From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1MbYzr-0004Fb-I4 for qemu-devel@nongnu.org; Thu, 13 Aug 2009 08:01:32 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1MbYzm-0004Aa-5r for qemu-devel@nongnu.org; Thu, 13 Aug 2009 08:01:30 -0400 Received: from [199.232.76.173] (port=54178 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1MbYzl-0004AK-0k for qemu-devel@nongnu.org; Thu, 13 Aug 2009 08:01:25 -0400 Received: from mx2.redhat.com ([66.187.237.31]:50345) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1MbYzj-00061a-UK for qemu-devel@nongnu.org; Thu, 13 Aug 2009 08:01:24 -0400 Received: from int-mx2.corp.redhat.com (int-mx2.corp.redhat.com [172.16.27.26]) by mx2.redhat.com (8.13.8/8.13.8) with ESMTP id n7DC1M5S018247 for ; Thu, 13 Aug 2009 08:01:22 -0400 Received: from ns3.rdu.redhat.com (ns3.rdu.redhat.com [10.11.255.199]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n7DC1LQk016122 for ; Thu, 13 Aug 2009 08:01:22 -0400 Received: from [10.35.0.60] (dhcp-0-60.tlv.redhat.com [10.35.0.60]) by ns3.rdu.redhat.com (8.13.8/8.13.8) with ESMTP id n7DC1Kit022154 for ; Thu, 13 Aug 2009 08:01:21 -0400 Message-ID: <4A840090.8050304@redhat.com> Date: Thu, 13 Aug 2009 15:01:20 +0300 From: Naphtali Sprei MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] [PATCH] hw/eepro100.c: Use extended TBD only where applicable List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Bug fix for segfault when run as i82551 HW: Use Extended TBD only when HW supports it (i82558 and up). Added assertions to guard from such buffer overflow Introduce the MAX_TCB_BYTE_COUNT macro Allocate buf big enough as HW needs (MAX_ETH_FRAME_SIZE -> MAX_TCB_BYTE_COUNT) I don't feel 100% OK with the "s->device >= i82558B" condition since it relies on the numeric (hex) value of those defines, which currently is correct, but changes (which I don't forsee now) might break it. Signed-off-by: Naphtali Sprei --- hw/eepro100.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/eepro100.c b/hw/eepro100.c index ec31a6a..907c0a1 100644 --- a/hw/eepro100.c +++ b/hw/eepro100.c @@ -715,8 +715,8 @@ static void eepro100_cu_command(EEPRO100State * s, uint8_t val) } else { /* Flexible mode. */ uint8_t tbd_count = 0; - if (!(s->configuration[6] & BIT(4))) { - /* Extended TCB. */ + if ((s->device >= i82558B) && !(s->configuration[6] & BIT(4))) { + /* Extended Flexible TCB. */ assert(tcb_bytes == 0); for (; tbd_count < 2; tbd_count++) { uint32_t tx_buffer_address = ldl_phys(tbd_address); @@ -724,7 +724,7 @@ static void eepro100_cu_command(EEPRO100State * s, uint8_t val) uint16_t tx_buffer_el = lduw_phys(tbd_address + 6); tbd_address += 8; logout - ("TBD (extended mode): buffer address 0x%08x, size 0x%04x\n", + ("TBD (extended flexible mode): buffer address 0x%08x, size 0x%04x\n", tx_buffer_address, tx_buffer_size); cpu_physical_memory_read(tx_buffer_address, &buf[size], tx_buffer_size); -- 1.6.3.3