From: Simon Guinot
> Sent: 08 November 2017 16:59
>
> The mvneta controller provides a 8-bit register to update the pending
> Tx descriptor counter. Then, a maximum of 255 Tx descriptors can be
> added at once. In the current code the mvneta_txq_pend_desc_add function
> assumes the caller takes care of this limit. But it is not the case. In
> some situations (xmit_more flag), more than 255 descriptors are added.
> When this happens, the Tx descriptor counter register is updated with a
> wrong value, which breaks the whole Tx queue management.
Even with xmit_more it is usually best to limit the number
(in order to reduce tx latency).
OTOH there are probably paths where it 'just happens'.
> This patch fixes the issue by allowing the mvneta_txq_pend_desc_add
> function to process more than 255 Tx descriptors.
>
> Fixes: 2a90f7e1d5d0 ("net: mvneta: add xmit_more support")
> Cc: stable@xxxxxxxxxxxxxxx # 4.11+
> Signed-off-by: Simon Guinot <simon.guinot@xxxxxxxxxxxx>
> ---
> drivers/net/ethernet/marvell/mvneta.c | 16 +++++++++-------
> 1 file changed, 9 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
> index 64a04975bcf8..027c08ce4e5d 100644
> --- a/drivers/net/ethernet/marvell/mvneta.c
> +++ b/drivers/net/ethernet/marvell/mvneta.c
> @@ -816,11 +816,14 @@ static void mvneta_txq_pend_desc_add(struct mvneta_port *pp,
> {
> u32 val;
>
> - /* Only 255 descriptors can be added at once ; Assume caller
> - * process TX desriptors in quanta less than 256
> - */
> - val = pend_desc + txq->pending;
> - mvreg_write(pp, MVNETA_TXQ_UPDATE_REG(txq->id), val);
> + pend_desc += txq->pending;
> +
> + /* Only 255 Tx descriptors can be added at once */
> + while (pend_desc > 0) {
> + val = min(pend_desc, 255);
> + mvreg_write(pp, MVNETA_TXQ_UPDATE_REG(txq->id), val);
> + pend_desc -= val;
> + }
do { ... } while () ??
David