From: jmatthew <jmatthew@openbsd.org>
Date: Sun, 6 Oct 2024 23:43:18 +0000 (+0000)
Subject: Fix the rx refill timeout to only refill rings that are currently empty.
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=2783188a65d179771b59689a8006ab2b8e0f033a;p=openbsd

Fix the rx refill timeout to only refill rings that are currently empty.
This is normally how the timeout works, but in this driver it's complicated
by the use of separate rx and ag rings.

This prevents the refill timeout from operating on a ring concurrently
with an rx interrupt, which leads to corruption and crashes as experienced
by bluhm@

ok dlg@
earlier version tested by and ok bluhm@
---

diff --git a/sys/dev/pci/if_bnxt.c b/sys/dev/pci/if_bnxt.c
index 52165d95f2c..dc297c1908e 100644
--- a/sys/dev/pci/if_bnxt.c
+++ b/sys/dev/pci/if_bnxt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_bnxt.c,v 1.51 2024/06/26 01:40:49 jsg Exp $	*/
+/*	$OpenBSD: if_bnxt.c,v 1.52 2024/10/06 23:43:18 jmatthew Exp $	*/
 /*-
  * Broadcom NetXtreme-C/E network driver.
  *
@@ -316,6 +316,7 @@ void		bnxt_write_tx_doorbell(struct bnxt_softc *, struct bnxt_ring *,
 		    int);
 
 int		bnxt_rx_fill(struct bnxt_queue *);
+int		bnxt_rx_fill_ag(struct bnxt_queue *);
 u_int		bnxt_rx_fill_slots(struct bnxt_softc *, struct bnxt_ring *, void *,
 		    struct bnxt_slot *, uint *, int, uint16_t, u_int);
 void		bnxt_refill(void *);
@@ -955,6 +956,7 @@ bnxt_queue_up(struct bnxt_softc *sc, struct bnxt_queue *bq)
 	rx->rx_ag_prod = 0;
 	rx->rx_ag_cons = 0;
 	bnxt_rx_fill(bq);
+	bnxt_rx_fill_ag(bq);
 
 	tx->tx_cons = 0;
 	tx->tx_prod = 0;
@@ -1659,6 +1661,7 @@ bnxt_intr(void *xq)
 		}
 
 		bnxt_rx_fill(q);
+		bnxt_rx_fill_ag(q);
 		if ((rx->rx_cons == rx->rx_prod) ||
 		    (rx->rx_ag_cons == rx->rx_ag_prod))
 			timeout_add(&rx->rx_refill, 0);
@@ -2233,6 +2236,17 @@ bnxt_rx_fill(struct bnxt_queue *q)
 	} else
 		rv = 1;
 
+	return (rv);
+}
+
+int
+bnxt_rx_fill_ag(struct bnxt_queue *q)
+{
+	struct bnxt_rx_queue *rx = &q->q_rx;
+	struct bnxt_softc *sc = q->q_sc;
+	u_int slots;
+	int rv = 0;
+
 	slots = if_rxr_get(&rx->rxr[1],  rx->rx_ag_ring.ring_size);
 	if (slots > 0) {
 		slots = bnxt_rx_fill_slots(sc, &rx->rx_ag_ring,
@@ -2253,9 +2267,14 @@ bnxt_refill(void *xq)
 	struct bnxt_queue *q = xq;
 	struct bnxt_rx_queue *rx = &q->q_rx;
 
-	bnxt_rx_fill(q);
-
 	if (rx->rx_cons == rx->rx_prod)
+		bnxt_rx_fill(q);
+
+	if (rx->rx_ag_cons == rx->rx_ag_prod)
+		bnxt_rx_fill_ag(q);
+
+	if ((rx->rx_cons == rx->rx_prod) ||
+	    (rx->rx_ag_cons == rx->rx_ag_prod))
 		timeout_add(&rx->rx_refill, 1);
 }