fix: harden ch390 rx protocol handling

Drivers/CH390/CH390.c

@@ -92,6 +92,7 @@ int ch390_peek_packet(uint8_t *rx_status, uint16_t *rx_len)
 uint32_t ch390_receive_packet(uint8_t *buff, uint8_t *rx_status)
 {
     uint8_t nsr;
+    uint8_t ready;
     uint16_t rx_len = 0;
 	uint8_t ReceiveData[4];
 
@@ -107,6 +108,18 @@ uint32_t ch390_receive_packet(uint8_t *buff, uint8_t *rx_status)
         return 0;
     }
 
+    (void)ch390_read_mrcmdx();
+    ready = ch390_read_mrcmdx1();
+    if (ready == 0u)
+    {
+        return 0;
+    }
+    if (ready != CH390_PKT_RDY)
+    {
+        ch390_rx_reset();
+        return 0;
+    }
+
     ch390_read_mem(ReceiveData, 4);
 
     if (rx_status != 0)
@@ -115,15 +128,17 @@ uint32_t ch390_receive_packet(uint8_t *buff, uint8_t *rx_status)
     }
     rx_len = (uint16_t)ReceiveData[2] | ((uint16_t)ReceiveData[3] << 8);
 
-    if (((ReceiveData[1] & 0x3Fu) != 0u) ||
+    if ((ReceiveData[0] != CH390_PKT_RDY) ||
-        (rx_len < 14u) ||
+        ((ReceiveData[1] & 0x3Fu) != 0u) ||
+        (rx_len < (uint16_t)(14u + CH390_PKT_CRC_LEN)) ||
         (rx_len > CH390_PKT_MAX))
     {
+        ch390_rx_reset();
         return 0;
     }
 
     ch390_read_mem(buff, rx_len);
-    return rx_len;
+    return (uint32_t)(rx_len - CH390_PKT_CRC_LEN);
 }
 
 /**
@@ -189,6 +204,7 @@ void ch390_rx_reset(void)
     uint8_t rcr = ch390_read_reg(CH390_RCR);
 
     ch390_write_reg(CH390_RCR, (uint8_t)(rcr & (uint8_t)(~RCR_RXEN)));
+    ch390_write_reg(CH390_MPTRCR, MPTRCR_RST_RX);
     ch390_write_reg(CH390_NSR, NSR_RXOV);
     ch390_write_reg(CH390_ISR, (uint8_t)(ISR_ROS | ISR_ROO | ISR_PR));
     ch390_write_reg(CH390_RCR, (uint8_t)(rcr | RCR_RXEN));

Drivers/CH390/CH390.h

@@ -150,6 +150,8 @@ enum ch390_phy_mode
 #define CH390_BCASTCR   0x53
 #define CH390_INTCKCR   0x54
 #define CH390_MPTRCR    0x55
+    #define MPTRCR_RST_TX   (1<<1)
+    #define MPTRCR_RST_RX   (1<<0)
 #define CH390_MLEDCR    0x57
 #define CH390_MRCMDX    0x70
 #define CH390_MRCMDX1   0x71
@@ -302,6 +304,8 @@ enum ch390_phy_mode
 #define CH390_RLENCR    0x52
 #define CH390_BCASTCR   0x53
 #define CH390_MPTRCR    0x55
+    #define MPTRCR_RST_TX   (1<<1)
+    #define MPTRCR_RST_RX   (1<<0)
 #define CH390_MRCMDX    0xF0
 #define CH390_MRCMDX1   0xF1
 #define CH390_MRCMD     0xF2
@@ -356,6 +360,7 @@ enum ch390_phy_mode
 #define CH390_PKT_NONE  0x00    /* No packet received */
 #define CH390_PKT_RDY   0x01    /* Packet ready to receive */
 #define CH390_PKT_ERR   0xFE    /* Un-stable states */
+#define CH390_PKT_CRC_LEN 4u    /* Ethernet FCS stored in RX SRAM */
 #define CH390_PKT_MAX   1536    /* Received packet max size */
 #define CH390_PKT_MIN   64
 

Drivers/CH390/CH390_Interface.c

@@ -283,25 +283,16 @@ uint8_t ch390_read_reg(uint8_t reg)
 
 static uint8_t ch390_read_rx_reg(uint8_t reg)
 {
-    uint8_t tx_buf[3];
+    uint8_t value;
-    uint8_t rx_buf[3];
-
-    tx_buf[0] = OPC_MEM_DMY_R;
-    tx_buf[1] = reg;
-    tx_buf[2] = 0x00u;
 
     CH390_SPI_ATOMIC_ENTER();
     ch390_cs(0);
-    if (HAL_SPI_TransmitReceive(&hspi1, tx_buf, rx_buf, 3, SPI_TIMEOUT) != HAL_OK)
+    ch390_spi_exchange_byte(reg | OPC_REG_R);
-    {
+    value = ch390_spi_dummy_read();
-        ch390_cs(1);
-        CH390_SPI_ATOMIC_EXIT();
-        return 0u;
-    }
     ch390_cs(1);
     CH390_SPI_ATOMIC_EXIT();
 
-    return rx_buf[2];
+    return value;
 }
 
 uint8_t ch390_read_mrcmdx(void)

Drivers/CH390/CH390_Interface.h

@@ -30,28 +30,28 @@ uint8_t ch390_read_reg(uint8_t reg);
 
 /**
  * @name ch390_read_mrcmdx
- * @brief Read MRCMDX via memory-dummy-read opcode
+ * @brief Read MRCMDX receive-ready latch
  * @return Register value
  */
 uint8_t ch390_read_mrcmdx(void);
 
 /**
  * @name ch390_read_mrcmdx1
- * @brief Read MRCMDX1 via memory-dummy-read opcode
+ * @brief Read MRCMDX1 receive-ready latch
  * @return Register value
  */
 uint8_t ch390_read_mrcmdx1(void);
 
 /**
  * @name ch390_read_mrrl
- * @brief Read MRRL via memory-dummy-read opcode
+ * @brief Read MRRL receive memory pointer register
  * @return Register value
  */
 uint8_t ch390_read_mrrl(void);
 
 /**
  * @name ch390_read_mrrh
- * @brief Read MRRH via memory-dummy-read opcode
+ * @brief Read MRRH receive memory pointer register
  * @return Register value
  */
 uint8_t ch390_read_mrrh(void);