From: Maciej Fijalkowski <maciej.fijalkowski@intel•com>
To: Larysa Zaremba <larysa.zaremba@intel•com>
Cc: bpf@vger•kernel.org, "Claudiu Manoil" <claudiu.manoil@nxp•com>,
"Vladimir Oltean" <vladimir.oltean@nxp•com>,
"Wei Fang" <wei.fang@nxp•com>,
"Clark Wang" <xiaoning.wang@nxp•com>,
"Andrew Lunn" <andrew+netdev@lunn•ch>,
"David S. Miller" <davem@davemloft•net>,
"Eric Dumazet" <edumazet@google•com>,
"Jakub Kicinski" <kuba@kernel•org>,
"Paolo Abeni" <pabeni@redhat•com>,
"Tony Nguyen" <anthony.l.nguyen@intel•com>,
"Przemek Kitszel" <przemyslaw.kitszel@intel•com>,
"Alexei Starovoitov" <ast@kernel•org>,
"Daniel Borkmann" <daniel@iogearbox•net>,
"Jesper Dangaard Brouer" <hawk@kernel•org>,
"John Fastabend" <john.fastabend@gmail•com>,
"Stanislav Fomichev" <sdf@fomichev•me>,
"Andrii Nakryiko" <andrii@kernel•org>,
"Martin KaFai Lau" <martin.lau@linux•dev>,
"Eduard Zingerman" <eddyz87@gmail•com>,
"Song Liu" <song@kernel•org>,
"Yonghong Song" <yonghong.song@linux•dev>,
"KP Singh" <kpsingh@kernel•org>, "Hao Luo" <haoluo@google•com>,
"Jiri Olsa" <jolsa@kernel•org>, "Simon Horman" <horms@kernel•org>,
"Shuah Khan" <shuah@kernel•org>,
"Alexander Lobakin" <aleksander.lobakin@intel•com>,
"Bastien Curutchet (eBPF Foundation)"
<bastien.curutchet@bootlin•com>,
"Tushar Vyavahare" <tushar.vyavahare@intel•com>,
"Jason Xing" <kernelxing@tencent•com>,
"Ricardo B. Marlière" <rbm@suse•com>,
"Eelco Chaudron" <echaudro@redhat•com>,
"Lorenzo Bianconi" <lorenzo@kernel•org>,
"Toke Hoiland-Jorgensen" <toke@redhat•com>,
imx@lists•linux.dev, netdev@vger•kernel.org,
linux-kernel@vger•kernel.org, intel-wired-lan@lists•osuosl.org,
linux-kselftest@vger•kernel.org,
"Aleksandr Loktionov" <aleksandr.loktionov@intel•com>,
"Dragos Tatulea" <dtatulea@nvidia•com>
Subject: Re: [PATCH bpf v3 4/9] ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
Date: Fri, 27 Feb 2026 12:22:41 +0100 [thread overview]
Message-ID: <aaF+gUtL/qzvgFym@boxer> (raw)
In-Reply-To: <20260217132450.1936200-5-larysa.zaremba@intel.com>
On Tue, Feb 17, 2026 at 02:24:42PM +0100, Larysa Zaremba wrote:
> The only user of frag_size field in XDP RxQ info is
> bpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead
> of DMA write size. Different assumptions in ice driver configuration lead
> to negative tailroom.
>
> This allows to trigger kernel panic, when using
> XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to
> 6912 and the requested offset to a huge value, e.g.
> XSK_UMEM__MAX_FRAME_SIZE * 100.
>
> Due to other quirks of the ZC configuration in ice, panic is not observed
> in ZC mode, but tailroom growing still fails when it should not.
>
> Use fill queue buffer truesize instead of DMA write size in XDP RxQ info.
> Fix ZC mode too by using the new helper.
>
> Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side")
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel•com>
> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel•com>
> ---
> drivers/net/ethernet/intel/ice/ice_base.c | 9 ++++-----
> 1 file changed, 4 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c
> index 511d803cf0a4..27ab899a4052 100644
> --- a/drivers/net/ethernet/intel/ice/ice_base.c
> +++ b/drivers/net/ethernet/intel/ice/ice_base.c
> @@ -659,7 +659,6 @@ static int ice_vsi_cfg_rxq(struct ice_rx_ring *ring)
> {
> struct device *dev = ice_pf_to_dev(ring->vsi->back);
> u32 num_bufs = ICE_DESC_UNUSED(ring);
> - u32 rx_buf_len;
> int err;
>
> if (ring->vsi->type == ICE_VSI_PF || ring->vsi->type == ICE_VSI_SF) {
> @@ -669,12 +668,12 @@ static int ice_vsi_cfg_rxq(struct ice_rx_ring *ring)
> return err;
>
> if (ring->xsk_pool) {
> - rx_buf_len =
> - xsk_pool_get_rx_frame_size(ring->xsk_pool);
ice_setup_rx_ctx() consumes ring->rx_buf_len. This can't come from
page_pool when you have configured xsk_pool on a given rxq. I believe we
need a setting:
ring->rx_buf_len =
xsk_pool_get_rx_frame_size(ring->xsk_pool);
> + u32 frag_size =
> + xsk_pool_get_rx_frag_step(ring->xsk_pool);
> err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev,
> ring->q_index,
> ring->q_vector->napi.napi_id,
> - rx_buf_len);
> + frag_size);
> if (err)
> return err;
> err = xdp_rxq_info_reg_mem_model(&ring->xdp_rxq,
> @@ -694,7 +693,7 @@ static int ice_vsi_cfg_rxq(struct ice_rx_ring *ring)
> err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev,
> ring->q_index,
> ring->q_vector->napi.napi_id,
> - ring->rx_buf_len);
> + ring->truesize);
> if (err)
> goto err_destroy_fq;
>
> --
> 2.52.0
>
next prev parent reply other threads:[~2026-02-27 11:22 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-17 13:24 [PATCH bpf v3 0/9] Address XDP frags having negative tailroom Larysa Zaremba
2026-02-17 13:24 ` [PATCH bpf v3 1/9] xdp: use modulo operation to calculate XDP frag tailroom Larysa Zaremba
2026-02-17 15:10 ` Loktionov, Aleksandr
2026-02-17 13:24 ` [PATCH bpf v3 2/9] xsk: introduce helper to determine rxq->frag_size Larysa Zaremba
2026-02-17 15:11 ` Loktionov, Aleksandr
2026-02-17 13:24 ` [PATCH bpf v3 3/9] ice: fix rxq info registering in mbuf packets Larysa Zaremba
2026-02-17 13:24 ` [PATCH bpf v3 4/9] ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz Larysa Zaremba
2026-02-27 11:22 ` Maciej Fijalkowski [this message]
2026-03-02 14:32 ` Larysa Zaremba
2026-02-17 13:24 ` [PATCH bpf v3 5/9] i40e: fix registering XDP RxQ info Larysa Zaremba
2026-02-17 15:12 ` Loktionov, Aleksandr
2026-02-19 12:00 ` Maciej Fijalkowski
2026-03-02 14:23 ` Larysa Zaremba
2026-02-17 13:24 ` [PATCH bpf v3 6/9] i40e: use xdp.frame_sz as XDP RxQ info frag_size Larysa Zaremba
2026-02-17 15:13 ` Loktionov, Aleksandr
2026-02-17 13:24 ` [PATCH bpf v3 7/9] libeth, idpf: use truesize " Larysa Zaremba
2026-02-17 15:06 ` Loktionov, Aleksandr
2026-02-17 16:19 ` Alexander Lobakin
2026-02-17 13:24 ` [PATCH bpf v3 8/9] net: enetc: " Larysa Zaremba
2026-02-17 13:24 ` [PATCH bpf v3 9/9] xdp: produce a warning when calculated tailroom is negative Larysa Zaremba
2026-02-27 15:31 ` [PATCH bpf v3 0/9] Address XDP frags having negative tailroom Maciej Fijalkowski
2026-03-02 9:18 ` Larysa Zaremba
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aaF+gUtL/qzvgFym@boxer \
--to=maciej.fijalkowski@intel$(echo .)com \
--cc=aleksander.lobakin@intel$(echo .)com \
--cc=aleksandr.loktionov@intel$(echo .)com \
--cc=andrew+netdev@lunn$(echo .)ch \
--cc=andrii@kernel$(echo .)org \
--cc=anthony.l.nguyen@intel$(echo .)com \
--cc=ast@kernel$(echo .)org \
--cc=bastien.curutchet@bootlin$(echo .)com \
--cc=bpf@vger$(echo .)kernel.org \
--cc=claudiu.manoil@nxp$(echo .)com \
--cc=daniel@iogearbox$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=dtatulea@nvidia$(echo .)com \
--cc=echaudro@redhat$(echo .)com \
--cc=eddyz87@gmail$(echo .)com \
--cc=edumazet@google$(echo .)com \
--cc=haoluo@google$(echo .)com \
--cc=hawk@kernel$(echo .)org \
--cc=horms@kernel$(echo .)org \
--cc=imx@lists$(echo .)linux.dev \
--cc=intel-wired-lan@lists$(echo .)osuosl.org \
--cc=john.fastabend@gmail$(echo .)com \
--cc=jolsa@kernel$(echo .)org \
--cc=kernelxing@tencent$(echo .)com \
--cc=kpsingh@kernel$(echo .)org \
--cc=kuba@kernel$(echo .)org \
--cc=larysa.zaremba@intel$(echo .)com \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-kselftest@vger$(echo .)kernel.org \
--cc=lorenzo@kernel$(echo .)org \
--cc=martin.lau@linux$(echo .)dev \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=przemyslaw.kitszel@intel$(echo .)com \
--cc=rbm@suse$(echo .)com \
--cc=sdf@fomichev$(echo .)me \
--cc=shuah@kernel$(echo .)org \
--cc=song@kernel$(echo .)org \
--cc=toke@redhat$(echo .)com \
--cc=tushar.vyavahare@intel$(echo .)com \
--cc=vladimir.oltean@nxp$(echo .)com \
--cc=wei.fang@nxp$(echo .)com \
--cc=xiaoning.wang@nxp$(echo .)com \
--cc=yonghong.song@linux$(echo .)dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox