summaryrefslogtreecommitdiff
path: root/src/dev/arm/gic_pl390.cc
diff options
context:
space:
mode:
authorMitch Hayenga <mitch.hayenga@arm.com>2014-09-03 07:42:27 -0400
committerMitch Hayenga <mitch.hayenga@arm.com>2014-09-03 07:42:27 -0400
commit71769d2d7b094580b7a4437bf8d8e1401c418c4d (patch)
treed2f5e24de054e80b5ef8d396ef828469cb3f9ea9 /src/dev/arm/gic_pl390.cc
parent87f6034462d06c7921ebe7f8e4ab78db5a09d319 (diff)
downloadgem5-71769d2d7b094580b7a4437bf8d8e1401c418c4d.tar.xz
dev: Avoid invalid sized reads in PL390 with DPRINTF enabled
The first DPRINTF() in PL390::writeDistributor always read a uint32_t, though a packet may have only been 1 or 2 bytes. This caused an assertion in packet->get().
Diffstat (limited to 'src/dev/arm/gic_pl390.cc')
-rw-r--r--src/dev/arm/gic_pl390.cc19
1 files changed, 18 insertions, 1 deletions
diff --git a/src/dev/arm/gic_pl390.cc b/src/dev/arm/gic_pl390.cc
index 7fc65b2b7..b93cdd028 100644
--- a/src/dev/arm/gic_pl390.cc
+++ b/src/dev/arm/gic_pl390.cc
@@ -395,8 +395,25 @@ Pl390::writeDistributor(PacketPtr pkt)
assert(pkt->req->hasContextId());
int ctx_id = pkt->req->contextId();
+ uint32_t pkt_data M5_VAR_USED;
+ switch (pkt->getSize())
+ {
+ case 1:
+ pkt_data = pkt->get<uint8_t>();
+ break;
+ case 2:
+ pkt_data = pkt->get<uint16_t>();
+ break;
+ case 4:
+ pkt_data = pkt->get<uint32_t>();
+ break;
+ default:
+ panic("Invalid size when writing to priority regs in Gic: %d\n",
+ pkt->getSize());
+ }
+
DPRINTF(GIC, "gic distributor write register %#x size %#x value %#x \n",
- daddr, pkt->getSize(), pkt->get<uint32_t>());
+ daddr, pkt->getSize(), pkt_data);
if (daddr >= ICDISER_ST && daddr < ICDISER_ED + 4) {
assert((daddr-ICDISER_ST) >> 2 < 32);