On Wed, Oct 17, 2012 at 08:31:46PM +0200, Dmitry Fleytman wrote: > Device RX initization from driver's side consists of following steps: > 1. Initialize head and tail of RX ring to 0 > 2. Enable Rx (set bit in RCTL register) > 3. Allocate buffers, fill descriptors > 4. Write ring tail > > Forth operation signals hardware that RX buffers available > and it may start packets indication. > > Current implementation treats first operation (write 0 to ring tail) > as signal of buffers availability and starts data transfers as soon > as RX enable indicaton arrives. > > This is not correct because there is a chance that ring is still > empty (third action not performed yet) and then memory corruption > occures.
Any idea what the point of hw/e1000.c check_rxov is? I see nothing in the datasheet that requires these semantics. The Linux e1000 driver never enables the RXO (rx fifo overflow) interrupt, only RXDMT0 (receive descriptor minimum threshold). This means hw/e1000.c will not upset the Linux e1000 driver when e1000_receive() gets called with check_rxov == 1 and RDH == RDT == 0. BTW the Linux e1000 driver does not follow the sequence recommended in the datasheet 14.4 Receive Initialization, which would avoid the weird window of time where RDH == RDT == 0. If we get rid of check_rxov and always check rxbuf space then we have the correct behavior. I'm a little nervous of simply dropping it because its purpose is unclear to me :(. Stefan
