From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 08194CCF2D6 for ; Mon, 19 Oct 2026 11:16:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: Content-Type:Message-ID:References:In-Reply-To:Subject:Cc:To:From:Date: MIME-Version:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=/XjINHqIBzneqFkY4u1ge+eJSkp77hxmWQgeY7LjLvk=; b=2wJtHwH7dohsvmKbFnGjY0Rt/J O850bQN1J3gKAHmZzSzAcSazBqpD36MLkGA8ZmZk58MI8JCGZzOGNT/Y2hbh7uSkSrI9pCPZNJnKI d69F45umxKNQX0VQ82rrcdwBSlrvqn1aQLb1fb4xwRM+5HiwvnyXYoQ+xGk6vNbtY5Yn86Xs/QYrk JGu151HbkCST1z5703ZKRBX7jq3qcn1RnOTNDkRFoxmPT9ZCVpWNQfl3gMp6cqbRg6BBwbXS/8ari jgYe/sWfPf3FwJXwq50YlT3QYPN8MH7m/O2DfAXgWnL4k2NTeZ+u5jQrNML8Od5DCgtHsbKrDsOWH dDgJZjUQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1xIlM7-00000007GmT-0y0Z; Mon, 19 Oct 2026 11:16:39 +0000 Received: from mail.tipi-net.de ([2a03:4000:43:185::1]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1xIlM3-00000007Glu-3dqk for linux-arm-kernel@lists.infradead.org; Mon, 19 Oct 2026 11:16:37 +0000 Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 8B4E2A156C; Mon, 19 Oct 2026 13:16:30 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tipi-net.de; s=dkim; t=1792408593; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=/XjINHqIBzneqFkY4u1ge+eJSkp77hxmWQgeY7LjLvk=; b=W61oJF60IVzoEfj4TjI2sf7h4bhSvysGjad19NTTcOghjn0ruiY7Y7IeCNuPUciH0KwlhM jWVQ/W5+ZNCq1zP6LDZF0vR7jG0uA9D5vYrpLgLbBED+iFJRChlQhOoHe4EhtvbhrrQVCK kou/iprWa4Sq0jXtgrZ7l7H8fEb33DfR178ghbU4NUwTsYnKj3sVojGCPDju7ZY0uemy6P ZrwjJuwLMa+qD4MF48A/9W+sZpeZwqNHnqxfI3Nfhlnm7ELqJMwReEJvfXTY7vnHRPNue2 mw/6IJjO8IGuHxEELvqdVNQ/Or04voQG3jCCktUxYrFbz0g43xDdH2i1yPyUrA== MIME-Version: 1.0 Date: Mon, 19 Oct 2026 13:16:30 +0200 From: Nicolai Buchwitz To: Lorenzo Bianconi Cc: Maxime Chevallier , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Maxime Coquelin , Alexandre Torgue , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Jose Abreu , Ong Boon Leong , netdev@vger.kernel.org, linux-arm-kernel@lists.infradead.org, bpf@vger.kernel.org Subject: Re: [PATCH net-next v8 2/5] net: stmmac: drop split frames on AF_XDP zero-copy RX In-Reply-To: <20261018-stmmac-rx-mb-v8-2-5f58c0b25849@oss.qualcomm.com> References: <20261018-stmmac-rx-mb-v8-0-5f58c0b25849@oss.qualcomm.com> <20261018-stmmac-rx-mb-v8-2-5f58c0b25849@oss.qualcomm.com> Message-ID: <8c9e47e535ecc8190fa1c93ad5b5e32a@tipi-net.de> X-Sender: nb@tipi-net.de Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit X-Last-TLS-Session-Version: TLSv1.3 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20261019_041636_463387_DACA5C1C X-CRM114-Status: GOOD ( 26.17 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Lorenzo On 18.10.2026 19:07, Lorenzo Bianconi wrote: > stmmac_rx_zc() assumes a 1:1 mapping between a received frame and an > XSK pool buffer and drops any frame that spans more than one RX > descriptor: > > /* XSK pool expects RX frame 1:1 mapped to XSK buffer */ > if (likely(status & rx_not_ls)) { > xsk_buff_free(buf->xdp); > buf->xdp = NULL; > dirty++; > count++; > goto read_again; > } > > The non-last descriptors are freed and dropped, but the frame is not > marked as errored. When the poll reaches the last descriptor of the > same frame, error is still 0, so the fragment is handled as a complete > frame: it is passed to the XDP program, copied into an skb on XDP_PASS, > or converted for XDP_TX. The tail starts in the middle of the original > payload at a predictable offset and, parsed as a fresh frame (len == > 0), > stmmac_rx_buf1_len() reports the full dma_buf_sz length for it even > though the DMA engine only wrote the tail remainder into that buffer, > so > the reads extend past the received bytes and can reach beyond the end > of > the XSK pool buffer. GMAC4 always enables jumbo frames (GMAC_CONFIG_JE > in GMAC_CORE_INIT), so an on-link peer can trigger such a split even > when the interface MTU is left at 1500. > > Set error when the 1:1 mapping check drops a descriptor, so the > remaining descriptors of the frame - including the last one - are > drained and released with xsk_buff_free() instead of being processed as > a new frame. Account every freed buffer with dirty and count the > dropped frame once in the poll budget / rx_pkt_n. The direct 1:1 > mapping drop also increments rx_dropped. > > Normalize the legacy normal and enhanced descriptor callbacks to report > rx_not_ls together with discard_frame for non-last descriptors. This > allows both stmmac_rx_zc() and stmmac_rx() to drain split frames on > dwmac100 and dwmac1000 instead of reparsing the final fragment as a new > packet. > > Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy") > Reviewed-by: Nicolai Buchwitz This grew quite a bit since v6 (legacy desc changes, stmmac_rx() etc), so my R-b should have been dropped. I had another look and two small notes below. > Signed-off-by: Lorenzo Bianconi > --- > [...] > --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c > +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c > @@ -5695,18 +5695,21 @@ static int stmmac_rx_zc(struct stmmac_priv > *priv, int limit, u32 queue) > if (priv->extend_desc) > stmmac_rx_extended_status(priv, &priv->xstats, > rx_q->dma_erx + entry); > - if (unlikely(status == discard_frame)) { > - xsk_buff_free(buf->xdp); > - buf->xdp = NULL; > - dirty++; > + > + if (unlikely(status & discard_frame)) { > error = 1; > if (!priv->hwts_rx_en) > rx_errors++; > } There's no !error check here, so on the legacy descriptors a split frame now counts once per descriptor in rx_errors. stmmac_rx() in 3/5 counts it once. Could you add the !error check here too? > [...] > @@ -5883,7 +5887,8 @@ static int stmmac_rx(struct stmmac_priv *priv, > int limit, u32 queue) > > if (priv->extend_desc) > stmmac_rx_extended_status(priv, &priv->xstats, rx_q->dma_erx + > entry); > - if (unlikely(status == discard_frame)) { > + > + if (unlikely(status & discard_frame)) { AFAIU this also changes GMAC4: a frame with an error plus an IP header error returns discard_frame | csum_none, which the old "==" let through. Dropping it is right, but maybe worth a line in the commit message? > [...] With the !error check added: Reviewed-by: Nicolai Buchwitz Thanks, Nicolai