Re: [PATCH net-next 0/6] net: bcmgenet: add XDP support

Nicolai Buchwitz
2026-03-14T19:51:05Z

On 14.3.2026 00:01, Florian Fainelli wrote:
> On 3/13/26 02:20, Nicolai Buchwitz wrote:
>> Add XDP support to the bcmgenet driver, covering XDP_PASS, XDP_DROP,
>> XDP_TX, XDP_REDIRECT, and ndo_xdp_xmit.
>>
>> The first patch converts the RX path from the existing kmalloc-based
>> allocation to page_pool, which is a prerequisite for XDP. The
>> remaining
>> patches incrementally add XDP functionality and per-action statistics.
>>
>> Tested on Raspberry Pi CM4 (BCM2711, bcmgenet, 1Gbps link):
>> - XDP_PASS: 943 Mbit/s TX, 935 Mbit/s RX (no regression vs baseline)
>> - XDP_PASS latency: 0.164ms avg, 0% packet loss
>> - XDP_DROP: all inbound traffic blocked as expected
>> - XDP_TX: TX counter increments (packet reflection working)
>> - Link flap with XDP attached: no errors
>> - Program swap under iperf3 load: no errors
>
> This is very nice, thanks for doing that work! If the network is
> brought up and there is a background iperf3 client transmitting data,
> and then you issue "reboot -f", you will see the following NPD:
>
> [ 176.531216] Unable to handle kernel NULL pointer dereference at
> virtual address 0000000000000010
> [ 176.540052] Mem abort info:
> [ 176.542854] ESR = 0x0000000096000004
> [ 176.546614] EC = 0x25: DABT (current EL), IL = 32 bits
> [ 176.551938] SET = 0, FnV = 0
> [ 176.555000] EA = 0, S1PTW = 0
> [ 176.558149] FSC = 0x04: level 0 translation fault
> [ 176.563037] Data abort info:
> [ 176.565924] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> [ 176.571421] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> [ 176.576489] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> [ 176.581813] user pgtable: 4k pages, 48-bit VAs,
> pgdp=0000000044d02000
> [ 176.588286] [0000000000000010] pgd=0000000000000000,
> p4d=0000000000000000
> [ 176.595101] Internal error: Oops: 0000000096000004 [#1] SMP
> [ 176.600774] Modules linked in: bdc udc_core
> [ 176.604976] CPU: 3 UID: 0 PID: 1575 Comm: reboot Not tainted
> 7.0.0-rc3-g08ac0b907060 #2 PREEMPTLAZY
> [ 176.614124] Hardware name: BCM972180HB_V20 (DT)
> [ 176.618662] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS
> BTYPE=--)
> [ 176.625636] pc : bcmgenet_free_rx_buffers+0x78/0x148
> [ 176.630618] lr : bcmgenet_fini_dma+0x104/0x180
> [ 176.635071] sp : ffff8000836d3910
> [ 5] 95.00-96.00 sec 98.4 MB[ 176.638390] x29: ffff8000836d3910
> x28: 0000000000000000 x27: 0000000000000038
> ytes 826 Mbits/sec 0 819[ 176.648318] x26: 0000000000000001
> x25: 0000000000000010 x24: 00000000000003c0
> KBytes
> [ 176.658238] x23: ffffffffffffffff x22: ffff0000086b4a00 x21:
> 0000000000000000
> [ 176.666766] x20: ffff0000086b8600 x19: 0000000000000000 x18:
> 0000000000000000
> [ 176.673917] x17: 000000000000fe88 x16: 00000000000733f0 x15:
> 00000000000005a8
> [ 176.681067] x14: 000000291895b141 x13: 00000000000733f0 x12:
> 0000000000000000
> [ 176.688218] x11: 00000000000000c0 x10: 0000000000000910 x9 :
> ffff8000809b4ecc
> [ 176.695368] x8 : ffff0000058531f0 x7 : 0000000000000000 x6 :
> 0000000000000000
> [ 176.702518] x5 : 0000000000000000 x4 : ffffffff00000000 x3 :
> 00000000fffe1db3
> [ 176.709669] x2 : 0000000000000001 x1 : ffff80008103a108 x0 :
> 0000000000000001
> [ 176.716821] Call trace:
> [ 176.719271] bcmgenet_free_rx_buffers+0x78/0x148 (P)
> [ 176.724247] bcmgenet_fini_dma+0x104/0x180
> [ 176.728353] bcmgenet_netif_stop+0x1b4/0x1f8
> [ 176.732633] bcmgenet_close+0x38/0xd8
> [ 176.736304] __dev_close_many+0xd4/0x1f8
> [ 176.740237] netif_close_many+0x8c/0x140
> [ 176.744169] unregister_netdevice_many_notify+0x210/0x998
> [ 176.749578] unregister_netdevice_queue+0xa0/0xe8
> [ 176.754291] unregister_netdev+0x28/0x50
> [ 176.758221] bcmgenet_shutdown+0x24/0x48
> [ 176.762153] platform_shutdown+0x28/0x40
> [ 176.766085] device_shutdown+0x154/0x260
> [ 176.770015] kernel_restart+0x48/0xc8
> [ 176.773688] __do_sys_reboot+0x154/0x268
> [ 176.777620] __arm64_sys_reboot+0x28/0x38
> [ 176.781638] invoke_syscall+0x4c/0x118
> [ 176.785397] el0_svc_common.constprop.0+0x44/0xe8
> [ 176.790110] do_el0_svc+0x20/0x30
> [ 176.793433] el0_svc+0x18/0x68
> [ 176.796495] el0t_64_sync_handler+0x98/0xe0
> [ 176.800689] el0t_64_sync+0x154/0x158
> [ 176.804362] Code: d280003a d503201f f94d2e93 9b3b4eb3 (f9400a61)
> [ 176.810467] ---[ end trace 0000000000000000 ]---
>
> That does not happen if you do:
>
> ip link set eth0 down
>
> while there is transmission in progress, FWIW.
>

Thanks for testing!

Both the NPD and the stalled page_pool are the same
bug: bcmgenet_free_rx_buffers() used a wrong ring index (DESC_INDEX
remapping that doesn't match init_rx_queues). Already fixed in v2 WIP.

I will do some more testing (also with the xdp selftests Jakub
mentioned)
and then send the v2.

> pw-bot: cr

Thanks,
Nicolai