[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 1/2] Ignore RX tail kicks when RX disabled.
From: |
Stefan Hajnoczi |
Subject: |
Re: [Qemu-devel] [PATCH 1/2] Ignore RX tail kicks when RX disabled. |
Date: |
Thu, 18 Oct 2012 09:31:56 +0200 |
User-agent: |
Mutt/1.5.21 (2010-09-15) |
On Wed, Oct 17, 2012 at 08:31:46PM +0200, Dmitry Fleytman wrote:
> Device RX initization from driver's side consists of following steps:
> 1. Initialize head and tail of RX ring to 0
> 2. Enable Rx (set bit in RCTL register)
> 3. Allocate buffers, fill descriptors
> 4. Write ring tail
>
> Forth operation signals hardware that RX buffers available
> and it may start packets indication.
>
> Current implementation treats first operation (write 0 to ring tail)
> as signal of buffers availability and starts data transfers as soon
> as RX enable indicaton arrives.
>
> This is not correct because there is a chance that ring is still
> empty (third action not performed yet) and then memory corruption
> occures.
The existing code tries to prevent this:
e1000_receive(NetClientState *nc, const uint8_t *buf, size_t size)
{
[...]
if (!(s->mac_reg[RCTL] & E1000_RCTL_EN))
return -1;
[...]
total_size = size + fcs_len(s);
if (!e1000_has_rxbufs(s, total_size)) {
set_ics(s, 0, E1000_ICS_RXO);
return -1;
}
Why are these checks not enough?
Which memory gets corrupted?
Stefan
Re: [Qemu-devel] [PATCH 1/2] Ignore RX tail kicks when RX disabled.,
Stefan Hajnoczi <=
[Qemu-devel] [PATCH 2/2] Add check_rxov into VMState., Dmitry Fleytman, 2012/10/17