On Tue, 9 Apr 2024 at 14:38, Philippe Mathieu-Daudé <phi...@linaro.org> wrote:
>
> When the MAC Interface Layer (MIL) transmit FIFO is full,
> truncate the packet, and raise the Transmitter Error (TXE)
> flag.
>
> Broken since model introduction in commit 2a42499017
> ("LAN9118 emulation").
>
> When using the reproducer from
> https://gitlab.com/qemu-project/qemu/-/issues/2267 we get:
>
> hw/net/lan9118.c:798:17: runtime error:
> index 2048 out of bounds for type 'uint8_t[2048]' (aka 'unsigned
> char[2048]')
> #0 0x563ec9a057b1 in tx_fifo_push hw/net/lan9118.c:798:43
> #1 0x563ec99fbb28 in lan9118_writel hw/net/lan9118.c:1042:9
> #2 0x563ec99f2de2 in lan9118_16bit_mode_write hw/net/lan9118.c:1205:9
> #3 0x563ecbf78013 in memory_region_write_accessor system/memory.c:497:5
> #4 0x563ecbf776f5 in access_with_adjusted_size system/memory.c:573:18
> #5 0x563ecbf75643 in memory_region_dispatch_write system/memory.c:1521:16
> #6 0x563ecc01bade in flatview_write_continue_step system/physmem.c:2713:18
> #7 0x563ecc01b374 in flatview_write_continue system/physmem.c:2743:19
> #8 0x563ecbff1c9b in flatview_write system/physmem.c:2774:12
> #9 0x563ecbff1768 in address_space_write system/physmem.c:2894:18
> ...
>
> [*] LAN9118 DS00002266B.pdf, Table 5.3.3 "INTERRUPT STATUS REGISTER"
>
> Reported-by: Will Lester
> Reported-by: Chuhong Yuan <hsleste...@gmail.com>
> Suggested-by: Peter Maydell <peter.mayd...@linaro.org>
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2267
> Signed-off-by: Philippe Mathieu-Daudé <phi...@linaro.org>
> ---
Reviewed-by: Peter Maydell <peter.mayd...@linaro.org>
thanks
-- PMM
