mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
To: Maxime Chevallier <maxime.chevallier@bootlin.com>,
	Andrew Lunn <andrew+netdev@lunn.ch>,
	"David S . Miller" <davem@davemloft.net>,
	"Eric Dumazet" <edumazet@kernel.org>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Maxime Coquelin <mcoquelin.stm32@gmail.com>,
	"Alexandre Torgue" <alexandre.torgue@foss.st.com>,
	Alexei Starovoitov <ast@kernel.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	Jesper Dangaard Brouer <hawk@kernel.org>,
	John Fastabend <john.fastabend@gmail.com>,
	"Stanislav Fomichev" <sdf@fomichev.me>,
	Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>,
	Christophe Roullier <christophe.roullier@foss.st.com>
Cc: <netdev@vger.kernel.org>,
	<linux-stm32@st-md-mailman.stormreply.com>,
	<linux-arm-kernel@lists.infradead.org>,
	<linux-kernel@vger.kernel.org>, <bpf@vger.kernel.org>,
	Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Subject: [PATCH 0/1] net: stmmac: descriptor management issue during PM sequence
Date: Tue, 27 Oct 2026 16:05:55 +0100	[thread overview]
Message-ID: <20261027150556.51209-1-thomas.bourgoin@foss.st.com> (raw)

Hello,

During low power sequence on STM32MP21 we sometimes observe out of range access
to the DDR by the GMAC ethernet. I managed to narrow down the issue to the
resume sequence of the RX descriptors with the function
stmmac_clear_descriptors().

On resume, stmmac_clear_descriptors() returns RX descriptors to the DMA
without restoring their buffer addresses. On DWMAC4, the DMA will
therefore consider a descriptor for the application as one for the DMA.
This can lead to illegal access from the DMA anywhere.
On STM32MP21 the DMA address bus is 40 bits, thus the extended status from the
write-back descriptor is read as an high address by the DMA. DMA will then try
to write in the DDR at 0x100000000 whereas on STM32MP215f-dk DDR is only 2Gb
from 0x8000 0000 to 0xffff ffff and nothing is mapped at 0x100000000.
All the other SoCs of the STM32MP1x or STM32MP2x are using a GMAC with a 32bits
DMA address, so I do not have illegal attemps.

To fix this, I propose to reconstruct the RX descriptors that have been used by
the DMA but not forwarded to the NAPI function stmmac_rx() before suspend.

I'm not used to this driver especially the xsk management and zero copy part.
Since this driver is used by a lot of plateforms I'm open to all suggestions.

This V1 propose to reuse stmmac_init_rx_buffers() but maybe using
stmmac_refill() would better fit the issue. From what I read, I could not call
stmmac_refill() as rx_q->cur_rx is only updated in stmmac_rx(), so
stmmac_rx_dirty() returns 0.

Thomas Bourgoin (1):
  net: stmmac: rebuild RX descriptors before restarting DMA on resume

 .../net/ethernet/stmicro/stmmac/stmmac_main.c | 86 +++++++++++++++----
 1 file changed, 68 insertions(+), 18 deletions(-)

-- 
2.43.0


             reply	other threads:[~2026-10-27 15:06 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-27 15:05 Thomas Bourgoin [this message]
2026-10-27 15:05 ` [PATCH 1/1] net: stmmac: rebuild RX descriptors before restarting DMA on resume Thomas Bourgoin
2026-10-27 15:18 ` [PATCH 0/1] net: stmmac: descriptor management issue during PM sequence Maxime Chevallier
2026-10-28  9:05   ` Thomas BOURGOIN

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261027150556.51209-1-thomas.bourgoin@foss.st.com \
    --to=thomas.bourgoin@foss.st.com \
    --cc=alexandre.torgue@foss.st.com \
    --cc=andrew+netdev@lunn.ch \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=christophe.roullier@foss.st.com \
    --cc=daniel@iogearbox.net \
    --cc=davem@davemloft.net \
    --cc=edumazet@kernel.org \
    --cc=hawk@kernel.org \
    --cc=john.fastabend@gmail.com \
    --cc=kuba@kernel.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-stm32@st-md-mailman.stormreply.com \
    --cc=lorenzo.bianconi@oss.qualcomm.com \
    --cc=maxime.chevallier@bootlin.com \
    --cc=mcoquelin.stm32@gmail.com \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=sdf@fomichev.me \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®