From nobody Sat May 18 05:53:01 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linaro.org ARC-Seal: i=1; a=rsa-sha256; t=1712573593; cv=none; d=zohomail.com; s=zohoarc; b=AdbR9ejBVKWygpyem3dSy0ZahDqzj+d8df+jUZIW32/Vcp8PJh1AVp+/J6pJVk4Y3qy1B6Cgi0GfNk9LFPBClRn8HeMuo2NQHicd4cyXVf+rAonlUDCPaC2povvn9WzbBc0NRQ5/EekfxZc7+NCpJJ9B1+PVi537JzU9Mj3KYWk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1712573593; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=MNFkEWahBP6+0XNPWOMbRiFKrOw7mESIctQanLUg3j4=; b=G1rYt5xteHDJLcyyhmDrp2tXl+3yqGLo76VzkW0tfJOBynpTIZobp7jMl5uDo3Eaw4kFS2cfGfR28mMVUlJwoNxvzpkaeMdH0IE13VOefR7F/S3GY7xNmmhPRmAxhXAyzymkZKYFfUXFCjr7OFbDycHVDTHET/RRvOe70wlq640= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1712573593772847.2160176986805; Mon, 8 Apr 2024 03:53:13 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rtmbf-0002ra-BW; Mon, 08 Apr 2024 06:52:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rtmba-0002qP-Jw for qemu-devel@nongnu.org; Mon, 08 Apr 2024 06:52:05 -0400 Received: from mail-lj1-x235.google.com ([2a00:1450:4864:20::235]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1rtmbY-0007r0-Dr for qemu-devel@nongnu.org; Mon, 08 Apr 2024 06:52:01 -0400 Received: by mail-lj1-x235.google.com with SMTP id 38308e7fff4ca-2d6fc3adaacso54378891fa.2 for ; Mon, 08 Apr 2024 03:51:59 -0700 (PDT) Received: from m1x-phil.lan ([176.176.144.67]) by smtp.gmail.com with ESMTPSA id y13-20020a5d4acd000000b00343eac2acc4sm8044440wrs.111.2024.04.08.03.51.56 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 08 Apr 2024 03:51:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1712573518; x=1713178318; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=MNFkEWahBP6+0XNPWOMbRiFKrOw7mESIctQanLUg3j4=; b=v7sk+vPQQqcBIBr9wBaYl8id6gWxDAMt2HxYjO7j0vHBY2ynPyXJsSLHr+bnvW1hsa 8xARVyNmH+c7KvYRgXFA+JSPVyCd4MXX0sJNJL6FpMek/zO9z3IM9xjDvilFX3kCVewp lT1bYwWI4M6uYzZAhdYYMySXBCtDg+1Q6/fyk+BodgVMDxAIRU+oQr12oE+6U7/0hiFa WEuJTacypyO8zYkgLvqcAO01uksNE0uHfjpwv/I/jJxhJj941zwSfrCxtc7/hDwuVSzM vErmfb3QlBLQmqW2OcRE4I0aNVeSc24lbNnrUWKA5IFVVZdfRG2HCtXhsMurz1hEx2c/ 7xRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712573518; x=1713178318; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=MNFkEWahBP6+0XNPWOMbRiFKrOw7mESIctQanLUg3j4=; b=ejIAC/6JzpeVQW/bHGWuIrGK96Dj1DZyaiCJHNxQ/GP7yMBxG12BsKuWUNH+q7RKNJ xHRtWBCL+nneh5jtrvFMA6GlbXqyvsSDU0yjFfSB8BYSm7zoW2Bz40KD8r1lJb9DcID0 nm0f/SD+tPCK8YvYXUhZb0HFpa3l7WzhXNOsR0iH191nkCqiKlAQhJRgaj2QHdVSh1Hx WN2ZgMN70Rp+Shk4YkMsfXzRt7lXS4bHEQ+5g1D25iNNNZo+sMUXC0UPu68qrIFGenx7 +8YOxJYaqdhVRtXB+QeYjq1TIovwwasb+CQ9GsJguFqYKh7xiQJBZOn9DXX98OMHNf1j Popw== X-Gm-Message-State: AOJu0Yy33A85AjLg5uTMKAjB/z/cChGWy7OwTHUac8lgKniFkvNNYkkn MwrUrEYvZkBNdHic8W8VOM+QwugZFymmjN+ot2aAIjnIzVGarf1U9zPXcgxcCGdMdg8j0BwKQY8 H X-Google-Smtp-Source: AGHT+IGuU114wAEJj6GTy0xj0eSHS45aOJ0lyqmd3sNchGCSh5YOJbulHyRvt04fKkf7lD3WruBIkg== X-Received: by 2002:a05:6512:554:b0:513:da61:9b46 with SMTP id h20-20020a056512055400b00513da619b46mr5192172lfl.53.1712573518197; Mon, 08 Apr 2024 03:51:58 -0700 (PDT) From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Cc: Jason Wang , Alexander Bulekov , qemu-arm@nongnu.org, Chuhong Yuan , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [PATCH-for-9.0? 1/2] hw/net/lan9118: Replace magic '2048' value by 'PKT_SIZE' definition Date: Mon, 8 Apr 2024 12:51:48 +0200 Message-ID: <20240408105149.59258-2-philmd@linaro.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20240408105149.59258-1-philmd@linaro.org> References: <20240408105149.59258-1-philmd@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::235; envelope-from=philmd@linaro.org; helo=mail-lj1-x235.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linaro.org) X-ZM-MESSAGEID: 1712573595112100003 Signed-off-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Peter Maydell --- hw/net/lan9118.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c index 47ff25b441..7be0430ac5 100644 --- a/hw/net/lan9118.c +++ b/hw/net/lan9118.c @@ -150,6 +150,8 @@ do { printf("lan9118: " fmt , ## __VA_ARGS__); } while = (0) =20 #define GPT_TIMER_EN 0x20000000 =20 +#define PKT_SIZE 2048 + enum tx_state { TX_IDLE, TX_B, @@ -166,7 +168,7 @@ typedef struct { int32_t pad; int32_t fifo_used; int32_t len; - uint8_t data[2048]; + uint8_t data[PKT_SIZE]; } LAN9118Packet; =20 static const VMStateDescription vmstate_lan9118_packet =3D { @@ -182,7 +184,7 @@ static const VMStateDescription vmstate_lan9118_packet = =3D { VMSTATE_INT32(pad, LAN9118Packet), VMSTATE_INT32(fifo_used, LAN9118Packet), VMSTATE_INT32(len, LAN9118Packet), - VMSTATE_UINT8_ARRAY(data, LAN9118Packet, 2048), + VMSTATE_UINT8_ARRAY(data, LAN9118Packet, PKT_SIZE), VMSTATE_END_OF_LIST() } }; @@ -544,7 +546,7 @@ static ssize_t lan9118_receive(NetClientState *nc, cons= t uint8_t *buf, return -1; } =20 - if (size >=3D 2048 || size < 14) { + if (size >=3D PKT_SIZE || size < 14) { return -1; } =20 --=20 2.41.0 From nobody Sat May 18 05:53:01 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linaro.org ARC-Seal: i=1; a=rsa-sha256; t=1712573584; cv=none; d=zohomail.com; s=zohoarc; b=gD1Hs50fgPaxwUoTlhuUaNOqFzJgve5Rrmct/besQj9c+K4YLfbzM4nBFqqQkowMHaiy2MSJz124U3/oeGdHEk+jAfQtRhlnhLe/ljhEyLBCJoVX0Xbdj9SPQv6V92iLTOdyvFYmbAcc/PFL6SnOh9Gft1T+uT91DbKAZzCkgMY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1712573584; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=TGK9qftknixU9heZO350MkV2K3QN1Ehw0AuOxkZ5V7g=; b=HcHerhPWb1NvNVb5EmuwqN5TrK173XWCsU3MfQpdsOnRhRtvCtry6f/7QLoeEH4KrmsC/iDGSm5+DuMgI4STY6lu7lwUYtQ+wsOq6tUAlnvM+s0zQ9sF4zjAix9+VsUZc/4sgtrNFbvreZnd49vn8ZjTSw5V5rYlNik6S4Ar+/M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1712573584897734.8610985975627; Mon, 8 Apr 2024 03:53:04 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rtmbi-0002sU-Ks; Mon, 08 Apr 2024 06:52:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rtmbg-0002s8-Bm for qemu-devel@nongnu.org; Mon, 08 Apr 2024 06:52:08 -0400 Received: from mail-wm1-x32b.google.com ([2a00:1450:4864:20::32b]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1rtmbd-0007rW-Jt for qemu-devel@nongnu.org; Mon, 08 Apr 2024 06:52:08 -0400 Received: by mail-wm1-x32b.google.com with SMTP id 5b1f17b1804b1-4166d58a71eso5353745e9.1 for ; Mon, 08 Apr 2024 03:52:05 -0700 (PDT) Received: from m1x-phil.lan ([176.176.144.67]) by smtp.gmail.com with ESMTPSA id t8-20020a05600c450800b004147db8a91asm16599890wmo.40.2024.04.08.03.52.02 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 08 Apr 2024 03:52:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1712573523; x=1713178323; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=TGK9qftknixU9heZO350MkV2K3QN1Ehw0AuOxkZ5V7g=; b=Ss3eciLoqlmCl7g5mhOwqMCpsTC9n52vVcU83tD27d1YYCuNpVJ2RDViszBd9qztNF uKwy/8k85uw4/oXbMb/R8KiTvJRRGY5fT7mKucRNkuNPn3gfURU13sRrglkjgl7Okt4K jYNgeDDivuybgvmC1+IqfZ4X0WeRyrwly4/nkELSavi9Gyrg0d7ff+SmGIdoNF2Lo4mF 5bh7xJ6WFfJ5Jg1I4tqMZ18sm7p5OMYFvRQdr2PPKhAXekDIHGGt/Y7stPMuCzz7xEN+ nhvmjXu9E8qlHhGG2X8UgOjRSVt4LdGjc1C9L++P/nESkQuMRT6ARSqMEF4AfoPT3nFZ pEEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712573523; x=1713178323; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=TGK9qftknixU9heZO350MkV2K3QN1Ehw0AuOxkZ5V7g=; b=cVgJAOMuzSgHSZ/aOOH3WyivQ4c32liBSt4ynaICFwNk5fRcYPNCLuqRWCAChtK+MD fJ6hQPge38Y+H2C1amX0IlKWoJaDXpRAHHJZiiSOjs6cZRNMDeL/DIVWZe1i9x5IA6EK jBKpGux2Vhu3kogxQ78Int8ty4aBIo4d9OOEc152eubpP/ocGciQZZdwITYps2yZ/iV5 GO8SdIsyEnCW3e4i+SfC7gC3KYc5TPKxeCHxOujG8WJwpVjweaFV6Vb3dLM10ABZZ1uM 5FgGx1No6XPcf9ddlspKlodnKcYpg/fUQEZBBbVotloSaJRzB1Cflyfq//jd10zUTL5h ATBg== X-Gm-Message-State: AOJu0Yy+8XaiGPAy/aPFZNYP1HMWS5iHjHYe3fYfgWMyCp96RuVUfIi2 VEal7YgPGDW0ZYtdz9gKg+NeXGqcN0316+6kvSWACo9I6PdTnwCJGkFaupzAhrJlQvlRY+H8S20 I X-Google-Smtp-Source: AGHT+IFuZoZ+F6kG2sFmWwiYLxzsZUXEgTHnKzb8lMuAa2XboqvpUJqex529qYbJlC5E2BpKaQJhsg== X-Received: by 2002:a05:600c:4f83:b0:416:5a88:4b49 with SMTP id n3-20020a05600c4f8300b004165a884b49mr2855420wmq.15.1712573523640; Mon, 08 Apr 2024 03:52:03 -0700 (PDT) From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Cc: Jason Wang , Alexander Bulekov , qemu-arm@nongnu.org, Chuhong Yuan , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [PATCH-for-9.0? 2/2] hw/net/lan9118: Fix overflow in TX FIFO Date: Mon, 8 Apr 2024 12:51:49 +0200 Message-ID: <20240408105149.59258-3-philmd@linaro.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20240408105149.59258-1-philmd@linaro.org> References: <20240408105149.59258-1-philmd@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::32b; envelope-from=philmd@linaro.org; helo=mail-wm1-x32b.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linaro.org) X-ZM-MESSAGEID: 1712573587049100006 When the TX FIFO is full, raise the TX Status FIFO Overflow (TXSO) flag, "Generated when the TX Status FIFO overflows" [*]. Broken since model introduction in commit 2a42499017 ("LAN9118 emulation"). When using the reproducer from https://gitlab.com/qemu-project/qemu/-/issues/2267 we get: hw/net/lan9118.c:798:17: runtime error: index 2048 out of bounds for type 'uint8_t[2048]' (aka 'unsigned char[204= 8]') =C2=A0 =C2=A0 #0 0x563ec9a057b1 in tx_fifo_push hw/net/lan9118.c:798:43 =C2=A0 =C2=A0 #1 0x563ec99fbb28 in lan9118_writel hw/net/lan9118.c:1042:9 =C2=A0 =C2=A0 #2 0x563ec99f2de2 in lan9118_16bit_mode_write hw/net/lan9118.= c:1205:9 =C2=A0 =C2=A0 #3 0x563ecbf78013 in memory_region_write_accessor system/memo= ry.c:497:5 =C2=A0 =C2=A0 #4 0x563ecbf776f5 in access_with_adjusted_size system/memory.= c:573:18 =C2=A0 =C2=A0 #5 0x563ecbf75643 in memory_region_dispatch_write system/memo= ry.c:1521:16 =C2=A0 =C2=A0 #6 0x563ecc01bade in flatview_write_continue_step system/phys= mem.c:2713:18 =C2=A0 =C2=A0 #7 0x563ecc01b374 in flatview_write_continue system/physmem.c= :2743:19 =C2=A0 =C2=A0 #8 0x563ecbff1c9b in flatview_write system/physmem.c:2774:12 =C2=A0 =C2=A0 #9 0x563ecbff1768 in address_space_write system/physmem.c:289= 4:18 ... [*] LAN9118 DS00002266B.pdf, Table 5.3.3 "INTERRUPT STATUS REGISTER" Reported-by: Will Lester Reported-by: Chuhong Yuan Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2267 Signed-off-by: Philippe Mathieu-Daud=C3=A9 --- hw/net/lan9118.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c index 7be0430ac5..7a1367b0bb 100644 --- a/hw/net/lan9118.c +++ b/hw/net/lan9118.c @@ -795,8 +795,11 @@ static void tx_fifo_push(lan9118_state *s, uint32_t va= l) /* Documentation is somewhat unclear on the ordering of bytes in FIFO words. Empirical results show it to be little-endi= an. */ - /* TODO: FIFO overflow checking. */ while (n--) { + if (s->txp->len =3D=3D PKT_SIZE) { + s->int_sts |=3D TXSO_INT; + break; + } s->txp->data[s->txp->len] =3D val & 0xff; s->txp->len++; val >>=3D 8; --=20 2.41.0