[PATCH net v7 3/4] net: hsr: segment GSO before per-frame forwarding

[Xin Xie <xiexinet@gmail.com>]

HSR/PRP require a tag/RCT and sequence number for each wire frame.
Adding them to a GSO aggregate before segmentation cannot provide
valid per-frame metadata.

Use the core GSO segmenter before normal per-frame processing.
Each segment follows the usual local-delivery and forwarding paths.
Remove GSO_MASK types from the master's hw_features so core TX also
segments local traffic before ndo_start_xmit().

Classify by inner protocol, not ingress port. Use the core's bounded
VLAN decoder for 802.1Q, 802.1AD and nested or accelerated tags.
Reject inner HSR/PRP aggregates, unreadable fragments and undecodable
headers. Also reject trailing bytes beyond a known nonzero IP length:
otherwise an old PRP sender's erroneous whole-aggregate RCT becomes
transport payload. This check also rejects locally destined malformed
inputs that the base kernel accepted. Zero IP lengths and GSO_PARTIAL
are left to the segmenter because they provide no full IP extent for
this check.

The preceding ordered-consumer patch is required for per-segment
local numbering. Charge the worker budget by the actual segment count,
or one on failure, and count each rejected input once through core
per-CPU statistics on its entry device.

Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)")
Signed-off-by: Xin Xie <xiexinet@gmail.com>
---
 net/hsr/hsr_device.c        |   2 +-
 net/hsr/hsr_forward.c       | 148 +++++++++++++++++++++++++++++++++++-
 net/hsr/hsr_forward.h       |   5 ++
 net/hsr/hsr_forward_queue.c |  22 ++----
 4 files changed, 158 insertions(+), 19 deletions(-)

diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index 68cd64a865fd..a67d85551abe 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -698,7 +698,7 @@ void hsr_dev_setup(struct net_device *dev)
 	dev->needs_free_netdev = true;
 
 	dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
-			   NETIF_F_GSO_MASK | NETIF_F_HW_CSUM |
+			   NETIF_F_HW_CSUM |
 			   NETIF_F_HW_VLAN_CTAG_TX |
 			   NETIF_F_HW_VLAN_CTAG_FILTER;
 
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index e8b53367bf3e..0c227a20b7d8 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -12,6 +12,9 @@
 #include <linux/skbuff.h>
 #include <linux/etherdevice.h>
 #include <linux/if_vlan.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <net/gso.h>
 #include "hsr_main.h"
 #include "hsr_framereg.h"
 
@@ -818,6 +821,149 @@ void hsr_forward_frame(struct sk_buff *skb, struct hsr_port *port,
 	kfree_skb(skb);
 }
 
+/* Shared drop mapping for the new queue and GSO gate stages: one
+ * count per dropped original input.  Ordinary master TX and all
+ * internal supervision (local and proxy) are TX drops on the entry
+ * device; ordinary slave A/B and interlink RX are RX drops.
+ * Internal supervision keeps the TX mapping regardless of its
+ * entry role.
+ */
+void hsr_fwd_drop_stat(struct net_device *dev, enum hsr_port_type type,
+		       enum hsr_job_class class)
+{
+	if (class == HSR_JOB_NORMAL && type != HSR_PT_MASTER)
+		dev_core_stats_rx_dropped_inc(dev);
+	else
+		dev_core_stats_tx_dropped_inc(dev);
+}
+
+/* Return the inner EtherType using the core's bounded 802.1Q/802.1AD
+ * decoder. An accelerated outer tag is metadata, not frame bytes.
+ */
+static __be16 hsr_gso_effective_proto(const struct sk_buff *skb, int *l3off)
+{
+	struct ethhdr eh;
+	const struct ethhdr *eth;
+
+	if (skb_vlan_tag_present(skb) &&
+	    !eth_type_vlan(skb->vlan_proto))
+		return 0;
+
+	eth = skb_header_pointer(skb, 0, sizeof(eh), &eh);
+	if (!eth)
+		return 0;
+
+	return __vlan_get_protocol(skb, eth->h_proto, l3off);
+}
+
+/* Bytes beyond the IP datagram must not become segment payload. Older
+ * PRP senders can append an RCT to a whole GSO skb. Zero IP lengths and
+ * GSO_PARTIAL headers do not provide the full aggregate length here.
+ */
+static bool hsr_gso_trailing_data(const struct sk_buff *skb, __be16 proto,
+				  int l3off)
+{
+	unsigned int l3len;
+
+	if (skb_shinfo(skb)->gso_type & SKB_GSO_PARTIAL)
+		return false;
+
+	if (proto == htons(ETH_P_IP)) {
+		struct iphdr buffer;
+		const struct iphdr *iph;
+
+		iph = skb_header_pointer(skb, l3off, sizeof(buffer), &buffer);
+		if (!iph)
+			return true;
+		l3len = ntohs(iph->tot_len);
+	} else if (proto == htons(ETH_P_IPV6)) {
+		struct ipv6hdr buffer;
+		const struct ipv6hdr *ip6h;
+
+		ip6h = skb_header_pointer(skb, l3off, sizeof(buffer), &buffer);
+		if (!ip6h)
+			return true;
+		l3len = ntohs(ip6h->payload_len);
+		if (l3len)
+			l3len += sizeof(*ip6h);
+	} else {
+		return false;
+	}
+
+	return l3len && l3off + l3len < skb->len;
+}
+
+/* GSO fan-out funnel: unfold super-packets before per-frame
+ * processing so each wire frame gets its own HSR/PRP tag and
+ * sequence number.  Returns the number of per-frame units actually
+ * processed (one for a single-frame input or a failed aggregate).
+ */
+unsigned int hsr_forward_input(struct sk_buff *skb, struct hsr_port *port,
+			       enum hsr_job_class class,
+			       enum hsr_exec_source source)
+{
+	struct sk_buff *segs, *next;
+	unsigned int count = 0;
+	__be16 proto;
+	int l3off;
+
+	if (likely(!skb_is_gso(skb))) {
+		hsr_forward_frame(skb, port, source);
+		return 1;
+	}
+
+	/* Conforming plain-protocol GSO super-packets carry
+	 * trailer-free sender payload and are segmented here: each
+	 * segment is delivered or forwarded as its own wire frame, on
+	 * any ingress role.
+	 *
+	 * The gate is content-based, not port-based.  An aggregate
+	 * whose effective protocol is ETH_P_HSR or ETH_P_PRP cannot be
+	 * safely segmented and is dropped, as is any skb whose headers
+	 * cannot be read or whose fragments are unreadable net_iov
+	 * (device-memory) pages: software segmentation cannot read
+	 * their payload, so each segment would inherit the unreadable
+	 * flag and carry uninitialized data.  Ordinary VLAN GSO
+	 * (802.1Q/802.1AD at any reachable tag depth, accelerated or
+	 * in-band) is classified to its inner protocol through the core
+	 * VLAN decoder and segmented like plain input.  With
+	 * NETIF_F_HW_HSR_TAG_RM the lower has already stripped the tag,
+	 * so such aggregates arrive plain and are segmented.
+	 */
+	if (!skb_frags_readable(skb))
+		goto drop_gso; /* net_iov frags are not host-readable */
+	proto = hsr_gso_effective_proto(skb, &l3off);
+	if (!proto)
+		goto drop_gso; /* classification failure, fail-safe */
+	if (proto == htons(ETH_P_HSR) || proto == htons(ETH_P_PRP))
+		goto drop_gso;
+	if (hsr_gso_trailing_data(skb, proto, l3off))
+		goto drop_gso;
+
+	/* features = 0: request full software segmentation.  tx_path is
+	 * true only for locally generated traffic on the master; ingress
+	 * follows RX checksum semantics.
+	 */
+	segs = __skb_gso_segment(skb, 0, port->type == HSR_PT_MASTER);
+	if (IS_ERR(segs) || unlikely(!segs))
+		goto drop_gso;
+
+	consume_skb(skb);
+	while (segs) {
+		next = segs->next;
+		segs->next = NULL;
+		hsr_forward_frame(segs, port, source);
+		count++;
+		segs = next;
+	}
+	return count;
+
+drop_gso:
+	hsr_fwd_drop_stat(port->dev, port->type, class);
+	kfree_skb(skb);
+	return 1;
+}
+
 /* Submission entry.  Inputs that need a local sequence number go to
  * the single consumer before any numbering happens; the synchronous
  * LAN A/B receive path keeps its original behavior.
@@ -828,7 +974,7 @@ void hsr_forward_skb(struct sk_buff *skb, struct hsr_port *port)
 		hsr_queue_submit(skb, port, HSR_JOB_NORMAL);
 		return;
 	}
-	hsr_forward_frame(skb, port, HSR_EXEC_DIRECT_LAN);
+	hsr_forward_input(skb, port, HSR_JOB_NORMAL, HSR_EXEC_DIRECT_LAN);
 }
 
 /* Internally generated supervision frames always take the common
diff --git a/net/hsr/hsr_forward.h b/net/hsr/hsr_forward.h
index 0fde1972c0a5..12fdf1bff4a3 100644
--- a/net/hsr/hsr_forward.h
+++ b/net/hsr/hsr_forward.h
@@ -36,6 +36,11 @@ void hsr_forward_skb(struct sk_buff *skb, struct hsr_port *port);
 void hsr_forward_sup_skb(struct sk_buff *skb, struct hsr_port *port);
 void hsr_forward_frame(struct sk_buff *skb, struct hsr_port *port,
 		       enum hsr_exec_source source);
+unsigned int hsr_forward_input(struct sk_buff *skb, struct hsr_port *port,
+			       enum hsr_job_class class,
+			       enum hsr_exec_source source);
+void hsr_fwd_drop_stat(struct net_device *dev, enum hsr_port_type type,
+		       enum hsr_job_class class);
 void hsr_assign_sup_seq(struct sk_buff *skb, struct hsr_priv *hsr,
 			enum hsr_exec_source source);
 
diff --git a/net/hsr/hsr_forward_queue.c b/net/hsr/hsr_forward_queue.c
index 5e96c24dec00..c97cc722eaca 100644
--- a/net/hsr/hsr_forward_queue.c
+++ b/net/hsr/hsr_forward_queue.c
@@ -28,18 +28,7 @@ struct hsr_job {
 	unsigned int		charge;	/* immutable skb->truesize */
 };
 
-/* Queue-stage drop: one count per dropped original input on the held
- * entry device.  Ordinary interlink RX is an RX drop; master TX and
- * internally generated supervision frames are TX drops.
- */
-static void hsr_fwd_drop_stat(struct net_device *dev, enum hsr_port_type type,
-			      enum hsr_job_class class)
-{
-	if (class == HSR_JOB_NORMAL && type == HSR_PT_INTERLINK)
-		dev_core_stats_rx_dropped_inc(dev);
-	else
-		dev_core_stats_tx_dropped_inc(dev);
-}
+/* Queue-stage drops share the mapping in hsr_forward.c. */
 
 static void hsr_job_drop(struct hsr_job *job)
 {
@@ -113,6 +102,7 @@ static unsigned int hsr_job_process(struct hsr_priv *hsr, struct hsr_job *job,
 {
 	struct hsr_port *port;
 	unsigned int raised = 0;
+	unsigned int cost;
 
 	rcu_read_lock();
 	port = hsr_job_port(hsr, job);
@@ -129,7 +119,7 @@ static unsigned int hsr_job_process(struct hsr_priv *hsr, struct hsr_job *job,
 
 	if (job->class == HSR_JOB_INTERNAL_SUP)
 		hsr_assign_sup_seq(job->skb, hsr, source);
-	hsr_forward_frame(job->skb, port, source);
+	cost = hsr_forward_input(job->skb, port, job->class, source);
 
 	while (raised) {
 		dev_xmit_recursion_dec();
@@ -140,10 +130,8 @@ static unsigned int hsr_job_process(struct hsr_priv *hsr, struct hsr_job *job,
 	dev_put(job->dev);
 	kfree(job);
 
-	/* One input is one budget unit; GSO per-frame accounting is
-	 * added by the segmentation change.
-	 */
-	return 1;
+	/* Actual per-frame units consumed; a failed aggregate costs 1. */
+	return cost;
 }
 
 static void hsr_queue_owned_release(struct hsr_priv *hsr)
-- 
2.43.0