The Linux radeon KMS driver does an additional check when looking up COMBIOS
table entries. It checks a header size field to validate that the entry
falls in the header region. Prior to this patch that size field is zero
which causes the driver to fall back to another method (CLOCK_CNTL
registers) also resulting in bad values and a division by zero.

Tested on Debian Squeeze (Linux 2.6.32) and Debian Trixie (Linux 6.12.94)
with:

qemu-system-x86_64 -vga none -device ati-vga,model=rv100,vgamem_mb=32

Signed-off-by: Chad Jablonski <chad@jablonski.xyz>
---
 vgasrc/atiext.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/vgasrc/atiext.c b/vgasrc/atiext.c
index f003eea8..44c9afa0 100644
--- a/vgasrc/atiext.c
+++ b/vgasrc/atiext.c
@@ -347,7 +347,9 @@ static void ati_i2c_edid_rage128(void)
 // radeonfb needs the pll information, otherwise it'll crash with a
 // division by zero ...
 struct ati_main_table_s {
-    u8 pad_0[48];
+    u8 pad_0[6];
+    u8 size;
+    u8 pad_7[41];
     u16 pll_table;
     u8 pad_50[30];
     u16 connector_table;
@@ -374,7 +376,9 @@ struct ati_connector_table_s {
 } PACKED;
 
 extern u16 _rom_header_ati_table_anchor;
-static struct ati_main_table_s ati_main_table VAR16 __aligned(16);
+static struct ati_main_table_s ati_main_table VAR16 __aligned(16) = {
+    .size = sizeof(struct ati_main_table_s),
+};
 static struct ati_pll_table_s ati_pll_table VAR16 __aligned(16) = {
     .sclk = 23000,
     .mclk = 23000,
-- 
2.54.0

_______________________________________________
SeaBIOS mailing list -- seabios@seabios.org
To unsubscribe send an email to seabios-leave@seabios.org