From nobody Fri Oct 30 17:33:02 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jGSqM00Kpz6xFp3 for ; Fri, 30 Oct 2026 17:33:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jGSqL5mfRz4W2K for ; Fri, 30 Oct 2026 17:33:02 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793381582; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zbuHMmsNInZH5iQaKKW37zTD1bWjnwhlD/cm73ycaN8=; b=uOqE0nAA0YER77unygHMiRq1OgSeGrfdWXtSUu8mOHBb6DnXJ7rtVZbJ8n24wGZo/ePC5F 26Izus7mFr/eUCXMnxY7vR2tKc8ZWVK8bT4lv2oluOVrNeXmH5iyESZ8Hi3dKzSSxK4l1B fRuAtTA1/gZ0Ju9dpbIFzquUVEB5UvUGbhIMfhRwhe0cInKodJpe557eJB6n9lF9IWFg1M nrBbx0XShSINvItwGUo7dpHVNGnf33zs3sujyWUyF7u06dxClI1l+72KjG1falovK6ZBTm WlLCPTdnRXGrD6ys5yihPF1d15FJHE3THPorLPxgo5to/IsxAPC4iGpbw0W0Mw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793381582; b=U6/fMMb53GAAeZghHtsPjWcMFkjdKsCjoRGoMld5O05qBNp1PtSlhCfzsOImwbwOfhsk/y FcQxkuNGGd4usV8sMbWb2PSmW89jE/QP0qU/uxrd7BNtU+0gtLk4vN5kDBFikH+KllW6jE POldaLi/qbkXWcv5FEddFASwrHWXOzY+rYmkivHudKkB1sgaRCc7jnuO35aP3O2DMDKT9T lP9XkuYAKE+8bpSQm5Y1Lu4lM0t0jnbeDviQMEDzrua2o9VAkr3g8+syBe+QnSaQCPv9z2 JMIS12GJN0TvqoByyk1qxaXf7WMV8Eq4ApseHiFEnBaFrPMp5CsyA4FPJi7mRw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793381582; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zbuHMmsNInZH5iQaKKW37zTD1bWjnwhlD/cm73ycaN8=; b=ERe8tmd28eL4xJBI9bZ3PEAyFnzLqPiRctDoj5tbqKPZITGf6gpF9tHgYmvygFkVrJN1kJ 0JJZqpOrPL+zpB1AXbrtjq4+OEaTINLbUzVfnH/GIm4foby9pHQNcgS05I/mGFYgOdrG/r OD6bmdaDAMf1vYu0IMtiTWV2kAr4m8BT4dgsHSEphvRMJ6oqkBm6gpY7uPsNEKTThHLZXF wBefcDpakKM3UiFruZfqz70OgnGCWME12OTb8YSaogIvVis2rnIAIzo6qQTYbjKKwocetr YVLEW0/fQGTQnqm6Es1J3dIF0INFmdq7dMLGofsaT+/f6WDTfdbCDPaOC7xAHg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jGSqL58m6zdkn for ; Fri, 30 Oct 2026 17:33:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3e460 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 30 Oct 2026 17:33:02 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: =?utf-8?Q?J=C3=A9r=C3=A9mie?= Jourdin From: Kevin Bowling Subject: git: 34b0db9bc8d6 - stable/15 - re(4): quiesce RTL8168G+ and reset before freeing buffers in re_stop() List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kbowling X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 34b0db9bc8d671b86bcfba3d767b6bebd7a950b4 Auto-Submitted: auto-generated Date: Fri, 30 Oct 2026 17:33:02 +0000 Message-Id: <6ae4d4ce.3e460.36b6645e@gitrepo.freebsd.org> The branch stable/15 has been updated by kbowling: URL: https://cgit.FreeBSD.org/src/commit/?id=34b0db9bc8d671b86bcfba3d767b6bebd7a950b4 commit 34b0db9bc8d671b86bcfba3d767b6bebd7a950b4 Author: Jérémie Jourdin AuthorDate: 2026-07-19 18:39:49 +0000 Commit: Kevin Bowling CommitDate: 2026-10-30 17:32:12 +0000 re(4): quiesce RTL8168G+ and reset before freeing buffers in re_stop() The STOPREQ command written by re_stop() is not defined for RTL8168G and later; issuing it can wedge the MAC. Replace it on those parts with the vendor-documented sequence: * settle delay * bounded poll for Tx queue empty * clear TE/RE * then bounded poll of the MCU command register (0xD3) FIFO-empty bits. Also reset the controller before the Rx/Tx buffer free: a controller that has not quiesced keeps DMAing stale, still-owned descriptors pointing at freed mbufs (use-after-free under INVARIANTS, cross-NIC mbuf corruption reported in the PR). Adds the RL_MCU_* register definitions. All waits are bounded; error paths only. * iperf3 --bidir at line rate against RTL8168H (XID 0x541); previously wedged the controller until power cycle, with the quiesce the reset path recovers. * Deployed in production on an RTL8168H fleet since 2026-07-01. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D58276 PR: kern/166724 (cherry picked from commit 38187938f52283143308dd219db35d889da55ea4) --- sys/dev/re/if_re.c | 41 ++++++++++++++++++++++++++++++++++++++++- sys/dev/rl/if_rlreg.h | 8 ++++++++ 2 files changed, 48 insertions(+), 1 deletion(-) diff --git a/sys/dev/re/if_re.c b/sys/dev/re/if_re.c index d56c975a43d2..eaa9d0ca934b 100644 --- a/sys/dev/re/if_re.c +++ b/sys/dev/re/if_re.c @@ -3630,7 +3630,37 @@ re_stop(struct rl_softc *sc) 0x00080000); } - if ((sc->rl_flags & RL_FLAG_WAIT_TXPOLL) != 0) { + if ((sc->rl_flags & RL_FLAG_8168G_PLUS) != 0) { + /* + * RTL8168G and later. The STOPREQ command is defined only for + * earlier controllers; issuing it on these parts can leave the + * MAC wedged. With the RXDV gate enabled above, drain the TX + * descriptor queue and the on-chip TX/RX FIFOs and clear the + * TX/RX enable bits so the DMA engine is idle before the reset + * and buffer free below. All waits are bounded. + */ + DELAY(2000); + for (i = RL_TIMEOUT; i > 0; i--) { + if ((CSR_READ_4(sc, RL_TXCFG) & + RL_TXCFG_QUEUE_EMPTY) != 0) + break; + DELAY(100); + } + if (i == 0) + device_printf(sc->rl_dev, "stopping TXQ timed out!\n"); + CSR_WRITE_1(sc, RL_COMMAND, CSR_READ_1(sc, RL_COMMAND) & + ~(RL_CMD_TX_ENB | RL_CMD_RX_ENB)); + for (i = RL_TIMEOUT * 3; i > 0; i--) { + if ((CSR_READ_1(sc, RL_MCU_CMD) & + (RL_MCU_TXFIFO_EMPTY | RL_MCU_RXFIFO_EMPTY)) == + (RL_MCU_TXFIFO_EMPTY | RL_MCU_RXFIFO_EMPTY)) + break; + DELAY(20); + } + if (i == 0) + device_printf(sc->rl_dev, + "TX/RX FIFO drain timed out!\n"); + } else if ((sc->rl_flags & RL_FLAG_WAIT_TXPOLL) != 0) { for (i = RL_TIMEOUT; i > 0; i--) { if ((CSR_READ_1(sc, sc->rl_txstart) & RL_TXSTART_START) == 0) @@ -3661,6 +3691,15 @@ re_stop(struct rl_softc *sc) CSR_WRITE_2(sc, RL_IMR, 0x0000); CSR_WRITE_2(sc, RL_ISR, 0xFFFF); + /* + * Reset the controller before freeing the DMA buffers below. A + * controller that has not fully quiesced can keep fetching stale, + * still-owned descriptors that point at about-to-be-freed mbufs. + * re_init_locked() resets again on the reinit path; the extra reset + * is idempotent and cheap. + */ + re_reset(sc); + if (sc->rl_head != NULL) { m_freem(sc->rl_head); sc->rl_head = sc->rl_tail = NULL; diff --git a/sys/dev/rl/if_rlreg.h b/sys/dev/rl/if_rlreg.h index 6339b12472b6..176452d412c9 100644 --- a/sys/dev/rl/if_rlreg.h +++ b/sys/dev/rl/if_rlreg.h @@ -145,6 +145,14 @@ #define RL_INTRMOD 0x00E2 /* 16 bits */ #define RL_MISC 0x00F0 +/* + * MCU command / FIFO status register (RTL8168G and later). Polled to + * confirm the on-chip TX/RX FIFOs have drained before a controller reset. + */ +#define RL_MCU_CMD 0x00D3 +#define RL_MCU_TXFIFO_EMPTY 0x20 /* bit 5 */ +#define RL_MCU_RXFIFO_EMPTY 0x10 /* bit 4 */ + /* * TX config register bits */