[PATCH net 0/3] mlx5 misc fixes 2025-07-10

[PATCH net 0/3] mlx5 misc fixes 2025-07-10

[Tariq Toukan]

Hi,

This small patchset provides misc bug fixes from the team to the mlx5
core and EN drivers.

Thanks,
Tariq.


Carolina Jubran (2):
  net/mlx5: Reset bw_share field when changing a node's parent
  net/mlx5e: Fix race between DIM disable and net_dim()

Jianbo Liu (1):
  net/mlx5e: Add new prio for promiscuous mode

 drivers/net/ethernet/mellanox/mlx5/core/en/fs.h   |  9 +++++++--
 drivers/net/ethernet/mellanox/mlx5/core/en_dim.c  |  4 ++--
 drivers/net/ethernet/mellanox/mlx5/core/en_fs.c   |  2 +-
 drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c |  1 +
 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 13 +++++++++----
 5 files changed, 20 insertions(+), 9 deletions(-)


base-commit: 0fda5ccf5425c7b92eaca868a3fba8a3c9f8b746
-- 
2.31.1

[PATCH net 1/3] net/mlx5: Reset bw_share field when changing a node's parent

[Tariq Toukan]

From: Carolina Jubran <cjubran@nvidia.com>

When changing a node's parent, its scheduling element is destroyed and
re-created with bw_share 0. However, the node's bw_share field was not
updated accordingly.

Set the node's bw_share to 0 after re-creation to keep the software
state in sync with the firmware configuration.

Fixes: 9c7bbf4c3304 ("net/mlx5: Add support for setting parent of nodes")
Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c
index b6ae384396b3..ad9f6fca9b6a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c
@@ -1076,6 +1076,7 @@ static int esw_qos_vports_node_update_parent(struct mlx5_esw_sched_node *node,
 		return err;
 	}
 	esw_qos_node_set_parent(node, parent);
+	node->bw_share = 0;
 
 	return 0;
 }
-- 
2.31.1

[PATCH net 2/3] net/mlx5e: Fix race between DIM disable and net_dim()

[Tariq Toukan]

From: Carolina Jubran <cjubran@nvidia.com>

There's a race between disabling DIM and NAPI callbacks using the dim
pointer on the RQ or SQ.

If NAPI checks the DIM state bit and sees it still set, it assumes
`rq->dim` or `sq->dim` is valid. But if DIM gets disabled right after
that check, the pointer might already be set to NULL, leading to a NULL
pointer dereference in net_dim().

Fix this by calling `synchronize_net()` before freeing the DIM context.
This ensures all in-progress NAPI callbacks are finished before the
pointer is cleared.

Kernel log:

BUG: kernel NULL pointer dereference, address: 0000000000000000
...
RIP: 0010:net_dim+0x23/0x190
...
Call Trace:
 <TASK>
 ? __die+0x20/0x60
 ? page_fault_oops+0x150/0x3e0
 ? common_interrupt+0xf/0xa0
 ? sysvec_call_function_single+0xb/0x90
 ? exc_page_fault+0x74/0x130
 ? asm_exc_page_fault+0x22/0x30
 ? net_dim+0x23/0x190
 ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core]
 ? sysvec_apic_timer_interrupt+0xb/0x90
 mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core]
 mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core]
 ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core]
 busy_poll_stop+0xa2/0x200
 ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core]
 ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core]
 __napi_busy_loop+0x345/0x3b0
 ? sysvec_call_function_single+0xb/0x90
 ? asm_sysvec_call_function_single+0x16/0x20
 ? sysvec_apic_timer_interrupt+0xb/0x90
 ? pcpu_free_area+0x1e4/0x2e0
 napi_busy_loop+0x11/0x20
 xsk_recvmsg+0x10c/0x130
 sock_recvmsg+0x44/0x70
 __sys_recvfrom+0xbc/0x130
 ? __schedule+0x398/0x890
 __x64_sys_recvfrom+0x20/0x30
 do_syscall_64+0x4c/0x100
 entry_SYSCALL_64_after_hwframe+0x4b/0x53
...
---[ end trace 0000000000000000 ]---
...
---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

Fixes: 445a25f6e1a2 ("net/mlx5e: Support updating coalescing configuration without resetting channels")
Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_dim.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c
index 298bb74ec5e9..d1d629697e28 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c
@@ -113,7 +113,7 @@ int mlx5e_dim_rx_change(struct mlx5e_rq *rq, bool enable)
 		__set_bit(MLX5E_RQ_STATE_DIM, &rq->state);
 	} else {
 		__clear_bit(MLX5E_RQ_STATE_DIM, &rq->state);
-
+		synchronize_net();
 		mlx5e_dim_disable(rq->dim);
 		rq->dim = NULL;
 	}
@@ -140,7 +140,7 @@ int mlx5e_dim_tx_change(struct mlx5e_txqsq *sq, bool enable)
 		__set_bit(MLX5E_SQ_STATE_DIM, &sq->state);
 	} else {
 		__clear_bit(MLX5E_SQ_STATE_DIM, &sq->state);
-
+		synchronize_net();
 		mlx5e_dim_disable(sq->dim);
 		sq->dim = NULL;
 	}
-- 
2.31.1

[PATCH net 3/3] net/mlx5e: Add new prio for promiscuous mode

[Tariq Toukan]

From: Jianbo Liu <jianbol@nvidia.com>

An optimization for promiscuous mode adds a high-priority steering
table with a single catch-all rule to steer all traffic directly to
the TTC table.

However, a gap exists between the creation of this table and the
insertion of the catch-all rule. Packets arriving in this brief window
would miss as no rule was inserted yet, unnecessarily incrementing the
'rx_steer_missed_packets' counter and dropped.

This patch resolves the issue by introducing a new prio for this
table, placing it between MLX5E_TC_PRIO and MLX5E_NIC_PRIO. By doing
so, packets arriving during the window now fall through to the next
prio (at MLX5E_NIC_PRIO) instead of being dropped.

Fixes: 1c46d7409f30 ("net/mlx5e: Optimize promiscuous mode")
Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/en/fs.h   |  9 +++++++--
 drivers/net/ethernet/mellanox/mlx5/core/en_fs.c   |  2 +-
 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 13 +++++++++----
 3 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
index b5c3a2a9d2a5..9560fcba643f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
@@ -18,7 +18,8 @@ enum {
 
 enum {
 	MLX5E_TC_PRIO = 0,
-	MLX5E_NIC_PRIO
+	MLX5E_PROMISC_PRIO,
+	MLX5E_NIC_PRIO,
 };
 
 struct mlx5e_flow_table {
@@ -68,9 +69,13 @@ struct mlx5e_l2_table {
 				 MLX5_HASH_FIELD_SEL_DST_IP   |\
 				 MLX5_HASH_FIELD_SEL_IPSEC_SPI)
 
-/* NIC prio FTS */
+/* NIC promisc FT level */
 enum {
 	MLX5E_PROMISC_FT_LEVEL,
+};
+
+/* NIC prio FTS */
+enum {
 	MLX5E_VLAN_FT_LEVEL,
 	MLX5E_L2_FT_LEVEL,
 	MLX5E_TTC_FT_LEVEL,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index 04a969128161..265c4ca85f7d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -780,7 +780,7 @@ static int mlx5e_create_promisc_table(struct mlx5e_flow_steering *fs)
 	ft_attr.max_fte = MLX5E_PROMISC_TABLE_SIZE;
 	ft_attr.autogroup.max_num_groups = 1;
 	ft_attr.level = MLX5E_PROMISC_FT_LEVEL;
-	ft_attr.prio = MLX5E_NIC_PRIO;
+	ft_attr.prio = MLX5E_PROMISC_PRIO;
 
 	ft->t = mlx5_create_auto_grouped_flow_table(fs->ns, &ft_attr);
 	if (IS_ERR(ft->t)) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index a8046200d376..3dd9a6f40709 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -113,13 +113,16 @@
 #define ETHTOOL_PRIO_NUM_LEVELS 1
 #define ETHTOOL_NUM_PRIOS 11
 #define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS)
-/* Promiscuous, Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy,
+/* Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy,
  * {IPsec RoCE MPV,Alias table},IPsec RoCE policy
  */
-#define KERNEL_NIC_PRIO_NUM_LEVELS 11
+#define KERNEL_NIC_PRIO_NUM_LEVELS 10
 #define KERNEL_NIC_NUM_PRIOS 1
-/* One more level for tc */
-#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 1)
+/* One more level for tc, and one more for promisc */
+#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 2)
+
+#define KERNEL_NIC_PROMISC_NUM_PRIOS 1
+#define KERNEL_NIC_PROMISC_NUM_LEVELS 1
 
 #define KERNEL_NIC_TC_NUM_PRIOS  1
 #define KERNEL_NIC_TC_NUM_LEVELS 3
@@ -187,6 +190,8 @@ static struct init_tree_node {
 			   ADD_NS(MLX5_FLOW_TABLE_MISS_ACTION_DEF,
 				  ADD_MULTIPLE_PRIO(KERNEL_NIC_TC_NUM_PRIOS,
 						    KERNEL_NIC_TC_NUM_LEVELS),
+				  ADD_MULTIPLE_PRIO(KERNEL_NIC_PROMISC_NUM_PRIOS,
+						    KERNEL_NIC_PROMISC_NUM_LEVELS),
 				  ADD_MULTIPLE_PRIO(KERNEL_NIC_NUM_PRIOS,
 						    KERNEL_NIC_PRIO_NUM_LEVELS))),
 		  ADD_PRIO(0, BY_PASS_MIN_LEVEL, 0, FS_CHAINING_CAPS,
-- 
2.31.1

Re: [PATCH net 1/3] net/mlx5: Reset bw_share field when changing a node's parent

[Jacob Keller]

[-- Attachment #1.1: Type: text/plain, Size: 1368 bytes --]



On 7/10/2025 6:53 AM, Tariq Toukan wrote:
> From: Carolina Jubran <cjubran@nvidia.com>
> 
> When changing a node's parent, its scheduling element is destroyed and
> re-created with bw_share 0. However, the node's bw_share field was not
> updated accordingly.
> 
> Set the node's bw_share to 0 after re-creation to keep the software
> state in sync with the firmware configuration.
> 
> Fixes: 9c7bbf4c3304 ("net/mlx5: Add support for setting parent of nodes")
> Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com>
> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c
> index b6ae384396b3..ad9f6fca9b6a 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c
> @@ -1076,6 +1076,7 @@ static int esw_qos_vports_node_update_parent(struct mlx5_esw_sched_node *node,
>  		return err;
>  	}
>  	esw_qos_node_set_parent(node, parent);
> +	node->bw_share = 0;
>  

Makes sense.

Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>

>  	return 0;
>  }


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 236 bytes --]

Re: [PATCH net 2/3] net/mlx5e: Fix race between DIM disable and net_dim()

[Jacob Keller]

[-- Attachment #1.1: Type: text/plain, Size: 3385 bytes --]



On 7/10/2025 6:53 AM, Tariq Toukan wrote:
> From: Carolina Jubran <cjubran@nvidia.com>
> 
> There's a race between disabling DIM and NAPI callbacks using the dim
> pointer on the RQ or SQ.
> 
> If NAPI checks the DIM state bit and sees it still set, it assumes
> `rq->dim` or `sq->dim` is valid. But if DIM gets disabled right after
> that check, the pointer might already be set to NULL, leading to a NULL
> pointer dereference in net_dim().
> 
> Fix this by calling `synchronize_net()` before freeing the DIM context.
> This ensures all in-progress NAPI callbacks are finished before the
> pointer is cleared.
> 
> Kernel log:
> 
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> ...
> RIP: 0010:net_dim+0x23/0x190
> ...
> Call Trace:
>  <TASK>
>  ? __die+0x20/0x60
>  ? page_fault_oops+0x150/0x3e0
>  ? common_interrupt+0xf/0xa0
>  ? sysvec_call_function_single+0xb/0x90
>  ? exc_page_fault+0x74/0x130
>  ? asm_exc_page_fault+0x22/0x30
>  ? net_dim+0x23/0x190
>  ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core]
>  ? sysvec_apic_timer_interrupt+0xb/0x90
>  mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core]
>  mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core]
>  ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core]
>  busy_poll_stop+0xa2/0x200
>  ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core]
>  ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core]
>  __napi_busy_loop+0x345/0x3b0
>  ? sysvec_call_function_single+0xb/0x90
>  ? asm_sysvec_call_function_single+0x16/0x20
>  ? sysvec_apic_timer_interrupt+0xb/0x90
>  ? pcpu_free_area+0x1e4/0x2e0
>  napi_busy_loop+0x11/0x20
>  xsk_recvmsg+0x10c/0x130
>  sock_recvmsg+0x44/0x70
>  __sys_recvfrom+0xbc/0x130
>  ? __schedule+0x398/0x890
>  __x64_sys_recvfrom+0x20/0x30
>  do_syscall_64+0x4c/0x100
>  entry_SYSCALL_64_after_hwframe+0x4b/0x53
> ...
> ---[ end trace 0000000000000000 ]---
> ...
> ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
> 

Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>

> Fixes: 445a25f6e1a2 ("net/mlx5e: Support updating coalescing configuration without resetting channels")
> Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/en_dim.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c
> index 298bb74ec5e9..d1d629697e28 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c
> @@ -113,7 +113,7 @@ int mlx5e_dim_rx_change(struct mlx5e_rq *rq, bool enable)
>  		__set_bit(MLX5E_RQ_STATE_DIM, &rq->state);
>  	} else {
>  		__clear_bit(MLX5E_RQ_STATE_DIM, &rq->state);
> -
> +		synchronize_net();

We've requested NAPI be disabled by this point, and just need to
guarantee that the already running threads close. Makes sense.

>  		mlx5e_dim_disable(rq->dim);
>  		rq->dim = NULL;
>  	}
> @@ -140,7 +140,7 @@ int mlx5e_dim_tx_change(struct mlx5e_txqsq *sq, bool enable)
>  		__set_bit(MLX5E_SQ_STATE_DIM, &sq->state);
>  	} else {
>  		__clear_bit(MLX5E_SQ_STATE_DIM, &sq->state);
> -
> +		synchronize_net();
>  		mlx5e_dim_disable(sq->dim);
>  		sq->dim = NULL;
>  	}



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 236 bytes --]

Re: [PATCH net 3/3] net/mlx5e: Add new prio for promiscuous mode

[Jacob Keller]

[-- Attachment #1.1: Type: text/plain, Size: 1069 bytes --]



On 7/10/2025 6:53 AM, Tariq Toukan wrote:
> From: Jianbo Liu <jianbol@nvidia.com>
> 
> An optimization for promiscuous mode adds a high-priority steering
> table with a single catch-all rule to steer all traffic directly to
> the TTC table.
> 
> However, a gap exists between the creation of this table and the
> insertion of the catch-all rule. Packets arriving in this brief window
> would miss as no rule was inserted yet, unnecessarily incrementing the
> 'rx_steer_missed_packets' counter and dropped.
> 
> This patch resolves the issue by introducing a new prio for this
> table, placing it between MLX5E_TC_PRIO and MLX5E_NIC_PRIO. By doing
> so, packets arriving during the window now fall through to the next
> prio (at MLX5E_NIC_PRIO) instead of being dropped.
> 
> Fixes: 1c46d7409f30 ("net/mlx5e: Optimize promiscuous mode")
> Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
> Reviewed-by: Mark Bloch <mbloch@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
> ---

Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 236 bytes --]

Re: [PATCH net 0/3] mlx5 misc fixes 2025-07-10

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 10 Jul 2025 16:53:41 +0300 you wrote:
> Hi,
> 
> This small patchset provides misc bug fixes from the team to the mlx5
> core and EN drivers.
> 
> Thanks,
> Tariq.
> 
> [...]

Here is the summary with links:
  - [net,1/3] net/mlx5: Reset bw_share field when changing a node's parent
    https://git.kernel.org/netdev/net/c/f7b764668940
  - [net,2/3] net/mlx5e: Fix race between DIM disable and net_dim()
    https://git.kernel.org/netdev/net/c/eb41a264a3a5
  - [net,3/3] net/mlx5e: Add new prio for promiscuous mode
    https://git.kernel.org/netdev/net/c/4c9fce56fa70

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html