[RFC PATCH 0/1] IDPF + SWIOTLB Bug

[RFC PATCH 0/1] IDPF + SWIOTLB Bug

[Steve Rutherford]

Found an issue with the IDPF driver when SWIOTLB is enabled. The issue
results in empty headers for packets that hit the split queue workaround
path. It's caused by a spurious sync in that path. The header is synced
from the SWIOTLB even when the header was shoved into the payload.

I cooked up a sample patch, but I'm not an expert in this driver, so I have
no idea if it's the right solution. It did allow my QEMU VM to boot with a
superficially functional passed-through IDPF NIC and SWIOTLB=force.

The patch was written against COS's 6.12, so I assume that it will not
apply cleanly elsewhere, but I figured a wrong sample patch was better than
a long paragraph describing the same thing. My read of more recent kernels
is that this problem is still present, but could be mistaken.

Steve Rutherford (1):
  Fix header clobber in IDPF with SWIOTLB enabled

 drivers/net/ethernet/intel/idpf/idpf_txrx.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

-- 
2.53.0.473.g4a7958ca14-goog

[RFC PATCH 1/1] Fix header clobber in IDPF with SWIOTLB enabled

[Steve Rutherford]

When SWIOTLB and header split are enabled, IDPF sees empty packets in the
rx queue.

This is caused by libeth_rx_sync_for_cpu clobbering the synthesized header
in the workaround (i.e. overflow) path. After the header is synthesized by
idpf_rx_hsplit_wa, the sync call pulls from the empty SWIOTLB buffer,
effectively zeroing out the buffer.

This skips the extra sync in the workaround path in most cases. The one
exception is that it calls sync to trigger a recycle for the header buffer
when it fails to find a header in the payload.

Signed-off-by: Steve Rutherford <srutherford@google.com>
---
 drivers/net/ethernet/intel/idpf/idpf_txrx.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
index 3ddf7b1e85ef..b02195fa2813 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
@@ -3007,9 +3007,14 @@ static int idpf_rx_splitq_clean(struct idpf_rx_queue *rxq, int budget)
 			u64_stats_update_begin(&rxq->stats_sync);
 			u64_stats_inc(&rxq->q_stats.hsplit_buf_ovf);
 			u64_stats_update_end(&rxq->stats_sync);
-		}
 
-		if (libeth_rx_sync_for_cpu(hdr, hdr_len)) {
+			/* Recycle the hdr buffer if unused */
+			if (!hdr_len)
+				libeth_rx_sync_for_cpu(hdr, 0);
+		} else if (!libeth_rx_sync_for_cpu(hdr, hdr_len))
+			hdr_len = 0;
+
+		if (hdr_len) {
 			skb = idpf_rx_build_skb(hdr, hdr_len);
 			if (!skb)
 				break;
-- 
2.53.0.473.g4a7958ca14-goog

RE: [Intel-wired-lan] [RFC PATCH 1/1] Fix header clobber in IDPF with SWIOTLB enabled

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Steve Rutherford via Intel-wired-lan
> Sent: Friday, February 27, 2026 4:00 AM
> To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; Lobakin, Aleksander
> <aleksander.lobakin@intel.com>
> Cc: andrew+netdev@lunn.ch; davem@davemloft.net; edumazet@google.com;
> kuba@kernel.org; pabeni@redhat.com; intel-wired-lan@lists.osuosl.org;
> netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Steve Rutherford
> <srutherford@google.com>
> Subject: [Intel-wired-lan] [RFC PATCH 1/1] Fix header clobber in IDPF
> with SWIOTLB enabled
> 
> When SWIOTLB and header split are enabled, IDPF sees empty packets in
> the rx queue.
> 
> This is caused by libeth_rx_sync_for_cpu clobbering the synthesized
> header in the workaround (i.e. overflow) path. After the header is
> synthesized by idpf_rx_hsplit_wa, the sync call pulls from the empty
> SWIOTLB buffer, effectively zeroing out the buffer.
> 
> This skips the extra sync in the workaround path in most cases. The
> one exception is that it calls sync to trigger a recycle for the
> header buffer when it fails to find a header in the payload.
> 
> Signed-off-by: Steve Rutherford <srutherford@google.com>


It looks like subsystem prefix idpf: is missed in subj, and Fixes tag in commit message.


> ---
>  drivers/net/ethernet/intel/idpf/idpf_txrx.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> index 3ddf7b1e85ef..b02195fa2813 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> @@ -3007,9 +3007,14 @@ static int idpf_rx_splitq_clean(struct
> idpf_rx_queue *rxq, int budget)
>  			u64_stats_update_begin(&rxq->stats_sync);
>  			u64_stats_inc(&rxq->q_stats.hsplit_buf_ovf);
>  			u64_stats_update_end(&rxq->stats_sync);
> -		}
> 
> -		if (libeth_rx_sync_for_cpu(hdr, hdr_len)) {
> +			/* Recycle the hdr buffer if unused */
> +			if (!hdr_len)
> +				libeth_rx_sync_for_cpu(hdr, 0);
> +		} else if (!libeth_rx_sync_for_cpu(hdr, hdr_len))
> +			hdr_len = 0;
> +
> +		if (hdr_len) {
>  			skb = idpf_rx_build_skb(hdr, hdr_len);
>  			if (!skb)
>  				break;
> --
> 2.53.0.473.g4a7958ca14-goog