On Sun, 18 Oct 2026 at 14:36, Marcelo Manzo <[email protected]> wrote: > > From: Sergey Kambalin <[email protected]> > > Implement the transmit DMA ring handling: walk TX descriptors > between the consumer and producer index for a ring, pull frame data > out of guest memory, and hand completed frames to the netdev peer > via qemu_send_packet(), advancing the consumer index and raising the > TXDMA_MBDONE interrupt as descriptors complete. > > Part of Sergey Kambalin's original Raspberry Pi 4B PCIe/GENET > networking series (patchwork series 829638, posted to qemu-devel in > 2024, never merged). Carried forward and completed by Marcelo Manzo. > > While carrying this forward, fix bcm2838_genet_tdma_ring_active(): > it extracted the per-ring enable bit using the DMA_CTRL register's > 1-bit EN field definition instead of DMA_RING_CFG's 17-bit EN field > (one bit per ring), so only ring 0 ever appeared active and TX > traffic hashed onto any other queue was silently dropped, eventually > tripping the guest's qdisc watchdog ("NETDEV WATCHDOG: transmit > queue N timed out") and breaking DHCP. > > While carrying this forward, also: > > - Check that a frame is at least a status block plus an Ethernet > header before looking at it, and that the descriptors of a frame > don't add up to more than the TX buffer, so a guest can't make us > read or write outside it. > - Check that reading the frame data from guest memory succeeded. > - Use lduw_be_p()/stw_be_p() for the length/type field. > > Signed-off-by: Sergey Kambalin <[email protected]> > Signed-off-by: Marcelo Manzo <[email protected]>
Reviewed-by: Peter Maydell <[email protected]> thanks -- PMM
