diff --git a/NEWS b/NEWS

index 2e5356c5cd..c670cf8f35 100644

--- a/NEWS

+++ b/NEWS

@@ -1,3 +1,6 @@

+v3.5.1 - xx xxx xxxx

+--------------------

+

 v3.5.0 - 17 Feb 2025

 --------------------

    - The limit on the number of fields for address prefix tracking in flow

diff --git a/configure.ac b/configure.ac

index 2b19888775..60122e4913 100644

--- a/configure.ac

+++ b/configure.ac

@@ -13,7 +13,7 @@

 # limitations under the License.

 AC_PREREQ(2.63)

-AC_INIT(openvswitch, 3.5.0, bugs@openvswitch.org)

+AC_INIT(openvswitch, 3.5.1, bugs@openvswitch.org)

 AC_CONFIG_SRCDIR([vswitchd/ovs-vswitchd.c])

 AC_CONFIG_MACRO_DIR([m4])

 AC_CONFIG_AUX_DIR([build-aux])

diff --git a/debian/changelog b/debian/changelog

index 1ba7afbf40..ad638cc44f 100644

--- a/debian/changelog

+++ b/debian/changelog

@@ -1,3 +1,9 @@

+openvswitch (3.5.1-1) unstable; urgency=low

+   [ Open vSwitch team ]

+   * New upstream version

+

+ -- Open vSwitch team <dev@openvswitch.org>  Mon, 17 Feb 2025 13:13:23 +0100

+

 openvswitch (3.5.0-1) unstable; urgency=low

    * New upstream version

diff --git a/dpdk/VERSION b/dpdk/VERSION

index 0a492611a0..9e2934aa34 100644

--- a/dpdk/VERSION

+++ b/dpdk/VERSION

@@ -1 +1 @@

-24.11.0

+24.11.1

diff --git a/dpdk/doc/guides/rel_notes/release_24_11.rst b/dpdk/doc/guides/rel_notes/release_24_11.rst

index 8486cd986f..f9df63141e 100644

--- a/dpdk/doc/guides/rel_notes/release_24_11.rst

+++ b/dpdk/doc/guides/rel_notes/release_24_11.rst

@@ -616,3 +616,22 @@ Tested Platforms

       * Firmware version: 2.14, 0x8000028c

       * Device id (pf): 8086:125b

       * Driver version(in-tree): 6.8.0-45-generic (Ubuntu24.04.1)(igc)

+

+24.11.1 Release Notes

+---------------------

+

+

+24.11.1 Fixes

+~~~~~~~~~~~~~

+

+* net/virtio: fix Rx checksum calculation

+

+24.11.1 Validation

+~~~~~~~~~~~~~~~~~~

+

+* Tested by Red Hat validation team

+

+24.11.1 Known Issues

+~~~~~~~~~~~~~~~~~~~~

+

+* DPDK 24.11.1 contains DPDK 24.11 plus the fix for CVE-2024-11614 only

diff --git a/dpdk/kernel/linux/uapi/linux/vduse.h b/dpdk/kernel/linux/uapi/linux/vduse.h

new file mode 100644

index 0000000000..11bd48c72c

--- /dev/null

+++ b/dpdk/kernel/linux/uapi/linux/vduse.h

@@ -0,0 +1,353 @@

+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */

+#ifndef _UAPI_VDUSE_H_

+#define _UAPI_VDUSE_H_

+

+#include <linux/types.h>

+

+#define VDUSE_BASE	0x81

+

+/* The ioctls for control device (/dev/vduse/control) */

+

+#define VDUSE_API_VERSION	0

+

+/*

+ * Get the version of VDUSE API that kernel supported (VDUSE_API_VERSION).

+ * This is used for future extension.

+ */

+#define VDUSE_GET_API_VERSION	_IOR(VDUSE_BASE, 0x00, __u64)

+

+/* Set the version of VDUSE API that userspace supported. */

+#define VDUSE_SET_API_VERSION	_IOW(VDUSE_BASE, 0x01, __u64)

+

+/**

+ * struct vduse_dev_config - basic configuration of a VDUSE device

+ * @name: VDUSE device name, needs to be NUL terminated

+ * @vendor_id: virtio vendor id

+ * @device_id: virtio device id

+ * @features: virtio features

+ * @vq_num: the number of virtqueues

+ * @vq_align: the allocation alignment of virtqueue's metadata

+ * @reserved: for future use, needs to be initialized to zero

+ * @config_size: the size of the configuration space

+ * @config: the buffer of the configuration space

+ *

+ * Structure used by VDUSE_CREATE_DEV ioctl to create VDUSE device.

+ */

+struct vduse_dev_config {

+#define VDUSE_NAME_MAX	256

+	char name[VDUSE_NAME_MAX];

+	__u32 vendor_id;

+	__u32 device_id;

+	__u64 features;

+	__u32 vq_num;

+	__u32 vq_align;

+	__u32 reserved[13];

+	__u32 config_size;

+	__u8 config[];

+};

+

+/* Create a VDUSE device which is represented by a char device (/dev/vduse/$NAME) */

+#define VDUSE_CREATE_DEV	_IOW(VDUSE_BASE, 0x02, struct vduse_dev_config)

+

+/*

+ * Destroy a VDUSE device. Make sure there are no more references

+ * to the char device (/dev/vduse/$NAME).

+ */

+#define VDUSE_DESTROY_DEV	_IOW(VDUSE_BASE, 0x03, char[VDUSE_NAME_MAX])

+

+/* The ioctls for VDUSE device (/dev/vduse/$NAME) */

+

+/**

+ * struct vduse_iotlb_entry - entry of IOTLB to describe one IOVA region [start, last]

+ * @offset: the mmap offset on returned file descriptor

+ * @start: start of the IOVA region

+ * @last: last of the IOVA region

+ * @perm: access permission of the IOVA region

+ *

+ * Structure used by VDUSE_IOTLB_GET_FD ioctl to find an overlapped IOVA region.

+ */

+struct vduse_iotlb_entry {

+	__u64 offset;

+	__u64 start;

+	__u64 last;

+#define VDUSE_ACCESS_RO 0x1

+#define VDUSE_ACCESS_WO 0x2

+#define VDUSE_ACCESS_RW 0x3

+	__u8 perm;

+};

+

+/*

+ * Find the first IOVA region that overlaps with the range [start, last]

+ * and return the corresponding file descriptor. Return -EINVAL means the

+ * IOVA region doesn't exist. Caller should set start and last fields.

+ */

+#define VDUSE_IOTLB_GET_FD	_IOWR(VDUSE_BASE, 0x10, struct vduse_iotlb_entry)

+

+/*

+ * Get the negotiated virtio features. It's a subset of the features in

+ * struct vduse_dev_config which can be accepted by virtio driver. It's

+ * only valid after FEATURES_OK status bit is set.

+ */

+#define VDUSE_DEV_GET_FEATURES	_IOR(VDUSE_BASE, 0x11, __u64)

+

+/**

+ * struct vduse_config_data - data used to update configuration space

+ * @offset: the offset from the beginning of configuration space

+ * @length: the length to write to configuration space

+ * @buffer: the buffer used to write from

+ *

+ * Structure used by VDUSE_DEV_SET_CONFIG ioctl to update device

+ * configuration space.

+ */

+struct vduse_config_data {

+	__u32 offset;

+	__u32 length;

+	__u8 buffer[];

+};

+

+/* Set device configuration space */

+#define VDUSE_DEV_SET_CONFIG	_IOW(VDUSE_BASE, 0x12, struct vduse_config_data)

+

+/*

+ * Inject a config interrupt. It's usually used to notify virtio driver

+ * that device configuration space has changed.

+ */

+#define VDUSE_DEV_INJECT_CONFIG_IRQ	_IO(VDUSE_BASE, 0x13)

+

+/**

+ * struct vduse_vq_config - basic configuration of a virtqueue

+ * @index: virtqueue index

+ * @max_size: the max size of virtqueue

+ * @reserved: for future use, needs to be initialized to zero

+ *

+ * Structure used by VDUSE_VQ_SETUP ioctl to setup a virtqueue.

+ */

+struct vduse_vq_config {

+	__u32 index;

+	__u16 max_size;

+	__u16 reserved[13];

+};

+

+/*

+ * Setup the specified virtqueue. Make sure all virtqueues have been

+ * configured before the device is attached to vDPA bus.

+ */

+#define VDUSE_VQ_SETUP		_IOW(VDUSE_BASE, 0x14, struct vduse_vq_config)

+

+/**

+ * struct vduse_vq_state_split - split virtqueue state

+ * @avail_index: available index

+ */

+struct vduse_vq_state_split {

+	__u16 avail_index;

+};

+

+/**

+ * struct vduse_vq_state_packed - packed virtqueue state

+ * @last_avail_counter: last driver ring wrap counter observed by device

+ * @last_avail_idx: device available index

+ * @last_used_counter: device ring wrap counter

+ * @last_used_idx: used index

+ */

+struct vduse_vq_state_packed {

+	__u16 last_avail_counter;

+	__u16 last_avail_idx;

+	__u16 last_used_counter;

+	__u16 last_used_idx;

+};

+

+/**

+ * struct vduse_vq_info - information of a virtqueue

+ * @index: virtqueue index

+ * @num: the size of virtqueue

+ * @desc_addr: address of desc area

+ * @driver_addr: address of driver area

+ * @device_addr: address of device area

+ * @split: split virtqueue state

+ * @packed: packed virtqueue state

+ * @ready: ready status of virtqueue

+ *

+ * Structure used by VDUSE_VQ_GET_INFO ioctl to get virtqueue's information.

+ */

+struct vduse_vq_info {

+	__u32 index;

+	__u32 num;

+	__u64 desc_addr;

+	__u64 driver_addr;

+	__u64 device_addr;

+	union {

+		struct vduse_vq_state_split split;

+		struct vduse_vq_state_packed packed;

+	};

+	__u8 ready;

+};

+

+/* Get the specified virtqueue's information. Caller should set index field. */

+#define VDUSE_VQ_GET_INFO	_IOWR(VDUSE_BASE, 0x15, struct vduse_vq_info)

+

+/**

+ * struct vduse_vq_eventfd - eventfd configuration for a virtqueue

+ * @index: virtqueue index

+ * @fd: eventfd, -1 means de-assigning the eventfd

+ *

+ * Structure used by VDUSE_VQ_SETUP_KICKFD ioctl to setup kick eventfd.

+ */

+struct vduse_vq_eventfd {

+	__u32 index;

+#define VDUSE_EVENTFD_DEASSIGN -1

+	int fd;

+};

+

+/*

+ * Setup kick eventfd for specified virtqueue. The kick eventfd is used

+ * by VDUSE kernel module to notify userspace to consume the avail vring.

+ */

+#define VDUSE_VQ_SETUP_KICKFD	_IOW(VDUSE_BASE, 0x16, struct vduse_vq_eventfd)

+

+/*

+ * Inject an interrupt for specific virtqueue. It's used to notify virtio driver

+ * to consume the used vring.

+ */

+#define VDUSE_VQ_INJECT_IRQ	_IOW(VDUSE_BASE, 0x17, __u32)

+

+/**

+ * struct vduse_iova_umem - userspace memory configuration for one IOVA region

+ * @uaddr: start address of userspace memory, it must be aligned to page size

+ * @iova: start of the IOVA region

+ * @size: size of the IOVA region

+ * @reserved: for future use, needs to be initialized to zero

+ *

+ * Structure used by VDUSE_IOTLB_REG_UMEM and VDUSE_IOTLB_DEREG_UMEM

+ * ioctls to register/de-register userspace memory for IOVA regions

+ */

+struct vduse_iova_umem {

+	__u64 uaddr;

+	__u64 iova;

+	__u64 size;

+	__u64 reserved[3];

+};

+

+/* Register userspace memory for IOVA regions */

+#define VDUSE_IOTLB_REG_UMEM	_IOW(VDUSE_BASE, 0x18, struct vduse_iova_umem)

+

+/* De-register the userspace memory. Caller should set iova and size field. */

+#define VDUSE_IOTLB_DEREG_UMEM	_IOW(VDUSE_BASE, 0x19, struct vduse_iova_umem)

+

+/**

+ * struct vduse_iova_info - information of one IOVA region

+ * @start: start of the IOVA region

+ * @last: last of the IOVA region

+ * @capability: capability of the IOVA regsion

+ * @reserved: for future use, needs to be initialized to zero

+ *

+ * Structure used by VDUSE_IOTLB_GET_INFO ioctl to get information of

+ * one IOVA region.

+ */

+struct vduse_iova_info {

+	__u64 start;

+	__u64 last;

+#define VDUSE_IOVA_CAP_UMEM (1 << 0)

+	__u64 capability;

+	__u64 reserved[3];

+};

+

+/*

+ * Find the first IOVA region that overlaps with the range [start, last]

+ * and return some information on it. Caller should set start and last fields.

+ */

+#define VDUSE_IOTLB_GET_INFO	_IOWR(VDUSE_BASE, 0x1a, struct vduse_iova_info)

+

+/* The control messages definition for read(2)/write(2) on /dev/vduse/$NAME */

+

+/**

+ * enum vduse_req_type - request type

+ * @VDUSE_GET_VQ_STATE: get the state for specified virtqueue from userspace

+ * @VDUSE_SET_STATUS: set the device status

+ * @VDUSE_UPDATE_IOTLB: Notify userspace to update the memory mapping for

+ *                      specified IOVA range via VDUSE_IOTLB_GET_FD ioctl

+ */

+enum vduse_req_type {

+	VDUSE_GET_VQ_STATE,

+	VDUSE_SET_STATUS,

+	VDUSE_UPDATE_IOTLB,

+};

+

+/**

+ * struct vduse_vq_state - virtqueue state

+ * @index: virtqueue index

+ * @split: split virtqueue state

+ * @packed: packed virtqueue state

+ */

+struct vduse_vq_state {

+	__u32 index;

+	union {

+		struct vduse_vq_state_split split;

+		struct vduse_vq_state_packed packed;

+	};

+};

+

+/**

+ * struct vduse_dev_status - device status

+ * @status: device status

+ */

+struct vduse_dev_status {

+	__u8 status;

+};

+

+/**

+ * struct vduse_iova_range - IOVA range [start, last]

+ * @start: start of the IOVA range

+ * @last: last of the IOVA range

+ */

+struct vduse_iova_range {

+	__u64 start;

+	__u64 last;

+};

+

+/**

+ * struct vduse_dev_request - control request

+ * @type: request type

+ * @request_id: request id

+ * @reserved: for future use

+ * @vq_state: virtqueue state, only index field is available

+ * @s: device status

+ * @iova: IOVA range for updating

+ * @padding: padding

+ *

+ * Structure used by read(2) on /dev/vduse/$NAME.

+ */

+struct vduse_dev_request {

+	__u32 type;

+	__u32 request_id;

+	__u32 reserved[4];

+	union {

+		struct vduse_vq_state vq_state;

+		struct vduse_dev_status s;

+		struct vduse_iova_range iova;

+		__u32 padding[32];

+	};

+};

+

+/**

+ * struct vduse_dev_response - response to control request

+ * @request_id: corresponding request id

+ * @result: the result of request

+ * @reserved: for future use, needs to be initialized to zero

+ * @vq_state: virtqueue state

+ * @padding: padding

+ *

+ * Structure used by write(2) on /dev/vduse/$NAME.

+ */

+struct vduse_dev_response {

+	__u32 request_id;

+#define VDUSE_REQ_RESULT_OK	0x00

+#define VDUSE_REQ_RESULT_FAILED	0x01

+	__u32 result;

+	__u32 reserved[4];

+	union {

+		struct vduse_vq_state vq_state;

+		__u32 padding[32];

+	};

+};

+

+#endif /* _UAPI_VDUSE_H_ */

diff --git a/dpdk/lib/vhost/meson.build b/dpdk/lib/vhost/meson.build

index 51bcf17244..0004f283bb 100644

--- a/dpdk/lib/vhost/meson.build

+++ b/dpdk/lib/vhost/meson.build

@@ -26,16 +26,13 @@ sources = files(

         'iotlb.c',

         'socket.c',

         'vdpa.c',

+        'vduse.c',

         'vhost.c',

         'vhost_crypto.c',

         'vhost_user.c',

         'virtio_net.c',

         'virtio_net_ctrl.c',

 )

-if cc.has_header('linux/vduse.h')

-    sources += files('vduse.c')

-    cflags += '-DVHOST_HAS_VDUSE'

-endif

 headers = files(

         'rte_vdpa.h',

         'rte_vhost.h',

diff --git a/dpdk/lib/vhost/vduse.c b/dpdk/lib/vhost/vduse.c

index 8ba58555f9..eaf3146b95 100644

--- a/dpdk/lib/vhost/vduse.c

+++ b/dpdk/lib/vhost/vduse.c

@@ -8,7 +8,7 @@

 #include <fcntl.h>

-#include <linux/vduse.h>

+#include <uapi/linux/vduse.h>

 #include <linux/virtio_net.h>

 #include <sys/ioctl.h>

diff --git a/dpdk/lib/vhost/vduse.h b/dpdk/lib/vhost/vduse.h

index 0d8f3f1205..47ca97a064 100644

--- a/dpdk/lib/vhost/vduse.h

+++ b/dpdk/lib/vhost/vduse.h

@@ -9,29 +9,7 @@

 #define VDUSE_NET_SUPPORTED_FEATURES VIRTIO_NET_SUPPORTED_FEATURES

-#ifdef VHOST_HAS_VDUSE

-

 int vduse_device_create(const char *path, bool compliant_ol_flags);

 int vduse_device_destroy(const char *path);

-#else

-

-static inline int

-vduse_device_create(const char *path, bool compliant_ol_flags)

-{

-	RTE_SET_USED(compliant_ol_flags);

-

-	VHOST_CONFIG_LOG(path, ERR, "VDUSE support disabled at build time");

-	return -1;

-}

-

-static inline int

-vduse_device_destroy(const char *path)

-{

-	VHOST_CONFIG_LOG(path, ERR, "VDUSE support disabled at build time");

-	return -1;

-}

-

-#endif /* VHOST_HAS_VDUSE */

-

 #endif /* _VDUSE_H */

diff --git a/dpdk/lib/vhost/virtio_net.c b/dpdk/lib/vhost/virtio_net.c

index d764d4bc6a..a340e5a772 100644

--- a/dpdk/lib/vhost/virtio_net.c

+++ b/dpdk/lib/vhost/virtio_net.c

@@ -2823,6 +2823,9 @@ vhost_dequeue_offload(struct virtio_net *dev, struct virtio_net_hdr *hdr,

 			 */

 			uint16_t csum = 0, off;

+			if (hdr->csum_start >= rte_pktmbuf_pkt_len(m))

+				return;

+

 			if (rte_raw_cksum_mbuf(m, hdr->csum_start,

 					rte_pktmbuf_pkt_len(m) - hdr->csum_start, &csum) < 0)

 				return;

@@ -3626,6 +3629,8 @@ rte_vhost_dequeue_burst(int vid, uint16_t queue_id,

 		rte_rwlock_read_unlock(&vq->access_lock);

 		virtio_dev_vring_translate(dev, vq);

+

+		count = 0;

 		goto out_no_unlock;

 	}