Skip to contentSkip to conversation

net: mana: add ethtool private flag for full-page RX buffers

PATCH Applied Dipayaan Roy 3 participants 6 messages Jul 29 – Aug 4

Subsystems (6)
lore
Share & tools
lore
#0 lore raw

v13 cover net: mana: add ethtool private flag for full-page RX buffers

On some ARM64 platforms with 4K PAGE_SIZE, utilizing page_pool fragments for allocation in the RX refill path (~2kB buffer per fragment) causes 15-20% throughput regression under high connection counts (>16 TCP streams at 180+ Gbps). Using full-page buffers on these platforms shows no regression and restores line-rate performance.

This behavior is observed on a single platform; other platforms perform better with page_pool fragments, indicating this is not a page_pool issue but platform-specific.

This series adds an ethtool private flag "full-page-rx" to let the user opt in to one RX buffer per page:

  ethtool --set-priv-flags eth0 full-page-rx on

There is no behavioral change by default. The flag can be persisted via udev rule for affected platforms.

This series depends on the following fixes now merged in net-next:
commit 17bfe0a8c014 ("net: mana: Add NULL guards in teardown path to prevent panic on attach failure") commit 5b05aa36ee24 ("net: mana: Skip redundant detach on already-detached port")

Changes in v13:
- Dropped patches 2/4 (mana_detach dealloc bail-out fix) and 4/4 (attach failure recovery). Both will be sent as separate series:
the dealloc fix as a standalone fix, and the recovery mechanism after concluding pre-allocate-and-replace approach discussion with the HW team.
- Removed schedule_port_reset logic from mana_set_priv_flags(); on mana_attach() failure, the old priv_flags are restored and the error is returned without scheduling async recovery.
Changes in v12:
- Added patch 2 to ensure mana_detach() always completes its full teardown even if mana_dealloc_queues() fails, keeping port state consistent for recovery.
- Added patch 4 to schedule queue_reset_work when mana_attach() fails during ethtool ring size or channel count changes, with fallback values that maximize recovery chances.
Changes in v11:
- Rebased on net-next
Changes in v10:
- Rebased on net-next which now includes the prerequisite fixes.
- Recovery logic in mana_set_priv_flags() leverages the idempotent mana_detach() from the merged fixes.
Changes in v9:
- Added correct tree.
Changes in v8:
- Fixed queue_reset_work recovery by restoring port_is_up before scheduling reset so the handler can properly re-attach.
- Simplified "err && schedule_port_reset" to "schedule_port_reset".
Changes in v7:
- Rebased onto net-next.
- Retained private flag approach after David Wei's testing on Grace (ARM64) confirmed that fragment mode outperforms full-page mode on other platforms, validating this is a single-platform workaround rather than a generic issue.
Changes in v6:
- Added missed maintainers.
Changes in v5:
- Split prep refactor into separate patch (patch 1/2)
Changes in v4:
- Dropping the smbios string parsing and add ethtool priv flag to reconfigure the queues with full page rx buffers.
Changes in v3:
- changed u8* to char*
Changes in v2:
- separate reading string index and the string, remove inline.

Dipayaan Roy (2):
net: mana: refactor mana_get_strings() and mana_get_sset_count() to
use switch
net: mana: force full-page RX buffers via ethtool private flag

 drivers/net/ethernet/microsoft/mana/mana_en.c |  22 ++-
 .../ethernet/microsoft/mana/mana_ethtool.c    | 169 +++++++++++++++---
 include/net/mana/mana.h                       |   8 +
 3 files changed, 168 insertions(+), 31 deletions(-)
Signature · 1 line
2.43.0
#1 lore raw

PATCH v13 1/2 net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch

Refactor mana_get_strings() and mana_get_sset_count() from if/else to switch statements in preparation for adding ethtool private flags support which requires handling ETH_SS_PRIV_FLAGS.

No functional change.

---
 .../ethernet/microsoft/mana/mana_ethtool.c    | 75 ++++++++++++-------
 1 file changed, 46 insertions(+), 29 deletions(-)
drivers/net/ethernet/microsoft/mana/mana_ethtool.c +46 -29
index 9e31e2595ae3..482cd16009ab 100644
@@ -138,53 +138,70 @@ static int mana_get_sset_count(struct net_device *ndev, int stringset)
 	struct mana_port_context *apc = netdev_priv(ndev);
 	unsigned int num_queues = apc->num_queues;
 
-	if (stringset != ETH_SS_STATS)
+	switch (stringset) {
+	case ETH_SS_STATS:
+		return ARRAY_SIZE(mana_eth_stats) +
+		       ARRAY_SIZE(mana_phy_stats) +
+		       ARRAY_SIZE(mana_hc_stats)  +
+		       num_queues * (MANA_STATS_RX_COUNT + MANA_STATS_TX_COUNT);
+	default:
 		return -EINVAL;
-
-	return ARRAY_SIZE(mana_eth_stats) + ARRAY_SIZE(mana_phy_stats) + ARRAY_SIZE(mana_hc_stats) +
-			num_queues * (MANA_STATS_RX_COUNT + MANA_STATS_TX_COUNT);
+	}
 }
 
-static void mana_get_strings(struct net_device *ndev, u32 stringset, u8 *data)
+static void mana_get_strings_stats(struct mana_port_context *apc, u8 **data)
 {
-	struct mana_port_context *apc = netdev_priv(ndev);
 	unsigned int num_queues = apc->num_queues;
 	int i, j;
 
-	if (stringset != ETH_SS_STATS)
-		return;
 	for (i = 0; i < ARRAY_SIZE(mana_eth_stats); i++)
-		ethtool_puts(&data, mana_eth_stats[i].name);
+		ethtool_puts(data, mana_eth_stats[i].name);
 
 	for (i = 0; i < ARRAY_SIZE(mana_hc_stats); i++)
-		ethtool_puts(&data, mana_hc_stats[i].name);
+		ethtool_puts(data, mana_hc_stats[i].name);
 
 	for (i = 0; i < ARRAY_SIZE(mana_phy_stats); i++)
-		ethtool_puts(&data, mana_phy_stats[i].name);
+		ethtool_puts(data, mana_phy_stats[i].name);
 
 	for (i = 0; i < num_queues; i++) {
-		ethtool_sprintf(&data, "rx_%d_packets", i);
-		ethtool_sprintf(&data, "rx_%d_bytes", i);
-		ethtool_sprintf(&data, "rx_%d_xdp_drop", i);
-		ethtool_sprintf(&data, "rx_%d_xdp_tx", i);
-		ethtool_sprintf(&data, "rx_%d_xdp_redirect", i);
-		ethtool_sprintf(&data, "rx_%d_pkt_len0_err", i);
+		ethtool_sprintf(data, "rx_%d_packets", i);
+		ethtool_sprintf(data, "rx_%d_bytes", i);
+		ethtool_sprintf(data, "rx_%d_xdp_drop", i);
+		ethtool_sprintf(data, "rx_%d_xdp_tx", i);
+		ethtool_sprintf(data, "rx_%d_xdp_redirect", i);
+		ethtool_sprintf(data, "rx_%d_pkt_len0_err", i);
 		for (j = 0; j < MANA_RXCOMP_OOB_NUM_PPI - 1; j++)
-			ethtool_sprintf(&data, "rx_%d_coalesced_cqe_%d", i, j + 2);
+			ethtool_sprintf(data,
+					"rx_%d_coalesced_cqe_%d",
+					i,
+					j + 2);
 	}
 
 	for (i = 0; i < num_queues; i++) {
-		ethtool_sprintf(&data, "tx_%d_packets", i);
-		ethtool_sprintf(&data, "tx_%d_bytes", i);
-		ethtool_sprintf(&data, "tx_%d_xdp_xmit", i);
-		ethtool_sprintf(&data, "tx_%d_tso_packets", i);
-		ethtool_sprintf(&data, "tx_%d_tso_bytes", i);
-		ethtool_sprintf(&data, "tx_%d_tso_inner_packets", i);
-		ethtool_sprintf(&data, "tx_%d_tso_inner_bytes", i);
-		ethtool_sprintf(&data, "tx_%d_long_pkt_fmt", i);
-		ethtool_sprintf(&data, "tx_%d_short_pkt_fmt", i);
-		ethtool_sprintf(&data, "tx_%d_csum_partial", i);
-		ethtool_sprintf(&data, "tx_%d_mana_map_err", i);
+		ethtool_sprintf(data, "tx_%d_packets", i);
+		ethtool_sprintf(data, "tx_%d_bytes", i);
+		ethtool_sprintf(data, "tx_%d_xdp_xmit", i);
+		ethtool_sprintf(data, "tx_%d_tso_packets", i);
+		ethtool_sprintf(data, "tx_%d_tso_bytes", i);
+		ethtool_sprintf(data, "tx_%d_tso_inner_packets", i);
+		ethtool_sprintf(data, "tx_%d_tso_inner_bytes", i);
+		ethtool_sprintf(data, "tx_%d_long_pkt_fmt", i);
+		ethtool_sprintf(data, "tx_%d_short_pkt_fmt", i);
+		ethtool_sprintf(data, "tx_%d_csum_partial", i);
+		ethtool_sprintf(data, "tx_%d_mana_map_err", i);
+	}
+}
+
+static void mana_get_strings(struct net_device *ndev, u32 stringset, u8 *data)
+{
+	struct mana_port_context *apc = netdev_priv(ndev);
+
+	switch (stringset) {
+	case ETH_SS_STATS:
+		mana_get_strings_stats(apc, &data);
+		break;
+	default:
+		break;
 	}
 }
 
Signature · 1 line
2.43.0
#2 lore raw

PATCH v13 2/2 net: mana: force full-page RX buffers via ethtool private flag

In reply to Dipayaan Roy

On some ARM64 platforms with 4K PAGE_SIZE, page_pool fragment allocation in the RX refill path can cause 15-20% throughput regression under high connection counts (>16 TCP streams).

Add an ethtool private flag "full-page-rx" that allows the user to force one RX buffer per page, bypassing the page_pool fragment path. This restores line-rate (180+ Gbps) performance on affected platforms.

Usage:
ethtool --set-priv-flags eth0 full-page-rx on

There is no behavioral change by default. The flag must be explicitly enabled by the user or udev rule.

The existing single-buffer-per-page logic for XDP and jumbo frames is consolidated into a new helper mana_use_single_rxbuf_per_page() which is now the single decision point for both the automatic and user-controlled paths.

---
 drivers/net/ethernet/microsoft/mana/mana_en.c | 22 ++++-
 .../ethernet/microsoft/mana/mana_ethtool.c    | 94 +++++++++++++++++++
 include/net/mana/mana.h                       |  8 ++
 3 files changed, 122 insertions(+), 2 deletions(-)
drivers/net/ethernet/microsoft/mana/mana_en.c +20 -2
index 89e7f59f635d..d859c2eae0a5 100644
@@ -755,6 +755,25 @@ static void *mana_get_rxbuf_pre(struct mana_rxq *rxq, dma_addr_t *da)
 	return va;
 }
 
+static bool
+mana_use_single_rxbuf_per_page(struct mana_port_context *apc, u32 mtu)
+{
+	/* On some platforms with 4K PAGE_SIZE, page_pool fragment allocation
+	 * in the RX refill path (~2kB buffer) can cause significant throughput
+	 * regression under high connection counts. Allow user to force one RX
+	 * buffer per page via ethtool private flag to bypass the fragment
+	 * path.
+	 */
+	if (apc->priv_flags & BIT(MANA_PRIV_FLAG_USE_FULL_PAGE_RXBUF))
+		return true;
+
+	/* For xdp and jumbo frames make sure only one packet fits per page. */
+	if (mtu + MANA_RXBUF_PAD > PAGE_SIZE / 2 || mana_xdp_get(apc))
+		return true;
+
+	return false;
+}
+
 /* Get RX buffer's data size, alloc size, XDP headroom based on MTU */
 static void mana_get_rxbuf_cfg(struct mana_port_context *apc,
 			       int mtu, u32 *datasize, u32 *alloc_size,
@@ -765,8 +784,7 @@ static void mana_get_rxbuf_cfg(struct mana_port_context *apc,
 	/* Calculate datasize first (consistent across all cases) */
 	*datasize = mtu + ETH_HLEN;
 
-	/* For xdp and jumbo frames make sure only one packet fits per page */
-	if (mtu + MANA_RXBUF_PAD > PAGE_SIZE / 2 || mana_xdp_get(apc)) {
+	if (mana_use_single_rxbuf_per_page(apc, mtu)) {
 		if (mana_xdp_get(apc)) {
 			*headroom = XDP_PACKET_HEADROOM;
 			*alloc_size = PAGE_SIZE;
drivers/net/ethernet/microsoft/mana/mana_ethtool.c +94 -0

134 lines not on this page · raw message

include/net/mana/mana.h +8 -0
index 226b61504596..768d9f9bf167 100644
@@ -31,6 +31,12 @@ enum TRI_STATE {
 	TRI_STATE_TRUE = 1
 };
 
+/* MANA ethtool private flag bit positions */
+enum mana_priv_flag_bits {
+	MANA_PRIV_FLAG_USE_FULL_PAGE_RXBUF = 0,
+	MANA_PRIV_FLAG_MAX,
+};
+
 /* Number of entries for hardware indirection table must be in power of 2 */
 #define MANA_INDIRECT_TABLE_MAX_SIZE 512
 #define MANA_INDIRECT_TABLE_DEF_SIZE 64
@@ -565,6 +571,8 @@ struct mana_port_context {
 	u32 rxbpre_headroom;
 	u32 rxbpre_frag_count;
 
+	u32 priv_flags;
+
 	struct bpf_prog *bpf_prog;
 
 	/* Create num_queues EQs, SQs, SQ-CQs, RQs and RQ-CQs, respectively. */
Signature · 1 line
2.43.0
#3 lore raw

Re: [PATCH net-next v13 2/2] net: mana: force full-page RX buffers via ethtool private flag

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-after-free of BPF program when mana_pre_alloc_rxbufs fails during XDP setup --

--- Patch [2]: [PATCH net-next v13 2/2] net: mana: force full-page RX buffers via ethtool private flag --- commit 2ea505589c71d255969461add82f06436f8f8e80
Author: Dipayaan Roy <[email protected]>

net: mana: force full-page RX buffers via ethtool private flag

This commit adds an ethtool private flag to force one RX buffer per page, bypassing the page_pool fragment path. This is intended to restore line-rate throughput on certain ARM64 platforms with 4K PAGE_SIZE.

Quoted 4 lines
drivers/net/ethernet/microsoft/mana/mana_ethtool.c +0 -0
index 482cd16009abb..7e441d6ae5dce 100644

[ ... ]

Quoted 1 line
drivers/net/ethernet/microsoft/mana/mana_ethtool.c +0 -0
@@ -756,6 +775,78 @@ static int mana_get_link_ksettings(struct net_device *ndev,

[ ... ]

Quoted 2 lines
drivers/net/ethernet/microsoft/mana/mana_ethtool.c +2 -0
+static int mana_set_priv_flags(struct net_device *ndev, u32 priv_flags)
+{

[ ... ]

Quoted 1 line
drivers/net/ethernet/microsoft/mana/mana_ethtool.c +1 -0
+	if (changed & BIT(MANA_PRIV_FLAG_USE_FULL_PAGE_RXBUF)) {

[ ... ]

drivers/net/ethernet/microsoft/mana/mana_ethtool.c static int mana_get_link_ksettings(struct net_device *ndev, · line 824

Quoted 7 lines
drivers/net/ethernet/microsoft/mana/mana_ethtool.c +7 -0
+		err = mana_pre_alloc_rxbufs(apc, ndev->mtu, apc->num_queues);
+		if (err) {
+			netdev_err(ndev,
+				   "Insufficient memory for new allocations\n");
+			apc->priv_flags = old_priv_flags;
+			goto clear_flag;
+		}

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing the callers of mana_pre_alloc_rxbufs(), does a failure during XDP setup leave a dangling pointer?

In drivers/net/ethernet/microsoft/mana/mana_bpf.c:mana_xdp_set(), apc->bpf_prog is updated before the allocation:

        apc->bpf_prog = prog;

If the allocation fails, the function returns early without cleaning up:

        err = mana_pre_alloc_rxbufs(apc, ndev->mtu, apc->num_queues);
        if (err) {
                NL_SET_ERR_MSG_MOD(extack,
                                   "XDP: Insufficient memory ...");
                return err;
        }

The core network stack handles the error by releasing its reference to the new BPF program, which may then be freed. Because the early return skips the err_dealloc_rxbuffs label, apc->bpf_prog is never reverted to old_prog. Could a subsequent interface flap execute mana_attach() and assign this freed BPF program to the hardware RX queues, causing a use-after-free?

Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2
#4 lore raw

Re: [PATCH net-next v13 2/2] net: mana: force full-page RX buffers via ethtool private flag

Quoted 55 lines · On Thu, Jul 30, 2026 at 06:34:37AM +0000, [email protected] wrote:

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-after-free of BPF program when mana_pre_alloc_rxbufs fails during XDP setup --

--- Patch [2]: [PATCH net-next v13 2/2] net: mana: force full-page RX buffers via ethtool private flag --- commit 2ea505589c71d255969461add82f06436f8f8e80
Author: Dipayaan Roy <[email protected]>

net: mana: force full-page RX buffers via ethtool private flag

This commit adds an ethtool private flag to force one RX buffer per page, bypassing the page_pool fragment path. This is intended to restore line-rate throughput on certain ARM64 platforms with 4K PAGE_SIZE.

Quoted 4 lines
drivers/net/ethernet/microsoft/mana/mana_ethtool.c +0 -0
index 482cd16009abb..7e441d6ae5dce 100644

[ ... ]

Quoted 1 line
drivers/net/ethernet/microsoft/mana/mana_ethtool.c +0 -0
@@ -756,6 +775,78 @@ static int mana_get_link_ksettings(struct net_device *ndev,

[ ... ]

Quoted 2 lines
drivers/net/ethernet/microsoft/mana/mana_ethtool.c +2 -0
+static int mana_set_priv_flags(struct net_device *ndev, u32 priv_flags)
+{

[ ... ]

Quoted 1 line
drivers/net/ethernet/microsoft/mana/mana_ethtool.c +1 -0
+	if (changed & BIT(MANA_PRIV_FLAG_USE_FULL_PAGE_RXBUF)) {

[ ... ]

drivers/net/ethernet/microsoft/mana/mana_ethtool.c static int mana_get_link_ksettings(struct net_device *ndev, · line 824

Quoted 7 lines
drivers/net/ethernet/microsoft/mana/mana_ethtool.c +7 -0
+		err = mana_pre_alloc_rxbufs(apc, ndev->mtu, apc->num_queues);
+		if (err) {
+			netdev_err(ndev,
+				   "Insufficient memory for new allocations\n");
+			apc->priv_flags = old_priv_flags;
+			goto clear_flag;
+		}

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing the callers of mana_pre_alloc_rxbufs(), does a failure during XDP setup leave a dangling pointer?

In drivers/net/ethernet/microsoft/mana/mana_bpf.c:mana_xdp_set(), apc->bpf_prog is updated before the allocation:

        apc->bpf_prog = prog;

If the allocation fails, the function returns early without cleaning up:

        err = mana_pre_alloc_rxbufs(apc, ndev->mtu, apc->num_queues);
        if (err) {
                NL_SET_ERR_MSG_MOD(extack,
                                   "XDP: Insufficient memory ...");
                return err;
        }
Quoted 8 lines

The core network stack handles the error by releasing its reference to the new BPF program, which may then be freed. Because the early return skips the err_dealloc_rxbuffs label, apc->bpf_prog is never reverted to old_prog. Could a subsequent interface flap execute mana_attach() and assign this freed BPF program to the hardware RX queues, causing a use-after-free?

Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2

As this Sashiko comment is for a pre-exisiting issue and not related to this patch, will send out a different patch for this.

Regards
Dipayaan Roy

#5 lore raw
In reply to Dipayaan Roy
This series was applied to netdev/net-next.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This series was applied to netdev/net-next.git (main) by Jakub Kicinski <[email protected]>:

Quoted 8 lines · On Tue, 28 Jul 2026 23:21:27 -0700 you wrote:

On some ARM64 platforms with 4K PAGE_SIZE, utilizing page_pool fragments for allocation in the RX refill path (~2kB buffer per fragment) causes 15-20% throughput regression under high connection counts (>16 TCP streams at 180+ Gbps). Using full-page buffers on these platforms shows no regression and restores line-rate performance.

[...]

Here is the summary with links:
- [net-next,v13,1/2] net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch

    https://git.kernel.org/netdev/net-next/c/d52f80731055
  - [net-next,v13,2/2] net: mana: force full-page RX buffers via ethtool private flag
    https://git.kernel.org/netdev/net-next/c/5b5cb75fb86a

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html