RE: [PATCH net-next] i40e: fix VF queue mapping collision with PF queue 0

[Romanowski, Rafal]

> -----Original Message-----
> From: Tian Run <15503232150@xxxxxxx>
> Sent: Tuesday, September 15, 2026 12:11 PM
> To: intel-wired-lan@xxxxxxxxxxxxxxxx; netdev@xxxxxxxxxxxxxxx
> Cc: Nguyen, Anthony L <anthony.l.nguyen@xxxxxxxxx>; Kitszel, Przemyslaw
> <przemyslaw.kitszel@xxxxxxxxx>; Andrew Lunn <andrew+netdev@xxxxxxx>;
> David S.Miller <davem@xxxxxxxxxxxxx>; Eric Dumazet <edumazet@xxxxxxxxxx>;
> Jakub Kicinski <kuba@xxxxxxxxxx>; Paolo Abeni <pabeni@xxxxxxxxxx>; linux-
> kernel@xxxxxxxxxxxxxxx
> Subject: [PATCH net-next] i40e: fix VF queue mapping collision with PF queue 0
> 
> i40e_vsi_setup() limits the queue pairs of an SRIOV VSI to
> pf->num_lan_msix and fills info.queue_mapping[] only for that many
> entries, leaving the rest zeroed. i40e_vc_get_pf_queue_id() resolves such an
> entry to absolute queue 0, which belongs to the PF itself.
> 
> i40e_config_vsi_tx_queue() then overwrites the PF's queue 0 context with the
> VF's ring and re-programs QTX_CTL(0) into VF mode. The PF's next transmit on
> queue 0 wedges the queue: the device stops it, reports a Malicious Driver
> Detection event without a valid event ID, sets both PF_MDET_TX and
> VP_MDET_TX and the PF enters a NETDEV WATCHDOG / reset loop.
> 
> alloc_queue_pairs is set to pf->num_vf_qps, so GET_VF_RESOURCES advertises
> the full count and a VF with more online CPUs than the PF's num_lan_msix (e.g. a
> 4-CPU guest on a 3-CPU host) configures the extra queue pair and hits the
> unprogrammed mapping entry.
> 
> Clamp alloc_queue_pairs by num_lan_msix like i40e_vsi_setup() does, so the VF
> is only offered queue pairs whose mapping was programmed.
> 
> Fixes: 1563f2d2e012 ("i40e: Do not allow use more TC queue pairs than MSI-X
> vectors exist")
> Signed-off-by: Tian Run <15503232150@xxxxxxx>
> ---
>  drivers/net/ethernet/intel/i40e/i40e_main.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c
> b/drivers/net/ethernet/intel/i40e/i40e_main.c
> index abbc71e81..2934862da 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_main.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
> @@ -11443,6 +11443,12 @@ static int i40e_set_num_rings_in_vsi(struct
> i40e_vsi *vsi)
> 
>  	case I40E_VSI_SRIOV:
>  		vsi->alloc_queue_pairs = pf->num_vf_qps;
> +		/* i40e_vsi_setup() limits queue pairs to num_lan_msix;
> +		 * keep alloc_queue_pairs consistent with that limit.
> +		 */
> +		if (test_bit(I40E_FLAG_MSIX_ENA, pf->flags))
> +			vsi->alloc_queue_pairs =
> +				min_t(u16, pf->num_vf_qps, pf-
> >num_lan_msix);
>  		if (!vsi->num_tx_desc)
>  			vsi->num_tx_desc =
> ALIGN(I40E_DEFAULT_NUM_DESCRIPTORS,
> 
> I40E_REQ_DESCRIPTOR_MULTIPLE);
> --
> 2.43.0


Tested-by: Rafal Romanowski <rafal.romanowski@xxxxxxxxx>