From 2d5c08ec1532547fd776e8171dee5d32a257e592 Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi Date: Mon, 12 Oct 2026 17:24:39 +0200 Subject: [PATCH 1/2] net: stmmac: fix XDP TX DMA address for compound RX pages When RX buffers are compound pages (order > 0), only the head page carries the DMA address programmed by the page pool (page_pool_get_dma_addr()). stmmac_xdp_xmit_xdpf() computed the head buffer's bus address from the page that happens to contain the data: page = frag ? skb_frag_page(frag) : virt_to_page(xdpf->data); dma_addr = page_pool_get_dma_addr(page); ... RX pages become compound as soon as dma_buf_sz needs more than one page (pp_params.order = order_base_2(num_pages) > 0), which happens from an MTU around 3000 bytes once dma_buf_sz reaches 4096. If an XDP program moves the data forward with bpf_xdp_adjust_head() by more than about a page, xdpf->data points into a tail page whose struct page has no DMA address: page_pool_get_dma_addr() then returns a bogus bus address, and dma_sync_single_for_device() together with the TX descriptor transmit from the wrong location. Use virt_to_head_page() to read the DMA base of the buffer and keep the offset relative to the head page (sizeof(*xdpf) + xdpf->headroom), which is correct no matter which page the data ends up in. Signed-off-by: Lorenzo Bianconi Reviewed-by: Daniel Machon Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20261012-stmmac-xdp-tx-pre-fixes-v1-1-05fd0c90f7e1@oss.qualcomm.com Signed-off-by: Paolo Abeni --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index 9477ba654946..85076e917289 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -5303,7 +5303,7 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue, struct page *page; page = frag ? skb_frag_page(frag) - : virt_to_page(xdpf->data); + : virt_to_head_page(xdpf->data); dma_addr = page_pool_get_dma_addr(page); if (frag) dma_addr += skb_frag_off(frag); From 667a375a5294b29f66b935d57a8b250e75d576ae Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi Date: Mon, 12 Oct 2026 17:24:40 +0200 Subject: [PATCH 2/2] net: stmmac: disable TX checksum offload for jumbo frames on bugged cores stmmac_xdp_xmit_xdpf() decides TX checksum insertion from the queue COE capability only: csum = !priv->plat->tx_queues_cfg[queue].coe_unsupported; and lets the enhanced descriptor set TX_CIC_FULL accordingly. On the bugged_jumbo cores (snps,dwmac-3.40a, snps,dwmac-3.610 and snps,dwmac-3.710) hardware checksum insertion is broken for jumbo frames; the skb path works around it by clearing NETIF_F_CSUM_MASK in stmmac_fix_features() when the MTU exceeds ETH_DATA_LEN, so skbs are never marked CHECKSUM_PARTIAL and no checksum is inserted. The XDP TX path bypasses that workaround, so once XDP is allowed at MTU > ETH_DATA_LEN, jumbo frames sent via XDP_TX or redirected into the device would leave the interface with a full checksum insertion enabled on those cores - exactly what the workaround is meant to avoid. Disable checksum insertion for oversized frames on bugged_jumbo cores in the XDP TX path too. Signed-off-by: Lorenzo Bianconi Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20261012-stmmac-xdp-tx-pre-fixes-v1-2-05fd0c90f7e1@oss.qualcomm.com Signed-off-by: Paolo Abeni --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index 85076e917289..3636449e1ffc 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -5278,6 +5278,14 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue, return STMMAC_XDP_CONSUMED; } + /* Disable TX checksum offload for jumbo frames on cores where + * checksum insertion is broken for oversized frames, matching the + * stmmac_fix_features() workaround used by the skb path. + */ + if (priv->plat->bugged_jumbo && + xdp_get_frame_len(xdpf) > ETH_FRAME_LEN) + csum = false; + while (true) { skb_frag_t *frag = i ? &sinfo->frags[i - 1] : NULL; int len = frag ? skb_frag_size(frag) : xdpf->len;