From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:46143) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZcXbo-0005Rg-UT for qemu-devel@nongnu.org; Thu, 17 Sep 2015 07:44:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZcXbk-0001ND-V3 for qemu-devel@nongnu.org; Thu, 17 Sep 2015 07:44:12 -0400 Received: from mx1.redhat.com ([209.132.183.28]:58202) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZcXbk-0001My-Qq for qemu-devel@nongnu.org; Thu, 17 Sep 2015 07:44:08 -0400 From: Stefan Hajnoczi Date: Thu, 17 Sep 2015 12:44:00 +0100 Message-Id: <1442490241-17702-4-git-send-email-stefanha@redhat.com> In-Reply-To: <1442490241-17702-1-git-send-email-stefanha@redhat.com> References: <1442490241-17702-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PULL 3/4] net: smc91c111: gate can_receive() on rx FIFO having a slot List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Peter Crosthwaite , Stefan Hajnoczi , Peter Crosthwaite From: Peter Crosthwaite Return false from can_receive() when the FIFO doesn't have a free RX slot. This fixes a bug in the current code where the allocated buffer is freed before the fifo pop, triggering a premature flush of queued RX packets. It also will handle a corner case, where the guest manually frees the allocated buffer before popping the rx FIFO (hence it is not enough to just delay the flush_queued_packets()). Reported-by: Richard Purdie Signed-off-by: Peter Crosthwaite Reviewed-by: Fam Zheng Tested-by: Richard Purdie Message-id: 97bfdfc5cbce0bd5e0cbbbff35ce7a1bf6f8603d.1441873621.git.crosthwaite.peter@gmail.com Signed-off-by: Stefan Hajnoczi --- hw/net/smc91c111.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index 5774eff..8fc3deb 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -129,7 +129,8 @@ static int smc91c111_can_receive(smc91c111_state *s) if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) { return 1; } - if (s->allocated == (1 << NUM_PACKETS) - 1) { + if (s->allocated == (1 << NUM_PACKETS) - 1 || + s->rx_fifo_len == NUM_PACKETS) { return 0; } return 1; @@ -182,6 +183,7 @@ static void smc91c111_pop_rx_fifo(smc91c111_state *s) } else { s->int_level &= ~INT_RCV; } + smc91c111_flush_queued_packets(s); smc91c111_update(s); } -- 2.4.3