From patchwork Wed Sep 16 11:46:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5370 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:6446:b0:8a0:ea1f:253a with SMTP id n6csp6082476mag; Wed, 16 Sep 2026 04:47:11 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBzpR+CTstOi1V2shYB6XgUBDnR26Xi7qnlCzoctjr92lOz2nrKQE5V1J755aCq9itYJQDSrTVR6gs8=@openvpn.net X-Received: by 2002:a05:6870:3344:b0:483:67d7:e03e with SMTP id 586e51a60fabf-48476c4a899mr4078434fac.10.1789559231285; Wed, 16 Sep 2026 04:47:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1789559231; cv=none; d=google.com; s=arc-20260327; b=R8Z6ryBKQ5mQq3i9lL0KXTGxEaJSKpXupMay3Wjmh6S3/l4FhCuIv/9YaWY0m5AiOc GjnlxrLw6IF0RQJTWT+IDWDrQ04Q/5mUMmkS0ml3HJAgR+qGD1nuF9VwcUySTo4mvhAR /psPn4IvQ6vdZ597eaps+aslG4ydNS41HDse1Y5qkrAAtQP7Q97vwa+ufyWJIhA0Uz4N kgBsv9mUNmxDsYK2pCbl86Vo3umLRmvxhzIlWBtH5On6s3HzQJU2XZ82/XVo07WIdDkB 6sVzG735xqEGMCANZbeVd0AreZ895S4BfFHRwBS8dUJp6GaTXyN6Ad0INltohvL3S7nr wsIw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=+6s0EMRAyRbF1d4XLzYpVQvZbcVROxNH2fI4BSHH6eI=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=PjtlBDQxxHg/uDJv0tHaiopqAiq5NRnjlgk5epoJtMq3ZwmNz2nanapEgJr40kyCMQ 9mrzC6ehuMn4AcTzwX9kv0/0IgWHLmpn4fhn6bQC1mmdETiEsCpyT6JRRTIb+/YJBoj2 Li6jlyprThYdkElexBmegWlBc3UZTD3j0vWD+3M3ZSx8a/nMJl1xJDserui4P1IVWnp+ p1i4tWnzlHDUGSHRLCIo9HkJu0Nx5ojrvo6FqqztThzZNFfUIEFMsj5mstM2AkhyCjUQ SO+edaeA/YeGBwWGpmia/KW+QdymOP9TLDx61rHO9bLY1Q/QTBvQiTgsuMsJ91sb5AcG ROsg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="gjW/5yQ5"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=kRNBWBB5; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=h5zuw+Q2; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=Ab8wm7GA; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-48427909da7si2901755fac.12.2026.09.16.04.47.11 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 16 Sep 2026 04:47:11 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="gjW/5yQ5"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=kRNBWBB5; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=h5zuw+Q2; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=Ab8wm7GA; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=+6s0EMRAyRbF1d4XLzYpVQvZbcVROxNH2fI4BSHH6eI=; b=gjW/5yQ5uQhZnR3eUC/3M53eQw HRKxvRJvVE0mf7H04GZvw9JTSAzZGdujzSmDpEhdCTQevH1FX7DvSOZDqFJ2WB+Vl7Nwf1ZhtE5iH YR4Nr9zNBd2j8msXexWk3YuVkayEIFBrUe8xby6GOyIlYRw94DwqQ/PZF1mkjs0NUYX8=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1x6o6W-0006fU-Bg; Wed, 16 Sep 2026 11:47:08 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1x6o6U-0006fL-MN for openvpn-devel@lists.sourceforge.net; Wed, 16 Sep 2026 11:47:06 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=O+LmGQUkIOAcoLzVlPOmq0l5jGQ82sDFNvn6yuJvxTo=; b=kRNBWBB5+INJQBoCxnwSzTZlHT gjfCkCoQ3yVdyfHqF3v224Wrfl1ogHhIBey+nROZlJnulBbJecCQdws1NewNZ52ZqR/Hyl+3cb8qE r3Oi0QzFBeA0ci4KTRUROM9KYb2Q/8AxFnEwiJC/A/FIWyY8dvL9JxQppwf9Ie6jKRqo=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=O+LmGQUkIOAcoLzVlPOmq0l5jGQ82sDFNvn6yuJvxTo=; b=h5zuw+Q2XVCp7fF0J+d/Ja9Zpi aNLpxklonBI06RGU+doSTMQX0tAbyW0GCM4SEy8b140F34dHhNv1td8vocLcBJWnu9S5tHhvRp85D iDGtN8HMF9MpkrhD2G3Iay2ocYUwJ/+6SZ6+8KXb3tijzgXgtxDrxksnSb/3bUO02ThQ=; Received: from mout-b-107.mailbox.org ([195.10.208.47]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1x6o6R-0001Vw-He for openvpn-devel@lists.sourceforge.net; Wed, 16 Sep 2026 11:47:06 +0000 Received: from smtp1.mailbox.org (smtp1.mailbox.org [IPv6:2001:67c:2050:b231:465::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-107.mailbox.org (Postfix) with ESMTPS id 4hlHCn1dgPz3y01 for ; Wed, 16 Sep 2026 13:46:29 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1789559189; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=O+LmGQUkIOAcoLzVlPOmq0l5jGQ82sDFNvn6yuJvxTo=; b=Ab8wm7GAmuuHXNgc2uTO/ATA7W2plSn1x7dFNikx6xnZjlxzrkPjJEJywUwvJnnI3E5kuz 5jS5McOWeEJpm000oO9QV4sFWQ++47KboArFlJKf9H5vIEgAytE6fswUPSb25Tz1N02cZ1 Ck5j8b2KGWVnhz3rQ2pGZjkMUB/8cVcYIKHoBp8VDGmjOLmaP3Y3fwbRn3MbSyk5y3cHNo yEggh2CZp6d+dS60W+kZkG0tqyGa40WiKsd5XgB79Msko2LC5/wh3V2xAzOmAUnRlYg+Vu Q/rqOvexpk6lckwzj5Xar7SlPVNwdSqteHCCJaCC6HOU12QkrWV+HlSa4e87yQ== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::1 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Wed, 16 Sep 2026 13:46:09 +0200 Message-ID: <1bbfde37488ade61928554db3a119525adf7b608.1789558856.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4hlHCn1dgPz3y01 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: ovpn already advertises software GSO support and segments GSO skbs in its transmit path. However, without checksum offload in the device features, the networking core has to segment GSO packets before [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-Headers-End: 1x6o6R-0001Vw-He Subject: [Openvpn-devel] [RFC ovpn net-next v4 1/9] ovpn: advertise checksum offload for GSO packets X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1876488860204238834 X-GMAIL-MSGID: 1876488860204238834 ovpn already advertises software GSO support and segments GSO skbs in its transmit path. However, without checksum offload in the device features, the networking core has to segment GSO packets before they reach ovpn because TCP GSO packets normally carry CHECKSUM_PARTIAL state. Advertise NETIF_F_HW_CSUM so the stack can pass such packets to ovpn. Complete partial checksums after any GSO segmentation and before submitting packets for encryption, since the inner packet checksum can no longer be fixed after the packet has been encrypted. Also pass the ovpn feature set to skb_gso_segment with GSO capabilities masked out: this forces software segmentation, but still lets the segmenter preserve supported non-GSO properties such as non-linear skb data instead of needlessly linearizing. Signed-off-by: Ralf Lici --- No changes since v3 https://lore.kernel.org/openvpn-devel/1bbfde37488ade61928554db3a119525adf7b608.1789546917.git.ralf@mandelbit.com/ No changes since v2 https://lore.kernel.org/openvpn-devel/1bbfde37488ade61928554db3a119525adf7b608.1789540779.git.ralf@mandelbit.com/ No changes since v1 https://lore.kernel.org/openvpn-devel/1bbfde37488ade61928554db3a119525adf7b608.1789485693.git.ralf@mandelbit.com/ drivers/net/ovpn/io.c | 20 ++++++++++++++++++-- drivers/net/ovpn/main.c | 2 +- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/drivers/net/ovpn/io.c b/drivers/net/ovpn/io.c index 9526f8096da6..112067ded401 100644 --- a/drivers/net/ovpn/io.c +++ b/drivers/net/ovpn/io.c @@ -358,6 +358,7 @@ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev) struct ovpn_priv *ovpn = netdev_priv(dev); struct sk_buff *segments, *curr, *next; struct sk_buff_head skb_list; + netdev_features_t features; unsigned int tx_bytes = 0; struct ovpn_peer *peer; __be16 proto; @@ -392,8 +393,13 @@ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev) skb_dst_drop(skb); if (skb_is_gso(skb)) { - segments = skb_gso_segment(skb, 0); - if (IS_ERR(segments)) { + /* force software segmentation, but keep ovpn's non-GSO feature + * bits so the generated segments can preserve non-linear skb + * data where possible + */ + features = netif_skb_features(skb); + segments = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK); + if (IS_ERR_OR_NULL(segments)) { ret = PTR_ERR(segments); net_err_ratelimited("%s: cannot segment payload packet: %d\n", netdev_name(dev), ret); @@ -418,6 +424,16 @@ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev) continue; } + /* NETIF_F_HW_CSUM requires completing partial checksums */ + if (unlikely(curr->ip_summed == CHECKSUM_PARTIAL && + skb_checksum_help(curr) < 0)) { + net_err_ratelimited("%s: skb_checksum_help failed for payload packet\n", + netdev_name(dev)); + ovpn_dev_dstats_tx_dropped(ovpn->dev); + kfree_skb(curr); + continue; + } + /* only count what we actually send */ tx_bytes += curr->len; __skb_queue_tail(&skb_list, curr); diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c index 0708249e9607..28e1eb06e127 100644 --- a/drivers/net/ovpn/main.c +++ b/drivers/net/ovpn/main.c @@ -157,7 +157,7 @@ static const struct ethtool_ops ovpn_ethtool_ops = { static void ovpn_setup(struct net_device *dev) { - netdev_features_t feat = NETIF_F_SG | NETIF_F_GSO | + netdev_features_t feat = NETIF_F_HW_CSUM | NETIF_F_SG | NETIF_F_GSO | NETIF_F_GSO_SOFTWARE | NETIF_F_HIGHDMA; dev->needs_free_netdev = true;