[PATCH net 0/2] igb: Fix i210/i211 Rx timestamping loss and packet corruption

Hi!

This series fixes two issues with i210/i211 hardware Rx timestamping:

Patch 1 fixes a silent fallback to software timestamps. igb_setup_tx_mode()
unconditionally writes RXPBS, clearing CFG_TS_EN on every igb_up() (link
down/up, MTU change, or reset). Unlike other drivers (igc, i40e, ice),
hardware Rx timestamping fails to persist across link changes.

Patch 2 fixes frame corruption when enabling Rx timestamping at runtime.
RXPBS.CFG_TS_EN changes the packet buffer layout. Toggling it while Rx
queues are active creates a race where descriptor status and buffer layout
disagree for in-flight packets, corrupting Ethernet headers and dropping
frames silently. Fix by quiescing the Rx path around the change.

Patch 1 must precede patch 2, as the quiesce cycle in patch 2 invokes
igb_up() and would otherwise trigger the register clobber.

Best,
Pascal

Pascal Kneuper (2):
  igb: Preserve RXPBS.CFG_TS_EN in igb_setup_tx_mode
  igb: Quiesce the receive path before enabling i210 Rx timestamping

 drivers/net/ethernet/intel/igb/igb_main.c |  7 ++++++-
 drivers/net/ethernet/intel/igb/igb_ptp.c  | 17 +++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

-- 
2.47.3

Commit 05f9d3e1ae6e ("igb: Add support for CBS offload") restores the i210
Rx packet buffer size with an unmasked write to RXPBS. Bit 31 of RXPBS is
CFG_TS_EN, which enables per-packet Rx timestamping. Writing the register
unconditionally clears this bit on every igb_up() (link down/up, MTU
change, or driver reset).

Like other drivers (igc, i40e, ice), igb intends timestamping settings to
persist across link changes: igb_reset() calls igb_ptp_reset() to re-apply
tstamp_config and set CFG_TS_EN with queues stopped. igb_up() then clears
it immediately afterwards, undoing its own restore.

igb_ptp_hwtstamp_get() returns cached settings and never reads the
register, masking the fallback to software timestamps. On an i210, a link
flap increases PTP path delay from <1us to tens of microseconds.

Fix by masking the buffer size field, as the FQTSS branch already does.

Fixes: 05f9d3e1ae6e ("igb: Add support for CBS offload")
Signed-off-by: Pascal Kneuper <redacted>
---
 drivers/net/ethernet/intel/igb/igb_main.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index d4a897a8c82c6..0f3c728a07fb1 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c

@@ -1947,7 +1947,12 @@ static void igb_setup_tx_mode(struct igb_adapter *adapter)
 			igb_config_tx_modes(adapter, i);
 		}
 	} else {
-		wr32(E1000_RXPBS, I210_RXPBSIZE_DEFAULT);
+		/* Preserve RXPBS.CFG_TS_EN so Rx timestamping settings
+		 * persist across link changes.
+		 */
+		val = rd32(E1000_RXPBS) & E1000_RXPBS_CFG_TS_EN;
+		wr32(E1000_RXPBS, val | I210_RXPBSIZE_DEFAULT);
+
 		wr32(E1000_TXPBS, I210_TXPBSIZE_DEFAULT);
 		wr32(E1000_I210_DTXMXPKTSZ, I210_DTXMXPKTSZ_DEFAULT);
 

-- 
2.47.3

Commit e57b8bdb4833 ("igb: Add 1588 support to I210/I211.") enables
per-packet Rx timestamping by setting RXPBS.CFG_TS_EN with Rx queues
running. On i210/i211, CFG_TS_EN makes the DMA engine prepend a 16-byte
timestamp header to every Rx packet buffer and sets RXDADV_STAT_TSIP in the
Rx descriptor so igb_clean_rx_irq() strips it.

Setting CFG_TS_EN changes the buffer layout of already-armed descriptors.
Without a pipeline handshake, descriptor status and packet buffer layout
disagree for in-flight packets:

  header inserted, no TSIP -> unstripped, frame shifted 16 bytes right
  TSIP set, no header      -> 16 bytes stripped, buffer tail appended

In both cases the Ethernet header is corrupted, causing protocol demux to
drop the frame silently. Because igb_alloc_mapped_page() allocates pages
without __GFP_ZERO, the second case appends uninitialized memory.

This occurs reliably on i210/i211 under traffic when requesting hardware
timestamps at runtime, yielding corrupt frames on off-to-on transitions.

Fix by bracketing the CFG_TS_EN transition with igb_down() and igb_up()
when the interface is running, ensuring the bit is only toggled with Rx
queues stopped.

Fixes: e57b8bdb4833 ("igb: Add 1588 support to I210/I211.")
Signed-off-by: Pascal Kneuper <redacted>
---
 drivers/net/ethernet/intel/igb/igb_ptp.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
index 638d8242b66bb..4da26e997f92c 100644
--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
+++ b/drivers/net/ethernet/intel/igb/igb_ptp.c

@@ -1283,9 +1283,26 @@ int igb_ptp_hwtstamp_set(struct net_device *netdev,
 			 struct netlink_ext_ack *extack)
 {
 	struct igb_adapter *adapter = netdev_priv(netdev);
+	struct e1000_hw *hw = &adapter->hw;
+	bool quiesce = false;
 	int err;
 
+	/* CFG_TS_EN changes the Rx buffer layout, so flipping it on a live
+	 * queue leaves the descriptor and the data disagreeing about the
+	 * 16 byte timestamp header for one window, mangling a frame.
+	 */
+	if ((hw->mac.type == e1000_i210 || hw->mac.type == e1000_i211) &&
+	    netif_running(netdev) &&
+	    !(rd32(E1000_RXPBS) & E1000_RXPBS_CFG_TS_EN)) {
+		quiesce = true;
+		igb_down(adapter);
+	}
+
 	err = igb_ptp_set_timestamp_mode(adapter, config);
+
+	if (quiesce)
+		igb_up(adapter);
+
 	if (err)
 		return err;
 

-- 
2.47.3

Reviewed-by: Aleksandr Loktionov <redacted>

-----Original Message-----
From: Pascal Kneuper <redacted> 
Sent: Thursday, September 10, 2026 4:39 AM
To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel, Przemyslaw <przemyslaw.kitszel@intel.com>; Andrew Lunn <andrew+netdev@lunn.ch>; David S . Miller <davem@davemloft.net>; Eric Dumazet <redacted>; Jakub Kicinski <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>
Cc: Baldin, Daniel <redacted>; intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Kneuper, Paskal <redacted>
Subject: [PATCH net 1/2] igb: Preserve RXPBS.CFG_TS_EN in igb_setup_tx_mode

Commit 05f9d3e1ae6e ("igb: Add support for CBS offload") restores the i210 Rx packet buffer size with an unmasked write to RXPBS. Bit 31 of RXPBS is CFG_TS_EN, which enables per-packet Rx timestamping. Writing the register unconditionally clears this bit on every igb_up() (link down/up, MTU change, or driver reset).

Like other drivers (igc, i40e, ice), igb intends timestamping settings to persist across link changes: igb_reset() calls igb_ptp_reset() to re-apply tstamp_config and set CFG_TS_EN with queues stopped. igb_up() then clears it immediately afterwards, undoing its own restore.

igb_ptp_hwtstamp_get() returns cached settings and never reads the register, masking the fallback to software timestamps. On an i210, a link flap increases PTP path delay from <1us to tens of microseconds.

Fix by masking the buffer size field, as the FQTSS branch already does.

Fixes: 05f9d3e1ae6e ("igb: Add support for CBS offload")
Signed-off-by: Pascal Kneuper <redacted>
---
 drivers/net/ethernet/intel/igb/igb_main.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

Tested-by: Alexander Nowlin <redacted>

-----Original Message-----
From: Pascal Kneuper <redacted> 
Sent: Thursday, September 10, 2026 4:39 AM
To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel, Przemyslaw <przemyslaw.kitszel@intel.com>; Andrew Lunn <andrew+netdev@lunn.ch>; David S . Miller <davem@davemloft.net>; Eric Dumazet <redacted>; Jakub Kicinski <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>
Cc: Baldin, Daniel <redacted>; intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Kneuper, Paskal <redacted>
Subject: [PATCH net 2/2] igb: Quiesce the receive path before enabling i210 Rx timestamping

Commit e57b8bdb4833 ("igb: Add 1588 support to I210/I211.") enables per-packet Rx timestamping by setting RXPBS.CFG_TS_EN with Rx queues running. On i210/i211, CFG_TS_EN makes the DMA engine prepend a 16-byte timestamp header to every Rx packet buffer and sets RXDADV_STAT_TSIP in the Rx descriptor so igb_clean_rx_irq() strips it.

Setting CFG_TS_EN changes the buffer layout of already-armed descriptors.
Without a pipeline handshake, descriptor status and packet buffer layout disagree for in-flight packets:

  header inserted, no TSIP -> unstripped, frame shifted 16 bytes right
  TSIP set, no header      -> 16 bytes stripped, buffer tail appended

In both cases the Ethernet header is corrupted, causing protocol demux to drop the frame silently. Because igb_alloc_mapped_page() allocates pages without __GFP_ZERO, the second case appends uninitialized > memory.

This occurs reliably on i210/i211 under traffic when requesting hardware timestamps at runtime, yielding corrupt frames on off-to-on transitions.

Fix by bracketing the CFG_TS_EN transition with igb_down() and igb_up() when the interface is running, ensuring the bit is only toggled with Rx queues stopped.

Fixes: e57b8bdb4833 ("igb: Add 1588 support to I210/I211.")
Signed-off-by: Pascal Kneuper <redacted>
---
 drivers/net/ethernet/intel/igb/igb_ptp.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

Tested-by: Alexander Nowlin <redacted>