Hi Victor,

I thought about that, but release Packet is on both the root and the packet. One of them is an mPipe packet, the other is a pseudo packet that will not be sent.

Regards,
-Ken

On Jul 25, 2013, at 2:23 AM, "Victor Julien" <notifications@github.com<mailto:notifications@github.com>> wrote:


In src/source-mpipe.c:

> +    edesc.words[1] = 0;
> +    edesc.bound = 1;
> +    edesc.xfer_size = p->mpipe_v.idesc.l2_size;
> +    edesc.va = p->mpipe_v.idesc.va;
> +    edesc.stack_idx = p->mpipe_v.idesc.stack_idx;
> +    edesc.hwb = 1; /* mPIPE will return packet buffer to proper stack. */
> +    edesc.size = p->mpipe_v.idesc.size;
> +    int channel = p->mpipe_v.idesc.channel;
> +    /* Tell mPIPE to egress the packet. */
> +    gxio_mpipe_equeue_put(channel_to_equeue[channel].peer_equeue, edesc);
> +}
> +
> +/* Release Packet and send copy if action is not DROP. */
> +void MpipeReleasePacketCopyIPS(Packet *p)
> +{
> +    if (unlikely(p->action & ACTION_DROP)) {


Wonder if we should use PACKET_TEST_ACTION(p, ACTION_DROP) here. It checks the 'root' pkt in case of tunneled/defrag/streamend pseudo pkts.

—
Reply to this email directly or view it on GitHub<https://github.com/inliniac/suricata/pull/462/files#r5393859>.