{"id":2224524,"url":"http://patchwork.ozlabs.org/api/1.2/covers/2224524/?format=json","web_url":"http://patchwork.ozlabs.org/project/intel-wired-lan/cover/cover.1776426683.git.poros@redhat.com/","project":{"id":46,"url":"http://patchwork.ozlabs.org/api/1.2/projects/46/?format=json","name":"Intel Wired Ethernet development","link_name":"intel-wired-lan","list_id":"intel-wired-lan.osuosl.org","list_email":"intel-wired-lan@osuosl.org","web_url":"","scm_url":"","webscm_url":"","list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"","list_archive_url":null,"date":"2026-04-17T14:29:41","name":"[iwl-net,v2,0/4] iavf: fix VLAN filter state machine races","submitter":{"id":74657,"url":"http://patchwork.ozlabs.org/api/1.2/people/74657/?format=json","name":"Petr Oros","email":"poros@redhat.com"},"mbox":"http://patchwork.ozlabs.org/project/intel-wired-lan/cover/cover.1776426683.git.poros@redhat.com/mbox/","series":[{"id":500351,"url":"http://patchwork.ozlabs.org/api/1.2/series/500351/?format=json","web_url":"http://patchwork.ozlabs.org/project/intel-wired-lan/list/?series=500351","date":"2026-04-17T14:29:41","name":"iavf: fix VLAN filter state machine races","version":2,"mbox":"http://patchwork.ozlabs.org/series/500351/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/covers/2224524/comments/","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","intel-wired-lan@lists.osuosl.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","intel-wired-lan@lists.osuosl.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=osuosl.org header.i=@osuosl.org header.a=rsa-sha256\n header.s=default header.b=3sFIplKj;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=osuosl.org\n (client-ip=140.211.166.137; helo=smtp4.osuosl.org;\n envelope-from=intel-wired-lan-bounces@osuosl.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxy2l6B5Sz1yDF\n\tfor ; Sat, 18 Apr 2026 00:30:07 +1000 (AEST)","from localhost (localhost [127.0.0.1])\n\tby smtp4.osuosl.org (Postfix) with ESMTP id BA27F406D7;\n\tFri, 17 Apr 2026 14:30:05 +0000 (UTC)","from smtp4.osuosl.org ([127.0.0.1])\n by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id 6hum3JqKJ73t; Fri, 17 Apr 2026 14:30:05 +0000 (UTC)","from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142])\n\tby smtp4.osuosl.org (Postfix) with ESMTP id F35DB406C7;\n\tFri, 17 Apr 2026 14:30:04 +0000 (UTC)","from smtp4.osuosl.org (smtp4.osuosl.org [IPv6:2605:bc80:3010::137])\n by lists1.osuosl.org (Postfix) with ESMTP id 3BC30396\n for ; Fri, 17 Apr 2026 14:30:04 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp4.osuosl.org (Postfix) with ESMTP id 2DFA7406C7\n for ; Fri, 17 Apr 2026 14:30:04 +0000 (UTC)","from smtp4.osuosl.org ([127.0.0.1])\n by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id 0em3AgLOYRSP for ;\n Fri, 17 Apr 2026 14:30:03 +0000 (UTC)","from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.129.124])\n by smtp4.osuosl.org (Postfix) with ESMTPS id 0D2C9406C5\n for ; Fri, 17 Apr 2026 14:30:01 +0000 (UTC)","from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com\n (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by\n relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3,\n cipher=TLS_AES_256_GCM_SHA384) id us-mta-209-IUGfYR2MOca36ebwIRMVDg-1; Fri,\n 17 Apr 2026 10:29:54 -0400","from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com\n (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS\n id 2E861195609E; Fri, 17 Apr 2026 14:29:52 +0000 (UTC)","from ShadowPeak.redhat.com (unknown [10.44.32.76])\n by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP\n id 7438C18004AD; Fri, 17 Apr 2026 14:29:47 +0000 (UTC)"],"X-Virus-Scanned":["amavis at osuosl.org","amavis at osuosl.org"],"X-Comment":"SPF check N/A for local connections - client-ip=140.211.166.142;\n helo=lists1.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org;\n receiver= ","DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp4.osuosl.org F35DB406C7","OpenDKIM Filter v2.11.0 smtp4.osuosl.org 0D2C9406C5"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org;\n\ts=default; t=1776436205;\n\tbh=QhuUMlw5oI66yhDBof2Uk4e9WvcaXPJJJdM3yIvPUsw=;\n\th=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:\n\t List-Post:List-Help:List-Subscribe:Cc:From;\n\tb=3sFIplKjTNn0KS2O1w1Xd3PLDDzx3aysD6xdnJHBAYNBiNT+FClPLlKMoObXH7Ur4\n\t TQfgHegIeD9gksQ9uHG4bQ6QNNn/JzB8ZDOBus1RL07D0I/eprcT6ZAj9pqR1vS8fp\n\t /cNSpeoxBCG+PCTVpPjWGQazYixOuiKVAry4I+Bah2gvsUVYI4niG56vTb8f6SJkjo\n\t t+Yc82mQqK3LlcAdrxd8q64Bebu9BG1qND2ktGeuuXlk0NkWNxOLYRt1P2e4JlkugG\n\t uWshSROmGeDBZM/8tWQYFYt0Brj7JNuK4oNfB63PV2yP6rv/rx9iA22MfqrNOVae9t\n\t 8OEgkzJLz60Eg==","Received-SPF":"Pass (mailfrom) identity=mailfrom; client-ip=170.10.129.124;\n helo=us-smtp-delivery-124.mimecast.com; envelope-from=poros@redhat.com;\n receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp4.osuosl.org 0D2C9406C5","X-MC-Unique":"IUGfYR2MOca36ebwIRMVDg-1","X-Mimecast-MFC-AGG-ID":"IUGfYR2MOca36ebwIRMVDg_1776436192","From":"Petr Oros ","To":"netdev@vger.kernel.org","Date":"Fri, 17 Apr 2026 16:29:41 +0200","Message-ID":"","MIME-Version":"1.0","X-Scanned-By":"MIMEDefang 3.4.1 on 10.30.177.93","X-Mimecast-MFC-PROC-ID":"c0OuCwVY5DPd0jUZ5b-nJAH3BphnRLsgS_zboJiDI50_1776436192","X-Mimecast-Originator":"redhat.com","Content-Transfer-Encoding":"8bit","content-type":"text/plain; charset=\"US-ASCII\"; x-default=true","X-Mailman-Original-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=redhat.com;\n s=mimecast20190719; t=1776436200;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding;\n bh=QhuUMlw5oI66yhDBof2Uk4e9WvcaXPJJJdM3yIvPUsw=;\n b=P3fV79jLIJ3TES42YgtTctbilksXD8crhX4xX/xu+A6X3WIDO3Jm6PZ330J2TfcLvO5M3Y\n 1aIRAP1xCyYLdXGgyySxfxJLYptXnnL4xC2+UcoSHT5Pp0PATTb1nmqeC/tSiUKc5yjFzE\n 7q0EImWQgkqEl3goQcC9xUGBm4Dubkg=","X-Mailman-Original-Authentication-Results":["smtp4.osuosl.org;\n dmarc=pass (p=quarantine dis=none)\n header.from=redhat.com","smtp4.osuosl.org;\n dkim=pass (1024-bit key,\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=P3fV79jL"],"Subject":"[Intel-wired-lan] [PATCH iwl-net v2 0/4] iavf: fix VLAN filter\n state machine races","X-BeenThere":"intel-wired-lan@osuosl.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Intel Wired Ethernet Linux Kernel Driver Development\n ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Cc":"Przemyslaw Patynowski ,\n Aaron Brown ,\n Przemek Kitszel ,\n Mitch Williams ,\n Eric Dumazet ,\n Jesse Brandeburg ,\n Andrew Lunn ,\n Tony Nguyen ,\n intel-wired-lan@lists.osuosl.org, jacob.e.keller@intel.com,\n Jakub Kicinski ,\n Jedrzej Jagielski ,\n Paolo Abeni , \"David S. Miller\" ,\n linux-kernel@vger.kernel.org","Errors-To":"intel-wired-lan-bounces@osuosl.org","Sender":"\"Intel-wired-lan\" "},"content":"The iavf VLAN filter state machine has several design issues that lead\nto race conditions between userspace add/del calls and the watchdog\ntask's virtchnl processing. Filters can get lost or leak HW resources,\nespecially during interface down/up cycles and namespace moves.\n\nThe root problems:\n\n1) On interface down, all VLAN filters are sent as DEL to PF and\n re-added on interface up. This is unnecessary and creates multiple\n race windows (details below).\n\n2) The DELETE path immediately frees the filter struct after sending\n the DEL message, without waiting for PF confirmation. If the PF\n rejects the DEL, the filter remains in HW but the driver lost its\n tracking structure. Race conditions between a pending DEL and\n add/reset operations cannot be resolved because the struct is gone.\n\n3) VIRTCHNL_OP_ADD_VLAN (V1) had no success completion handler, so\n filters stayed in IS_NEW state permanently.\n\n\nWhy removing VLAN filters on down/up is unnecessary:\n\nUnlike MAC filters, which need to be re-evaluated on up because the\nPF can administratively change the MAC address during down, VLAN\nfilters are purely user-controlled. The PF cannot change them while\nthe VF is down. When the VF goes down, VIRTCHNL_OP_DISABLE_QUEUES\nstops all traffic; VLAN filters sitting in PF HW are harmless\nbecause no packets flow through the disabled queues.\n\nCompare with other filter types in iavf_down():\n- MAC filters: only the current MAC is removed (it gets re-read from\n PF on up in case it was administratively changed)\n- Cloud filters: left as-is across down/up\n- FDIR filters: left as-is across down/up\n\nVLAN filters were the only type going through a full DEL+ADD cycle,\nand this caused real problems:\n\n- With spoofcheck enabled, the PF activates TX VLAN anti-spoof on\n the first non-zero VLAN ADD. During the re-add phase after up,\n the filter list is transiently incomplete; traffic for VLANs not\n yet re-added gets dropped by anti-spoof.\n\n- Rapid down/up can overlap with pending DEL messages. The old code\n used DISABLE/INACTIVE states to track this, but the DISABLE state\n could overwrite a concurrent REMOVE from userspace, causing the\n filter to be restored instead of deleted.\n\n- Namespace moves trigger implicit ndo_vlan_rx_kill_vid() calls\n concurrent with the down/up sequence. The DEL from the namespace\n teardown races with the DISABLE from iavf_down(), and the filter\n can end up leaked in num_vlan_filters with no associated netdev.\n\nAfter reset, VF-configured VLAN filters are properly re-added via\nthe VIRTCHNL_OP_GET_VF_RESOURCES / GET_OFFLOAD_VLAN_V2_CAPS response\nhandlers, which unconditionally set all filters to ADD state. This\npath is unaffected by these changes.\n\n\nThis series addresses all three issues:\n\nPatch 1 renames IS_NEW to ADDING for clarity.\n\nPatch 2 removes the DISABLE/INACTIVE state machinery so VLAN filters\nstay ACTIVE across down/up cycles. This is the core behavioral\nchange; VLAN filters are no longer sent as DEL to PF on interface\ndown, and iavf_restore_filters() is removed since there is nothing\nto restore.\n\nPatch 3 adds a REMOVING state to make the DELETE path symmetric with\nADD; filters are only freed after PF confirms the deletion. If the\nPF rejects the DEL, the filter reverts to ACTIVE instead of being\nlost.\n\nPatch 4 hardens the remaining race windows: adds V1 ADD success\nhandler and prevents redundant DEL on filters already in REMOVING\nstate.\n\nv2: Retarget from iwl-next to iwl-net; these are bug fixes.\n Rebase on current net tree (conflict resolved).\n\nPetr Oros (4):\n iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING\n iavf: stop removing VLAN filters from PF on interface down\n iavf: wait for PF confirmation before removing VLAN filters\n iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler\n\n drivers/net/ethernet/intel/iavf/iavf.h | 9 +--\n drivers/net/ethernet/intel/iavf/iavf_main.c | 52 +++----------\n .../net/ethernet/intel/iavf/iavf_virtchnl.c | 76 +++++++++----------\n 3 files changed, 52 insertions(+), 85 deletions(-)"}