diff options
| author | Patrick Wildt <patrick@cvs.openbsd.org> | 2021-02-25 23:59:55 +0000 |
|---|---|---|
| committer | Patrick Wildt <patrick@cvs.openbsd.org> | 2021-02-25 23:59:55 +0000 |
| commit | 1737041ec89828c0c0c7356faa85f5d33fbc373c (patch) | |
| tree | 05411009e9ad495daa0540014cbd605949a0bd78 /sys/dev | |
| parent | fe9408b2d62a9dc43bbbb70dcdb03271f40200d2 (diff) | |
The firmware replaces the last 32-bit on RAM with a shared DRAM address.
While the for-loop checks that thie value has changed since we wrote to
it, the timeout-condition checked for non-zero, which is wrong. This
means that we didn't realize the firmware wasn't started. While there,
make sure the shared DRAM address is inside the chip's address space.
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/pci/if_bwfm_pci.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/sys/dev/pci/if_bwfm_pci.c b/sys/dev/pci/if_bwfm_pci.c index 848869694b8..079b984a2fd 100644 --- a/sys/dev/pci/if_bwfm_pci.c +++ b/sys/dev/pci/if_bwfm_pci.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_bwfm_pci.c,v 1.42 2021/02/25 23:55:41 patrick Exp $ */ +/* $OpenBSD: if_bwfm_pci.c,v 1.43 2021/02/25 23:59:54 patrick Exp $ */ /* * Copyright (c) 2010-2016 Broadcom Corporation * Copyright (c) 2017 Patrick Wildt <patrick@blueri.se> @@ -788,10 +788,16 @@ bwfm_pci_load_microcode(struct bwfm_pci_softc *sc, const u_char *ucode, size_t s if (shared != written) break; } - if (!shared) { + if (shared == written) { printf("%s: firmware did not come up\n", DEVNAME(sc)); return 1; } + if (shared < bwfm->sc_chip.ch_rambase || + shared >= bwfm->sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize) { + printf("%s: invalid shared RAM address 0x%08x\n", DEVNAME(sc), + shared); + return 1; + } sc->sc_shared_address = shared; return 0; |