[Bug 166724] if_re(4): watchdog timeout

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D166724

--- Comment #144 from [email protected] ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=3D38187938f52283143308dd219db35d889=
da55ea4

commit 38187938f52283143308dd219db35d889da55ea4
Author:     J=C3=A9r=C3=A9mie Jourdin <[email protected]>
AuthorDate: 2026-07-19 18:39:49 +0000
Commit:     Adrian Chadd <[email protected]>
CommitDate: 2026-07-19 18:44:36 +0000

    re(4): quiesce RTL8168G+ and reset before freeing buffers in re_stop()

    The STOPREQ command written by re_stop() is not defined for
    RTL8168G and later; issuing it can wedge the MAC.

    Replace it on those parts with the vendor-documented sequence:

    * settle delay
    * bounded poll for Tx queue empty
    * clear TE/RE
    * then bounded poll of the MCU command register (0xD3) FIFO-empty bits.

    Also reset the controller before the Rx/Tx buffer free: a controller th=
at
    has not quiesced keeps DMAing stale, still-owned descriptors pointing at
    freed mbufs (use-after-free under INVARIANTS, cross-NIC mbuf corruption
    reported in the PR).

    Adds the RL_MCU_* register definitions.

    All waits are bounded; error paths only.

    * iperf3 --bidir at line rate against RTL8168H (XID 0x541);
      previously wedged the controller until power cycle, with the
      quiesce the reset path recovers.

    * Deployed in production on an RTL8168H fleet since 2026-07-01.

    Reviewed by:    adrian
    Differential Revision:  https://reviews.freebsd.org/D58276
    PR: kern/166724

 sys/dev/re/if_re.c    | 41 ++++++++++++++++++++++++++++++++++++++++-
 sys/dev/rl/if_rlreg.h |  8 ++++++++
 2 files changed, 48 insertions(+), 1 deletion(-)

--=20
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.=