@@ -791,6 +791,9 @@ static int rtl8139_can_receive(VLANClientState *nc)
return 1;
if (!rtl8139_receiver_enabled(s))
return 1;
+ /* network/host communication happens only in normal mode */
+ if ((s->Cfg9346 & Chip9346_op_mask) != Cfg9346_Normal)
+ return 0;
if (rtl8139_cp_receiver_enabled(s)) {
/* ??? Flow control not implemented in c+ mode.
@@ -833,6 +836,12 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
return -1;
}
+ /* check whether we are in normal mode */
+ if ((s->Cfg9346 & Chip9346_op_mask) != Cfg9346_Normal) {
+ DPRINTF("not in normal op mode\n");
+ return -1;
+ }
+
/* XXX: check this */
if (s->RxConfig & AcceptAllPhys) {
/* promiscuous: receive all */
According the spec, the card works in network/host communication mode only when both EEM1 and EEM0 are unset in 93C46 Command Register (normal op mode). So this patch check these bits before trying to receive packets. As some guest driver (such as linux, see cp_init_hw() in 8139cp.c) allocate rx ring after the recevier were enabled, this would cause our emulation codes tries to dma into guest memory when the rx descriptor is not properly configured. This patch fixes this. Signed-off-by: Jason Wang <jasowang@redhat.com> --- hw/rtl8139.c | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-)