[PATCH 0/9] Stability fixes for GVE

[PATCH 0/9] Stability fixes for GVE

[Joshua Washington]

This patch series consists of mostly unrelated fixes in the GVE driver.

Joshua Washington (9):
  net/gve: clear out shared memory region for stats report
  net/gve: delay adding mbuf head to software ring
  net/gve: copy data to QPL buffer when mbuf read does not
  net/gve: validate buf ID before processing Rx packet
  net/gve: set mbuf to null in software ring after use
  net/gve: free ctx mbuf if packet dropped after first segment
  net/gve: increase range of DMA memzone ids to 64 bits
  net/gve: don't reset ring size bounds to default on reset
  net/gve: restrict max ring size in GQ QPL to 2K

 drivers/net/gve/base/gve_adminq.c | 12 ++++++---
 drivers/net/gve/base/gve_osdep.h  |  4 +--
 drivers/net/gve/gve_ethdev.c      |  8 +++---
 drivers/net/gve/gve_ethdev.h      |  1 +
 drivers/net/gve/gve_rx.c          |  3 +++
 drivers/net/gve/gve_rx_dqo.c      |  6 +++++
 drivers/net/gve/gve_tx.c          | 42 +++++++++++++++++++------------
 7 files changed, 52 insertions(+), 24 deletions(-)

-- 
2.55.0.rc0.799.gd6f94ed593-goog

[PATCH 1/9] net/gve: clear out shared memory region for stats report

[Joshua Washington]

The stats report memzone is allocated from hugepage memory which could
possibly have had sensitive data from a previous DPDK invocation.

Clear out the buffer before sharing the memory region with the virtual
device to protect guest memory.

Fixes: 458b53dec01e ("net/gve: enable imissed stats for GQ format")
Cc: stable@dpdk.org
Signed-off-by: Joshua Washington <joshwash@google.com>
Reviewed-by: Mark Blasko <blasko@google.com>
---
 drivers/net/gve/gve_ethdev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/gve/gve_ethdev.c b/drivers/net/gve/gve_ethdev.c
index 0b02dcb3ad..f73784a109 100644
--- a/drivers/net/gve/gve_ethdev.c
+++ b/drivers/net/gve/gve_ethdev.c
@@ -306,6 +306,8 @@ gve_alloc_stats_report(struct gve_priv *priv,
 	if (!priv->stats_report_mem)
 		return -ENOMEM;
 
+	memset(priv->stats_report_mem->addr, 0, priv->stats_report_mem->len);
+
 	/* offset by skipping stats written by gve. */
 	priv->stats_start_idx = (GVE_TX_STATS_REPORT_NUM * nb_tx_queues) +
 		(GVE_RX_STATS_REPORT_NUM * nb_rx_queues);
-- 
2.55.0.rc0.799.gd6f94ed593-goog

[PATCH 2/9] net/gve: delay adding mbuf head to software ring

[Joshua Washington]

The GQ TX datapath was set up to write the mbuf head into the sw_ring
before writing the descriptors. This poses a problem because it's
possible for the packet to be dropped due to lacking the FIFO space to
do a proper TX. In such a case, the packet won't be sent, and will lead
to leaked mbufs in the subsequent segments.

There is also no real reason that the head mbuf must be set in the
sw_ring separately from the others; the mbuf chain is not actually
walked as part of GQ TX.

Fixes: a46583cf43c8 ("net/gve: support Rx/Tx")
Cc: stable@dpdk.org
Signed-off-by: Joshua Washington <joshwash@google.com>
Reviewed-by: Jasper Tran O'Leary <jtranoleary@google.com>
---
 drivers/net/gve/gve_tx.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/gve/gve_tx.c b/drivers/net/gve/gve_tx.c
index 5c73c21b8d..59c82b04ed 100644
--- a/drivers/net/gve/gve_tx.c
+++ b/drivers/net/gve/gve_tx.c
@@ -301,7 +301,6 @@ gve_tx_burst_qpl(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
 			(uint32_t)(tx_offload.l2_len + tx_offload.l3_len + tx_offload.l4_len) :
 			tx_pkt->pkt_len;
 
-		sw_ring[sw_id] = tx_pkt;
 		if (!is_fifo_avail(txq, hlen)) {
 			gve_tx_clean(txq);
 			if (!is_fifo_avail(txq, hlen))
@@ -344,13 +343,14 @@ gve_tx_burst_qpl(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
 		}
 
 		/* record mbuf in sw_ring for free */
-		for (i = 1; i < first->nb_segs; i++) {
+		for (i = 0; i < first->nb_segs; i++) {
+			if (!tx_pkt)
+				break;
+			sw_ring[sw_id] = tx_pkt;
 			sw_id = (sw_id + 1) & mask;
 			tx_pkt = tx_pkt->next;
-			sw_ring[sw_id] = tx_pkt;
 		}
 
-		sw_id = (sw_id + 1) & mask;
 		tx_id = (tx_id + 1) & mask;
 
 		txq->nb_free -= nb_used;
-- 
2.55.0.rc0.799.gd6f94ed593-goog

[PATCH 3/9] net/gve: copy data to QPL buffer when mbuf read does not

[Joshua Washington]

The rte_pktmbuf_read method does not guarantee that data will be copied
from an mbuf. If the requested data is all contiguous, the method will
instead return a pointer to the memory location within the buffer that
should be read from, leaving the destination buffer empty.

This is problematic for TSO/multi-segment TX packets which only make use
of two mbufs. If all data in the second mbuf is contiguous, the data
will not be read to QPL memory.

Update the QPL copy logic to copy if the rte_pktmbuf_read does not.

Fixes: a46583cf43c8 ("net/gve: support Rx/Tx")
Cc: stable@dpdk.org
Signed-off-by: Joshua Washington <joshwash@google.com>
Reviewed-by: Jasper Tran O'Leary <jtranoleary@google.com>
---
 drivers/net/gve/gve_tx.c | 34 ++++++++++++++++++++++------------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/drivers/net/gve/gve_tx.c b/drivers/net/gve/gve_tx.c
index 59c82b04ed..2f5a7b0a2e 100644
--- a/drivers/net/gve/gve_tx.c
+++ b/drivers/net/gve/gve_tx.c
@@ -273,6 +273,9 @@ gve_tx_burst_qpl(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
 		gve_tx_clean_swr_qpl(txq);
 
 	for (nb_tx = 0; nb_tx < nb_pkts; nb_tx++) {
+		const void *mbuf_header_addr;
+		void *qpl_write_addr;
+
 		tx_pkt = *tx_pkts++;
 		ol_flags = tx_pkt->ol_flags;
 
@@ -317,26 +320,33 @@ gve_tx_burst_qpl(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
 					goto end_of_tx;
 			}
 		}
-		if (tx_pkt->nb_segs == 1 || ol_flags & RTE_MBUF_F_TX_TCP_SEG)
-			rte_memcpy((void *)(size_t)(fifo_addr + txq->fifo_base),
-				   (void *)(size_t)addr, hlen);
-		else
-			rte_pktmbuf_read(tx_pkt, 0, hlen,
-					 (void *)(size_t)(fifo_addr + txq->fifo_base));
+
+		qpl_write_addr = (void *)(size_t)(fifo_addr + txq->fifo_base);
+		mbuf_header_addr = rte_pktmbuf_read(tx_pkt, 0, hlen, qpl_write_addr);
+
+		/* Header data is linear in the mbuf head. Copy directly. */
+		if (mbuf_header_addr != qpl_write_addr)
+			rte_memcpy(qpl_write_addr, mbuf_header_addr, hlen);
+
 		gve_tx_fill_pkt_desc(txd, tx_pkt, nb_used, hlen, fifo_addr);
 
 		if (ol_flags & RTE_MBUF_F_TX_TCP_SEG) {
+			const void *mbuf_payload_addr;
+
 			tx_id = (tx_id + 1) & mask;
 			txd = &txr[tx_id];
 			addr = (uint64_t)(tx_pkt->buf_addr) + tx_pkt->data_off + hlen;
 			fifo_addr = gve_tx_alloc_from_fifo(txq, tx_id, tx_pkt->pkt_len - hlen);
-			if (tx_pkt->nb_segs == 1)
-				rte_memcpy((void *)(size_t)(fifo_addr + txq->fifo_base),
-					   (void *)(size_t)addr,
+			qpl_write_addr = (void *)(txq->fifo_base + fifo_addr);
+			mbuf_payload_addr = rte_pktmbuf_read(tx_pkt, hlen, tx_pkt->pkt_len - hlen,
+							     qpl_write_addr);
+
+			/* Payload data is contiguous. Take the offset from the
+			 * read request and copy from there.
+			 */
+			if (mbuf_payload_addr != qpl_write_addr)
+				rte_memcpy(qpl_write_addr, mbuf_payload_addr,
 					   tx_pkt->pkt_len - hlen);
-			else
-				rte_pktmbuf_read(tx_pkt, hlen, tx_pkt->pkt_len - hlen,
-						 (void *)(size_t)(fifo_addr + txq->fifo_base));
 
 			gve_tx_fill_seg_desc(txd, ol_flags, tx_offload,
 					     tx_pkt->pkt_len - hlen, fifo_addr);
-- 
2.55.0.rc0.799.gd6f94ed593-goog

[PATCH 4/9] net/gve: validate buf ID before processing Rx packet

[Joshua Washington]

The buffer id is part of the RX completion descriptor for packets in the
DQ format. This value can technically go up to 64K, while the max RX
ring size is 4K, meaning that there could similarly be an expected 4K RX
buffer IDs. Validate that the RX buffer ID is valid before attempting to
access it in the sw_ring to prevent a potential out of bounds in the
event of a hardware error.

Fixes: 1aed73b23ac0 ("net/gve: support out-of-order completions on DQ Rx")
Cc: stable@dpdk.org
Signed-off-by: Joshua Washington <joshwash@google.com>
Reviewed-by: Jasper Tran O'Leary <jtranoleary@google.com>
---
 drivers/net/gve/gve_rx_dqo.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/gve/gve_rx_dqo.c b/drivers/net/gve/gve_rx_dqo.c
index cc343f3fd8..c4e2d32067 100644
--- a/drivers/net/gve/gve_rx_dqo.c
+++ b/drivers/net/gve/gve_rx_dqo.c
@@ -200,6 +200,11 @@ gve_rx_burst_dqo(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 		}
 
 		rx_buf_id = rte_le_to_cpu_16(rx_desc->buf_id);
+		if (unlikely(rx_buf_id >= rxq->nb_rx_desc)) {
+			PMD_DRV_DP_LOG(ERR, "Invalid buf_id %d", rx_buf_id);
+			continue;
+		}
+
 		rxm = rxq->sw_ring[rx_buf_id];
 		gve_completed_buf_list_push(rxq, rx_buf_id);
 
-- 
2.55.0.rc0.799.gd6f94ed593-goog

[PATCH 5/9] net/gve: set mbuf to null in software ring after use

[Joshua Washington]

Currently, it is possible for mbufs to be uncleared in the sw_ring after
being returned to the application. This causes an erroneous
dual-ownership over the buffer until GVE cleans the buffer queue and
posts new mbufs, overwriting the older pointers. It is possible in such
a case for a double free to occur while tearing down rings, as both
the application and the driver could attempt to free the same mbuf.
Release ownership of the mbuf from the sw_ring as soon as appropriate to
avoid such a scenario.

Fixes: a46583cf43c8 ("net/gve: support Rx/Tx")
Fixes: 45da16b5b181 ("net/gve: support basic Rx data path for DQO")
Cc: stable@dpdk.org
Signed-off-by: Joshua Washington <joshwash@google.com>
Reviewed-by: Jasper Tran O'Leary <jtranoleary@google.com>
---
 drivers/net/gve/gve_rx.c     | 1 +
 drivers/net/gve/gve_rx_dqo.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/net/gve/gve_rx.c b/drivers/net/gve/gve_rx.c
index 625649cdcf..cda87af294 100644
--- a/drivers/net/gve/gve_rx.c
+++ b/drivers/net/gve/gve_rx.c
@@ -152,6 +152,7 @@ gve_rx(struct gve_rx_queue *rxq, volatile struct gve_rx_desc *rxd, uint16_t rx_i

 	rxe = rxq->sw_ring[rx_id];
 	gve_rx_mbuf(rxq, rxe, frag_size, rx_id);
+	rxq->sw_ring[rx_id] = NULL;
 	rxq->stats.bytes += frag_size;

 	if (is_first_frag) {
diff --git a/drivers/net/gve/gve_rx_dqo.c b/drivers/net/gve/gve_rx_dqo.c
index c4e2d32067..3665d9e4cd 100644
--- a/drivers/net/gve/gve_rx_dqo.c
+++ b/drivers/net/gve/gve_rx_dqo.c
@@ -207,6 +207,7 @@ gve_rx_burst_dqo(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)

 		rxm = rxq->sw_ring[rx_buf_id];
 		gve_completed_buf_list_push(rxq, rx_buf_id);
+		rxq->sw_ring[rx_buf_id] = NULL;

 		/* Free buffer and report error. */
 		if (unlikely(rx_desc->rx_error)) {
--
2.55.0.rc0.799.gd6f94ed593-goog

[PATCH 6/9] net/gve: free ctx mbuf if packet dropped after first segment

[Joshua Washington]

GVE GQ has support for multi-descriptor RX. It is possible for a packet
to be dropped after the first descriptor has been processed and an mbuf
has been added to the context. In such a case, the mbuf head should be
freed before clearing the context so that mbufs aren't leaked.

Fixes: 496d4d2c8b54 ("net/gve: support jumbo frame for GQI")
Cc: stable@dpdk.org
Signed-off-by: Joshua Washington <joshwash@google.com>
Reviewed-by: Jasper Tran O'Leary <jtranoleary@google.com>
---
 drivers/net/gve/gve_rx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/gve/gve_rx.c b/drivers/net/gve/gve_rx.c
index cda87af294..567b82d020 100644
--- a/drivers/net/gve/gve_rx.c
+++ b/drivers/net/gve/gve_rx.c
@@ -205,6 +205,8 @@ gve_rx_burst(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 		if (gve_rx(rxq, rxd, rx_id)) {
 			if (!ctx->drop_pkt)
 				rx_pkts[nb_rx++] = ctx->mbuf_head;
+			else if (ctx->mbuf_head != NULL)
+				rte_pktmbuf_free(ctx->mbuf_head);
 			rxq->nb_avail += ctx->total_frags;
 			gve_rx_ctx_clear(ctx);
 		}
--
2.55.0.rc0.799.gd6f94ed593-goog

[PATCH 7/9] net/gve: increase range of DMA memzone ids to 64 bits

[Joshua Washington]

Long running programs can very easily eclipse this 16-bit range, leading
to name collisions and failed DMA region allocations despite there being
plenty of available memory.

Fixes: c9ba2caf6302 ("net/gve/base: add OS-specific implementation")
Cc: stable@dpdk.org
Signed-off-by: Joshua Washington <joshwash@google.com>
Reviewed-by: Jasper Tran O'Leary <jtranoleary@google.com>
---
 drivers/net/gve/base/gve_osdep.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/gve/base/gve_osdep.h b/drivers/net/gve/base/gve_osdep.h
index c47ce4da85..55629a0e1a 100644
--- a/drivers/net/gve/base/gve_osdep.h
+++ b/drivers/net/gve/base/gve_osdep.h
@@ -175,14 +175,14 @@ struct gve_dma_mem {
 static inline void *
 gve_alloc_dma_mem(struct gve_dma_mem *mem, u64 size)
 {
-	static RTE_ATOMIC(uint16_t) gve_dma_memzone_id;
+	static RTE_ATOMIC(uint64_t) gve_dma_memzone_id;
 	const struct rte_memzone *mz = NULL;
 	char z_name[RTE_MEMZONE_NAMESIZE];
 
 	if (!mem)
 		return NULL;
 
-	snprintf(z_name, sizeof(z_name), "gve_dma_%u",
+	snprintf(z_name, sizeof(z_name), "gve_dma_%" PRIu64,
 		 rte_atomic_fetch_add_explicit(&gve_dma_memzone_id, 1, rte_memory_order_relaxed));
 	mz = rte_memzone_reserve_aligned(z_name, size, SOCKET_ID_ANY,
 					 RTE_MEMZONE_IOVA_CONTIG,
-- 
2.55.0.rc0.799.gd6f94ed593-goog

[PATCH 8/9] net/gve: don't reset ring size bounds to default on reset

[Joshua Washington]

On device reset, GVE skips describe_device functionality, as the device
is not expected to change on a reset. However, before skipping the
describe_device functionality, GVE still sets the ring sizes to their
default values. This effectively removes the ability to create queues
with higher-than-default descriptor counts after a reset.

Fix this behavior by only setting the default ring size bounds is
describe_device is being executed.

Fixes: 1bf64edce3c4 ("net/gve: add reset path")
Cc: stable@dpdk.org
Signed-off-by: Joshua Washington <joshwash@google.com>
Reviewed-by: Jasper Tran O'Leary <jtranoleary@google.com>
---
 drivers/net/gve/gve_ethdev.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/gve/gve_ethdev.c b/drivers/net/gve/gve_ethdev.c
index f73784a109..c990920a4d 100644
--- a/drivers/net/gve/gve_ethdev.c
+++ b/drivers/net/gve/gve_ethdev.c
@@ -1579,12 +1579,12 @@ gve_init_priv(struct gve_priv *priv, bool skip_describe_device)
 		goto free_adminq;
 	}
 
-	/* Set default descriptor counts */
-	gve_set_default_ring_size_bounds(priv);
-
 	if (skip_describe_device)
 		goto setup_device;
 
+	/* Set default descriptor counts */
+	gve_set_default_ring_size_bounds(priv);
+
 	/* Get the initial information we need from the device */
 	err = gve_adminq_describe_device(priv);
 	if (err) {
-- 
2.55.0.rc0.799.gd6f94ed593-goog

[PATCH 9/9] net/gve: restrict max ring size in GQ QPL to 2K

[Joshua Washington]

The GQ QPL queue format has a maximum supported ring size of 2k.
However, it is possible in some cases for the device to pass a larger
ring size as the max ring size. Restrict the ring size in the driver to
ensure that rings with invalid queue depths are not created.

Fixes: cde01d164f8f ("net/gve: support modifying ring size in GQ format")
Cc: stable@dpdk.org
Signed-off-by: Joshua Washington <joshwash@google.com>
Reviewed-by: Jasper Tran O'Leary <jtranoleary@google.com>
---
 drivers/net/gve/base/gve_adminq.c | 12 +++++++++---
 drivers/net/gve/gve_ethdev.h      |  1 +
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/net/gve/base/gve_adminq.c b/drivers/net/gve/base/gve_adminq.c
index 2b25c7f390..315e2456fd 100644
--- a/drivers/net/gve/base/gve_adminq.c
+++ b/drivers/net/gve/base/gve_adminq.c
@@ -6,6 +6,7 @@
 #include "../gve_ethdev.h"
 #include "gve_adminq.h"
 #include "gve_register.h"
+#include "rte_common.h"
 
 #define GVE_MAX_ADMINQ_RELEASE_CHECK	500
 #define GVE_ADMINQ_SLEEP_LEN		20
@@ -946,15 +947,20 @@ static void
 gve_set_max_desc_cnt(struct gve_priv *priv,
 	const struct gve_device_option_modify_ring *modify_ring)
 {
+	priv->max_rx_desc_cnt = be16_to_cpu(modify_ring->max_ring_size.rx);
+	priv->max_tx_desc_cnt = be16_to_cpu(modify_ring->max_ring_size.tx);
+
 	if (priv->queue_format == GVE_DQO_RDA_FORMAT) {
 		PMD_DRV_LOG(DEBUG, "Overriding max ring size from device for DQ "
 			    "queue format to 4096.");
 		priv->max_rx_desc_cnt = GVE_MAX_QUEUE_SIZE_DQO;
 		priv->max_tx_desc_cnt = GVE_MAX_QUEUE_SIZE_DQO;
-		return;
+	} else if (priv->queue_format == GVE_GQI_QPL_FORMAT) {
+		priv->max_rx_desc_cnt = RTE_MIN(priv->max_rx_desc_cnt,
+						GVE_MAX_RING_SIZE_GQ_QPL);
+		priv->max_tx_desc_cnt = RTE_MIN(priv->max_tx_desc_cnt,
+						GVE_MAX_RING_SIZE_GQ_QPL);
 	}
-	priv->max_rx_desc_cnt = be16_to_cpu(modify_ring->max_ring_size.rx);
-	priv->max_tx_desc_cnt = be16_to_cpu(modify_ring->max_ring_size.tx);
 }
 
 static void gve_enable_supported_features(struct gve_priv *priv,
diff --git a/drivers/net/gve/gve_ethdev.h b/drivers/net/gve/gve_ethdev.h
index 4a7e5ecdf3..c9a176ff17 100644
--- a/drivers/net/gve/gve_ethdev.h
+++ b/drivers/net/gve/gve_ethdev.h
@@ -21,6 +21,7 @@
 #define DQO_TX_MULTIPLIER 4
 
 #define GVE_DEFAULT_MAX_RING_SIZE	1024
+#define GVE_MAX_RING_SIZE_GQ_QPL	2048
 #define GVE_DEFAULT_MIN_RX_RING_SIZE	512
 #define GVE_DEFAULT_MIN_TX_RING_SIZE	256
 
-- 
2.55.0.rc0.799.gd6f94ed593-goog

Re: [PATCH 0/9] Stability fixes for GVE

[Stephen Hemminger]

On Wed,  1 Jul 2026 11:35:18 -0700
Joshua Washington <joshwash@google.com> wrote:

> This patch series consists of mostly unrelated fixes in the GVE driver.
> 
> Joshua Washington (9):
>   net/gve: clear out shared memory region for stats report
>   net/gve: delay adding mbuf head to software ring
>   net/gve: copy data to QPL buffer when mbuf read does not
>   net/gve: validate buf ID before processing Rx packet
>   net/gve: set mbuf to null in software ring after use
>   net/gve: free ctx mbuf if packet dropped after first segment
>   net/gve: increase range of DMA memzone ids to 64 bits
>   net/gve: don't reset ring size bounds to default on reset
>   net/gve: restrict max ring size in GQ QPL to 2K
> 
>  drivers/net/gve/base/gve_adminq.c | 12 ++++++---
>  drivers/net/gve/base/gve_osdep.h  |  4 +--
>  drivers/net/gve/gve_ethdev.c      |  8 +++---
>  drivers/net/gve/gve_ethdev.h      |  1 +
>  drivers/net/gve/gve_rx.c          |  3 +++
>  drivers/net/gve/gve_rx_dqo.c      |  6 +++++
>  drivers/net/gve/gve_tx.c          | 42 +++++++++++++++++++------------
>  7 files changed, 52 insertions(+), 24 deletions(-)
> 

*Build Failed #1:
OS: OpenAnolis8.10-64
Target: x86_64-native-linuxapp-gcc
FAILED: drivers/libtmp_rte_net_gve.a.p/net_gve_gve_tx.c.o 
gcc -Idrivers/libtmp_rte_net_gve.a.p -Idrivers -I../drivers -Idrivers/net/gve -I../drivers/net/gve -I../drivers/net/gve/base -Ilib/ethdev -I../lib/ethdev -Ilib/eal/common -I../lib/eal/common -I. -I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include -Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include -I../lib/eal/x86/include -I../kernel/linux -Ilib/eal -I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/log -I../lib/log -Ilib/metrics -I../lib/metrics -Ilib/telemetry -I../lib/telemetry -Ilib/argparse -I../lib/argparse -Ilib/net -I../lib/net -Ilib/mbuf -I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring -Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci -I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev -I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall -Winvalid-pch -Wextra -Werror -std=c11 -O3 -include rte_config.h -Wvla -Wcast-qual -Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security -Wmissing-declarations -Wmissing-prototypes -Wnested-externs -Wold-style-definition -Wpointer-arith -Wshadow -Wsign-compare -Wstrict-prototypes -Wundef -Wwrite-strings -Wno-packed-not-aligned -Wno-missing-field-initializers -D_GNU_SOURCE -fPIC -march=native -mrtm -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API -Wno-format-truncation -Wno-vla -DRTE_COMPONENT_CLASS=pmd_net -DRTE_COMPONENT_NAME=gve -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.gve -MD -MQ drivers/libtmp_rte_net_gve.a.p/net_gve_gve_tx.c.o -MF drivers/libtmp_rte_net_gve.a.p/net_gve_gve_tx.c.o.d -o drivers/libtmp_rte_net_gve.a.p/net_gve_gve_tx.c.o -c ../drivers/net/gve/gve_tx.c
../drivers/net/gve/gve_tx.c: In function ‘gve_tx_burst_qpl’:
../drivers/net/gve/gve_tx.c:258:21: error: variable ‘addr’ set but not used [-Werror=unused-but-set-variable]
  uint64_t ol_flags, addr, fifo_addr;
                     ^~~~
cc1: all warnings being treated as errors
[1640/3750] Compiling C object drivers/libtmp_rte_net_gve.a.p/net_gve_gve_rx.c.o
[1641/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_base_hinic_pmd_cfg.c.o
[1642/3750] Compiling C object drivers/libtmp_rte_net_failsafe.a.p/net_failsafe_failsafe_ops.c.o
[1643/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_base_hinic_pmd_api_cmd.c.o
[1644/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_base_hinic_pmd_cmdq.c.o
[1645/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_hinic_pmd_rx.c.o
[1646/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_hinic_pmd_flow.c.o
[1647/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_hinic_pmd_ethdev.c.o
[1648/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_hinic_pmd_tx.c.o
ninja: build stopped

Re: [PATCH 0/9] Stability fixes for GVE

[Joshua Washington]

On Wed, Jul 1, 2026 at 11:50 AM Stephen Hemminger
<stephen@networkplumber.org> wrote:
>
> On Wed,  1 Jul 2026 11:35:18 -0700
> Joshua Washington <joshwash@google.com> wrote:
>
> > This patch series consists of mostly unrelated fixes in the GVE driver.
> >
> > Joshua Washington (9):
> >   net/gve: clear out shared memory region for stats report
> >   net/gve: delay adding mbuf head to software ring
> >   net/gve: copy data to QPL buffer when mbuf read does not
> >   net/gve: validate buf ID before processing Rx packet
> >   net/gve: set mbuf to null in software ring after use
> >   net/gve: free ctx mbuf if packet dropped after first segment
> >   net/gve: increase range of DMA memzone ids to 64 bits
> >   net/gve: don't reset ring size bounds to default on reset
> >   net/gve: restrict max ring size in GQ QPL to 2K
> >
> >  drivers/net/gve/base/gve_adminq.c | 12 ++++++---
> >  drivers/net/gve/base/gve_osdep.h  |  4 +--
> >  drivers/net/gve/gve_ethdev.c      |  8 +++---
> >  drivers/net/gve/gve_ethdev.h      |  1 +
> >  drivers/net/gve/gve_rx.c          |  3 +++
> >  drivers/net/gve/gve_rx_dqo.c      |  6 +++++
> >  drivers/net/gve/gve_tx.c          | 42 +++++++++++++++++++------------
> >  7 files changed, 52 insertions(+), 24 deletions(-)
> >
>
> *Build Failed #1:
> OS: OpenAnolis8.10-64
> Target: x86_64-native-linuxapp-gcc
> FAILED: drivers/libtmp_rte_net_gve.a.p/net_gve_gve_tx.c.o
> gcc -Idrivers/libtmp_rte_net_gve.a.p -Idrivers -I../drivers -Idrivers/net/gve -I../drivers/net/gve -I../drivers/net/gve/base -Ilib/ethdev -I../lib/ethdev -Ilib/eal/common -I../lib/eal/common -I. -I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include -Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include -I../lib/eal/x86/include -I../kernel/linux -Ilib/eal -I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/log -I../lib/log -Ilib/metrics -I../lib/metrics -Ilib/telemetry -I../lib/telemetry -Ilib/argparse -I../lib/argparse -Ilib/net -I../lib/net -Ilib/mbuf -I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring -Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci -I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev -I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall -Winvalid-pch -Wextra -Werror -std=c11 -O3 -include rte_config.h -Wvla -Wcast-qual -Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security -Wmissing-declarations -Wmissing-prototypes -Wnested-externs -Wold-style-definition -Wpointer-arith -Wshadow -Wsign-compare -Wstrict-prototypes -Wundef -Wwrite-strings -Wno-packed-not-aligned -Wno-missing-field-initializers -D_GNU_SOURCE -fPIC -march=native -mrtm -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API -Wno-format-truncation -Wno-vla -DRTE_COMPONENT_CLASS=pmd_net -DRTE_COMPONENT_NAME=gve -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.gve -MD -MQ drivers/libtmp_rte_net_gve.a.p/net_gve_gve_tx.c.o -MF drivers/libtmp_rte_net_gve.a.p/net_gve_gve_tx.c.o.d -o drivers/libtmp_rte_net_gve.a.p/net_gve_gve_tx.c.o -c ../drivers/net/gve/gve_tx.c
> ../drivers/net/gve/gve_tx.c: In function ‘gve_tx_burst_qpl’:
> ../drivers/net/gve/gve_tx.c:258:21: error: variable ‘addr’ set but not used [-Werror=unused-but-set-variable]
>   uint64_t ol_flags, addr, fifo_addr;
>                      ^~~~
> cc1: all warnings being treated as errors
> [1640/3750] Compiling C object drivers/libtmp_rte_net_gve.a.p/net_gve_gve_rx.c.o
> [1641/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_base_hinic_pmd_cfg.c.o
> [1642/3750] Compiling C object drivers/libtmp_rte_net_failsafe.a.p/net_failsafe_failsafe_ops.c.o
> [1643/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_base_hinic_pmd_api_cmd.c.o
> [1644/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_base_hinic_pmd_cmdq.c.o
> [1645/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_hinic_pmd_rx.c.o
> [1646/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_hinic_pmd_flow.c.o
> [1647/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_hinic_pmd_ethdev.c.o
> [1648/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_hinic_pmd_tx.c.o
> ninja: build stopped

Will fix in v2.

Re: [PATCH 0/9] Stability fixes for GVE

[Stephen Hemminger]

On Wed, 1 Jul 2026 12:59:18 -0700
Joshua Washington <joshwash@google.com> wrote:

> On Wed, Jul 1, 2026 at 11:50 AM Stephen Hemminger
> <stephen@networkplumber.org> wrote:
> >
> > On Wed,  1 Jul 2026 11:35:18 -0700
> > Joshua Washington <joshwash@google.com> wrote:
> >  
> > > This patch series consists of mostly unrelated fixes in the GVE driver.
> > >
> > > Joshua Washington (9):
> > >   net/gve: clear out shared memory region for stats report
> > >   net/gve: delay adding mbuf head to software ring
> > >   net/gve: copy data to QPL buffer when mbuf read does not
> > >   net/gve: validate buf ID before processing Rx packet
> > >   net/gve: set mbuf to null in software ring after use
> > >   net/gve: free ctx mbuf if packet dropped after first segment
> > >   net/gve: increase range of DMA memzone ids to 64 bits
> > >   net/gve: don't reset ring size bounds to default on reset
> > >   net/gve: restrict max ring size in GQ QPL to 2K
> > >
> > >  drivers/net/gve/base/gve_adminq.c | 12 ++++++---
> > >  drivers/net/gve/base/gve_osdep.h  |  4 +--
> > >  drivers/net/gve/gve_ethdev.c      |  8 +++---
> > >  drivers/net/gve/gve_ethdev.h      |  1 +
> > >  drivers/net/gve/gve_rx.c          |  3 +++
> > >  drivers/net/gve/gve_rx_dqo.c      |  6 +++++
> > >  drivers/net/gve/gve_tx.c          | 42 +++++++++++++++++++------------
> > >  7 files changed, 52 insertions(+), 24 deletions(-)
> > >  
> >
> > *Build Failed #1:
> > OS: OpenAnolis8.10-64
> > Target: x86_64-native-linuxapp-gcc
> > FAILED: drivers/libtmp_rte_net_gve.a.p/net_gve_gve_tx.c.o
> > gcc -Idrivers/libtmp_rte_net_gve.a.p -Idrivers -I../drivers -Idrivers/net/gve -I../drivers/net/gve -I../drivers/net/gve/base -Ilib/ethdev -I../lib/ethdev -Ilib/eal/common -I../lib/eal/common -I. -I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include -Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include -I../lib/eal/x86/include -I../kernel/linux -Ilib/eal -I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/log -I../lib/log -Ilib/metrics -I../lib/metrics -Ilib/telemetry -I../lib/telemetry -Ilib/argparse -I../lib/argparse -Ilib/net -I../lib/net -Ilib/mbuf -I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring -Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci -I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev -I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall -Winvalid-pch -Wextra -Werror -std=c11 -O3 -include rte_config.h -Wvla -Wcast-qual -Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security -Wmissing-declarations -Wmissing-prototypes -Wnested-externs -Wold-style-definition -Wpointer-arith -Wshadow -Wsign-compare -Wstrict-prototypes -Wundef -Wwrite-strings -Wno-packed-not-aligned -Wno-missing-field-initializers -D_GNU_SOURCE -fPIC -march=native -mrtm -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API -Wno-format-truncation -Wno-vla -DRTE_COMPONENT_CLASS=pmd_net -DRTE_COMPONENT_NAME=gve -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.gve -MD -MQ drivers/libtmp_rte_net_gve.a.p/net_gve_gve_tx.c.o -MF drivers/libtmp_rte_net_gve.a.p/net_gve_gve_tx.c.o.d -o drivers/libtmp_rte_net_gve.a.p/net_gve_gve_tx.c.o -c ../drivers/net/gve/gve_tx.c
> > ../drivers/net/gve/gve_tx.c: In function ‘gve_tx_burst_qpl’:
> > ../drivers/net/gve/gve_tx.c:258:21: error: variable ‘addr’ set but not used [-Werror=unused-but-set-variable]
> >   uint64_t ol_flags, addr, fifo_addr;
> >                      ^~~~
> > cc1: all warnings being treated as errors
> > [1640/3750] Compiling C object drivers/libtmp_rte_net_gve.a.p/net_gve_gve_rx.c.o
> > [1641/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_base_hinic_pmd_cfg.c.o
> > [1642/3750] Compiling C object drivers/libtmp_rte_net_failsafe.a.p/net_failsafe_failsafe_ops.c.o
> > [1643/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_base_hinic_pmd_api_cmd.c.o
> > [1644/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_base_hinic_pmd_cmdq.c.o
> > [1645/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_hinic_pmd_rx.c.o
> > [1646/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_hinic_pmd_flow.c.o
> > [1647/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_hinic_pmd_ethdev.c.o
> > [1648/3750] Compiling C object drivers/libtmp_rte_net_hinic.a.p/net_hinic_hinic_pmd_tx.c.o
> > ninja: build stopped  
> 
> Will fix in v2.

Here is AI review if it helps
Review of "net/gve" 9-patch series (bundle 1995)

Applied cleanly on top of 26.07-rc2 and built with
  meson -Dbuildtype=minsize -Ddefault_library=static -Dwerror=true

The series is a solid set of datapath and reset-path bug fixes. One patch
breaks the build on its own, which blocks the series until fixed.


Patch 3/9 (net/gve: copy data to QPL buffer when mbuf read does not)

Error: build failure. Removing the two rte_memcpy() calls that consumed
'addr' leaves 'addr' set but never read, so the driver no longer compiles
under -Werror:

  gve_tx.c: In function 'gve_tx_burst_qpl':
  gve_tx.c:258:28: error: variable 'addr' set but not used
                          [-Werror=unused-but-set-variable]

Both remaining assignments are now dead:

  addr = (uint64_t)(tx_pkt->buf_addr) + tx_pkt->data_off;
  ...
  addr = (uint64_t)(tx_pkt->buf_addr) + tx_pkt->data_off + hlen;

Drop 'addr' from the declaration and delete both assignments. This also
means each commit does not build independently, breaking git bisect.

The fix itself is correct: rte_pktmbuf_read() returns a pointer into the
mbuf when the range is contiguous and does not touch the destination, so
the guarded rte_memcpy() is needed for both the header and the TSO
payload copy.


Patch 9/9 (net/gve: restrict max ring size in GQ QPL to 2K)

Info: the new include uses quotes,

  #include "rte_common.h"

but every other DPDK header in this driver (including base/gve_osdep.h)
uses angle brackets. Prefer:

  #include <rte_common.h>

The GQ-QPL RTE_MIN() cap and the DQO override refactor are correct; the
initial device-value assignment that DQO overwrites is an intentional
default, not a dead store.


Patches 1, 2, 4, 5, 6, 7, 8: no issues found.

- 2/9: sw_ring record loop advances sw_id by nb_segs exactly as before;
  the added !tx_pkt guard is a safe bound.
- 4/9: buf_id bound check sits after the completion descriptor is
  consumed (rx_id / nb_rx_hold / generation advanced), so a bad id is
  dropped without stalling the ring.
- 5/9 + 6/9: nulling sw_ring after handing the mbuf to the application
  and freeing ctx->mbuf_head on drop are consistent - the head chain is
  removed from sw_ring before being freed, so no double free, and refill
  overwrites the slots with freshly allocated mbufs.

No Reviewed-by given: patch 3 does not build. Once the unused 'addr' is
removed I'm happy to ack the series.