From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:50762) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TOlAK-0004Jq-A9 for qemu-devel@nongnu.org; Thu, 18 Oct 2012 04:09:21 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TOlAG-0002Mo-8i for qemu-devel@nongnu.org; Thu, 18 Oct 2012 04:09:16 -0400 Received: from mail-bk0-f45.google.com ([209.85.214.45]:65495) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TOlAG-0002Mk-1r for qemu-devel@nongnu.org; Thu, 18 Oct 2012 04:09:12 -0400 Received: by mail-bk0-f45.google.com with SMTP id jf3so3382790bkc.4 for ; Thu, 18 Oct 2012 01:09:11 -0700 (PDT) Date: Thu, 18 Oct 2012 10:09:09 +0200 From: Stefan Hajnoczi Message-ID: <20121018080909.GF22425@stefanha-thinkpad.redhat.com> References: <1350498707-6749-1-git-send-email-dmitry@daynix.com> <1350498707-6749-2-git-send-email-dmitry@daynix.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1350498707-6749-2-git-send-email-dmitry@daynix.com> Subject: Re: [Qemu-devel] [PATCH 1/2] Ignore RX tail kicks when RX disabled. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Dmitry Fleytman Cc: Yan Vugenfirer , Chris Webb , qemu-devel@nongnu.org, Richard Davies On Wed, Oct 17, 2012 at 08:31:46PM +0200, Dmitry Fleytman wrote: > Device RX initization from driver's side consists of following steps: > 1. Initialize head and tail of RX ring to 0 > 2. Enable Rx (set bit in RCTL register) > 3. Allocate buffers, fill descriptors > 4. Write ring tail > > Forth operation signals hardware that RX buffers available > and it may start packets indication. > > Current implementation treats first operation (write 0 to ring tail) > as signal of buffers availability and starts data transfers as soon > as RX enable indicaton arrives. > > This is not correct because there is a chance that ring is still > empty (third action not performed yet) and then memory corruption > occures. Any idea what the point of hw/e1000.c check_rxov is? I see nothing in the datasheet that requires these semantics. The Linux e1000 driver never enables the RXO (rx fifo overflow) interrupt, only RXDMT0 (receive descriptor minimum threshold). This means hw/e1000.c will not upset the Linux e1000 driver when e1000_receive() gets called with check_rxov == 1 and RDH == RDT == 0. BTW the Linux e1000 driver does not follow the sequence recommended in the datasheet 14.4 Receive Initialization, which would avoid the weird window of time where RDH == RDT == 0. If we get rid of check_rxov and always check rxbuf space then we have the correct behavior. I'm a little nervous of simply dropping it because its purpose is unclear to me :(. Stefan