[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 5/5] net/dp8393x: do not use memory_region_init_rom_d
From: |
Leon Alrae |
Subject: |
[Qemu-devel] [PULL 5/5] net/dp8393x: do not use memory_region_init_rom_device with NULL |
Date: |
Tue, 28 Jul 2015 11:04:48 +0100 |
From: Hervé Poussineau <address@hidden>
Replace memory_region_init_rom_device() with memory_region_init_ram() and
memory_region_set_readonly().
This fixes a guest-triggerable QEMU crash when guest tries to write to PROM.
Signed-off-by: Hervé Poussineau <address@hidden>
address@hidden: shorten subject length]
Signed-off-by: Leon Alrae <address@hidden>
---
hw/net/dp8393x.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 0f45146..ab607e4 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -831,6 +831,7 @@ static void dp8393x_realize(DeviceState *dev, Error **errp)
dp8393xState *s = DP8393X(dev);
int i, checksum;
uint8_t *prom;
+ Error *local_err = NULL;
address_space_init(&s->as, s->dma_mr, "dp8393x");
memory_region_init_io(&s->mmio, OBJECT(dev), &dp8393x_ops, s,
@@ -843,8 +844,13 @@ static void dp8393x_realize(DeviceState *dev, Error **errp)
s->watchdog = timer_new_ns(QEMU_CLOCK_VIRTUAL, dp8393x_watchdog, s);
s->regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */
- memory_region_init_rom_device(&s->prom, OBJECT(dev), NULL, NULL,
- "dp8393x-prom", SONIC_PROM_SIZE, NULL);
+ memory_region_init_ram(&s->prom, OBJECT(dev),
+ "dp8393x-prom", SONIC_PROM_SIZE, &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+ memory_region_set_readonly(&s->prom, true);
prom = memory_region_get_ram_ptr(&s->prom);
checksum = 0;
for (i = 0; i < 6; i++) {
--
2.1.0
- [Qemu-devel] [PULL 0/5] target-mips queue for 2.4, Leon Alrae, 2015/07/28
- [Qemu-devel] [PULL 1/5] target-mips: fix passing incompatible pointer type in machine.c, Leon Alrae, 2015/07/28
- [Qemu-devel] [PULL 3/5] net/dp8393x: disable user creation, Leon Alrae, 2015/07/28
- [Qemu-devel] [PULL 4/5] net/dp8393x: remove check of runt packets, Leon Alrae, 2015/07/28
- [Qemu-devel] [PULL 5/5] net/dp8393x: do not use memory_region_init_rom_device with NULL,
Leon Alrae <=
- [Qemu-devel] [PULL 2/5] target-mips: fix offset calculation for Interrupts, Leon Alrae, 2015/07/28
- Re: [Qemu-devel] [PULL 0/5] target-mips queue for 2.4, Peter Maydell, 2015/07/28