kernel-fxtec-pro1x/drivers/gpu/drm/nouveau/nv50_gpio.c
Dan Carpenter 55a4c5c515 nouveau: off by one in nv50_gpio_location()
If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
end of the array.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-06-08 11:03:31 +10:00

76 lines
2.2 KiB
C

/*
* Copyright 2010 Red Hat Inc.
*
* Permission is hereby granted, free of charge, to any person obtaining a
* copy of this software and associated documentation files (the "Software"),
* to deal in the Software without restriction, including without limitation
* the rights to use, copy, modify, merge, publish, distribute, sublicense,
* and/or sell copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
* THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
* OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*
* Authors: Ben Skeggs
*/
#include "drmP.h"
#include "nouveau_drv.h"
#include "nouveau_hw.h"
static int
nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
{
const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
if (gpio->line >= 32)
return -EINVAL;
*reg = nv50_gpio_reg[gpio->line >> 3];
*shift = (gpio->line & 7) << 2;
return 0;
}
int
nv50_gpio_get(struct drm_device *dev, enum dcb_gpio_tag tag)
{
struct dcb_gpio_entry *gpio;
uint32_t r, s, v;
gpio = nouveau_bios_gpio_entry(dev, tag);
if (!gpio)
return -ENOENT;
if (nv50_gpio_location(gpio, &r, &s))
return -EINVAL;
v = nv_rd32(dev, r) >> (s + 2);
return ((v & 1) == (gpio->state[1] & 1));
}
int
nv50_gpio_set(struct drm_device *dev, enum dcb_gpio_tag tag, int state)
{
struct dcb_gpio_entry *gpio;
uint32_t r, s, v;
gpio = nouveau_bios_gpio_entry(dev, tag);
if (!gpio)
return -ENOENT;
if (nv50_gpio_location(gpio, &r, &s))
return -EINVAL;
v = nv_rd32(dev, r) & ~(0x3 << s);
v |= (gpio->state[state] ^ 2) << s;
nv_wr32(dev, r, v);
return 0;
}