W dniu 24.12.2016 o 18:41, Jean-Christophe DUBOIS pisze:
Le 24/12/2016 à 18:18, mar.krzeminski a écrit :
Hello,
W dniu 24.12.2016 o 16:11, Jean-Christophe Dubois pisze:
It did happen that the internal data buffer was overrun leading to a
Qemu
crash (in particular while emulating the i.MX6 sabrelite board).
This patch makes sure the data array would not be overrun and allow the
sabrelite emulation to run without crash.
Signed-off-by: Jean-Christophe Dubois <j...@tribudubois.net>
---
hw/block/m25p80.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index d29ff4c..a1c4e5d 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -1117,7 +1117,7 @@ static uint32_t m25p80_transfer8(SSISlave *ss,
uint32_t tx)
s->data[s->len] = (uint8_t)tx;
s->len++;
- if (s->len == s->needed_bytes) {
+ if ((s->len >= s->needed_bytes) || (s->len >=
sizeof(s->data))) {
complete_collecting_data(s);
}
break;
Do you have exact scenario that caused the problem?
When booting Xvisor (http://xhypervisor.org/) on top of Qemu emulated
Sabrelite.
During the boot Qemu would segfault while writing to the SPI flash.
Thanks, I'll try to take I look.
Generally it should not happen.
The fact is that there is no protection to make sure the data array is
not overrun.
Yes. IMHO it could be nice to log some error here and reset state
machine instead
of going to next state.
May be it should not happen but it did happen in this case ....
Yeap, but this mean m25p80's state machine goes nuts. Overflow is just a
symptom
that something wrong is going on.
Thanks,
Marcin
JC
Thanks,
Marcin
