Kyösti Mälkki (kyosti.malkki@gmail.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/4522
-gerrit
commit 99e7cb4f1d685c5887642a3e523d1fa705e61f9a Author: Kyösti Mälkki kyosti.malkki@gmail.com Date: Thu Dec 12 06:50:21 2013 +0200
cpu/amd (non-AGESA): Fix CPU id_mapping_table
In case a matching item is not in the array, the invalid use of sizeof will cause access beyond the end of array.
Change-Id: I2be6d8f046d06702be21ed0155529c1bf41ede26 Signed-off-by: Kyösti Mälkki kyosti.malkki@gmail.com --- src/cpu/amd/model_10xxx/update_microcode.c | 47 +++++++-------- src/cpu/amd/model_fxx/model_fxx_update_microcode.c | 70 ++++++++++------------ 2 files changed, 56 insertions(+), 61 deletions(-)
diff --git a/src/cpu/amd/model_10xxx/update_microcode.c b/src/cpu/amd/model_10xxx/update_microcode.c index 95624e9..dcaaf18 100644 --- a/src/cpu/amd/model_10xxx/update_microcode.c +++ b/src/cpu/amd/model_10xxx/update_microcode.c @@ -18,6 +18,7 @@ */
#include <stdint.h> +#include <stdlib.h> #include <console/console.h> #include <cpu/amd/microcode.h>
@@ -56,38 +57,36 @@ static const u8 microcode_updates[] __attribute__ ((aligned(16))) = { 0x0, 0x0, 0x0, 0x0, };
-static u32 get_equivalent_processor_rev_id(u32 orig_id) { - static unsigned id_mapping_table[] = { - 0x100f00, 0x1000, - 0x100f01, 0x1000, - 0x100f02, 0x1000, - 0x100f20, 0x1020, - 0x100f21, 0x1020, - 0x100f2A, 0x1020, - 0x100f22, 0x1022, - 0x100f23, 0x1022, - 0x100f42, 0x1041, - 0x100f43, 0x1043, - 0x100f62, 0x1062, - 0x100f63, 0x1043, - 0x100f81, 0x1081, - 0x100fa0, 0x10A0, - }; +static const u32 id_mapping_table[] = { + 0x100f00, 0x1000, + 0x100f01, 0x1000, + 0x100f02, 0x1000, + 0x100f20, 0x1020, + 0x100f21, 0x1020, + 0x100f2A, 0x1020, + 0x100f22, 0x1022, + 0x100f23, 0x1022, + 0x100f42, 0x1041, + 0x100f43, 0x1043, + 0x100f62, 0x1062, + 0x100f63, 0x1043, + 0x100f81, 0x1081, + 0x100fa0, 0x10A0, +}; +#define ID_MAPPING_TABLE_LEN ARRAY_SIZE(id_mapping_table)
- u32 new_id; +static unsigned get_equivalent_processor_rev_id(unsigned orig_id) +{ + unsigned new_id = 0; int i;
- new_id = 0; - - for (i = 0; i < sizeof(id_mapping_table); i += 2 ) { - if(id_mapping_table[i]==orig_id) { + for (i = 0; i < ID_MAPPING_TABLE_LEN; i += 2) { + if (id_mapping_table[i]==orig_id) { new_id = id_mapping_table[i + 1]; break; } } - return new_id; - }
void update_microcode(u32 cpu_deviceid) diff --git a/src/cpu/amd/model_fxx/model_fxx_update_microcode.c b/src/cpu/amd/model_fxx/model_fxx_update_microcode.c index 4a53fea..3e3afc6 100644 --- a/src/cpu/amd/model_fxx/model_fxx_update_microcode.c +++ b/src/cpu/amd/model_fxx/model_fxx_update_microcode.c @@ -19,6 +19,8 @@ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */
+#include <stdint.h> +#include <stdlib.h> #include <console/console.h> #include <cpu/amd/microcode.h>
@@ -40,49 +42,43 @@ static uint8_t microcode_updates[] __attribute__ ((aligned(16))) = { 0x0, 0x0, 0x0, 0x0, };
-static unsigned get_equivalent_processor_rev_id(unsigned orig_id) { - static unsigned id_mapping_table[] = { - #if !CONFIG_K8_REV_F_SUPPORT - 0x0f48, 0x0048, - 0x0f58, 0x0048, - - 0x0f4a, 0x004a, - 0x0f5a, 0x004a, - 0x0f7a, 0x004a, - 0x0f82, 0x004a, - 0x0fc0, 0x004a, - 0x0ff0, 0x004a, - - 0x10f50, 0x0150, - 0x10f70, 0x0150, - 0x10f80, 0x0150, - 0x10fc0, 0x0150, - 0x10ff0, 0x0150, - - 0x20f10, 0x0210, - 0x20f12, 0x0210, - 0x20f32, 0x0210, - 0x20fb1, 0x0210, - #endif - - #if CONFIG_K8_REV_F_SUPPORT - - #endif - - }; +static const u32 id_mapping_table[] = { +#if !CONFIG_K8_REV_F_SUPPORT + 0x0f48, 0x0048, + 0x0f58, 0x0048, + + 0x0f4a, 0x004a, + 0x0f5a, 0x004a, + 0x0f7a, 0x004a, + 0x0f82, 0x004a, + 0x0fc0, 0x004a, + 0x0ff0, 0x004a, + + 0x10f50, 0x0150, + 0x10f70, 0x0150, + 0x10f80, 0x0150, + 0x10fc0, 0x0150, + 0x10ff0, 0x0150, + + 0x20f10, 0x0210, + 0x20f12, 0x0210, + 0x20f32, 0x0210, + 0x20fb1, 0x0210, +#endif +}; +#define ID_MAPPING_TABLE_LEN ARRAY_SIZE(id_mapping_table)
- unsigned new_id; +static unsigned get_equivalent_processor_rev_id(unsigned orig_id) +{ + unsigned new_id = 0; int i;
- new_id = 0; - - for(i=0; i<sizeof(id_mapping_table); i+=2 ) { - if(id_mapping_table[i]==orig_id) { - new_id = id_mapping_table[i+1]; + for (i = 0; i < ID_MAPPING_TABLE_LEN; i += 2) { + if (id_mapping_table[i]==orig_id) { + new_id = id_mapping_table[i + 1]; break; } } - return new_id; }