f7f742beb6
The datasheet doesn't explicitly say that TXFR_LEN has to be word
aligned but the fact there is a DMA_D_WIDTH flag to select between 32
bit and 128 bit strongly implies that is how it works. The downstream
rpi kernel also goes to efforts to not write sub-4 byte lengths so
lets:
- fail when mis-programmed and report GUEST_ERROR
- catch setting D_WIDTH for 128 bit and report UNIMP
Yodel did some digging into the specs (see discussion link):
{A} AMBA AXI Protocol Version: 2.0 Specification
https://documentation-service.arm.com/static/64256e84314e245d086bc88f
{B} BCM2835 ARM Peripherals
https://datasheets.raspberrypi.com/bcm2835/bcm2835-peripherals.pdf
[1] {A} (p. 10-2)
[2] {B} (p. 51)
[3] {A} (p. 14-5)
[4] {A} (p. 4-3)
[5] {A} (p. 9-4)
[6] {B} (p. 53)
However was unable to come up with an unambiguous conclusion without
testing on the real hardware. So in the absence of certainty and for
the sake of addressing the DoS I suggest we merge as is for now.
Link: https://lore.kernel.org/all/20251111105429.3993300-1-alex.bennee@linaro.org/
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3201
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20260710131500.2323848-1-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>