RE: [PATCH v2] ravb: On timeout disable IRQs to stop processing

[Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>]

Hi again and again,

> From: Yoshihiro Shimoda, Sent: Friday, May 22, 2020 8:17 PM
> 
> Hi again,
> 
> > From: Yoshihiro Shimoda, Sent: Friday, May 22, 2020 2:58 PM
> >
> > Hello Sergei-san,
> >
> > > From: Sergei Shtylyov, Sent: Monday, May 18, 2020 5:45 PM
> > >
> > > On 18.05.2020 7:54, Dirk Behme wrote:
> > >
> > > > Analyzing [1] it seems there is a race condition where ravb_start_xmit()
> > >  > can be called from interrupt while tx skbuffs are being torn down in
> > >  > the scheduled timeout handling. The actual timeout work is done in
> > >  > ravb_tx_timeout_work() during which the tx skbuffs are torn down via
> > >  > invocations of ravb_ring_free(). But there seems to be no flag to tell
> > >  > the driver it is shutting down so it continues to use the ring buffer
> > >  > when it should not.
> > >  >
> > >  > Fix this by disabling the interrupts in the timeout handler.
> > >
> > >     Hm, given that we stop all TX queues prior to tearing down the buffers,
> > > it is somewhat strange that you see the driver's send path called...
> > >     But disabling the interrupts seems the Right Thing anyways...
> >
> > I didn't reproduce this issue and I didn't know the root cause yet.
> > But, I'm feeling to strange. Especially, "ravb_start_xmit() can be called from interrupt".
> > I didn't find where ravb_start_xmit() can be called from interrupt for now.
> >
> > By the way, I'm thinking the following message is related to the issue.
> > > > ravb e6800000.ethernet ethernet: failed to switch device to config mode
> >
> > The ravb_config() output the message if failed. And, ravb_tx_timeout_work()
> > calls ravb_config() via ravb_stop_dma() and ravb_dmac_init().
> > ---
> > ravb_tx_timeout_work() {
> > 	ravb_stop_dma()		// call ravb_config()
> >
> > 	ravb_ring_free()	// *1
> > <snip>
> > 	ravb_dmac_init()	// call ravb_config()
> > <snip>
> > }
> >
> > ravb_dmac_init()
> > {
> > <snip>
> > 	error = ravb_config()	// "failed to switch device to config modes" here and -ETIMEDOUT
> > 	if (error)
> > 		return error	// *2
> > 	ravb_ring_init()	// *3
> > <snip>
> > }
> > --
> >
> > If ravb_config() failed at the *2, since ravb_ring_init() was not called,
> > any descriptors were not allocated and then the issue should happen.
> > Note that according to the datasheet, the controller cannot change the
> > mode from "Operation" to Configuration" when the controller is doing
> > TX or RX.
> 
> I'm afraid but, this scenario seems wrong because if the controller
> enters "Configuration" once, the driver needs to change the mode to
> "Operation" for starting any transfer again.

I realized that ravb_stop_dma() is possible to return without ravb_rcv_snd_disable() and
ravb_config() calling if TCCR or CSR register indicates transmit is started.

> > I don't know why the first ravb_config() doesn't fail for now.
> > But, my scenario is one of functions below enables the TX and RX
> > by calling ravb_rcv_snd_enable():
> >  - ravb_emac_interrupt_unlocked() ... if ESCR_LCHNG && !no_avb_link && PSR_LMON
> >  - ravb_adjust_link() ... if no_avb_link && phydev->link
> >  - ravb_set_rx_csum() ... if enabling NETIF_F_RXCSUM

In such the case (ravb_stop_dma() returns without any message),
I think my scenario is still alive without any these functions calling
because ravb_rcv_snd_disable() is not called.

I'll check the TCCR and CSR registers in next week.

Best regards,
Yoshihiro Shimoda