From 77d54985b85a0cb760330ec2bd92505e0a2a97a9 Mon Sep 17 00:00:00 2001 From: Prasad J Pandit Date: Tue, 29 Nov 2016 00:38:39 +0530 Subject: [PATCH 1/3] net: mcf: check receive buffer size register value ColdFire Fast Ethernet Controller uses a receive buffer size register(EMRBR) to hold maximum size of all receive buffers. It is set by a user before any operation. If it was set to be zero, ColdFire emulator would go into an infinite loop while receiving data in mcf_fec_receive. Add check to avoid it. Reported-by: Wjjzhang Signed-off-by: Prasad J Pandit Signed-off-by: Jason Wang --- hw/net/mcf_fec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/mcf_fec.c b/hw/net/mcf_fec.c index dc61bac2fc..4025eb3b33 100644 --- a/hw/net/mcf_fec.c +++ b/hw/net/mcf_fec.c @@ -393,7 +393,7 @@ static void mcf_fec_write(void *opaque, hwaddr addr, s->tx_descriptor = s->etdsr; break; case 0x188: - s->emrbr = value & 0x7f0; + s->emrbr = value > 0 ? value & 0x7F0 : 0x7F0; break; default: hw_error("mcf_fec_write Bad address 0x%x\n", (int)addr); From 64f441d2e53ac6ed8b4ef199e1995529d2012000 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Mon, 28 Nov 2016 10:13:14 -0800 Subject: [PATCH 2/3] fsl_etsec: Pad short payloads with zeros Depending on QEMU network setup it is possible for us to receive a complete Ethernet packet that is less 64 bytes long. One such example is when QEMU is configured to use a standalone TAP device (not set to be a part of any bridge) receives and ARP packet. In cases like that we need to add more than just 4-bytes of CRC padding and ensure that our payload is at least 60 bytes long, such that, when combined with CRC padding bytes the resulting size is at least 802.3 minimum MTU bytes long (64). Failing to do that results in code in etsec_walk_rx_ring() setting BD_RX_SH which, in turn, makes corresponding Linux driver of emulated host to reject buffer as a runt packet Signed-off-by: Andrey Smirnov Signed-off-by: Jason Wang --- hw/net/fsl_etsec/rings.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/net/fsl_etsec/rings.c b/hw/net/fsl_etsec/rings.c index 79d2f14dd8..54c01275d4 100644 --- a/hw/net/fsl_etsec/rings.c +++ b/hw/net/fsl_etsec/rings.c @@ -474,6 +474,14 @@ static void rx_init_frame(eTSEC *etsec, const uint8_t *buf, size_t size) /* CRC padding (We don't have to compute the CRC) */ etsec->rx_padding = 4; + /* + * Ensure that payload length + CRC length is at least 802.3 + * minimum MTU size bytes long (64) + */ + if (etsec->rx_buffer_len < 60) { + etsec->rx_padding += 60 - etsec->rx_buffer_len; + } + etsec->rx_first_in_frame = 1; etsec->rx_remaining_data = etsec->rx_buffer_len; RING_DEBUG("%s: rx_buffer_len:%u rx_padding+crc:%u\n", __func__, From 9f5832d34b0c155e9538a745c80e441aed257670 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Mon, 28 Nov 2016 10:13:15 -0800 Subject: [PATCH 3/3] fsl_etsec: Fix various small problems in hexdump code Fix various small problems in hexdump code, such as: - Reference to non-existing field etsec->nic->nc.name is replaced with nc->name - Type mismatch warnings Signed-off-by: Andrey Smirnov Signed-off-by: Jason Wang --- hw/net/fsl_etsec/etsec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/net/fsl_etsec/etsec.c b/hw/net/fsl_etsec/etsec.c index 951c5f0038..fadf9c8faf 100644 --- a/hw/net/fsl_etsec/etsec.c +++ b/hw/net/fsl_etsec/etsec.c @@ -348,8 +348,8 @@ static ssize_t etsec_receive(NetClientState *nc, eTSEC *etsec = qemu_get_nic_opaque(nc); #if defined(HEX_DUMP) - fprintf(stderr, "%s receive size:%d\n", etsec->nic->nc.name, size); - qemu_hexdump(buf, stderr, "", size); + fprintf(stderr, "%s receive size:%zd\n", nc->name, size); + qemu_hexdump((void *)buf, stderr, "", size); #endif /* Flush is unnecessary as are already in receiving path */ etsec->need_flush = false;