Re: [PATCH net-next v2] net: stmmac: add XDP multi-buff support for TX side

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net: stmmac: missing dma_wmb() before setting OWN bit in XDP TX
--

commit cb286a806a3e690802c6042eb9f26c31d2e6ccda
Author: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>
Subject: net: stmmac: add XDP multi-buff support for TX side

This commit extends stmmac_xdp_xmit_xdpf() to transmit XDP frames with
fragments (multi-buff). Each buffer, including the frame head and every frag,
is mapped and programmed into a dedicated TX descriptor.

> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index bf9e7e4cb1c31..089281ef9e612 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
[ ... ]
> @@ -5239,77 +5239,117 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue,
[ ... ]
> +	while (true) {
> +		skb_frag_t *frag = i ? &sinfo->frags[i - 1] : NULL;
> +		int len = frag ? skb_frag_size(frag) : xdpf->len;
> +		bool last_frame = i == num_frames - 1;
[ ... ]
> +		stmmac_prepare_tx_desc(priv, desc, !i, len, csum,
> +				       priv->descriptor_mode, !!i, last_frame,
> +				       xdp_get_frame_len(xdpf));
[ ... ]
> +	/* Set the OWN bit on the first descriptor now that all descriptors
> +	 * for this skb are populated.
> +	 */
> +	desc = stmmac_get_tx_desc(priv, tx_q, first_entry);
> +	stmmac_set_tx_owner(priv, desc);

[Severity: High]
Does this code need a memory barrier before setting the OWN bit?

When preparing the first descriptor, stmmac_prepare_tx_desc() is called with
tx_own set to false (!!i evaluates to 0 for the first entry). This skips the
internal dma_wmb() that would normally serialize writing the descriptor
payload before setting the OWN bit.

Since stmmac_set_tx_owner() lacks a memory barrier, weakly-ordered CPUs can
reorder the writes. If the DMA engine is actively polling the TX ring, it
might observe the OWN bit being set before the descriptor's payload is fully
written. Could this cause the DMA engine to fetch incorrect memory regions,
leading to data corruption on the wire or hardware IOMMU faults?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924-b4-stmmac-xmit-mb-v2-1-003347b7bc25@oss.qualcomm.com?part=1