3354 3354 args.v2.usVoltageLevel = cpu_to_le16(voltage_level); 3355 3355 3356 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3356 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3357 3357 3358 3358 *gpio_mask = le32_to_cpu(*(u32 *)&args.v2); 3359 3359 ··· 3361 3361 args.v2.ucVoltageMode = SET_ASIC_VOLTAGE_MODE_GET_GPIOVAL; 3362 3362 args.v2.usVoltageLevel = cpu_to_le16(voltage_level); 3363 3363 3364 - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); 3364 + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args, sizeof(args)); 3365 3365 3366 3366 *gpio_value = le32_to_cpu(*(u32 *)&args.v2); 3367 3367 break;