Re: [PATCH 6/9] [TULIP] Fix IRQ/DMA race

[Valerie Henson <val_henson@linux.intel.com>]

On Wed, Aug 09, 2006 at 01:35:05AM -0400, Jeff Garzik wrote:
> Kyle McMartin wrote:
> >From: Grant Grundler <grundler@parisc-linux.org>
> >
> >IRQs are racing with tulip_down().
> >DMA can be restarted by tulip_interrupt() _after_ we call
> >tulip_stop_rxtx() and the DMA buffers are unmapped.  The result
> >is an MCA (hard crash on ia64) because of an IO TLB miss.
> >
> >Signed-off-by: Grant Grundler <grundler@parisc-linux.org>
> >Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
> >---
> > drivers/net/tulip/interrupt.c  |    4 ++++
> > drivers/net/tulip/tulip_core.c |   17 +++++++----------
> > 2 files changed, 11 insertions(+), 10 deletions(-)
> >
> >diff --git a/drivers/net/tulip/interrupt.c b/drivers/net/tulip/interrupt.c
> >index 99ccf2e..19faa0e 100644
> >--- a/drivers/net/tulip/interrupt.c
> >+++ b/drivers/net/tulip/interrupt.c
> >@@ -87,6 +87,10 @@ int tulip_refill_rx(struct net_device *d
> > 		}
> > 		tp->rx_ring[entry].status = cpu_to_le32(DescOwned);
> > 	}
> >+
> >+/* FIXME: restarting DMA breaks tulip_down() code path.
> >+   tulip_down() will unmap the RX and TX descriptors.
> >+ */
> > 	if(tp->chip_id == LC82C168) {
> > 		if(((ioread32(tp->base_addr + CSR5)>>17)&0x07) == 4) {
> > 			/* Rx stopped due to out of buffers,
> >diff --git a/drivers/net/tulip/tulip_core.c 
> >b/drivers/net/tulip/tulip_core.c
> >index 81905f4..363e5f6 100644
> >--- a/drivers/net/tulip/tulip_core.c
> >+++ b/drivers/net/tulip/tulip_core.c
> >@@ -742,21 +742,20 @@ #endif
> > 
> > 	/* Disable interrupts by clearing the interrupt mask. */
> > 	iowrite32 (0x00000000, ioaddr + CSR7);
> >+	ioread32 (ioaddr + CSR7);	/* flush posted write */
> > 
> >-	/* Stop the Tx and Rx processes. */
> >-	tulip_stop_rxtx(tp);
> >+	spin_unlock_irqrestore (&tp->lock, flags);
> > 
> >-	/* prepare receive buffers */
> >-	tulip_refill_rx(dev);
> >+	free_irq (dev->irq, dev);	/* no more races after this */
> >+	tulip_stop_rxtx(tp);		/* Stop DMA */
> 
> same old comment:  need to stop DMA before releasing interrupt handler.

I'm testing my implementation of a version that checks for in-progress
shutdown in the interupt handler; unfortunately TX died in overnight
testing so there's more work to do.

-VAL