Repository: firecracker-microvm/firecracker
File: src/vmm/src/devices/virtio/net/device.rs (Rust)

Code before:
        if self.rx_deferred_frame {
            self.handle_deferred_frame()
        } else {
            Ok(())
        }
    }

    fn process_tx(&mut self) -> Result<(), DeviceError> {
        // This is safe since we checked in the event handler that the device is activated.
        let mem = self.device_state.mem().unwrap();

        // The MMDS network stack works like a state machine, based on synchronous calls, and
        // without being added to any event loop. If any frame is accepted by the MMDS, we also
        // trigger a process_rx() which checks if there are any new frames to be sent, starting
        // with the MMDS network stack.
        let mut process_rx_for_mmds = false;
        let mut used_any = false;
        let tx_queue = &mut self.queues[TX_INDEX];

        while let Some(head) = tx_queue.pop_or_enable_notification(mem) {
            self.metrics
                .tx_remaining_reqs_count
                .add(tx_queue.len(mem).into());
            let head_index = head.index;
            // Parse IoVecBuffer from descriptor head
            // SAFETY: This descriptor chain is only loaded into this buffer
            if unsafe { self.io_vec_buffer.load_descriptor_chain(head).is_err() } {
                self.metrics.tx_fails.inc();
                tx_queue
                    .add_used(mem, head_index, 0)
                    .map_err(DeviceError::QueueError)?;
                continue;
            }

            // We only handle frames that are up to MAX_BUFFER_SIZE
            if self.io_vec_buffer.len() > MAX_BUFFER_SIZE {
                error!("net: received too big frame from driver");
                self.metrics.tx_malformed_frames.inc();
                tx_queue
                    .add_used(mem, head_index, 0)
                    .map_err(DeviceError::QueueError)?;
                continue;
            }

            if !Self::rate_limiter_consume_op(&mut self.tx_rate_limiter, self.io_vec_buffer.len() as u64) {
                tx_queue.undo_pop();
                self.metrics.tx_rate_limiter_throttled.inc();
                break;
            }

            let frame_consumed_by_mmds = Self::write_to_mmds_or_tap(

Review comment (suggestion):
Let's elaborate on these - virtio requests are handled sequentially, so no two iovecbuffers are ever "live" at the same time, meaning this one really has exclusive ownership over the memory (well, from rust's side.. the guest can do as it pleases)

Code after:
            self.handle_deferred_frame()
        } else {
            Ok(())
        }
    }

    fn process_tx(&mut self) -> Result<(), DeviceError> {
        // This is safe since we checked in the event handler that the device is activated.
        let mem = self.device_state.mem().unwrap();

        // The MMDS network stack works like a state machine, based on synchronous calls, and
        // without being added to any event loop. If any frame is accepted by the MMDS, we also
        // trigger a process_rx() which checks if there are any new frames to be sent, starting
        // with the MMDS network stack.
        let mut process_rx_for_mmds = false;
        let mut used_any = false;
        let tx_queue = &mut self.queues[TX_INDEX];

        while let Some(head) = tx_queue.pop_or_enable_notification(mem) {
            self.metrics
                .tx_remaining_reqs_count
                .add(tx_queue.len(mem).into());
            let head_index = head.index;
            // Parse IoVecBuffer from descriptor head
            // SAFETY: This descriptor chain is only loaded once
            // virtio requests are handled sequentially so no two IoVecBuffers
            // are live at the same time, meaning this has exclusive ownership over the memory
            if unsafe { self.tx_buffer.load_descriptor_chain(head).is_err() } {
                self.metrics.tx_fails.inc();
                tx_queue
                    .add_used(mem, head_index, 0)
                    .map_err(DeviceError::QueueError)?;
                continue;
            };

            // We only handle frames that are up to MAX_BUFFER_SIZE
            if self.tx_buffer.len() as usize > MAX_BUFFER_SIZE {
                error!("net: received too big frame from driver");
                self.metrics.tx_malformed_frames.inc();
                tx_queue
                    .add_used(mem, head_index, 0)
                    .map_err(DeviceError::QueueError)?;
                continue;
            }

            if !Self::rate_limiter_consume_op(
                &mut self.tx_rate_limiter,
                u64::from(self.tx_buffer.len()),
            ) {
                tx_queue.undo_pop();
                self.metrics.tx_rate_limiter_throttled.inc();