From: Gennaro Cimmino Date: Fri, 24 Jul 2026 15:21:46 +0000 (+0200) Subject: realtek: eth: reclaim completed TX buffers on RX poll X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;ds=inline;p=thirdparty%2Fopenwrt.git realtek: eth: reclaim completed TX buffers on RX poll The transmit path frees a TX skb only when its descriptor slot is reused, RTETH_TX_RING_SIZE transmissions later. Until then the skb stays charged to the sending socket's send buffer. With standard frames the pinned amount is negligible, but with jumbo frames a handful of completed transmissions is enough to exhaust the sender's budget: eight ~9k echo replies exceed the kernel ICMP socket limit of 2 * SKB_TRUESIZE(64 * 1024), after which the stack drops every further reply of any size (Icmp OutErrors) until unrelated transmissions happen to recycle the slots. Observed on the Hasivo S1100W-8XGT-SE (RTL9303) as a total ICMP blackout setting in after exactly eight jumbo echo replies, healed by any sixteen device-originated frames. Track monotonic send/clean counters in the driver-private ring info (their difference is the number of unreleased skbs, their low bits the ring slots), and release the contiguous completed run at the start of the RX poll, before the received packets are processed, so replies generated while handling the poll always find their send budget released. The walk runs under the TX queue lock the transmit path already holds, stops at the first descriptor the hardware still owns, and is skipped entirely - no lock taken, no access to the uncached descriptor memory - while nothing is pending. The transmit path reuses the same walk for the ring-wrap case instead of its old per-slot cleanup, and stopped or watchdog-frozen queues are left to the rteth_tx_timeout() recovery, which keeps releasing every buffer itself. Assisted-by: Claude:claude-fable-5 Signed-off-by: Gennaro Cimmino Link: https://github.com/openwrt/openwrt/pull/24406 Signed-off-by: Markus Stockhausen --- diff --git a/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c b/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c index 98258030218..3a62dc2b53f 100644 --- a/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c +++ b/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c @@ -89,7 +89,8 @@ struct rteth_rx_info { }; struct rteth_tx_info { - int slot; + unsigned int send_count; /* skbs handed to the hardware */ + unsigned int clean_count; /* skbs released after completion */ struct sk_buff *skb[RTETH_TX_RING_SIZE]; }; @@ -657,6 +658,49 @@ static void rteth_free_tx_buffers(struct rteth_ctrl *ctrl) tx_info->skb[i]->len, DMA_TO_DEVICE); rteth_free_skb(&tx_info->skb[i]); } + tx_info->send_count = 0; + tx_info->clean_count = 0; + } +} + +static void rteth_reclaim_tx_ring(struct rteth_ctrl *ctrl, int r) +{ + struct rteth_tx_info *tx_info = &ctrl->tx_info[r]; + + BUILD_BUG_ON(RTETH_TX_RING_SIZE & (RTETH_TX_RING_SIZE - 1)); + + while (tx_info->send_count != tx_info->clean_count) { + int i = tx_info->clean_count & (RTETH_TX_RING_SIZE - 1); + + if (ctrl->tx_data[r].ring[i] & RING_OWN_HW) + break; + + dma_unmap_single(&ctrl->pdev->dev, ctrl->tx_data[r].frag[i].dma, + tx_info->skb[i]->len, DMA_TO_DEVICE); + dev_consume_skb_any(tx_info->skb[i]); + tx_info->skb[i] = NULL; + tx_info->clean_count++; + } +} + +static void rteth_reclaim_tx_rings(struct rteth_ctrl *ctrl) +{ + for (int r = 0; r < RTETH_TX_RINGS; r++) { + struct netdev_queue *txq; + + /* Cached-memory fast path, made stable by the lock below */ + if (READ_ONCE(ctrl->tx_info[r].send_count) == + READ_ONCE(ctrl->tx_info[r].clean_count)) + continue; + + txq = netdev_get_tx_queue(ctrl->dev, r); + + __netif_tx_lock(txq, smp_processor_id()); + + if (!netif_xmit_frozen_or_stopped(txq)) + rteth_reclaim_tx_ring(ctrl, r); + + __netif_tx_unlock(txq); } } @@ -735,7 +779,8 @@ static int rteth_setup_ring_buffer(struct rteth_ctrl *ctrl) } ctrl->tx_data[r].ring[RTETH_TX_RING_SIZE - 1] |= RING_WRAP; - ctrl->tx_info[r].slot = 0; + ctrl->tx_info[r].send_count = 0; + ctrl->tx_info[r].clean_count = 0; } if (highmem) @@ -1073,7 +1118,7 @@ static int rteth_start_xmit(struct sk_buff *skb, struct net_device *dev) return NETDEV_TX_OK; } - slot = ctrl->tx_info[ring].slot; + slot = ctrl->tx_info[ring].send_count & (RTETH_TX_RING_SIZE - 1); frag = &ctrl->tx_data[ring].frag[slot]; packet_dma = ctrl->tx_data[ring].ring[slot]; packet_skb = &ctrl->tx_info[ring].skb[slot]; @@ -1086,11 +1131,8 @@ static int rteth_start_xmit(struct sk_buff *skb, struct net_device *dev) return NETDEV_TX_BUSY; } - if (likely(*packet_skb)) { - /* cleanup old data of this slot */ - dma_unmap_single(&ctrl->pdev->dev, frag->dma, (*packet_skb)->len, DMA_TO_DEVICE); - dev_consume_skb_any(*packet_skb); - } + if (unlikely(*packet_skb)) + rteth_reclaim_tx_ring(ctrl, ring); *packet_skb = skb; frag->len = len; @@ -1106,7 +1148,7 @@ static int rteth_start_xmit(struct sk_buff *skb, struct net_device *dev) /* Hand frag over to switch */ dma_wmb(); ctrl->tx_data[ring].ring[slot] = packet_dma | RING_OWN_HW; - ctrl->tx_info[ring].slot = (slot + 1) % RTETH_TX_RING_SIZE; + ctrl->tx_info[ring].send_count++; wmb(); spin_lock(&ctrl->tx_lock); @@ -1297,6 +1339,8 @@ static int rteth_poll_rx(struct napi_struct *napi, int budget) struct rteth_ctrl *ctrl = rx_q->ctrl; int work_done, ring = rx_q->id; + rteth_reclaim_tx_rings(ctrl); + work_done = rteth_hw_receive(ctrl->dev, ring, budget); if (work_done < budget && napi_complete_done(napi, work_done)) rteth_reenable_irq(ctrl, ring);