net/gve: fix TX queue stalls and sync DQO RDA with Linux driver

The DPDK GVE driver previously tracked transmitted packet count (re_cnt) at the end of each burst rather than tracking descriptor intervals per packet against GVE_TX_MIN_RE_INTERVAL (32).

In multi-segment and TSO transmissions, each packet consumes multiple descriptors. The descriptor ring could exhaust before 32 packets were sent, resulting in zero descriptors requesting report_event and preventing the hardware DMA engine from returning GVE_COMPL_TYPE_DQO_DESC completions. Without these completions, txq->nb_free was never replenished, permanently stalling the TX queue.

Align with the Linux kernel driver (gve_tx_update_tail()) by tracking descriptor indices with last_re_idx:
- Replace re_cnt with last_re_idx in struct gve_tx_queue.
- Reset last_re_idx = 0 in gve_reset_tx_ring_state_dqo().
- On each packet transmission, check descriptor interval (last_desc_idx - last_re_idx) & mask >= GVE_TX_MIN_RE_INTERVAL. When met, set report_event on the packet's last descriptor and update last_re_idx.

Fixes 4022f9999f56 ("net/gve: support basic Tx data path for DQO")

Fixes 403c671a46b6 ("net/gve: support TSO in DQO RDA")

Cc [email protected]

Acked-by Joshua Washington <[email protected]>

Signed-off-by Tathagat Priyadarshi <[email protected]>

---
 drivers/net/gve/gve_ethdev.h |  2 +-
 drivers/net/gve/gve_tx_dqo.c | 18 ++++++++++--------
 2 files changed, 11 insertions(+), 9 deletions(-)

drivers/net/gve/gve_ethdev.h +1 -1

index c9a176ff17..2033f49444 100644
@@ -193,8 +193,8 @@ struct gve_tx_queue {
        uint16_t sw_size;
        uint8_t cur_gen_bit;
        uint32_t last_desc_cleaned;
+       uint32_t last_re_idx;
        void **txqs;
-       uint16_t re_cnt;
 
        /* Only valid for DQO_RDA queue format */
        struct gve_tx_queue *complq;

drivers/net/gve/gve_tx_dqo.c +0 -0

index c864d722d9..a8382ff3c4 100644

drivers/net/gve/gve_tx_dqo.c +3 -9

+               }
+
                txq->nb_free -= nb_descs;
                txq->nb_used += nb_descs;
        }
 
        /* update the tail pointer if any packets were processed */
        if (nb_tx > 0) {
-               /* Request a descriptor completion on the last descriptor */
-               txq->re_cnt += nb_tx;
-               if (txq->re_cnt >= GVE_TX_MIN_RE_INTERVAL) {
-                       txd = &txr[(tx_id - 1) & mask];
-                       txd->pkt.report_event = true;
-                       txq->re_cnt = 0;
-               }
-
                rte_write32(tx_id, txq->qtx_tail);
                txq->tx_tail = tx_id;
 

@@ -445,6 +446,7 @@ gve_reset_tx_ring_state_dqo(struct gve_tx_queue *txq)
        txq->nb_used = 0;
 
        txq->last_desc_cleaned = 0;
+       txq->last_re_idx = 0;
        txq->nb_free = txq->nb_tx_desc - 1;
 
        txq->complq_tail = 0;
--

2.43.0

The GVNIC DQO hardware restricts each packet (or MTU segment in TSO) to at most 10 data descriptors (GVE_TX_MAX_DATA_DESCS), beyond which the hardware drops traffic. In addition to this 10-descriptor limit, the hardware imposes strict packet sizing and header constraints.

Enforce these hardware packet and TSO validation constraints in DQO RDA mode within gve_tx_validate_descs() matching the upstream Linux kernel driver:
- Define GVE_TX_MAX_TSO_MSS_DQO (9728 bytes) to avoid 14-bit MSS field overflow in struct gve_tx_tso_context_desc_dqo.
- Define GVE_TX_MIN_PKT_SIZE_DQO (17 bytes) and GVE_TX_MAX_PKT_SIZE_DQO (9728 bytes) to reject runts (which cause hardware DMA parse errors) and oversized non-TSO packets.
- In gve_tx_validate_descs():
* Reject zero-length mbufs (nb_descs == 0 or pkt_len == 0).
* Enforce packet size in [17, 9728] for non-TSO packets alongside the 10-descriptor limit (nb_descs <= GVE_TX_MAX_DATA_DESCS).
* Reject split transport headers across mbuf segments (data_len < headlen).
* Reject TSO packets missing an L4 header (l4_len == 0).
* Reject TSO packets without payload (pkt_len <= headlen).
* Enforce MSS limits [88, 9728] and header length limit <= 255.

Fixes 403c671a46b6 ("net/gve: support TSO in DQO RDA")

Cc [email protected]

Acked-by Joshua Washington <[email protected]>

Signed-off-by Tathagat Priyadarshi <[email protected]>

---
 drivers/net/gve/base/gve_desc_dqo.h |  3 ++
 drivers/net/gve/gve_tx_dqo.c        | 44 ++++++++++++++++++++++++-----
 2 files changed, 40 insertions(+), 7 deletions(-)

drivers/net/gve/base/gve_desc_dqo.h +0 -0

index c1534959c2..1740f69d73 100644

drivers/net/gve/base/gve_desc_dqo.h +0 -0

 /* Basic TX descriptor (DTYPE 0x0C) */
 struct gve_tx_pkt_desc_dqo {

drivers/net/gve/gve_tx_dqo.c +35 -4

index 9210b02eb1..03ac3bd5dd 100644
@@ -134,12 +134,43 @@ gve_tx_clean_descs_dqo(struct gve_tx_queue *txq, uint16_t nb_descs) {
 static inline bool
 gve_tx_validate_descs(struct rte_mbuf *tx_pkt, uint16_t nb_descs, bool is_tso)
 {
-       if (!is_tso)
+       int tso_segsz, seg_remain, mbuf_remain;
+       int num_descs, seg_offset, mbuf_len;
+       int headlen;
+
+       /* Reject zero-length packet */
+       if (unlikely(nb_descs == 0 || tx_pkt->pkt_len == 0))
+               return false;
+
+       if (!is_tso) {
+               /* Reject packets that violate hardware length constraints */
+               if (unlikely(tx_pkt->pkt_len < GVE_TX_MIN_PKT_SIZE_DQO ||
+                            tx_pkt->pkt_len > GVE_TX_MAX_PKT_SIZE_DQO))
+                       return false;
                return nb_descs <= GVE_TX_MAX_DATA_DESCS;
+       }
 
-       int tso_segsz = tx_pkt->tso_segsz;
-       int num_descs, seg_offset, mbuf_len;
-       int headlen = tx_pkt->l2_len + tx_pkt->l3_len + tx_pkt->l4_len;
+       headlen = tx_pkt->l2_len + tx_pkt->l3_len + tx_pkt->l4_len;
+
+       /* Reject split transport header */
+       if (unlikely(tx_pkt->data_len < headlen))
+               return false;
+
+       /* Reject missing TCP header on TSO */
+       if (unlikely(tx_pkt->l4_len == 0))
+               return false;
+
+       /* Reject TSO packet without payload */
+       if (unlikely(tx_pkt->pkt_len <= (uint32_t)headlen))
+               return false;
+
+       /* Enforce GVE hardware MSS and header limits */
+       if (unlikely(tx_pkt->tso_segsz < GVE_TX_MIN_TSO_MSS_DQO ||
+                    tx_pkt->tso_segsz > GVE_TX_MAX_TSO_MSS_DQO ||
+                    headlen > GVE_TX_MAX_HDR_SIZE_DQO))
+               return false;
+
+       tso_segsz = tx_pkt->tso_segsz;
 
        /* Headers will be split into their own buffer. */
        num_descs = 1;

drivers/net/gve/gve_tx_dqo.c +1 -3

                if (num_descs == GVE_TX_MAX_DATA_DESCS && seg_remain)
                        return false;
 

@@ -162,7 +193,7 @@ gve_tx_validate_descs(struct rte_mbuf *tx_pkt, uint16_t nb_descs, bool is_tso)
                         * is not at risk of defying this limitation.
                         * Thus, such segments are ignored.
                         */
-                       int mbuf_remain = tx_pkt->data_len % GVE_TX_MAX_BUF_SIZE_DQO;
+                       mbuf_remain = tx_pkt->data_len % GVE_TX_MAX_BUF_SIZE_DQO;
 
                        /* For each TSO segment, HW will prepend
                         * headers. The remaining bytes of this mbuf

@@ -184,7 +215,6 @@ gve_tx_validate_descs(struct rte_mbuf *tx_pkt, uint16_t nb_descs, bool is_tso)
                        mbuf_len = tx_pkt->data_len;
        }
 
-
        return true;
 }
 
--

2.43.0

This patch series aligns the Google Virtual NIC (gve) DQO RDA transmit path with the upstream Linux kernel driver (drivers/net/ethernet/google/gve/) to resolve transmit queue stalls and hardware validation issues:

1. net/gve: fix DQO descriptor cleaning loop bound
Fixes the off-by-one error in gve_tx_clean_descs_dqo() ("while (--nb_descs)" -> "while (nb_descs--)") and avoids stalling the completion queue on unrecognized descriptor types.

2. net/gve: fix DQO TX queue stall on multi-seg and TSO Tracks descriptor intervals with last_re_idx per packet against GVE_TX_MIN_RE_INTERVAL (32) instead of counting packets at burst end, preventing descriptor ring starvation and queue deadlocks under multi-segment and TSO traffic.

3. net/gve: add cacheline overlap margin to DQO TX ring Enforces GVE_TX_MIN_DESC_PREVENT_CACHE_OVERLAP (4 descriptors) margin in ring space checks, avoiding CPU and device DMA cacheline collisions.

4. net/gve: add packet and TSO hardware constraints for DQO Augments gve_tx_validate_descs() (which enforces the 10-descriptor limit per packet or MTU segment) with the remaining hardware length
constraints: [17, 9728] bytes for non-TSO packets, maximum MSS limit (9728 bytes) to avoid 14-bit field wrap-around, and validates header contiguity and payload presence on TSO packets.

Tathagat Priyadarshi (4):
net/gve: fix DQO descriptor cleaning loop bound net/gve: fix DQO TX queue stall on multi-seg and TSO net/gve: add cacheline overlap margin to DQO TX ring net/gve: add packet and TSO hardware constraints for DQO

 drivers/net/gve/base/gve_desc_dqo.h |  3 ++
 drivers/net/gve/gve_ethdev.h        |  2 +-
 drivers/net/gve/gve_tx_dqo.c        | 80 +++++++++++++++++++++--------
 3 files changed, 62 insertions(+), 23 deletions(-)

The DPDK GVE driver previously tracked transmitted packet count (re_cnt) at the end of each burst rather than tracking descriptor intervals per packet against GVE_TX_MIN_RE_INTERVAL (32).

In multi-segment and TSO transmissions, each packet consumes multiple descriptors. The descriptor ring could exhaust before 32 packets were sent, resulting in zero descriptors requesting report_event and preventing the hardware DMA engine from returning GVE_COMPL_TYPE_DQO_DESC completions. Without these completions, txq->nb_free was never replenished, permanently stalling the TX queue.

Align with the Linux kernel driver (gve_tx_update_tail()) by tracking descriptor indices with last_re_idx:
- Replace re_cnt with last_re_idx in struct gve_tx_queue.
- Reset last_re_idx = 0 in gve_reset_tx_ring_state_dqo().
- On each packet transmission, check descriptor interval (last_desc_idx - last_re_idx) & mask >= GVE_TX_MIN_RE_INTERVAL. When met, set report_event on the packet's last descriptor and update last_re_idx.
- Ring the transmit doorbell immediately upon setting report_event to kick hardware processing early and reduce device fetch latency during bursts of multi-descriptor TSO packets, amortizing MMIO writes over RE_INTERVAL descriptors.
- Defensively pop completion tags before writing TSO context descriptors to avoid partial descriptor ring updates if completion tags are exhausted.

Fixes 4022f9999f56 ("net/gve: support basic Tx data path for DQO")

Fixes 403c671a46b6 ("net/gve: support TSO in DQO RDA")

Cc [email protected]

Signed-off-by Tathagat Priyadarshi <[email protected]>

---
 drivers/net/gve/gve_ethdev.h |  2 +-
 drivers/net/gve/gve_tx_dqo.c | 46 ++++++++++++++++++++----------------
 2 files changed, 27 insertions(+), 21 deletions(-)

drivers/net/gve/gve_ethdev.h +1 -1

index c9a176ff17..2033f49444 100644
@@ -193,8 +193,8 @@ struct gve_tx_queue {
        uint16_t sw_size;
        uint8_t cur_gen_bit;
        uint32_t last_desc_cleaned;
+       uint32_t last_re_idx;
        void **txqs;
-       uint16_t re_cnt;
 
        /* Only valid for DQO_RDA queue format */
        struct gve_tx_queue *complq;

drivers/net/gve/gve_tx_dqo.c +4 -6

index c864d722d9..0839179d7f 100644
@@ -250,21 +250,23 @@ gve_fill_tx_pkt_desc(struct gve_tx_queue *txq, uint16_t *tx_id,
 uint16_t
 gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
 {
+       volatile union gve_tx_desc_dqo *txr, *txd;
        struct gve_tx_queue *txq = tx_queue;
-       volatile union gve_tx_desc_dqo *txr;
-       volatile union gve_tx_desc_dqo *txd;
-       uint16_t mask = txq->nb_tx_desc - 1;
-       struct gve_tx_pkt *pkts;
+       uint32_t last_re_interval;
        struct rte_mbuf *tx_pkt;
-       uint16_t compl_tag;
-       const char *reason;
+       struct gve_tx_pkt *pkts;
+       uint32_t last_desc_idx;

drivers/net/gve/gve_tx_dqo.c +18 -14

+       mask = txq->nb_tx_desc - 1;
        pkts = txq->pkt_ring_dqo;
        txr = txq->tx_ring;
 

@@ -306,15 +308,15 @@ gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
                        break;
                }
 
+               if (!gve_free_compl_tags_pop(txq, &compl_tag))
+                       break;
+
                if (tso) {
                        txd = &txr[tx_id];
                        gve_tx_fill_seg_desc_dqo(txd, tx_pkt);
                        tx_id = (tx_id + 1) & mask;
                }
 
-               if (!gve_free_compl_tags_pop(txq, &compl_tag))
-                       break;
-
                pkts[compl_tag].mbuf = tx_pkt;
                while (tx_pkt) {
                        /* Skip writing descriptors if mbuf has no data. */

@@ -331,23 +333,26 @@ gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
                txd = &txr[(tx_id - 1) & mask];
                txd->pkt.end_of_packet = 1;
 
+               last_desc_idx = (tx_id - 1) & mask;
+               last_re_interval = (last_desc_idx - txq->last_re_idx) & mask;
+               if (unlikely(last_re_interval >= GVE_TX_MIN_RE_INTERVAL)) {
+                       txd->pkt.report_event = true;
+                       txq->last_re_idx = last_desc_idx;
+                       rte_write32(tx_id, txq->qtx_tail);
+                       txq->tx_tail = tx_id;
+               }
+
                txq->nb_free -= nb_descs;
                txq->nb_used += nb_descs;
        }
 
-       /* update the tail pointer if any packets were processed */
-       if (nb_tx > 0) {
-               /* Request a descriptor completion on the last descriptor */
-               txq->re_cnt += nb_tx;
-               if (txq->re_cnt >= GVE_TX_MIN_RE_INTERVAL) {
-                       txd = &txr[(tx_id - 1) & mask];
-                       txd->pkt.report_event = true;
-                       txq->re_cnt = 0;
-               }
-
+       /* update the tail pointer if any uncommitted descriptors remain */
+       if (txq->tx_tail != tx_id) {
                rte_write32(tx_id, txq->qtx_tail);
                txq->tx_tail = tx_id;
+       }
 
+       if (nb_tx > 0) {
                txq->stats.packets += nb_tx;
                txq->stats.bytes += bytes;
                txq->stats.errors += nb_pkts - nb_tx;

@@ -445,6 +450,7 @@ gve_reset_tx_ring_state_dqo(struct gve_tx_queue *txq)
        txq->nb_used = 0;
 
        txq->last_desc_cleaned = 0;
+       txq->last_re_idx = 0;
        txq->nb_free = txq->nb_tx_desc - 1;
 
        txq->complq_tail = 0;
--

2.43.0

The GVNIC DQO hardware restricts each packet (or MTU segment in TSO) to at most 10 data descriptors (GVE_TX_MAX_DATA_DESCS), beyond which the hardware drops traffic. In addition to this 10-descriptor limit, the hardware imposes strict packet sizing and header constraints.

Previously, failing the descriptor limit or rte_mbuf_check() broke from the Tx burst loop without consuming the invalid mbuf. This caused tx_burst to return a short count, leading the application to retry the same rejected packet indefinitely and causing Head-of-Line (HOL) queue stalls.

Enforce hardware validation and prevent HOL blocking in DPDK:
- Validate packet and hardware constraints prior to ring space checks.
- When packet validation or rte_mbuf_check() fails, drop and free the invalid mbuf with rte_pktmbuf_free(), update stats, and continue the burst to prevent Head-of-Line (HOL) blocking.
- Exclude dropped packets from txq->stats.packets while returning the total consumed count to the caller.
- Rename too_many_descs in struct gve_tx_stats to dropped_pkts to reflect all validation and malformed mbuf drop events.
- Reject packets whose descriptor count exceeds the maximum capacity of the ring (accounting for reserved slots, cacheline overlap margin, and unreported descriptors), preventing permanent queue stalls.
- Define GVE_TX_MIN_PKT_SIZE_DQO (17 bytes) and GVE_TX_MAX_PKT_SIZE_DQO (9728 bytes) to enforce wire packet boundaries for non-TSO packets and TSO MSS.
- Define GVE_TX_MAX_TSO_LEN_DQO (262143 bytes) to enforce the hardware L4 payload limit in the 24-bit tso_total_len field.

- In gve_tx_validate_descs():
* Enforce packet size in [17, 9728] for non-TSO packets alongside the 10-descriptor limit (nb_descs <= GVE_TX_MAX_DATA_DESCS).
* Reject TSO packets missing an L4 header (l4_len == 0).
* Reject packet with headers (L2-L4) not contiguous in first segment.
* Reject TSO packets without payload (pkt_len <= headlen).
* Enforce TSO total payload length limit (pkt_len - headlen <= 262143).
* Enforce MSS limits [88, 9728] and header length limit <= 255.

4. The commit message lists the diff line by line. Cut it to the problem (invalid packets stalled the queue; hardware limits were not enforced) and the fix (drop and continue; the limits enforced).

Fixes 4022f9999f56 ("net/gve: support basic Tx data path for DQO")

Fixes f4a70b449bfa ("net/gve: add DQO Tx descriptor limit")

Fixes 403c671a46b6 ("net/gve: support TSO in DQO RDA")

Cc [email protected]

Signed-off-by Tathagat Priyadarshi <[email protected]>

---
 drivers/net/gve/base/gve_desc_dqo.h |  3 +
 drivers/net/gve/gve_ethdev.h        |  2 +-
 drivers/net/gve/gve_tx_dqo.c        | 92 +++++++++++++++++++++++------
 3 files changed, 79 insertions(+), 18 deletions(-)

drivers/net/gve/base/gve_desc_dqo.h +3 -0

index c1534959c2..53e394f01c 100644
@@ -12,6 +12,9 @@
 
 #define GVE_TX_MAX_HDR_SIZE_DQO 255
 #define GVE_TX_MIN_TSO_MSS_DQO 88
+#define GVE_TX_MIN_PKT_SIZE_DQO 17
+#define GVE_TX_MAX_PKT_SIZE_DQO 9728
+#define GVE_TX_MAX_TSO_LEN_DQO ((256 * 1024) - 1)
 
 /* Basic TX descriptor (DTYPE 0x0C) */
 struct gve_tx_pkt_desc_dqo {

drivers/net/gve/gve_ethdev.h +0 -0

index 2033f49444..d6d71c31bb 100644

drivers/net/gve/gve_ethdev.h +0 -0

 };
 
 struct gve_rx_stats {

drivers/net/gve/gve_tx_dqo.c +57 -8

index eee1f10df1..94ea426961 100644
@@ -126,20 +126,67 @@ gve_tx_clean_descs_dqo(struct gve_tx_queue *txq, uint16_t nb_descs) {
                gve_tx_clean_dqo(txq);
 }
 
+/* Max descriptors a single packet may use. A larger packet can never pass
+ * gve_can_tx(): one slot is always reserved, the cacheline overlap margin
+ * must stay free, and up to GVE_TX_MIN_RE_INTERVAL - 1 descriptors posted
+ * after the last report_event are not reclaimed until more are posted.
+ */
+static inline int
+gve_tx_max_pkt_descs(const struct gve_tx_queue *txq)
+{
+       return (int)txq->nb_tx_desc - 1 - GVE_TX_MIN_DESC_PREVENT_CACHE_OVERLAP -
+               (GVE_TX_MIN_RE_INTERVAL - 1);
+}
+
 /* GVE expects at most 10 data descriptors per mtu-sized segment. Beyond this,
  * the hardware will assume the driver is malicious and stop transmitting
  * packets altogether. Validate that a packet can be sent to avoid sending
  * posting descriptors for an invalid packet.
  */
 static inline bool
-gve_tx_validate_descs(struct rte_mbuf *tx_pkt, uint16_t nb_descs, bool is_tso)
+gve_tx_validate_descs(const struct gve_tx_queue *txq, struct rte_mbuf *tx_pkt,
+                     uint16_t nb_descs, bool is_tso)
 {
-       if (!is_tso)
+       int num_descs, seg_offset, mbuf_len;
+       int tso_segsz, headlen;
+
+       /* Reject packets that can never fit in the ring */
+       if (unlikely(nb_descs > gve_tx_max_pkt_descs(txq)))
+               return false;
+
+       if (!is_tso) {
+               /* Reject packets that violate hardware length constraints */
+               if (unlikely(tx_pkt->pkt_len < GVE_TX_MIN_PKT_SIZE_DQO ||
+                            tx_pkt->pkt_len > GVE_TX_MAX_PKT_SIZE_DQO))
+                       return false;
                return nb_descs <= GVE_TX_MAX_DATA_DESCS;
+       }
 
-       int tso_segsz = tx_pkt->tso_segsz;
-       int num_descs, seg_offset, mbuf_len;
-       int headlen = tx_pkt->l2_len + tx_pkt->l3_len + tx_pkt->l4_len;
+       headlen = tx_pkt->l2_len + tx_pkt->l3_len + tx_pkt->l4_len;
+
+       /* Reject missing TCP header on TSO */
+       if (unlikely(tx_pkt->l4_len == 0))
+               return false;
+
+       /* Reject packet with headers (L2-L4) not contiguous in first segment */
+       if (unlikely(tx_pkt->data_len < headlen))
+               return false;
+
+       /* Reject TSO packet without payload */
+       if (unlikely(tx_pkt->pkt_len <= (uint32_t)headlen))
+               return false;
+
+       /* Enforce GVE hardware TSO total length limit */
+       if (unlikely(tx_pkt->pkt_len - headlen > GVE_TX_MAX_TSO_LEN_DQO))
+               return false;
+
+       /* Enforce GVE hardware MSS and header limits */
+       if (unlikely(tx_pkt->tso_segsz < GVE_TX_MIN_TSO_MSS_DQO ||
+                    tx_pkt->tso_segsz > GVE_TX_MAX_PKT_SIZE_DQO ||
+                    headlen > GVE_TX_MAX_HDR_SIZE_DQO))
+               return false;
+
+       tso_segsz = tx_pkt->tso_segsz;
 
        /* Headers will be split into their own buffer. */
        num_descs = 1;

@@ -147,14 +194,18 @@ gve_tx_validate_descs(struct rte_mbuf *tx_pkt, uint16_t nb_descs, bool is_tso)
        mbuf_len = tx_pkt->data_len - headlen;
 
        while (tx_pkt) {
+               int seg_remain;
+
                if (!mbuf_len)
                        goto next_mbuf;
 
-               int seg_remain = tso_segsz - seg_offset;
+               seg_remain = tso_segsz - seg_offset;
                if (num_descs == GVE_TX_MAX_DATA_DESCS && seg_remain)
                        return false;
 
                if (seg_remain < mbuf_len) {
+                       int mbuf_remain = tx_pkt->data_len % GVE_TX_MAX_BUF_SIZE_DQO;
+
                        seg_offset = mbuf_len % tso_segsz;
                        /* The MSS is bound from above by 9728B, so a
                         * single TSO segment in the middle of an mbuf

@@ -162,7 +213,6 @@ gve_tx_validate_descs(struct rte_mbuf *tx_pkt, uint16_t nb_descs, bool is_tso)
                         * is not at risk of defying this limitation.
                         * Thus, such segments are ignored.
                         */
-                       int mbuf_remain = tx_pkt->data_len % GVE_TX_MAX_BUF_SIZE_DQO;
 
                        /* For each TSO segment, HW will prepend
                         * headers. The remaining bytes of this mbuf

@@ -184,7 +234,6 @@ gve_tx_validate_descs(struct rte_mbuf *tx_pkt, uint16_t nb_descs, bool is_tso)
                        mbuf_len = tx_pkt->data_len;
        }
 
-
        return true;
 }
 

drivers/net/gve/gve_tx_dqo.c +17 -10

        uint16_t nb_tx = 0;
        uint64_t bytes = 0;
        const char *reason;

@@ -281,9 +331,13 @@ gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
                                               txq->rs_thresh);
 
 
-               if (rte_mbuf_check(tx_pkt, true, &reason)) {
+               if (unlikely(rte_mbuf_check(tx_pkt, true, &reason))) {
                        PMD_DRV_DP_LOG(DEBUG, "Invalid mbuf: %s", reason);
-                       break;
+                       txq->stats.dropped_pkts++;
+                       txq->stats.errors++;
+                       rte_pktmbuf_free(tx_pkt);
+                       nb_drop++;
+                       continue;
                }
 
                ol_flags = tx_pkt->ol_flags;

@@ -292,6 +346,16 @@ gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
 
                nb_descs = gve_tx_pkt_nb_data_descs(tx_pkt);
                nb_descs += tso;
+
+               /* Drop packet if it doesn't adhere to hardware limits. */
+               if (unlikely(!gve_tx_validate_descs(txq, tx_pkt, nb_descs, tso))) {
+                       txq->stats.dropped_pkts++;
+                       txq->stats.errors++;
+                       rte_pktmbuf_free(tx_pkt);
+                       nb_drop++;
+                       continue;
+               }
+
                req_descs = nb_descs + GVE_TX_MIN_DESC_PREVENT_CACHE_OVERLAP;
 
                /* Clean if there aren't enough descriptors to send the packet

@@ -306,12 +370,6 @@ gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
                                break;
                }
 
-               /* Drop packet if it doesn't adhere to hardware limits. */
-               if (!gve_tx_validate_descs(tx_pkt, nb_descs, tso)) {
-                       txq->stats.too_many_descs++;
-                       break;
-               }
-
                if (!gve_free_compl_tags_pop(txq, &compl_tag))
                        break;
 

@@ -357,7 +415,7 @@ gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
        }
 
        if (nb_tx > 0) {
-               txq->stats.packets += nb_tx;
+               txq->stats.packets += (nb_tx - nb_drop);
                txq->stats.bytes += bytes;
                txq->stats.errors += nb_pkts - nb_tx;
        }
--

2.43.0

Quoted 29 lines · Tathagat Priyadarshi

The GVNIC DQO hardware restricts each packet (or MTU segment in TSO) to at most 10 data descriptors (GVE_TX_MAX_DATA_DESCS), beyond which the hardware drops traffic. In addition to this 10-descriptor limit, the hardware imposes strict packet sizing and header constraints.

Previously, failing the descriptor limit or rte_mbuf_check() broke from the Tx burst loop without consuming the invalid mbuf. This caused tx_burst to return a short count, leading the application to retry the same rejected packet indefinitely and causing Head-of-Line (HOL) queue stalls.

Enforce hardware validation and prevent HOL blocking in DPDK:
- Validate packet and hardware constraints prior to ring space checks.
- When packet validation or rte_mbuf_check() fails, drop and free the invalid mbuf with rte_pktmbuf_free(), update stats, and continue the burst to prevent Head-of-Line (HOL) blocking.
- Exclude dropped packets from txq->stats.packets while returning the total consumed count to the caller.
- Rename too_many_descs in struct gve_tx_stats to dropped_pkts to reflect all validation and malformed mbuf drop events.
- Reject packets whose descriptor count exceeds the maximum capacity of the ring (accounting for reserved slots, cacheline overlap margin, and unreported descriptors), preventing permanent queue stalls.
- Define GVE_TX_MIN_PKT_SIZE_DQO (17 bytes) and GVE_TX_MAX_PKT_SIZE_DQO (9728 bytes) to enforce wire packet boundaries for non-TSO packets and TSO MSS.
- Define GVE_TX_MAX_TSO_LEN_DQO (262143 bytes) to enforce the hardware L4 payload limit in the 24-bit tso_total_len field.

Quoted 8 lines

- In gve_tx_validate_descs():
* Enforce packet size in [17, 9728] for non-TSO packets alongside the 10-descriptor limit (nb_descs <= GVE_TX_MAX_DATA_DESCS).
* Reject TSO packets missing an L4 header (l4_len == 0).
* Reject packet with headers (L2-L4) not contiguous in first segment.
* Reject TSO packets without payload (pkt_len <= headlen).
* Enforce TSO total payload length limit (pkt_len - headlen <= 262143).
* Enforce MSS limits [88, 9728] and header length limit <= 255.

I agree with the AI code review on this patch description.

Quoted 3 lines

4. The commit message lists the diff line by line. Cut it to the problem (invalid packets stalled the queue; hardware limits were not enforced) and the fix (drop and continue; the limits enforced).

Can we trim this message down a bit, and more succinctly explain the error condition and how this patch fixes it? If it cannot be describe succinctly, that might be a sign that the patch should be split up into smaller logical pieces.

Quoted 32 lines

Fixes 4022f9999f56 ("net/gve: support basic Tx data path for DQO")

Fixes f4a70b449bfa ("net/gve: add DQO Tx descriptor limit")

Fixes 403c671a46b6 ("net/gve: support TSO in DQO RDA")

Cc [email protected]

Signed-off-by Tathagat Priyadarshi <[email protected]>

---
 drivers/net/gve/base/gve_desc_dqo.h |  3 +
 drivers/net/gve/gve_ethdev.h        |  2 +-
 drivers/net/gve/gve_tx_dqo.c        | 92 +++++++++++++++++++++++------
 3 files changed, 79 insertions(+), 18 deletions(-)

drivers/net/gve/base/gve_desc_dqo.h +3 -0

index c1534959c2..53e394f01c 100644
@@ -12,6 +12,9 @@
 
 #define GVE_TX_MAX_HDR_SIZE_DQO 255
 #define GVE_TX_MIN_TSO_MSS_DQO 88
+#define GVE_TX_MIN_PKT_SIZE_DQO 17
+#define GVE_TX_MAX_PKT_SIZE_DQO 9728
+#define GVE_TX_MAX_TSO_LEN_DQO ((256 * 1024) - 1)
 
 /* Basic TX descriptor (DTYPE 0x0C) */
 struct gve_tx_pkt_desc_dqo {

drivers/net/gve/gve_ethdev.h +0 -0

index 2033f49444..d6d71c31bb 100644

drivers/net/gve/gve_ethdev.h struct gve_tx_stats { · line 116

Quoted 5 lines

drivers/net/gve/gve_ethdev.h +1 -1

@@ -113,7 +113,7 @@ struct gve_tx_stats {
        uint64_t packets;
        uint64_t bytes;
        uint64_t errors;
-       uint64_t too_many_descs;
+       uint64_t dropped_pkts;

Is there any reason to change this to a general "dropped_pkts" instead of adding a different stat if there is a different error condition that needs to be captured? These are extended stats, so if we can give more specific drop conditions, I think we should aim to. However, there is nothing wrong with also introducing a new aggregate dropped_pkts stat. Not sure if adding new stats would be considered scope creep, though.

Quoted 117 lines

drivers/net/gve/gve_ethdev.h +0 -0

 };
 
 struct gve_rx_stats {

drivers/net/gve/gve_tx_dqo.c +57 -8

index eee1f10df1..94ea426961 100644
@@ -126,20 +126,67 @@ gve_tx_clean_descs_dqo(struct gve_tx_queue *txq, uint16_t nb_descs) {
                gve_tx_clean_dqo(txq);
 }
 
+/* Max descriptors a single packet may use. A larger packet can never pass
+ * gve_can_tx(): one slot is always reserved, the cacheline overlap margin
+ * must stay free, and up to GVE_TX_MIN_RE_INTERVAL - 1 descriptors posted
+ * after the last report_event are not reclaimed until more are posted.
+ */
+static inline int
+gve_tx_max_pkt_descs(const struct gve_tx_queue *txq)
+{
+       return (int)txq->nb_tx_desc - 1 - GVE_TX_MIN_DESC_PREVENT_CACHE_OVERLAP -
+               (GVE_TX_MIN_RE_INTERVAL - 1);
+}
+
 /* GVE expects at most 10 data descriptors per mtu-sized segment. Beyond this,
  * the hardware will assume the driver is malicious and stop transmitting
  * packets altogether. Validate that a packet can be sent to avoid sending
  * posting descriptors for an invalid packet.
  */
 static inline bool
-gve_tx_validate_descs(struct rte_mbuf *tx_pkt, uint16_t nb_descs, bool is_tso)
+gve_tx_validate_descs(const struct gve_tx_queue *txq, struct rte_mbuf *tx_pkt,
+                     uint16_t nb_descs, bool is_tso)
 {
-       if (!is_tso)
+       int num_descs, seg_offset, mbuf_len;
+       int tso_segsz, headlen;
+
+       /* Reject packets that can never fit in the ring */
+       if (unlikely(nb_descs > gve_tx_max_pkt_descs(txq)))
+               return false;
+
+       if (!is_tso) {
+               /* Reject packets that violate hardware length constraints */
+               if (unlikely(tx_pkt->pkt_len < GVE_TX_MIN_PKT_SIZE_DQO ||
+                            tx_pkt->pkt_len > GVE_TX_MAX_PKT_SIZE_DQO))
+                       return false;
                return nb_descs <= GVE_TX_MAX_DATA_DESCS;
+       }
 
-       int tso_segsz = tx_pkt->tso_segsz;
-       int num_descs, seg_offset, mbuf_len;
-       int headlen = tx_pkt->l2_len + tx_pkt->l3_len + tx_pkt->l4_len;
+       headlen = tx_pkt->l2_len + tx_pkt->l3_len + tx_pkt->l4_len;
+
+       /* Reject missing TCP header on TSO */
+       if (unlikely(tx_pkt->l4_len == 0))
+               return false;
+
+       /* Reject packet with headers (L2-L4) not contiguous in first segment */
+       if (unlikely(tx_pkt->data_len < headlen))
+               return false;
+
+       /* Reject TSO packet without payload */
+       if (unlikely(tx_pkt->pkt_len <= (uint32_t)headlen))
+               return false;
+
+       /* Enforce GVE hardware TSO total length limit */
+       if (unlikely(tx_pkt->pkt_len - headlen > GVE_TX_MAX_TSO_LEN_DQO))
+               return false;
+
+       /* Enforce GVE hardware MSS and header limits */
+       if (unlikely(tx_pkt->tso_segsz < GVE_TX_MIN_TSO_MSS_DQO ||
+                    tx_pkt->tso_segsz > GVE_TX_MAX_PKT_SIZE_DQO ||
+                    headlen > GVE_TX_MAX_HDR_SIZE_DQO))
+               return false;
+
+       tso_segsz = tx_pkt->tso_segsz;
 
        /* Headers will be split into their own buffer. */
        num_descs = 1;

@@ -147,14 +194,18 @@ gve_tx_validate_descs(struct rte_mbuf *tx_pkt, uint16_t nb_descs, bool is_tso)
        mbuf_len = tx_pkt->data_len - headlen;
 
        while (tx_pkt) {
+               int seg_remain;
+
                if (!mbuf_len)
                        goto next_mbuf;
 
-               int seg_remain = tso_segsz - seg_offset;
+               seg_remain = tso_segsz - seg_offset;
                if (num_descs == GVE_TX_MAX_DATA_DESCS && seg_remain)
                        return false;
 
                if (seg_remain < mbuf_len) {
+                       int mbuf_remain = tx_pkt->data_len % GVE_TX_MAX_BUF_SIZE_DQO;
+
                        seg_offset = mbuf_len % tso_segsz;
                        /* The MSS is bound from above by 9728B, so a
                         * single TSO segment in the middle of an mbuf

@@ -162,7 +213,6 @@ gve_tx_validate_descs(struct rte_mbuf *tx_pkt, uint16_t nb_descs, bool is_tso)
                         * is not at risk of defying this limitation.
                         * Thus, such segments are ignored.
                         */
-                       int mbuf_remain = tx_pkt->data_len % GVE_TX_MAX_BUF_SIZE_DQO;
 
                        /* For each TSO segment, HW will prepend
                         * headers. The remaining bytes of this mbuf

@@ -184,7 +234,6 @@ gve_tx_validate_descs(struct rte_mbuf *tx_pkt, uint16_t nb_descs, bool is_tso)
                        mbuf_len = tx_pkt->data_len;
        }
 
-
        return true;
 }
 

drivers/net/gve/gve_tx_dqo.c gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts) · line 308

Quoted 4 lines

drivers/net/gve/gve_tx_dqo.c +1 -0

@@ -256,6 +305,7 @@ gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
        struct rte_mbuf *tx_pkt;
        struct gve_tx_pkt *pkts;
        uint32_t last_desc_idx;
+       uint16_t nb_drop = 0;

Minor nit: maybe we can capture the number of packet sent after we write the descriptors instead? Then we can increment in one place instead of two, and remove the math in getting the number of packets sent.

Quoted 61 lines

drivers/net/gve/gve_tx_dqo.c +17 -10

        uint16_t nb_tx = 0;
        uint64_t bytes = 0;
        const char *reason;

@@ -281,9 +331,13 @@ gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
                                               txq->rs_thresh);
 
 
-               if (rte_mbuf_check(tx_pkt, true, &reason)) {
+               if (unlikely(rte_mbuf_check(tx_pkt, true, &reason))) {
                        PMD_DRV_DP_LOG(DEBUG, "Invalid mbuf: %s", reason);
-                       break;
+                       txq->stats.dropped_pkts++;
+                       txq->stats.errors++;
+                       rte_pktmbuf_free(tx_pkt);
+                       nb_drop++;
+                       continue;
                }
 
                ol_flags = tx_pkt->ol_flags;

@@ -292,6 +346,16 @@ gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
 
                nb_descs = gve_tx_pkt_nb_data_descs(tx_pkt);
                nb_descs += tso;
+
+               /* Drop packet if it doesn't adhere to hardware limits. */
+               if (unlikely(!gve_tx_validate_descs(txq, tx_pkt, nb_descs, tso))) {
+                       txq->stats.dropped_pkts++;
+                       txq->stats.errors++;
+                       rte_pktmbuf_free(tx_pkt);
+                       nb_drop++;
+                       continue;
+               }
+
                req_descs = nb_descs + GVE_TX_MIN_DESC_PREVENT_CACHE_OVERLAP;
 
                /* Clean if there aren't enough descriptors to send the packet

@@ -306,12 +370,6 @@ gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
                                break;
                }
 
-               /* Drop packet if it doesn't adhere to hardware limits. */
-               if (!gve_tx_validate_descs(tx_pkt, nb_descs, tso)) {
-                       txq->stats.too_many_descs++;
-                       break;
-               }
-
                if (!gve_free_compl_tags_pop(txq, &compl_tag))
                        break;
 

@@ -357,7 +415,7 @@ gve_tx_burst_dqo(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
        }
 
        if (nb_tx > 0) {
-               txq->stats.packets += nb_tx;
+               txq->stats.packets += (nb_tx - nb_drop);
                txq->stats.bytes += bytes;
                txq->stats.errors += nb_pkts - nb_tx;
        }
--

2.43.0

This patch series aligns the Google Virtual NIC (gve) DQO RDA transmit path with the upstream Linux kernel driver (drivers/net/ethernet/google/gve/) to resolve transmit queue stalls and hardware validation issues:

1. net/gve: fix DQO descriptor cleaning loop bound
Fixes the off-by-one error in gve_tx_clean_descs_dqo() ("while (--nb_descs)" -> "while (nb_descs--)") and avoids stalling the completion queue on unrecognized descriptor types.

2. net/gve: fix DQO Tx queue stall on multi-seg and TSO Tracks descriptor intervals with last_re_idx per packet against GVE_TX_MIN_RE_INTERVAL (32) instead of counting packets at burst end, preventing descriptor ring starvation and queue deadlocks under multi-segment and TSO traffic.

3. net/gve: add cacheline overlap margin to DQO Tx ring Enforces GVE_TX_MIN_DESC_PREVENT_CACHE_OVERLAP (4 descriptors) margin in ring space checks, avoiding CPU and device DMA cacheline collisions.

4. net/gve: add packet and TSO hardware constraints for DQO Augments gve_tx_validate_descs() (which enforces the 10-descriptor limit per packet or MTU segment) with the remaining hardware length
constraints: [17, 9728] bytes for non-TSO packets, maximum MSS limit (9728 bytes), TSO total length limit (262143 bytes), and validates header contiguity and payload presence on TSO packets. Invalid packets are dropped instead of stalling the queue.

This patch series aligns the Google Virtual NIC (gve) DQO RDA transmit path with the upstream Linux kernel driver (drivers/net/ethernet/google/gve/) to resolve transmit queue stalls and hardware validation issues:

1. net/gve: fix DQO descriptor cleaning loop bound
Fixes the off-by-one error in gve_tx_clean_descs_dqo() ("while (--nb_descs)" -> "while (nb_descs--)") and avoids stalling the completion queue on unrecognized descriptor types.

2. net/gve: fix DQO Tx queue stall on multi-seg and TSO Tracks descriptor intervals with last_re_idx per packet against GVE_TX_MIN_RE_INTERVAL (32) instead of counting packets at burst end, preventing descriptor ring starvation and queue deadlocks under multi-segment and TSO traffic.

3. net/gve: add cacheline overlap margin to DQO Tx ring Enforces GVE_TX_MIN_DESC_PREVENT_CACHE_OVERLAP (4 descriptors) margin in ring space checks, avoiding CPU and device DMA cacheline collisions.

4. net/gve: add packet and TSO hardware constraints for DQO Augments gve_tx_validate_descs() (which enforces the 10-descriptor limit per packet or MTU segment) with the remaining hardware length
constraints: [17, 9728] bytes for non-TSO packets, maximum MSS limit (9728 bytes), TSO total length limit (262143 bytes), and validates header contiguity and payload presence on TSO packets. Invalid packets are dropped instead of stalling the queue.

v2:
- Patch 1/4, 3/4: No changes.

This series fixes several ways the gve DQO RDA Tx path can stall or post invalid descriptors: completion handling bugs (1-2), a report event interval that can starve the ring (3), a stray TSO context descriptor when completion tags run out (4), a missing cacheline margin (5), invalid packets blocking the burst (6-8), and missing device length checks (9-10).