Message ID | 20240409133801.23503-9-philmd@linaro.org |
---|---|
State | New |
Headers | show |
Series | hw/net/lan9118: Fix overflow in TX FIFO | expand |
On Tue, 9 Apr 2024 at 14:39, Philippe Mathieu-Daudé <philmd@linaro.org> wrote: > > rx_status_fifo[] is an array of words, > rx_status_fifo_size is a word count. > > Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> > --- > hw/net/lan9118.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c > index a983ce193b..cace22381d 100644 > --- a/hw/net/lan9118.c > +++ b/hw/net/lan9118.c > @@ -262,7 +262,7 @@ struct lan9118_state { > int32_t rx_status_fifo_size; > int32_t rx_status_fifo_used; > int32_t rx_status_fifo_head; > - uint32_t rx_status_fifo[896]; > + uint32_t rx_status_fifo[RX_STATUS_FIFO_BYTES / 4]; > int32_t rx_fifo_size; > int32_t rx_fifo_used; > int32_t rx_fifo_head; > @@ -332,7 +332,9 @@ static const VMStateDescription vmstate_lan9118 = { > VMSTATE_INT32(rx_status_fifo_size, lan9118_state), > VMSTATE_INT32(rx_status_fifo_used, lan9118_state), > VMSTATE_INT32(rx_status_fifo_head, lan9118_state), > - VMSTATE_UINT32_ARRAY(rx_status_fifo, lan9118_state, 896), > + VMSTATE_UINT32_ARRAY(rx_status_fifo, lan9118_state, > + RX_STATUS_FIFO_BYTES / 4), > + VMSTATE_UNUSED(896 * 4 - RX_STATUS_FIFO_BYTES), > VMSTATE_INT32(rx_fifo_size, lan9118_state), > VMSTATE_INT32(rx_fifo_used, lan9118_state), > VMSTATE_INT32(rx_fifo_head, lan9118_state), Ideally in the state struct we should have the arrays be the size of the largest possible FIFO, not the size of the default-out-of-reset FIFO, to leave the way open for making the FIFO size be runtime configurable in future if we want that. thanks -- PMM
diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c index a983ce193b..cace22381d 100644 --- a/hw/net/lan9118.c +++ b/hw/net/lan9118.c @@ -262,7 +262,7 @@ struct lan9118_state { int32_t rx_status_fifo_size; int32_t rx_status_fifo_used; int32_t rx_status_fifo_head; - uint32_t rx_status_fifo[896]; + uint32_t rx_status_fifo[RX_STATUS_FIFO_BYTES / 4]; int32_t rx_fifo_size; int32_t rx_fifo_used; int32_t rx_fifo_head; @@ -332,7 +332,9 @@ static const VMStateDescription vmstate_lan9118 = { VMSTATE_INT32(rx_status_fifo_size, lan9118_state), VMSTATE_INT32(rx_status_fifo_used, lan9118_state), VMSTATE_INT32(rx_status_fifo_head, lan9118_state), - VMSTATE_UINT32_ARRAY(rx_status_fifo, lan9118_state, 896), + VMSTATE_UINT32_ARRAY(rx_status_fifo, lan9118_state, + RX_STATUS_FIFO_BYTES / 4), + VMSTATE_UNUSED(896 * 4 - RX_STATUS_FIFO_BYTES), VMSTATE_INT32(rx_fifo_size, lan9118_state), VMSTATE_INT32(rx_fifo_used, lan9118_state), VMSTATE_INT32(rx_fifo_head, lan9118_state), @@ -458,10 +460,9 @@ static void lan9118_reset(DeviceState *d) s->txp->fifo_used = 0; s->tx_fifo_bytes = TX_DATA_FIFO_BYTES; s->tx_status_fifo_used = 0; - s->rx_status_fifo_size = 704; s->rx_fifo_size = 2640; s->rx_fifo_used = 0; - s->rx_status_fifo_size = 176; + s->rx_status_fifo_size = RX_STATUS_FIFO_BYTES / 4; s->rx_status_fifo_used = 0; s->rxp_offset = 0; s->rxp_size = 0;
rx_status_fifo[] is an array of words, rx_status_fifo_size is a word count. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> --- hw/net/lan9118.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)