diff mbox series

[for-5.2,13/19] ftgmac100: Check for invalid len and address before doing a DMA transfer

Message ID 20200806132106.747414-14-clg@kaod.org (mailing list archive)
State New, archived
Headers show
Series aspeed: mostly cleanups and some extensions | expand

Commit Message

Cédric Le Goater Aug. 6, 2020, 1:21 p.m. UTC
According to the Aspeed specs, no interrupts are raised in that case
but a "Tx-packets lost" status seems like a good modeling choice for
all implementations. It is covered by the Linux kernel.

Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/net/ftgmac100.c | 9 +++++++++
 1 file changed, 9 insertions(+)

Comments

Joel Stanley Aug. 6, 2020, 11:51 p.m. UTC | #1
On Thu, 6 Aug 2020 at 13:21, Cédric Le Goater <clg@kaod.org> wrote:
>
> According to the Aspeed specs, no interrupts are raised in that case
> but a "Tx-packets lost" status seems like a good modeling choice for
> all implementations. It is covered by the Linux kernel.
>
> Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
> Signed-off-by: Cédric Le Goater <clg@kaod.org>

Reviewed-by: Joel Stanley <joel@jms.id.au>

> ---
>  hw/net/ftgmac100.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
> index 014980d30aca..280aa3d3a1e2 100644
> --- a/hw/net/ftgmac100.c
> +++ b/hw/net/ftgmac100.c
> @@ -507,6 +507,15 @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
>          }
>
>          len = FTGMAC100_TXDES0_TXBUF_SIZE(bd.des0);
> +        if (!len) {
> +            /*
> +             * 0 is an invalid size, however the HW does not raise any
> +             * interrupt. Flag an error because the guest is buggy.
> +             */
> +            qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid segment size\n",
> +                          __func__);
> +        }
> +
>          if (frame_size + len > sizeof(s->frame)) {
>              qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n",
>                            __func__, len);
> --
> 2.25.4
>
diff mbox series

Patch

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index 014980d30aca..280aa3d3a1e2 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -507,6 +507,15 @@  static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
         }
 
         len = FTGMAC100_TXDES0_TXBUF_SIZE(bd.des0);
+        if (!len) {
+            /*
+             * 0 is an invalid size, however the HW does not raise any
+             * interrupt. Flag an error because the guest is buggy.
+             */
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid segment size\n",
+                          __func__);
+        }
+
         if (frame_size + len > sizeof(s->frame)) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n",
                           __func__, len);