david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hw/arm/boot: pass an address limit to and return size from load_dtb()

Browse Source 
Add an address limit input parameter to load_dtb() so that we can
tell load_dtb() how much memory the dtb is allowed to consume. If
the dtb doesn't fit, return 0, otherwise return the actual size of
the loaded dtb.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Message-id: 1410453915-9344-3-git-send-email-ard.biesheuvel@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Ard Biesheuvel 2014-09-12 14:06:50 +01:00 committed by Peter Maydell
parent 4c4bf65474
commit fee8ea12eb
1 changed files with 31 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
hw/arm/boot.c
View File

@ -312,7 +312,26 @@ static void set_kernel_args_old(const struct arm_boot_info *info)
} }
} }
static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo) /**
* load_dtb() - load a device tree binary image into memory
* @addr: the address to load the image at
* @binfo: struct describing the boot environment
* @addr_limit: upper limit of the available memory area at @addr
*
* Load a device tree supplied by the machine or by the user with the
* '-dtb' command line option, and put it at offset @addr in target
* memory.
*
* If @addr_limit contains a meaningful value (i.e., it is strictly greater
* than @addr), the device tree is only loaded if its size does not exceed
* the limit.
*
* Returns: the size of the device tree image on success,
* 0 if the image size exceeds the limit,
* -1 on errors.
*/
static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
hwaddr addr_limit)
{ {
void *fdt = NULL; void *fdt = NULL;
int size, rc; int size, rc;
@ -341,6 +360,15 @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo)
} }
} }
if (addr_limit > addr && size > (addr_limit - addr)) {
/* Installing the device tree blob at addr would exceed addr_limit.
* Whether this constitutes failure is up to the caller to decide,
* so just return 0 as size, i.e., no error.
*/
g_free(fdt);
return 0;
}
acells = qemu_fdt_getprop_cell(fdt, "/", "#address-cells"); acells = qemu_fdt_getprop_cell(fdt, "/", "#address-cells");
scells = qemu_fdt_getprop_cell(fdt, "/", "#size-cells"); scells = qemu_fdt_getprop_cell(fdt, "/", "#size-cells");
if (acells == 0 || scells == 0) { if (acells == 0 || scells == 0) {
@ -403,7 +431,7 @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo)
g_free(fdt); g_free(fdt);
return 0; return size;
fail: fail:
g_free(fdt); g_free(fdt);
@ -572,7 +600,7 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
*/ */
hwaddr dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size, hwaddr dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
4096); 4096);
if (load_dtb(dtb_start, info)) { if (load_dtb(dtb_start, info, 0) < 0) {
exit(1); exit(1);
} }
fixupcontext[FIXUP_ARGPTR] = dtb_start; fixupcontext[FIXUP_ARGPTR] = dtb_start;