xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

ether82563, ether82598, etherx550: round rbsz to multiple of 1K

Browse source 
the max packet size is configured in 1K increments on these chips,
which can result in the card receiving a 10K packet but the
driver having only allocated 9.5K of buffer. this actually caued
pool corruption with i210, i217, i218, i219, i350.

for 82598 and x550, we explicitely round rbsz to avoid similar bugs
in the future, even tho the Rbsz constant was already a multiple of
1K and is not affected by the bug.
This commit is contained in:
cinap_lenrek 2019-01-12 15:34:23 +01:00
parent d0f824edc2
commit 53275c7045
3 changed files with 12 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

10
sys/src/9/pc/ether82563.c
View file

@ -512,7 +512,7 @@ struct Ctlr {
void *alloc; /* receive/transmit descriptors */ void *alloc; /* receive/transmit descriptors */
int nrd; int nrd;
int ntd; int ntd;
uint rbsz; int rbsz;
u32int *nic; u32int *nic;
Lock imlock; Lock imlock;
@ -942,8 +942,6 @@ i82563rxinit(Ctlr *ctlr)
csr32w(ctlr, Rctl, Dpf|Bsize2048|Bam|RdtmsHALF); csr32w(ctlr, Rctl, Dpf|Bsize2048|Bam|RdtmsHALF);
else{ else{
i = ctlr->rbsz / 1024; i = ctlr->rbsz / 1024;
if(ctlr->rbsz % 1024)
i++;
if(cttab[ctlr->type].flag & F75){ if(cttab[ctlr->type].flag & F75){
csr32w(ctlr, Rctl, Lpe|Dpf|Bsize2048|Bam|RdtmsHALF|Secrc); csr32w(ctlr, Rctl, Lpe|Dpf|Bsize2048|Bam|RdtmsHALF|Secrc);
if(ctlr->type != i82575) if(ctlr->type != i82575)
@ -1098,7 +1096,7 @@ phyread(Ctlr *c, int phyno, int reg)
microdelay(1); microdelay(1);
} }
if((phy & (MDIe|MDIready)) != MDIready){ if((phy & (MDIe|MDIready)) != MDIready){
print("%s: phy %d wedged %.8ux\n", cttab[c->type].name, phyno, phy); print("%s: phy %d wedged %.8ux\n", cname(c), phyno, phy);
return ~0; return ~0;
} }
return phy & 0xffff; return phy & 0xffff;
@ -2032,7 +2030,7 @@ i82563pci(void)
} }
ctlr->type = type; ctlr->type = type;
ctlr->pcidev = p; ctlr->pcidev = p;
ctlr->rbsz = cttab[type].mtu; ctlr->rbsz = ROUND(cttab[type].mtu, 1024);
ctlr->port = p->mem[0].bar & ~0x0F; ctlr->port = p->mem[0].bar & ~0x0F;
if(i82563ctlrhead != nil) if(i82563ctlrhead != nil)
i82563ctlrtail->next = ctlr; i82563ctlrtail->next = ctlr;
@ -2098,7 +2096,7 @@ pnp(Ether *edev, int type)
edev->irq = ctlr->pcidev->intl; edev->irq = ctlr->pcidev->intl;
edev->tbdf = ctlr->pcidev->tbdf; edev->tbdf = ctlr->pcidev->tbdf;
edev->mbps = 1000; edev->mbps = 1000;
edev->maxmtu = ctlr->rbsz; edev->maxmtu = cttab[ctlr->type].mtu;
memmove(edev->ea, ctlr->ra, Eaddrlen); memmove(edev->ea, ctlr->ra, Eaddrlen);
/* /*

8
sys/src/9/pc/ether82598.c
View file

@ -305,7 +305,7 @@ typedef struct {
/* tweakable paramaters */ /* tweakable paramaters */
enum { enum {
Rbsz = 12*1024, Mtu = 12*1024,
Nrd = 256, Nrd = 256,
Ntd = 256, Ntd = 256,
Nrb = 256, Nrb = 256,
@ -500,7 +500,7 @@ rxinit(Ctlr *c)
c->reg[Fctrl] |= Bam; c->reg[Fctrl] |= Bam;
c->reg[Rxcsum] |= Ipcs; c->reg[Rxcsum] |= Ipcs;
c->reg[Srrctl] = (c->rbsz + 1023)/1024; c->reg[Srrctl] = c->rbsz / 1024;
c->reg[Mhadd] = c->rbsz << 16; c->reg[Mhadd] = c->rbsz << 16;
c->reg[Hlreg0] |= Jumboen; c->reg[Hlreg0] |= Jumboen;
@ -902,7 +902,7 @@ scan(void)
c->io = io; c->io = io;
c->reg = (u32int*)mem; c->reg = (u32int*)mem;
c->regmsi = (u32int*)memmsi; c->regmsi = (u32int*)memmsi;
c->rbsz = Rbsz; c->rbsz = ROUND(Mtu, 1024);
if(reset(c)){ if(reset(c)){
print("i82598: can't reset\n"); print("i82598: can't reset\n");
free(c); free(c);
@ -948,7 +948,7 @@ pnp(Ether *e)
e->irq = c->p->intl; e->irq = c->p->intl;
e->tbdf = c->p->tbdf; e->tbdf = c->p->tbdf;
e->mbps = 10000; e->mbps = 10000;
e->maxmtu = c->rbsz; e->maxmtu = Mtu;
e->arg = e; e->arg = e;
e->attach = attach; e->attach = attach;

8
sys/src/9/pc/etherx550.c
View file

@ -267,7 +267,7 @@ typedef struct {
/* tweakable paramaters */ /* tweakable paramaters */
enum { enum {
Rbsz = 12*1024, Mtu = 12*1024,
Nrd = 256, Nrd = 256,
Ntd = 256, Ntd = 256,
Nrb = 256, Nrb = 256,
@ -467,7 +467,7 @@ rxinit(Ctlr *c)
c->reg[Fctrl] |= Bam; c->reg[Fctrl] |= Bam;
c->reg[Rxcsum] |= Ippcse; c->reg[Rxcsum] |= Ippcse;
c->reg[Srrctl] = (c->rbsz + 1023)/1024; c->reg[Srrctl] = c->rbsz / 1024;
c->reg[Maxfrs] = c->rbsz << 16; c->reg[Maxfrs] = c->rbsz << 16;
c->reg[Hlreg0] |= Jumboen; c->reg[Hlreg0] |= Jumboen;
@ -852,7 +852,7 @@ scan(void)
c->io = io; c->io = io;
c->reg = (u32int*)mem; c->reg = (u32int*)mem;
c->regmsi = (u32int*)memmsi; c->regmsi = (u32int*)memmsi;
c->rbsz = Rbsz; c->rbsz = ROUND(Mtu, 1024);
if(reset(c)){ if(reset(c)){
print("iX550: can't reset\n"); print("iX550: can't reset\n");
free(c); free(c);
@ -898,7 +898,7 @@ pnp(Ether *e)
e->irq = c->p->intl; e->irq = c->p->intl;
e->tbdf = c->p->tbdf; e->tbdf = c->p->tbdf;
e->mbps = 10000; e->mbps = 10000;
e->maxmtu = c->rbsz; e->maxmtu = Mtu;
e->arg = e; e->arg = e;
e->attach = attach; e->attach = attach;