From nobody Sat Apr 20 10:49:52 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1581641319022783.9777663535775; Thu, 13 Feb 2020 16:48:39 -0800 (PST) Received: from localhost ([::1]:33216 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1j2P9o-0002sw-N5 for importer@patchew.org; Thu, 13 Feb 2020 19:48:36 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:58110) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1j2P9D-0002US-3E for qemu-devel@nongnu.org; Thu, 13 Feb 2020 19:48:00 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1j2P9B-000183-Oh for qemu-devel@nongnu.org; Thu, 13 Feb 2020 19:47:58 -0500 Received: from mail-wm1-x341.google.com ([2a00:1450:4864:20::341]:37955) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1j2P9B-00016l-Fw for qemu-devel@nongnu.org; Thu, 13 Feb 2020 19:47:57 -0500 Received: by mail-wm1-x341.google.com with SMTP id a9so8824338wmj.3 for ; Thu, 13 Feb 2020 16:47:57 -0800 (PST) Received: from x1w.redhat.com (78.red-88-21-202.staticip.rima-tde.net. [88.21.202.78]) by smtp.gmail.com with ESMTPSA id y131sm5185415wmc.13.2020.02.13.16.47.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Feb 2020 16:47:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=jrHsrciOVEWIlCjTCOW49db7lwtH9oDQHM2KLgoGjN4=; b=XIWlvMIPT2Y4/0Bzh8W1jvwFF58EPC6OuI9hJws/HNqB+STbsQeJoL72Tlz5ls8Ykv uubMWXep6j6Dn7j739s1k7TXTzflUidT+MZnTcSu3wTcYtHPnF5iCARhJJuGuqeJFLbT ZOVambFmqWsQndbvYPtbuG9QC3gWdSQYOE5ruEpdTKxSlecc2EujHEDr+w2s43KAN4yb W57D1ZyIUeWbiv+1OToTCyXdddjynQWPxqWwXc8Qq/+411b8Wz9Ja6mmEFQVBDNyJCNQ NQaWN4jYZE1niQaLGixJUj39C4fp9+14VkGvUJZA/5o02RWEbFo8/B8sF5N4nDXGRcwb xIlg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :mime-version:content-transfer-encoding; bh=jrHsrciOVEWIlCjTCOW49db7lwtH9oDQHM2KLgoGjN4=; b=D3FyDLSsva9PNCkrr9nOIc+JHB+nXcfdNhnaMV1Ux1LvsWeCZjXhZSYPch7dRP07JX De2Rr46N4rzJj9g9ZEaXL5Wc6TJcI1dpuiImD2Nf610bMT+Zw/l08AtyJy6q8W9+XR1Y xce/HLrM/y4bE06sBPck4HZThqFd34hbdJlXoStCt/oCeCdmaGj21zkz2OQO+P+QCKKL CvQONnUR2D89dedQJlH+SZXwPAYL6cjy2IQjjxL/8JRV5F/icWUUgM2S1QouTkWujqF5 Cgf5YF8v35exSxTAMll94JtxxFgfmh0qPdluXiPu088qQXhSaQJ76LDaHAdEtBmZfDKP TK4g== X-Gm-Message-State: APjAAAVRSX2prE8FfMrB1hkX61TLKEBB47/fKxFRSGPDYm9hBxKYwcYA EjYEYENDksN+d2X94YI7YltdZOuAMMs= X-Google-Smtp-Source: APXvYqz+IHrXIY0ADBtLlorugH6n893HdwupKUHny610CoLL6p9VmauhzGpLV4YBD+4CGH+y3xolBA== X-Received: by 2002:a1c:dc08:: with SMTP id t8mr798000wmg.139.1581641275930; Thu, 13 Feb 2020 16:47:55 -0800 (PST) From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org, Sven Schnelle , Helge Deller Subject: [PATCH] hw/net/i82596: Correct command bitmask (CID 1419392) Date: Fri, 14 Feb 2020 01:47:53 +0100 Message-Id: <20200214004753.15736-1-f4bug@amsat.org> X-Mailer: git-send-email 2.21.1 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2a00:1450:4864:20::341 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jason Wang , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Richard Henderson Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) The command is 32-bit, but we are loading the 16 upper bits with the 'get_uint16(s->scb + 2)' call. Once shifted by 16, the command bits match the status bits: - Command Bit 31 ACK-CX Acknowledges that the CU completed an Action Command. Bit 30 ACK-FR Acknowledges that the RU received a frame. Bit 29 ACK-CNA Acknowledges that the Command Unit became not active. Bit 28 ACK-RNR Acknowledges that the Receive Unit became not ready. - Status Bit 15 CX The CU finished executing a command with its I(interrupt)= bit set. Bit 14 FR The RU finished receiving a frame. Bit 13 CNA The Command Unit left the Active state. Bit 12 RNR The Receive Unit left the Ready state. Add the SCB_COMMAND_ACK_MASK definition to simplify the code. This fixes Coverity 1419392 (CONSTANT_EXPRESSION_RESULT): /hw/net/i82596.c: 352 in examine_scb() 346 cuc =3D (command >> 8) & 0x7; 347 ruc =3D (command >> 4) & 0x7; 348 DBG(printf("MAIN COMMAND %04x cuc %02x ruc %02x\n", command,= cuc, ruc)); 349 /* and clear the scb command word */ 350 set_uint16(s->scb + 2, 0); 351 >>> CID 1419392: (CONSTANT_EXPRESSION_RESULT) >>> "command & (2147483648UL /* 1UL << 31 */)" is always 0 regardless= of the values of its operands. This occurs as the logical operand of "if". 352 if (command & BIT(31)) /* ACK-CX */ 353 s->scb_status &=3D ~SCB_STATUS_CX; >>> CID 1419392: (CONSTANT_EXPRESSION_RESULT) >>> "command & (1073741824UL /* 1UL << 30 */)" is always 0 regardless= of the values of its operands. This occurs as the logical operand of "if". 354 if (command & BIT(30)) /*ACK-FR */ 355 s->scb_status &=3D ~SCB_STATUS_FR; >>> CID 1419392: (CONSTANT_EXPRESSION_RESULT) >>> "command & (536870912UL /* 1UL << 29 */)" is always 0 regardless = of the values of its operands. This occurs as the logical operand of "if". 356 if (command & BIT(29)) /*ACK-CNA */ 357 s->scb_status &=3D ~SCB_STATUS_CNA; >>> CID 1419392: (CONSTANT_EXPRESSION_RESULT) >>> "command & (268435456UL /* 1UL << 28 */)" is always 0 regardless = of the values of its operands. This occurs as the logical operand of "if". 358 if (command & BIT(28)) /*ACK-RNR */ 359 s->scb_status &=3D ~SCB_STATUS_RNR; Fixes: Covertiy CID 1419392 (commit 376b851909) Signed-off-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Peter Maydell --- hw/net/i82596.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/hw/net/i82596.c b/hw/net/i82596.c index 3a0e1ec4c0..b7c2458a96 100644 --- a/hw/net/i82596.c +++ b/hw/net/i82596.c @@ -43,6 +43,9 @@ #define SCB_STATUS_CNA 0x2000 /* CU left active state */ #define SCB_STATUS_RNR 0x1000 /* RU left active state */ =20 +#define SCB_COMMAND_ACK_MASK \ + (SCB_STATUS_CX | SCB_STATUS_FR | SCB_STATUS_CNA | SCB_STATUS_RNR) + #define CU_IDLE 0 #define CU_SUSPENDED 1 #define CU_ACTIVE 2 @@ -349,14 +352,7 @@ static void examine_scb(I82596State *s) /* and clear the scb command word */ set_uint16(s->scb + 2, 0); =20 - if (command & BIT(31)) /* ACK-CX */ - s->scb_status &=3D ~SCB_STATUS_CX; - if (command & BIT(30)) /*ACK-FR */ - s->scb_status &=3D ~SCB_STATUS_FR; - if (command & BIT(29)) /*ACK-CNA */ - s->scb_status &=3D ~SCB_STATUS_CNA; - if (command & BIT(28)) /*ACK-RNR */ - s->scb_status &=3D ~SCB_STATUS_RNR; + s->scb_status &=3D ~(command & SCB_COMMAND_ACK_MASK); =20 switch (cuc) { case 0: /* no change */ --=20 2.21.1