[PATCH] net: hip04: use 16-bit byte order for HI13X1 TX fields

The HI13X1 transmit descriptor stores send_size and data_offset in u16
fields, but hip04_mac_start_xmit() converts both values with
cpu_to_be32() before assigning them. On little-endian systems the
assignment truncates the converted value, leaving neither field with the
intended 16-bit big-endian representation.

Use cpu_to_be16() for the two HI13X1 fields. Keep the original 32-bit
conversion for the other descriptor format.

Fixes: d413779cdd93 ("net: hisilicon: Add an tx_desc to adapt HI13X1_GMAC")
Signed-off-by: hpp.iscas <redacted>
---
 drivers/net/ethernet/hisilicon/hip04_eth.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
index fc2c47d..2920985 100644
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c

@@ -527,13 +527,14 @@ hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 	priv->tx_skb[tx_head] = skb;
 	priv->tx_phys[tx_head] = phys;
 
-	desc->send_size = (__force u32)cpu_to_be32(skb->len);
 #if defined(CONFIG_HI13X1_GMAC)
+	desc->send_size = (__force u16)cpu_to_be16(skb->len);
 	desc->cfg = (__force u32)cpu_to_be32(TX_CLEAR_WB | TX_FINISH_CACHE_INV
 		| TX_RELEASE_TO_PPE | priv->port << TX_POOL_SHIFT);
-	desc->data_offset = (__force u32)cpu_to_be32(phys & SOC_CACHE_LINE_MASK);
+	desc->data_offset = (__force u16)cpu_to_be16(phys & SOC_CACHE_LINE_MASK);
 	desc->send_addr =  (__force u32)cpu_to_be32(phys & ~SOC_CACHE_LINE_MASK);
 #else
+	desc->send_size = (__force u32)cpu_to_be32(skb->len);
 	desc->cfg = (__force u32)cpu_to_be32(TX_CLEAR_WB | TX_FINISH_CACHE_INV);
 	desc->send_addr = (__force u32)cpu_to_be32(phys);
 #endif

On Sat, Sep 05, 2026 at 09:29:58PM +0800, hpp.iscas wrote:

The HI13X1 transmit descriptor stores send_size and data_offset in u16
fields, but hip04_mac_start_xmit() converts both values with
cpu_to_be32() before assigning them. On little-endian systems the
assignment truncates the converted value, leaving neither field with the
intended 16-bit big-endian representation.

Use cpu_to_be16() for the two HI13X1 fields. Keep the original 32-bit
conversion for the other descriptor format.

I am curious to know a) how this bug was found b) how it seems to have
gone otherwise unnoticed since 2019.

Fixes: d413779cdd93 ("net: hisilicon: Add an tx_desc to adapt HI13X1_GMAC")
Signed-off-by: hpp.iscas <redacted>

Please consider using your name in the From field and the Signed-off-by tag.

The fix itself looks good to me:
Reviewed-by: Simon Horman <horms@kernel.org>

on 2026/9/5 21:29, hpp.iscas wrote:

The HI13X1 transmit descriptor stores send_size and data_offset in u16

fields, but hip04_mac_start_xmit() converts both values with

cpu_to_be32() before assigning them. On little-endian systems the

assignment truncates the converted value, leaving neither field with the

intended 16-bit big-endian representation.



Use cpu_to_be16() for the two HI13X1 fields. Keep the original 32-bit

conversion for the other descriptor format.



Fixes: d413779cdd93 ("net: hisilicon: Add an tx_desc to adapt HI13X1_GMAC")

Signed-off-by: hpp.iscas <redacted>

Thanks!

Reviewed-by: Jijie Shao <shaojijie@huawei.com>