Commit 440c3247 authored by Alex Elder's avatar Alex Elder Committed by David S. Miller

net: ipa: memory region array is variable size

IPA configuration data includes an array of memory region
descriptors.  That was a fixed-size array at one time, but
at some point we started defining it such that it was only
as big as required for a given platform.  The actual number
of entries in the array is recorded in the configuration data
along with the array.

A loop in ipa_mem_config() still assumes the array has entries
for all defined memory region IDs.  As a result, this loop can
go past the end of the actual array and attempt to write
"canary" values based on nonsensical data.

Fix this, by stashing the number of entries in the array, and
using that rather than IPA_MEM_COUNT in the initialization loop
found in ipa_mem_config().

The only remaining use of IPA_MEM_COUNT is in a validation check
to ensure configuration data doesn't have too many entries.
That's fine for now.

Fixes: 3128aae8 ("net: ipa: redefine struct ipa_mem_data")
Signed-off-by: default avatarAlex Elder <elder@linaro.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent bcbda3fc
...@@ -58,6 +58,7 @@ enum ipa_flag { ...@@ -58,6 +58,7 @@ enum ipa_flag {
* @mem_virt: Virtual address of IPA-local memory space * @mem_virt: Virtual address of IPA-local memory space
* @mem_offset: Offset from @mem_virt used for access to IPA memory * @mem_offset: Offset from @mem_virt used for access to IPA memory
* @mem_size: Total size (bytes) of memory at @mem_virt * @mem_size: Total size (bytes) of memory at @mem_virt
* @mem_count: Number of entries in the mem array
* @mem: Array of IPA-local memory region descriptors * @mem: Array of IPA-local memory region descriptors
* @imem_iova: I/O virtual address of IPA region in IMEM * @imem_iova: I/O virtual address of IPA region in IMEM
* @imem_size: Size of IMEM region * @imem_size: Size of IMEM region
...@@ -103,6 +104,7 @@ struct ipa { ...@@ -103,6 +104,7 @@ struct ipa {
void *mem_virt; void *mem_virt;
u32 mem_offset; u32 mem_offset;
u32 mem_size; u32 mem_size;
u32 mem_count;
const struct ipa_mem *mem; const struct ipa_mem *mem;
unsigned long imem_iova; unsigned long imem_iova;
......
...@@ -180,7 +180,7 @@ int ipa_mem_config(struct ipa *ipa) ...@@ -180,7 +180,7 @@ int ipa_mem_config(struct ipa *ipa)
* for the region, write "canary" values in the space prior to * for the region, write "canary" values in the space prior to
* the region's base address. * the region's base address.
*/ */
for (mem_id = 0; mem_id < IPA_MEM_COUNT; mem_id++) { for (mem_id = 0; mem_id < ipa->mem_count; mem_id++) {
const struct ipa_mem *mem = &ipa->mem[mem_id]; const struct ipa_mem *mem = &ipa->mem[mem_id];
u16 canary_count; u16 canary_count;
__le32 *canary; __le32 *canary;
...@@ -487,6 +487,7 @@ int ipa_mem_init(struct ipa *ipa, const struct ipa_mem_data *mem_data) ...@@ -487,6 +487,7 @@ int ipa_mem_init(struct ipa *ipa, const struct ipa_mem_data *mem_data)
ipa->mem_size = resource_size(res); ipa->mem_size = resource_size(res);
/* The ipa->mem[] array is indexed by enum ipa_mem_id values */ /* The ipa->mem[] array is indexed by enum ipa_mem_id values */
ipa->mem_count = mem_data->local_count;
ipa->mem = mem_data->local; ipa->mem = mem_data->local;
ret = ipa_imem_init(ipa, mem_data->imem_addr, mem_data->imem_size); ret = ipa_imem_init(ipa, mem_data->imem_addr, mem_data->imem_size);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment