> -----Original Message----- > From: Intel-wired-lan <[email protected]> On Behalf Of Bryan > Fraschetti via Intel-wired-lan > Sent: Monday, August 3, 2026 8:29 AM > To: Nguyen, Anthony L <[email protected]>; Kitszel, Przemyslaw > <[email protected]>; Andrew Lunn <[email protected]>; David S. > Miller <[email protected]>; Eric Dumazet <[email protected]>; Jakub > Kicinski <[email protected]>; Paolo Abeni <[email protected]>; Alice Michael > <[email protected]>; Greenwalt, Paul <[email protected]>; > Fijalkowski, Maciej <[email protected]>; Loktionov, Aleksandr > <[email protected]> > Cc: Bryan Fraschetti <[email protected]>; > [email protected]; [email protected]; > [email protected] > Subject: [Intel-wired-lan] [PATCH iwl] ice: Restore Ordered MMIO Writes for > Tx Doorbells > > The DQL accounting state which tracks the number of bytes queued for the NIC > to transmit, namely dql->num_queued, is updated by the ICE driver when it > invokes __netdev_tx_sent_queue(). Subsequently the > driver updates the > hardware queue tail allowing the NIC to begin processing the work queue. The > queue accounting update should be ordered before the NIC begins transmitting > descriptors. > > The transmit path currently updates the hardware doorbell using > writel_relaxed(), which (on arm64) does not provide the same ordering > guarantees between writes to normal memory and writes to MMIO registers that > writel() does. This introduces a potential race where the NIC begins > transmitting descriptors before the dql->num_queued update is globally > visible. If the NIC finishes before the update is observed > by > dql_completed(), it detects an invalid state where more bytes have been > completed than have been queued. When this happens the following BUG_ON is > triggered. > > BUG_ON(count > num_queued - dql->num_completed); > > This has been observed and manifests as the following crash (note that the > trace has been trimmed) in an environment with sustained network load that > uses an Intel Corporation Ethernet Controller E810-XXV > for SFP (rev 02) on > an arm64 machine. Replacing writel_relaxed() with writel() in a test kernel > eliminated the crash in the user's workload, which previously reproduced the > issue reliably. > > kernel BUG at lib/dynamic_queue_limits.c:99 > > Internal error: Oops - BUG: 00000000f2000800 [#1] SMP pc : > dql_completed+0x268/0x2a0 lr : ice_clean_tx_irq+0x1d4/0x620 [ice] Call trace: > dql_completed+0x268/0x2a0 (P) > ice_napi_poll+0x94/0x520 [ice] > __napi_poll+0x48/0x3f0 > net_rx_action+0x194/0x420 > > This restores the behaviour prior to commit ccde82e90946 ("ice: add E830 > Earliest TxTime First Offload support"), which changed the notification > mechanism from writel() to writel_relaxed(). > > Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161572 > Fixes: ccde82e90946 ("ice: add E830 Earliest TxTime First Offload support") > Signed-off-by: Bryan Fraschetti <[email protected]> > --- > drivers/net/ethernet/intel/ice/ice_txrx.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-)
Tested-by: Alexander Nowlin <[email protected]>
