net: ethernet: cortina: Carry over frag counter

The gmac_rx() NAPI poll function assembles packets in an
SKB from a ring buffer.

If the ring buffer gets completely emptied during a poll cycle,
we exit gmac_rx(), but the packet is not yet completely
assembled in the SKB, yet the fragment counter frag_nr is
reset to zero on the next invocation.

Solve this by making the RX fragment counter a part of the
port struct, and carry it over between invocations.

Reset the fragment counter only right after calling
napi_gro_frags(), on error (after calling napi_free_frags())
or if stopping the port.

Reset it in some place where not strictly necessary just to
emphasize what is going on.

This was found by Sashiko during normal patch review.

Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet")
Link: https://sashiko.dev/#/patchset/20260505-gemini-ethernet-fix-v2-1-997c31d06079%40kernel.org
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260509-gemini-ethernet-fixes-v1-3-6c5d20ddc35b@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index d5a56366fb432e5850b4c894c4dc43daec3532dc..4c762229ce420f102195ad96223743bec706fa84 100644 (file)
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -123,6 +123,7 @@ struct gemini_ethernet_port {
        struct hrtimer          rx_coalesce_timer;
        unsigned int            rx_coalesce_nsecs;
        struct sk_buff          *rx_skb;
+       unsigned int            rx_frag_nr;
 
        unsigned int            freeq_refill;
        struct gmac_txq         txq[TX_QUEUE_NUM];
@@ -1444,6 +1445,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)
        unsigned short m = (1 << port->rxq_order) - 1;
        struct gemini_ethernet *geth = port->geth;
        void __iomem *ptr_reg = port->rxq_rwptr;
+       unsigned int frag_nr = port->rx_frag_nr;
        struct sk_buff *skb = port->rx_skb;
        unsigned int frame_len, frag_len;
        struct gmac_rxdesc *rx = NULL;
@@ -1457,7 +1459,6 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)
        unsigned short r, w;
        union dma_rwptr rw;
        dma_addr_t mapping;
-       int frag_nr = 0;
 
        spin_lock_irqsave(&geth->irq_lock, flags);
        rw.bits32 = readl(ptr_reg);
@@ -1497,6 +1498,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)
                        if (skb) {
                                napi_free_frags(&port->napi);
                                skb = NULL;
+                               frag_nr = 0;
                        }
                        continue;
                }
@@ -1507,6 +1509,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)
                                napi_free_frags(&port->napi);
                                port->stats.rx_dropped++;
                                skb = NULL;
+                               frag_nr = 0;
                        }
 
                        skb = gmac_skb_if_good_frame(port, word0, frame_len);
@@ -1541,6 +1544,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)
                if (word3.bits32 & EOF_BIT) {
                        napi_gro_frags(&port->napi);
                        skb = NULL;
+                       frag_nr = 0;
                        --budget;
                }
                continue;
@@ -1549,6 +1553,7 @@ err_drop:
                if (skb) {
                        napi_free_frags(&port->napi);
                        skb = NULL;
+                       frag_nr = 0;
                }
 
                if (mapping)
@@ -1558,6 +1563,7 @@ err_drop:
        }
 
        port->rx_skb = skb;
+       port->rx_frag_nr = frag_nr;
        writew(r, ptr_reg);
        return budget;
 }
@@ -1886,6 +1892,7 @@ static int gmac_stop(struct net_device *netdev)
        gmac_stop_dma(port);
        napi_disable(&port->napi);
        port->rx_skb = NULL;
+       port->rx_frag_nr = 0;
 
        gmac_enable_irq(netdev, 0);
        gmac_cleanup_rxq(netdev);