[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 08/10] dp8393x: Implement packet size limit and RBAE interrupt
From: |
Finn Thain |
Subject: |
[PATCH 08/10] dp8393x: Implement packet size limit and RBAE interrupt |
Date: |
Sat, 14 Dec 2019 12:25:57 +1100 |
Add a bounds check to prevent a large packet from causing a buffer
overflow. This is defensive programming -- I haven't actually tried
sending an oversized packet or a jumbo ethernet frame.
The SONIC handles packets that are too big for the buffer by raising
the RBAE interrupt and dropping them. Linux uses that interrupt to
count dropped packets.
Signed-off-by: Finn Thain <address@hidden>
---
QEMU passes short packets to dp8393x_receive(). But a real SONIC rejects
packets shorter than 64 bytes.
For dp8393x, the effective limit is 60 bytes because packets passed to
dp8393x_receive() lack a frame checksum. However, even 60 bytes proved
too high and blocked ARP packets when I tried it.
So the SONIC's mechanism for detecting runt packets (the RNT bit in the
RCR register) remains unimplemented in dp8393x (i.e. they are still
accepted).
This packet length issue may have implications for guests that depend on
the chip honouring the packet length threshold set in the EOBC register.
---
hw/net/dp8393x.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 5e4494a945..24f2e19f07 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -139,6 +139,7 @@ do { printf("sonic ERROR: %s: " fmt, __func__ , ##
__VA_ARGS__); } while (0)
#define SONIC_TCR_CRCI 0x2000
#define SONIC_TCR_PINT 0x8000
+#define SONIC_ISR_RBAE 0x0010
#define SONIC_ISR_RBE 0x0020
#define SONIC_ISR_RDE 0x0040
#define SONIC_ISR_TC 0x0080
@@ -751,6 +752,14 @@ static ssize_t dp8393x_receive(NetClientState *nc, const
uint8_t * buf,
uint32_t checksum;
int size;
+ if (pkt_size + 4 > dp8393x_rbwc(s) * 2) {
+ DPRINTF("oversize packet, pkt_size is %d\n", pkt_size);
+ s->regs[SONIC_ISR] |= SONIC_ISR_RBAE;
+ dp8393x_update_irq(s);
+ dp8393x_do_read_rra(s);
+ return pkt_size;
+ }
+
width = (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1;
s->regs[SONIC_RCR] &= ~(SONIC_RCR_PRX | SONIC_RCR_LBK | SONIC_RCR_FAER |
--
2.23.0
- [PATCH 09/10] dp8393x: Don't stop reception upon RBE interrupt assertion, (continued)
- [PATCH 09/10] dp8393x: Don't stop reception upon RBE interrupt assertion, Finn Thain, 2019/12/13
- [PATCH 04/10] dp8393x: Don't advance RX descriptor twice, Finn Thain, 2019/12/13
- [PATCH 06/10] dp8393x: Clear RRRA command register bit only when appropriate, Finn Thain, 2019/12/13
- [PATCH 02/10] dp8393x: Clean up endianness hacks, Finn Thain, 2019/12/13
- [PATCH 01/10] dp8393x: Mask EOL bit from descriptor addresses, Finn Thain, 2019/12/13
- [PATCH 03/10] dp8393x: Have dp8393x_receive() return the packet size, Finn Thain, 2019/12/13
- [PATCH 08/10] dp8393x: Implement packet size limit and RBAE interrupt,
Finn Thain <=
- Re: [PATCH 00/10] Fixes for DP8393X SONIC device emulation, no-reply, 2019/12/13
- Re: [PATCH 00/10] Fixes for DP8393X SONIC device emulation, Aleksandar Markovic, 2019/12/14