[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 06/45] hw/arm/musicpal: Remove nonexistent CDTP2, CDT
From: |
Peter Maydell |
Subject: |
[Qemu-devel] [PULL 06/45] hw/arm/musicpal: Remove nonexistent CDTP2, CDTP3 registers |
Date: |
Wed, 26 Feb 2014 18:01:56 +0000 |
The ethernet device in the musicpal only has two tx queues,
but we modelled it with four CTDP registers, presumably a
cut and paste from the rx queue registers. Since the tx_queue[]
array is only 2 entries long this allowed a guest to overrun
this buffer. Remove the nonexistent registers.
Signed-off-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Acked-by: Jan Kiszka <address@hidden>
Cc: address@hidden
---
hw/arm/musicpal.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index 50a3b8f..cce7127 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -92,8 +92,6 @@
#define MP_ETH_CRDP3 0x4AC
#define MP_ETH_CTDP0 0x4E0
#define MP_ETH_CTDP1 0x4E4
-#define MP_ETH_CTDP2 0x4E8
-#define MP_ETH_CTDP3 0x4EC
/* MII PHY access */
#define MP_ETH_SMIR_DATA 0x0000FFFF
@@ -308,7 +306,7 @@ static uint64_t mv88w8618_eth_read(void *opaque, hwaddr
offset,
case MP_ETH_CRDP0 ... MP_ETH_CRDP3:
return s->rx_queue[(offset - MP_ETH_CRDP0)/4];
- case MP_ETH_CTDP0 ... MP_ETH_CTDP3:
+ case MP_ETH_CTDP0 ... MP_ETH_CTDP1:
return s->tx_queue[(offset - MP_ETH_CTDP0)/4];
default:
@@ -362,7 +360,7 @@ static void mv88w8618_eth_write(void *opaque, hwaddr offset,
s->cur_rx[(offset - MP_ETH_CRDP0)/4] = value;
break;
- case MP_ETH_CTDP0 ... MP_ETH_CTDP3:
+ case MP_ETH_CTDP0 ... MP_ETH_CTDP1:
s->tx_queue[(offset - MP_ETH_CTDP0)/4] = value;
break;
}
--
1.9.0
- [Qemu-devel] [PULL 08/45] hw/intc/arm_gic: Fix GIC_SET_LEVEL, (continued)
- [Qemu-devel] [PULL 08/45] hw/intc/arm_gic: Fix GIC_SET_LEVEL, Peter Maydell, 2014/02/26
- [Qemu-devel] [PULL 32/45] target-arm: A64: Implement WFI, Peter Maydell, 2014/02/26
- [Qemu-devel] [PULL 19/45] target-arm: Implement AArch64 TLB invalidate ops, Peter Maydell, 2014/02/26
- [Qemu-devel] [PULL 02/45] hw/net/stellaris_enet: Avoid unintended sign extension, Peter Maydell, 2014/02/26
- [Qemu-devel] [PULL 01/45] hw/misc/arm_sysctl: Fix bad boundary check on mb clock accesses, Peter Maydell, 2014/02/26
- [Qemu-devel] [PULL 09/45] linux-headers: Update from v3.14-rc3, Peter Maydell, 2014/02/26
- [Qemu-devel] [PULL 21/45] target-arm: Implement AArch64 memory attribute registers, Peter Maydell, 2014/02/26
- [Qemu-devel] [PULL 18/45] target-arm: Implement AArch64 cache invalidate/clean ops, Peter Maydell, 2014/02/26
- [Qemu-devel] [PULL 03/45] hw/timer/arm_timer: Avoid array overrun for bad addresses, Peter Maydell, 2014/02/26
- [Qemu-devel] [PULL 07/45] target-arm: Load correct access bits from ARMv5 level 2 page table descriptors, Peter Maydell, 2014/02/26
- [Qemu-devel] [PULL 06/45] hw/arm/musicpal: Remove nonexistent CDTP2, CDTP3 registers,
Peter Maydell <=
- Re: [Qemu-devel] [PULL 00/45] target-arm queue, Peter Maydell, 2014/02/27