diff options
| author | Naphtali Sprei <nsprei@redhat.com> | 2009-08-13 15:01:20 +0300 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2009-08-27 19:33:16 -0500 |
| commit | 3f9cb1c14dc368f41447db5f78d6248c4f100ad4 (patch) | |
| tree | 9be48ef2f56680a5ba032f465cb86ca1a4dd33d1 /hw/eepro100.c | |
| parent | 06c79f4ebdddbb55a27e06818eedc614e0e02815 (diff) | |
| download | qemu-3f9cb1c14dc368f41447db5f78d6248c4f100ad4.zip qemu-3f9cb1c14dc368f41447db5f78d6248c4f100ad4.tar.gz qemu-3f9cb1c14dc368f41447db5f78d6248c4f100ad4.tar.bz2 | |
hw/eepro100.c: Use extended TBD only where applicable
Bug fix for segfault when run as i82551 HW:
Use Extended TBD only when HW supports it (i82558 and up).
Added assertions to guard from such buffer overflow
Introduce the MAX_TCB_BYTE_COUNT macro
Allocate buf big enough as HW needs (MAX_ETH_FRAME_SIZE -> MAX_TCB_BYTE_COUNT)
I don't feel 100% OK with the "s->device >= i82558B" condition
since it relies on the numeric (hex) value of those defines, which currently
is correct, but changes (which I don't forsee now) might break it.
Signed-off-by: Naphtali Sprei <nsprei@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'hw/eepro100.c')
| -rw-r--r-- | hw/eepro100.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/hw/eepro100.c b/hw/eepro100.c index 8988b3f..1990264 100644 --- a/hw/eepro100.c +++ b/hw/eepro100.c @@ -715,8 +715,8 @@ static void eepro100_cu_command(EEPRO100State * s, uint8_t val) } else { /* Flexible mode. */ uint8_t tbd_count = 0; - if (!(s->configuration[6] & BIT(4))) { - /* Extended TCB. */ + if ((s->device >= i82558B) && !(s->configuration[6] & BIT(4))) { + /* Extended Flexible TCB. */ assert(tcb_bytes == 0); for (; tbd_count < 2; tbd_count++) { uint32_t tx_buffer_address = ldl_phys(tbd_address); @@ -724,7 +724,7 @@ static void eepro100_cu_command(EEPRO100State * s, uint8_t val) uint16_t tx_buffer_el = lduw_phys(tbd_address + 6); tbd_address += 8; logout - ("TBD (extended mode): buffer address 0x%08x, size 0x%04x\n", + ("TBD (extended flexible mode): buffer address 0x%08x, size 0x%04x\n", tx_buffer_address, tx_buffer_size); cpu_physical_memory_read(tx_buffer_address, &buf[size], tx_buffer_size); |