On Wed, Oct 17, 2012 at 08:31:46PM +0200, Dmitry Fleytman wrote: > Device RX initization from driver's side consists of following steps: > 1. Initialize head and tail of RX ring to 0 > 2. Enable Rx (set bit in RCTL register) > 3. Allocate buffers, fill descriptors > 4. Write ring tail > > Forth operation signals hardware that RX buffers available > and it may start packets indication. > > Current implementation treats first operation (write 0 to ring tail) > as signal of buffers availability and starts data transfers as soon > as RX enable indicaton arrives. > > This is not correct because there is a chance that ring is still > empty (third action not performed yet) and then memory corruption > occures.
The existing code tries to prevent this: e1000_receive(NetClientState *nc, const uint8_t *buf, size_t size) { [...] if (!(s->mac_reg[RCTL] & E1000_RCTL_EN)) return -1; [...] total_size = size + fcs_len(s); if (!e1000_has_rxbufs(s, total_size)) { set_ics(s, 0, E1000_ICS_RXO); return -1; } Why are these checks not enough? Which memory gets corrupted? Stefan