From: Pin-yen Lin <treapking@google.com>
To: treapking@google.com
Cc: stable@vger.kernel.org, Joshua Washington <joshwash@google.com>,
Harshitha Ramamurthy <hramamurthy@google.com>
Subject: [PATCH net v3 4/5] gve: Fix link flap after ethtool ops
Date: Tue, 13 Oct 2026 02:38:35 -0700 [thread overview]
Message-ID: <20261013093836.1269134-5-treapking@google.com> (raw)
In-Reply-To: <20261013093836.1269134-1-treapking@google.com>
When modifying device features via ethtool, GVE causes a short link-down
after the ethtool command completes, which can break scripts that use
the network interface right after the ethtool command.
This issue was discovered and actually triggered by the
drivers/net/ping.py selftest. Modifying checksum offload features via
ethtool caused a transient carrier drop ("Lost carrier", DHCP lease lost),
causing the immediate ping invocation to fail.
Fix it by calling gve_turnup_and_check_status() in gve_queues_start() to
update the carrier status synchronously before returning to userspace,
and move the device_status register read into gve_handle_link_status()
so callers always check the current link status when NAPI is enabled.
This change was tested using the DQO RDA queue format.
Cc: stable@vger.kernel.org
Fixes: 3b7cc73628ff ("gve: Use link status register to report link status")
Signed-off-by: Pin-yen Lin <treapking@google.com>
Reviewed-by: Joshua Washington <joshwash@google.com>
Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com>
---
Changes in v3:
- Retitled from "gve: Make ethtool config changes synchronous"
- Read device_status inside gve_handle_link_status()
- Fix the Fixes tag
- Refined the commit message
drivers/net/ethernet/google/gve/gve_main.c | 63 +++++++++++-----------
1 file changed, 31 insertions(+), 32 deletions(-)
diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
index 5bd6549e99b2..f1eb0c6e1f9b 100644
--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -1442,6 +1442,34 @@ static void gve_queues_mem_remove(struct gve_priv *priv)
gve_queues_mem_free(priv, &tx_alloc_cfg, &rx_alloc_cfg);
}
+static void gve_handle_link_status(struct gve_priv *priv)
+{
+ bool link_status;
+ u32 status;
+
+ if (!gve_get_napi_enabled(priv))
+ return;
+
+ status = ioread32be(&priv->reg_bar0->device_status);
+ link_status = GVE_DEVICE_STATUS_LINK_STATUS_MASK & status;
+ if (link_status == netif_carrier_ok(priv->dev))
+ return;
+
+ if (link_status) {
+ netdev_info(priv->dev, "Device link is up.\n");
+ netif_carrier_on(priv->dev);
+ } else {
+ netdev_info(priv->dev, "Device link is down.\n");
+ netif_carrier_off(priv->dev);
+ }
+}
+
+static void gve_turnup_and_check_status(struct gve_priv *priv)
+{
+ gve_turnup(priv);
+ gve_handle_link_status(priv);
+}
+
/* The passed-in queue memory is stored into priv and the queues are made live.
* No memory is allocated. Passed-in memory is freed on errors.
*/
@@ -1506,8 +1534,7 @@ static int gve_queues_start(struct gve_priv *priv,
round_jiffies(jiffies +
msecs_to_jiffies(priv->stats_report_timer_period)));
- gve_turnup(priv);
- queue_work(priv->gve_wq, &priv->service_task);
+ gve_turnup_and_check_status(priv);
priv->interface_up_cnt++;
return 0;
@@ -1599,23 +1626,6 @@ static int gve_close(struct net_device *dev)
return 0;
}
-static void gve_handle_link_status(struct gve_priv *priv, bool link_status)
-{
- if (!gve_get_napi_enabled(priv))
- return;
-
- if (link_status == netif_carrier_ok(priv->dev))
- return;
-
- if (link_status) {
- netdev_info(priv->dev, "Device link is up.\n");
- netif_carrier_on(priv->dev);
- } else {
- netdev_info(priv->dev, "Device link is down.\n");
- netif_carrier_off(priv->dev);
- }
-}
-
static int gve_configure_rings_xdp(struct gve_priv *priv,
u16 num_xdp_rings)
{
@@ -1634,7 +1644,6 @@ static int gve_set_xdp(struct gve_priv *priv, struct bpf_prog *prog,
{
struct bpf_prog *old_prog;
int err = 0;
- u32 status;
old_prog = READ_ONCE(priv->xdp_prog);
if (!netif_running(priv->dev)) {
@@ -1661,8 +1670,7 @@ static int gve_set_xdp(struct gve_priv *priv, struct bpf_prog *prog,
bpf_prog_put(old_prog);
out:
- status = ioread32be(&priv->reg_bar0->device_status);
- gve_handle_link_status(priv, GVE_DEVICE_STATUS_LINK_STATUS_MASK & status);
+ gve_handle_link_status(priv);
return err;
}
@@ -2090,15 +2098,6 @@ static void gve_turnup(struct gve_priv *priv)
gve_set_napi_enabled(priv);
}
-static void gve_turnup_and_check_status(struct gve_priv *priv)
-{
- u32 status;
-
- gve_turnup(priv);
- status = ioread32be(&priv->reg_bar0->device_status);
- gve_handle_link_status(priv, GVE_DEVICE_STATUS_LINK_STATUS_MASK & status);
-}
-
static struct gve_notify_block *gve_get_tx_notify_block(struct gve_priv *priv,
unsigned int txqueue)
{
@@ -2427,7 +2426,7 @@ static void gve_service_task(struct work_struct *work)
gve_handle_status(priv, status);
gve_handle_reset(priv);
- gve_handle_link_status(priv, GVE_DEVICE_STATUS_LINK_STATUS_MASK & status);
+ gve_handle_link_status(priv);
}
static void gve_set_netdev_xdp_features(struct gve_priv *priv)
--
2.56.0.385.gd3acb90ef8-goog
next prev parent reply other threads:[~2026-10-13 9:38 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20261013093836.1269134-1-treapking@google.com>
2026-10-13 9:38 ` [PATCH net v3 1/5] gve: Fix race between stats query and queue reconfig Pin-yen Lin
2026-10-13 9:42 ` Pin-yen Lin
2026-10-13 9:38 ` [PATCH net v3 2/5] gve: Fix backward stats when interface goes down or configuration is adjusted Pin-yen Lin
2026-10-13 9:38 ` [PATCH net v3 3/5] gve: Block invalid ring sizes when device options are 0 Pin-yen Lin
2026-10-13 9:38 ` Pin-yen Lin [this message]
2026-10-13 9:38 ` [PATCH net v3 5/5] gve: Fix UAF due to stats report race with teardown Pin-yen Lin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261013093836.1269134-5-treapking@google.com \
--to=treapking@google.com \
--cc=hramamurthy@google.com \
--cc=joshwash@google.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox