* [PATCH net v3 1/2] net: nixge: free IRQs before killing the DMA error tasklet
2026-10-18 2:08 [PATCH net v3 0/2] net: nixge: fix tasklet and DMA teardown Myeonghun Pak
@ 2026-10-18 2:08 ` Myeonghun Pak
2026-10-18 2:08 ` [PATCH net v3 2/2] net: nixge: wait for DMA reset before releasing buffers Myeonghun Pak
1 sibling, 0 replies; 3+ messages in thread
From: Myeonghun Pak @ 2026-10-18 2:08 UTC (permalink / raw)
To: netdev
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, linux-kernel,
stable, ae878000, daniel.machon
The TX and RX IRQ handlers can schedule dma_err_tasklet. Killing the
tasklet before freeing the IRQs leaves a window for either handler to
schedule it again. The tasklet can then access descriptors and TX skb
state after nixge_stop() releases them.
Free both IRQs before tasklet_kill() so the IRQ handlers have finished
and cannot queue further error recovery when the tasklet is drained.
Fixes: 492caffa8a1a ("net: ethernet: nixge: Add support for National Instruments XGE netdev")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
drivers/net/ethernet/ni/nixge.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
index 230d5ff..8697a76 100644
--- a/drivers/net/ethernet/ni/nixge.c
+++ b/drivers/net/ethernet/ni/nixge.c
@@ -927,11 +927,12 @@ static int nixge_stop(struct net_device *ndev)
nixge_dma_write_reg(priv, XAXIDMA_TX_CR_OFFSET,
cr & (~XAXIDMA_CR_RUNSTOP_MASK));
- tasklet_kill(&priv->dma_err_tasklet);
-
+ /* Remove both producers before draining the error tasklet. */
free_irq(priv->tx_irq, ndev);
free_irq(priv->rx_irq, ndev);
+ tasklet_kill(&priv->dma_err_tasklet);
+
nixge_hw_dma_bd_release(ndev);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH net v3 2/2] net: nixge: wait for DMA reset before releasing buffers
2026-10-18 2:08 [PATCH net v3 0/2] net: nixge: fix tasklet and DMA teardown Myeonghun Pak
2026-10-18 2:08 ` [PATCH net v3 1/2] net: nixge: free IRQs before killing the DMA error tasklet Myeonghun Pak
@ 2026-10-18 2:08 ` Myeonghun Pak
1 sibling, 0 replies; 3+ messages in thread
From: Myeonghun Pak @ 2026-10-18 2:08 UTC (permalink / raw)
To: netdev
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, linux-kernel,
stable, ae878000, daniel.machon
nixge_stop() clears RUNSTOP before releasing the DMA buffers, but this
does not ensure that outstanding DMA accesses have completed. Pending
error recovery can also restart both channels and enable interrupts
while the stop path drains dma_err_tasklet.
After both IRQ handlers and the error tasklet have been drained, mask
channel interrupts and clear RUNSTOP again. Reset the DMA engine and
wait for reset completion before releasing the buffers. Return the
reset result from __nixge_device_reset() so the stop path can check it.
If reset times out, retain the DMA buffers and reject subsequent opens
to prevent those buffers from being freed or their pointers overwritten
while DMA may still be using them.
Fixes: 492caffa8a1a ("net: ethernet: nixge: Add support for National Instruments XGE netdev")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
drivers/net/ethernet/ni/nixge.c | 28 +++++++++++++++++++++++++++-
1 file changed, 27 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
index 8697a76..8bfda27 100644
--- a/drivers/net/ethernet/ni/nixge.c
+++ b/drivers/net/ethernet/ni/nixge.c
@@ -185,6 +185,7 @@ struct nixge_priv {
void __iomem *dma_regs;
struct tasklet_struct dma_err_tasklet;
+ bool dma_stop_failed;
int tx_irq;
int rx_irq;
@@ -391,7 +392,7 @@ out:
return -ENOMEM;
}
-static void __nixge_device_reset(struct nixge_priv *priv, off_t offset)
+static int __nixge_device_reset(struct nixge_priv *priv, off_t offset)
{
u32 status;
int err;
@@ -407,6 +408,8 @@ static void __nixge_device_reset(struct nixge_priv *priv, off_t offset)
1000);
if (err)
netdev_err(priv->ndev, "%s: DMA reset timeout!\n", __func__);
+
+ return err;
}
static void nixge_device_reset(struct net_device *ndev)
@@ -869,6 +872,10 @@ static int nixge_open(struct net_device *ndev)
struct phy_device *phy;
int ret;
+ /* A failed stop retained buffers which DMA may still be using. */
+ if (priv->dma_stop_failed)
+ return -EIO;
+
nixge_device_reset(ndev);
phy = of_phy_connect(ndev, priv->phy_node,
@@ -910,6 +917,7 @@ err_tx_irq:
static int nixge_stop(struct net_device *ndev)
{
struct nixge_priv *priv = netdev_priv(ndev);
+ int ret;
u32 cr;
netif_stop_queue(ndev);
@@ -920,6 +928,7 @@ static int nixge_stop(struct net_device *ndev)
phy_disconnect(ndev->phydev);
}
+ /* Stop DMA while the completion IRQ handlers are still installed. */
cr = nixge_dma_read_reg(priv, XAXIDMA_RX_CR_OFFSET);
nixge_dma_write_reg(priv, XAXIDMA_RX_CR_OFFSET,
cr & (~XAXIDMA_CR_RUNSTOP_MASK));
@@ -933,6 +942,23 @@ static int nixge_stop(struct net_device *ndev)
tasklet_kill(&priv->dma_err_tasklet);
+ /* Error recovery may have restarted DMA and enabled interrupts. */
+ cr = nixge_dma_read_reg(priv, XAXIDMA_RX_CR_OFFSET);
+ nixge_dma_write_reg(priv, XAXIDMA_RX_CR_OFFSET,
+ cr & ~(XAXIDMA_CR_RUNSTOP_MASK | XAXIDMA_IRQ_ALL_MASK));
+ cr = nixge_dma_read_reg(priv, XAXIDMA_TX_CR_OFFSET);
+ nixge_dma_write_reg(priv, XAXIDMA_TX_CR_OFFSET,
+ cr & ~(XAXIDMA_CR_RUNSTOP_MASK | XAXIDMA_IRQ_ALL_MASK));
+
+ /* Either channel's reset quiesces the entire AXI DMA engine. */
+ ret = __nixge_device_reset(priv, XAXIDMA_TX_CR_OFFSET);
+ if (ret) {
+ /* Retain DMA buffers and prevent a subsequent open replacing them. */
+ priv->dma_stop_failed = true;
+ netdev_err(ndev, "DMA stop failed; retaining DMA buffers\n");
+ return ret;
+ }
+
nixge_hw_dma_bd_release(ndev);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread