From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D300218AD1 for ; Mon, 27 Oct 2025 14:59:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761577152; cv=none; b=rWPuJEmadNGdCZrAlfEr4PQxzjWQROMvLLEOp1RQSoQyFJWnxhLF9cuimDXW49UBi2ezJSgfzygeNsbprHhQRUShH5YftBkSGtu0IpIAgSFw92NFSdzY/6eZlNMQIabCW1CAM5wohydItWvzWAxBy6O54zcRosBvYGxh4LJPgMw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761577152; c=relaxed/simple; bh=uOHwQ5QU7IkbxJT91LHq8qvl+uBlgZdrx56UfcyxsRg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=DxrUOxiMksZINQmdI+AcGJbBXRbq1DJJnQTIP+EkXQUq5RGDD5qskF9wAn8zkF8vBxROGMeiLme5T+V6DLD4YdbDr9PfbXBxNsaDq+6/AMp+EoFhwCp/td6LVqOzYDTr4NXu858DO+7zXgUHN9smTBB7W3rKo1JDYaOEcNX51/M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=LuLxQE6S; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="LuLxQE6S" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DE870C4CEF1; Mon, 27 Oct 2025 14:59:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761577151; bh=uOHwQ5QU7IkbxJT91LHq8qvl+uBlgZdrx56UfcyxsRg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LuLxQE6SYJTExbChwRZBlVTk8m40Tb21NPoyT8M1XBZn+we9Gih0olNgoZNcmcFCW Sb2RQrs7+lGCvS4+wvDf4IW9h4sac2w/d+6y/jfn4rIGo240uNm9gL5VSb+Pv4A+iu VB+c8fRCXzkqujW95uom5WXXk09PrKS4DW/sDkfuJxmlzFioFuid9JYmHIP85uq4so o4rZ4hUYe0lbEBB6y+DRm8Fe7o5tfR8n9SmgbmjBetdJm+hoCoe8uSjEoXo9wvrR0n 5Q6XQ8EytUQVI/wD/8dKa7iWtlMn06mHhJmT0g8mlS7lfL1DpcIL9f6FLf5t3C6AnW 6Q5saIDjdkFgg== From: Sasha Levin To: stable@vger.kernel.org Cc: Lad Prabhakar , Fabrizio Castro , =?UTF-8?q?Niklas=20S=C3=B6derlund?= , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.4.y] net: ravb: Enforce descriptor type ordering Date: Mon, 27 Oct 2025 10:59:07 -0400 Message-ID: <20251027145907.533046-1-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <2025102624-direness-catalyze-d721@gregkh> References: <2025102624-direness-catalyze-d721@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Lad Prabhakar [ Upstream commit 5370c31e84b0e0999c7b5ff949f4e104def35584 ] Ensure the TX descriptor type fields are published in a safe order so the DMA engine never begins processing a descriptor chain before all descriptor fields are fully initialised. For multi-descriptor transmits the driver writes DT_FEND into the last descriptor and DT_FSTART into the first. The DMA engine begins processing when it observes DT_FSTART. Move the dma_wmb() barrier so it executes immediately after DT_FEND and immediately before writing DT_FSTART (and before DT_FSINGLE in the single-descriptor case). This guarantees that all prior CPU writes to the descriptor memory are visible to the device before DT_FSTART is seen. This avoids a situation where compiler/CPU reordering could publish DT_FSTART ahead of DT_FEND or other descriptor fields, allowing the DMA to start on a partially initialised chain and causing corrupted transmissions or TX timeouts. Such a failure was observed on RZ/G2L with an RT kernel as transmit queue timeouts and device resets. Fixes: 2f45d1902acf ("ravb: minimize TX data copying") Cc: stable@vger.kernel.org Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Niklas Söderlund Link: https://patch.msgid.link/20251017151830.171062-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski [ kept unconditional skb_tx_timestamp() ] Signed-off-by: Sasha Levin --- drivers/net/ethernet/renesas/ravb_main.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c index 3cc312a526d9b..6541bc6999996 100644 --- a/drivers/net/ethernet/renesas/ravb_main.c +++ b/drivers/net/ethernet/renesas/ravb_main.c @@ -1593,13 +1593,25 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) } skb_tx_timestamp(skb); - /* Descriptor type must be set after all the above writes */ - dma_wmb(); + if (num_tx_desc > 1) { desc->die_dt = DT_FEND; desc--; + /* When using multi-descriptors, DT_FEND needs to get written + * before DT_FSTART, but the compiler may reorder the memory + * writes in an attempt to optimize the code. + * Use a dma_wmb() barrier to make sure DT_FEND and DT_FSTART + * are written exactly in the order shown in the code. + * This is particularly important for cases where the DMA engine + * is already running when we are running this code. If the DMA + * sees DT_FSTART without the corresponding DT_FEND it will enter + * an error condition. + */ + dma_wmb(); desc->die_dt = DT_FSTART; } else { + /* Descriptor type must be set after all the above writes */ + dma_wmb(); desc->die_dt = DT_FSINGLE; } ravb_modify(ndev, TCCR, TCCR_TSRQ0 << q, TCCR_TSRQ0 << q); -- 2.51.0