diff mbox series

[PATCH-for-9.1,v2,10/11] hw/net/lan9118: Use RX_DATA_FIFO_BYTES definition

Message ID 20240409133801.23503-11-philmd@linaro.org
State New
Headers show
Series hw/net/lan9118: Fix overflow in TX FIFO | expand

Commit Message

Philippe Mathieu-Daudé April 9, 2024, 1:37 p.m. UTC 
rx_fifo[] is an array of words,
rx_fifo_size is a word count.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/lan9118.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

Comments

Peter Maydell April 9, 2024, 2:05 p.m. UTC | #1 
On Tue, 9 Apr 2024 at 14:39, Philippe Mathieu-Daudé <philmd@linaro.org> wrote:
>
> rx_fifo[] is an array of words,
> rx_fifo_size is a word count.

True, but that's not why rx_fifo[] has been sized to 3360.
It's 3360 because that is the worst-case RX data FIFO size
in words (if TX_FIF_SZ is 2 then the RX data FIFO is 13440
bytes, which is 3360 words). So in this case the array size
is correct.

thanks
-- PMM
diff mbox series

Patch

diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index 663776f575..56cc52d450 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -266,7 +266,7 @@  struct lan9118_state {
     int32_t rx_fifo_size;
     int32_t rx_fifo_used;
     int32_t rx_fifo_head;
-    uint32_t rx_fifo[3360];
+    uint32_t rx_fifo[RX_DATA_FIFO_BYTES / 4];
     int32_t rx_packet_size_head;
     int32_t rx_packet_size_tail;
     int32_t rx_packet_size[1024];
@@ -338,7 +338,9 @@  static const VMStateDescription vmstate_lan9118 = {
         VMSTATE_INT32(rx_fifo_size, lan9118_state),
         VMSTATE_INT32(rx_fifo_used, lan9118_state),
         VMSTATE_INT32(rx_fifo_head, lan9118_state),
-        VMSTATE_UINT32_ARRAY(rx_fifo, lan9118_state, 3360),
+        VMSTATE_UINT32_ARRAY(rx_fifo, lan9118_state,
+                             RX_DATA_FIFO_BYTES / 4),
+        VMSTATE_UNUSED(3360 * 4 - RX_DATA_FIFO_BYTES),
         VMSTATE_INT32(rx_packet_size_head, lan9118_state),
         VMSTATE_INT32(rx_packet_size_tail, lan9118_state),
         VMSTATE_INT32_ARRAY(rx_packet_size, lan9118_state, 1024),
@@ -460,7 +462,7 @@  static void lan9118_reset(DeviceState *d)
     s->txp->fifo_used = 0;
     s->tx_fifo_bytes = TX_DATA_FIFO_BYTES;
     s->tx_status_fifo_used = 0;
-    s->rx_fifo_size = 2640;
+    s->rx_fifo_size = RX_DATA_FIFO_BYTES / 4;
     s->rx_fifo_used = 0;
     s->rx_status_fifo_wordcount = RX_STATUS_FIFO_BYTES / 4;
     s->rx_status_fifo_used = 0;