Commit 3f9cb1c1 authored by Naphtali Sprei's avatar Naphtali Sprei Committed by Anthony Liguori
Browse files

hw/eepro100.c: Use extended TBD only where applicable 



Bug fix for segfault when run as i82551 HW:
Use Extended TBD only when HW supports it (i82558 and up).

Added assertions to guard from such buffer overflow
Introduce the MAX_TCB_BYTE_COUNT macro
Allocate buf big enough as HW needs (MAX_ETH_FRAME_SIZE -> MAX_TCB_BYTE_COUNT)

I don't feel 100% OK with the "s->device >= i82558B" condition
since it relies on the numeric (hex) value of those defines, which currently
is correct, but changes (which I don't forsee now) might break it.

Signed-off-by: default avatarNaphtali Sprei <nsprei@redhat.com>
Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
parent 06c79f4e

hw/eepro100.c

+3 −3
Original line number Diff line number Diff line
@@ -715,8 +715,8 @@ static void eepro100_cu_command(EEPRO100State * s, uint8_t val) 
            } else {

                /* Flexible mode. */

                uint8_t tbd_count = 0;

                if (!(s->configuration[6] & BIT(4))) {

                    /* Extended TCB. */

                if ((s->device >= i82558B) && !(s->configuration[6] & BIT(4))) {

                    /* Extended Flexible TCB. */

                    assert(tcb_bytes == 0);

                    for (; tbd_count < 2; tbd_count++) {

                        uint32_t tx_buffer_address = ldl_phys(tbd_address);
@@ -724,7 +724,7 @@ static void eepro100_cu_command(EEPRO100State * s, uint8_t val) 
                        uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);

                        tbd_address += 8;

                        logout

                            ("TBD (extended mode): buffer address 0x%08x, size 0x%04x\n",

                            ("TBD (extended flexible mode): buffer address 0x%08x, size 0x%04x\n",

                             tx_buffer_address, tx_buffer_size);

                        cpu_physical_memory_read(tx_buffer_address, &buf[size],

                                                 tx_buffer_size);