diff options
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/powerpc/boot/devtree.c | 23 |
1 files changed, 11 insertions, 12 deletions
diff --git a/arch/powerpc/boot/devtree.c b/arch/powerpc/boot/devtree.c index 23492d7fb556..ac4b5ee92d58 100644 --- a/arch/powerpc/boot/devtree.c +++ b/arch/powerpc/boot/devtree.c @@ -123,15 +123,17 @@ static void get_reg_format(void *node, u32 *naddr, u32 *nsize) static void copy_val(u32 *dest, u32 *src, int naddr) { - memset(dest, 0, (MAX_ADDR_CELLS - naddr) * 4); - memcpy(dest, src, naddr * 4); + int pad = MAX_ADDR_CELLS - naddr; + + memset(dest, 0, pad * 4); + memcpy(dest + pad, src, naddr * 4); } static int sub_reg(u32 *reg, u32 *sub) { int i, borrow = 0; - for (i = 0; i < MAX_ADDR_CELLS; i++) { + for (i = MAX_ADDR_CELLS - 1; i >= 0; i--) { int prev_borrow = borrow; borrow = reg[i] < sub[i] + prev_borrow; reg[i] -= sub[i] + prev_borrow; @@ -140,11 +142,11 @@ static int sub_reg(u32 *reg, u32 *sub) return !borrow; } -static int add_reg(u32 *reg, u32 *add) +static int add_reg(u32 *reg, u32 *add, int naddr) { int i, carry = 0; - for (i = 0; i < MAX_ADDR_CELLS; i++) { + for (i = MAX_ADDR_CELLS - 1; i >= MAX_ADDR_CELLS - naddr; i--) { u64 tmp = (u64)reg[i] + add[i] + carry; carry = tmp >> 32; reg[i] = (u32)tmp; @@ -228,7 +230,8 @@ int dt_xlate_reg(void *node, int res, unsigned long *addr, buflen = getprop(node, "reg", buf, sizeof(buf)) / 4; offset = (naddr + nsize) * res; - if (buflen < offset + naddr + nsize) + if (buflen < offset + naddr + nsize || + sizeof(buf) < offset + naddr + nsize) return 0; copy_val(last_addr, buf + offset, naddr); @@ -263,18 +266,14 @@ int dt_xlate_reg(void *node, int res, unsigned long *addr, copy_val(this_addr, buf + offset + prev_naddr, naddr); - if (!add_reg(last_addr, this_addr)) + if (!add_reg(last_addr, this_addr, naddr)) return 0; } if (naddr > 2) return 0; - ret_addr = last_addr[0]; - if (naddr == 2) { - ret_addr <<= 32; - ret_addr |= last_addr[1]; - } + ret_addr = ((u64)last_addr[2] << 32) | last_addr[3]; if (sizeof(void *) == 4 && (ret_addr >= 0x100000000ULL || ret_size > 0x100000000ULL || |