From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.tipi-net.de (mail.tipi-net.de [194.13.80.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7F4183E40FB; Mon, 19 Oct 2026 11:16:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=194.13.80.246 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792408610; cv=none; b=FjJR78axjBexhE5wGnSfdb67s5/RmIzzO2nlow7yjji6KuMOd611NGi5Rdy0j4kiSkDTOxMM4RKhyFlFBQJ1exJZays+7yNiYyGAfjEfqoGo7k2vuWuUmmFPg5aUN/b4zX2HkZJJBlremtWJ3IkVZV9Wo8LnWMHZREdFmnp+brY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792408610; c=relaxed/simple; bh=A89akwBWY5UiZFDwcsf3ddUcoPDfVkegP+DOiS2ufP4=; h=MIME-Version:Date:From:To:Cc:Subject:In-Reply-To:References: Message-ID:Content-Type; b=J68QD2dQGmW9+TWVwoNnl+sElo0sh46F9JlWZpg6Zlak5QFuqEt0CiOV6jC3+8e/nQdFHMSJAvL1nO+Qk6LuUNdlM9wJ3XlQqsLcs9+d8aGNbzkH0B7bpG6g6GVjUZDV0ehjBK0TVy5hYiNgOBU4JTZEVR56iVqz4RKsvBXZpro= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=tipi-net.de; spf=pass smtp.mailfrom=tipi-net.de; dkim=pass (2048-bit key) header.d=tipi-net.de header.i=@tipi-net.de header.b=W61oJF60; arc=none smtp.client-ip=194.13.80.246 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=tipi-net.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=tipi-net.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=tipi-net.de header.i=@tipi-net.de header.b="W61oJF60" Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 8B4E2A156C; Mon, 19 Oct 2026 13:16:30 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tipi-net.de; s=dkim; t=1792408593; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=/XjINHqIBzneqFkY4u1ge+eJSkp77hxmWQgeY7LjLvk=; b=W61oJF60IVzoEfj4TjI2sf7h4bhSvysGjad19NTTcOghjn0ruiY7Y7IeCNuPUciH0KwlhM jWVQ/W5+ZNCq1zP6LDZF0vR7jG0uA9D5vYrpLgLbBED+iFJRChlQhOoHe4EhtvbhrrQVCK kou/iprWa4Sq0jXtgrZ7l7H8fEb33DfR178ghbU4NUwTsYnKj3sVojGCPDju7ZY0uemy6P ZrwjJuwLMa+qD4MF48A/9W+sZpeZwqNHnqxfI3Nfhlnm7ELqJMwReEJvfXTY7vnHRPNue2 mw/6IJjO8IGuHxEELvqdVNQ/Or04voQG3jCCktUxYrFbz0g43xDdH2i1yPyUrA== Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Date: Mon, 19 Oct 2026 13:16:30 +0200 From: Nicolai Buchwitz To: Lorenzo Bianconi Cc: Maxime Chevallier , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Maxime Coquelin , Alexandre Torgue , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Jose Abreu , Ong Boon Leong , netdev@vger.kernel.org, linux-arm-kernel@lists.infradead.org, bpf@vger.kernel.org Subject: Re: [PATCH net-next v8 2/5] net: stmmac: drop split frames on AF_XDP zero-copy RX In-Reply-To: <20261018-stmmac-rx-mb-v8-2-5f58c0b25849@oss.qualcomm.com> References: <20261018-stmmac-rx-mb-v8-0-5f58c0b25849@oss.qualcomm.com> <20261018-stmmac-rx-mb-v8-2-5f58c0b25849@oss.qualcomm.com> Message-ID: <8c9e47e535ecc8190fa1c93ad5b5e32a@tipi-net.de> X-Sender: nb@tipi-net.de Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit X-Last-TLS-Session-Version: TLSv1.3 Hi Lorenzo On 18.10.2026 19:07, Lorenzo Bianconi wrote: > stmmac_rx_zc() assumes a 1:1 mapping between a received frame and an > XSK pool buffer and drops any frame that spans more than one RX > descriptor: > > /* XSK pool expects RX frame 1:1 mapped to XSK buffer */ > if (likely(status & rx_not_ls)) { > xsk_buff_free(buf->xdp); > buf->xdp = NULL; > dirty++; > count++; > goto read_again; > } > > The non-last descriptors are freed and dropped, but the frame is not > marked as errored. When the poll reaches the last descriptor of the > same frame, error is still 0, so the fragment is handled as a complete > frame: it is passed to the XDP program, copied into an skb on XDP_PASS, > or converted for XDP_TX. The tail starts in the middle of the original > payload at a predictable offset and, parsed as a fresh frame (len == > 0), > stmmac_rx_buf1_len() reports the full dma_buf_sz length for it even > though the DMA engine only wrote the tail remainder into that buffer, > so > the reads extend past the received bytes and can reach beyond the end > of > the XSK pool buffer. GMAC4 always enables jumbo frames (GMAC_CONFIG_JE > in GMAC_CORE_INIT), so an on-link peer can trigger such a split even > when the interface MTU is left at 1500. > > Set error when the 1:1 mapping check drops a descriptor, so the > remaining descriptors of the frame - including the last one - are > drained and released with xsk_buff_free() instead of being processed as > a new frame. Account every freed buffer with dirty and count the > dropped frame once in the poll budget / rx_pkt_n. The direct 1:1 > mapping drop also increments rx_dropped. > > Normalize the legacy normal and enhanced descriptor callbacks to report > rx_not_ls together with discard_frame for non-last descriptors. This > allows both stmmac_rx_zc() and stmmac_rx() to drain split frames on > dwmac100 and dwmac1000 instead of reparsing the final fragment as a new > packet. > > Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy") > Reviewed-by: Nicolai Buchwitz This grew quite a bit since v6 (legacy desc changes, stmmac_rx() etc), so my R-b should have been dropped. I had another look and two small notes below. > Signed-off-by: Lorenzo Bianconi > --- > [...] > --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c > +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c > @@ -5695,18 +5695,21 @@ static int stmmac_rx_zc(struct stmmac_priv > *priv, int limit, u32 queue) > if (priv->extend_desc) > stmmac_rx_extended_status(priv, &priv->xstats, > rx_q->dma_erx + entry); > - if (unlikely(status == discard_frame)) { > - xsk_buff_free(buf->xdp); > - buf->xdp = NULL; > - dirty++; > + > + if (unlikely(status & discard_frame)) { > error = 1; > if (!priv->hwts_rx_en) > rx_errors++; > } There's no !error check here, so on the legacy descriptors a split frame now counts once per descriptor in rx_errors. stmmac_rx() in 3/5 counts it once. Could you add the !error check here too? > [...] > @@ -5883,7 +5887,8 @@ static int stmmac_rx(struct stmmac_priv *priv, > int limit, u32 queue) > > if (priv->extend_desc) > stmmac_rx_extended_status(priv, &priv->xstats, rx_q->dma_erx + > entry); > - if (unlikely(status == discard_frame)) { > + > + if (unlikely(status & discard_frame)) { AFAIU this also changes GMAC4: a frame with an error plus an IP header error returns discard_frame | csum_none, which the old "==" let through. Dropping it is right, but maybe worth a line in the commit message? > [...] With the !error check added: Reviewed-by: Nicolai Buchwitz Thanks, Nicolai