patch 'net/bnxt: roll back Tx descriptors for invalid packets' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/01/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/42c73f84096ad0859abeb643a912e33933d21bb7

Thanks.

Kevin

---
>From 42c73f84096ad0859abeb643a912e33933d21bb7 Mon Sep 17 00:00:00 2001
From: Zoe Cheimets <zoe.cheimets at broadcom.com>
Date: Wed, 3 Jun 2026 21:18:47 -0600
Subject: [PATCH] net/bnxt: roll back Tx descriptors for invalid packets

[ upstream commit 3bca8405f09fa8b9e63987fe0b070cbb5a5d82d2 ]

When bnxt_start_xmit() returned -EINVAL for a bad packet, the burst
loop broke immediately, dropping all subsequent valid packets. The
Tx ring was also left in a corrupt state because tx_raw_prod was not
rolled back after a partial descriptor write. Additionally, the
tx_mbuf_drop oerrors accumulation was gated behind a tx_started
check, silently omitting drops from the statistics.

Fix by rolling back tx_raw_prod and any partially-written ring slots
on the drop path, replacing the break with continue so the burst
loop keeps processing remaining packets, and moving the tx_mbuf_drop
read to before the tx_started guard in both stats paths. Return
value is corrected to RTE_MIN(nb_tx_pkts + dropped, nb_pkts) to
accurately report consumed packet count.

Fixes: 220de9869bc3 ("net/bnxt: optimize Tx batching")

Signed-off-by: Zoe Cheimets <zoe.cheimets at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/bnxt_txr.c | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/drivers/net/bnxt/bnxt_txr.c b/drivers/net/bnxt/bnxt_txr.c
index e422a9be81..8e6ed1a09d 100644
--- a/drivers/net/bnxt/bnxt_txr.c
+++ b/drivers/net/bnxt/bnxt_txr.c
@@ -236,6 +236,8 @@ static int bnxt_start_xmit(struct rte_mbuf *tx_pkt,
 				struct tx_bd_long **last_txbd)
 {
+	struct tx_bd_long *last_txbd_save = *last_txbd;
 	struct bnxt_tx_ring_info *txr = txq->tx_ring;
 	struct bnxt_ring *ring = txr->tx_ring_struct;
+	uint16_t tx_raw_prod_save = txr->tx_raw_prod;
 	uint32_t outer_tpid_bd = 0;
 	struct tx_bd_long *txbd;
@@ -244,5 +246,5 @@ static int bnxt_start_xmit(struct rte_mbuf *tx_pkt,
 	bool long_bd = false;
 	unsigned short nr_bds;
-	uint16_t prod;
+	uint16_t prod, idx;
 	bool pkt_needs_ts = 0;
 	struct rte_mbuf *m_seg;
@@ -506,4 +508,22 @@ static int bnxt_start_xmit(struct rte_mbuf *tx_pkt,
 	return 0;
 drop:
+	/* Roll back any descriptors and tx_buf_ring slots that were written
+	 * for this packet before the failure was detected.  Walking from the
+	 * saved producer index up to (but not including) the current one is
+	 * safe because we hold the Tx lock and the HW has not been notified
+	 * (the doorbell is only rung after bnxt_start_xmit() returns
+	 * successfully).
+	 */
+	idx = tx_raw_prod_save;
+
+	while (idx != txr->tx_raw_prod) {
+		uint16_t slot = RING_IDX(ring, idx);
+
+		txr->tx_buf_ring[slot] = NULL;
+		txr->tx_desc_ring[slot].address = 0;
+		idx = RING_NEXT(idx);
+	}
+	txr->tx_raw_prod = tx_raw_prod_save;
+	*last_txbd = last_txbd_save;
 	rte_pktmbuf_free(tx_pkt);
 ret:
@@ -819,7 +839,9 @@ uint16_t _bnxt_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,
 		if (unlikely(rc)) {
 			if (rc == -EINVAL) {
+				coal_pkts--;
 				rte_atomic_fetch_add_explicit(&txq->tx_mbuf_drop, 1,
 							      rte_memory_order_relaxed);
 				dropped++;
+				continue;
 			}
 			break;
@@ -827,5 +849,9 @@ uint16_t _bnxt_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,
 	}
 
-	if (likely(nb_tx_pkts)) {
+	/* last_txbd is used to check for if any packets have been sent in
+	 * the burst as bnxt_start_xmit will update it to the most recent
+	 * non-dropped buffer descriptor in the burst.
+	 */
+	if (likely(last_txbd != NULL)) {
 		/* Request a completion on the last packet */
 		last_txbd->flags_type &= ~TX_BD_LONG_FLAGS_NO_CMPL;
@@ -833,6 +859,6 @@ uint16_t _bnxt_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,
 	}
 
-	nb_tx_pkts += dropped;
-	return nb_tx_pkts;
+	return RTE_MIN((uint16_t)(nb_tx_pkts + dropped), nb_pkts);
+
 }
 
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-28 16:54:51.641901662 +0100
+++ 0028-net-bnxt-roll-back-Tx-descriptors-for-invalid-packet.patch	2026-07-28 16:54:50.769580015 +0100
@@ -1 +1 @@
-From 3bca8405f09fa8b9e63987fe0b070cbb5a5d82d2 Mon Sep 17 00:00:00 2001
+From 42c73f84096ad0859abeb643a912e33933d21bb7 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 3bca8405f09fa8b9e63987fe0b070cbb5a5d82d2 ]
+
@@ -21 +22,0 @@
-Cc: stable at dpdk.org
@@ -30 +31 @@
-index a9469ca366..3fae0824d1 100644
+index e422a9be81..8e6ed1a09d 100644
@@ -33 +34 @@
-@@ -239,6 +239,8 @@ static int bnxt_start_xmit(struct rte_mbuf *tx_pkt,
+@@ -236,6 +236,8 @@ static int bnxt_start_xmit(struct rte_mbuf *tx_pkt,
@@ -42 +43 @@
-@@ -247,5 +249,5 @@ static int bnxt_start_xmit(struct rte_mbuf *tx_pkt,
+@@ -244,5 +246,5 @@ static int bnxt_start_xmit(struct rte_mbuf *tx_pkt,
@@ -49 +50 @@
-@@ -509,4 +511,22 @@ static int bnxt_start_xmit(struct rte_mbuf *tx_pkt,
+@@ -506,4 +508,22 @@ static int bnxt_start_xmit(struct rte_mbuf *tx_pkt,
@@ -72 +73 @@
-@@ -838,7 +858,9 @@ uint16_t _bnxt_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,
+@@ -819,7 +839,9 @@ uint16_t _bnxt_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,
@@ -82 +83 @@
-@@ -846,5 +868,9 @@ uint16_t _bnxt_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,
+@@ -827,5 +849,9 @@ uint16_t _bnxt_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,
@@ -93 +94 @@
-@@ -852,6 +878,6 @@ uint16_t _bnxt_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,
+@@ -833,6 +859,6 @@ uint16_t _bnxt_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,