[PATCH 1/2] net/e1000: fix igc RSS redirection table

[PATCH 1/2] net/e1000: fix igc RSS redirection table

[Shuzo Ichiyoshi]

The IGC RETA register stores four 8-bit queue indexes.
igc_rss_configure() and igc_add_rss_filter() used a fresh
uninitialized union for each table entry and wrote the register only
every fourth entry. As a result, three bytes of each RETA register
came from stack garbage.

Build the register a word at a time and initialize all four queue
indexes before writing it.

Fixes: a5aeb2b9e225 ("net/igc: support Rx and Tx")
Fixes: 746664d546fb ("net/igc: support flow API")
Cc: stable@dpdk.org
Signed-off-by: Shuzo Ichiyoshi <deadcafe.beef@gmail.com>
---
 drivers/net/intel/e1000/igc_txrx.c | 49 ++++++++++++++++--------------
 1 file changed, 26 insertions(+), 23 deletions(-)

diff --git a/drivers/net/intel/e1000/igc_txrx.c b/drivers/net/intel/e1000/igc_txrx.c
index c13460f381..1ab8f2079d 100644
--- a/drivers/net/intel/e1000/igc_txrx.c
+++ b/drivers/net/intel/e1000/igc_txrx.c
@@ -828,17 +828,20 @@ igc_rss_configure(struct rte_eth_dev *dev)
 	uint16_t i;
 
 	/* Fill in redirection table. */
-	for (i = 0; i < IGC_RSS_RDT_SIZD; i++) {
-		union igc_rss_reta_reg reta;
-		uint16_t q_idx, reta_idx;
-
-		q_idx = (uint8_t)((dev->data->nb_rx_queues > 1) ?
-				   i % dev->data->nb_rx_queues : 0);
-		reta_idx = i % sizeof(reta);
-		reta.bytes[reta_idx] = q_idx;
-		if (reta_idx == sizeof(reta) - 1)
-			E1000_WRITE_REG_LE_VALUE(hw,
-				E1000_RETA(i / sizeof(reta)), reta.dword);
+	for (i = 0; i < IGC_RSS_RDT_SIZD; i += IGC_RSS_RDT_REG_SIZE) {
+		union igc_rss_reta_reg reta = { .dword = 0 };
+		uint16_t reta_idx;
+
+		RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE);
+		for (reta_idx = 0; reta_idx < IGC_RSS_RDT_REG_SIZE; reta_idx++) {
+			uint16_t q_idx;
+
+			q_idx = (uint8_t)((dev->data->nb_rx_queues > 1) ?
+				(i + reta_idx) % dev->data->nb_rx_queues : 0);
+			reta.bytes[reta_idx] = q_idx;
+		}
+		E1000_WRITE_REG_LE_VALUE(hw,
+			E1000_RETA(i / IGC_RSS_RDT_REG_SIZE), reta.dword);
 	}
 
 	/*
@@ -944,18 +947,18 @@ igc_add_rss_filter(struct rte_eth_dev *dev, struct igc_rss_filter *rss)
 	igc_rss_conf_set(rss_filter, &rss->conf);
 
 	/* Fill in redirection table. */
-	for (i = 0, j = 0; i < IGC_RSS_RDT_SIZD; i++, j++) {
-		union igc_rss_reta_reg reta;
-		uint16_t q_idx, reta_idx;
-
-		if (j == rss->conf.queue_num)
-			j = 0;
-		q_idx = rss->conf.queue[j];
-		reta_idx = i % sizeof(reta);
-		reta.bytes[reta_idx] = q_idx;
-		if (reta_idx == sizeof(reta) - 1)
-			E1000_WRITE_REG_LE_VALUE(hw,
-				E1000_RETA(i / sizeof(reta)), reta.dword);
+	for (i = 0, j = 0; i < IGC_RSS_RDT_SIZD; i += IGC_RSS_RDT_REG_SIZE) {
+		union igc_rss_reta_reg reta = { .dword = 0 };
+		uint16_t reta_idx;
+
+		RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE);
+		for (reta_idx = 0; reta_idx < IGC_RSS_RDT_REG_SIZE; reta_idx++, j++) {
+			if (j == rss->conf.queue_num)
+				j = 0;
+			reta.bytes[reta_idx] = rss->conf.queue[j];
+		}
+		E1000_WRITE_REG_LE_VALUE(hw,
+			E1000_RETA(i / IGC_RSS_RDT_REG_SIZE), reta.dword);
 	}
 
 	if (rss_conf.rss_key == NULL)
-- 
2.43.0

[PATCH 2/2] net/e1000: fix igc Tx descriptor ring wrap

[Shuzo Ichiyoshi]

igc_xmit_pkts() reserves two extra descriptors for launch time.
It indexed sw_ring[tx_last + 2] without wrapping the descriptor
index first.

If tx_last is one of the last two descriptors in the ring, this
reads past the software ring. Wrap the index before looking up
last_id.

Fixes: 2e79349dcd07 ("net/e1000: fix igc launch time calculation")
Cc: stable@dpdk.org
Signed-off-by: Shuzo Ichiyoshi <deadcafe.beef@gmail.com>
---
 drivers/net/intel/e1000/igc_txrx.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/intel/e1000/igc_txrx.c b/drivers/net/intel/e1000/igc_txrx.c
index 1ab8f2079d..d61fdb33a8 100644
--- a/drivers/net/intel/e1000/igc_txrx.c
+++ b/drivers/net/intel/e1000/igc_txrx.c
@@ -1834,7 +1834,11 @@ igc_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
 		 * The "last descriptor" of the previously sent packet, if any,
 		 * which used the last descriptor to allocate.
 		 */
-		tx_end = sw_ring[tx_last + 2].last_id;
+		tx_end = (uint16_t)(tx_last + 2);
+		if (tx_end >= txq->nb_tx_desc)
+			tx_end = (uint16_t)(tx_end - txq->nb_tx_desc);
+
+		tx_end = sw_ring[tx_end].last_id;
 
 		/*
 		 * The next descriptor following that "last descriptor" in the
-- 
2.43.0

RE: [PATCH 2/2] net/e1000: fix igc Tx descriptor ring wrap

[Song, Yoong Siang]

On Monday, June 29, 2026 12:51 PM, Shuzo Ichiyoshi <deadcafe.beef@gmail.com> wrote:
>igc_xmit_pkts() reserves two extra descriptors for launch time.
>It indexed sw_ring[tx_last + 2] without wrapping the descriptor
>index first.
>
>If tx_last is one of the last two descriptors in the ring, this
>reads past the software ring. Wrap the index before looking up
>last_id.
>
>Fixes: 2e79349dcd07 ("net/e1000: fix igc launch time calculation")
>Cc: stable@dpdk.org
>Signed-off-by: Shuzo Ichiyoshi <deadcafe.beef@gmail.com>

Reviewed-by: Song Yoong Siang <yoong.siang.song@intel.com>

Thanks for the fix.

>---
> drivers/net/intel/e1000/igc_txrx.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
>diff --git a/drivers/net/intel/e1000/igc_txrx.c
>b/drivers/net/intel/e1000/igc_txrx.c
>index 1ab8f2079d..d61fdb33a8 100644
>--- a/drivers/net/intel/e1000/igc_txrx.c
>+++ b/drivers/net/intel/e1000/igc_txrx.c
>@@ -1834,7 +1834,11 @@ igc_xmit_pkts(void *tx_queue, struct rte_mbuf
>**tx_pkts, uint16_t nb_pkts)
> 		 * The "last descriptor" of the previously sent packet, if any,
> 		 * which used the last descriptor to allocate.
> 		 */
>-		tx_end = sw_ring[tx_last + 2].last_id;
>+		tx_end = (uint16_t)(tx_last + 2);
>+		if (tx_end >= txq->nb_tx_desc)
>+			tx_end = (uint16_t)(tx_end - txq->nb_tx_desc);
>+
>+		tx_end = sw_ring[tx_end].last_id;
>
> 		/*
> 		 * The next descriptor following that "last descriptor" in the
>--
>2.43.0

Re: [PATCH 1/2] net/e1000: fix igc RSS redirection table

[Bruce Richardson]

On Mon, Jun 29, 2026 at 01:51:13PM +0900, Shuzo Ichiyoshi wrote:
> The IGC RETA register stores four 8-bit queue indexes.
> igc_rss_configure() and igc_add_rss_filter() used a fresh
> uninitialized union for each table entry and wrote the register only
> every fourth entry. As a result, three bytes of each RETA register
> came from stack garbage.
> 
> Build the register a word at a time and initialize all four queue
> indexes before writing it.
> 
> Fixes: a5aeb2b9e225 ("net/igc: support Rx and Tx")
> Fixes: 746664d546fb ("net/igc: support flow API")
> Cc: stable@dpdk.org
> Signed-off-by: Shuzo Ichiyoshi <deadcafe.beef@gmail.com>

Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Re: [PATCH 2/2] net/e1000: fix igc Tx descriptor ring wrap

[Bruce Richardson]

On Mon, Jun 29, 2026 at 06:59:37AM +0100, Song, Yoong Siang wrote:
> On Monday, June 29, 2026 12:51 PM, Shuzo Ichiyoshi <deadcafe.beef@gmail.com> wrote:
> >igc_xmit_pkts() reserves two extra descriptors for launch time.
> >It indexed sw_ring[tx_last + 2] without wrapping the descriptor
> >index first.
> >
> >If tx_last is one of the last two descriptors in the ring, this
> >reads past the software ring. Wrap the index before looking up
> >last_id.
> >
> >Fixes: 2e79349dcd07 ("net/e1000: fix igc launch time calculation")
> >Cc: stable@dpdk.org
> >Signed-off-by: Shuzo Ichiyoshi <deadcafe.beef@gmail.com>
> 
> Reviewed-by: Song Yoong Siang <yoong.siang.song@intel.com>
> 
> Thanks for the fix.
> 
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Re: [PATCH 1/2] net/e1000: fix igc RSS redirection table

[Bruce Richardson]

On Mon, Jun 29, 2026 at 04:21:26PM +0100, Bruce Richardson wrote:
> On Mon, Jun 29, 2026 at 01:51:13PM +0900, Shuzo Ichiyoshi wrote:
> > The IGC RETA register stores four 8-bit queue indexes.
> > igc_rss_configure() and igc_add_rss_filter() used a fresh
> > uninitialized union for each table entry and wrote the register only
> > every fourth entry. As a result, three bytes of each RETA register
> > came from stack garbage.
> > 
> > Build the register a word at a time and initialize all four queue
> > indexes before writing it.
> > 
> > Fixes: a5aeb2b9e225 ("net/igc: support Rx and Tx")
> > Fixes: 746664d546fb ("net/igc: support flow API")
> > Cc: stable@dpdk.org
> > Signed-off-by: Shuzo Ichiyoshi <deadcafe.beef@gmail.com>
> 
> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
> 
Series applied to dpdk-next-net-intel.
Thanks,
/Bruce