From nobody Fri Apr 11 20:27:33 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1585307729; cv=none; d=zohomail.com; s=zohoarc; b=ka4i/yxX4vjcmOw0nUBFeYWRjiljQk+3tpl0VEYIGYlilSl2XKmJA0EiuMplSFDd/ujY2HAqk6BpzSVJ0w2OiVrcTqAi3PoZzFJcQm6Y2TvSFGc5ERxUz443gCdTiIZblPxL1kLKw9jXDN+ovZQDFSyrdVSHX0J/t8fyjut19oY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1585307729; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=ZBpdFRO5rJLxNzdJEGO4mRvZn0CjlnODLs22OFn9v5M=; b=GuWb6Liu7KNWP1vsSAec2RYzgL80kufcdg4oftzxiUB3PIc9yfFkizVB12pJn6avdFgofW7XcHg/PHNXhOCAnvwwL6ZLtaEQHvRRKGzQ87zaPiVLGof6ak6By31DM3wEMIceGpDO1lc/+jPNVeoyfc3mJkO0NIEYLqRw8+4v12M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1585307729252733.2467517351465; Fri, 27 Mar 2020 04:15:29 -0700 (PDT) Received: from localhost ([::1]:40300 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jHmxT-000298-6d for importer@patchew.org; Fri, 27 Mar 2020 07:15:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:37671) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jHmwN-0000cK-Fu for qemu-devel@nongnu.org; Fri, 27 Mar 2020 07:14:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1jHmwM-0001Du-1P for qemu-devel@nongnu.org; Fri, 27 Mar 2020 07:14:19 -0400 Received: from us-smtp-delivery-74.mimecast.com ([216.205.24.74]:21047) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1jHmwL-00018Q-TO for qemu-devel@nongnu.org; Fri, 27 Mar 2020 07:14:17 -0400 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-115-Q0EmkO2QMyO8oLyBXwXSbA-1; Fri, 27 Mar 2020 07:14:14 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 926D1801E53; Fri, 27 Mar 2020 11:14:13 +0000 (UTC) Received: from jason-ThinkPad-T430s.redhat.com (ovpn-12-77.pek2.redhat.com [10.72.12.77]) by smtp.corp.redhat.com (Postfix) with ESMTP id DAF735E01F; Fri, 27 Mar 2020 11:14:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1585307657; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZBpdFRO5rJLxNzdJEGO4mRvZn0CjlnODLs22OFn9v5M=; b=YOkKFWd04Yrt2ZtHxyqg5UDNq8xGGrFSWe8XMZE1vvLwqD0rgGqG3ESn2kYtgdb34Mf4km UccWpHn8W2Qu1dSyndd2+EldH7XdApTGyfJ3CMoIzZRLzL8M2hJTsiX11FHZIpj51OQl27 zjVQCeUyamNJgL8ycVXZZxJQg5PeO/k= X-MC-Unique: Q0EmkO2QMyO8oLyBXwXSbA-1 From: Jason Wang To: qemu-devel@nongnu.org, peter.maydell@linaro.org Subject: [PULL 01/13] hw/net/i82596: Correct command bitmask (CID 1419392) Date: Fri, 27 Mar 2020 19:13:55 +0800 Message-Id: <1585307647-24456-2-git-send-email-jasowang@redhat.com> In-Reply-To: <1585307647-24456-1-git-send-email-jasowang@redhat.com> References: <1585307647-24456-1-git-send-email-jasowang@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 216.205.24.74 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jason Wang , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" From: Philippe Mathieu-Daud=C3=A9 The command is 32-bit, but we are loading the 16 upper bits with the 'get_uint16(s->scb + 2)' call. Once shifted by 16, the command bits match the status bits: - Command Bit 31 ACK-CX Acknowledges that the CU completed an Action Command. Bit 30 ACK-FR Acknowledges that the RU received a frame. Bit 29 ACK-CNA Acknowledges that the Command Unit became not active. Bit 28 ACK-RNR Acknowledges that the Receive Unit became not ready. - Status Bit 15 CX The CU finished executing a command with its I(interrupt)= bit set. Bit 14 FR The RU finished receiving a frame. Bit 13 CNA The Command Unit left the Active state. Bit 12 RNR The Receive Unit left the Ready state. Add the SCB_COMMAND_ACK_MASK definition to simplify the code. This fixes Coverity 1419392 (CONSTANT_EXPRESSION_RESULT): /hw/net/i82596.c: 352 in examine_scb() 346 cuc =3D (command >> 8) & 0x7; 347 ruc =3D (command >> 4) & 0x7; 348 DBG(printf("MAIN COMMAND %04x cuc %02x ruc %02x\n", command,= cuc, ruc)); 349 /* and clear the scb command word */ 350 set_uint16(s->scb + 2, 0); 351 >>> CID 1419392: (CONSTANT_EXPRESSION_RESULT) >>> "command & (2147483648UL /* 1UL << 31 */)" is always 0 regardless= of the values of its operands. This occurs as the logical operand of "if". 352 if (command & BIT(31)) /* ACK-CX */ 353 s->scb_status &=3D ~SCB_STATUS_CX; >>> CID 1419392: (CONSTANT_EXPRESSION_RESULT) >>> "command & (1073741824UL /* 1UL << 30 */)" is always 0 regardless= of the values of its operands. This occurs as the logical operand of "if". 354 if (command & BIT(30)) /*ACK-FR */ 355 s->scb_status &=3D ~SCB_STATUS_FR; >>> CID 1419392: (CONSTANT_EXPRESSION_RESULT) >>> "command & (536870912UL /* 1UL << 29 */)" is always 0 regardless = of the values of its operands. This occurs as the logical operand of "if". 356 if (command & BIT(29)) /*ACK-CNA */ 357 s->scb_status &=3D ~SCB_STATUS_CNA; >>> CID 1419392: (CONSTANT_EXPRESSION_RESULT) >>> "command & (268435456UL /* 1UL << 28 */)" is always 0 regardless = of the values of its operands. This occurs as the logical operand of "if". 358 if (command & BIT(28)) /*ACK-RNR */ 359 s->scb_status &=3D ~SCB_STATUS_RNR; Fixes: Covertiy CID 1419392 (commit 376b851909) Signed-off-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Peter Maydell Signed-off-by: Jason Wang --- hw/net/i82596.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/hw/net/i82596.c b/hw/net/i82596.c index fe9f239..ecdb9aa 100644 --- a/hw/net/i82596.c +++ b/hw/net/i82596.c @@ -43,6 +43,9 @@ #define SCB_STATUS_CNA 0x2000 /* CU left active state */ #define SCB_STATUS_RNR 0x1000 /* RU left active state */ =20 +#define SCB_COMMAND_ACK_MASK \ + (SCB_STATUS_CX | SCB_STATUS_FR | SCB_STATUS_CNA | SCB_STATUS_RNR) + #define CU_IDLE 0 #define CU_SUSPENDED 1 #define CU_ACTIVE 2 @@ -348,14 +351,7 @@ static void examine_scb(I82596State *s) /* and clear the scb command word */ set_uint16(s->scb + 2, 0); =20 - if (command & BIT(31)) /* ACK-CX */ - s->scb_status &=3D ~SCB_STATUS_CX; - if (command & BIT(30)) /*ACK-FR */ - s->scb_status &=3D ~SCB_STATUS_FR; - if (command & BIT(29)) /*ACK-CNA */ - s->scb_status &=3D ~SCB_STATUS_CNA; - if (command & BIT(28)) /*ACK-RNR */ - s->scb_status &=3D ~SCB_STATUS_RNR; + s->scb_status &=3D ~(command & SCB_COMMAND_ACK_MASK); =20 switch (cuc) { case 0: /* no change */ --=20 2.5.0