disp/nv50-: audit and version SOR_DP_PWR method

The full object interfaces are about to be exposed to userspace, so we
need to check for any security-related issues and version the structs
to make it easier to handle any changes we may need in the future.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

9 files changed, 41 insertions, 74 deletions

diff --git a/drm/nv50_display.c b/drm/nv50_display.c
index ac80bdc7c..844fc4ee7 100644
--- a/drm/nv50_display.c
+++ b/drm/nv50_display.c
@@ -1785,9 +1785,18 @@ nv50_sor_dpms(struct drm_encoder *encoder, int mode)
 		.base.hashm  = nv_encoder->dcb->hashm,
 		.pwr.state = mode == DRM_MODE_DPMS_ON,
 	};
+	struct {
+		struct nv50_disp_mthd_v1 base;
+		struct nv50_disp_sor_dp_pwr_v0 pwr;
+	} link = {
+		.base.version = 1,
+		.base.method = NV50_DISP_MTHD_V1_SOR_DP_PWR,
+		.base.hasht  = nv_encoder->dcb->hasht,
+		.base.hashm  = nv_encoder->dcb->hashm,
+		.pwr.state = mode == DRM_MODE_DPMS_ON,
+	};
 	struct drm_device *dev = encoder->dev;
 	struct drm_encoder *partner;
-	u32 mthd, data;
 
 	nv_encoder->last_dpms = mode;
 
@@ -1805,16 +1814,10 @@ nv50_sor_dpms(struct drm_encoder *encoder, int mode)
 		}
 	}
 
-	mthd  = (ffs(nv_encoder->dcb->heads) - 1) << 3;
-	mthd |= (ffs(nv_encoder->dcb->sorconf.link) - 1) << 2;
-	mthd |= nv_encoder->or;
-
 	if (nv_encoder->dcb->type == DCB_OUTPUT_DP) {
 		args.pwr.state = 1;
 		nvif_mthd(disp->disp, 0, &args, sizeof(args));
-		data  = (mode == DRM_MODE_DPMS_ON);
-		mthd |= NV94_DISP_SOR_DP_PWR;
-		nvif_exec(disp->disp, mthd, &data, sizeof(data));
+		nvif_mthd(disp->disp, 0, &link, sizeof(link));
 	} else {
 		nvif_mthd(disp->disp, 0, &args, sizeof(args));
 	}
diff --git a/nvif/class.h b/nvif/class.h
index a3d433859..e0d45faa4 100644
--- a/nvif/class.h
+++ b/nvif/class.h
@@ -367,4 +367,10 @@ struct nv50_disp_sor_lvds_script_v0 {
 	__u8  pad04[4];
 };
 
+struct nv50_disp_sor_dp_pwr_v0 {
+	__u8  version;
+	__u8  state;
+	__u8  pad02[6];
+};
+
 #endif
diff --git a/nvkm/engine/disp/nv50.c b/nvkm/engine/disp/nv50.c
index 93e06ae67..ed55cc296 100644
--- a/nvkm/engine/disp/nv50.c
+++ b/nvkm/engine/disp/nv50.c
@@ -928,6 +928,30 @@ nv50_disp_base_mthd(struct nouveau_object *object, u32 mthd,
 			return ret;
 	}
 		break;
+	case NV50_DISP_MTHD_V1_SOR_DP_PWR: {
+		struct nvkm_output_dp *outpdp = (void *)outp;
+		union {
+			struct nv50_disp_sor_dp_pwr_v0 v0;
+		} *args = data;
+		nv_ioctl(object, "disp sor dp pwr size %d\n", size);
+		if (nvif_unpack(args->v0, 0, 0, false)) {
+			nv_ioctl(object, "disp sor dp pwr vers %d state %d\n",
+				 args->v0.version, args->v0.state);
+			if (args->v0.state == 0) {
+				nvkm_notify_put(&outpdp->irq);
+				((struct nvkm_output_dp_impl *)nv_oclass(outp))
+					->lnk_pwr(outpdp, 0);
+				atomic_set(&outpdp->lt.done, 0);
+				return 0;
+			} else
+			if (args->v0.state != 0) {
+				nvkm_output_dp_train(&outpdp->base, 0, true);
+				return 0;
+			}
+		} else
+			return ret;
+	}
+		break;
 	default:
 		break;
 	}
diff --git a/nvkm/engine/disp/nv50.h b/nvkm/engine/disp/nv50.h
index a9c8e19d0..ec623b731 100644
--- a/nvkm/engine/disp/nv50.h
+++ b/nvkm/engine/disp/nv50.h
@@ -77,7 +77,6 @@ int nv84_hdmi_ctrl(NV50_DISP_MTHD_V1);
 int nva3_hdmi_ctrl(NV50_DISP_MTHD_V1);
 int nvd0_hdmi_ctrl(NV50_DISP_MTHD_V1);
 
-int nv50_sor_mthd(struct nouveau_object *, u32, void *, u32);
 int nv50_sor_power(NV50_DISP_MTHD_V1);
 
 int nv94_sor_dp_train_init(struct nv50_disp_priv *, int, int, int, u16, u16,
diff --git a/nvkm/engine/disp/nv94.c b/nvkm/engine/disp/nv94.c
index f926e967f..821084da7 100644
--- a/nvkm/engine/disp/nv94.c
+++ b/nvkm/engine/disp/nv94.c
@@ -74,7 +74,6 @@ nv94_disp_sclass[] = {
 static struct nouveau_omthds
 nv94_disp_base_omthds[] = {
 	{ HEAD_MTHD(NV50_DISP_SCANOUTPOS)     , nv50_disp_base_scanoutpos },
-	{ SOR_MTHD(NV94_DISP_SOR_DP_PWR)      , nv50_sor_mthd },
 	{ PIOR_MTHD(NV50_DISP_PIOR_PWR)       , nv50_pior_mthd },
 	{ PIOR_MTHD(NV50_DISP_PIOR_TMDS_PWR)  , nv50_pior_mthd },
 	{ PIOR_MTHD(NV50_DISP_PIOR_DP_PWR)    , nv50_pior_mthd },
diff --git a/nvkm/engine/disp/nva3.c b/nvkm/engine/disp/nva3.c
index e87ee1eee..cd887166f 100644
--- a/nvkm/engine/disp/nva3.c
+++ b/nvkm/engine/disp/nva3.c
@@ -46,7 +46,6 @@ nva3_disp_sclass[] = {
 static struct nouveau_omthds
 nva3_disp_base_omthds[] = {
 	{ HEAD_MTHD(NV50_DISP_SCANOUTPOS)     , nv50_disp_base_scanoutpos },
-	{ SOR_MTHD(NV94_DISP_SOR_DP_PWR)      , nv50_sor_mthd },
 	{ PIOR_MTHD(NV50_DISP_PIOR_PWR)       , nv50_pior_mthd },
 	{ PIOR_MTHD(NV50_DISP_PIOR_TMDS_PWR)  , nv50_pior_mthd },
 	{ PIOR_MTHD(NV50_DISP_PIOR_DP_PWR)    , nv50_pior_mthd },
diff --git a/nvkm/engine/disp/nvd0.c b/nvkm/engine/disp/nvd0.c
index bceb7bd2c..c9a3b5803 100644
--- a/nvkm/engine/disp/nvd0.c
+++ b/nvkm/engine/disp/nvd0.c
@@ -712,7 +712,6 @@ nvd0_disp_base_ofuncs = {
 struct nouveau_omthds
 nvd0_disp_base_omthds[] = {
 	{ HEAD_MTHD(NV50_DISP_SCANOUTPOS)     , nvd0_disp_base_scanoutpos },
-	{ SOR_MTHD(NV94_DISP_SOR_DP_PWR)      , nv50_sor_mthd },
 	{ PIOR_MTHD(NV50_DISP_PIOR_PWR)       , nv50_pior_mthd },
 	{ PIOR_MTHD(NV50_DISP_PIOR_TMDS_PWR)  , nv50_pior_mthd },
 	{ PIOR_MTHD(NV50_DISP_PIOR_DP_PWR)    , nv50_pior_mthd },
diff --git a/nvkm/engine/disp/sornv50.c b/nvkm/engine/disp/sornv50.c
index 25344feb9..7b32821f3 100644
--- a/nvkm/engine/disp/sornv50.c
+++ b/nvkm/engine/disp/sornv50.c
@@ -57,54 +57,3 @@ nv50_sor_power(NV50_DISP_MTHD_V1)
 	nv_wait(priv, 0x61c030 + soff, 0x10000000, 0x00000000);
 	return 0;
 }
-
-int
-nv50_sor_mthd(struct nouveau_object *object, u32 mthd, void *args, u32 size)
-{
-	struct nv50_disp_priv *priv = (void *)object->engine;
-	const u8  type = (mthd & NV50_DISP_SOR_MTHD_TYPE) >> 12;
-	const u8  head = (mthd & NV50_DISP_SOR_MTHD_HEAD) >> 3;
-	const u8  link = (mthd & NV50_DISP_SOR_MTHD_LINK) >> 2;
-	const u8    or = (mthd & NV50_DISP_SOR_MTHD_OR);
-	const u16 mask = (0x0100 << head) | (0x0040 << link) | (0x0001 << or);
-	struct nvkm_output *outp = NULL, *temp;
-	u32 data;
-	int ret = -EINVAL;
-
-	if (size < sizeof(u32))
-		return -EINVAL;
-	data = *(u32 *)args;
-
-	list_for_each_entry(temp, &priv->base.outp, head) {
-		if ((temp->info.hasht & 0xff) == type &&
-		    (temp->info.hashm & mask) == mask) {
-			outp = temp;
-			break;
-		}
-	}
-
-	switch (mthd & ~0x3f) {
-	case NV94_DISP_SOR_DP_PWR:
-		if (outp) {
-			struct nvkm_output_dp *outpdp = (void *)outp;
-			switch (data) {
-			case NV94_DISP_SOR_DP_PWR_STATE_OFF:
-				nvkm_notify_put(&outpdp->irq);
-				((struct nvkm_output_dp_impl *)nv_oclass(outp))
-					->lnk_pwr(outpdp, 0);
-				atomic_set(&outpdp->lt.done, 0);
-				break;
-			case NV94_DISP_SOR_DP_PWR_STATE_ON:
-				nvkm_output_dp_train(&outpdp->base, 0, true);
-				break;
-			default:
-				return -EINVAL;
-			}
-		}
-		break;
-	default:
-		BUG_ON(1);
-	}
-
-	return ret;
-}
diff --git a/nvkm/include/core/class.h b/nvkm/include/core/class.h
index d63edc73a..89dd80e50 100644
--- a/nvkm/include/core/class.h
+++ b/nvkm/include/core/class.h
@@ -53,17 +53,6 @@ struct nv04_display_scanoutpos {
 
 #define NV50_DISP_SCANOUTPOS                                         0x00000000
 
-#define NV50_DISP_SOR_MTHD                                           0x00010000
-#define NV50_DISP_SOR_MTHD_TYPE                                      0x0000f000
-#define NV50_DISP_SOR_MTHD_HEAD                                      0x00000018
-#define NV50_DISP_SOR_MTHD_LINK                                      0x00000004
-#define NV50_DISP_SOR_MTHD_OR                                        0x00000003
-
-#define NV94_DISP_SOR_DP_PWR                                         0x00016000
-#define NV94_DISP_SOR_DP_PWR_STATE                                   0x00000001
-#define NV94_DISP_SOR_DP_PWR_STATE_OFF                               0x00000000
-#define NV94_DISP_SOR_DP_PWR_STATE_ON                                0x00000001
-
 #define NV50_DISP_PIOR_MTHD                                          0x00030000
 #define NV50_DISP_PIOR_MTHD_TYPE                                     0x0000f000
 #define NV50_DISP_PIOR_MTHD_OR                                       0x00000003