From nobody Mon Feb 9 09:28:59 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1579475717; cv=none; d=zohomail.com; s=zohoarc; b=UiZqvqMKWTzu0yGGf8adzeNAR642EOQdZB+w7KLh5PpJijzvtkFQhPz8+hxGA0Um66CKFgcaqyQXssasyXvCKa+cZwg1xARZvvXnyUIjqu+Mnrp9uRPkM68dQ9xBT+4Wx4Wqq5WhbCz5WqkAQn3BrPP+rOV5h9WHbdz9m+O8MMI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1579475717; h=Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:To; bh=H2haCm402I5zJpI3Rv4MTSMQ8iZtXu+gNJBru7/94Jg=; b=RUEx/w6ylklr9yQjd/PYuzwGo8vQ+uH8P+ZfupIVgW7ZnaJqwS+UGVokxjN3vkG6Y/aQMLkTXLIxKXmdDlCofhXTFKD5eUu0bPUDn711Jjgyrfdly90WHvzmsd1iehYmGdkQcBTWo4GHr9EAtfAGsMQxFPiy1sqdY5GKXQtSnqs= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1579475717587251.30045085044492; Sun, 19 Jan 2020 15:15:17 -0800 (PST) Received: from localhost ([::1]:54920 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1itJml-0006MC-KQ for importer@patchew.org; Sun, 19 Jan 2020 18:15:15 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:55966) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1itJfj-0004AF-Gk for qemu-devel@nongnu.org; Sun, 19 Jan 2020 18:08:00 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1itJfh-0003m1-AN for qemu-devel@nongnu.org; Sun, 19 Jan 2020 18:07:59 -0500 Received: from kvm5.telegraphics.com.au ([98.124.60.144]:54738) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1itJfh-0003lW-3q; Sun, 19 Jan 2020 18:07:57 -0500 Received: by kvm5.telegraphics.com.au (Postfix, from userid 502) id 5F5F029633; Sun, 19 Jan 2020 18:07:55 -0500 (EST) To: Jason Wang , qemu-devel@nongnu.org Message-Id: <49ee52289db03344afc627dd49706ae81eb7d165.1579474761.git.fthain@telegraphics.com.au> In-Reply-To: References: From: Finn Thain Subject: [PATCH v3 10/14] dp8393x: Pad frames to word or long word boundary Date: Mon, 20 Jan 2020 09:59:21 +1100 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 98.124.60.144 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Aleksandar Rikalo , =?UTF-8?q?Herv=C3=A9=20Poussineau?= , Laurent Vivier , qemu-stable@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The existing code has a bug where the Remaining Buffer Word Count (RBWC) is calculated with a truncating division, which gives the wrong result for odd-sized packets. Section 1.4.1 of the datasheet says, Once the end of the packet has been reached, the serializer will fill out the last word (16-bit mode) or long word (32-bit mode) if the last byte did not end on a word or long word boundary respectively. The fill byte will be 0FFh. Implement buffer padding so that buffer limits are correctly enforced. Signed-off-by: Finn Thain Tested-by: Laurent Vivier Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- hw/net/dp8393x.c | 39 ++++++++++++++++++++++++++++----------- 1 file changed, 28 insertions(+), 11 deletions(-) diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c index b052e2c854..13513986f0 100644 --- a/hw/net/dp8393x.c +++ b/hw/net/dp8393x.c @@ -766,16 +766,23 @@ static ssize_t dp8393x_receive(NetClientState *nc, co= nst uint8_t * buf, dp8393xState *s =3D qemu_get_nic_opaque(nc); int packet_type; uint32_t available, address; - int width, rx_len =3D pkt_size; + int width, rx_len, padded_len; uint32_t checksum; int size; =20 - width =3D (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1; - s->regs[SONIC_RCR] &=3D ~(SONIC_RCR_PRX | SONIC_RCR_LBK | SONIC_RCR_FA= ER | SONIC_RCR_CRCR | SONIC_RCR_LPKT | SONIC_RCR_BC | SONIC_RCR_MC); =20 - if (pkt_size + 4 > dp8393x_rbwc(s) * 2) { + rx_len =3D pkt_size + sizeof(checksum); + if (s->regs[SONIC_DCR] & SONIC_DCR_DW) { + width =3D 2; + padded_len =3D ((rx_len - 1) | 3) + 1; + } else { + width =3D 1; + padded_len =3D ((rx_len - 1) | 1) + 1; + } + + if (padded_len > dp8393x_rbwc(s) * 2) { DPRINTF("oversize packet, pkt_size is %d\n", pkt_size); s->regs[SONIC_ISR] |=3D SONIC_ISR_RBAE; dp8393x_update_irq(s); @@ -810,22 +817,32 @@ static ssize_t dp8393x_receive(NetClientState *nc, co= nst uint8_t * buf, s->regs[SONIC_TRBA0] =3D s->regs[SONIC_CRBA0]; =20 /* Calculate the ethernet checksum */ - checksum =3D cpu_to_le32(crc32(0, buf, rx_len)); + checksum =3D cpu_to_le32(crc32(0, buf, pkt_size)); =20 /* Put packet into RBA */ DPRINTF("Receive packet at %08x\n", dp8393x_crba(s)); address =3D dp8393x_crba(s); address_space_rw(&s->as, address, - MEMTXATTRS_UNSPECIFIED, (uint8_t *)buf, rx_len, 1); - address +=3D rx_len; + MEMTXATTRS_UNSPECIFIED, (uint8_t *)buf, pkt_size, 1); + address +=3D pkt_size; + + /* Put frame checksum into RBA */ address_space_rw(&s->as, address, - MEMTXATTRS_UNSPECIFIED, (uint8_t *)&checksum, 4, 1); - address +=3D 4; - rx_len +=3D 4; + MEMTXATTRS_UNSPECIFIED, (uint8_t *)&checksum, sizeof(checksum), 1); + address +=3D sizeof(checksum); + + /* Pad short packets to keep pointers aligned */ + if (rx_len < padded_len) { + size =3D padded_len - rx_len; + address_space_rw(&s->as, address, MEMTXATTRS_UNSPECIFIED, + (uint8_t *)"\xFF\xFF\xFF", size, 1); + address +=3D size; + } + s->regs[SONIC_CRBA1] =3D address >> 16; s->regs[SONIC_CRBA0] =3D address & 0xffff; available =3D dp8393x_rbwc(s); - available -=3D rx_len / 2; + available -=3D padded_len >> 1; s->regs[SONIC_RBWC1] =3D available >> 16; s->regs[SONIC_RBWC0] =3D available & 0xffff; =20 --=20 2.24.1