diff options
author | Ben Skeggs <bskeggs@redhat.com> | 2016-06-22 12:41:04 +1000 |
---|---|---|
committer | Ben Skeggs <bskeggs@redhat.com> | 2016-07-14 11:53:25 +1000 |
commit | 2f96e8e3e0226d74ca62544d3c9f3558e55b6bb2 (patch) | |
tree | 8f324be15ad5387dc51f0b28d6fafbee850dfe20 /drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c | |
parent | drm/nouveau/bios: guard against out-of-bounds accesses to image (diff) | |
download | linux-dev-2f96e8e3e0226d74ca62544d3c9f3558e55b6bb2.tar.xz linux-dev-2f96e8e3e0226d74ca62544d3c9f3558e55b6bb2.zip |
drm/nouveau/bios: pointers beyond end of first image need special handling
Makes common the code that was previously used by the PMU table parsing,
as it appears other tables need this too.
Not much of an idea what this is all about...
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c')
-rw-r--r-- | drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c | 20 |
1 files changed, 2 insertions, 18 deletions
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c index c268e5afe852..b4a308f3cf7b 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/pmu.c @@ -26,21 +26,6 @@ #include <subdev/bios/image.h> #include <subdev/bios/pmu.h> -static u32 -weirdo_pointer(struct nvkm_bios *bios, u32 data) -{ - struct nvbios_image image; - int idx = 0; - if (nvbios_image(bios, idx++, &image)) { - data -= image.size; - while (nvbios_image(bios, idx++, &image)) { - if (image.type == 0xe0) - return image.base + data; - } - } - return 0; -} - u32 nvbios_pmuTe(struct nvkm_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len) { @@ -50,7 +35,7 @@ nvbios_pmuTe(struct nvkm_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len) if (!bit_entry(bios, 'p', &bit_p)) { if (bit_p.version == 2 && bit_p.length >= 4) data = nvbios_rd32(bios, bit_p.offset + 0x00); - if ((data = weirdo_pointer(bios, data))) { + if (data) { *ver = nvbios_rd08(bios, data + 0x00); /* maybe? */ *hdr = nvbios_rd08(bios, data + 0x01); *len = nvbios_rd08(bios, data + 0x02); @@ -97,8 +82,7 @@ nvbios_pmuRm(struct nvkm_bios *bios, u8 type, struct nvbios_pmuR *info) u32 data; memset(info, 0x00, sizeof(*info)); while ((data = nvbios_pmuEp(bios, idx++, &ver, &hdr, &pmuE))) { - if ( pmuE.type == type && - (data = weirdo_pointer(bios, pmuE.data))) { + if (pmuE.type == type && (data = pmuE.data)) { info->init_addr_pmu = nvbios_rd32(bios, data + 0x08); info->args_addr_pmu = nvbios_rd32(bios, data + 0x0c); info->boot_addr = data + 0x30; |