Commit 5a7aad9a authored by David Miller's avatar David Miller Committed by Dave Airlie

drm: ati_pcigart: Do not access I/O MEM space using pointer derefs.

The PCI GART table initialization code treats the GART table mapping
unconditionally as a kernel virtual address.

But it could be in the framebuffer, for example, and thus we're
dealing with a PCI MEM space ioremap() cookie.  Treating that as a
virtual address is illegal and will crash some system types (such as
sparc64 where the ioremap() return value is actually a physical I/O
address).

So access the area correctly, using gart_info->gart_table_location as
our guide.
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarDave Airlie <airlied@linux.ie>
parent 8e100458
...@@ -95,10 +95,11 @@ EXPORT_SYMBOL(drm_ati_pcigart_cleanup); ...@@ -95,10 +95,11 @@ EXPORT_SYMBOL(drm_ati_pcigart_cleanup);
int drm_ati_pcigart_init(struct drm_device *dev, struct drm_ati_pcigart_info *gart_info) int drm_ati_pcigart_init(struct drm_device *dev, struct drm_ati_pcigart_info *gart_info)
{ {
struct drm_local_map *map = &gart_info->mapping;
struct drm_sg_mem *entry = dev->sg; struct drm_sg_mem *entry = dev->sg;
void *address = NULL; void *address = NULL;
unsigned long pages; unsigned long pages;
u32 *pci_gart, page_base; u32 *pci_gart, page_base, gart_idx;
dma_addr_t bus_address = 0; dma_addr_t bus_address = 0;
int i, j, ret = 0; int i, j, ret = 0;
int max_pages; int max_pages;
...@@ -133,8 +134,14 @@ int drm_ati_pcigart_init(struct drm_device *dev, struct drm_ati_pcigart_info *ga ...@@ -133,8 +134,14 @@ int drm_ati_pcigart_init(struct drm_device *dev, struct drm_ati_pcigart_info *ga
pages = (entry->pages <= max_pages) pages = (entry->pages <= max_pages)
? entry->pages : max_pages; ? entry->pages : max_pages;
if (gart_info->gart_table_location == DRM_ATI_GART_MAIN) {
memset(pci_gart, 0, max_pages * sizeof(u32)); memset(pci_gart, 0, max_pages * sizeof(u32));
} else {
for (gart_idx = 0; gart_idx < max_pages; gart_idx++)
DRM_WRITE32(map, gart_idx * sizeof(u32), 0);
}
gart_idx = 0;
for (i = 0; i < pages; i++) { for (i = 0; i < pages; i++) {
/* we need to support large memory configurations */ /* we need to support large memory configurations */
entry->busaddr[i] = pci_map_page(dev->pdev, entry->pagelist[i], entry->busaddr[i] = pci_map_page(dev->pdev, entry->pagelist[i],
...@@ -149,19 +156,26 @@ int drm_ati_pcigart_init(struct drm_device *dev, struct drm_ati_pcigart_info *ga ...@@ -149,19 +156,26 @@ int drm_ati_pcigart_init(struct drm_device *dev, struct drm_ati_pcigart_info *ga
page_base = (u32) entry->busaddr[i]; page_base = (u32) entry->busaddr[i];
for (j = 0; j < (PAGE_SIZE / ATI_PCIGART_PAGE_SIZE); j++) { for (j = 0; j < (PAGE_SIZE / ATI_PCIGART_PAGE_SIZE); j++) {
u32 val;
switch(gart_info->gart_reg_if) { switch(gart_info->gart_reg_if) {
case DRM_ATI_GART_IGP: case DRM_ATI_GART_IGP:
*pci_gart = cpu_to_le32((page_base) | 0xc); val = page_base | 0xc;
break; break;
case DRM_ATI_GART_PCIE: case DRM_ATI_GART_PCIE:
*pci_gart = cpu_to_le32((page_base >> 8) | 0xc); val = (page_base >> 8) | 0xc;
break; break;
default: default:
case DRM_ATI_GART_PCI: case DRM_ATI_GART_PCI:
*pci_gart = cpu_to_le32(page_base); val = page_base;
break; break;
} }
pci_gart++; if (gart_info->gart_table_location ==
DRM_ATI_GART_MAIN)
pci_gart[gart_idx] = cpu_to_le32(val);
else
DRM_WRITE32(map, gart_idx * sizeof(u32), val);
gart_idx++;
page_base += ATI_PCIGART_PAGE_SIZE; page_base += ATI_PCIGART_PAGE_SIZE;
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment