[PATCH iwl-net] ice: fix usage of logical PF id

[PATCH iwl-net] ice: fix usage of logical PF id

[Grzegorz Nitka]

In some devices, the function numbers used are non-contiguous. For
example, here is such configuration for E825 device:

root@/home/root# lspci -v | grep Eth
0a:00.0 Ethernet controller: Intel Corporation Ethernet Connection
E825-C for backplane (rev 04)
0a:00.1 Ethernet controller: Intel Corporation Ethernet Connection
E825-C for backplane (rev 04)
0a:00.4 Ethernet controller: Intel Corporation Ethernet Connection
E825-C 10GbE (rev 04)
0a:00.5 Ethernet controller: Intel Corporation Ethernet Connection
E825-C 10GbE (rev 04)

When distributing RSS and FDIR masks, which are global resources across
the active devices, it is required to have a contiguous PF id, which can
be described as a logical PF id. In the case above, function 0 would
have a logical PF id of 0, function 1 would have a logical PF id
of 1, and functions 4 and 5 would have a logical PF ids 2 and 3
respectively.
Using logical PF id can properly describe which slice of resources can
be used by a particular PF.

The 'function id' to 'logical id' mapping has been introduced with the
commit 015307754a19 ("ice: Support VF queue rate limit and quanta size
configuration"). However, the usage of 'logical_pf_id' field was
unintentionally skipped for profile mask configuration.
Fix it by using 'logical_pf_id' instead of 'pf_id' value when configuring
masks.

Without that patch, wrong indexes, i.e. out of range for given PF, can
be used while configuring resources masks, which might lead to memory
corruption and undefined driver behavior.
The call trace below is one of the examples of such error:

[  +0.000008] WARNING: CPU: 39 PID: 3830 at drivers/base/devres.c:1095
devm_kfree+0x70/0xa0
[  +0.000002] RIP: 0010:devm_kfree+0x70/0xa0
[  +0.000001] Call Trace:
[  +0.000002]  <TASK>
[  +0.000002]  ice_free_hw_tbls+0x183/0x710 [ice]
[  +0.000106]  ice_deinit_hw+0x67/0x90 [ice]
[  +0.000091]  ice_deinit+0x20d/0x2f0 [ice]
[  +0.000076]  ice_remove+0x1fa/0x6a0 [ice]
[  +0.000075]  pci_device_remove+0xa7/0x1d0
[  +0.000010]  device_release_driver_internal+0x365/0x530
[  +0.000006]  driver_detach+0xbb/0x170
[  +0.000003]  bus_remove_driver+0x117/0x290
[  +0.000007]  pci_unregister_driver+0x26/0x250

Fixes: 015307754a19 ("ice: Support VF queue rate limit and quanta size configuration")
Suggested-by: Dan Nowlin <dan.nowlin@intel.com>
Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
---
 drivers/net/ethernet/intel/ice/ice_flex_pipe.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
index 363ae79a3620..013c93b6605e 100644
--- a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
+++ b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
@@ -1479,7 +1479,7 @@ static void ice_init_prof_masks(struct ice_hw *hw, enum ice_block blk)
 	per_pf = ICE_PROF_MASK_COUNT / hw->dev_caps.num_funcs;
 
 	hw->blk[blk].masks.count = per_pf;
-	hw->blk[blk].masks.first = hw->pf_id * per_pf;
+	hw->blk[blk].masks.first = hw->logical_pf_id * per_pf;
 
 	memset(hw->blk[blk].masks.masks, 0, sizeof(hw->blk[blk].masks.masks));
 

base-commit: 8b223715f39c8a944abff2831c47d5509fdb6e57
-- 
2.39.3

Re: [PATCH iwl-net] ice: fix usage of logical PF id

[Simon Horman]

On Wed, Oct 08, 2025 at 12:28:53PM +0200, Grzegorz Nitka wrote:
> In some devices, the function numbers used are non-contiguous. For
> example, here is such configuration for E825 device:
> 
> root@/home/root# lspci -v | grep Eth
> 0a:00.0 Ethernet controller: Intel Corporation Ethernet Connection
> E825-C for backplane (rev 04)
> 0a:00.1 Ethernet controller: Intel Corporation Ethernet Connection
> E825-C for backplane (rev 04)
> 0a:00.4 Ethernet controller: Intel Corporation Ethernet Connection
> E825-C 10GbE (rev 04)
> 0a:00.5 Ethernet controller: Intel Corporation Ethernet Connection
> E825-C 10GbE (rev 04)
> 
> When distributing RSS and FDIR masks, which are global resources across
> the active devices, it is required to have a contiguous PF id, which can
> be described as a logical PF id. In the case above, function 0 would
> have a logical PF id of 0, function 1 would have a logical PF id
> of 1, and functions 4 and 5 would have a logical PF ids 2 and 3
> respectively.
> Using logical PF id can properly describe which slice of resources can
> be used by a particular PF.
> 
> The 'function id' to 'logical id' mapping has been introduced with the
> commit 015307754a19 ("ice: Support VF queue rate limit and quanta size
> configuration"). However, the usage of 'logical_pf_id' field was
> unintentionally skipped for profile mask configuration.
> Fix it by using 'logical_pf_id' instead of 'pf_id' value when configuring
> masks.
> 
> Without that patch, wrong indexes, i.e. out of range for given PF, can
> be used while configuring resources masks, which might lead to memory
> corruption and undefined driver behavior.
> The call trace below is one of the examples of such error:
> 
> [  +0.000008] WARNING: CPU: 39 PID: 3830 at drivers/base/devres.c:1095
> devm_kfree+0x70/0xa0
> [  +0.000002] RIP: 0010:devm_kfree+0x70/0xa0
> [  +0.000001] Call Trace:
> [  +0.000002]  <TASK>
> [  +0.000002]  ice_free_hw_tbls+0x183/0x710 [ice]
> [  +0.000106]  ice_deinit_hw+0x67/0x90 [ice]
> [  +0.000091]  ice_deinit+0x20d/0x2f0 [ice]
> [  +0.000076]  ice_remove+0x1fa/0x6a0 [ice]
> [  +0.000075]  pci_device_remove+0xa7/0x1d0
> [  +0.000010]  device_release_driver_internal+0x365/0x530
> [  +0.000006]  driver_detach+0xbb/0x170
> [  +0.000003]  bus_remove_driver+0x117/0x290
> [  +0.000007]  pci_unregister_driver+0x26/0x250
> 
> Fixes: 015307754a19 ("ice: Support VF queue rate limit and quanta size configuration")
> Suggested-by: Dan Nowlin <dan.nowlin@intel.com>
> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com>
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>

Reviewed-by: Simon Horman <horms@kernel.org>

RE: [Intel-wired-lan] [PATCH iwl-net] ice: fix usage of logical PF id

[Rinitha, SX]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of Grzegorz Nitka
> Sent: 08 October 2025 15:59
> To: intel-wired-lan@lists.osuosl.org
> Cc: Loktionov, Aleksandr <aleksandr.loktionov@intel.com>; netdev@vger.kernel.org; Kitszel, Przemyslaw <przemyslaw.kitszel@intel.com>; Nowlin, Dan <dan.nowlin@intel.com>
> Subject: [Intel-wired-lan] [PATCH iwl-net] ice: fix usage of logical PF id
>
> In some devices, the function numbers used are non-contiguous. For example, here is such configuration for E825 device:
> 
> root@/home/root# lspci -v | grep Eth
> 0a:00.0 Ethernet controller: Intel Corporation Ethernet Connection E825-C for backplane (rev 04)
> 0a:00.1 Ethernet controller: Intel Corporation Ethernet Connection E825-C for backplane (rev 04)
> 0a:00.4 Ethernet controller: Intel Corporation Ethernet Connection E825-C 10GbE (rev 04)
> 0a:00.5 Ethernet controller: Intel Corporation Ethernet Connection E825-C 10GbE (rev 04)
>
> When distributing RSS and FDIR masks, which are global resources across the active devices, it is required to have a contiguous PF id, which can be described as a logical PF id. In the case above, function 0 would have > a logical PF id of 0, function 1 would have a logical PF id of 1, and functions 4 and 5 would have a logical PF ids 2 and 3 respectively.
> Using logical PF id can properly describe which slice of resources can be used by a particular PF.
>
> The 'function id' to 'logical id' mapping has been introduced with the commit 015307754a19 ("ice: Support VF queue rate limit and quanta size configuration"). However, the usage of 'logical_pf_id' field was unintentionally skipped for profile mask configuration.
> Fix it by using 'logical_pf_id' instead of 'pf_id' value when configuring masks.
> 
> Without that patch, wrong indexes, i.e. out of range for given PF, can be used while configuring resources masks, which might lead to memory corruption and undefined driver behavior.
> The call trace below is one of the examples of such error:
>
> [  +0.000008] WARNING: CPU: 39 PID: 3830 at drivers/base/devres.c:1095
> devm_kfree+0x70/0xa0
> [  +0.000002] RIP: 0010:devm_kfree+0x70/0xa0 [  +0.000001] Call Trace:
> [  +0.000002]  <TASK>
> [  +0.000002]  ice_free_hw_tbls+0x183/0x710 [ice] [  +0.000106]  ice_deinit_hw+0x67/0x90 [ice] [  +0.000091]  ice_deinit+0x20d/0x2f0 [ice] [  +0.000076]  ice_remove+0x1fa/0x6a0 [ice] [  +0.000075]  pci_device_remove+0xa7/0x1d0 [  +0.000010]  device_release_driver_internal+0x365/0x530
> [  +0.000006]  driver_detach+0xbb/0x170
> [  +0.000003]  bus_remove_driver+0x117/0x290 [  +0.000007]  pci_unregister_driver+0x26/0x250
>
> Fixes: 015307754a19 ("ice: Support VF queue rate limit and quanta size configuration")
> Suggested-by: Dan Nowlin <dan.nowlin@intel.com>
> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com>
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ---
> drivers/net/ethernet/intel/ice/ice_flex_pipe.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>

Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)