openkylin
/
qemu
mirror of https://gitee.com/openkylin/qemu.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

dp8393x: Pad frames to word or long word boundary 

The existing code has a bug where the Remaining Buffer Word Count (RBWC)
is calculated with a truncating division, which gives the wrong result
for odd-sized packets.

Section 1.4.1 of the datasheet says,

    Once the end of the packet has been reached, the serializer will
    fill out the last word (16-bit mode) or long word (32-bit mode)
    if the last byte did not end on a word or long word boundary
    respectively. The fill byte will be 0FFh.

Implement buffer padding so that buffer limits are correctly enforced.

Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Tested-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
This commit is contained in:
Finn Thain 2020-01-29 20:27:49 +11:00 committed by Jason Wang
parent ea2270279b
commit 350e7d9a77
1 changed files with 28 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
hw/net/dp8393x.c
View File

@ -768,16 +768,23 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
dp8393xState *s = qemu_get_nic_opaque(nc);
int packet_type;
uint32_t available, address;
int width, rx_len = pkt_size;
int width, rx_len, padded_len;
uint32_t checksum;
int size;
width = (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1;
s->regs[SONIC_RCR] &= ~(SONIC_RCR_PRX | SONIC_RCR_LBK | SONIC_RCR_FAER |
SONIC_RCR_CRCR | SONIC_RCR_LPKT | SONIC_RCR_BC | SONIC_RCR_MC);
if (pkt_size + 4 > dp8393x_rbwc(s) * 2) {
rx_len = pkt_size + sizeof(checksum);
if (s->regs[SONIC_DCR] & SONIC_DCR_DW) {
width = 2;
padded_len = ((rx_len - 1) | 3) + 1;
} else {
width = 1;
padded_len = ((rx_len - 1) | 1) + 1;
}
if (padded_len > dp8393x_rbwc(s) * 2) {
DPRINTF("oversize packet, pkt_size is %d\n", pkt_size);
s->regs[SONIC_ISR] |= SONIC_ISR_RBAE;
dp8393x_update_irq(s);
@ -812,22 +819,32 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
s->regs[SONIC_TRBA0] = s->regs[SONIC_CRBA0];
/* Calculate the ethernet checksum */
checksum = cpu_to_le32(crc32(0, buf, rx_len));
checksum = cpu_to_le32(crc32(0, buf, pkt_size));
/* Put packet into RBA */
DPRINTF("Receive packet at %08x\n", dp8393x_crba(s));
address = dp8393x_crba(s);
address_space_write(&s->as, address, MEMTXATTRS_UNSPECIFIED,
buf, rx_len);
address += rx_len;
buf, pkt_size);
address += pkt_size;
/* Put frame checksum into RBA */
address_space_write(&s->as, address, MEMTXATTRS_UNSPECIFIED,
&checksum, 4);
address += 4;
rx_len += 4;
&checksum, sizeof(checksum));
address += sizeof(checksum);
/* Pad short packets to keep pointers aligned */
if (rx_len < padded_len) {
size = padded_len - rx_len;
address_space_rw(&s->as, address, MEMTXATTRS_UNSPECIFIED,
(uint8_t *)"\xFF\xFF\xFF", size, 1);
address += size;
}
s->regs[SONIC_CRBA1] = address >> 16;
s->regs[SONIC_CRBA0] = address & 0xffff;
available = dp8393x_rbwc(s);
available -= rx_len / 2;
available -= padded_len >> 1;
s->regs[SONIC_RBWC1] = available >> 16;
s->regs[SONIC_RBWC0] = available & 0xffff;