Skip to content

[RLC-9] Rebase Custom Changes to rlc-9/5.14.0-687.39.1.el9_8 - #1541

Open
PlaidCat wants to merge 53 commits into
rlc-9/5.14.0-687.39.1.el9_8from
jmaple_rlc-9/5.14.0-687.39.1.el9_8
Open

[RLC-9] Rebase Custom Changes to rlc-9/5.14.0-687.39.1.el9_8#1541
PlaidCat wants to merge 53 commits into
rlc-9/5.14.0-687.39.1.el9_8from
jmaple_rlc-9/5.14.0-687.39.1.el9_8

Conversation

@PlaidCat

Copy link
Copy Markdown
Collaborator

https://ciqinc.atlassian.net/browse/KERNEL-1491

Update process (This kernel CentOS base for 5.14.0-687.39.1.el9_8)

  • Rolling Release Rebase Process
  • Create rlc-9/5.14.0-687.39.1.el9_8 branch from rocky9_8
  • Cherry-pick all code from previous branch rlc-9/5.14.0-687.36.1.el9_8 into new branch (skipping unneeded code)
    • Fix conflicts as they arise
  • Build and Test

Rebase Log

Already on 'rlc-9/5.14.0-687.36.1.el9_8'
Already on 'jmaple_rlc-9/5.14.0-687.39.1.el9_8'
[rolling release update] Rolling Product:  rlc-9
[rolling release update] Checking out branch:  rlc-9/5.14.0-687.36.1.el9_8
[rolling release update] Gathering all the RESF kernel Tags
[rolling release update] Found 19 RESF kernel tags
[rolling release update] Checking out branch:  rocky9_8
[rolling release update] Gathering all the RESF kernel Tags
[rolling release update] Found 21 RESF kernel tags
[rolling release update] Common tag sha:  b'b77d4cd45c1b'
"b77d4cd45c1b08a1e14dfd30ce75b5caab4041d6 Rebuild rocky9_8 with kernel-5.14.0-687.36.1.el9_8"
[rolling release update] Checking for FIPS protected changes between the common tag and HEAD
[rolling release update] Checking for FIPS protected changes
[rolling release update] Getting SHAS b77d4cd45c1b..HEAD
[rolling release update] Number of commits to check:  15
[rolling release update] Checking modifications of shas
[rolling release update] Checked 1 of 15 commits
[rolling release update] Checked 2 of 15 commits
[rolling release update] Checked 3 of 15 commits
[rolling release update] Checked 4 of 15 commits
[rolling release update] Checked 5 of 15 commits
[rolling release update] Checked 6 of 15 commits
[rolling release update] Checked 7 of 15 commits
[rolling release update] Checked 8 of 15 commits
[rolling release update] Checked 9 of 15 commits
[rolling release update] Checked 10 of 15 commits
[rolling release update] Checked 11 of 15 commits
[rolling release update] Checked 12 of 15 commits
[rolling release update] Checked 13 of 15 commits
[rolling release update] Checked 14 of 15 commits
[rolling release update] Checked 15 of 15 commits
[rolling release update] 0 of 15 commits have FIPS protected changes
[rolling release update] Checking out old rolling branch:  rlc-9/5.14.0-687.36.1.el9_8
[rolling release update] Finding the CIQ Kernel and Associated Upstream commits between the last resf tag and HEAD
[rolling release update] Getting SHAS b77d4cd45c1b..HEAD
[rolling release update] Last RESF tag sha:  b'b77d4cd45c1b'
[rolling release update] Total commits in old branch: 55
[rolling release update] Checking out new base branch:  rocky9_8
[rolling release update] Finding the kernel version for the new rolling release
[rolling release update] New Branch to create: rlc-9/5.14.0-687.39.1.el9_8
[rolling release update] Creating new branch: rlc-9/5.14.0-687.39.1.el9_8
[rolling release update] Creating new branch for PR:  jmaple_rlc-9/5.14.0-687.39.1.el9_8
[rolling release update] Creating Map of all new commits from last rolling release fork
[rolling release update] Total commits in new branch: 14
[rolling release update] Checking if any of the commits from the old rolling release are already present in the new base branch
- Old commit 2cf45757c60c backported upstream 5057e1aca011
  Already in new base as 881e5da5942b: net/sched: act_api: use RCU with deferred freeing for action lifecycle
[rolling release update] Found 1 duplicate commits to remove
[rolling release update] Removing duplicate commits:
  - 2cf45757c60c2bc8670b63f2a6d54611b8d124fc net/sched: act_api: use RCU with deferred freeing for action lifecycle
[rolling release update] Applying 54 remaining commits to the new branch
  [1/54] b6e960d43fe2 selftests/mm temporary fix of hmm infinite loop
  [2/54] 212a2c1f27cc SUSE: patch: crypto-ecdh-implement-FIPS-PCT.patch
  [3/54] e9e836fb5bfe crypto: essiv - Zeroize keys on exit in essiv_aead_setkey()
  [4/54] c194d98ddec5 crypto: jitter - replace LFSR with SHA3-256
  [5/54] ce886ef0d8ea crypto: aead,cipher - zeroize key buffer after use
  [6/54] f73305bb6a21 crypto: ecdh - explicitly zeroize private_key
  [7/54] 4068c7e08502 crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
  [8/54] 369dfcef26ef crypto: Kconfig - Make CRYPTO_FIPS depend on the DRBG being built-in
  [9/54] c6b55283b2e8 random: Restrict extrng registration to init time
  [10/54] 230bba64780d crypto: rng - Convert crypto_default_rng_refcnt into an unsigned int
  [11/54] 34a070d1c728 crypto: drbg - Align buffers to at least a cache line
  [12/54] b352e63907bc crypto: rng - Fix priority inversions due to mutex locks
  [13/54] 3b107b73cdb2 mm/gup: reintroduce pin_user_pages_fast_only()
  [14/54] e61d2175ebf1 crypto: rng - Implement fast per-CPU DRBG instances
  [15/54] 890e9925c0a1 configs: Ensure FIPS settings defined
  [16/54] daecafbb26eb github actions: Use reusable validate kernel commits workflow
  [17/54] 21e933f9d646 github actions: Add kernelCI for rlc-9
  [18/54] ef30fa52d4ee github actions: Use trigger for kernelCI
  [19/54] d16c5ca0ec27 Revert "xfrm: esp: avoid in-place decrypt on shared skb frags"
  [20/54] 08cc2aa2a8f5 tools: hv: Enable debug logs for hv_kvp_daemon
  [21/54] 3eb8a741f4e0 crypto: rng - Only allow the DRBG to register as "stdrng" in FIPS mode
  [22/54] 342f16d2efb8 net: mana: Add support for net_shaper_ops
  [23/54] 3a54daf32c88 net: mana: Add speed support in mana_get_link_ksettings
  [24/54] 2ec55ee0fb7e net: mana: Fix build errors when CONFIG_NET_SHAPER is disabled
  [25/54] c9832e7e942f rxrpc: Fix potential UAF after skb_unshare() failure
  [26/54] 8847bb5a2b0a rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
  [27/54] e91f12611412 xfrm: esp: avoid in-place decrypt on shared skb frags
  [28/54] be12ac759a69 rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  [29/54] 25132fcdb719 KVM: arm64: Reassign nested_mmus array behind mmu_lock
  [30/54] 6340f4f25960 crypto: rng - Skip leading zero-length iovec segments
  [31/54] a1e5aeaffb11 crypto: rng - Fix spurious EFAULT when the destination PTE is zapped
  [32/54] 753e5f8c7449 Revert "mm/gup: reintroduce pin_user_pages_fast_only()"
  [33/54] 344da7adfee4 net: openvswitch: reject oversized nested action attrs
[rolling release update] ERROR: Failed to cherry-pick commit 344da7adfee44ccf29a8cda7e4ea42b9daa5b24d
The previous cherry-pick is now empty, possibly due to conflict resolution.
If you wish to commit it anyway, use:

    git commit --allow-empty

Otherwise, please use 'git cherry-pick --skip'

[rolling release update] ========================================
[rolling release update] INTERACTIVE MODE: Merge conflict detected
[rolling release update] ========================================
[rolling release update] Please resolve or skip the merge conflict manually.
[rolling release update] To resolve:
[rolling release update]   1. Fix merge conflicts in the working directory
[rolling release update]   2. Stage resolved files: git add <files>
[rolling release update]   3. Complete cherry-pick: git cherry-pick --continue
[rolling release update]      (or commit manually if needed)
[rolling release update] To skip:
[rolling release update]   1. To skip this commit: git cherry-pick --skip
[rolling release update] When done:
[rolling release update]   Return here and press Enter to continue
[rolling release update] ========================================
[rolling release update] Press Enter when resolved (or type "stop"/"abort" to exit): [rolling release update] Cherry-pick resolved successfully, continuing...
  [34/54] acc354edb22c gve: Define config structs for queue allocation
  [35/54] f99676ac8c64 gve: Refactor napi add and remove functions
  [36/54] a2fe5b07aaf8 gve: Switch to config-aware queue allocation
  [37/54] bd6ce8b8bc14 gve: Refactor gve_open and gve_close
  [38/54] 62976bcb95bb gve: Alloc before freeing when adjusting queues
  [39/54] f598590f775d gve: Alloc before freeing when changing features
  [40/54] 28f6408bc999 gve: simplify setting decriptor count defaults
  [41/54] 10c54fe3953a gve: make the completion and buffer ring size equal for DQO
  [42/54] 1a4616a8db9c gve: set page count for RX QPL for GQI and DQO queue formats
  [43/54] 60d2a64cf43b gve: add support to read ring size ranges from the device
  [44/54] 5e15480ceddd gve: add support to change ring size via ethtool
  [45/54] 7571a6a59bf8 gve: Fix use of netif_carrier_ok()
  [46/54] 02dc682a9435 gve: Remove unused declaration gve_rx_alloc_rings()
  [47/54] 3d291af5c93d gve: clean XDP queues in gve_tx_stop_ring_gqi
  [48/54] 6d3dd5bd93f1 gve: fix XDP allocation path in edge cases
  [49/54] 5d47a30019f6 gve: prevent ethtool ops after shutdown
  [50/54] aab9015fbf7f gve: defer interrupt enabling until NAPI registration
  [51/54] 6cb04cda64bf gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
  [52/54] 7c61d959e973 gve: Update QPL page registration logic
  [53/54] 7190fa31a36f gve: Enable reading max ring size from the device in DQO-QPL mode
  [54/54] 7c2e5c578611 gve: bound DQO-QPL TX buffer count to the s16 free-list range
[rolling release update] Successfully applied all 54 commits

BUILD

$ egrep -B 5 -A 5 "\[TIMER\]|^Starting Build" $(ls -t kbuild* | head -n1)
/mnt/code/kernel-src-tree-build
Running make mrproper...
  CLEAN   scripts/basic
  CLEAN   scripts/kconfig
  CLEAN   include/config include/generated
[TIMER]{MRPROPER}: 5s
x86_64 architecture detected, copying config
'configs/kernel-x86_64-rhel.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-rocky9_8_rebuild-ad60ad494aae"
Making olddefconfig
--
  HOSTCC  scripts/kconfig/util.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
Starting Build
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_32.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_64.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_x32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h
--
  BTF [M] sound/usb/usx2y/snd-usb-us144mkii.ko
  BTF [M] sound/virtio/virtio_snd.ko
  BTF [M] sound/x86/snd-hdmi-lpe-audio.ko
  BTF [M] sound/usb/usx2y/snd-usb-us122l.ko
  BTF [M] sound/xen/snd_xen_front.ko
[TIMER]{BUILD}: 1703s
Making Modules
  INSTALL /lib/modules/5.14.0-rocky9_8_rebuild-ad60ad494aae/kernel/arch/x86/crypto/blake2s-x86_64.ko
  INSTALL /lib/modules/5.14.0-rocky9_8_rebuild-ad60ad494aae/kernel/arch/x86/crypto/blowfish-x86_64.ko
  INSTALL /lib/modules/5.14.0-rocky9_8_rebuild-ad60ad494aae/kernel/arch/x86/crypto/camellia-aesni-avx-x86_64.ko
  INSTALL /lib/modules/5.14.0-rocky9_8_rebuild-ad60ad494aae/kernel/arch/x86/crypto/camellia-aesni-avx2.ko
--
  SIGN    /lib/modules/5.14.0-rocky9_8_rebuild-ad60ad494aae/kernel/sound/virtio/virtio_snd.ko
  SIGN    /lib/modules/5.14.0-rocky9_8_rebuild-ad60ad494aae/kernel/sound/xen/snd_xen_front.ko
  SIGN    /lib/modules/5.14.0-rocky9_8_rebuild-ad60ad494aae/kernel/sound/usb/snd-usb-audio.ko
  SIGN    /lib/modules/5.14.0-rocky9_8_rebuild-ad60ad494aae/kernel/sound/usb/snd-usbmidi-lib.ko
  DEPMOD  /lib/modules/5.14.0-rocky9_8_rebuild-ad60ad494aae
[TIMER]{MODULES}: 9s
Making Install
sh ./arch/x86/boot/install.sh 5.14.0-rocky9_8_rebuild-ad60ad494aae \
	arch/x86/boot/bzImage System.map "/boot"
[TIMER]{INSTALL}: 23s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-rocky9_8_rebuild-ad60ad494aae and Index to 0
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 5s
[TIMER]{BUILD}: 1703s
[TIMER]{MODULES}: 9s
[TIMER]{INSTALL}: 23s
[TIMER]{TOTAL} 1746s
Rebooting in 10 seconds

KSelfTest

$ ./kernel-tools/kernel_auto_rebuild/get_kselftest_diff.sh
selftest-5.14.0-jmaple_rlc-9_5.14.0-687.33.1.el9_8-ed76d7b351a8+-1.log: 395 passed
selftest-5.14.0-jmaple_rlc-9_5.14.0-687.34.1.el9_8-7fe64056b2b1+-1.log: 396 passed
selftest-5.14.0-jmaple_rlc-9_5.14.0-687.36.1.el9_8-2cf45757c60c+-1.log: 396 passed
selftest-5.14.0-jmaple_rlc-9_5.14.0-687.39.1.el9_8-f7bf3d748187+-1.log: 396 passed

Before: selftest-5.14.0-jmaple_rlc-9_5.14.0-687.36.1.el9_8-2cf45757c60c+-1.log
After: selftest-5.14.0-jmaple_rlc-9_5.14.0-687.39.1.el9_8-f7bf3d748187+-1.log
Diff:
+ok 4 selftests: cgroup: test_freezer
-ok 72 selftests: net: test_vxlan_vnifiltering.sh

PlaidCat and others added 30 commits August 18, 2026 15:20
jira SECO-170

In Rocky9 if you run ./run_vmtests.sh -t hmm it will fail and cause an
infinite loop on ASSERTs in FIXTURE_TEARDOWN()
This temporary fix is based on the discussion here
https://patchwork.kernel.org/project/linux-kselftest/patch/26017fe3-5ad7-6946-57db-e5ec48063ceb@suse.cz/#25046055

We will investigate further kselftest updates that will resolve the root
causes of this.

Signed-off-by: Jonathan Maple <jmaple@ciq.com>
Signed-off-by: Jeremy Allison <jallison@ciq.com>
In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey()
to zeroize keys on exit.

[Sultan: touched up commit message]

Signed-off-by: Jason Rodriguez <jrodriguez@ciq.com>
        Using the kernel crypto API, the SHA3-256 algorithm is used as
        conditioning element to replace the LFSR in the Jitter RNG. All other
        parts of the Jitter RNG are unchanged.

        The application and use of the SHA-3 conditioning operation is identical
        to the user space Jitter RNG 3.4.0 by applying the following concept:

        - the Jitter RNG initializes a SHA-3 state which acts as the "entropy
          pool" when the Jitter RNG is allocated.

        - When a new time delta is obtained, it is inserted into the "entropy
          pool" with a SHA-3 update operation. Note, this operation in most of
          the cases is a simple memcpy() onto the SHA-3 stack.

        - To cause a true SHA-3 operation for each time delta operation, a
          second SHA-3 operation is performed hashing Jitter RNG status
          information. The final message digest is also inserted into the
          "entropy pool" with a SHA-3 update operation. Yet, this data is not
          considered to provide any entropy, but it shall stir the entropy pool.

        - To generate a random number, a SHA-3 final operation is performed to
          calculate a message digest followed by an immediate SHA-3 init to
          re-initialize the "entropy pool". The obtained message digest is one
          block of the Jitter RNG that is returned to the caller.

        Mathematically speaking, the random number generated by the Jitter RNG
        is:

        aux_t = SHA-3(Jitter RNG state data)

        Jitter RNG block = SHA-3(time_i || aux_i || time_(i-1) || aux_(i-1) ||
                                 ... || time_(i-255) || aux_(i-255))

        when assuming that the OSR = 1, i.e. the default value.

        This operation implies that the Jitter RNG has an output-blocksize of
        256 bits instead of the 64 bits of the LFSR-based Jitter RNG that is
        replaced with this patch.

        The patch also replaces the varying number of invocations of the
        conditioning function with one fixed number of invocations. The use
        of the conditioning function consistent with the userspace Jitter RNG
        library version 3.4.0.

        The code is tested with a system that exhibited the least amount of
        entropy generated by the Jitter RNG: the SiFive Unmatched RISC-V
        system. The measured entropy rate is well above the heuristically
        implied entropy value of 1 bit of entropy per time delta. On all other
        tested systems, the measured entropy rate is even higher by orders
        of magnitude. The measurement was performed using updated tooling
        provided with the user space Jitter RNG library test framework.

        The performance of the Jitter RNG with this patch is about en par
        with the performance of the Jitter RNG without the patch.

        Signed-off-by: Stephan Mueller <smueller@chronox.de>
        Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

            Back-port of commit bb897c5
            Author: Stephan Müller <smueller@chronox.de>
            Date:   Fri Apr 21 08:08:04 2023 +0200

Signed-off-by: Jeremy Allison <jallison@ciq.com>
    I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding
    cryptographic information should be zeroized once they are no longer
    needed. Accomplish this by using kfree_sensitive for buffers that
    previously held the private key.

    Signed-off-by: Hailey Mothershead <hailmo@amazon.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

        Back-ported from commit 23e4099
        Author: Hailey Mothershead <hailmo@amazon.com>
        Date:   Mon Apr 15 22:19:15 2024 +0000

Signed-off-by: Jeremy Allison <jallison@ciq.com>
private_key is overwritten with the key parameter passed in by the
caller (if present), or alternatively a newly generated private key.
However, it is possible that the caller provides a key (or the newly
generated key) which is shorter than the previous key. In that
scenario, some key material from the previous key would not be
overwritten. The easiest solution is to explicitly zeroize the entire
private_key array first.

Note that this patch slightly changes the behavior of this function:
previously, if the ecc_gen_privkey failed, the old private_key would
remain. Now, the private_key is always zeroized. This behavior is
consistent with the case where params.key is set and ecc_is_key_valid
fails.

Signed-off-by: Joachim Vandersmissen <git@jvdsn.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
[ Upstream commit ba3c557 ]

When the mpi_ec_ctx structure is initialized, some fields are not
cleared, causing a crash when referencing the field when the
structure was released. Initially, this issue was ignored because
memory for mpi_ec_ctx is allocated with the __GFP_ZERO flag.
For example, this error will be triggered when calculating the
Za value for SM2 separately.

Fixes: d58bb7e ("lib/mpi: Introduce ec implementation to MPI library")
Cc: stable@vger.kernel.org # v6.5
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
When FIPS mode is enabled (via fips=1), there is an absolute need for the
DRBG to be available. This is at odds with the fact that the DRBG can be
built as a module when in FIPS mode, leaving critical RNG functionality at
the whims of userspace.

Userspace could simply rmmod the DRBG module, or not provide it at all and
thus a different stdrng algorithm could be used without anyone noticing.

Additionally, when running a FIPS-enabled userspace, modprobe itself may
perform a getrandom() syscall _before_ loading a given module. As a result,
there's a possible deadlock scenario where the RNG core (crypto/rng.c)
initializes _before_ the DRBG, thereby installing its getrandom() override
without having an stdrng algorithm available. Then, when userspace calls
getrandom() which redirects to the override in crypto/rng.c,
crypto_alloc_rng("stdrng") invokes the UMH (modprobe) to load the DRBG
(which is aliased to stdrng). And *then* that modprobe invocation gets
stuck at getrandom() because there's no stdrng algorithm available!

There are too many risks that come with allowing the DRBG and RNG core to
be modular for FIPS mode. Therefore, make CRYPTO_FIPS require the DRBG to
be built-in, which in turn makes the DRBG require the RNG core to be
built-in. That way, it's guaranteed for these drivers to be built-in when
running in FIPS mode.

Also clean up the CRYPTO_FIPS option name and remove the CRYPTO_ANSI_CPRNG
dependency since it's obsolete for FIPS now.

Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
It is technically a risk to permit extrng registration by modules after
kernel init completes. Since there is only one user of the extrng interface
and it is imperative that it is the _only_ registered extrng for FIPS
compliance, restrict the extrng registration interface to only permit
registration during kernel init and only from built-in drivers.

This also eliminates the risks associated with the extrng interface itself
being designed to solely accommodate a single registration, which would
therefore permit the registered extrng to be overridden or even removed by
an unrelated module.

Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
There is no reason this refcount should be a signed int. Convert it to an
unsigned int, thereby also making it less likely to ever overflow.

Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
None of the ciphers used by the DRBG have an alignment requirement; thus,
they all return 0 from .crypto_init, resulting in inconsistent alignment
across all buffers.

Align all buffers to at least a cache line to improve performance. This is
especially useful when multiple DRBG instances are used, since it prevents
false sharing of cache lines between the different instances.

Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
Since crypto_devrandom_read_iter() is invoked directly by user tasks and is
accessible by every task in the system, there are glaring priority
inversions on crypto_reseed_rng_lock and crypto_default_rng_lock.

Tasks of arbitrary scheduling priority access crypto_devrandom_read_iter().
When a low-priority task owns one of the mutex locks, higher-priority tasks
waiting on that mutex lock are stalled until the low-priority task is done.

Fix the priority inversions by converting the mutex locks into rt_mutex
locks which have PI support.

Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
Like pin_user_pages_fast(), but with the internal-only FOLL_FAST_ONLY flag.

This complements the get_user_pages*() API, which already has
get_user_pages_fast_only().

Note that pin_user_pages_fast_only() used to exist but was removed in
upstream commit edad1bb ("mm/gup: remove pin_user_pages_fast_only()")
due to it not having any users.

Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
When the kernel is booted with fips=1, the RNG exposed to userspace is
hijacked away from the CRNG and redirects to crypto_devrandom_read_iter(),
which utilizes the DRBG.

Notably, crypto_devrandom_read_iter() maintains just two global DRBG
instances _for the entire system_, and the two instances serve separate
request types: one instance for GRND_RANDOM requests (crypto_reseed_rng),
and one instance for non-GRND_RANDOM requests (crypto_default_rng). So in
essence, for requests of a single type, there is just one global RNG for
all CPUs in the entire system, which scales _very_ poorly.

To make matters worse, the temporary buffer used to ferry data between the
DRBG and userspace is woefully small at only 256 bytes, which doesn't do a
good job of maximizing throughput from the DRBG. This results in lost
performance when userspace requests >256 bytes; it is observed that DRBG
throughput improves by 70% on an i9-13900H when the buffer size is
increased to 4096 bytes (one page). Going beyond the size of one page up to
the DRBG maximum request limit of 65536 bytes produces diminishing returns
of only 3% improved throughput in comparison. And going below the size of
one page produces progressively less throughput at each power of 2: there's
a 5% loss going from 4096 bytes to 2048 bytes and a 9% loss going from 2048
bytes to 1024 bytes.

Thus, this implements per-CPU DRBG instances utilizing a page-sized buffer
for each CPU to utilize the DRBG itself more effectively. On top of that,
for non-GRND_RANDOM requests, the DRBG's operations now occur under a local
lock that disables preemption on non-PREEMPT_RT kernels, which not only
keeps each CPU's DRBG instance isolated from another, but also improves
temporal cache locality while the DRBG actively generates a new string of
random bytes.

Prefaulting one user destination page at a time is also employed to prevent
a DRBG instance from getting blocked on page faults, thereby maximizing the
use of the DRBG so that the only bottleneck is the DRBG itself.

Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
We want to hard set the x86_64 FIPS required configs rather than rely on
default settings in the kernel, should these ever change without our
knowing it would not be something we would have actively checked.

The configs are a limited set of configs that is expanded out when
building using `make olddefconfig` a common practice in kernel building.

Note had to manually add the following since its normaly set by the RPM
build process.
CONFIG_CRYPTO_FIPS_NAME="Rocky Linux 9 Kernel Cryptographic API"

Signed-off-by: Jonathan Maple <jmaple@ciq.com>
Simplifies the workflow to use the reusable workflow defined in main
branch. This reduces duplication and makes the workflow easier to
maintain across multiple branches.

The workflow was renamed because it now includes validation over
and above just checking for upstream fixes

Signed-off-by: Jonathan Maple <jmaple@ciq.com>
Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
jira LE-3207
feature tools_hv
commit-author Shradha Gupta <shradhagupta@linux.microsoft.com>
commit a9c0b33

Allow the KVP daemon to log the KVP updates triggered in the VM
with a new debug flag(-d).
When the daemon is started with this flag, it logs updates and debug
information in syslog with loglevel LOG_DEBUG. This information comes
in handy for debugging issues where the key-value pairs for certain
pools show mismatch/incorrect values.
The distro-vendors can further consume these changes and modify the
respective service files to redirect the logs to specific files as
needed.

	Signed-off-by: Shradha Gupta <shradhagupta@linux.microsoft.com>
	Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
	Reviewed-by: Dexuan Cui <decui@microsoft.com>
Link: https://lore.kernel.org/r/1744715978-8185-1-git-send-email-shradhagupta@linux.microsoft.com
	Signed-off-by: Wei Liu <wei.liu@kernel.org>
Message-ID: <1744715978-8185-1-git-send-email-shradhagupta@linux.microsoft.com>
(cherry picked from commit a9c0b33)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
In FIPS mode, the DRBG must take precedence over all stdrng algorithms.
The only problem standing in the way of this is that a different stdrng
algorithm could get registered and utilized before the DRBG is registered,
and since crypto_alloc_rng() only allocates an stdrng algorithm when
there's no existing allocation, this means that it's possible for the wrong
stdrng algorithm to remain in use indefinitely.

This issue is also often impossible to observe from userspace; an RNG other
than the DRBG could be used somewhere in the kernel and userspace would be
none the wiser.

To ensure this can never happen, only allow stdrng instances from the DRBG
to be registered when running in FIPS mode. This works since the previous
commit forces the DRBG to be built into the kernel when CONFIG_CRYPTO_FIPS
is enabled, so the DRBG's presence is guaranteed when fips_enabled is true.

Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
jira LE-4472
commit-author Erni Sri Satya Vennela <ernis@linux.microsoft.com>
commit 75cabb4
upstream-diff There was a conflict seen when applying this
patch due to the following commit not present in our tree.
92272ec ("eth: add missing xdp.h includes in drivers")
Additionally, used RH_KABI_HIDE_INCLUDE for net/net_shaper.h,
RH_KABI_EXTEND for new struct fields (handle, speed) in
mana_port_context, and RH_KABI_EXTEND_ENUM for new command codes
(MANA_QUERY_LINK_CONFIG, MANA_SET_BW_CLAMP) to preserve kABI
compatibility. New struct fields moved to end of mana_port_context.

Introduce support for net_shaper_ops in the MANA driver,
enabling configuration of rate limiting on the MANA NIC.

To apply rate limiting, the driver issues a HWC command via
mana_set_bw_clamp() and updates the corresponding shaper object
in the net_shaper cache. If an error occurs during this process,
the driver restores the previous speed by querying the current link
configuration using mana_query_link_cfg().

The minimum supported bandwidth is 100 Mbps, and only values that are
exact multiples of 100 Mbps are allowed. Any other values are rejected.

To remove a shaper, the driver resets the bandwidth to the maximum
supported by the SKU using mana_set_bw_clamp() and clears the
associated cache entry. If an error occurs during this process,
the shaper details are retained.

On the hardware that does not support these APIs, the net-shaper
calls to set speed would fail.

Set the speed:
./tools/net/ynl/pyynl/cli.py \
 --spec Documentation/netlink/specs/net_shaper.yaml \
 --do set --json '{"ifindex":'$IFINDEX',
		   "handle":{"scope": "netdev", "id":'$ID' },
		   "bw-max": 200000000 }'

Get the shaper details:
./tools/net/ynl/pyynl/cli.py \
 --spec Documentation/netlink/specs/net_shaper.yaml \
 --do get --json '{"ifindex":'$IFINDEX',
		      "handle":{"scope": "netdev", "id":'$ID' }}'

> {'bw-max': 200000000,
> 'handle': {'scope': 'netdev'},
> 'ifindex': $IFINDEX,
> 'metric': 'bps'}

Delete the shaper object:
./tools/net/ynl/pyynl/cli.py \
 --spec Documentation/netlink/specs/net_shaper.yaml \
 --do delete --json '{"ifindex":'$IFINDEX',
		      "handle":{"scope": "netdev","id":'$ID' }}'

	Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com>
	Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
	Reviewed-by: Shradha Gupta <shradhagupta@linux.microsoft.com>
	Reviewed-by: Saurabh Singh Sengar <ssengar@linux.microsoft.com>
	Reviewed-by: Long Li <longli@microsoft.com>
Link: https://patch.msgid.link/1750144656-2021-3-git-send-email-ernis@linux.microsoft.com
	Signed-off-by: Paolo Abeni <pabeni@redhat.com>

(cherry picked from commit 75cabb4)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira LE-4472
commit-author Erni Sri Satya Vennela <ernis@linux.microsoft.com>
commit a6d5edf
upstream-diff Used RH_KABI_EXTEND for the new max_speed field in
mana_port_context to preserve kABI compatibility. Field moved to
end of struct.

Allow mana ethtool get_link_ksettings operation to report
the maximum speed supported by the SKU in mbps.

The driver retrieves this information by issuing a
HWC command to the hardware via mana_query_link_cfg(),
which retrieves the SKU's maximum supported speed.

These APIs when invoked on hardware that are older/do
not support these APIs, the speed would be reported as UNKNOWN.

Before:
$ethtool enP30832s1
> Settings for enP30832s1:
        Supported ports: [  ]
        Supported link modes:   Not reported
        Supported pause frame use: No
        Supports auto-negotiation: No
        Supported FEC modes: Not reported
        Advertised link modes:  Not reported
        Advertised pause frame use: No
        Advertised auto-negotiation: No
        Advertised FEC modes: Not reported
        Speed: Unknown!
        Duplex: Full
        Auto-negotiation: off
        Port: Other
        PHYAD: 0
        Transceiver: internal
        Link detected: yes

After:
$ethtool enP30832s1
> Settings for enP30832s1:
        Supported ports: [  ]
        Supported link modes:   Not reported
        Supported pause frame use: No
        Supports auto-negotiation: No
        Supported FEC modes: Not reported
        Advertised link modes:  Not reported
        Advertised pause frame use: No
        Advertised auto-negotiation: No
        Advertised FEC modes: Not reported
        Speed: 16000Mb/s
        Duplex: Full
        Auto-negotiation: off
        Port: Other
        PHYAD: 0
        Transceiver: internal
        Link detected: yes

	Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com>
	Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
	Reviewed-by: Shradha Gupta <shradhagupta@linux.microsoft.com>
	Reviewed-by: Saurabh Singh Sengar <ssengar@linux.microsoft.com>
	Reviewed-by: Long Li <longli@microsoft.com>
Link: https://patch.msgid.link/1750144656-2021-4-git-send-email-ernis@linux.microsoft.com
	Signed-off-by: Paolo Abeni <pabeni@redhat.com>

(cherry picked from commit a6d5edf)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira LE-4472
commit-author Erni Sri Satya Vennela <ernis@linux.microsoft.com>
commit 11cd020

Fix build errors when CONFIG_NET_SHAPER is disabled, including:

drivers/net/ethernet/microsoft/mana/mana_en.c:804:10: error:
'const struct net_device_ops' has no member named 'net_shaper_ops'

     804 |         .net_shaper_ops         = &mana_shaper_ops,

drivers/net/ethernet/microsoft/mana/mana_en.c:804:35: error:
initialization of 'int (*)(struct net_device *, struct neigh_parms *)'
from incompatible pointer type 'const struct net_shaper_ops *'
[-Werror=incompatible-pointer-types]

     804 |         .net_shaper_ops         = &mana_shaper_ops,

	Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com>
Fixes: 75cabb4 ("net: mana: Add support for net_shaper_ops")
	Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202506230625.bfUlqb8o-lkp@intel.com/
	Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/1750851355-8067-1-git-send-email-ernis@linux.microsoft.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 11cd020)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
cve-pre CVE-2026-43500
commit-author David Howells <dhowells@redhat.com>
commit 1f27401
upstream-diff |
	Upstream's rxrpc_input_call_event() pulls skbs from a per-call queue
	in a loop, so the unshare block sits inside that loop alongside
	rxrpc_free_skb() and saw_ack bookkeeping. This kernel's version
	receives a single skb as a function parameter and doesn't free
	it (the caller in rxrpc_io_thread() does). As such, the adapted
	unshare block wraps the existing rxrpc_input_call_packet() call
	site, creates and frees a copy when needed, and drops the loop
	and queue-drain logic that doesn't exist here.

	Upstream already had rxrpc_skb_put_call_rx and rxrpc_skb_get_call_rx
	trace constants from a prior refactor not present in this tree.
	rxrpc_skb_put_call_rx is added here since the new skb_copy path
	needs it; rxrpc_skb_get_call_rx is omitted since nothing uses it.

	Several trace constants added by upstream (rxrpc_skb_put_purge_oob,
	rxrpc_skb_put_response, rxrpc_skb_put_response_copy) don't apply
	since the code they trace doesn't exist in this kernel.

	Note, Conflict caused by 153f90a
	("rxrpc: Use ktimes for call timeout tracking and set the timer lazily").

If skb_unshare() fails to unshare a packet due to allocation failure in
rxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thread())
will be NULL'd out.  This will likely cause the call to
trace_rxrpc_rx_done() to oops.

Fix this by moving the unsharing down to where rxrpc_input_call_event()
calls rxrpc_input_call_packet().  There are a number of places prior to
that where we ignore DATA packets for a variety of reasons (such as the
call already being complete) for which an unshare is then avoided.

And with that, rxrpc_input_packet() doesn't need to take a pointer to the
pointer to the packet, so change that to just a pointer.

Fixes: 2d1faf7 ("rxrpc: Simplify skbuff accounting in receive path")
Closes: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com
	Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260422161438.2593376-4-dhowells@redhat.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 1f27401)
	Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
Signed-off-by: Shreeya Patel <spatel@ciq.com>
cve-pre CVE-2026-43500
commit-author David Howells <dhowells@redhat.com>
commit 55b2984

Fix rxrpc_input_call_event() to only unshare DATA packets and not ACK,
ABORT, etc..

And with that, rxrpc_input_packet() doesn't need to take a pointer to the
pointer to the packet, so change that to just a pointer.

Fixes: 1f27401 ("rxrpc: Fix potential UAF after skb_unshare() failure")
Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com
	Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260423200909.3049438-2-dhowells@redhat.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 55b2984)
	Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
cve CVE-2026-43284
commit-author Kuan-Ting Chen <h3xrabbit@gmail.com>
commit f4c50a4
upstream-diff |
	While this kernel lacks MSG_SPLICE_PAGES, it still has udp_sendpage().
	Upstream didn't patch udp_sendpage() because sendpage was removed
	entirely in favor of MSG_SPLICE_PAGES. In this kernel, splice() can
	still attach a page cache page to an IPv4 datagram via sendpage.
	Therefore, udp_sendpage() must be patched instead. And there is no
	patch for IPv6 datagrams because it isn't affected; there's no
	sendpage callback for IPv6 UDP.

MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP
marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),
so later paths that may modify packet data can first make a private
copy. The IPv4/IPv6 datagram append paths did not set this flag when
splicing pages into UDP skbs.

That leaves an ESP-in-UDP packet made from shared pipe pages looking
like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW
fast path for uncloned skbs without a frag_list and decrypts in place
over data that is not owned privately by the skb.

Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching
TCP. Also make ESP input fall back to skb_cow_data() when the flag is
present, so ESP does not decrypt externally backed frags in place.
Private nonlinear skb frags still use the existing fast path.

This intentionally does not change ESP output. In esp_output_head(),
the path that appends the ESP trailer to existing skb tailroom without
calling skb_cow_data() is not reachable for nonlinear skbs:
skb_tailroom() returns zero when skb->data_len is nonzero, while ESP
tailen is positive. Thus ESP output will either use the separate
destination-frag path or fall back to skb_cow_data().

Fixes: cac2661 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30 ("esp6: Avoid skb_cow_data whenever possible")
Fixes: 7da0dde ("ip, udp: Support MSG_SPLICE_PAGES")
Fixes: 6d8192b ("ip6, udp6: Support MSG_SPLICE_PAGES")
	Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
	Reported-by: Kuan-Ting Chen <h3xrabbit@gmail.com>
	Tested-by: Hyunwoo Kim <imv4bel@gmail.com>
	Cc: stable@vger.kernel.org
	Signed-off-by: Kuan-Ting Chen <h3xrabbit@gmail.com>
	Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit f4c50a4)
Signed-off-by: Shreeya Patel <spatel@ciq.com>
cve CVE-2026-43500
commit-author Hyunwoo Kim <imv4bel@gmail.com>
commit -
commit-source https://lore.kernel.org/all/afKV2zGR6rrelPC7@v4bel
upstream-diff |
	The conn_event.c hunk is dropped entirely. Upstream wraps the
	conn->security->verify_response() call inside a new
	rxrpc_verify_response() function that copies non-linear skbs before
	in-place decryption. This kernel doesn't have that wrapper; the
	security op is called directly from rxrpc_process_event(), so there
	is no call site to patch. The call_event.c hunk applies as-is.

The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
handler in rxrpc_verify_response() copy the skb to a linear one before
calling into the security ops only when skb_cloned() is true.  An skb
that is not cloned but still carries paged fragments (skb->data_len != 0)
falls through to the in-place decryption path, which binds the frag
pages directly into the AEAD/skcipher SGL via skb_to_sgvec().

Extend the gate so that any skb with non-linear data is also copied,
ensuring the security handler always operates on a fully linear skb.
The OOM/trace handling already in place is reused.

Fixes: d0d5c0c ("rxrpc: Use skb_unshare() rather than skb_cow_data()")
	Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
(cherry picked from commit 544687651fe57721c5e4e76380ed8ef8fdfdc98b)
	Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
cve CVE-2026-46317
commit-author Hyunwoo Kim <imv4bel@gmail.com>
commit 7054335
upstream-diff | Due to missing the following change set the merge
    conflict arose due to a previous drop extra parameters to
    kvrealloc().  The change set was deemed unnecessary for this fix.
    https://lore.kernel.org/all/20240722163111.4766-1-dakr@kernel.org/

kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the
MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which
can run at any time. kvm_vcpu_init_nested() reallocates the array and frees
the old buffer while holding only kvm->arch.config_lock, so such a walker
can reference the freed array.

Allocate the new array outside of mmu_lock, as the allocation can sleep.
Under the lock, copy the existing entries, fix up the back pointers and
reassign the array. Free the old buffer after dropping the lock, as
kvfree() can sleep as well.

Fixes: 4f128f8 ("KVM: arm64: nv: Support multiple nested Stage-2 mmu structures")
	Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
	Reviewed-by: Oliver Upton <oupton@kernel.org>
Link: https://patch.msgid.link/aiKIVVeIr1aAB1yp@v4bel
	Signed-off-by: Marc Zyngier <maz@kernel.org>
	Cc: stable@vger,kernel.org
(cherry picked from commit 7054335)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
The fast per-CPU DRBG path computes its initial user destination address
straight from the iov_iter. For an ITER_IOVEC iter it reads iter_iov_addr()
and iter_iov_len() of the current segment, but when the iovec leads with
one or more zero-length segments, the current segment is one of those empty
entries. iter_iov_addr() then hands back the base of an empty segment,
which is whatever userspace put there: its base can be NULL or some other
unwritable address, since a zero-length segment is never actually touched.

Right after the setup, that address is prefaulted, and on a bogus base it
fails. A failed prefault on the very first address is treated as fatal, so
the whole read bails out to -EFAULT even though there are perfectly good
non-empty segments later in the iovec. This is reachable with something as
simple as readv() on /dev/urandom where the first iovec entry is {NULL, 0}.

Fix it by advancing the iterator by zero before reading the first address.
The iovec advance loop walks past every leading empty segment and stops at
the first non-empty one, and there's guaranteed to be such a segment
because iov_iter_count() is nonzero at this point. Empty segments that crop
up mid-stream are already skipped by the per-copy advance, so this only
needs to run once during setup.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
kerneltoast and others added 23 commits August 18, 2026 15:21
While GUP pinning makes it possible to pin the page _backing_ a user
address, it *doesn't* pin the page table entry (PTE) for that mapping. This
means the pinned physical page can be separated from the user address it
was backing, and even back a _different_ user address within the same
process. PTE zapping naturally happens during memory reclaim when memory
pressure is elevated, and can even be done directly by userspace via
madvise(MADV_DONTNEED).

Since the optimized per-CPU DRBG loop assumes copy_to_user_nofault() will
always succeed on a GUP-pinned page, it immediately bails out when the
nofault copy actually *does* fail for the reasons described above. This
results in either fewer than requested random bytes copied or, more
seriously, a spurious EFAULT returned to userspace when no random bytes
were copied.

As it turns out, there's no way to pin a PTE. That means it's not possible
to guarantee a 100% success rate for the copy_to_user_nofault() attempt.

Fix this by handling copy_to_user_nofault() errors correctly with a fall
back to a faultable copy attempt outside of the RNG lock. In order to
guarantee forward progress for the caller, an on-stack bounce buffer is
used to copy up to 256 bytes of the generated random bytes whenever this
happens rather than discarding the whole thing.

There's no need to use GUP pinning anymore since there's no use for having
a page pinned without pinning a PTE to go along with that page, hence the
page pinning is eliminated which saves a software page table walk that was
performed for _at least_ every destination page.

Reported-by: Kun Yi <kunyi@google.com>
Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
This reverts commit ef467f3.

This helper is no longer used by the FIPS-mode RNG, which was the
motivation for reintroducing it. Remove it.

Signed-off-by: Sultan Alsawaf <sultan@ciq.com>
jira KERNEL-1218
commit-author Shailend Chand <shailend@google.com>
commit 7cea48b

Queue allocation functions currently can only allocate into priv and
free memory in priv. These new structs would be passed into the queue
functions in a subsequent change to make them capable of returning newly
allocated resources and not just writing them into priv. They also make
it possible to allocate resources for queues with a different config
than that of the currently active queues.

	Signed-off-by: Shailend Chand <shailend@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Reviewed-by: Jeroen de Borst <jeroendb@google.com>
	Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240122182632.1102721-2-shailend@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 7cea48b)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Shailend Chand <shailend@google.com>
commit 1dfc2e4

This change makes the napi poll functions non-static and moves the
gve_(add|remove)_napi functions to gve_utils.c, to make possible future
"start queue" hooks in the datapath files.

	Signed-off-by: Shailend Chand <shailend@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Reviewed-by: Jeroen de Borst <jeroendb@google.com>
	Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240122182632.1102721-3-shailend@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 1dfc2e4)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Shailend Chand <shailend@google.com>
commit f13697c
upstream-diff The error-cleanup loops in gve_tx_alloc_rings_gqi()/_dqo()
  start at cfg->start_idx (not 0) so a failed XDP ring alloc does not
  free live non-XDP rings, and gve_add_xdp_queues() has an
  unreg_xdp_qpls label to unregister QPLs before freeing them on a
  create failure.
  Both are latent upstream bugs; upstream removed these paths in
  542a58f ("gve: introduce config-based allocation for XDP"),
  which this tree does not take.

The new config-aware functions will help achieve the goal of being able
to allocate resources for new queues while there already are active
queues serving traffic.

These new functions work off of arbitrary queue allocation configs
rather than just the currently active config in priv, and they return
the newly allocated resources instead of writing them into priv.

	Signed-off-by: Shailend Chand <shailend@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Reviewed-by: Jeroen de Borst <jeroendb@google.com>
	Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240122182632.1102721-4-shailend@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit f13697c)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Shailend Chand <shailend@google.com>
commit 92a6d7a

gve_open is rewritten to be composed of two funcs: gve_queues_mem_alloc
and gve_queues_start. The former only allocates queue resources without
doing anything to install the queues, which is taken up by the latter.
Similarly gve_close is split into gve_queues_stop and
gve_queues_mem_free.

Separating the acts of queue resource allocation and making the queue
become live help with subsequent changes that aim to not take down the
datapath when applying new configurations.

	Signed-off-by: Shailend Chand <shailend@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Reviewed-by: Jeroen de Borst <jeroendb@google.com>
Link: https://lore.kernel.org/r/20240122182632.1102721-5-shailend@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 92a6d7a)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Shailend Chand <shailend@google.com>
commit 5f08cd3

Previously, existing queues were being freed before the resources for
the new queues were being allocated. This would take down the interface
if someone were to attempt to change queue counts under a resource
crunch.

	Signed-off-by: Shailend Chand <shailend@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Reviewed-by: Jeroen de Borst <jeroendb@google.com>
Link: https://lore.kernel.org/r/20240122182632.1102721-6-shailend@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 5f08cd3)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Shailend Chand <shailend@google.com>
commit f375377

Previously, existing queues were being freed before the resources for
the new queues were being allocated. This would take down the interface
if someone were to attempt to change feature flags under a resource
crunch.

	Signed-off-by: Shailend Chand <shailend@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Reviewed-by: Jeroen de Borst <jeroendb@google.com>
Link: https://lore.kernel.org/r/20240122182632.1102721-7-shailend@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit f375377)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Harshitha Ramamurthy <hramamurthy@google.com>
commit 4cbc70f

Combine the gve_set_desc_cnt and gve_set_desc_cnt_dqo into
one function which sets the counts after checking the queue
format. Both the functions in the previous code and the new
combined function never return an error so make the new
function void and remove the goto on error.

Also rename the new function to gve_set_default_desc_cnt to
be clearer about its intention.

	Reviewed-by: Praveen Kaligineedi <pkaligineedi@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 4cbc70f)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Harshitha Ramamurthy <hramamurthy@google.com>
commit 5dee3c7

For the DQO queue format, the gve driver stores two ring sizes
for both TX and RX - one for completion queue ring and one for
data buffer ring. This is supposed to enable asymmetric sizes
for these two rings but that is not supported. Make both fields
reference the same single variable.

This change renders reading supported TX completion ring size
and RX buffer ring size for DQO from the device useless, so change
those fields to reserved and remove related code.

	Reviewed-by: Praveen Kaligineedi <pkaligineedi@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 5dee3c7)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Harshitha Ramamurthy <hramamurthy@google.com>
commit b94d370

Fulfill the requirement that for GQI, the number of pages per
RX QPL is equal to the ring size. Set this value to be equal to
ring size. Because of this change, the rx_data_slot_cnt and
rx_pages_per_qpl fields stored in the priv structure are not
needed, so remove their usage. And for DQO, the number of pages
per RX QPL is more than ring size to account for out-of-order
completions. So set it to two times of rx ring size.

	Reviewed-by: Praveen Kaligineedi <pkaligineedi@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit b94d370)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Harshitha Ramamurthy <hramamurthy@google.com>
commit ed4fb32
upstream-diff Folded in the BUFFER_SIZES declarations (struct
  gve_device_option_buffer_sizes, its static_assert, and the three
  BUFFER_SIZES enumerators) from 0b43cf5 ("gve: Add header split
  device option"), since this commit's hunks land on those lines and
  RLC 9 lacks them; nothing consumes the declarations at the tip.
  There is no GVE_DEV_OPT_ID_BUFFER_SIZES parse case and the driver
  does not advertise GVE_SUP_BUFFER_SIZES_MASK, so the device is
  never told the option is supported and an unsolicited one falls
  into the existing unknown-option path.

Add support to read ring size change capability and the
min and max descriptor counts from the device and store it
in the driver. Also accommodate a special case where the
device does not provide minimum ring size depending on the
version of the device. In that case, rely on default values
for the minimums.

	Reviewed-by: Praveen Kaligineedi <pkaligineedi@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit ed4fb32)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Harshitha Ramamurthy <hramamurthy@google.com>
commit 834f945
upstream-diff Omitted the gve_set_hsplit_config() call in
  gve_set_ringparam, as the header-split feature
  (gve_header_split_supported / priv->header_split_enabled /
  gve_set_hsplit_config) is not present in RLC 9 and is unrelated to
  ring-size support. Added the ".set_ringparam = gve_set_ringparam"
  entry to gve_ethtool_ops, which upstream carried on a pre-existing
  stub that RLC 9 did not have.
  Upstream later reworks gve_set_ringparam() in d235bb2 ("gve:
  Allow ethtool to configure rx_buf_len") and c30fd91 ("gve:
  Consolidate and persist ethtool ring changes"), neither with a
  Fixes tag; check both when backporting future ethtool fixes.

Allow the user to change ring size via ethtool if
supported by the device. The driver relies on the
ring size ranges queried from device to validate
ring sizes requested by the user.

	Reviewed-by: Praveen Kaligineedi <pkaligineedi@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 834f945)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Praveen Kaligineedi <pkaligineedi@google.com>
commit fba917b
upstream-diff Kept RLC 9's 4-arg gve_adjust_config(priv, &qpls_alloc_cfg,
  &tx_alloc_cfg, &rx_alloc_cfg) signature and the existing inline
  feature-revert in gve_set_features (RLC 9 lacks the later qpl-cfg
  removal and the goto revert_features refactor); only the
  netif_carrier_ok()->netif_running() change from this commit was taken.

GVE driver wrongly relies on netif_carrier_ok() to check the
interface administrative state when resources are being
allocated/deallocated for queue(s). netif_carrier_ok() needs
to be replaced with netif_running() for all such cases.

Administrative state is the result of "ip link set dev <dev>
up/down". It reflects whether the administrator wants to use
the device for traffic and the corresponding resources have
been allocated.

Fixes: 5f08cd3 ("gve: Alloc before freeing when adjusting queues")
	Signed-off-by: Praveen Kaligineedi <pkaligineedi@google.com>
	Reviewed-by: Shailend Chand <shailend@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20240801205619.987396-1-pkaligineedi@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit fba917b)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Yue Haibing <yuehaibing@huawei.com>
commit 359c5eb
upstream-diff The removed line (int gve_rx_alloc_rings(struct gve_priv *))
  is identical to upstream, but it applies against different surrounding
  context: upstream deletes it just below the singular gve_rx_alloc_ring_gqi/
  gve_rx_free_ring_gqi declarations, which RLC 9's gve.h does not carry
  (this branch predates the singular-ring-helper split and uses only the
  plural gve_rx_alloc_rings_gqi/gve_rx_free_rings_gqi forms). The deletion
  was reanchored below gve_rx_work_pending() accordingly; no other lines
  change.

Commit f13697c ("gve: Switch to config-aware queue allocation")
convert this function to gve_rx_alloc_rings_gqi().

	Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
	Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20240816101906.882743-1-yuehaibing@huawei.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 359c5eb)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Joshua Washington <joshwash@google.com>
commit 6321f5f

When stopping XDP TX rings, the XDP clean function needs to be called to
clean out the entire queue, similar to what happens in the normal TX
queue case. Otherwise, the FIFO won't be cleared correctly, and
xsk_tx_completed won't be reported.

Fixes: 75eaae1 ("gve: Add XDP DROP and TX support for GQI-QPL format")
	Cc: stable@vger.kernel.org
	Signed-off-by: Joshua Washington <joshwash@google.com>
	Signed-off-by: Praveen Kaligineedi <pkaligineedi@google.com>
	Reviewed-by: Praveen Kaligineedi <pkaligineedi@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 6321f5f)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Joshua Washington <joshwash@google.com>
commit de63ac4
upstream-diff Kept RLC 9's qpls_alloc_cfg / new_qpl_cfg locals in
  gve_adjust_queues (pool-based QPL model; RLC 9 lacks the later qpl-cfg
  removal) alongside the num_xdp_queues local this commit adds; functional
  hunks apply unchanged. gve_set_channels() guards its XDP symmetry check
  on priv->xdp_prog instead of priv->num_xdp_queues (0 when the program is
  attached while the interface is down), from the guard change in upstream
  542a58f, whose full form depends on the num_xdp_queues->cfg
  refactor RLC 9 does not take.

This patch fixes a number of consistency issues in the queue allocation
path related to XDP.

As it stands, the number of allocated XDP queues changes in three
different scenarios.
1) Adding an XDP program while the interface is up via
   gve_add_xdp_queues
2) Removing an XDP program while the interface is up via
   gve_remove_xdp_queues
3) After queues have been allocated and the old queue memory has been
   removed in gve_queues_start.

However, the requirement for the interface to be up for
gve_(add|remove)_xdp_queues to be called, in conjunction with the fact
that the number of queues stored in priv isn't updated until _after_ XDP
queues have been allocated in the normal queue allocation path means
that if an XDP program is added while the interface is down, XDP queues
won't be added until the _second_ if_up, not the first.

Given the expectation that the number of XDP queues is equal to the
number of RX queues, scenario (3) has another problematic implication.
When changing the number of queues while an XDP program is loaded, the
number of XDP queues must be updated as well, as there is logic in the
driver (gve_xdp_tx_queue_id()) which relies on every RX queue having a
corresponding XDP TX queue. However, the number of XDP queues stored in
priv would not be updated until _after_ a close/open leading to a
mismatch in the number of XDP queues reported vs the number of XDP
queues which actually exist after the queue count update completes.

This patch remedies these issues by doing the following:
1) The allocation config getter function is set up to retrieve the
   _expected_ number of XDP queues to allocate instead of relying
   on the value stored in `priv` which is only updated once the queues
   have been allocated.
2) When adjusting queues, XDP queues are adjusted to match the number of
   RX queues when XDP is enabled. This only works in the case when
   queues are live, so part (1) of the fix must still be available in
   the case that queues are adjusted when there is an XDP program and
   the interface is down.

Fixes: 5f08cd3 ("gve: Alloc before freeing when adjusting queues")
	Cc: stable@vger.kernel.org
	Signed-off-by: Joshua Washington <joshwash@google.com>
	Signed-off-by: Praveen Kaligineedi <pkaligineedi@google.com>
	Reviewed-by: Praveen Kaligineedi <pkaligineedi@google.com>
	Reviewed-by: Shailend Chand <shailend@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit de63ac4)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
cve CVE-2025-38735
commit-author Jordan Rhee <jordanrhee@google.com>
commit 75a9a46

A crash can occur if an ethtool operation is invoked
after shutdown() is called.

shutdown() is invoked during system shutdown to stop DMA operations
without performing expensive deallocations. It is discouraged to
unregister the netdev in this path, so the device may still be visible
to userspace and kernel helpers.

In gve, shutdown() tears down most internal data structures. If an
ethtool operation is dispatched after shutdown(), it will dereference
freed or NULL pointers, leading to a kernel panic. While graceful
shutdown normally quiesces userspace before invoking the reboot
syscall, forced shutdowns (as observed on GCP VMs) can still trigger
this path.

Fix by calling netif_device_detach() in shutdown().
This marks the device as detached so the ethtool ioctl handler
will skip dispatching operations to the driver.

Fixes: 974365e ("gve: Implement suspend/resume/shutdown")
	Signed-off-by: Jordan Rhee <jordanrhee@google.com>
	Signed-off-by: Jeroen de Borst <jeroendb@google.com>
Link: https://patch.msgid.link/20250818211245.1156919-1-jeroendb@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 75a9a46)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
cve CVE-2025-71156
commit-author Ankit Garg <nktgrg@google.com>
commit 3d970ed
upstream-diff RLC 9 predates 9a5e077 ("gve: Avoid rescheduling
  napi if on wrong cpu"), so there is no block->irq field and no
  netif_napi_set_irq() call: the enable_irq()/disable_irq() calls
  take the irq from the matching msix vector entry
  (priv->msix_vectors[ntfy_idx].vector; notify block i is requested
  on msix vector i) and land around this tree's unlocked
  netif_napi_add()/netif_napi_del() forms.

Currently, interrupts are automatically enabled immediately upon
request. This allows interrupt to fire before the associated NAPI
context is fully initialized and cause failures like below:

[    0.946369] Call Trace:
[    0.946369]  <IRQ>
[    0.946369]  __napi_poll+0x2a/0x1e0
[    0.946369]  net_rx_action+0x2f9/0x3f0
[    0.946369]  handle_softirqs+0xd6/0x2c0
[    0.946369]  ? handle_edge_irq+0xc1/0x1b0
[    0.946369]  __irq_exit_rcu+0xc3/0xe0
[    0.946369]  common_interrupt+0x81/0xa0
[    0.946369]  </IRQ>
[    0.946369]  <TASK>
[    0.946369]  asm_common_interrupt+0x22/0x40
[    0.946369] RIP: 0010:pv_native_safe_halt+0xb/0x10

Use the `IRQF_NO_AUTOEN` flag when requesting interrupts to prevent auto
enablement and explicitly enable the interrupt in NAPI initialization
path (and disable it during NAPI teardown).

This ensures that interrupt lifecycle is strictly coupled with
readiness of NAPI context.

	Cc: stable@vger.kernel.org
Fixes: 1dfc2e4 ("gve: Refactor napi add and remove functions")
	Signed-off-by: Ankit Garg <nktgrg@google.com>
	Reviewed-by: Jordan Rhee <jordanrhee@google.com>
	Reviewed-by: Joshua Washington <joshwash@google.com>
	Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
Link: https://patch.msgid.link/20251219102945.2193617-1-hramamurthy@google.com
	Signed-off-by: Paolo Abeni <pabeni@redhat.com>

(cherry picked from commit 3d970ed)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
… QPL

jira KERNEL-1218
cve CVE-2026-23386
commit-author Ankit Garg <nktgrg@google.com>
commit fb868db
upstream-diff The moved gve_unmap_packet() keeps this tree's
  dma_unmap_page() for the frag entries; the netmem conversion
  (netmem_dma_unmap_page_attrs) is not in this tree.

In DQ-QPL mode, gve_tx_clean_pending_packets() incorrectly uses the RDA
buffer cleanup path. It iterates num_bufs times and attempts to unmap
entries in the dma array.

This leads to two issues:
1. The dma array shares storage with tx_qpl_buf_ids (union).
 Interpreting buffer IDs as DMA addresses results in attempting to
 unmap incorrect memory locations.
2. num_bufs in QPL mode (counting 2K chunks) can significantly exceed
 the size of the dma array, causing out-of-bounds access warnings
(trace below is how we noticed this issue).

UBSAN: array-index-out-of-bounds in
drivers/net/ethernet/drivers/net/ethernet/google/gve/gve_tx_dqo.c:178:5 index 18 is out of
range for type 'dma_addr_t[18]' (aka 'unsigned long long[18]')
Workqueue: gve gve_service_task [gve]
Call Trace:
<TASK>
dump_stack_lvl+0x33/0xa0
__ubsan_handle_out_of_bounds+0xdc/0x110
gve_tx_stop_ring_dqo+0x182/0x200 [gve]
gve_close+0x1be/0x450 [gve]
gve_reset+0x99/0x120 [gve]
gve_service_task+0x61/0x100 [gve]
process_scheduled_works+0x1e9/0x380

Fix this by properly checking for QPL mode and delegating to
gve_free_tx_qpl_bufs() to reclaim the buffers.

	Cc: stable@vger.kernel.org
Fixes: a6fb8d5 ("gve: Tx path for DQO-QPL")
	Signed-off-by: Ankit Garg <nktgrg@google.com>
	Reviewed-by: Jordan Rhee <jordanrhee@google.com>
	Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com>
	Signed-off-by: Joshua Washington <joshwash@google.com>
	Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260220215324.1631350-1-joshwash@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>

(cherry picked from commit fb868db)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Matt Olson <maolson@google.com>
commit 07993df
upstream-diff gve_update_num_qpl_pages()'s page math is inlined in
  gve_alloc_qpls(), since RLC 9 keeps the pool-based QPL model: u32
  intermediates and (u64) casts on the math; the GQI branch writes both
  tx and rx counts (upstream writes only rx and relies on the get-curr
  seeding of tx, which this commit adds to RLC 9's get-curr helpers
  too); cfg->is_gqi gating and cfg->tx_cfg/rx_cfg queue counts in place
  of upstream's queue_format/qcfg forms. The QPLs are sized from the
  u16 pages_per_qpl cfg fields so QPL size and num_buf_states agree;
  tx_num_qpls is derived from the xdp_prog-aware tx_alloc_cfg->num_rings
  (from upstream 542a58f, paired with the gve_set_channels() guard
  in de63ac4), which removes the last reader of
  gve_qpls_alloc_cfg.num_xdp_queues, so that field and its write in
  gve_qpls_get_curr_alloc_cfg() are deleted.

For DQO, change QPL page registration logic to be more flexible to honor
the "max_registered_pages" parameter from the gVNIC device.

Previously the number of RX pages per QPL was hardcoded to twice the
ring size, and the number of TX pages per QPL was dictated by the device
in the DQO-QPL device option. Now [in DQO-QPL mode], the driver will
ignore the "tx_pages_per_qpl" parameter indicated in the DQO-QPL device
option and instead allocate up to (tx_queue_length / 2) pages per TX QPL
and up to (rx_queue_length * 2) pages per RX QPL while keeping the total
number of pages under the "max_registered_pages".

Merge DQO and GQI QPL page calculation logic into a unified
gve_update_num_qpl_pages function. Add rx_pages_per_qpl to the priv
struct for consumption by both DQO and GQI.

	Signed-off-by: Matt Olson <maolson@google.com>
	Signed-off-by: Max Yuan <maxyuan@google.com>
	Reviewed-by: Jordan Rhee <jordanrhee@google.com>
	Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
	Reviewed-by: Praveen Kaligineedi <pkaligineedi@google.com>
	Signed-off-by: Joshua Washington <joshwash@google.com>
Link: https://patch.msgid.link/20260225182342.1049816-2-joshwash@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 07993df)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218
commit-author Matt Olson <maolson@google.com>
commit a2f1918

The gVNIC device indicates a device option (MODIFY_RING) to the driver,
which presents a range of ring sizes from which the user is allowed to
select. But in DQO-QPL queue format, the driver ignores the "max" of
this range and instead allows the user to configure the ring size in the
range [min, default]. This was done because increasing the ring size
could result in the number of registered pages being higher than the max
allowed by the device.

In order to support large ring sizes, stop ignoring the "max" of the
range presented in the MODIFY_RING option.

	Signed-off-by: Matt Olson <maolson@google.com>
	Signed-off-by: Max Yuan <maxyuan@google.com>
	Reviewed-by: Jordan Rhee <jordanrhee@google.com>
	Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com>
	Reviewed-by: Praveen Kaligineedi <pkaligineedi@google.com>
	Signed-off-by: Joshua Washington <joshwash@google.com>
Link: https://patch.msgid.link/20260225182342.1049816-3-joshwash@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit a2f1918)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
jira KERNEL-1218

gve_tx_qpl_buf_init() sizes the TX buffer free list as
GVE_TX_BUFS_PER_PAGE_DQO * num_entries, but the free-list links
(tx_qpl_buf_next) are s16.  GVE_TX_BUFS_PER_PAGE_DQO is PAGE_SIZE >> 11,
so on 64K-page builds (the aarch64-64k config ships CONFIG_GVE=m) a
4096-entry TX ring yields 2048 pages and 65536 buffers: entry 32767 is
seeded with a link of 32768, which reads back as -32768, and once 32768
buffers have been allocated gve_alloc_tx_qpl_buf() dereferences
tx_qpl_buf_next[-32768] and returns ids that index outside the QPL.

Clamp the count to S16_MAX, leaving an oversized QPL's tail unused
rather than mislinked.

This is not unique to this backport: upstream has the same unclamped
math at its tip. Kept as a separate commit so it can be dropped in
favor of the upstream fix once one lands;

Fixes: 07993df ("gve: Update QPL page registration logic")
Signed-off-by: Shreeya Patel <spatel@ciq.com>
@github-actions

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/32189418305

@github-actions

Copy link
Copy Markdown

🔍 Upstream Linux Kernel Commit Check

  • ⚠️ PR commit 89ae02e1cb4 (net: mana: Add support for net_shaper_ops) references upstream commit
    75cabb46935b which has been referenced by a Fixes: tag in the upstream
    Linux kernel:
    3b7c7fc97ae net: mana: Move current_speed debugfs file to mana_init_port() (Erni Sri Satya Vennela)
  • ⚠️ PR commit ddf77be41c2 (rxrpc: Fix potential UAF after skb_unshare() failure) does not reference a CVE but
    upstream commit 1f2740150f90 is associated with CVE-2026-45998

  • ⚠️ PR commit 81bb6767f77 (xfrm: esp: avoid in-place decrypt on shared skb frags) references upstream commit
    f4c50a4034e6 which has been referenced by a Fixes: tag in the upstream
    Linux kernel:

    48f6a5356a3 net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) (CVE-2026-43503)
    f84eca58173 net: skbuff: preserve shared-frag marker during coalescing (William Bowling) (CVE-2026-46300)

This is an automated message from the kernel commit checker workflow.

@github-actions

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit 89ae02e1cb4 (net: mana: Add support for net_shaper_ops) → upstream 75cabb46935b
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/include/net/mana/mana.h
+++ b/include/net/mana/mana.h
@@ -4,9 +4,6 @@
 #ifndef _MANA_H
 #define _MANA_H
 
-#include <linux/rh_kabi.h>
-#include RH_KABI_HIDE_INCLUDE(<net/net_shaper.h>)
-
 #include "gdma.h"
 #include "hw_channel.h"
 
@@ -555,14 +552,6 @@
 
 	/* Debugfs */
 	struct dentry *mana_port_debugfs;
-
-	/* Fields added via RH_KABI_EXTEND to preserve kABI for MANA symbols
-	 * added to the kABI whitelist in RHEL 9.8.
-	 * Upstream commits: 75cabb46935b ("net: mana: Add support for net_shaper_ops")
-	 * and a6d5edf11e0c ("net: mana: Add speed support in mana_get_link_ksettings")
-	 */
-	RH_KABI_EXTEND(struct net_shaper_handle handle)
-	RH_KABI_EXTEND(u32 speed)
 };
 
 netdev_tx_t mana_start_xmit(struct sk_buff *skb, struct net_device *ndev);
@@ -619,8 +605,8 @@
 	MANA_FENCE_RQ		= 0x20006,
 	MANA_CONFIG_VPORT_RX	= 0x20007,
 	MANA_QUERY_VPORT_CONFIG	= 0x20008,
-	RH_KABI_EXTEND_ENUM(MANA_QUERY_LINK_CONFIG = 0x2000A)
-	RH_KABI_EXTEND_ENUM(MANA_SET_BW_CLAMP = 0x2000B)
+	MANA_QUERY_LINK_CONFIG	= 0x2000A,
+	MANA_SET_BW_CLAMP	= 0x2000B,
 	MANA_QUERY_PHY_STAT     = 0x2000c,
 
 	/* Privileged commands for the PF mode */

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/include/net/mana/mana.h
+++ b/include/net/mana/mana.h
@@ -5,6 +5,7 @@
 #define _MANA_H
 
 #include <net/xdp.h>
+#include <net/net_shaper.h>
 
 #include "gdma.h"
 #include "hw_channel.h"
@@ -526,6 +527,9 @@
 	struct mutex vport_mutex;
 	int vport_use_count;
 
+	/* Net shaper handle*/
+	struct net_shaper_handle handle;
+
 	u16 port_idx;
 
 	bool port_is_up;
@@ -527,6 +531,8 @@
 	int vport_use_count;
 
 	u16 port_idx;
+	/* Currently configured speed (mbps) */
+	u32 speed;
 
 	bool port_is_up;
 	bool port_st_save; /* Saved port state */
@@ -562,6 +568,9 @@
 void mana_chn_setxdp(struct mana_port_context *apc, struct bpf_prog *prog);
 int mana_bpf(struct net_device *ndev, struct netdev_bpf *bpf);
 void mana_query_gf_stats(struct mana_port_context *apc);
+int mana_query_link_cfg(struct mana_port_context *apc);
+int mana_set_bw_clamp(struct mana_port_context *apc, u32 speed,
+		      int enable_clamping);
 void mana_query_phy_stats(struct mana_port_context *apc);
 int mana_pre_alloc_rxbufs(struct mana_port_context *apc, int mtu, int num_queues);
 void mana_pre_dealloc_rxbufs(struct mana_port_context *apc);

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/ethernet/microsoft/mana/mana_en.c
+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
@@ -3139,5 +3008,5 @@
-
-	netif_carrier_on(ndev);
+		goto free_indir;
+	}
 
 	return 0;
 
--- b/include/net/mana/mana.h
+++ b/include/net/mana/mana.h
@@ -2,4 +1,9 @@
 #define _MANA_H
 
+#include <net/xdp.h>
+
+#include <linux/rh_kabi.h>
+#include RH_KABI_HIDE_INCLUDE(<net/net_shaper.h>)
+
 #include "gdma.h"
 #include "hw_channel.h"
@@ -576,6 +564,6 @@
 void mana_chn_setxdp(struct mana_port_context *apc, struct bpf_prog *prog);
 int mana_bpf(struct net_device *ndev, struct netdev_bpf *bpf);
-int mana_query_gf_stats(struct mana_context *ac);
+void mana_query_gf_stats(struct mana_port_context *apc);
 void mana_query_phy_stats(struct mana_port_context *apc);
 int mana_pre_alloc_rxbufs(struct mana_port_context *apc, int mtu, int num_queues);
 void mana_pre_dealloc_rxbufs(struct mana_port_context *apc);
  • ⚠️ PR commit 087b8fb048c (net: mana: Add speed support in mana_get_link_ksettings) → upstream a6d5edf11e0c
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/include/net/mana/mana.h
+++ b/include/net/mana/mana.h
@@ -563,7 +563,6 @@
 	 */
 	RH_KABI_EXTEND(struct net_shaper_handle handle)
 	RH_KABI_EXTEND(u32 speed)
-	RH_KABI_EXTEND(u32 max_speed)
 };
 
 netdev_tx_t mana_start_xmit(struct sk_buff *skb, struct net_device *ndev);

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/include/net/mana/mana.h
+++ b/include/net/mana/mana.h
@@ -533,6 +533,8 @@
 	u16 port_idx;
 	/* Currently configured speed (mbps) */
 	u32 speed;
+	/* Maximum speed supported by the SKU (mbps) */
+	u32 max_speed;
 
 	bool port_is_up;
 	bool port_st_save; /* Saved port state */

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/net/mana/mana.h
+++ b/include/net/mana/mana.h
@@ -530,6 +530,6 @@
-	 */
-	RH_KABI_EXTEND(struct net_shaper_handle handle)
-	RH_KABI_EXTEND(u32 speed)
-};
+	u16 port_idx;
+	/* Currently configured speed (mbps) */
+	u32 speed;
 
-netdev_tx_t mana_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+	bool port_is_up;
+	bool port_st_save; /* Saved port state */
  • ⚠️ PR commit ddf77be41c2 (rxrpc: Fix potential UAF after skb_unshare() failure) → upstream 1f2740150f90
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -137,7 +139,6 @@
 	EM(rxrpc_skb_new_error_report,		"NEW error-rpt") \
 	EM(rxrpc_skb_new_jumbo_subpacket,	"NEW jumbo-sub") \
 	EM(rxrpc_skb_new_unshared,		"NEW unshared ") \
-	EM(rxrpc_skb_put_call_rx,		"PUT call-rx  ") \
 	EM(rxrpc_skb_put_conn_secured,		"PUT conn-secd") \
 	EM(rxrpc_skb_put_conn_work,		"PUT conn-work") \
 	EM(rxrpc_skb_put_error_report,		"PUT error-rep") \
--- b/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -342,27 +342,8 @@
 	if (skb && skb->mark == RXRPC_SKB_MARK_ERROR)
 		goto out;
 
-	if (skb) {
-		struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
-
-		if (sp->hdr.securityIndex != 0 &&
-		    skb_cloned(skb)) {
-			/* Unshare the packet so that it can be
-			 * modified by in-place decryption.
-			 */
-			struct sk_buff *nskb = skb_copy(skb, GFP_ATOMIC);
-
-			if (nskb) {
-				rxrpc_new_skb(nskb, rxrpc_skb_new_unshared);
-				rxrpc_input_call_packet(call, nskb);
-				rxrpc_free_skb(nskb, rxrpc_skb_put_call_rx);
-			} else {
-				rxrpc_see_skb(skb, rxrpc_skb_see_unshare_nomem);
-			}
-		} else {
-			rxrpc_input_call_packet(call, skb);
-		}
-	}
+	if (skb)
+		rxrpc_input_call_packet(call, skb);
 
 	/* If we see our async-event poke, check for timeout trippage. */
 	now = ktime_get_real();

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -162,8 +162,6 @@
 	E_(rxrpc_call_poke_timer_now,		"Timer-now")
 
 #define rxrpc_skb_traces \
-	EM(rxrpc_skb_eaten_by_unshare,		"ETN unshare  ") \
-	EM(rxrpc_skb_eaten_by_unshare_nomem,	"ETN unshar-nm") \
 	EM(rxrpc_skb_get_call_rx,		"GET call-rx  ") \
 	EM(rxrpc_skb_get_conn_secured,		"GET conn-secd") \
 	EM(rxrpc_skb_get_conn_work,		"GET conn-work") \
@@ -190,6 +188,7 @@
 	EM(rxrpc_skb_put_purge,			"PUT purge    ") \
 	EM(rxrpc_skb_put_purge_oob,		"PUT purge-oob") \
 	EM(rxrpc_skb_put_response,		"PUT response ") \
+	EM(rxrpc_skb_put_response_copy,		"PUT resp-cpy ") \
 	EM(rxrpc_skb_put_rotate,		"PUT rotate   ") \
 	EM(rxrpc_skb_put_unknown,		"PUT unknown  ") \
 	EM(rxrpc_skb_see_conn_work,		"SEE conn-work") \
--- b/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -332,7 +332,24 @@
 
 			saw_ack |= sp->hdr.type == RXRPC_PACKET_TYPE_ACK;
 
-			rxrpc_input_call_packet(call, skb);
+			if (sp->hdr.securityIndex != 0 &&
+			    skb_cloned(skb)) {
+				/* Unshare the packet so that it can be
+				 * modified by in-place decryption.
+				 */
+				struct sk_buff *nskb = skb_copy(skb, GFP_ATOMIC);
+
+				if (nskb) {
+					rxrpc_new_skb(nskb, rxrpc_skb_new_unshared);
+					rxrpc_input_call_packet(call, nskb);
+					rxrpc_free_skb(nskb, rxrpc_skb_put_call_rx);
+				} else {
+					/* OOM - Drop the packet. */
+					rxrpc_see_skb(skb, rxrpc_skb_see_unshare_nomem);
+				}
+			} else {
+				rxrpc_input_call_packet(call, skb);
+			}
 			rxrpc_free_skb(skb, rxrpc_skb_put_call_rx);
 			did_receive = true;
 		}

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -126,4 +126,5 @@
 	EM(rxrpc_skb_eaten_by_unshare,		"ETN unshare  ") \
 	EM(rxrpc_skb_eaten_by_unshare_nomem,	"ETN unshar-nm") \
+	EM(rxrpc_skb_get_call_rx,		"GET call-rx  ") \
 	EM(rxrpc_skb_get_conn_secured,		"GET conn-secd") \
 	EM(rxrpc_skb_get_conn_work,		"GET conn-work") \
--- b/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -331,6 +329,7 @@
 
-	if (skb)
-		rxrpc_input_call_packet(call, skb);
+			saw_ack |= sp->hdr.type == RXRPC_PACKET_TYPE_ACK;
 
-	/* If we see our async-event poke, check for timeout trippage. */
-	now = ktime_get_real();
+			rxrpc_input_call_packet(call, skb);
+			rxrpc_free_skb(skb, rxrpc_skb_put_call_rx);
+			did_receive = true;
+		}
  • ⚠️ PR commit 5ed484d213c (rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets) → upstream 55b2984c96c3
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -345,8 +345,7 @@
 	if (skb) {
 		struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 
-		if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
-		    sp->hdr.securityIndex != 0 &&
+		if (sp->hdr.securityIndex != 0 &&
 		    skb_cloned(skb)) {
 			/* Unshare the packet so that it can be
 			 * modified by in-place decryption.

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -332,7 +332,8 @@
 
 			saw_ack |= sp->hdr.type == RXRPC_PACKET_TYPE_ACK;
 
-			if (sp->hdr.securityIndex != 0 &&
+			if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
+			    sp->hdr.securityIndex != 0 &&
 			    skb_cloned(skb)) {
 				/* Unshare the packet so that it can be
 				 * modified by in-place decryption.

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -331,5 +329,7 @@
 
-		if (sp->hdr.securityIndex != 0 &&
-		    skb_cloned(skb)) {
-			/* Unshare the packet so that it can be
-			 * modified by in-place decryption.
+			saw_ack |= sp->hdr.type == RXRPC_PACKET_TYPE_ACK;
+
+			if (sp->hdr.securityIndex != 0 &&
+			    skb_cloned(skb)) {
+				/* Unshare the packet so that it can be
+				 * modified by in-place decryption.
  • ⚠️ PR commit 81bb6767f77 (xfrm: esp: avoid in-place decrypt on shared skb frags) → upstream f4c50a4034e6
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1468,9 +1468,6 @@
 			goto error;
 		}
 
-		if (!(flags & MSG_NO_SHARED_FRAGS))
-			skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
-
 		if (skb->ip_summed == CHECKSUM_NONE) {
 			__wsum csum;
 			csum = csum_page(page, offset, len);

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1233,6 +1233,8 @@
 			if (err < 0)
 				goto error;
 			copy = err;
+			if (!(flags & MSG_NO_SHARED_FRAGS))
+				skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
 			wmem_alloc_delta += copy;
 		} else if (!zc) {
 			int i = skb_shinfo(skb)->nr_frags;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1230,6 +1230,6 @@
-			goto error;
-		}
-
-		if (skb->ip_summed == CHECKSUM_NONE) {
-			__wsum csum;
-			csum = csum_page(page, offset, len);
+			if (err < 0)
+				goto error;
+			copy = err;
+			wmem_alloc_delta += copy;
+		} else if (!zc) {
+			int i = skb_shinfo(skb)->nr_frags;

================================================================================
*    ONLY IN PATCH2 - files not modified by patch1                             *
================================================================================

--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -915,7 +915,8 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
 			nfrags = 1;
 
 			goto skip_cow;
-		} else if (!skb_has_frag_list(skb)) {
+		} else if (!skb_has_frag_list(skb) &&
+			   !skb_has_shared_frag(skb)) {
 			nfrags = skb_shinfo(skb)->nr_frags;
 			nfrags++;
 
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1794,6 +1794,8 @@ alloc_new_skb:
 			if (err < 0)
 				goto error;
 			copy = err;
+			if (!(flags & MSG_NO_SHARED_FRAGS))
+				skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
 			wmem_alloc_delta += copy;
 		} else if (!zc) {
 			int i = skb_shinfo(skb)->nr_frags;
  • ⚠️ PR commit e974f0f9d74 (KVM: arm64: Reassign nested_mmus array behind mmu_lock) → upstream 70543358fa08
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/arch/arm64/kvm/nested.c
+++ b/arch/arm64/kvm/nested.c
@@ -61,6 +61,13 @@
 	 * again, and there is no reason to affect the whole VM for this.
 	 */
 	num_mmus = atomic_read(&kvm->online_vcpus) * S2_MMU_PER_VCPU;
+	tmp = kvrealloc(kvm->arch.nested_mmus,
+			size_mul(sizeof(*kvm->arch.nested_mmus), kvm->arch.nested_mmus_size),
+			size_mul(sizeof(*kvm->arch.nested_mmus), num_mmus),
+			GFP_KERNEL_ACCOUNT | __GFP_ZERO);
+	if (!tmp)
+		return -ENOMEM;
+
 	if (num_mmus > kvm->arch.nested_mmus_size) {
 		tmp = kvcalloc(num_mmus, sizeof(*tmp), GFP_KERNEL_ACCOUNT);
 		if (!tmp)

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/arch/arm64/kvm/nested.c
+++ b/arch/arm64/kvm/nested.c
@@ -89,11 +89,6 @@
 	 * again, and there is no reason to affect the whole VM for this.
 	 */
 	num_mmus = atomic_read(&kvm->online_vcpus) * S2_MMU_PER_VCPU;
-	tmp = kvrealloc(kvm->arch.nested_mmus,
-			size_mul(sizeof(*kvm->arch.nested_mmus), num_mmus),
-			GFP_KERNEL_ACCOUNT | __GFP_ZERO);
-	if (!tmp)
-		return -ENOMEM;
 
 	swap(kvm->arch.nested_mmus, tmp);
 

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/arch/arm64/kvm/nested.c
+++ b/arch/arm64/kvm/nested.c
@@ -59,7 +59,6 @@
 	 */
 	num_mmus = atomic_read(&kvm->online_vcpus) * S2_MMU_PER_VCPU;
 	tmp = kvrealloc(kvm->arch.nested_mmus,
-			size_mul(sizeof(*kvm->arch.nested_mmus), kvm->arch.nested_mmus_size),
 			size_mul(sizeof(*kvm->arch.nested_mmus), num_mmus),
 			GFP_KERNEL_ACCOUNT | __GFP_ZERO);
 	if (!tmp)
  • ⚠️ PR commit b0fd1f14e82 (gve: Switch to config-aware queue allocation) → upstream f13697cc7a19
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -1301,13 +1301,13 @@
 static void gve_qpls_get_curr_alloc_cfg(struct gve_priv *priv,
 					struct gve_qpls_alloc_cfg *cfg)
 {
-	cfg->raw_addressing = !gve_is_qpl(priv);
-	cfg->is_gqi = gve_is_gqi(priv);
-	cfg->num_xdp_queues = priv->num_xdp_queues;
-	cfg->qpl_cfg = &priv->qpl_cfg;
-	cfg->tx_cfg = &priv->tx_cfg;
-	cfg->rx_cfg = &priv->rx_cfg;
-	cfg->qpls = priv->qpls;
+	  cfg->raw_addressing = !gve_is_qpl(priv);
+	  cfg->is_gqi = gve_is_gqi(priv);
+	  cfg->num_xdp_queues = priv->num_xdp_queues;
+	  cfg->qpl_cfg = &priv->qpl_cfg;
+	  cfg->tx_cfg = &priv->tx_cfg;
+	  cfg->rx_cfg = &priv->rx_cfg;
+	  cfg->qpls = priv->qpls;
 }
 
 static void gve_rx_get_curr_alloc_cfg(struct gve_priv *priv,
@@ -1542,12 +1542,10 @@
 
 	err = gve_create_xdp_rings(priv);
 	if (err)
-		goto unreg_xdp_qpls;
+		goto free_xdp_rings;
 
 	return 0;
 
-unreg_xdp_qpls:
-	gve_unregister_xdp_qpls(priv);
 free_xdp_rings:
 	gve_free_xdp_rings(priv);
 free_xdp_qpls:
--- b/drivers/net/ethernet/google/gve/gve_tx.c
+++ b/drivers/net/ethernet/google/gve/gve_tx.c
@@ -358,7 +358,7 @@
 	return 0;
 
 cleanup:
-	for (j = cfg->start_idx; j < i; j++)
+	for (j = 0; j < i; j++)
 		gve_tx_free_ring_gqi(priv, &tx[j], cfg);
 	if (cfg->start_idx == 0)
 		kvfree(tx);
--- b/drivers/net/ethernet/google/gve/gve_tx_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_tx_dqo.c
@@ -413,7 +413,7 @@
 	return 0;
 
 err:
-	for (j = cfg->start_idx; j < i; j++)
+	for (j = 0; j < i; j++)
 		gve_tx_free_ring_dqo(priv, &tx[j], cfg);
 	if (cfg->start_idx == 0)
 		kvfree(tx);

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/net/ethernet/google/gve/gve.h
+++ b/drivers/net/ethernet/google/gve/gve.h
@@ -1102,8 +1101,12 @@
 void gve_xdp_tx_flush(struct gve_priv *priv, u32 xdp_qid);
 bool gve_tx_poll(struct gve_notify_block *block, int budget);
 bool gve_xdp_poll(struct gve_notify_block *block, int budget);
-int gve_tx_alloc_rings(struct gve_priv *priv, int start_id, int num_rings);
-void gve_tx_free_rings_gqi(struct gve_priv *priv, int start_id, int num_rings);
+int gve_tx_alloc_rings_gqi(struct gve_priv *priv,
+			   struct gve_tx_alloc_rings_cfg *cfg);
+void gve_tx_free_rings_gqi(struct gve_priv *priv,
+			   struct gve_tx_alloc_rings_cfg *cfg);
+void gve_tx_start_ring_gqi(struct gve_priv *priv, int idx);
+void gve_tx_stop_ring_gqi(struct gve_priv *priv, int idx);
 u32 gve_tx_load_event_counter(struct gve_priv *priv,
 			      struct gve_tx_ring *tx);
 bool gve_tx_clean_pending(struct gve_priv *priv, struct gve_tx_ring *tx);

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve.h
+++ b/drivers/net/ethernet/google/gve/gve.h
@@ -1099,6 +1101,5 @@
 bool gve_tx_poll(struct gve_notify_block *block, int budget);
 bool gve_xdp_poll(struct gve_notify_block *block, int budget);
-int gve_xsk_tx_poll(struct gve_notify_block *block, int budget);
 int gve_tx_alloc_rings(struct gve_priv *priv, int start_id, int num_rings);
 void gve_tx_free_rings_gqi(struct gve_priv *priv, int start_id, int num_rings);
 u32 gve_tx_load_event_counter(struct gve_priv *priv,
  • ⚠️ PR commit 7a0ddae7c1d (gve: make the completion and buffer ring size equal for DQO) → upstream 5dee3c702c20
    Differences found:
================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve_adminq.c
+++ b/drivers/net/ethernet/google/gve/gve_adminq.c
@@ -640,4 +659,4 @@
 			cpu_to_be16(rx_buff_ring_entries);
 		cmd.create_rx_queue.enable_rsc =
 			!!(priv->dev->features & NETIF_F_LRO);
-	}
+		if (priv->header_split_enabled)
  • ⚠️ PR commit bf88331a496 (gve: set page count for RX QPL for GQI and DQO queue formats) → upstream b94d3703c1a6
    Differences found:
================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve.h
+++ b/drivers/net/ethernet/google/gve/gve.h
@@ -54,4 +54,4 @@
-#define GVE_GQ_TX_MIN_PKT_DESC_BYTES 182
+#define GVE_DEFAULT_HEADER_BUFFER_SIZE 128
 
 #define DQO_QPL_DEFAULT_TX_PAGES 512
 #define DQO_QPL_DEFAULT_RX_PAGES 2048
--- b/drivers/net/ethernet/google/gve/gve_adminq.c
+++ b/drivers/net/ethernet/google/gve/gve_adminq.c
@@ -749,3 +773,2 @@
 	}
-}
  • ⚠️ PR commit 85537e86870 (gve: add support to read ring size ranges from the device) → upstream ed4fb326947d
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve_adminq.c
+++ b/drivers/net/ethernet/google/gve/gve_adminq.c
@@ -42,9 +42,7 @@
 			     struct gve_device_option_gqi_qpl **dev_op_gqi_qpl,
 			     struct gve_device_option_dqo_rda **dev_op_dqo_rda,
 			     struct gve_device_option_jumbo_frames **dev_op_jumbo_frames,
-			     struct gve_device_option_dqo_qpl **dev_op_dqo_qpl,
-			     struct gve_device_option_buffer_sizes **dev_op_buffer_sizes,
-			     struct gve_device_option_modify_ring **dev_op_modify_ring)
+			     struct gve_device_option_dqo_qpl **dev_op_dqo_qpl)
 {
 	u32 req_feat_mask = be32_to_cpu(option->required_features_mask);
 	u16 option_length = be16_to_cpu(option->option_length);
@@ -189,9 +187,7 @@
 			   struct gve_device_option_gqi_qpl **dev_op_gqi_qpl,
 			   struct gve_device_option_dqo_rda **dev_op_dqo_rda,
 			   struct gve_device_option_jumbo_frames **dev_op_jumbo_frames,
-			   struct gve_device_option_dqo_qpl **dev_op_dqo_qpl,
-			   struct gve_device_option_buffer_sizes **dev_op_buffer_sizes,
-			   struct gve_device_option_modify_ring **dev_op_modify_ring)
+			   struct gve_device_option_dqo_qpl **dev_op_dqo_qpl)
 {
 	const int num_options = be16_to_cpu(descriptor->num_device_options);
 	struct gve_device_option *dev_opt;
@@ -212,8 +208,7 @@
 		gve_parse_device_option(priv, descriptor, dev_opt,
 					dev_op_gqi_rda, dev_op_gqi_qpl,
 					dev_op_dqo_rda, dev_op_jumbo_frames,
-					dev_op_dqo_qpl, dev_op_buffer_sizes,
-					dev_op_modify_ring);
+					dev_op_dqo_qpl);
 		dev_opt = next_opt;
 	}
 
@@ -757,11 +752,7 @@
 					  const struct gve_device_option_jumbo_frames
 					  *dev_op_jumbo_frames,
 					  const struct gve_device_option_dqo_qpl
-					  *dev_op_dqo_qpl,
-					  const struct gve_device_option_buffer_sizes
-					  *dev_op_buffer_sizes,
-					  const struct gve_device_option_modify_ring
-					  *dev_op_modify_ring)
+					  *dev_op_dqo_qpl)
 {
 	/* Before control reaches this point, the page-size-capped max MTU from
 	 * the gve_device_descriptor field has already been stored in
@@ -805,7 +796,6 @@
 
 int gve_adminq_describe_device(struct gve_priv *priv)
 {
-	struct gve_device_option_buffer_sizes *dev_op_buffer_sizes = NULL;
 	struct gve_device_option_jumbo_frames *dev_op_jumbo_frames = NULL;
 	struct gve_device_option_modify_ring *dev_op_modify_ring = NULL;
 	struct gve_device_option_gqi_rda *dev_op_gqi_rda = NULL;
@@ -839,9 +829,8 @@
 
 	err = gve_process_device_options(priv, descriptor, &dev_op_gqi_rda,
 					 &dev_op_gqi_qpl, &dev_op_dqo_rda,
-					 &dev_op_jumbo_frames, &dev_op_dqo_qpl,
-					 &dev_op_buffer_sizes,
-					 &dev_op_modify_ring);
+					 &dev_op_jumbo_frames,
+					 &dev_op_dqo_qpl);
 	if (err)
 		goto free_device_descriptor;
 
@@ -901,8 +890,7 @@
 	priv->default_num_queues = be16_to_cpu(descriptor->default_num_queues);
 
 	gve_enable_supported_features(priv, supported_features_mask,
-				      dev_op_jumbo_frames, dev_op_dqo_qpl,
-				      dev_op_buffer_sizes, dev_op_modify_ring);
+				      dev_op_jumbo_frames, dev_op_dqo_qpl);
 
 free_device_descriptor:
 	dma_pool_free(priv->adminq_pool, descriptor, descriptor_bus);
--- b/drivers/net/ethernet/google/gve/gve_adminq.h
+++ b/drivers/net/ethernet/google/gve/gve_adminq.h
@@ -124,15 +124,6 @@
 
 static_assert(sizeof(struct gve_device_option_jumbo_frames) == 8);
 
-struct gve_device_option_buffer_sizes {
-	/* GVE_SUP_BUFFER_SIZES_MASK bit should be set */
-	__be32 supported_features_mask;
-	__be16 packet_buffer_size;
-	__be16 header_buffer_size;
-};
-
-static_assert(sizeof(struct gve_device_option_buffer_sizes) == 8);
-
 struct gve_device_option_modify_ring {
 	__be32 supported_featured_mask;
 	__be16 max_rx_ring_size;
@@ -152,31 +143,25 @@
  *       the device for read/write and data is copied from/to SKBs.
  */
 enum gve_dev_opt_id {
-	GVE_DEV_OPT_ID_GQI_RAW_ADDRESSING	= 0x1,
-	GVE_DEV_OPT_ID_GQI_RDA			= 0x2,
-	GVE_DEV_OPT_ID_GQI_QPL			= 0x3,
-	GVE_DEV_OPT_ID_DQO_RDA			= 0x4,
-	GVE_DEV_OPT_ID_MODIFY_RING		= 0x6,
-	GVE_DEV_OPT_ID_DQO_QPL			= 0x7,
-	GVE_DEV_OPT_ID_JUMBO_FRAMES		= 0x8,
-	GVE_DEV_OPT_ID_BUFFER_SIZES		= 0xa,
+	GVE_DEV_OPT_ID_GQI_RAW_ADDRESSING = 0x1,
+	GVE_DEV_OPT_ID_GQI_RDA = 0x2,
+	GVE_DEV_OPT_ID_GQI_QPL = 0x3,
+	GVE_DEV_OPT_ID_DQO_RDA = 0x4,
+	GVE_DEV_OPT_ID_DQO_QPL = 0x7,
+	GVE_DEV_OPT_ID_JUMBO_FRAMES = 0x8,
 };
 
 enum gve_dev_opt_req_feat_mask {
-	GVE_DEV_OPT_REQ_FEAT_MASK_GQI_RAW_ADDRESSING	= 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_GQI_RDA		= 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_GQI_QPL		= 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_DQO_RDA		= 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_JUMBO_FRAMES		= 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_DQO_QPL		= 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_BUFFER_SIZES		= 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_MODIFY_RING		= 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_GQI_RAW_ADDRESSING = 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_GQI_RDA = 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_GQI_QPL = 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_DQO_RDA = 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_JUMBO_FRAMES = 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_DQO_QPL = 0x0,
 };
 
 enum gve_sup_feature_mask {
-	GVE_SUP_MODIFY_RING_MASK	= 1 << 0,
-	GVE_SUP_JUMBO_FRAMES_MASK	= 1 << 2,
-	GVE_SUP_BUFFER_SIZES_MASK	= 1 << 4,
+	GVE_SUP_JUMBO_FRAMES_MASK = 1 << 2,
 };
 
 #define GVE_DEV_OPT_LEN_GQI_RAW_ADDRESSING 0x0

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/net/ethernet/google/gve/gve_adminq.c
+++ b/drivers/net/ethernet/google/gve/gve_adminq.c
@@ -43,7 +45,8 @@
 			     struct gve_device_option_dqo_rda **dev_op_dqo_rda,
 			     struct gve_device_option_jumbo_frames **dev_op_jumbo_frames,
 			     struct gve_device_option_dqo_qpl **dev_op_dqo_qpl,
-			     struct gve_device_option_buffer_sizes **dev_op_buffer_sizes)
+			     struct gve_device_option_buffer_sizes **dev_op_buffer_sizes,
+			     struct gve_device_option_modify_ring **dev_op_modify_ring)
 {
 	u32 req_feat_mask = be32_to_cpu(option->required_features_mask);
 	u16 option_length = be16_to_cpu(option->option_length);
@@ -206,7 +230,8 @@
 			   struct gve_device_option_dqo_rda **dev_op_dqo_rda,
 			   struct gve_device_option_jumbo_frames **dev_op_jumbo_frames,
 			   struct gve_device_option_dqo_qpl **dev_op_dqo_qpl,
-			   struct gve_device_option_buffer_sizes **dev_op_buffer_sizes)
+			   struct gve_device_option_buffer_sizes **dev_op_buffer_sizes,
+			   struct gve_device_option_modify_ring **dev_op_modify_ring)
 {
 	const int num_options = be16_to_cpu(descriptor->num_device_options);
 	struct gve_device_option *dev_opt;
@@ -227,7 +252,8 @@
 		gve_parse_device_option(priv, descriptor, dev_opt,
 					dev_op_gqi_rda, dev_op_gqi_qpl,
 					dev_op_dqo_rda, dev_op_jumbo_frames,
-					dev_op_dqo_qpl, dev_op_buffer_sizes);
+					dev_op_dqo_qpl, dev_op_buffer_sizes,
+					dev_op_modify_ring);
 		dev_opt = next_opt;
 	}
 
@@ -776,7 +808,9 @@
 					  const struct gve_device_option_dqo_qpl
 					  *dev_op_dqo_qpl,
 					  const struct gve_device_option_buffer_sizes
-					  *dev_op_buffer_sizes)
+					  *dev_op_buffer_sizes,
+					  const struct gve_device_option_modify_ring
+					  *dev_op_modify_ring)
 {
 	/* Before control reaches this point, the page-size-capped max MTU from
 	 * the gve_device_descriptor field has already been stored in
@@ -865,9 +920,9 @@
 
 	err = gve_process_device_options(priv, descriptor, &dev_op_gqi_rda,
 					 &dev_op_gqi_qpl, &dev_op_dqo_rda,
-					 &dev_op_jumbo_frames,
-					 &dev_op_dqo_qpl,
-					 &dev_op_buffer_sizes);
+					 &dev_op_jumbo_frames, &dev_op_dqo_qpl,
+					 &dev_op_buffer_sizes,
+					 &dev_op_modify_ring);
 	if (err)
 		goto free_device_descriptor;
 
@@ -928,7 +983,7 @@
 
 	gve_enable_supported_features(priv, supported_features_mask,
 				      dev_op_jumbo_frames, dev_op_dqo_qpl,
-				      dev_op_buffer_sizes);
+				      dev_op_buffer_sizes, dev_op_modify_ring);
 
 free_device_descriptor:
 	dma_pool_free(priv->adminq_pool, descriptor, descriptor_bus);
--- b/drivers/net/ethernet/google/gve/gve_adminq.h
+++ b/drivers/net/ethernet/google/gve/gve_adminq.h
@@ -152,13 +162,14 @@
  *       the device for read/write and data is copied from/to SKBs.
  */
 enum gve_dev_opt_id {
-	GVE_DEV_OPT_ID_GQI_RAW_ADDRESSING = 0x1,
-	GVE_DEV_OPT_ID_GQI_RDA = 0x2,
-	GVE_DEV_OPT_ID_GQI_QPL = 0x3,
-	GVE_DEV_OPT_ID_DQO_RDA = 0x4,
-	GVE_DEV_OPT_ID_DQO_QPL = 0x7,
-	GVE_DEV_OPT_ID_JUMBO_FRAMES = 0x8,
-	GVE_DEV_OPT_ID_BUFFER_SIZES = 0xa,
+	GVE_DEV_OPT_ID_GQI_RAW_ADDRESSING	= 0x1,
+	GVE_DEV_OPT_ID_GQI_RDA			= 0x2,
+	GVE_DEV_OPT_ID_GQI_QPL			= 0x3,
+	GVE_DEV_OPT_ID_DQO_RDA			= 0x4,
+	GVE_DEV_OPT_ID_MODIFY_RING		= 0x6,
+	GVE_DEV_OPT_ID_DQO_QPL			= 0x7,
+	GVE_DEV_OPT_ID_JUMBO_FRAMES		= 0x8,
+	GVE_DEV_OPT_ID_BUFFER_SIZES		= 0xa,
 };
 
 enum gve_dev_opt_req_feat_mask {
@@ -162,13 +173,14 @@
 };
 
 enum gve_dev_opt_req_feat_mask {
-	GVE_DEV_OPT_REQ_FEAT_MASK_GQI_RAW_ADDRESSING = 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_GQI_RDA = 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_GQI_QPL = 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_DQO_RDA = 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_JUMBO_FRAMES = 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_DQO_QPL = 0x0,
-	GVE_DEV_OPT_REQ_FEAT_MASK_BUFFER_SIZES = 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_GQI_RAW_ADDRESSING	= 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_GQI_RDA		= 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_GQI_QPL		= 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_DQO_RDA		= 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_JUMBO_FRAMES		= 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_DQO_QPL		= 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_BUFFER_SIZES		= 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_MODIFY_RING		= 0x0,
 };
 
 enum gve_sup_feature_mask {
@@ -172,8 +184,9 @@
 };
 
 enum gve_sup_feature_mask {
-	GVE_SUP_JUMBO_FRAMES_MASK = 1 << 2,
-	GVE_SUP_BUFFER_SIZES_MASK = 1 << 4,
+	GVE_SUP_MODIFY_RING_MASK	= 1 << 0,
+	GVE_SUP_JUMBO_FRAMES_MASK	= 1 << 2,
+	GVE_SUP_BUFFER_SIZES_MASK	= 1 << 4,
 };
 
 #define GVE_DEV_OPT_LEN_GQI_RAW_ADDRESSING 0x0

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve.h
+++ b/drivers/net/ethernet/google/gve/gve.h
@@ -45,6 +45,6 @@
 /* PTYPEs are always 10 bits. */
 #define GVE_NUM_PTYPES	1024
 
 #define GVE_DEFAULT_RX_BUFFER_SIZE 2048
 
-#define GVE_DEFAULT_RX_BUFFER_OFFSET 2048
+#define GVE_MAX_RX_BUFFER_SIZE 4096
--- b/drivers/net/ethernet/google/gve/gve_adminq.c
+++ b/drivers/net/ethernet/google/gve/gve_adminq.c
@@ -36,6 +35,7 @@
 			     struct gve_device_option_dqo_rda **dev_op_dqo_rda,
 			     struct gve_device_option_jumbo_frames **dev_op_jumbo_frames,
-			     struct gve_device_option_dqo_qpl **dev_op_dqo_qpl)
+			     struct gve_device_option_dqo_qpl **dev_op_dqo_qpl,
+			     struct gve_device_option_buffer_sizes **dev_op_buffer_sizes)
 {
 	u32 req_feat_mask = be32_to_cpu(option->required_features_mask);
 	u16 option_length = be16_to_cpu(option->option_length);
@@ -162,6 +179,7 @@
 			   struct gve_device_option_dqo_rda **dev_op_dqo_rda,
 			   struct gve_device_option_jumbo_frames **dev_op_jumbo_frames,
-			   struct gve_device_option_dqo_qpl **dev_op_dqo_qpl)
+			   struct gve_device_option_dqo_qpl **dev_op_dqo_qpl,
+			   struct gve_device_option_buffer_sizes **dev_op_buffer_sizes)
 {
 	const int num_options = be16_to_cpu(descriptor->num_device_options);
 	struct gve_device_option *dev_opt;
@@ -185,7 +204,7 @@
 		gve_parse_device_option(priv, descriptor, dev_opt,
 					dev_op_gqi_rda, dev_op_gqi_qpl,
 					dev_op_dqo_rda, dev_op_jumbo_frames,
-					dev_op_dqo_qpl);
+					dev_op_dqo_qpl, dev_op_buffer_sizes);
 		dev_opt = next_opt;
 	}
 
@@ -715,5 +732,7 @@
 					  const struct gve_device_option_dqo_qpl
-					  *dev_op_dqo_qpl)
+					  *dev_op_dqo_qpl,
+					  const struct gve_device_option_buffer_sizes
+					  *dev_op_buffer_sizes)
 {
 	/* Before control reaches this point, the page-size-capped max MTU from
 	 * the gve_device_descriptor field has already been stored in
@@ -742,6 +765,7 @@
 
 int gve_adminq_describe_device(struct gve_priv *priv)
 {
+	struct gve_device_option_buffer_sizes *dev_op_buffer_sizes = NULL;
 	struct gve_device_option_jumbo_frames *dev_op_jumbo_frames = NULL;
 	struct gve_device_option_gqi_rda *dev_op_gqi_rda = NULL;
 	struct gve_device_option_gqi_qpl *dev_op_gqi_qpl = NULL;
@@ -780,7 +816,8 @@
 	err = gve_process_device_options(priv, descriptor, &dev_op_gqi_rda,
 					 &dev_op_gqi_qpl, &dev_op_dqo_rda,
 					 &dev_op_jumbo_frames,
-					 &dev_op_dqo_qpl);
+					 &dev_op_dqo_qpl,
+					 &dev_op_buffer_sizes);
 	if (err)
 		goto free_device_descriptor;
 
@@ -838,6 +874,7 @@
 
 	gve_enable_supported_features(priv, supported_features_mask,
-				      dev_op_jumbo_frames, dev_op_dqo_qpl);
+				      dev_op_jumbo_frames, dev_op_dqo_qpl,
+				      dev_op_buffer_sizes);
 
 free_device_descriptor:
 	dma_pool_free(priv->adminq_pool, descriptor, descriptor_bus);
--- b/drivers/net/ethernet/google/gve/gve_adminq.h
+++ b/drivers/net/ethernet/google/gve/gve_adminq.h
@@ -121,6 +121,6 @@
 
-static_assert(sizeof(struct gve_device_option_jumbo_frames) == 8);
+static_assert(sizeof(struct gve_device_option_buffer_sizes) == 8);
 
 /* Terminology:
  *
  * RDA - Raw DMA Addressing - Buffers associated with SKBs are directly DMA
@@ -139,6 +145,7 @@
 	GVE_DEV_OPT_ID_DQO_RDA = 0x4,
 	GVE_DEV_OPT_ID_DQO_QPL = 0x7,
 	GVE_DEV_OPT_ID_JUMBO_FRAMES = 0x8,
+	GVE_DEV_OPT_ID_BUFFER_SIZES = 0xa,
 };
 
 enum gve_dev_opt_req_feat_mask {
@@ -148,10 +155,12 @@
 	GVE_DEV_OPT_REQ_FEAT_MASK_DQO_RDA = 0x0,
 	GVE_DEV_OPT_REQ_FEAT_MASK_JUMBO_FRAMES = 0x0,
 	GVE_DEV_OPT_REQ_FEAT_MASK_DQO_QPL = 0x0,
+	GVE_DEV_OPT_REQ_FEAT_MASK_BUFFER_SIZES = 0x0,
 };
 
 enum gve_sup_feature_mask {
 	GVE_SUP_JUMBO_FRAMES_MASK = 1 << 2,
+	GVE_SUP_BUFFER_SIZES_MASK = 1 << 4,
 };
 
 #define GVE_DEV_OPT_LEN_GQI_RAW_ADDRESSING 0x0
  • ⚠️ PR commit b9d998516c3 (gve: add support to change ring size via ethtool) → upstream 834f9458f2fd
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve_ethtool.c
+++ b/drivers/net/ethernet/google/gve/gve_ethtool.c
@@ -482,90 +482,6 @@
 	cmd->tx_pending = priv->tx_desc_cnt;
 }
 
-static int gve_adjust_ring_sizes(struct gve_priv *priv,
-				 u16 new_tx_desc_cnt,
-				 u16 new_rx_desc_cnt)
-{
-	struct gve_tx_alloc_rings_cfg tx_alloc_cfg = {0};
-	struct gve_rx_alloc_rings_cfg rx_alloc_cfg = {0};
-	struct gve_qpls_alloc_cfg qpls_alloc_cfg = {0};
-	struct gve_qpl_config new_qpl_cfg;
-	int err;
-
-	/* get current queue configuration */
-	gve_get_curr_alloc_cfgs(priv, &qpls_alloc_cfg,
-				&tx_alloc_cfg, &rx_alloc_cfg);
-
-	/* copy over the new ring_size from ethtool */
-	tx_alloc_cfg.ring_size = new_tx_desc_cnt;
-	rx_alloc_cfg.ring_size = new_rx_desc_cnt;
-
-	/* qpl_cfg is not read-only, it contains a map that gets updated as
-	 * rings are allocated, which is why we cannot use the yet unreleased
-	 * one in priv.
-	 */
-	qpls_alloc_cfg.qpl_cfg = &new_qpl_cfg;
-	tx_alloc_cfg.qpl_cfg = &new_qpl_cfg;
-	rx_alloc_cfg.qpl_cfg = &new_qpl_cfg;
-
-	if (netif_running(priv->dev)) {
-		err = gve_adjust_config(priv, &qpls_alloc_cfg,
-					&tx_alloc_cfg, &rx_alloc_cfg);
-		if (err)
-			return err;
-	}
-
-	/* Set new ring_size for the next up */
-	priv->tx_desc_cnt = new_tx_desc_cnt;
-	priv->rx_desc_cnt = new_rx_desc_cnt;
-
-	return 0;
-}
-
-static int gve_validate_req_ring_size(struct gve_priv *priv, u16 new_tx_desc_cnt,
-				      u16 new_rx_desc_cnt)
-{
-	/* check for valid range */
-	if (new_tx_desc_cnt < priv->min_tx_desc_cnt ||
-	    new_tx_desc_cnt > priv->max_tx_desc_cnt ||
-	    new_rx_desc_cnt < priv->min_rx_desc_cnt ||
-	    new_rx_desc_cnt > priv->max_rx_desc_cnt) {
-		dev_err(&priv->pdev->dev, "Requested descriptor count out of range\n");
-		return -EINVAL;
-	}
-
-	if (!is_power_of_2(new_tx_desc_cnt) || !is_power_of_2(new_rx_desc_cnt)) {
-		dev_err(&priv->pdev->dev, "Requested descriptor count has to be a power of 2\n");
-		return -EINVAL;
-	}
-	return 0;
-}
-
-static int gve_set_ringparam(struct net_device *netdev,
-			     struct ethtool_ringparam *cmd,
-			     struct kernel_ethtool_ringparam *kernel_cmd,
-			     struct netlink_ext_ack *extack)
-{
-	struct gve_priv *priv = netdev_priv(netdev);
-	u16 new_tx_cnt, new_rx_cnt;
-
-	if (cmd->tx_pending == priv->tx_desc_cnt && cmd->rx_pending == priv->rx_desc_cnt)
-		return 0;
-
-	if (!priv->modify_ring_size_enabled) {
-		dev_err(&priv->pdev->dev, "Modify ring size is not supported.\n");
-		return -EOPNOTSUPP;
-	}
-
-	new_tx_cnt = cmd->tx_pending;
-	new_rx_cnt = cmd->rx_pending;
-
-	if (gve_validate_req_ring_size(priv, new_tx_cnt, new_rx_cnt))
-		return -EINVAL;
-
-	return gve_adjust_ring_sizes(priv, new_tx_cnt, new_rx_cnt);
-}
-
 static int gve_user_reset(struct net_device *netdev, u32 *flags)
 {
 	struct gve_priv *priv = netdev_priv(netdev);
@@ -751,7 +667,6 @@
 	.get_coalesce = gve_get_coalesce,
 	.set_coalesce = gve_set_coalesce,
 	.get_ringparam = gve_get_ringparam,
-	.set_ringparam = gve_set_ringparam,
 	.reset = gve_user_reset,
 	.get_tunable = gve_get_tunable,
 	.set_tunable = gve_set_tunable,

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/net/ethernet/google/gve/gve_ethtool.c
+++ b/drivers/net/ethernet/google/gve/gve_ethtool.c
@@ -503,6 +503,65 @@
 		kernel_cmd->tcp_data_split = ETHTOOL_TCP_DATA_SPLIT_DISABLED;
 }
 
+static int gve_adjust_ring_sizes(struct gve_priv *priv,
+				 u16 new_tx_desc_cnt,
+				 u16 new_rx_desc_cnt)
+{
+	struct gve_tx_alloc_rings_cfg tx_alloc_cfg = {0};
+	struct gve_rx_alloc_rings_cfg rx_alloc_cfg = {0};
+	struct gve_qpls_alloc_cfg qpls_alloc_cfg = {0};
+	struct gve_qpl_config new_qpl_cfg;
+	int err;
+
+	/* get current queue configuration */
+	gve_get_curr_alloc_cfgs(priv, &qpls_alloc_cfg,
+				&tx_alloc_cfg, &rx_alloc_cfg);
+
+	/* copy over the new ring_size from ethtool */
+	tx_alloc_cfg.ring_size = new_tx_desc_cnt;
+	rx_alloc_cfg.ring_size = new_rx_desc_cnt;
+
+	/* qpl_cfg is not read-only, it contains a map that gets updated as
+	 * rings are allocated, which is why we cannot use the yet unreleased
+	 * one in priv.
+	 */
+	qpls_alloc_cfg.qpl_cfg = &new_qpl_cfg;
+	tx_alloc_cfg.qpl_cfg = &new_qpl_cfg;
+	rx_alloc_cfg.qpl_cfg = &new_qpl_cfg;
+
+	if (netif_running(priv->dev)) {
+		err = gve_adjust_config(priv, &qpls_alloc_cfg,
+					&tx_alloc_cfg, &rx_alloc_cfg);
+		if (err)
+			return err;
+	}
+
+	/* Set new ring_size for the next up */
+	priv->tx_desc_cnt = new_tx_desc_cnt;
+	priv->rx_desc_cnt = new_rx_desc_cnt;
+
+	return 0;
+}
+
+static int gve_validate_req_ring_size(struct gve_priv *priv, u16 new_tx_desc_cnt,
+				      u16 new_rx_desc_cnt)
+{
+	/* check for valid range */
+	if (new_tx_desc_cnt < priv->min_tx_desc_cnt ||
+	    new_tx_desc_cnt > priv->max_tx_desc_cnt ||
+	    new_rx_desc_cnt < priv->min_rx_desc_cnt ||
+	    new_rx_desc_cnt > priv->max_rx_desc_cnt) {
+		dev_err(&priv->pdev->dev, "Requested descriptor count out of range\n");
+		return -EINVAL;
+	}
+
+	if (!is_power_of_2(new_tx_desc_cnt) || !is_power_of_2(new_rx_desc_cnt)) {
+		dev_err(&priv->pdev->dev, "Requested descriptor count has to be a power of 2\n");
+		return -EINVAL;
+	}
+	return 0;
+}
+
 static int gve_set_ringparam(struct net_device *netdev,
 			     struct ethtool_ringparam *cmd,
 			     struct kernel_ethtool_ringparam *kernel_cmd,
@@ -506,6 +565,12 @@
 			     struct netlink_ext_ack *extack)
 {
 	struct gve_priv *priv = netdev_priv(netdev);
+	u16 new_tx_cnt, new_rx_cnt;
+	int err;
+
+	err = gve_set_hsplit_config(priv, kernel_cmd->tcp_data_split);
+	if (err)
+		return err;
 
 	if (priv->tx_desc_cnt != cmd->tx_pending ||
 	    priv->rx_desc_cnt != cmd->rx_pending) {
@@ -507,9 +572,11 @@
 {
 	struct gve_priv *priv = netdev_priv(netdev);
 
-	if (priv->tx_desc_cnt != cmd->tx_pending ||
-	    priv->rx_desc_cnt != cmd->rx_pending) {
-		dev_info(&priv->pdev->dev, "Modify ring size is not supported.\n");
+	if (cmd->tx_pending == priv->tx_desc_cnt && cmd->rx_pending == priv->rx_desc_cnt)
+		return 0;
+
+	if (!priv->modify_ring_size_enabled) {
+		dev_err(&priv->pdev->dev, "Modify ring size is not supported.\n");
 		return -EOPNOTSUPP;
 	}
 
@@ -513,7 +580,13 @@
 		return -EOPNOTSUPP;
 	}
 
-	return gve_set_hsplit_config(priv, kernel_cmd->tcp_data_split);
+	new_tx_cnt = cmd->tx_pending;
+	new_rx_cnt = cmd->rx_pending;
+
+	if (gve_validate_req_ring_size(priv, new_tx_cnt, new_rx_cnt))
+		return -EINVAL;
+
+	return gve_adjust_ring_sizes(priv, new_tx_cnt, new_rx_cnt);
 }
 
 static int gve_user_reset(struct net_device *netdev, u32 *flags)

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve_ethtool.c
+++ b/drivers/net/ethernet/google/gve/gve_ethtool.c
@@ -595,6 +487,112 @@
-	.get_coalesce = gve_get_coalesce,
-	.set_coalesce = gve_set_coalesce,
-	.get_ringparam = gve_get_ringparam,
-	.reset = gve_user_reset,
-	.get_tunable = gve_get_tunable,
-	.set_tunable = gve_set_tunable,
+{
+	struct gve_priv *priv = netdev_priv(netdev);
+
+	cmd->rx_max_pending = priv->rx_desc_cnt;
+	cmd->tx_max_pending = priv->tx_desc_cnt;
+	cmd->rx_pending = priv->rx_desc_cnt;
+	cmd->tx_pending = priv->tx_desc_cnt;
+
+		kernel_cmd->tcp_data_split = ETHTOOL_TCP_DATA_SPLIT_DISABLED;
+}
+
+static int gve_set_ringparam(struct net_device *netdev,
+			     struct ethtool_ringparam *cmd,
+			     struct kernel_ethtool_ringparam *kernel_cmd,
+			     struct netlink_ext_ack *extack)
+{
+	struct gve_priv *priv = netdev_priv(netdev);
+
+	if (priv->tx_desc_cnt != cmd->tx_pending ||
+	    priv->rx_desc_cnt != cmd->rx_pending) {
+		dev_info(&priv->pdev->dev, "Modify ring size is not supported.\n");
+		return -EOPNOTSUPP;
+	}
+
+	return gve_set_hsplit_config(priv, kernel_cmd->tcp_data_split);
+}
+
+static int gve_adjust_ring_sizes(struct gve_priv *priv,
+				 u16 new_tx_desc_cnt,
+				 u16 new_rx_desc_cnt)
+{
+	struct gve_tx_alloc_rings_cfg tx_alloc_cfg = {0};
+	struct gve_rx_alloc_rings_cfg rx_alloc_cfg = {0};
+	struct gve_qpls_alloc_cfg qpls_alloc_cfg = {0};
+	struct gve_qpl_config new_qpl_cfg;
+	int err;
+
+	/* get current queue configuration */
+	gve_get_curr_alloc_cfgs(priv, &qpls_alloc_cfg,
+				&tx_alloc_cfg, &rx_alloc_cfg);
+
+	/* copy over the new ring_size from ethtool */
+	tx_alloc_cfg.ring_size = new_tx_desc_cnt;
+	rx_alloc_cfg.ring_size = new_rx_desc_cnt;
+
+	/* qpl_cfg is not read-only, it contains a map that gets updated as
+	 * rings are allocated, which is why we cannot use the yet unreleased
+	 * one in priv.
+	 */
+	qpls_alloc_cfg.qpl_cfg = &new_qpl_cfg;
+	tx_alloc_cfg.qpl_cfg = &new_qpl_cfg;
+	rx_alloc_cfg.qpl_cfg = &new_qpl_cfg;
+
+	if (netif_running(priv->dev)) {
+		err = gve_adjust_config(priv, &qpls_alloc_cfg,
+					&tx_alloc_cfg, &rx_alloc_cfg);
+		if (err)
+			return err;
+	}
+
+	/* Set new ring_size for the next up */
+	priv->tx_desc_cnt = new_tx_desc_cnt;
+	priv->rx_desc_cnt = new_rx_desc_cnt;
+
+	return 0;
+}
+
+static int gve_validate_req_ring_size(struct gve_priv *priv, u16 new_tx_desc_cnt,
+				      u16 new_rx_desc_cnt)
+{
+	/* check for valid range */
+	if (new_tx_desc_cnt < priv->min_tx_desc_cnt ||
+	    new_tx_desc_cnt > priv->max_tx_desc_cnt ||
+	    new_rx_desc_cnt < priv->min_rx_desc_cnt ||
+	    new_rx_desc_cnt > priv->max_rx_desc_cnt) {
+		dev_err(&priv->pdev->dev, "Requested descriptor count out of range\n");
+		return -EINVAL;
+	}
+
+	if (!is_power_of_2(new_tx_desc_cnt) || !is_power_of_2(new_rx_desc_cnt)) {
+		dev_err(&priv->pdev->dev, "Requested descriptor count has to be a power of 2\n");
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static int gve_set_ringparam(struct net_device *netdev,
+			     struct ethtool_ringparam *cmd,
+			     struct kernel_ethtool_ringparam *kernel_cmd,
+			     struct netlink_ext_ack *extack)
+{
+	struct gve_priv *priv = netdev_priv(netdev);
+	u16 new_tx_cnt, new_rx_cnt;
+
+	if (cmd->tx_pending == priv->tx_desc_cnt && cmd->rx_pending == priv->rx_desc_cnt)
+		return 0;
+
+	if (!priv->modify_ring_size_enabled) {
+		dev_err(&priv->pdev->dev, "Modify ring size is not supported.\n");
+		return -EOPNOTSUPP;
+	}
+
+	new_tx_cnt = cmd->tx_pending;
+	new_rx_cnt = cmd->rx_pending;
+
+	if (gve_validate_req_ring_size(priv, new_tx_cnt, new_rx_cnt))
+		return -EINVAL;
+
+	return gve_adjust_ring_sizes(priv, new_tx_cnt, new_rx_cnt);
+}
+
+static int gve_user_reset(struct net_device *netdev, u32 *flags)
  • ⚠️ PR commit e6eb87ca591 (gve: Fix use of netif_carrier_ok()) → upstream fba917b169be
    Differences found:
################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -1847,7 +1847,7 @@
 	rx_alloc_cfg.qcfg = &new_rx_config;
 	tx_alloc_cfg.num_rings = new_tx_config.num_queues;
 
-	if (netif_carrier_ok(priv->dev)) {
+	if (netif_running(priv->dev)) {
 		err = gve_adjust_config(priv, &tx_alloc_cfg, &rx_alloc_cfg);
 		return err;
 	}
@@ -2064,7 +2064,7 @@
 
 	if ((netdev->features & NETIF_F_LRO) != (features & NETIF_F_LRO)) {
 		netdev->features ^= NETIF_F_LRO;
-		if (netif_carrier_ok(netdev)) {
+		if (netif_running(netdev)) {
 			err = gve_adjust_config(priv, &tx_alloc_cfg, &rx_alloc_cfg);
 			if (err)
 				goto revert_features;
  • ⚠️ PR commit 9780a07d0b8 (gve: Remove unused declaration gve_rx_alloc_rings()) → upstream 359c5eb0f736
    Differences found:
################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/net/ethernet/google/gve/gve.h
+++ b/drivers/net/ethernet/google/gve/gve.h
@@ -1153,7 +1153,6 @@
 			  int idx);
 void gve_rx_free_ring_gqi(struct gve_priv *priv, struct gve_rx_ring *rx,
 			  struct gve_rx_alloc_rings_cfg *cfg);
-int gve_rx_alloc_rings(struct gve_priv *priv);
 int gve_rx_alloc_rings_gqi(struct gve_priv *priv,
 			   struct gve_rx_alloc_rings_cfg *cfg);
 void gve_rx_free_rings_gqi(struct gve_priv *priv,
  • ⚠️ PR commit ed55ba18dd3 (gve: fix XDP allocation path in edge cases) → upstream de63ac44a527
    Differences found:
################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -1845,6 +1847,7 @@
 {
 	struct gve_tx_alloc_rings_cfg tx_alloc_cfg = {0};
 	struct gve_rx_alloc_rings_cfg rx_alloc_cfg = {0};
+	int num_xdp_queues;
 	int err;
 
 	gve_get_curr_alloc_cfgs(priv, &tx_alloc_cfg, &rx_alloc_cfg);

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -1922,5 +1842,3 @@
 	struct gve_rx_alloc_rings_cfg rx_alloc_cfg = {0};
-	struct gve_qpls_alloc_cfg qpls_alloc_cfg = {0};
-	struct gve_qpl_config new_qpl_cfg;
 	int err;
 
@@ -1947,5 +1854,5 @@
 	tx_alloc_cfg.num_rings = new_tx_config.num_queues;
 
 	if (netif_running(priv->dev)) {
-		err = gve_adjust_config(priv, &qpls_alloc_cfg,
-					&tx_alloc_cfg, &rx_alloc_cfg);
+		err = gve_adjust_config(priv, &tx_alloc_cfg, &rx_alloc_cfg);
+		return err;

================================================================================
*    ONLY IN PATCH1 - files not modified by patch2                             *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve_ethtool.c
+++ a/drivers/net/ethernet/google/gve/gve_ethtool.c
@@ -451,7 +451,7 @@
 	if (!new_rx || !new_tx)
 		return -EINVAL;
 
+	if (priv->num_xdp_queues &&
-	if (priv->xdp_prog &&
 	    (new_tx != new_rx || (2 * new_tx > priv->tx_cfg.max_queues))) {
 		dev_err(&priv->pdev->dev, "XDP load failed: The number of configured RX queues should be equal to the number of configured TX queues and the number of configured RX/TX queues should be less than or equal to half the maximum number of RX/TX queues");
 		return -EINVAL;
  • ⚠️ PR commit e4702a7df60 (gve: prevent ethtool ops after shutdown) → upstream 75a9a46d67f4
    Differences found:
================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -2600,2 +2600,3 @@
 	rtnl_lock();
+	netdev_lock(netdev);
 	if (was_up && gve_close(priv->dev)) {
  • ⚠️ PR commit f010a80532b (gve: defer interrupt enabling until NAPI registration) → upstream 3d970eda0034
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve_utils.c
+++ b/drivers/net/ethernet/google/gve/gve_utils.c
@@ -105,12 +105,10 @@
 
 	netif_napi_add(priv->dev, &block->napi, gve_poll);
-	enable_irq(priv->msix_vectors[ntfy_idx].vector);
 }
 
 void gve_remove_napi(struct gve_priv *priv, int ntfy_idx)
 {
 	struct gve_notify_block *block = &priv->ntfy_blocks[ntfy_idx];
 
-	disable_irq(priv->msix_vectors[ntfy_idx].vector);
 	netif_napi_del(&block->napi);
 }

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/net/ethernet/google/gve/gve_utils.c
+++ b/drivers/net/ethernet/google/gve/gve_utils.c
@@ -112,6 +112,7 @@
 
 	netif_napi_add_locked(priv->dev, &block->napi, gve_poll);
 	netif_napi_set_irq_locked(&block->napi, block->irq);
+	enable_irq(block->irq);
 }
 
 void gve_remove_napi(struct gve_priv *priv, int ntfy_idx)
@@ -116,4 +117,5 @@
 	struct gve_notify_block *block = &priv->ntfy_blocks[ntfy_idx];
 
+	disable_irq(block->irq);
 	netif_napi_del_locked(&block->napi);
 }

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve_utils.c
+++ b/drivers/net/ethernet/google/gve/gve_utils.c
@@ -101,10 +101,11 @@
 
-	netif_napi_add(priv->dev, &block->napi, gve_poll);
+	netif_napi_add_locked(priv->dev, &block->napi, gve_poll);
+	netif_napi_set_irq_locked(&block->napi, block->irq);
 }
 
 void gve_remove_napi(struct gve_priv *priv, int ntfy_idx)
 {
 	struct gve_notify_block *block = &priv->ntfy_blocks[ntfy_idx];
 
-	netif_napi_del(&block->napi);
+	netif_napi_del_locked(&block->napi);
 }
  • ⚠️ PR commit 890451fb2cf (gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL) → upstream fb868db5f4bc
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve_tx_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_tx_dqo.c
@@ -169,8 +169,9 @@
 	dma_unmap_single(dev, dma_unmap_addr(pkt, dma[0]),
 			 dma_unmap_len(pkt, len[0]), DMA_TO_DEVICE);
 	for (i = 1; i < pkt->num_bufs; i++) {
-		dma_unmap_page(dev, dma_unmap_addr(pkt, dma[i]),
-			       dma_unmap_len(pkt, len[i]), DMA_TO_DEVICE);
+		netmem_dma_unmap_page_attrs(dev, dma_unmap_addr(pkt, dma[i]),
+					    dma_unmap_len(pkt, len[i]),
+					    DMA_TO_DEVICE, 0);
 	}
 	pkt->num_bufs = 0;
 }
@@ -1043,6 +1044,21 @@
 	}
 }
 
+static void gve_unmap_packet(struct device *dev,
+			     struct gve_tx_pending_packet_dqo *pkt)
+{
+	int i;
+
+	/* SKB linear portion is guaranteed to be mapped */
+	dma_unmap_single(dev, dma_unmap_addr(pkt, dma[0]),
+			 dma_unmap_len(pkt, len[0]), DMA_TO_DEVICE);
+	for (i = 1; i < pkt->num_bufs; i++) {
+		dma_unmap_page(dev, dma_unmap_addr(pkt, dma[i]),
+			       dma_unmap_len(pkt, len[i]), DMA_TO_DEVICE);
+	}
+	pkt->num_bufs = 0;
+}
+
 /* Completion types and expected behavior:
  * No Miss compl + Packet compl = Packet completed normally.
  * Miss compl + Re-inject compl = Packet completed normally.

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/net/ethernet/google/gve/gve_tx_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_tx_dqo.c
@@ -1167,22 +1177,6 @@
 	}
 }
 
-static void gve_unmap_packet(struct device *dev,
-			     struct gve_tx_pending_packet_dqo *pkt)
-{
-	int i;
-
-	/* SKB linear portion is guaranteed to be mapped */
-	dma_unmap_single(dev, dma_unmap_addr(pkt, dma[0]),
-			 dma_unmap_len(pkt, len[0]), DMA_TO_DEVICE);
-	for (i = 1; i < pkt->num_bufs; i++) {
-		netmem_dma_unmap_page_attrs(dev, dma_unmap_addr(pkt, dma[i]),
-					    dma_unmap_len(pkt, len[i]),
-					    DMA_TO_DEVICE, 0);
-	}
-	pkt->num_bufs = 0;
-}
-
 /* Completion types and expected behavior:
  * No Miss compl + Packet compl = Packet completed normally.
  * Miss compl + Re-inject compl = Packet completed normally.
  • ⚠️ PR commit 5c8acb8f262 (gve: Update QPL page registration logic) → upstream 07993df56091
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve.h
+++ b/drivers/net/ethernet/google/gve/gve.h
@@ -623,6 +623,7 @@
 	struct gve_queue_config *tx_cfg;
 	struct gve_queue_config *rx_cfg;
 
+	u16 num_xdp_queues;
 	bool raw_addressing;
 	bool is_gqi;
 
@@ -702,7 +701,7 @@
 	bool modify_ring_size_enabled;
 	bool default_min_ring_size;
-	u16 tx_pages_per_qpl; /* Suggested number of pages per qpl for TX queues by NIC */
-	u16 rx_pages_per_qpl; /* Number of pages per qpl for RX queues */
+	u16 tx_pages_per_qpl;
+	u16 rx_pages_per_qpl;
 	u64 max_registered_pages;
 	u64 num_registered_pages; /* num pages registered with NIC */
 	struct bpf_prog *xdp_prog; /* XDP BPF program */
--- b/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -1117,13 +1115,11 @@
 }
 
 static int gve_alloc_qpls(struct gve_priv *priv, struct gve_qpls_alloc_cfg *cfg,
-			  struct gve_tx_alloc_rings_cfg *tx_alloc_cfg,
 			  struct gve_rx_alloc_rings_cfg *rx_alloc_cfg)
 {
 	int max_queues = cfg->tx_cfg->max_queues + cfg->rx_cfg->max_queues;
-	struct gve_queue_page_list *qpls;
 	int rx_start_id, tx_num_qpls, rx_num_qpls;
-	u32 tx_page_count, rx_page_count;
+	struct gve_queue_page_list *qpls;
 	u32 page_count;
 	int err;
 
@@ -1143,50 +1139,25 @@
 		goto free_qpl_array;
 	}
 
-	/* Compute the number of pages per QPL. For DQO-QPL, honor the device's
-	 * max_registered_pages limit by allocating up to (tx ring_size / 2)
-	 * pages per TX QPL and up to (rx ring_size * 2) pages per RX QPL,
-	 * shrinking proportionally if the total would exceed the limit. For
-	 * GQI-QPL the RX page count keeps a 1:1 relationship with descriptors.
-	 */
-	tx_page_count = priv->tx_pages_per_qpl;
-
-	if (cfg->is_gqi) {
-		rx_page_count = rx_alloc_cfg->ring_size;
-	} else {
-		u64 ideal_tx_pages, ideal_rx_pages, max_pages, tx_pages;
-		u16 tx_num_queues = cfg->tx_cfg->num_queues;
-		u16 rx_num_queues = cfg->rx_cfg->num_queues;
-
-		ideal_tx_pages = (u64)tx_alloc_cfg->ring_size * tx_num_queues / 2;
-		ideal_rx_pages = (u64)rx_alloc_cfg->ring_size * rx_num_queues * 2;
-		max_pages = min(priv->max_registered_pages,
-				ideal_tx_pages + ideal_rx_pages);
-
-		tx_pages = div64_u64(max_pages * ideal_tx_pages,
-				     ideal_tx_pages + ideal_rx_pages);
-		tx_page_count = div_u64(tx_pages, tx_num_queues);
-		rx_page_count = div_u64(max_pages - tx_pages, rx_num_queues);
-	}
-
-	/* Store the computed per-QPL page counts for the datapath to consume */
-	tx_alloc_cfg->pages_per_qpl = tx_page_count;
-	rx_alloc_cfg->pages_per_qpl = rx_page_count;
-
-	/* Allocate TX QPLs. Derive the count from the (already xdp_prog-aware)
-	 * TX ring count in tx_alloc_cfg->num_rings so the QPL count cannot
-	 * disagree with the ring count (which would leave XDP TX rings backed
-	 * by zeroed QPL entries).
-	 */
-	page_count = tx_alloc_cfg->pages_per_qpl;
-	tx_num_qpls = gve_is_qpl(priv) ? tx_alloc_cfg->num_rings : 0;
+	/* Allocate TX QPLs */
+	page_count = priv->tx_pages_per_qpl;
+	tx_num_qpls = gve_num_tx_qpls(cfg->tx_cfg, cfg->num_xdp_queues,
+				      gve_is_qpl(priv));
 	err = gve_alloc_n_qpls(priv, qpls, page_count, 0, tx_num_qpls);
 	if (err)
 		goto free_qpl_map;
 
 	/* Allocate RX QPLs */
 	rx_start_id = gve_rx_start_qpl_id(cfg->tx_cfg);
-	page_count = rx_alloc_cfg->pages_per_qpl;
+	/* For GQI_QPL number of pages allocated have 1:1 relationship with
+	 * number of descriptors. For DQO, number of pages required are
+	 * more than descriptors (because of out of order completions).
+	 * Set it to twice the number of descriptors.
+	 */
+	if (cfg->is_gqi)
+		page_count = rx_alloc_cfg->ring_size;
+	else
+		page_count = gve_get_rx_pages_per_qpl_dqo(rx_alloc_cfg->ring_size);
 	rx_num_qpls = gve_num_rx_qpls(cfg->rx_cfg, gve_is_qpl(priv));
 	err = gve_alloc_n_qpls(priv, qpls, page_count, rx_start_id, rx_num_qpls);
 	if (err)
@@ -1338,6 +1309,7 @@
 {
 	cfg->raw_addressing = !gve_is_qpl(priv);
 	cfg->is_gqi = gve_is_gqi(priv);
+	cfg->num_xdp_queues = priv->num_xdp_queues;
 	cfg->qpl_cfg = &priv->qpl_cfg;
 	cfg->tx_cfg = &priv->tx_cfg;
 	cfg->rx_cfg = &priv->rx_cfg;
@@ -1410,7 +1381,7 @@
 {
 	int err;
 
-	err = gve_alloc_qpls(priv, qpls_alloc_cfg, tx_alloc_cfg, rx_alloc_cfg);
+	err = gve_alloc_qpls(priv, qpls_alloc_cfg, rx_alloc_cfg);
 	if (err) {
 		netif_err(priv, drv, priv->dev, "Failed to alloc QPLs\n");
 		return err;
--- b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
@@ -178,7 +178,7 @@
 			return err;
 	} else {
 		idx = rx->dqo.next_qpl_page_idx;
-		if (idx >= priv->rx_pages_per_qpl) {
+		if (idx >= gve_get_rx_pages_per_qpl_dqo(priv->rx_desc_cnt)) {
 			net_err_ratelimited("%s: Out of QPL pages\n",
 					    priv->dev->name);
 			return -ENOMEM;

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/net/ethernet/google/gve/gve.h
+++ b/drivers/net/ethernet/google/gve/gve.h
@@ -709,6 +707,7 @@
 /* Parameters for allocating resources for tx queues */
 struct gve_tx_alloc_rings_cfg {
 	struct gve_tx_queue_config *qcfg;
+	u16 pages_per_qpl;
 
 	u16 num_xdp_rings;
 
@@ -724,6 +723,7 @@
 	/* tx config is also needed to determine QPL ids */
 	struct gve_rx_queue_config *qcfg_rx;
 	struct gve_tx_queue_config *qcfg_tx;
+	u16 pages_per_qpl;
 
 	u16 ring_size;
 	u16 packet_buffer_size;
@@ -1149,14 +1150,6 @@
 	return gve_get_rx_qpl_id(tx_cfg, 0);
 }
 
-static inline u32 gve_get_rx_pages_per_qpl_dqo(u32 rx_desc_cnt)
-{
-	/* For DQO, page count should be more than ring size for
-	 * out-of-order completions. Set it to two times of ring size.
-	 */
-	return 2 * rx_desc_cnt;
-}
-
 /* Returns the correct dma direction for tx and rx qpls */
 static inline enum dma_data_direction gve_qpl_dma_dir(struct gve_priv *priv,
 						      int id)
@@ -1307,6 +1300,9 @@
 void gve_get_curr_alloc_cfgs(struct gve_priv *priv,
 			     struct gve_tx_alloc_rings_cfg *tx_alloc_cfg,
 			     struct gve_rx_alloc_rings_cfg *rx_alloc_cfg);
+void gve_update_num_qpl_pages(struct gve_priv *priv,
+			      struct gve_rx_alloc_rings_cfg *rx_alloc_cfg,
+			      struct gve_tx_alloc_rings_cfg *tx_alloc_cfg);
 int gve_adjust_config(struct gve_priv *priv,
 		      struct gve_tx_alloc_rings_cfg *tx_alloc_cfg,
 		      struct gve_rx_alloc_rings_cfg *rx_alloc_cfg);
--- b/drivers/net/ethernet/google/gve/gve_adminq.c
+++ b/drivers/net/ethernet/google/gve/gve_adminq.c
@@ -970,14 +970,6 @@
 		priv->dev->max_mtu = be16_to_cpu(dev_op_jumbo_frames->max_mtu);
 	}
 
-	/* Override pages for qpl for DQO-QPL */
-	if (dev_op_dqo_qpl) {
-		priv->tx_pages_per_qpl =
-			be16_to_cpu(dev_op_dqo_qpl->tx_pages_per_qpl);
-		if (priv->tx_pages_per_qpl == 0)
-			priv->tx_pages_per_qpl = DQO_QPL_DEFAULT_TX_PAGES;
-	}
-
 	if (dev_op_buffer_sizes &&
 	    (supported_features_mask & GVE_SUP_BUFFER_SIZES_MASK)) {
 		priv->max_rx_buffer_size =
--- b/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -11,6 +11,7 @@
 #include <linux/filter.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
+#include <linux/math64.h>
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/sched.h>
@@ -966,6 +967,7 @@
 	cfg->qcfg = &priv->tx_cfg;
 	cfg->raw_addressing = !gve_is_qpl(priv);
 	cfg->ring_size = priv->tx_desc_cnt;
+	cfg->pages_per_qpl = priv->tx_pages_per_qpl;
 	cfg->num_xdp_rings = cfg->qcfg->num_xdp_queues;
 	cfg->tx = priv->tx;
 }
@@ -997,6 +999,40 @@
 	}
 }
 
+void gve_update_num_qpl_pages(struct gve_priv *priv,
+			      struct gve_rx_alloc_rings_cfg *rx_alloc_cfg,
+			      struct gve_tx_alloc_rings_cfg *tx_alloc_cfg)
+{
+	u64 ideal_tx_pages, ideal_rx_pages;
+	u16 tx_num_queues, rx_num_queues;
+	u64 max_pages, tx_pages;
+
+	if (priv->queue_format == GVE_GQI_QPL_FORMAT) {
+		rx_alloc_cfg->pages_per_qpl = rx_alloc_cfg->ring_size;
+	} else if (priv->queue_format == GVE_DQO_QPL_FORMAT) {
+		/*
+		 * We want 2 pages per RX descriptor and half a page per TX
+		 * descriptor, which means the fraction ideal_tx_pages /
+		 * (ideal_tx_pages + ideal_rx_pages) of the pages we allocate
+		 * should be for TX. Shrink proportionally as necessary to avoid
+		 * allocating more than max_registered_pages total pages.
+		 */
+		tx_num_queues = tx_alloc_cfg->qcfg->num_queues;
+		rx_num_queues = rx_alloc_cfg->qcfg_rx->num_queues;
+
+		ideal_tx_pages = tx_alloc_cfg->ring_size * tx_num_queues / 2;
+		ideal_rx_pages = rx_alloc_cfg->ring_size * rx_num_queues * 2;
+		max_pages = min(priv->max_registered_pages,
+				ideal_tx_pages + ideal_rx_pages);
+
+		tx_pages = div64_u64(max_pages * ideal_tx_pages,
+				     ideal_tx_pages + ideal_rx_pages);
+		tx_alloc_cfg->pages_per_qpl = div_u64(tx_pages, tx_num_queues);
+		rx_alloc_cfg->pages_per_qpl = div_u64(max_pages - tx_pages,
+						      rx_num_queues);
+	}
+}
+
 static int gve_queues_mem_alloc(struct gve_priv *priv,
 				struct gve_tx_alloc_rings_cfg *tx_alloc_cfg,
 				struct gve_rx_alloc_rings_cfg *rx_alloc_cfg)
@@ -1000,6 +1036,8 @@
 {
 	int err;
 
+	gve_update_num_qpl_pages(priv, rx_alloc_cfg, tx_alloc_cfg);
+
 	if (gve_is_gqi(priv))
 		err = gve_tx_alloc_rings_gqi(priv, tx_alloc_cfg);
 	else
@@ -1293,6 +1331,7 @@
 	cfg->raw_addressing = !gve_is_qpl(priv);
 	cfg->enable_header_split = priv->header_split_enabled;
 	cfg->ring_size = priv->rx_desc_cnt;
+	cfg->pages_per_qpl = priv->rx_pages_per_qpl;
 	cfg->packet_buffer_size = priv->rx_cfg.packet_buffer_size;
 	cfg->rx = priv->rx;
 	cfg->xdp = !!cfg->qcfg_tx->num_xdp_queues;
--- b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
@@ -218,7 +218,6 @@
 {
 	struct device *hdev = &priv->pdev->dev;
 	struct page_pool *pool;
-	int qpl_page_cnt;
 	size_t size;
 	u32 qpl_id;
 
@@ -246,7 +245,7 @@
 	XSK_CHECK_PRIV_TYPE(struct gve_xdp_buff);
 
 	rx->dqo.num_buf_states = cfg->raw_addressing ? buffer_queue_slots :
-		gve_get_rx_pages_per_qpl_dqo(cfg->ring_size);
+		cfg->pages_per_qpl;
 	rx->dqo.buf_states = kvcalloc_node(rx->dqo.num_buf_states,
 					   sizeof(rx->dqo.buf_states[0]),
 					   GFP_KERNEL, priv->numa_node);
@@ -281,7 +280,6 @@
 		rx->dqo.page_pool = pool;
 	} else {
 		qpl_id = gve_get_rx_qpl_id(cfg->qcfg_tx, rx->q_num);
-		qpl_page_cnt = gve_get_rx_pages_per_qpl_dqo(cfg->ring_size);
 
 		rx->dqo.qpl = gve_alloc_queue_page_list(priv, qpl_id,
 							qpl_page_cnt);
@@ -284,7 +282,7 @@
 		qpl_page_cnt = gve_get_rx_pages_per_qpl_dqo(cfg->ring_size);
 
 		rx->dqo.qpl = gve_alloc_queue_page_list(priv, qpl_id,
-							qpl_page_cnt);
+							cfg->pages_per_qpl);
 		if (!rx->dqo.qpl)
 			goto err;
 		rx->dqo.next_qpl_page_idx = 0;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/ethernet/google/gve/gve.h
+++ b/drivers/net/ethernet/google/gve/gve.h
@@ -57,5 +57,5 @@
 
-#define GVE_GQ_TX_MIN_PKT_DESC_BYTES 182
+#define GVE_DEFAULT_HEADER_BUFFER_SIZE 128
 
 #define DQO_QPL_DEFAULT_TX_PAGES 512
 
@@ -658,5 +667,3 @@
 
-	u16 ring_size;
-	bool raw_addressing;
-	bool enable_header_split;
+	u16 num_xdp_rings;
 
@@ -1030,6 +1158,6 @@
 	return 2 * rx_desc_cnt;
 }
 
-/* Returns a pointer to the next available tx qpl in the list of qpls */
-static inline
-struct gve_queue_page_list *gve_assign_tx_qpl(struct gve_tx_alloc_rings_cfg *cfg,
+/* Returns the correct dma direction for tx and rx qpls */
+static inline enum dma_data_direction gve_qpl_dma_dir(struct gve_priv *priv,
+						      int id)
--- b/drivers/net/ethernet/google/gve/gve_adminq.c
+++ b/drivers/net/ethernet/google/gve/gve_adminq.c
@@ -782,6 +978,6 @@
 			priv->tx_pages_per_qpl = DQO_QPL_DEFAULT_TX_PAGES;
 	}
 
-	/* Read and store ring size ranges given by device */
-	if (dev_op_modify_ring &&
-	    (supported_features_mask & GVE_SUP_MODIFY_RING_MASK)) {
+	if (dev_op_buffer_sizes &&
+	    (supported_features_mask & GVE_SUP_BUFFER_SIZES_MASK)) {
+		priv->max_rx_buffer_size =
--- b/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -7,5 +6,6 @@
 #include <linux/filter.h>
 #include <linux/interrupt.h>
+#include <linux/irq.h>
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/sched.h>
@@ -1322,4 +1290,5 @@
-	cfg->qpls = priv->qpls;
-	cfg->qpl_cfg = &priv->qpl_cfg;
+	cfg->raw_addressing = !gve_is_qpl(priv);
+	cfg->enable_header_split = priv->header_split_enabled;
 	cfg->ring_size = priv->rx_desc_cnt;
+	cfg->packet_buffer_size = priv->rx_cfg.packet_buffer_size;
 	cfg->rx = priv->rx;
@@ -1435,6 +1369,6 @@
-	priv->rx_cfg = *rx_alloc_cfg->qcfg;
+	priv->rx_cfg = *rx_alloc_cfg->qcfg_rx;
 	priv->tx_desc_cnt = tx_alloc_cfg->ring_size;
 	priv->rx_desc_cnt = rx_alloc_cfg->ring_size;
 
-	if (priv->xdp_prog)
-		priv->num_xdp_queues = priv->rx_cfg.num_queues;
+	gve_tx_start_rings(priv, gve_num_tx_queues(priv));
+	gve_rx_start_rings(priv, rx_alloc_cfg->qcfg_rx->num_queues);
--- b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
@@ -291,7 +282,6 @@
 
-	rx->dqo.num_buf_states = cfg->raw_addressing ?
-		min_t(s16, S16_MAX, buffer_queue_slots * 4) :
-		gve_get_rx_pages_per_qpl_dqo(cfg->ring_size);
-	rx->dqo.buf_states = kvcalloc(rx->dqo.num_buf_states,
-				      sizeof(rx->dqo.buf_states[0]),
-				      GFP_KERNEL);
+		rx->dqo.qpl = gve_alloc_queue_page_list(priv, qpl_id,
+							qpl_page_cnt);
+		if (!rx->dqo.qpl)
+			goto err;
+		rx->dqo.next_qpl_page_idx = 0;

================================================================================
*    ONLY IN PATCH2 - files not modified by patch1                             *
================================================================================

--- a/drivers/net/ethernet/google/gve/gve_buffer_mgmt_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_buffer_mgmt_dqo.c
@@ -133,7 +133,7 @@ int gve_alloc_qpl_page_dqo(struct gve_rx_ring *rx,
 	u32 idx;
 
 	idx = rx->dqo.next_qpl_page_idx;
-	if (idx >= gve_get_rx_pages_per_qpl_dqo(priv->rx_desc_cnt)) {
+	if (idx >= priv->rx_pages_per_qpl) {
 		net_err_ratelimited("%s: Out of QPL pages\n",
 				    priv->dev->name);
 		return -ENOMEM;
--- a/drivers/net/ethernet/google/gve/gve_rx.c
+++ b/drivers/net/ethernet/google/gve/gve_rx.c
@@ -278,7 +278,6 @@ int gve_rx_alloc_ring_gqi(struct gve_priv *priv,
 	struct device *hdev = &priv->pdev->dev;
 	u32 slots = cfg->ring_size;
 	int filled_pages;
-	int qpl_page_cnt;
 	u32 qpl_id = 0;
 	size_t bytes;
 	int err;
@@ -314,10 +313,8 @@ int gve_rx_alloc_ring_gqi(struct gve_priv *priv,
 
 	if (!rx->data.raw_addressing) {
 		qpl_id = gve_get_rx_qpl_id(cfg->qcfg_tx, rx->q_num);
-		qpl_page_cnt = cfg->ring_size;
-
 		rx->data.qpl = gve_alloc_queue_page_list(priv, qpl_id,
-							 qpl_page_cnt);
+							 cfg->pages_per_qpl);
 		if (!rx->data.qpl) {
 			err = -ENOMEM;
 			goto abort_with_copy_pool;
--- a/drivers/net/ethernet/google/gve/gve_tx.c
+++ b/drivers/net/ethernet/google/gve/gve_tx.c
@@ -264,7 +264,6 @@ static int gve_tx_alloc_ring_gqi(struct gve_priv *priv,
 				 int idx)
 {
 	struct device *hdev = &priv->pdev->dev;
-	int qpl_page_cnt;
 	u32 qpl_id = 0;
 	size_t bytes;
 
@@ -291,10 +290,8 @@ static int gve_tx_alloc_ring_gqi(struct gve_priv *priv,
 	tx->dev = hdev;
 	if (!tx->raw_addressing) {
 		qpl_id = gve_tx_qpl_id(priv, tx->q_num);
-		qpl_page_cnt = priv->tx_pages_per_qpl;
-
 		tx->tx_fifo.qpl = gve_alloc_queue_page_list(priv, qpl_id,
-							    qpl_page_cnt);
+							    cfg->pages_per_qpl);
 		if (!tx->tx_fifo.qpl)
 			goto abort_with_desc;
 
--- a/drivers/net/ethernet/google/gve/gve_tx_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_tx_dqo.c
@@ -311,7 +311,6 @@ static int gve_tx_alloc_ring_dqo(struct gve_priv *priv,
 {
 	struct device *hdev = &priv->pdev->dev;
 	int num_pending_packets;
-	int qpl_page_cnt;
 	size_t bytes;
 	u32 qpl_id;
 	int i;
@@ -392,10 +391,9 @@ static int gve_tx_alloc_ring_dqo(struct gve_priv *priv,
 
 	if (!cfg->raw_addressing) {
 		qpl_id = gve_tx_qpl_id(priv, tx->q_num);
-		qpl_page_cnt = priv->tx_pages_per_qpl;
 
 		tx->dqo.qpl = gve_alloc_queue_page_list(priv, qpl_id,
-							qpl_page_cnt);
+							cfg->pages_per_qpl);
 		if (!tx->dqo.qpl)
 			goto err;

This is an automated interdiff check for backported commits.

@github-actions

Copy link
Copy Markdown

Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/32189418305

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

9 participants