diff options
| author | Jonathan Zhang <jonzhang@meta.com> | 2022-11-07 17:30:14 -0800 |
|---|---|---|
| committer | Felix Held <felix-coreboot@felixheld.de> | 2022-11-11 00:36:40 +0000 |
| commit | d5d9b280de718f0d5e458b227f3684ec7a7a1d3c (patch) | |
| tree | cbbbb96755e9f05c3c3edcc7c17ef2708dfce4be /src | |
| parent | aba1c945cd44332521df49228b883c7081723812 (diff) | |
acpi/acpi.c: Fix einj generation pointer arithmetics
Without a cast the aritmetics of
tat = einj + sizeof(acpi_einj_smi_t)
is the same as
tat = (uintptr_t)einj + size(acpi_einj_smi_t) * size(acpi_einj_smi_t)
So it overshoots the intended offset by a lot.
This issue only came apparent because now einj is in the small IMD
region which is close to TSEG. With the wrong aritmetics the tat
pointer ended up inside TSEG which is not accessible from the OS
causing exceptions.
TEST: observe that tat pointer is inside the small IMD below
TSEG (0x78000000 on our setup).
"acpi_create_einj trigger_action_table = 0x77ffe89c"
Change-Id: I3ab64b95c33eef01b2048816a21e17855bcb2f54
Signed-off-by: Arthur Heymans <arthur.heymans@9elements.com>
Signed-off-by: Jonathan Zhang <jonzhang@meta.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/69326
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Marc Jones <marc@marcjonesconsulting.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/acpi/acpi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/acpi/acpi.c b/src/acpi/acpi.c index 3ddb1d02ed..e1d40881c2 100644 --- a/src/acpi/acpi.c +++ b/src/acpi/acpi.c @@ -888,7 +888,7 @@ void acpi_create_einj(acpi_einj_t *einj, uintptr_t addr, u8 actions) printk(BIOS_DEBUG, "%s einj_smi = %p\n", __func__, einj_smi); memset(einj_smi, 0, sizeof(acpi_einj_smi_t)); - tat = (acpi_einj_trigger_table_t *)(einj_smi + sizeof(acpi_einj_smi_t)); + tat = (acpi_einj_trigger_table_t *)((uint8_t *)einj_smi + sizeof(acpi_einj_smi_t)); tat->header_size = 16; tat->revision = 0; tat->table_size = sizeof(acpi_einj_trigger_table_t) + |