Re: [PATCH 2/2] net/iavf: disable runtime queue setup during queue rate limiting

[Bruce Richardson <bruce.richardson@intel.com>]

On Wed, Jul 08, 2026 at 07:19:26PM -0400, Dawid Wesierski wrote:
> Runtime queue setup on E810 VFs causes queue state corruption when
> queues are dynamically reconfigured while the hardware rate limiter
> is actively pacing TX queues. Queue configuration messages to the PF
> via virtchnl can race with ongoing TX operations, leading to undefined
> behavior.
> 
> Rather than gating this behind a devarg that an application would have
> to know to set (and could just as easily avoid triggering the race by
> not calling rte_eth_{rx,tx}_queue_setup() on a running port), stop
> advertising RTE_ETH_DEV_CAPA_RUNTIME_RX_QUEUE_SETUP and
> RTE_ETH_DEV_CAPA_RUNTIME_TX_QUEUE_SETUP as soon as the application
> commits a per-queue bandwidth rte_tm hierarchy, i.e. as soon as the
> condition that causes the race actually exists. iavf_dev_info_get() is
> re-queried by the ethdev layer on every rx/tx_queue_setup() call, so
> this is enough for the generic layer to start rejecting runtime queue
> (re)configuration with -EBUSY once queue rate limiting is active, and
> to automatically allow it again once the rte_tm hierarchy is torn
> down.
> 
> vf->qtc_map, already used elsewhere to look up a queue's TC mapping,
> is repurposed as the "queue bandwidth committed" signal since it's set
> by iavf_hierarchy_commit() exactly when a per-queue bandwidth mapping
> has been pushed to the PF, regardless of whether the port was stopped
> at the time. Fix two related issues found while making it load-bearing
> for this check:
> 
> - iavf_hierarchy_commit() replaced vf->qtc_map on every successful
>   commit without freeing the previous allocation, leaking memory.
> - vf->qtc_map was never released on VF teardown, so
>   iavf_uninit_vf()/iavf_init_vf() (e.g. across a VF reset) could leave
>   a stale pointer referencing freed unrelated memory, and the runtime
>   queue setup capability would never be re-advertised after a reset.
> 
> Both are fixed by freeing vf->qtc_map before replacing it in
> iavf_hierarchy_commit(), and freeing and clearing it in
> iavf_uninit_vf().
> 
> Signed-off-by: Marek Kasiewicz <marek.kasiewicz@intel.com>
> Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
> ---

Acked-by: Bruce Richardson <bruce.richardson@intel.com>


However, this patch needs a rebase since some of the changes to cleanup
the qtc_map were made in a previously-applied patch.

>  doc/guides/nics/intel_vf.rst           | 10 ++++++++++
>  doc/guides/rel_notes/release_26_07.rst |  3 +++
>  drivers/net/intel/iavf/iavf_ethdev.c   | 23 ++++++++++++++++++++---
>  drivers/net/intel/iavf/iavf_tm.c       |  2 ++
>  4 files changed, 35 insertions(+), 3 deletions(-)
> 
> diff --git a/doc/guides/nics/intel_vf.rst b/doc/guides/nics/intel_vf.rst
> index e010f852cf..a47e3f6736 100644
> --- a/doc/guides/nics/intel_vf.rst
> +++ b/doc/guides/nics/intel_vf.rst
> @@ -150,6 +150,16 @@ Intel\ |reg| E800 Series Ethernet devices:
>    for example: ``-a 18:00.0,quanta_size=2048``.
>    The default value is 1024, and quanta size should be set as the product of 64 in legacy host interface mode.
>  
> +* Runtime (post-start) Rx/Tx queue setup can race with the hardware Tx rate
> +  limiter on E810 VFs and corrupt queue state.
> +  Once an application commits a per-queue bandwidth ``rte_tm`` hierarchy,
> +  the driver automatically stops advertising
> +  ``RTE_ETH_DEV_CAPA_RUNTIME_RX_QUEUE_SETUP`` and
> +  ``RTE_ETH_DEV_CAPA_RUNTIME_TX_QUEUE_SETUP``,
> +  so ``rte_eth_rx_queue_setup()``/``rte_eth_tx_queue_setup()``
> +  are rejected with ``-EBUSY`` on a running port for as long as queue rate
> +  limiting is active.
> +
>  * When using the Intel out-of-tree "ice" PF/kernel driver v1.13.7 or later,
>    to create VFs with >16 queues (aka. "large VFs"),
>    it is necessary to change the rss_lut_vf_addr setting in sysfs from the default of 64 to 512.
> diff --git a/doc/guides/rel_notes/release_26_07.rst b/doc/guides/rel_notes/release_26_07.rst
> index 6352ef27ab..7ea80112f4 100644
> --- a/doc/guides/rel_notes/release_26_07.rst
> +++ b/doc/guides/rel_notes/release_26_07.rst
> @@ -143,6 +143,9 @@ New Features
>  
>    * Added support for transmitting LLDP packets based on mbuf packet type.
>    * Implemented AVX2 context descriptor transmit paths.
> +  * Runtime Rx/Tx queue setup is now automatically disabled while a
> +    per-queue bandwidth ``rte_tm`` hierarchy is committed, to avoid
> +    corrupting queue state on E810 VFs.
>  
>  * **Updated Intel ice driver.**
>  
> diff --git a/drivers/net/intel/iavf/iavf_ethdev.c b/drivers/net/intel/iavf/iavf_ethdev.c
> index 80e740ef29..5d0c361978 100644
> --- a/drivers/net/intel/iavf/iavf_ethdev.c
> +++ b/drivers/net/intel/iavf/iavf_ethdev.c
> @@ -1160,9 +1160,18 @@ iavf_dev_info_get(struct rte_eth_dev *dev, struct rte_eth_dev_info *dev_info)
>  	dev_info->reta_size = vf->vf_res->rss_lut_size;
>  	dev_info->flow_type_rss_offloads = IAVF_RSS_OFFLOAD_ALL;
>  	dev_info->max_mac_addrs = IAVF_NUM_MACADDR_MAX;
> -	dev_info->dev_capa =
> -		RTE_ETH_DEV_CAPA_RUNTIME_RX_QUEUE_SETUP |
> -		RTE_ETH_DEV_CAPA_RUNTIME_TX_QUEUE_SETUP;
> +	/*
> +	 * Runtime queue setup can race with the hardware Tx rate limiter on
> +	 * E810 VFs and corrupt queue state. Once a per-queue bandwidth rte_tm
> +	 * hierarchy has been committed (vf->qtc_map is set), stop advertising
> +	 * the capability so the ethdev layer rejects further rx/tx_queue_setup()
> +	 * calls on a running port with -EBUSY. The capability is re-advertised
> +	 * automatically once the rte_tm hierarchy is torn down.
> +	 */
> +	if (vf->qtc_map == NULL)
> +		dev_info->dev_capa =
> +			RTE_ETH_DEV_CAPA_RUNTIME_RX_QUEUE_SETUP |
> +			RTE_ETH_DEV_CAPA_RUNTIME_TX_QUEUE_SETUP;
>  	dev_info->rx_offload_capa =
>  		RTE_ETH_RX_OFFLOAD_VLAN_STRIP |
>  		RTE_ETH_RX_OFFLOAD_QINQ_STRIP |
> @@ -2756,6 +2765,14 @@ iavf_uninit_vf(struct rte_eth_dev *dev)
>  	rte_free(vf->qos_cap);
>  	vf->qos_cap = NULL;
>  
> +	/*
> +	 * Drop the committed queue/TC bandwidth mapping so a subsequent
> +	 * iavf_init_vf() (e.g. after a device reset) starts with runtime
> +	 * Rx/Tx queue setup available again (see iavf_dev_info_get()).
> +	 */
> +	rte_free(vf->qtc_map);
> +	vf->qtc_map = NULL;
> +
>  	rte_free(vf->rss_lut);
>  	vf->rss_lut = NULL;
>  	rte_free(vf->rss_key);
> diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
> index e3492ec491..c9d856e937 100644
> --- a/drivers/net/intel/iavf/iavf_tm.c
> +++ b/drivers/net/intel/iavf/iavf_tm.c
> @@ -905,6 +905,8 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
>  	if (ret_val)
>  		goto fail_clear;
>  
> +	/* replace the previously committed mapping, if any */
> +	rte_free(vf->qtc_map);
>  	vf->qtc_map = qtc_map;
>  	if (adapter->stopped == 1)
>  		vf->tm_conf.committed = true;
> -- 
> 2.47.3
>