[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 35/79] e1000e: Fix ICR "Other" causes clear logic
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 35/79] e1000e: Fix ICR "Other" causes clear logic |
Date: |
Mon, 28 Aug 2017 19:14:10 -0500 |
From: Sameeh Jubran <address@hidden>
This commit fixes a bug which causes the guest to hang. The bug was
observed upon a "receive overrun" (bit #6 of the ICR register)
interrupt which could be triggered post migration in a heavy traffic
environment. Even though the "receive overrun" bit (#6) is masked out
by the IMS register (refer to the log below) the driver still receives
an interrupt as the "receive overrun" bit (#6) causes the "Other" -
bit #24 of the ICR register - bit to be set as documented below. The
driver handles the interrupt and clears the "Other" bit (#24) but
doesn't clear the "receive overrun" bit (#6) which leads to an
infinite loop. Apparently the Windows driver expects that the "receive
overrun" bit and other ones - documented below - to be cleared when
the "Other" bit (#24) is cleared.
So to sum that up:
1. Bit #6 of the ICR register is set by heavy traffic
2. As a results of setting bit #6, bit #24 is set
3. The driver receives an interrupt for bit 24 (it doesn't receieve an
interrupt for bit #6 as it is masked out by IMS)
4. The driver handles and clears the interrupt of bit #24
5. Bit #6 is still set.
6. 2 happens all over again
The Interrupt Cause Read - ICR register:
The ICR has the "Other" bit - bit #24 - that is set when one or more
of the following ICR register's bits are set:
LSC - bit #2, RXO - bit #6, MDAC - bit #9, SRPD - bit #16, ACK - bit
#17, MNG - bit #18
This bug can occur with any of these bits depending on the driver's
behaviour and the way it configures the device. However, trying to
reproduce it with any bit other than RX0 is challenging and came to
failure as the drivers don't implement most of these bits, trying to
reproduce it with LSC (Link Status Change - bit #2) bit didn't succeed
too as it seems that Windows handles this bit differently.
Log sample of the storm:
address@hidden:e1000e_irq_pending_interrupts ICR PENDING: 0x1000000 (ICR:
0x815000c2, IMS: 0x1a00004)
address@hidden:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2,
IMS: 0xa00004)
address@hidden:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2,
IMS: 0xa00004)
address@hidden:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2,
IMS: 0xa00004)
address@hidden:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2,
IMS: 0xa00004)
address@hidden:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2,
IMS: 0xa00004)
address@hidden:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2,
IMS: 0xa00004)
address@hidden:e1000e_irq_pending_interrupts ICR PENDING: 0x1000000 (ICR:
0x815000c2, IMS: 0x1a00004)
* This bug behaviour wasn't observed with the Linux driver.
This commit solves:
https://bugzilla.redhat.com/show_bug.cgi?id=1447935
https://bugzilla.redhat.com/show_bug.cgi?id=1449490
Cc: address@hidden
Signed-off-by: Sameeh Jubran <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
(cherry picked from commit 82342e91b60a4a078811df4e1a545e57abffa11d)
Signed-off-by: Michael Roth <address@hidden>
---
hw/net/e1000e_core.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index 28c5be1..8140564 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -2454,14 +2454,20 @@ e1000e_set_ics(E1000ECore *core, int index, uint32_t
val)
static void
e1000e_set_icr(E1000ECore *core, int index, uint32_t val)
{
+ uint32_t icr = 0;
if ((core->mac[ICR] & E1000_ICR_ASSERTED) &&
(core->mac[CTRL_EXT] & E1000_CTRL_EXT_IAME)) {
trace_e1000e_irq_icr_process_iame();
e1000e_clear_ims_bits(core, core->mac[IAM]);
}
- trace_e1000e_irq_icr_write(val, core->mac[ICR], core->mac[ICR] & ~val);
- core->mac[ICR] &= ~val;
+ icr = core->mac[ICR] & ~val;
+ /* Windows driver expects that the "receive overrun" bit and other
+ * ones to be cleared when the "Other" bit (#24) is cleared.
+ */
+ icr = (val & E1000_ICR_OTHER) ? (icr & ~E1000_ICR_OTHER_CAUSES) : icr;
+ trace_e1000e_irq_icr_write(val, core->mac[ICR], icr);
+ core->mac[ICR] = icr;
e1000e_update_interrupt_state(core);
}
--
2.7.4
- [Qemu-devel] [PATCH 18/79] qobject: Use simpler QDict/QList scalar insertion macros, (continued)
- [Qemu-devel] [PATCH 18/79] qobject: Use simpler QDict/QList scalar insertion macros, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 25/79] blockdev: use drained_begin/end for qmp_block_resize, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 24/79] block: Add errp to b{lk, drv}_truncate(), Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 34/79] virtio-scsi: Unset hotplug handler when unrealize, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 02/79] dirty-bitmap: Report BlockDirtyInfo.count in bytes, as documented, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 28/79] curl: strengthen assertion in curl_clean_state, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 39/79] blkdebug: Refactor error injection, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 03/79] qemu-img/convert: Always set ret < 0 on error, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 30/79] curl: avoid recursive locking of BDRVCURLState mutex, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 32/79] vvfat: fix qemu-img map and qemu-img convert, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 35/79] e1000e: Fix ICR "Other" causes clear logic,
Michael Roth <=
- [Qemu-devel] [PATCH 33/79] virtio: allow broken device to notify guest, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 31/79] stream: fix crash in stream_start() when block_job_create() fails, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 46/79] mirror: Drop permissions on s->target on completion, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 36/79] s390x/css: catch section mismatch on load, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 43/79] tests: Add coverage for recent block geometry fixes, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 41/79] blkdebug: Simplify override logic, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 44/79] block: Simplify BDRV_BLOCK_RAW recursion, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 49/79] tests: check-qom-proplist: add checks for cmdline-created objects, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 53/79] target/ppc: fix memory leak in kvmppc_is_mem_backend_page_size_ok(), Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 55/79] spapr: fix memory leak in spapr_memory_pre_plug(), Michael Roth, 2017/08/28