[PATCH net v3 0/7] net: bcm4908_enet: TX ring and DMA fixes

[Kordian Chmielewski <kudzo51@gmail.com>]

These fix the BCM4908 Ethernet driver. Patch 1 fixes a TX stall seen
on a TP-Link Archer AX6000 under sustained load. Patches 2 to 7 come
from reading the code and from review, and have no reproducer.

Tested on an Archer AX6000 with OpenWrt and Linux 6.18.55, whose driver
differs from net only in one tree-wide change, with the LAN going
through this driver: TX and RX at line rate (941 Mbit/s TCP), and four
ifdown/ifup cycles of the conduit while it was sending. I ran the same
again, plus a UDP stream at 1 Gbit/s (944 Mbit/s received), with the TX
ring shrunk to 16 descriptors for the test, so that the queue was
stopped and woken over and over (about a million qdisc requeues in a
minute, with the ring full or nearly full in a third of the one-second
samples). No stall, no errors in the counters, no DMA timeout warnings.

Sashiko's review of v2 also pointed at older problems that this series
doesn't fix: open() ignores a failure to fill the RX ring, and fills
it with napi_alloc_frag() from process context; a failed RX refill
loses the old buffer; and the driver does not work without its
optional TX interrupt. I'll send fixes for those after this series.
It also found that a TX completion reported before start_xmit()
publishes write_idx can be missed; patch 7 narrows that window, and
I'll look into closing it.

Changes in v3:
- patch 3: leave the TX ring empty after freeing it, so that a failed
  open() cannot lead to the same skbs being freed again; wait for the
  TX channel with read_poll_timeout(), as a 2 ms deadline in jiffies
  can expire after one poll; leave the skbs alone if the channel does
  not stop (Sashiko)
- new patch 7: order the TX ring index accesses between start_xmit()
  and poll_tx(), and publish write_idx before the DMA kick (Sashiko)
- add Florian's Reviewed-by to patches 1, 2 and 4 to 6, not to patch 3,
  which changed

Changes in v2:
- patch 1: stop and wake the queue with the netdev_queues.h helpers,
  also when start_xmit() finds the ring full on entry; the changelog
  also names the slot that poll_tx() completed without a frame
- patch 3: wait for the TX DMA channel to stop before freeing its
  buffers; free only between read_idx and write_idx instead of
  clearing slot->skb in poll_tx(); drop the OWN check that could stop
  the queue for good; fix the RX timeout warning; the changelog
  describes leaks and stale frames, not a use-after-free
- patch 6: the comment and changelog no longer say where the DMA waits
- patches 1 and 2: more exact changelogs (the measured rate and what
  stopped; what driver.rst says about NETDEV_TX_BUSY)
- drop v1 patch 7 (RX frames longer than the buffer): its trigger is
  not reachable with the driver's own settings
- wrap lines over 80 columns; author name without the nickname

v2: https://lore.kernel.org/netdev/20261112195051.597102-1-kudzo51@gmail.com/
v1: https://lore.kernel.org/netdev/20261109235700.2586821-1-kudzo51@gmail.com/

Kordian Chmielewski (7):
  net: bcm4908_enet: fix the TX ring wrap
  net: bcm4908_enet: drop a TX frame whose DMA mapping failed
  net: bcm4908_enet: release the TX ring on stop
  net: bcm4908_enet: unmap the buffer of a dropped RX frame
  net: bcm4908_enet: unmap RX buffers on stop with their mapped size
  net: bcm4908_enet: publish the buffer address before OWN
  net: bcm4908_enet: order the TX ring index accesses

 drivers/net/ethernet/broadcom/bcm4908_enet.c | 143 ++++++++++++++-----
 1 file changed, 107 insertions(+), 36 deletions(-)


base-commit: 86706ffa990ecd46a4326f8eecbccbbd60a6cb8d
-- 
2.56.1