[PATCH] net: designware: fix TX descriptor length corruption

[PATCH] net: designware: fix TX descriptor length corruption

[Ian Abbott]

dwc_ether_send() sets the SIZE1 field of the TX descriptor incorrectly.
It sets the SIZE1 field to a bit-wise OR of the old value and the new
value.  If the old value differs from the new value, the transmitted
Ethernet frame will be longer than it should be and is likely to have an
incorrect frame check sequence.  As more and more Ethernet frames of
different lengths are sent, more and more of the TX descriptors are
affected (up to a maximum number of CONFIG_TX_DESCR_NUM, defined as 16
in "designware.h").  Fix it by setting the SIZE1 field of the TX
descriptor to just the new value.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/net/designware.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/designware.c b/drivers/net/designware.c
index ad70967e8..3c9bca981 100644
--- a/drivers/net/designware.c
+++ b/drivers/net/designware.c
@@ -291,12 +291,14 @@ static int dwc_ether_send(struct eth_device *dev, void *packet, int length)
 
 	if (priv->enh_desc) {
 		desc_p->txrx_status |= DESC_ENH_TXSTS_TXFIRST | DESC_ENH_TXSTS_TXLAST;
+		desc_p->dmamac_cntl &= ~(DESC_ENH_TXCTRL_SIZE1MASK);
 		desc_p->dmamac_cntl |= (length << DESC_ENH_TXCTRL_SIZE1SHFT) &
 				       DESC_ENH_TXCTRL_SIZE1MASK;
 
 		desc_p->txrx_status &= ~(DESC_ENH_TXSTS_MSK);
 		desc_p->txrx_status |= DESC_ENH_TXSTS_OWNBYDMA;
 	} else {
+		desc_p->dmamac_cntl &= ~(DESC_TXCTRL_SIZE1MASK);
 		desc_p->dmamac_cntl |= ((length << DESC_TXCTRL_SIZE1SHFT) &
 				       DESC_TXCTRL_SIZE1MASK) | DESC_TXCTRL_TXLAST |
 				       DESC_TXCTRL_TXFIRST;
-- 
2.20.1


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

Re: [PATCH] net: designware: fix TX descriptor length corruption

[Sascha Hauer]

On Thu, Jan 31, 2019 at 05:19:05PM +0000, Ian Abbott wrote:
> dwc_ether_send() sets the SIZE1 field of the TX descriptor incorrectly.
> It sets the SIZE1 field to a bit-wise OR of the old value and the new
> value.  If the old value differs from the new value, the transmitted
> Ethernet frame will be longer than it should be and is likely to have an
> incorrect frame check sequence.  As more and more Ethernet frames of
> different lengths are sent, more and more of the TX descriptors are
> affected (up to a maximum number of CONFIG_TX_DESCR_NUM, defined as 16
> in "designware.h").  Fix it by setting the SIZE1 field of the TX
> descriptor to just the new value.
> 
> Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
> ---
>  drivers/net/designware.c | 2 ++
>  1 file changed, 2 insertions(+)

Applied, thanks

Sascha

> 
> diff --git a/drivers/net/designware.c b/drivers/net/designware.c
> index ad70967e8..3c9bca981 100644
> --- a/drivers/net/designware.c
> +++ b/drivers/net/designware.c
> @@ -291,12 +291,14 @@ static int dwc_ether_send(struct eth_device *dev, void *packet, int length)
>  
>  	if (priv->enh_desc) {
>  		desc_p->txrx_status |= DESC_ENH_TXSTS_TXFIRST | DESC_ENH_TXSTS_TXLAST;
> +		desc_p->dmamac_cntl &= ~(DESC_ENH_TXCTRL_SIZE1MASK);
>  		desc_p->dmamac_cntl |= (length << DESC_ENH_TXCTRL_SIZE1SHFT) &
>  				       DESC_ENH_TXCTRL_SIZE1MASK;
>  
>  		desc_p->txrx_status &= ~(DESC_ENH_TXSTS_MSK);
>  		desc_p->txrx_status |= DESC_ENH_TXSTS_OWNBYDMA;
>  	} else {
> +		desc_p->dmamac_cntl &= ~(DESC_TXCTRL_SIZE1MASK);
>  		desc_p->dmamac_cntl |= ((length << DESC_TXCTRL_SIZE1SHFT) &
>  				       DESC_TXCTRL_SIZE1MASK) | DESC_TXCTRL_TXLAST |
>  				       DESC_TXCTRL_TXFIRST;
> -- 
> 2.20.1
> 
> 
> _______________________________________________
> barebox mailing list
> barebox@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/barebox
> 

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox