Jérémie Jourdin 38187938f5 re(4): quiesce RTL8168G+ and reset before freeing buffers in re_stop() ...

The STOPREQ command written by re_stop() is not defined for
RTL8168G and later; issuing it can wedge the MAC.

Replace it on those parts with the vendor-documented sequence:

* settle delay
* bounded poll for Tx queue empty
* clear TE/RE
* then bounded poll of the MCU command register (0xD3) FIFO-empty bits.

Also reset the controller before the Rx/Tx buffer free: a controller that
has not quiesced keeps DMAing stale, still-owned descriptors pointing at
freed mbufs (use-after-free under INVARIANTS, cross-NIC mbuf corruption
reported in the PR).

Adds the RL_MCU_* register definitions.

All waits are bounded; error paths only.

* iperf3 --bidir at line rate against RTL8168H (XID 0x541);
  previously wedged the controller until power cycle, with the
  quiesce the reset path recovers.

* Deployed in production on an RTL8168H fleet since 2026-07-01.

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D58276
PR: kern/166724

2026-07-19 11:44:36 -07:00

..

if_rl.c

…

if_rlreg.h

…