dual_mac fw: fix possible ingress buffer management issues

P_W32 macro didn't c check "buffer full" after wrapping the wr_cur pointer.
That might cause data corruption. This commit fixed this issue.

Signed-off-by: Vitaly Andrianov <vitalya@ti.com>

diff --git a/firmware/icss_dualmac/src/psisandf.h b/firmware/icss_dualmac/src/psisandf.h
index 9f38098e18c31b197879eb88d971b4735c819f65..4d085618c19039c88bb953809f170dea05059dc6 100644 (file)
--- a/firmware/icss_dualmac/src/psisandf.h
+++ b/firmware/icss_dualmac/src/psisandf.h
@@ -70,29 +70,21 @@ MINPS .set  32   ;1st slot for 32 byte chunks
 ;called by Rx Task
 ;----------------------
 ;push r2-r9 to a bs slot, start of packet
-P_W32_S .macro  full_lable
-       .newblock
-        mov     GRegs.snf.b.wr_orig, GRegs.snf.b.wr_cur   ;stash original write pointer in case we abort
-        mov     r10, GRegs.snf.b.wr_cur
-        xout    Q_XID, &r2, 36
-        add     GRegs.snf.b.wr_cur, GRegs.snf.b.wr_cur, 1
-        qbeq    full_lable, GRegs.snf.b.wr_cur, GRegs.snf.b.rd_cur
-        qbge    $1, GRegs.snf.b.wr_cur, MAXPS
-        ldi     GRegs.snf.b.wr_cur, MINPS
-$1:
-  .endm
-
 ;push r2-r9 to a bs slot
 ; GR_AUX_STATE holds slot control info (r/w ptr)
-P_W32  .macro  full_lable
+P_W32  .macro  full_label
        .newblock
         mov     r10, GRegs.snf.b.wr_cur
         xout    Q_XID, &r2, 36
         add     GRegs.snf.b.wr_cur, GRegs.snf.b.wr_cur, 1
-        qbeq    full_lable, GRegs.snf.b.wr_cur, GRegs.snf.b.rd_cur
         qbge    $1, GRegs.snf.b.wr_cur, MAXPS
         ldi     GRegs.snf.b.wr_cur, MINPS
-$1:
+$1:     qbeq    full_label, GRegs.snf.b.wr_cur, GRegs.snf.b.rd_cur
+ .endm
+
+P_W32_S .macro  full_label
+        mov     GRegs.snf.b.wr_orig, GRegs.snf.b.wr_cur   ;stash original write pointer in case we abort
+       P_W32   full_label
  .endm
 
 P_W32_ABORT .macro
@@ -136,6 +128,13 @@ md_lab2?:
 eop_lab?:
  .endm
 
+READ_PAGE      .macro  page
+        TM_DISABLE
+        mov    r10.w0, page
+       xout    Q_XID, &r10.w0, 2
+       xin     Q_XID, &r2, 32 
+        TM_ENABLE
+ .endm
 
 ;poll routine for bg.  read 32 bytes from BS and send to host in 2 psi transfers
 ; r_s = psi state
@@ -145,11 +144,7 @@ PSISANDF_TX        .macro   more_data_label, eop_label
 ;have data ready
        qbge    tx_cont1a?, BgRegs.len2host, 32
 ;read the 32 bytes & write to PSI in 2 transactions
-        TM_DISABLE
-        mov    r10.w0, GRegs.snf.b.rd_cur
-       xout    Q_XID, &r10.w0, 2
-       xin     Q_XID, &r2, 32 
-        TM_ENABLE
+        READ_PAGE GRegs.snf.b.rd_cur
        ldi32   r1, MD_DATA0
        PSI_WRITE
         PSILOOP_STALL_TX_OK  ;stall until PSI tx status good
@@ -163,11 +158,7 @@ PSISANDF_TX        .macro   more_data_label, eop_label
        jmp     more_data_label
 
 tx_cont1a?:   ;eop 
-        TM_DISABLE
-        mov r10.w0,GRegs.snf.b.rd_cur
-       xout    Q_XID, &r10.w0, 2
-       xin     Q_XID, &r2, 32 
-        TM_ENABLE
+        READ_PAGE GRegs.snf.b.rd_cur
         add    GRegs.snf.b.rd_cur, GRegs.snf.b.rd_cur, 1
         qbge   chk_len?, GRegs.snf.b.rd_cur, MAXPS
         ldi    GRegs.snf.b.rd_cur,MINPS

diff --git a/firmware/icss_dualmac/src/rxl2_txl2.asm b/firmware/icss_dualmac/src/rxl2_txl2.asm
index 7bcdf6543319a3c81b503b4a65af56330e08de9d..84d9382bc1035a2afe310212ee3f190bec0b1756 100644 (file)
--- a/firmware/icss_dualmac/src/rxl2_txl2.asm
+++ b/firmware/icss_dualmac/src/rxl2_txl2.asm
@@ -615,6 +615,7 @@ RX_B0:
 
 ;some error/exception cases handling here
 rxb0_full:  ;psi fifo in bsram full
+       P_W32_ABORT
        ldi     GRegs.rx.x, 0x7F80
        add     GRegs.snf.b.dbg_cnt, GRegs.snf.b.dbg_cnt, 1
        jmp     rx_b0_done