* [PATCH net v7 1/7] can: dev: check netif_running() before bus-off recovery
2026-11-06 9:37 [PATCH net v7 0/7] can: fix bus-off restart and device close races Cunhao Lu via B4 Relay
@ 2026-11-06 9:37 ` Cunhao Lu via B4 Relay
2026-11-06 9:37 ` [PATCH net v7 2/7] can: dev: add close_candev_cancel_restart_sync() Cunhao Lu via B4 Relay
` (6 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Cunhao Lu via B4 Relay @ 2026-11-06 9:37 UTC (permalink / raw)
To: Marc Kleine-Budde, Vincent Mailhol, Heiko Stuebner,
David S. Miller, Wolfgang Grandegger, Oliver Hartkopp, kernel,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap
Cc: Cunhao Lu, linux-can, linux-kernel, linux-arm-kernel,
linux-rockchip, netdev, linux-doc, stable
From: Cunhao Lu <1579567540@qq.com>
The networking core clears __LINK_STATE_START before calling ndo_stop(),
but CAN bus-off recovery neither checks this state before queuing work
nor before calling the driver's restart callback. Recovery can therefore
be queued or started after the interface has begun closing, potentially
re-enabling hardware while the driver is tearing it down.
Check netif_running() in can_restart() before flushing echo skbs, sending
the restart notification or enabling the carrier. Keep the existing
unsupported-operation check first. In can_bus_off(), schedule recovery
only when the check observes the interface running, and make the log
message reflect that decision. Keep reporting bus-off and disabling the
carrier.
These checks do not wait for recovery that has already passed the check,
nor serialize the check with work submission. Drivers still need to
cancel restart work before tearing down resources and quiesce its
producers before their final cleanup.
Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
Cc: stable@vger.kernel.org
Signed-off-by: Cunhao Lu <1579567540@qq.com>
---
Changes in v7:
- Clarify the running checks' limits and configure restart-ms while down.
Changes in v6:
- Update the can_bus_off() comment and document the running-interface
requirement for automatic recovery.
---
Q: Do the running checks serialize recovery with device close?
A: No. With automatic recovery enabled, a worker can pass the check
before close clears the running bit. Drivers such as FlexCAN still
cancel it after hardware teardown, so their restart callback can run
after shutdown. The Rockchip patches in this series wait for an active
restart before teardown and cancel again after draining the IRQ.
Other drivers need separate lifetime fixes; these checks only reject
recovery that observes down.
Q: Can HI3110 queue restart work after close and outlive the device?
A: Yes. With restart-ms nonzero, its IRQ thread can sample running
before close, then queue work after close_candev() returns. The later
free_irq() drains the producer but does not cancel the queued core
work. A quick reopen can execute stale recovery; removal can leave
work referring to a freed can_priv. The driver's private workqueue
does not own this work. A separate fix must quiesce producers before
final cancellation and protect teardown from an active restart. The
running checks narrow this window but cannot protect freed memory.
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261017-rockchip-canfd-restart-close-v6-0-ed605feb4b6e%40qq.com
---
Documentation/networking/can.rst | 10 ++++++++--
drivers/net/can/dev/dev.c | 13 ++++++++++---
2 files changed, 18 insertions(+), 5 deletions(-)
diff --git a/Documentation/networking/can.rst b/Documentation/networking/can.rst
index 536ff411da1d1..41ba5cffdf108 100644
--- a/Documentation/networking/can.rst
+++ b/Documentation/networking/can.rst
@@ -1298,7 +1298,8 @@ More info to the above output:
Automatic restart delay time. If set to a non-zero value, a
restart of the CAN controller will be triggered automatically
in case of a bus-off condition after the specified delay time
- in milliseconds. By default it's off.
+ in milliseconds. Recovery is skipped if the interface is found
+ to be down. By default it's off.
"bitrate 125000 sample-point 0.875"
Shows the real bit-rate in bits/sec and the sample-point in the
@@ -1372,9 +1373,14 @@ before you can start it to avoid error-prone default settings::
A device may enter the "bus-off" state if too many errors occurred on
the CAN bus. Then no more messages are received or sent. An automatic
bus-off recovery can be enabled by setting the "restart-ms" to a
-non-zero value, e.g.::
+non-zero value while the interface is down, e.g.::
+ $ ip link set canX down
$ ip link set canX type can restart-ms 100
+ $ ip link set canX up
+
+Before scheduling or starting recovery, the kernel checks whether the
+interface is running and skips recovery if it is down.
Alternatively, the application may realize the "bus-off" condition
by monitoring CAN error message frames and do a restart when
diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
index 769745e22a3c7..a893a49a33813 100644
--- a/drivers/net/can/dev/dev.c
+++ b/drivers/net/can/dev/dev.c
@@ -198,6 +198,9 @@ static int can_restart(struct net_device *dev)
if (!priv->do_set_mode)
return -EOPNOTSUPP;
+ if (!netif_running(dev))
+ return -ENETDOWN;
+
if (netif_carrier_ok(dev))
netdev_err(dev, "Attempt to restart for bus-off recovery, but carrier is OK?\n");
@@ -259,13 +262,17 @@ int can_restart_now(struct net_device *dev)
*
* This functions should be called when the device goes bus-off to
* tell the netif layer that no more packets can be sent or received.
- * If enabled, a timer is started to trigger bus-off recovery.
+ * If automatic recovery is enabled, schedule delayed work unless the
+ * running check observes the interface down. Drivers must still synchronize
+ * recovery with device close.
*/
void can_bus_off(struct net_device *dev)
{
struct can_priv *priv = netdev_priv(dev);
+ bool restart;
- if (priv->restart_ms)
+ restart = priv->restart_ms && netif_running(dev);
+ if (restart)
netdev_info(dev, "bus-off, scheduling restart in %d ms\n",
priv->restart_ms);
else
@@ -273,7 +280,7 @@ void can_bus_off(struct net_device *dev)
netif_carrier_off(dev);
- if (priv->restart_ms)
+ if (restart)
schedule_delayed_work(&priv->restart_work,
msecs_to_jiffies(priv->restart_ms));
}
--
2.34.1
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH net v7 2/7] can: dev: add close_candev_cancel_restart_sync()
2026-11-06 9:37 [PATCH net v7 0/7] can: fix bus-off restart and device close races Cunhao Lu via B4 Relay
2026-11-06 9:37 ` [PATCH net v7 1/7] can: dev: check netif_running() before bus-off recovery Cunhao Lu via B4 Relay
@ 2026-11-06 9:37 ` Cunhao Lu via B4 Relay
2026-11-06 9:37 ` [PATCH net v7 3/7] can: rockchip_canfd: cancel bus-off restart before closing the device Cunhao Lu via B4 Relay
` (5 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Cunhao Lu via B4 Relay @ 2026-11-06 9:37 UTC (permalink / raw)
To: Marc Kleine-Budde, Vincent Mailhol, Heiko Stuebner,
David S. Miller, Wolfgang Grandegger, Oliver Hartkopp, kernel,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap
Cc: Cunhao Lu, linux-can, linux-kernel, linux-arm-kernel,
linux-rockchip, netdev, linux-doc
From: Cunhao Lu <1579567540@qq.com>
Drivers may need to wait for bus-off recovery before tearing down the
IRQ and hardware resources used by their restart callback. Calling
close_candev() at that point also flushes echo skbs, which belongs after
the driver has quiesced the users of those buffers.
Add close_candev_cancel_restart_sync() in linux/can/dev.h so drivers can
cancel the core restart work separately, without accessing can_priv's
work item directly. The helper only cancels restart work; callers must
still stop its producers and call close_candev() for the final cleanup.
Use the helper in close_candev(), preserving its existing cancellation
and echo cleanup order.
The following Rockchip fix uses the helper at the start of rkcanfd_stop()
to wait for recovery before IRQ teardown, leaving echo cleanup to
close_candev().
Signed-off-by: Cunhao Lu <1579567540@qq.com>
---
Changes in v6:
- Describe the helper's use by the following Rockchip fix.
---
drivers/net/can/dev/dev.c | 4 +---
include/linux/can/dev.h | 17 +++++++++++++++++
2 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
index a893a49a3381..39271a3ef0fa 100644
--- a/drivers/net/can/dev/dev.c
+++ b/drivers/net/can/dev/dev.c
@@ -537,9 +537,7 @@ EXPORT_SYMBOL_GPL(of_can_transceiver);
*/
void close_candev(struct net_device *dev)
{
- struct can_priv *priv = netdev_priv(dev);
-
- cancel_delayed_work_sync(&priv->restart_work);
+ close_candev_cancel_restart_sync(dev);
can_flush_echo_skb(dev);
}
EXPORT_SYMBOL_GPL(close_candev);
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index 6d0710d6f571..1b08ee263b1f 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -22,6 +22,7 @@
#include <linux/can/skb.h>
#include <linux/ethtool.h>
#include <linux/netdevice.h>
+#include <linux/workqueue.h>
/*
* CAN mode
@@ -115,6 +116,22 @@ struct can_priv *safe_candev_priv(struct net_device *dev);
int open_candev(struct net_device *dev);
void close_candev(struct net_device *dev);
+
+/**
+ * close_candev_cancel_restart_sync() - cancel bus-off restart synchronously
+ * @dev: CAN network device
+ *
+ * Call before tearing down resources used by the restart callback.
+ * The driver must quiesce restart work producers before calling
+ * close_candev() for the final cleanup.
+ */
+static inline void close_candev_cancel_restart_sync(struct net_device *dev)
+{
+ struct can_priv *priv = netdev_priv(dev);
+
+ cancel_delayed_work_sync(&priv->restart_work);
+}
+
void can_set_default_mtu(struct net_device *dev);
void can_set_cap_info(struct net_device *dev);
int __must_check can_set_static_ctrlmode(struct net_device *dev,
--
2.34.1
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH net v7 3/7] can: rockchip_canfd: cancel bus-off restart before closing the device
2026-11-06 9:37 [PATCH net v7 0/7] can: fix bus-off restart and device close races Cunhao Lu via B4 Relay
2026-11-06 9:37 ` [PATCH net v7 1/7] can: dev: check netif_running() before bus-off recovery Cunhao Lu via B4 Relay
2026-11-06 9:37 ` [PATCH net v7 2/7] can: dev: add close_candev_cancel_restart_sync() Cunhao Lu via B4 Relay
@ 2026-11-06 9:37 ` Cunhao Lu via B4 Relay
2026-11-06 9:37 ` [PATCH net v7 4/7] can: rockchip_canfd: disable RX offload on open failure Cunhao Lu via B4 Relay
` (4 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Cunhao Lu via B4 Relay @ 2026-11-06 9:37 UTC (permalink / raw)
To: Marc Kleine-Budde, Vincent Mailhol, Heiko Stuebner,
David S. Miller, Wolfgang Grandegger, Oliver Hartkopp, kernel,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap
Cc: Cunhao Lu, linux-can, linux-kernel, linux-arm-kernel,
linux-rockchip, netdev, linux-doc, stable
From: Cunhao Lu <1579567540@qq.com>
The close path cancels restart_work in close_candev() only after freeing
the IRQ, disabling RX offload and stopping the controller. A concurrent
restart can re-enable the controller and interrupts after IRQ teardown,
or requeue timestamp work that accesses registers after runtime suspend
has disabled the controller clocks.
Call close_candev_cancel_restart_sync() at the start of ndo_stop(), while
the resources needed by a running restart are still available. Keep
close_candev() after IRQ teardown for final cancellation and echo cleanup.
Fixes: ff60bfbaf67f ("can: rockchip_canfd: add driver for Rockchip CAN-FD controller")
Cc: stable@vger.kernel.org
Signed-off-by: Cunhao Lu <1579567540@qq.com>
---
Changes in v7:
- Keep close cancellation separate from restart and open error handling.
---
drivers/net/can/rockchip/rockchip_canfd-core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/can/rockchip/rockchip_canfd-core.c b/drivers/net/can/rockchip/rockchip_canfd-core.c
index 1cae86973da5..59a79fe057e6 100644
--- a/drivers/net/can/rockchip/rockchip_canfd-core.c
+++ b/drivers/net/can/rockchip/rockchip_canfd-core.c
@@ -758,6 +758,7 @@ static int rkcanfd_stop(struct net_device *ndev)
{
struct rkcanfd_priv *priv = netdev_priv(ndev);
+ close_candev_cancel_restart_sync(ndev);
netif_stop_queue(ndev);
rkcanfd_chip_interrupts_disable(priv);
--
2.34.1
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH net v7 4/7] can: rockchip_canfd: disable RX offload on open failure
2026-11-06 9:37 [PATCH net v7 0/7] can: fix bus-off restart and device close races Cunhao Lu via B4 Relay
` (2 preceding siblings ...)
2026-11-06 9:37 ` [PATCH net v7 3/7] can: rockchip_canfd: cancel bus-off restart before closing the device Cunhao Lu via B4 Relay
@ 2026-11-06 9:37 ` Cunhao Lu via B4 Relay
2026-11-06 9:37 ` [PATCH net v7 5/7] can: rockchip_canfd: serialize TX with bus-off and restart Cunhao Lu via B4 Relay
` (3 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Cunhao Lu via B4 Relay @ 2026-11-06 9:37 UTC (permalink / raw)
To: Marc Kleine-Budde, Vincent Mailhol, Heiko Stuebner,
David S. Miller, Wolfgang Grandegger, Oliver Hartkopp, kernel,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap
Cc: Cunhao Lu, linux-can, linux-kernel, linux-arm-kernel,
linux-rockchip, netdev, linux-doc, stable
From: Cunhao Lu <1579567540@qq.com>
rkcanfd_open() enables RX offload before requesting the IRQ. If
request_irq() fails, the error path leaves the offload enabled. A later
open calls napi_enable() on an already enabled NAPI instance.
Disable RX offload on that error path before stopping the controller and
releasing the runtime PM reference.
Fixes: ff60bfbaf67f ("can: rockchip_canfd: add driver for Rockchip CAN-FD controller")
Cc: stable@vger.kernel.org
Signed-off-by: Cunhao Lu <1579567540@qq.com>
---
Changes in v7:
- Split the open error cleanup into a separate patch.
Changes in v3:
- Disable RX offload when request_irq() fails during open.
---
drivers/net/can/rockchip/rockchip_canfd-core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/can/rockchip/rockchip_canfd-core.c b/drivers/net/can/rockchip/rockchip_canfd-core.c
index 59a79fe057e6..d05264605efc 100644
--- a/drivers/net/can/rockchip/rockchip_canfd-core.c
+++ b/drivers/net/can/rockchip/rockchip_canfd-core.c
@@ -747,6 +747,7 @@ static int rkcanfd_open(struct net_device *ndev)
return 0;
out_rkcanfd_chip_stop:
+ can_rx_offload_disable(&priv->offload);
rkcanfd_chip_stop_sync(priv, CAN_STATE_STOPPED);
pm_runtime_put(ndev->dev.parent);
out_close_candev:
--
2.34.1
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH net v7 5/7] can: rockchip_canfd: serialize TX with bus-off and restart
2026-11-06 9:37 [PATCH net v7 0/7] can: fix bus-off restart and device close races Cunhao Lu via B4 Relay
` (3 preceding siblings ...)
2026-11-06 9:37 ` [PATCH net v7 4/7] can: rockchip_canfd: disable RX offload on open failure Cunhao Lu via B4 Relay
@ 2026-11-06 9:37 ` Cunhao Lu via B4 Relay
2026-11-06 9:37 ` [PATCH net v7 6/7] can: rockchip_canfd: prevent timestamp work from rearming after bus-off Cunhao Lu via B4 Relay
` (2 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Cunhao Lu via B4 Relay @ 2026-11-06 9:37 UTC (permalink / raw)
To: Marc Kleine-Budde, Vincent Mailhol, Heiko Stuebner,
David S. Miller, Wolfgang Grandegger, Oliver Hartkopp, kernel,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap
Cc: Cunhao Lu, linux-can, linux-kernel, linux-arm-kernel,
linux-rockchip, netdev, linux-doc, stable
From: Cunhao Lu <1579567540@qq.com>
The bus-off path can reset the controller while TX submission or RX-side
echo handling is active. CAN restart flushes echo skbs before set_mode(),
so disabling TX in that callback is too late to protect the echo ring.
Use tx_lock and tx_enabled to drain TX and RX-side echo users before
publishing CAN_STATE_BUS_OFF. Return NETDEV_TX_BUSY while TX is disabled
and drop consumed RX entries so self-transmitted frames cannot escape
echo filtering as ordinary RX.
Before restart, mask device interrupts and flush the mask write, suspend
shared IRQ access, and drain active handlers and timestamp work. After
reinitialization, restore carrier, TX, IRQ handling and the queue under
tx_lock, so the old bus-off IRQ cannot leave carrier off and a new bus-off
takes precedence. Keep synchronous waits outside the lock and other
shared IRQ users enabled.
Keep IRQ handling suspended until open completes and TX disabled on
close or failed open. Initialize timestamp work once at probe.
Retain the original skb until after unlocking to keep its socket
destructor outside the IRQ-disabled critical section. Preserve the
prerequisite echo failure handling, also rejecting success without an
installed echo skb; neither case may advance tx_head, account BQL or
request hardware TX.
Fixes: ff60bfbaf67f ("can: rockchip_canfd: add driver for Rockchip CAN-FD controller")
Fixes: b6661d73290c ("can: rockchip_canfd: add TX PATH")
Cc: stable@vger.kernel.org
Signed-off-by: Cunhao Lu <1579567540@qq.com>
---
Changes in v7:
- Introduce restart/IRQ synchronization and TX protection together.
- Reuse prerequisite TX locking and adapt to the updated skb ownership.
Changes in v6:
- Defer the original skb's release until after unlocking.
- Abort TX submission if echo preparation fails.
Changes in v5:
- Drop consumed RX FIFO entries when tx_enabled is false under tx_lock,
rather than skipping only echo filtering and delivering them as RX.
Changes in v3:
- Replace disable_irq()/enable_irq() with device interrupt masking,
mask readback, an irq_suspended flag and synchronize_irq().
- Pair release/acquire accesses to publish reinitialized state before
the IRQ handler resumes, without disabling other shared IRQ users.
- Initialize timestamp delayed work once at probe and synchronously
cancel it before reinitializing the timestamp state during restart.
---
drivers/net/can/rockchip/rockchip_canfd-core.c | 64 ++++++++++++++++++++--
drivers/net/can/rockchip/rockchip_canfd-rx.c | 59 ++++++++++----------
.../net/can/rockchip/rockchip_canfd-timestamp.c | 6 +-
drivers/net/can/rockchip/rockchip_canfd-tx.c | 62 ++++++++++++---------
drivers/net/can/rockchip/rockchip_canfd.h | 8 ++-
5 files changed, 134 insertions(+), 65 deletions(-)
diff --git a/drivers/net/can/rockchip/rockchip_canfd-core.c b/drivers/net/can/rockchip/rockchip_canfd-core.c
index d05264605efc2..dcfdd81f940fe 100644
--- a/drivers/net/can/rockchip/rockchip_canfd-core.c
+++ b/drivers/net/can/rockchip/rockchip_canfd-core.c
@@ -20,6 +20,7 @@
#include <linux/of_device.h>
#include <linux/platform_device.h>
#include <linux/pm_runtime.h>
+#include <linux/smp.h>
#include <linux/string.h>
#include "rockchip_canfd.h"
@@ -325,6 +326,35 @@ static void rkcanfd_chip_start(struct rkcanfd_priv *priv)
rkcanfd_read(priv, RKCANFD_REG_MODE));
}
+static void rkcanfd_tx_disable(struct rkcanfd_priv *priv)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(&priv->tx_lock, flags);
+ priv->tx_enabled = false;
+ netif_stop_queue(priv->ndev);
+ spin_unlock_irqrestore(&priv->tx_lock, flags);
+}
+
+static void rkcanfd_chip_start_finish(struct rkcanfd_priv *priv)
+{
+ unsigned long flags;
+
+ /* Serialize carrier, IRQ enable and queue wake with a new bus-off. */
+ spin_lock_irqsave(&priv->tx_lock, flags);
+ /* A manual restart may have raced with the old bus-off IRQ's
+ * netif_carrier_off(). That IRQ is now drained; restore carrier
+ * before resuming IRQ handling so a new bus-off takes precedence.
+ */
+ netif_carrier_on(priv->ndev);
+ priv->tx_enabled = true;
+ /* Publish the initialized state before resuming IRQ handling. */
+ smp_store_release(&priv->irq_suspended, false);
+ rkcanfd_chip_interrupts_enable(priv);
+ netif_wake_queue(priv->ndev);
+ spin_unlock_irqrestore(&priv->tx_lock, flags);
+}
+
static void __rkcanfd_chip_stop(struct rkcanfd_priv *priv, const enum can_state state)
{
priv->can.state = state;
@@ -356,9 +386,18 @@ static int rkcanfd_set_mode(struct net_device *ndev,
switch (mode) {
case CAN_MODE_START:
+ rkcanfd_tx_disable(priv);
+ rkcanfd_chip_interrupts_disable(priv);
+ /* Flush the interrupt mask write before suspending the handler. */
+ rkcanfd_read(priv, RKCANFD_REG_INT_MASK);
+ /* Suspend our IRQ handler while reinitializing the device. */
+ WRITE_ONCE(priv->irq_suspended, true);
+ /* Wait for handlers that already passed the suspended check. */
+ synchronize_irq(ndev->irq);
+ rkcanfd_timestamp_stop_sync(priv);
+
rkcanfd_chip_start(priv);
- rkcanfd_chip_interrupts_enable(priv);
- netif_wake_queue(ndev);
+ rkcanfd_chip_start_finish(priv);
break;
default:
@@ -592,6 +631,12 @@ static int rkcanfd_handle_state_error_int(struct rkcanfd_priv *priv)
* handles cf == NULL.
*/
skb = rkcanfd_alloc_can_err_skb(priv, &cf, ×tamp);
+ if (new_state == CAN_STATE_BUS_OFF) {
+ /* Drain TX before publishing BUS_OFF, which permits a manual
+ * restart to flush echo SKBs before calling our set_mode().
+ */
+ rkcanfd_tx_disable(priv);
+ }
can_change_state(ndev, cf, tx_state, rx_state);
if (new_state == CAN_STATE_BUS_OFF) {
@@ -666,6 +711,10 @@ static irqreturn_t rkcanfd_irq(int irq, void *dev_id)
struct rkcanfd_priv *priv = dev_id;
u32 reg_int_unmasked, reg_int;
+ /* Pairs with the release after restart has initialized the device. */
+ if (smp_load_acquire(&priv->irq_suspended))
+ return IRQ_NONE;
+
reg_int_unmasked = rkcanfd_read(priv, RKCANFD_REG_INT);
reg_int = reg_int_unmasked & ~priv->reg_int_mask_default;
@@ -733,6 +782,8 @@ static int rkcanfd_open(struct net_device *ndev)
if (err)
goto out_close_candev;
+ /* A shared IRQ may run as soon as request_irq() succeeds. */
+ WRITE_ONCE(priv->irq_suspended, true);
rkcanfd_chip_start(priv);
can_rx_offload_enable(&priv->offload);
@@ -740,13 +791,12 @@ static int rkcanfd_open(struct net_device *ndev)
if (err)
goto out_rkcanfd_chip_stop;
- rkcanfd_chip_interrupts_enable(priv);
-
- netif_start_queue(ndev);
+ rkcanfd_chip_start_finish(priv);
return 0;
out_rkcanfd_chip_stop:
+ rkcanfd_tx_disable(priv);
can_rx_offload_disable(&priv->offload);
rkcanfd_chip_stop_sync(priv, CAN_STATE_STOPPED);
pm_runtime_put(ndev->dev.parent);
@@ -760,7 +810,7 @@ static int rkcanfd_stop(struct net_device *ndev)
struct rkcanfd_priv *priv = netdev_priv(ndev);
close_candev_cancel_restart_sync(ndev);
- netif_stop_queue(ndev);
+ rkcanfd_tx_disable(priv);
rkcanfd_chip_interrupts_disable(priv);
free_irq(ndev->irq, priv);
@@ -937,6 +987,8 @@ static int rkcanfd_probe(struct platform_device *pdev)
if (err)
goto out_free_candev;
+ rkcanfd_timestamp_work_init(priv);
+
err = rkcanfd_register(priv);
if (err)
goto out_can_rx_offload_del;
diff --git a/drivers/net/can/rockchip/rockchip_canfd-rx.c b/drivers/net/can/rockchip/rockchip_canfd-rx.c
index 59420233c9184..7e43a9b470cb3 100644
--- a/drivers/net/can/rockchip/rockchip_canfd-rx.c
+++ b/drivers/net/can/rockchip/rockchip_canfd-rx.c
@@ -91,6 +91,7 @@ rkcanfd_fifo_header_to_cfd_header(const struct rkcanfd_priv *priv,
return len + cfd->len;
}
+/* Called with tx_lock held and TX enabled. */
static int rkcanfd_rxstx_filter(struct rkcanfd_priv *priv,
const struct canfd_frame *cfd_rx, const u32 ts,
bool *tx_done)
@@ -100,25 +101,16 @@ static int rkcanfd_rxstx_filter(struct rkcanfd_priv *priv,
const struct canfd_frame *cfd_nominal;
const struct sk_buff *skb;
unsigned int tx_tail;
- unsigned long flags;
-
- spin_lock_irqsave(&priv->tx_lock, flags);
- if (!rkcanfd_get_tx_pending(priv))
- goto out_unlock;
+ lockdep_assert_held(&priv->tx_lock);
tx_tail = rkcanfd_get_tx_tail(priv);
skb = priv->can.echo_skb[tx_tail];
if (!skb) {
- const unsigned int tx_head_unmasked = priv->tx_head;
- const unsigned int tx_tail_unmasked = priv->tx_tail;
-
- spin_unlock_irqrestore(&priv->tx_lock, flags);
-
netdev_err(priv->ndev,
"%s: echo_skb[%u]=NULL tx_head=0x%08x tx_tail=0x%08x\n",
__func__, tx_tail,
- tx_head_unmasked, tx_tail_unmasked);
+ priv->tx_head, priv->tx_tail);
return -ENOMSG;
}
@@ -134,18 +126,17 @@ static int rkcanfd_rxstx_filter(struct rkcanfd_priv *priv,
rkcanfd_handle_tx_done_one(priv, ts, &frame_len);
WRITE_ONCE(priv->tx_tail, priv->tx_tail + 1);
- *tx_done = true;
-
- spin_unlock_irqrestore(&priv->tx_lock, flags);
netif_subqueue_completed_wake(priv->ndev, 0, 1, frame_len,
rkcanfd_get_effective_tx_free(priv),
RKCANFD_TX_START_THRESHOLD);
+ *tx_done = true;
+
return 0;
}
if (!(priv->devtype_data.quirks & RKCANFD_QUIRK_RK3568_ERRATUM_6))
- goto out_unlock;
+ return 0;
/* Erratum 6: Extended frames may be send as standard frames.
*
@@ -155,7 +146,7 @@ static int rkcanfd_rxstx_filter(struct rkcanfd_priv *priv,
*/
if (!(cfd_nominal->can_id & CAN_EFF_FLAG) ||
(cfd_rx->can_id & CAN_EFF_FLAG))
- goto out_unlock;
+ return 0;
/* Not affected if:
* - standard part and RTR flag of the TX'ed frame
@@ -163,20 +154,20 @@ static int rkcanfd_rxstx_filter(struct rkcanfd_priv *priv,
*/
if ((cfd_nominal->can_id & (CAN_RTR_FLAG | CAN_SFF_MASK)) !=
(cfd_rx->can_id & (CAN_RTR_FLAG | CAN_SFF_MASK)))
- goto out_unlock;
+ return 0;
/* Not affected if:
* - length is not the same
*/
if (cfd_nominal->len != cfd_rx->len)
- goto out_unlock;
+ return 0;
/* Not affected if:
* - the data of non RTR frames is different
*/
if (!(cfd_nominal->can_id & CAN_RTR_FLAG) &&
memcmp(cfd_nominal->data, cfd_rx->data, cfd_nominal->len))
- goto out_unlock;
+ return 0;
/* Affected by Erratum 6 */
u64_stats_update_begin(&rkcanfd_stats->syncp);
@@ -197,9 +188,6 @@ static int rkcanfd_rxstx_filter(struct rkcanfd_priv *priv,
rkcanfd_xmit_retry(priv);
-out_unlock:
- spin_unlock_irqrestore(&priv->tx_lock, flags);
-
return 0;
}
@@ -216,9 +204,11 @@ rkcanfd_fifo_header_empty(const struct rkcanfd_fifo_header *header)
static int rkcanfd_handle_rx_int_one(struct rkcanfd_priv *priv)
{
struct net_device_stats *stats = &priv->ndev->stats;
- struct canfd_frame cfd[1] = { }, *skb_cfd;
struct rkcanfd_fifo_header header[1] = { };
+ struct canfd_frame cfd[1] = { }, *skb_cfd;
+ bool tx_done = false;
struct sk_buff *skb;
+ unsigned long flags;
unsigned int len;
int err;
@@ -252,15 +242,24 @@ static int rkcanfd_handle_rx_int_one(struct rkcanfd_priv *priv)
return 0;
}
- if (rkcanfd_get_tx_pending(priv)) {
- bool tx_done = false;
+ /* Drop FIFO entries while TX is disabled, as they may be self-
+ * received frames. Do not access the echo ring, retry TX or wake the
+ * queue while restart owns the ring. The entry is already consumed.
+ */
+ spin_lock_irqsave(&priv->tx_lock, flags);
+ if (unlikely(!priv->tx_enabled)) {
+ spin_unlock_irqrestore(&priv->tx_lock, flags);
+ return 0;
+ }
+ err = 0;
+ if (rkcanfd_get_tx_pending(priv))
err = rkcanfd_rxstx_filter(priv, cfd, header->ts, &tx_done);
- if (err)
- return err;
- if (tx_done && !(priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK))
- return 0;
- }
+ spin_unlock_irqrestore(&priv->tx_lock, flags);
+ if (err)
+ return err;
+ if (tx_done && !(priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK))
+ return 0;
/* Manual handling of CAN Bus Error counters. See
* rkcanfd_get_corrected_berr_counter() for detailed
diff --git a/drivers/net/can/rockchip/rockchip_canfd-timestamp.c b/drivers/net/can/rockchip/rockchip_canfd-timestamp.c
index 72774cd2f94b7..ad582afbbd682 100644
--- a/drivers/net/can/rockchip/rockchip_canfd-timestamp.c
+++ b/drivers/net/can/rockchip/rockchip_canfd-timestamp.c
@@ -37,6 +37,11 @@ static void rkcanfd_timestamp_work(struct work_struct *work)
schedule_delayed_work(&priv->timestamp, priv->work_delay_jiffies);
}
+void rkcanfd_timestamp_work_init(struct rkcanfd_priv *priv)
+{
+ INIT_DELAYED_WORK(&priv->timestamp, rkcanfd_timestamp_work);
+}
+
void rkcanfd_timestamp_init(struct rkcanfd_priv *priv)
{
const struct can_bittiming *dbt = &priv->can.fd.data_bittiming;
@@ -73,7 +78,6 @@ void rkcanfd_timestamp_init(struct rkcanfd_priv *priv)
max_cycles = min(max_cycles, cc->mask);
work_delay_ns = clocksource_cyc2ns(max_cycles, cc->mult, cc->shift);
priv->work_delay_jiffies = div_u64(work_delay_ns, 3u * NSEC_PER_SEC / HZ);
- INIT_DELAYED_WORK(&priv->timestamp, rkcanfd_timestamp_work);
netdev_dbg(priv->ndev, "clock=%lu.%02luMHz bitrate=%lu.%02luMBit/s div=%u rate=%lu.%02luMHz mult=%u shift=%u delay=%lus\n",
priv->can.clock.freq / MEGA,
diff --git a/drivers/net/can/rockchip/rockchip_canfd-tx.c b/drivers/net/can/rockchip/rockchip_canfd-tx.c
index b367341dd0aeb..7bff961c04adf 100644
--- a/drivers/net/can/rockchip/rockchip_canfd-tx.c
+++ b/drivers/net/can/rockchip/rockchip_canfd-tx.c
@@ -35,22 +35,15 @@ static bool rkcanfd_tx_tail_is_eff(const struct rkcanfd_priv *priv)
return cfd->can_id & CAN_EFF_FLAG;
}
-unsigned int rkcanfd_get_effective_tx_free(struct rkcanfd_priv *priv)
+unsigned int rkcanfd_get_effective_tx_free(const struct rkcanfd_priv *priv)
{
- unsigned int tx_free;
- unsigned long flags;
-
- spin_lock_irqsave(&priv->tx_lock, flags);
+ lockdep_assert_held(&priv->tx_lock);
if (priv->devtype_data.quirks & RKCANFD_QUIRK_RK3568_ERRATUM_6 &&
rkcanfd_tx_tail_is_eff(priv))
- tx_free = 0;
- else
- tx_free = rkcanfd_get_tx_free(priv);
+ return 0;
- spin_unlock_irqrestore(&priv->tx_lock, flags);
-
- return tx_free;
+ return rkcanfd_get_tx_free(priv);
}
static void rkcanfd_start_xmit_write_cmd(const struct rkcanfd_priv *priv,
@@ -89,6 +82,12 @@ netdev_tx_t rkcanfd_start_xmit(struct sk_buff *skb, struct net_device *ndev)
if (can_dev_dropped_skb(ndev, skb))
return NETDEV_TX_OK;
+ spin_lock_irqsave(&priv->tx_lock, flags);
+ if (unlikely(!priv->tx_enabled)) {
+ netif_stop_queue(ndev);
+ goto out_busy;
+ }
+
if (!netif_subqueue_maybe_stop(priv->ndev, 0,
rkcanfd_get_effective_tx_free(priv),
RKCANFD_TX_STOP_THRESHOLD,
@@ -99,22 +98,10 @@ netdev_tx_t rkcanfd_start_xmit(struct sk_buff *skb, struct net_device *ndev)
priv->tx_head, priv->tx_tail,
rkcanfd_get_tx_pending(priv));
- return NETDEV_TX_BUSY;
- }
-
- spin_lock_irqsave(&priv->tx_lock, flags);
- tx_head = rkcanfd_get_tx_head(priv);
- frame_len = can_skb_get_frame_len(skb);
- err = can_put_echo_skb(skb, ndev, tx_head, frame_len);
- if (err) {
- spin_unlock_irqrestore(&priv->tx_lock, flags);
-
- ndev->stats.tx_dropped++;
- return NETDEV_TX_OK;
+ goto out_busy;
}
- skb = priv->can.echo_skb[tx_head];
- cfd = (const struct canfd_frame *)skb->data;
+ cfd = (struct canfd_frame *)skb->data;
if (cfd->can_id & CAN_EFF_FLAG) {
reg_frameinfo = RKCANFD_REG_FD_FRAMEINFO_FRAME_FORMAT;
@@ -140,8 +127,17 @@ netdev_tx_t rkcanfd_start_xmit(struct sk_buff *skb, struct net_device *ndev)
cfd->len);
}
+ tx_head = rkcanfd_get_tx_head(priv);
reg_cmd = RKCANFD_REG_CMD_TX_REQ(tx_head);
+ /* Keep the original skb alive until IRQs are restored so echo
+ * preparation cannot invoke its socket destructor under tx_lock.
+ */
+ frame_len = can_skb_get_frame_len(skb);
+ err = can_put_echo_skb(skb_get(skb), ndev, tx_head, frame_len);
+ if (unlikely(err || !priv->can.echo_skb[tx_head]))
+ goto out_drop;
+
rkcanfd_write(priv, RKCANFD_REG_FD_TXFRAMEINFO, reg_frameinfo);
rkcanfd_write(priv, RKCANFD_REG_FD_TXID, reg_id);
for (i = 0; i < cfd->len; i += 4)
@@ -153,14 +149,28 @@ netdev_tx_t rkcanfd_start_xmit(struct sk_buff *skb, struct net_device *ndev)
WRITE_ONCE(priv->tx_head, priv->tx_head + 1);
rkcanfd_start_xmit_write_cmd(priv, reg_cmd);
- spin_unlock_irqrestore(&priv->tx_lock, flags);
netif_subqueue_maybe_stop(priv->ndev, 0,
rkcanfd_get_effective_tx_free(priv),
RKCANFD_TX_STOP_THRESHOLD,
RKCANFD_TX_START_THRESHOLD);
+ spin_unlock_irqrestore(&priv->tx_lock, flags);
+ dev_consume_skb_any(skb);
+
return NETDEV_TX_OK;
+
+out_drop:
+ ndev->stats.tx_dropped++;
+ spin_unlock_irqrestore(&priv->tx_lock, flags);
+ dev_kfree_skb_any(skb);
+
+ return NETDEV_TX_OK;
+
+out_busy:
+ spin_unlock_irqrestore(&priv->tx_lock, flags);
+
+ return NETDEV_TX_BUSY;
}
void rkcanfd_handle_tx_done_one(struct rkcanfd_priv *priv, const u32 ts,
diff --git a/drivers/net/can/rockchip/rockchip_canfd.h b/drivers/net/can/rockchip/rockchip_canfd.h
index 2dc3a41afe32d..3664124a8da25 100644
--- a/drivers/net/can/rockchip/rockchip_canfd.h
+++ b/drivers/net/can/rockchip/rockchip_canfd.h
@@ -475,13 +475,16 @@ struct rkcanfd_priv {
struct can_rx_offload offload;
struct net_device *ndev;
- spinlock_t tx_lock; /* protects tx_head, tx_tail and echo_skb */
+ /* Serialize TX submission/completion with bus-off and restart. */
+ spinlock_t tx_lock;
void __iomem *regs;
unsigned int tx_head;
unsigned int tx_tail;
u32 reg_mode_default;
u32 reg_int_mask_default;
+ bool tx_enabled;
+ bool irq_suspended;
struct rkcanfd_devtype_data devtype_data;
struct cyclecounter cc;
@@ -553,12 +556,13 @@ int rkcanfd_handle_rx_int(struct rkcanfd_priv *priv);
void rkcanfd_skb_set_timestamp(const struct rkcanfd_priv *priv,
struct sk_buff *skb, const u32 timestamp);
+void rkcanfd_timestamp_work_init(struct rkcanfd_priv *priv);
void rkcanfd_timestamp_init(struct rkcanfd_priv *priv);
void rkcanfd_timestamp_start(struct rkcanfd_priv *priv);
void rkcanfd_timestamp_stop(struct rkcanfd_priv *priv);
void rkcanfd_timestamp_stop_sync(struct rkcanfd_priv *priv);
-unsigned int rkcanfd_get_effective_tx_free(struct rkcanfd_priv *priv);
+unsigned int rkcanfd_get_effective_tx_free(const struct rkcanfd_priv *priv);
void rkcanfd_xmit_retry(struct rkcanfd_priv *priv);
netdev_tx_t rkcanfd_start_xmit(struct sk_buff *skb, struct net_device *ndev);
void rkcanfd_handle_tx_done_one(struct rkcanfd_priv *priv, const u32 ts,
--
2.34.1
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH net v7 6/7] can: rockchip_canfd: prevent timestamp work from rearming after bus-off
2026-11-06 9:37 [PATCH net v7 0/7] can: fix bus-off restart and device close races Cunhao Lu via B4 Relay
` (4 preceding siblings ...)
2026-11-06 9:37 ` [PATCH net v7 5/7] can: rockchip_canfd: serialize TX with bus-off and restart Cunhao Lu via B4 Relay
@ 2026-11-06 9:37 ` Cunhao Lu via B4 Relay
2026-11-06 9:37 ` [PATCH net v7 7/7] can: rockchip_canfd: serialize timecounter timestamp conversion Cunhao Lu via B4 Relay
2026-11-06 12:50 ` [PATCH net v7 0/7] can: fix bus-off restart and device close races Heiko Stübner
7 siblings, 0 replies; 11+ messages in thread
From: Cunhao Lu via B4 Relay @ 2026-11-06 9:37 UTC (permalink / raw)
To: Marc Kleine-Budde, Vincent Mailhol, Heiko Stuebner,
David S. Miller, Wolfgang Grandegger, Oliver Hartkopp, kernel,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap
Cc: Cunhao Lu, linux-can, linux-kernel, linux-arm-kernel,
linux-rockchip, netdev, linux-doc, stable
From: Cunhao Lu <1579567540@qq.com>
The bus-off IRQ cancels timestamp work asynchronously. If the worker
is already running, it can requeue itself after cancellation and keep
polling while the controller remains bus-off.
Add a dedicated lock and an active flag, initialized once at probe.
Serialize the worker's active check, counter read and self-requeue with
start and stop. Clear the flag under the lock before cancelling work
so no worker can read the counter or rearm after deactivation. Enable
the flag and schedule the initial work under the same lock at start.
Keep both cancellation calls outside the lock so synchronous stop can
wait for the worker to finish.
Fixes: 4e1a18bab124 ("can: rockchip_canfd: add hardware timestamping support")
Cc: stable@vger.kernel.org
Signed-off-by: Cunhao Lu <1579567540@qq.com>
---
.../net/can/rockchip/rockchip_canfd-timestamp.c | 34 +++++++++++++++++++---
drivers/net/can/rockchip/rockchip_canfd.h | 3 ++
2 files changed, 33 insertions(+), 4 deletions(-)
diff --git a/drivers/net/can/rockchip/rockchip_canfd-timestamp.c b/drivers/net/can/rockchip/rockchip_canfd-timestamp.c
index ad582afbbd68..1d2a122770dc 100644
--- a/drivers/net/can/rockchip/rockchip_canfd-timestamp.c
+++ b/drivers/net/can/rockchip/rockchip_canfd-timestamp.c
@@ -30,18 +30,27 @@ static void rkcanfd_timestamp_work(struct work_struct *work)
{
const struct delayed_work *delayed_work = to_delayed_work(work);
struct rkcanfd_priv *priv;
+ unsigned long flags;
priv = container_of(delayed_work, struct rkcanfd_priv, timestamp);
- timecounter_read(&priv->tc);
-
- schedule_delayed_work(&priv->timestamp, priv->work_delay_jiffies);
+ spin_lock_irqsave(&priv->timestamp_lock, flags);
+ if (priv->timestamp_active) {
+ timecounter_read(&priv->tc);
+
+ /* Serialize requeueing with timestamp deactivation. */
+ schedule_delayed_work(&priv->timestamp, priv->work_delay_jiffies);
+ }
+ spin_unlock_irqrestore(&priv->timestamp_lock, flags);
}
void rkcanfd_timestamp_work_init(struct rkcanfd_priv *priv)
{
+ spin_lock_init(&priv->timestamp_lock);
+ priv->timestamp_active = false;
INIT_DELAYED_WORK(&priv->timestamp, rkcanfd_timestamp_work);
}
+/* The caller must quiesce IRQs and timestamp work before reconfiguration. */
void rkcanfd_timestamp_init(struct rkcanfd_priv *priv)
{
const struct can_bittiming *dbt = &priv->can.fd.data_bittiming;
@@ -93,17 +102,34 @@ void rkcanfd_timestamp_init(struct rkcanfd_priv *priv)
void rkcanfd_timestamp_start(struct rkcanfd_priv *priv)
{
- timecounter_init(&priv->tc, &priv->cc, ktime_get_real_ns());
+ unsigned long flags;
+ spin_lock_irqsave(&priv->timestamp_lock, flags);
+ timecounter_init(&priv->tc, &priv->cc, ktime_get_real_ns());
+ priv->timestamp_active = true;
schedule_delayed_work(&priv->timestamp, priv->work_delay_jiffies);
+ spin_unlock_irqrestore(&priv->timestamp_lock, flags);
}
void rkcanfd_timestamp_stop(struct rkcanfd_priv *priv)
{
+ unsigned long flags;
+
+ spin_lock_irqsave(&priv->timestamp_lock, flags);
+ priv->timestamp_active = false;
+ spin_unlock_irqrestore(&priv->timestamp_lock, flags);
+
cancel_delayed_work(&priv->timestamp);
}
void rkcanfd_timestamp_stop_sync(struct rkcanfd_priv *priv)
{
+ unsigned long flags;
+
+ spin_lock_irqsave(&priv->timestamp_lock, flags);
+ priv->timestamp_active = false;
+ spin_unlock_irqrestore(&priv->timestamp_lock, flags);
+
+ /* The worker needs timestamp_lock to finish. */
cancel_delayed_work_sync(&priv->timestamp);
}
diff --git a/drivers/net/can/rockchip/rockchip_canfd.h b/drivers/net/can/rockchip/rockchip_canfd.h
index 3664124a8da2..078876769a05 100644
--- a/drivers/net/can/rockchip/rockchip_canfd.h
+++ b/drivers/net/can/rockchip/rockchip_canfd.h
@@ -477,6 +477,8 @@ struct rkcanfd_priv {
/* Serialize TX submission/completion with bus-off and restart. */
spinlock_t tx_lock;
+ /* Protects timestamp_active and worker reads/requeueing. */
+ spinlock_t timestamp_lock;
void __iomem *regs;
unsigned int tx_head;
unsigned int tx_tail;
@@ -485,6 +487,7 @@ struct rkcanfd_priv {
u32 reg_int_mask_default;
bool tx_enabled;
bool irq_suspended;
+ bool timestamp_active;
struct rkcanfd_devtype_data devtype_data;
struct cyclecounter cc;
--
2.34.1
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH net v7 7/7] can: rockchip_canfd: serialize timecounter timestamp conversion
2026-11-06 9:37 [PATCH net v7 0/7] can: fix bus-off restart and device close races Cunhao Lu via B4 Relay
` (5 preceding siblings ...)
2026-11-06 9:37 ` [PATCH net v7 6/7] can: rockchip_canfd: prevent timestamp work from rearming after bus-off Cunhao Lu via B4 Relay
@ 2026-11-06 9:37 ` Cunhao Lu via B4 Relay
2026-11-06 12:50 ` [PATCH net v7 0/7] can: fix bus-off restart and device close races Heiko Stübner
7 siblings, 0 replies; 11+ messages in thread
From: Cunhao Lu via B4 Relay @ 2026-11-06 9:37 UTC (permalink / raw)
To: Marc Kleine-Budde, Vincent Mailhol, Heiko Stuebner,
David S. Miller, Wolfgang Grandegger, Oliver Hartkopp, kernel,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap
Cc: Cunhao Lu, linux-can, linux-kernel, linux-arm-kernel,
linux-rockchip, netdev, linux-doc, stable
From: Cunhao Lu <1579567540@qq.com>
The timestamp worker advances the timecounter with timecounter_read()
while RX, TX completion and error-frame paths use timecounter_cyc2time()
to convert hardware timestamps without holding timestamp_lock.
timecounter_read() updates frac, cycle_last and nsec in separate steps.
A concurrent conversion can observe the new cycle_last with the old
nsec and produce an incorrect timestamp.
Hold timestamp_lock across timecounter_cyc2time(), using the same lock
as timecounter_read() and timecounter_init(). Keep the SKB timestamp
assignment outside the critical section.
TX completion nests timestamp_lock inside tx_lock; no timestamp-lock
holder acquires tx_lock.
Fixes: 4e1a18bab124 ("can: rockchip_canfd: add hardware timestamping support")
Cc: stable@vger.kernel.org
Signed-off-by: Cunhao Lu <1579567540@qq.com>
---
drivers/net/can/rockchip/rockchip_canfd-timestamp.c | 5 ++++-
drivers/net/can/rockchip/rockchip_canfd.h | 4 ++--
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/can/rockchip/rockchip_canfd-timestamp.c b/drivers/net/can/rockchip/rockchip_canfd-timestamp.c
index 1d2a122770dc..e255bb33a20d 100644
--- a/drivers/net/can/rockchip/rockchip_canfd-timestamp.c
+++ b/drivers/net/can/rockchip/rockchip_canfd-timestamp.c
@@ -15,13 +15,16 @@ static u64 rkcanfd_timestamp_read(struct cyclecounter *cc)
return rkcanfd_get_timestamp(priv);
}
-void rkcanfd_skb_set_timestamp(const struct rkcanfd_priv *priv,
+void rkcanfd_skb_set_timestamp(struct rkcanfd_priv *priv,
struct sk_buff *skb, const u32 timestamp)
{
struct skb_shared_hwtstamps *hwtstamps = skb_hwtstamps(skb);
+ unsigned long flags;
u64 ns;
+ spin_lock_irqsave(&priv->timestamp_lock, flags);
ns = timecounter_cyc2time(&priv->tc, timestamp);
+ spin_unlock_irqrestore(&priv->timestamp_lock, flags);
hwtstamps->hwtstamp = ns_to_ktime(ns);
}
diff --git a/drivers/net/can/rockchip/rockchip_canfd.h b/drivers/net/can/rockchip/rockchip_canfd.h
index 078876769a05..ecb9e2d6aa19 100644
--- a/drivers/net/can/rockchip/rockchip_canfd.h
+++ b/drivers/net/can/rockchip/rockchip_canfd.h
@@ -477,7 +477,7 @@ struct rkcanfd_priv {
/* Serialize TX submission/completion with bus-off and restart. */
spinlock_t tx_lock;
- /* Protects timestamp_active and worker reads/requeueing. */
+ /* Protects tc, timestamp_active and worker requeueing. */
spinlock_t timestamp_lock;
void __iomem *regs;
unsigned int tx_head;
@@ -557,7 +557,7 @@ void rkcanfd_ethtool_init(struct rkcanfd_priv *priv);
int rkcanfd_handle_rx_int(struct rkcanfd_priv *priv);
-void rkcanfd_skb_set_timestamp(const struct rkcanfd_priv *priv,
+void rkcanfd_skb_set_timestamp(struct rkcanfd_priv *priv,
struct sk_buff *skb, const u32 timestamp);
void rkcanfd_timestamp_work_init(struct rkcanfd_priv *priv);
void rkcanfd_timestamp_init(struct rkcanfd_priv *priv);
--
2.34.1
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH net v7 0/7] can: fix bus-off restart and device close races
2026-11-06 9:37 [PATCH net v7 0/7] can: fix bus-off restart and device close races Cunhao Lu via B4 Relay
` (6 preceding siblings ...)
2026-11-06 9:37 ` [PATCH net v7 7/7] can: rockchip_canfd: serialize timecounter timestamp conversion Cunhao Lu via B4 Relay
@ 2026-11-06 12:50 ` Heiko Stübner
2026-11-07 2:57 ` Cunhao Lu
7 siblings, 1 reply; 11+ messages in thread
From: Heiko Stübner @ 2026-11-06 12:50 UTC (permalink / raw)
To: Marc Kleine-Budde, Vincent Mailhol, David S. Miller,
Wolfgang Grandegger, Oliver Hartkopp, kernel, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jonathan Corbet,
Shuah Khan, Randy Dunlap, 1579567540
Cc: Cunhao Lu, linux-can, linux-kernel, linux-arm-kernel,
linux-rockchip, netdev, linux-doc, stable
Hi,
Am Freitag, 6. November 2026, 10:37:19 Mitteleuropäische Normalzeit schrieb Cunhao Lu via B4 Relay:
> This work started from a real failure on a production robot using a
> LubanCat-5IO with an RK3588. RX continued, but the TX queue remained
> stopped and subsequent sends returned ENOBUFS. The interface still
> reported ERROR-ACTIVE, and the hardware indicated neither a bus-off
> condition nor a pending TX request.
[...]
> This series depends on the three patches in "can: skb: make CAN skb
> freeing safe in any IRQ context" [1] and the three patches in "can:
> rockchip_canfd: fix TX stalls and races" [2].
>
> [1] https://lore.kernel.org/linux-can/tencent_CD05F020BAFB2537F5D1F4CBB425588EA80A@qq.com/
> [2] https://lore.kernel.org/linux-can/tencent_E25C9BE6689264E4138A464803B810FDFD09@qq.com/
Both these series are from july and seemingly from before you started
using the b4-relay. So they may or may not have survived the kernel
releases and their threading is broken both on lore and in any maibox
they arrived in.
And if there haven't been any responses to them since then, I'd think
they have been lost or so.
So I'd suggest rolling both your dependencies forward on top of the can
tree and sending them as a new version, so that reviewers can find them?
Heiko
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH net v7 0/7] can: fix bus-off restart and device close races
2026-11-06 12:50 ` [PATCH net v7 0/7] can: fix bus-off restart and device close races Heiko Stübner
@ 2026-11-07 2:57 ` Cunhao Lu
2026-11-07 14:40 ` Heiko Stuebner
0 siblings, 1 reply; 11+ messages in thread
From: Cunhao Lu @ 2026-11-07 2:57 UTC (permalink / raw)
To: Heiko Stübner, Marc Kleine-Budde, Vincent Mailhol,
David S. Miller, Wolfgang Grandegger, Oliver Hartkopp, kernel,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap
Cc: linux-can, linux-kernel, linux-arm-kernel, linux-rockchip,
netdev, linux-doc, stable
Hi,
> > This series depends on the three patches in "can: skb: make CAN skb
> > freeing safe in any IRQ context" [1] and the three patches in "can:
> > rockchip_canfd: fix TX stalls and races" [2].
> >
> > [1] https://lore.kernel.org/linux-can/tencent_CD05F020BAFB2537F5D1F4CBB425588EA80A@qq.com/
> > [2] https://lore.kernel.org/linux-can/tencent_E25C9BE6689264E4138A464803B810FDFD09@qq.com/
>
> Both these series are from july and seemingly from before you started
> using the b4-relay. So they may or may not have survived the kernel
> releases and their threading is broken both on lore and in any maibox
> they arrived in.
>
> And if there haven't been any responses to them since then, I'd think
> they have been lost or so.
>
> So I'd suggest rolling both your dependencies forward on top of the can
> tree and sending them as a new version, so that reviewers can find them?
Thank you very much for the guidance! :-P
I just checked: the "can: skb: make CAN skb freeing safe in any IRQ
context" series was merged into mainline yesterday, so I won't send a
new version of it. I'll remove its link from the cover letter.
The "can: rockchip_canfd: fix TX stalls and races" series still has some
issues reported by the bots during submission to the net tree that I
need to address. Since those patches overlap with this series, I plan
to fold them into the next version (v8) and send them together.
Best regards,
Cunhao Lu
pw-bot: cr
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH net v7 0/7] can: fix bus-off restart and device close races
2026-11-07 2:57 ` Cunhao Lu
@ 2026-11-07 14:40 ` Heiko Stuebner
0 siblings, 0 replies; 11+ messages in thread
From: Heiko Stuebner @ 2026-11-07 14:40 UTC (permalink / raw)
To: Marc Kleine-Budde, Vincent Mailhol, David S. Miller,
Wolfgang Grandegger, Oliver Hartkopp, kernel, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jonathan Corbet,
Shuah Khan, Randy Dunlap, Cunhao Lu
Cc: linux-can, linux-kernel, linux-arm-kernel, linux-rockchip,
netdev, linux-doc, stable
Hi,
Am Samstag, 7. November 2026, 03:57:26 Mitteleuropäische Normalzeit schrieb Cunhao Lu:
> > > This series depends on the three patches in "can: skb: make CAN skb
> > > freeing safe in any IRQ context" [1] and the three patches in "can:
> > > rockchip_canfd: fix TX stalls and races" [2].
> > >
> > > [1] https://lore.kernel.org/linux-can/tencent_CD05F020BAFB2537F5D1F4CBB425588EA80A@qq.com/
> > > [2] https://lore.kernel.org/linux-can/tencent_E25C9BE6689264E4138A464803B810FDFD09@qq.com/
> >
> > Both these series are from july and seemingly from before you started
> > using the b4-relay. So they may or may not have survived the kernel
> > releases and their threading is broken both on lore and in any maibox
> > they arrived in.
> >
> > And if there haven't been any responses to them since then, I'd think
> > they have been lost or so.
> >
> > So I'd suggest rolling both your dependencies forward on top of the can
> > tree and sending them as a new version, so that reviewers can find them?
>
> Thank you very much for the guidance! :-P
>
> I just checked: the "can: skb: make CAN skb freeing safe in any IRQ
> context" series was merged into mainline yesterday, so I won't send a
> new version of it. I'll remove its link from the cover letter.
>
> The "can: rockchip_canfd: fix TX stalls and races" series still has some
> issues reported by the bots during submission to the net tree that I
> need to address. Since those patches overlap with this series, I plan
> to fold them into the next version (v8) and send them together.
As that series is also "just" for the Rockchip CAN driver, merging both
sounds like a good plan - especially as it makes it easier to keep track
of things :-) .
Heiko
^ permalink raw reply [flat|nested] 11+ messages in thread