[PATCH] app/testpmd: fix DCB queue allocation for VMDq devices

[PATCH] app/testpmd: fix DCB queue allocation for VMDq devices

[KAVYA AV]

When using DCB mode with VT disabled and requesting more queues than
traffic classes (e.g., rxq=64 with 8 TCs), testpmd crashes with null
pointer errors because it artificially limits queue allocation to
num_tcs.

For VMDq devices, use device-specific queue count (nb_rx_queues/
nb_tx_queues) instead of limiting to num_tcs. This allows VMDq devices
to utilize their full queue capacity while maintaining compatibility
with non VMDq devices.

Fixes null pointer dereference when queue structures are accessed
beyond the allocated range.

Fixes: 2169699b15fc ("app/testpmd: add queue restriction in DCB command")
Cc: stable@dpdk.org

Signed-off-by: KAVYA AV <kavyax.a.v@intel.com>
---
 app/test-pmd/testpmd.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/app/test-pmd/testpmd.c b/app/test-pmd/testpmd.c
index fbacee89ea..70be52d36f 100644
--- a/app/test-pmd/testpmd.c
+++ b/app/test-pmd/testpmd.c
@@ -4444,9 +4444,11 @@ init_port_dcb_config(portid_t pid,
 			if (rte_port->dev_info.vmdq_pool_base == 0) {
 				nb_rxq = rte_port->dev_info.max_rx_queues;
 				nb_txq = rte_port->dev_info.max_tx_queues;
-			} else {
-				nb_rxq = (queueid_t)num_tcs;
-				nb_txq = (queueid_t)num_tcs;
+			}
+			/* Use device queue count to prevent null pointer errors */
+			else {
+				nb_rxq = rte_port->dev_info.nb_rx_queues;
+				nb_txq = rte_port->dev_info.nb_tx_queues;
 			}
 		}
 	}
-- 
2.43.0

Re: [PATCH] app/testpmd: fix DCB queue allocation for VMDq devices

[Stephen Hemminger]

On Fri, 13 Mar 2026 10:15:53 +0000
KAVYA AV <kavyax.a.v@intel.com> wrote:

> diff --git a/app/test-pmd/testpmd.c b/app/test-pmd/testpmd.c
> index fbacee89ea..70be52d36f 100644
> --- a/app/test-pmd/testpmd.c
> +++ b/app/test-pmd/testpmd.c
> @@ -4444,9 +4444,11 @@ init_port_dcb_config(portid_t pid,
>  			if (rte_port->dev_info.vmdq_pool_base == 0) {
>  				nb_rxq = rte_port->dev_info.max_rx_queues;
>  				nb_txq = rte_port->dev_info.max_tx_queues;
> -			} else {
> -				nb_rxq = (queueid_t)num_tcs;
> -				nb_txq = (queueid_t)num_tcs;
> +			}
> +			/* Use device queue count to prevent null pointer errors */
> +			else {
> +				nb_rxq = rte_port->dev_info.nb_rx_queues;
> +				nb_txq = rte_port->dev_info.nb_tx_queues;
>  			}
>  		}
>  	}

Please don't break up  "} else {" with a comment.
The comment is associated with the next two lines anyway.

[PATCH v2] app/testpmd: fix DCB queue allocation for VMDq devices

[KAVYA AV]

When using DCB mode with VT disabled and requesting more queues than
traffic classes (e.g., rxq=64 with 8 TCs), testpmd crashes with null
pointer errors because it artificially limits queue allocation to
num_tcs.

For VMDq devices, use device-specific queue count (nb_rx_queues/
nb_tx_queues) instead of limiting to num_tcs. This allows VMDq devices
to utilize their full queue capacity while maintaining compatibility
with non VMDq devices.

Fixes null pointer dereference when queue structures are accessed
beyond the allocated range.

Fixes: 2169699b15fc ("app/testpmd: add queue restriction in DCB command")
Cc: stable@dpdk.org

Signed-off-by: KAVYA AV <kavyax.a.v@intel.com>
---

v2: Moved the comment inside the else block.
---
 app/test-pmd/testpmd.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/test-pmd/testpmd.c b/app/test-pmd/testpmd.c
index fbacee89ea..7e50689f23 100644
--- a/app/test-pmd/testpmd.c
+++ b/app/test-pmd/testpmd.c
@@ -4445,8 +4445,9 @@ init_port_dcb_config(portid_t pid,
 				nb_rxq = rte_port->dev_info.max_rx_queues;
 				nb_txq = rte_port->dev_info.max_tx_queues;
 			} else {
-				nb_rxq = (queueid_t)num_tcs;
-				nb_txq = (queueid_t)num_tcs;
+				/* Use device queue counts to prevent null pointer errors. */
+				nb_rxq = (queueid_t)rte_port->dev_info.nb_rx_queues;
+				nb_txq = (queueid_t)rte_port->dev_info.nb_tx_queues;
 			}
 		}
 	}
-- 
2.43.0

Re: [PATCH v2] app/testpmd: fix DCB queue allocation for VMDq devices

[Stephen Hemminger]

On Mon, 16 Mar 2026 05:52:55 +0000
KAVYA AV <kavyax.a.v@intel.com> wrote:

> When using DCB mode with VT disabled and requesting more queues than
> traffic classes (e.g., rxq=64 with 8 TCs), testpmd crashes with null
> pointer errors because it artificially limits queue allocation to
> num_tcs.
> 
> For VMDq devices, use device-specific queue count (nb_rx_queues/
> nb_tx_queues) instead of limiting to num_tcs. This allows VMDq devices
> to utilize their full queue capacity while maintaining compatibility
> with non VMDq devices.
> 
> Fixes null pointer dereference when queue structures are accessed
> beyond the allocated range.
> 
> Fixes: 2169699b15fc ("app/testpmd: add queue restriction in DCB command")
> Cc: stable@dpdk.org
> 
> Signed-off-by: KAVYA AV <kavyax.a.v@intel.com>
> ---

It makes sense to do this but AI review raised a number of issues:


Error: Wrong field — nb_rx_queues reflects the previous configure, not the device's DCB queue capacity

The patch changes the vmdq_pool_base > 0 path from num_tcs to dev_info.nb_rx_queues / dev_info.nb_tx_queues. However, dev_info.nb_rx_queues is the configured queue count from the rte_eth_dev_configure() call that happened earlier in this same function (line 4413: rte_eth_dev_configure(pid, nb_rxq, nb_rxq, &port_conf)). So dev_info.nb_rx_queues just reflects whatever nb_rxq was before entering this block — it is not the device's inherent DCB queue capacity.

If nb_rxq was previously set to 64 by the user (rxq=64), then after configure dev_info.nb_rx_queues will be 64, and this code sets nb_rxq = 64 — which is circular. It does avoid the crash from using num_tcs (which could be too small), but it doesn't set the queue count to a value derived from the device's VMDq/DCB capability. Compare with the DCB_VT_ENABLED branch just above, which uses dev_info.nb_rx_queues only when max_vfs > 0 because the VF driver legitimately constrains nb_rx_queues during configure.

For the VT_DISABLED + vmdq_pool_base > 0 case, the intent is to limit queues to those available to the PF (since VMDq pools consume some). The original num_tcs was an approximation; nb_rx_queues is another approximation that happens to be the user's requested count echoed back. Consider whether the correct value should be derived from vmdq_queue_base or vmdq_queue_num fields instead, which describe the actual PF/VMDq queue layout.

Warning: Comment is misleading

The added comment says "Use device queue counts to prevent null pointer errors" but dev_info.nb_rx_queues is the configured count, not a device-intrinsic limit. The comment should describe why this value is appropriate for the VMDq-with-pool-base case.

[PATCH v3] app/testpmd: fix DCB queue allocation for VMDq devices

[KAVYA AV]

When using DCB mode with VT disabled and requesting more queues than
traffic classes (e.g., rxq=64 with 8 TCs), testpmd crashes with null
pointer errors because it artificially limits queue allocation to
num_tcs.

For VMDq devices, use actual VMDq queue layout (vmdq_queue_num) instead
of limiting to num_tcs. This allows VMDq devices to utilize their full
queue capacity while maintaining compatibility with non-VMDq devices.

Fixes null pointer dereference when queue structures are accessed
beyond the allocated range.

Fixes: 2169699b15fc ("app/testpmd: add queue restriction in DCB command")
Cc: stable@dpdk.org

Signed-off-by: KAVYA AV <kavyax.a.v@intel.com>
---

v3:
* Replaced configured queue count with actual VMDQ queue layout.
* Changed comment accordingly.
* Revised commit message.

v2: Moved the comment inside the else block.
---
 app/test-pmd/testpmd.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/app/test-pmd/testpmd.c b/app/test-pmd/testpmd.c
index aad880aa34..abe40a3428 100644
--- a/app/test-pmd/testpmd.c
+++ b/app/test-pmd/testpmd.c
@@ -4448,8 +4448,11 @@ init_port_dcb_config(portid_t pid,
 				nb_rxq = rte_port->dev_info.max_rx_queues;
 				nb_txq = rte_port->dev_info.max_tx_queues;
 			} else {
-				nb_rxq = (queueid_t)num_tcs;
-				nb_txq = (queueid_t)num_tcs;
+				/* if vt disabled and vmdq_pool_base greater than 0,
+				 * use vmdq queue layout
+				 */
+				nb_rxq = rte_port->dev_info.vmdq_queue_num;
+				nb_txq = rte_port->dev_info.vmdq_queue_num;
 			}
 		}
 	}
-- 
2.43.0

Re: [PATCH v3] app/testpmd: fix DCB queue allocation for VMDq devices

[Stephen Hemminger]

On Tue, 24 Mar 2026 10:05:00 +0000
KAVYA AV <kavyax.a.v@intel.com> wrote:

> When using DCB mode with VT disabled and requesting more queues than
> traffic classes (e.g., rxq=64 with 8 TCs), testpmd crashes with null
> pointer errors because it artificially limits queue allocation to
> num_tcs.
> 
> For VMDq devices, use actual VMDq queue layout (vmdq_queue_num) instead
> of limiting to num_tcs. This allows VMDq devices to utilize their full
> queue capacity while maintaining compatibility with non-VMDq devices.
> 
> Fixes null pointer dereference when queue structures are accessed
> beyond the allocated range.
> 
> Fixes: 2169699b15fc ("app/testpmd: add queue restriction in DCB command")
> Cc: stable@dpdk.org
> 
> Signed-off-by: KAVYA AV <kavyax.a.v@intel.com>
> ---

I can't follow all the stuff here, is rather complex and esoteric case.
So did AI review.

The feedback from AI raised some questions (the I here is AI not me):


The basic idea of using dynamic VMDq queue info instead of limiting
to num_tcs is right -- the current code clearly crashes when more
queues are requested than traffic classes.

However, I'm not convinced vmdq_queue_num is the correct value here.
This code path is DCB-only (VT disabled) on a device with
vmdq_pool_base > 0, which in practice means i40e. In that case
vmdq_queue_num is the total VMDq pool queue count
(vmdq_nb_qps * max_nb_vmdq_vsi), but with VT disabled the PF queues
are what's used for DCB, not the VMDq pool queues. The PF queue count
would be max_rx_queues - vmdq_queue_num. Using the VMDq count here
could over-allocate or misconfigure queues in DCB-only mode.

Can you explain why vmdq_queue_num is the right value rather than
the PF queue count? Or test what happens when this value exceeds
what the hardware supports in DCB-only mode?

Minor: the prose line "Fixes null pointer dereference when queue
structures are accessed beyond the allocated range." reads as a
sentence fragment. Fold it into the preceding paragraph or drop it
since the Fixes tag already identifies what's being fixed.

RE: [PATCH v3] app/testpmd: fix DCB queue allocation for VMDq devices

[A V, KavyaX]

-----Original Message-----
From: Stephen Hemminger <stephen@networkplumber.org> 
Sent: Tuesday, March 24, 2026 9:17 PM
To: A V, KavyaX <kavyax.a.v@intel.com>
Cc: dev@dpdk.org; Richardson, Bruce <bruce.richardson@intel.com>; Singh, Aman Deep <aman.deep.singh@intel.com>; Medvedkin, Vladimir <vladimir.medvedkin@intel.com>; Wani, Shaiq <shaiq.wani@intel.com>; stable@dpdk.org
Subject: Re: [PATCH v3] app/testpmd: fix DCB queue allocation for VMDq devices

On Tue, 24 Mar 2026 10:05:00 +0000
KAVYA AV <kavyax.a.v@intel.com> wrote:

> When using DCB mode with VT disabled and requesting more queues than 
> traffic classes (e.g., rxq=64 with 8 TCs), testpmd crashes with null 
> pointer errors because it artificially limits queue allocation to 
> num_tcs.
> 
> For VMDq devices, use actual VMDq queue layout (vmdq_queue_num) 
> instead of limiting to num_tcs. This allows VMDq devices to utilize 
> their full queue capacity while maintaining compatibility with non-VMDq devices.
> 
> Fixes null pointer dereference when queue structures are accessed 
> beyond the allocated range.
> 
> Fixes: 2169699b15fc ("app/testpmd: add queue restriction in DCB 
> command")
> Cc: stable@dpdk.org
> 
> Signed-off-by: KAVYA AV <kavyax.a.v@intel.com>
> ---

I can't follow all the stuff here, is rather complex and esoteric case.
So did AI review.

The feedback from AI raised some questions (the I here is AI not me):


The basic idea of using dynamic VMDq queue info instead of limiting to num_tcs is right -- the current code clearly crashes when more queues are requested than traffic classes.

However, I'm not convinced vmdq_queue_num is the correct value here.
This code path is DCB-only (VT disabled) on a device with vmdq_pool_base > 0, which in practice means i40e. In that case vmdq_queue_num is the total VMDq pool queue count (vmdq_nb_qps * max_nb_vmdq_vsi), but with VT disabled the PF queues are what's used for DCB, not the VMDq pool queues. The PF queue count would be max_rx_queues - vmdq_queue_num. Using the VMDq count here could over-allocate or misconfigure queues in DCB-only mode.

Can you explain why vmdq_queue_num is the right value rather than the PF queue count? Or test what happens when this value exceeds what the hardware supports in DCB-only mode?

After testing with values beyond the hardware-supported limits, I found that the application could still configure up to max_rx_queues (320 for i40e) without any errors or crashes. The fwd_stream allocation and queue configuration also completed successfully.
Current number of RX queues: 320
Max possible RX queues: 320
nb_ports= 1
max_q= 320
Created 320 fwd_stream(s)
Although show port dcb_tc 0 indicates a limit of 8 queues per TC, the I40E_MAX_Q_PER_TC constant is 64.
testpmd> show port dcb_tc 0
  ================ DCB infos for port 0   ================
  TC NUMBER: 8

  TC :             0       1       2       3       4       5       6       7
  Prio2TC :        0       1       2       3       4       5       6       7
  BW percent :    13%     13%     13%     13%     12%     12%     12%     12%
  RXQ base :       0       8      16      24      32      40      48      56
  RXQ number :     8       8       8       8       8       8       8       8
  TXQ base :       0       8      16      24      32      40      48      56
  TXQ number :     8       8       8       8       8       8       8       8

As suggested, switched from the vmdq_queue_number-based layout to the PF-based layout, and testing showed that the scenario works correctly without errors.
 /* Use PF queue count for DCB-only mode with VMDQ devices */  
  nb_rxq = rte_port->dev_info.max_rx_queues - rte_port->dev_info.vmdq_queue_num;  
  nb_txq = rte_port->dev_info.max_tx_queues - rte_port->dev_info.vmdq_queue_num;
Please confirm whether it is appropriate to proceed with this fix.

Minor: the prose line "Fixes null pointer dereference when queue structures are accessed beyond the allocated range." reads as a sentence fragment. Fold it into the preceding paragraph or drop it since the Fixes tag already identifies what's being fixed.

[PATCH v4] app/testpmd: fix DCB queue allocation for VMDq devices

[KAVYA AV]

When using DCB mode with VT disabled and requesting more queues than
traffic classes (e.g., rxq=64 with 8 TCs), testpmd crashes with null
pointer errors because it artificially limits queue allocation to
num_tcs.

For VMDq devices, use actual VMDq queue layout (vmdq_queue_num) instead
of limiting to num_tcs. This allows VMDq devices to utilize their full
queue capacity while maintaining compatibility with non-VMDq devices.

Fixes: 2169699b15fc ("app/testpmd: add queue restriction in DCB command")
Cc: stable@dpdk.org

Signed-off-by: KAVYA AV <kavyax.a.v@intel.com>
---

v4:
* Replaced configured queue count with PF-based layout.
* Revised commit message.

v3:
* Replaced configured queue count with actual VMDQ queue layout.
* Changed comment accordingly.
* Revised commit message.

v2: Moved the comment inside the else block.
---
 app/test-pmd/testpmd.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/app/test-pmd/testpmd.c b/app/test-pmd/testpmd.c
index e2569d9e30..23a27322f8 100644
--- a/app/test-pmd/testpmd.c
+++ b/app/test-pmd/testpmd.c
@@ -4481,8 +4481,11 @@ init_port_dcb_config(portid_t pid,
 				nb_rxq = rte_port->dev_info.max_rx_queues;
 				nb_txq = rte_port->dev_info.max_tx_queues;
 			} else {
-				nb_rxq = (queueid_t)num_tcs;
-				nb_txq = (queueid_t)num_tcs;
+				/* Use PF queue count for DCB-only mode with VMDQ devices */
+				nb_rxq = rte_port->dev_info.max_rx_queues -
+					 rte_port->dev_info.vmdq_queue_num;
+				nb_txq = rte_port->dev_info.max_tx_queues -
+					 rte_port->dev_info.vmdq_queue_num;
 			}
 		}
 	}
-- 
2.43.0