[PATCH v4 net-next 1/1] tcp: allow congestion controls to override TSO autosizing

[PATCH v4 net-next 1/1] tcp: allow congestion controls to override TSO autosizing

[chia-yu.chang]

From: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>

Today, congestion control algorithms influence TSO sizing through the
min_tso_segs() callback, which provides the minimum number of segments
used by tcp_tso_autosize(). However, Prague congestion control requires
finer control and needs to determine the final TSO segment count
directly rather than only providing a minimum bound.
 
This patch introduces TCP_CONG_EXACT_TSO_SEGS flag and extends
tcp_congestion_ops with an alternative tso_segs() callback. When the
flag is set, the congestion control algorithm supplies the final TSO
segment count directly and bypasses tcp_tso_autosize(). Otherwise, the
existing min_tso_segs() callback continues to provide the minimum
segment count used by tcp_tso_autosize().

This preserves the existing behavior of current congestion control
algorithms without introducing additional callbacks while enabling
future algorithms to implement custom TSO sizing policies.

Signed-off-by: Ilpo Järvinen <ij@kernel.org>
Signed-off-by: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>
---
 include/net/tcp.h     | 16 +++++++++++++---
 net/ipv4/tcp_output.c | 17 +++++++++++++----
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 2c5b889530b5..82cd82a19ff9 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1283,9 +1283,11 @@ enum tcp_ca_ack_event_flags {
 #define TCP_CONG_ECT_1_NEGOTIATION	BIT(3)
 /* Cannot fallback to RFC3168 during AccECN negotiation */
 #define TCP_CONG_NO_FALLBACK_RFC3168	BIT(4)
+/* Congestion cotnrol provides the exact TSO segment numbers  */
+#define TCP_CONG_EXACT_TSO_SEGS		BIT(5)
 #define TCP_CONG_MASK  (TCP_CONG_NON_RESTRICTED | TCP_CONG_NEEDS_ECN | \
 			TCP_CONG_NEEDS_ACCECN | TCP_CONG_ECT_1_NEGOTIATION | \
-			TCP_CONG_NO_FALLBACK_RFC3168)
+			TCP_CONG_NO_FALLBACK_RFC3168 | TCP_CONG_EXACT_TSO_SEGS)
 
 union tcp_cc_info;
 
@@ -1361,8 +1363,16 @@ struct tcp_congestion_ops {
 	/* hook for packet ack accounting (optional) */
 	void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample);
 
-	/* override sysctl_tcp_min_tso_segs (optional) */
-	u32 (*min_tso_segs)(struct sock *sk);
+	union {
+		/* Used when TCP_CONG_EXACT_TSO_SEGS is not set,
+		 * override sysctl_tcp_min_tso_segs (optional)
+		 */
+		u32 (*min_tso_segs)(struct sock *sk);
+		/* Used when TCP_CONG_EXACT_TSO_SEGS is set,
+		 * override tcp_tso_autosize (optional)
+		 */
+		u32 (*tso_segs)(struct sock *sk, u32 mss_now);
+	};
 
 	/* new value of cwnd after loss (required) */
 	u32  (*undo_cwnd)(struct sock *sk);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index d7c1444b5e30..0de27a87c39e 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2278,11 +2278,20 @@ static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now)
 	const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
 	u32 min_tso, tso_segs;
 
-	min_tso = ca_ops->min_tso_segs ?
-			ca_ops->min_tso_segs(sk) :
-			READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
+	min_tso = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
+
+	if (ca_ops->flags & TCP_CONG_EXACT_TSO_SEGS) {
+		if (WARN_ON_ONCE(!ca_ops->tso_segs))
+			tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
+		else
+			tso_segs = ca_ops->tso_segs(sk, mss_now);
+	} else {
+		if (ca_ops->min_tso_segs)
+			min_tso = ca_ops->min_tso_segs(sk);
+
+		tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
+	}
 
-	tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
 	return min_t(u32, tso_segs, sk->sk_gso_max_segs);
 }
 
-- 
2.34.1

RE: [PATCH v4 net-next 1/1] tcp: allow congestion controls to override TSO autosizing

[Chia-Yu Chang (Nokia)]

> -----Original Message-----
> From: Chia-Yu Chang (Nokia) <chia-yu.chang@nokia-bell-labs.com> 
> Sent: Sunday, July 26, 2026 9:38 PM
> To: horms@kernel.org; dsahern@kernel.org; bpf@vger.kernel.org; netdev@vger.kernel.org; pabeni@redhat.com; jhs@mojatatu.com; kuba@kernel.org; stephen@networkplumber.org; davem@davemloft.net; edumazet@google.com; andrew+netdev@lunn.ch; donald.hunter@gmail.com; kuniyu@google.com; ij@kernel.org; ncardwell@google.com; Koen De Schepper (Nokia) <koen.de_schepper@nokia-bell-labs.com>; g.white@cablelabs.com; ingemar.s.johansson@ericsson.com; mirja.kuehlewind@ericsson.com; cheshire@apple.com; rs.ietf@gmx.at; Jason_Livingood@comcast.com; vidhi_goel@apple.com
> Cc: Chia-Yu Chang (Nokia) <chia-yu.chang@nokia-bell-labs.com>
> Subject: [PATCH v4 net-next 1/1] tcp: allow congestion controls to override TSO autosizing
> 
> From: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>
> 
> Today, congestion control algorithms influence TSO sizing through the
> min_tso_segs() callback, which provides the minimum number of segments used by tcp_tso_autosize(). However, Prague congestion control requires finer control and needs to determine the final TSO segment count directly rather than only providing a minimum bound.
>  
> This patch introduces TCP_CONG_EXACT_TSO_SEGS flag and extends tcp_congestion_ops with an alternative tso_segs() callback. When the flag is set, the congestion control algorithm supplies the final TSO segment count directly and bypasses tcp_tso_autosize(). Otherwise, the existing min_tso_segs() callback continues to provide the minimum segment count used by tcp_tso_autosize().
> 
> This preserves the existing behavior of current congestion control algorithms without introducing additional callbacks while enabling future algorithms to implement custom TSO sizing policies.
> 
> Signed-off-by: Ilpo Järvinen <ij@kernel.org>
> Signed-off-by: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>
> ---
>  include/net/tcp.h     | 16 +++++++++++++---
>  net/ipv4/tcp_output.c | 17 +++++++++++++----
>  2 files changed, 26 insertions(+), 7 deletions(-)
> 
> diff --git a/include/net/tcp.h b/include/net/tcp.h index 2c5b889530b5..82cd82a19ff9 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
> @@ -1283,9 +1283,11 @@ enum tcp_ca_ack_event_flags {
>  #define TCP_CONG_ECT_1_NEGOTIATION	BIT(3)
>  /* Cannot fallback to RFC3168 during AccECN negotiation */
>  #define TCP_CONG_NO_FALLBACK_RFC3168	BIT(4)
> +/* Congestion cotnrol provides the exact TSO segment numbers  */
> +#define TCP_CONG_EXACT_TSO_SEGS		BIT(5)
>  #define TCP_CONG_MASK  (TCP_CONG_NON_RESTRICTED | TCP_CONG_NEEDS_ECN | \
>  			TCP_CONG_NEEDS_ACCECN | TCP_CONG_ECT_1_NEGOTIATION | \
> -			TCP_CONG_NO_FALLBACK_RFC3168)
> +			TCP_CONG_NO_FALLBACK_RFC3168 | TCP_CONG_EXACT_TSO_SEGS)
>  
>  union tcp_cc_info;
>  
> @@ -1361,8 +1363,16 @@ struct tcp_congestion_ops {
>  	/* hook for packet ack accounting (optional) */
>  	void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample);
>  
> -	/* override sysctl_tcp_min_tso_segs (optional) */
> -	u32 (*min_tso_segs)(struct sock *sk);
> +	union {
> +		/* Used when TCP_CONG_EXACT_TSO_SEGS is not set,
> +		 * override sysctl_tcp_min_tso_segs (optional)
> +		 */
> +		u32 (*min_tso_segs)(struct sock *sk);
> +		/* Used when TCP_CONG_EXACT_TSO_SEGS is set,
> +		 * override tcp_tso_autosize (optional)
> +		 */
> +		u32 (*tso_segs)(struct sock *sk, u32 mss_now);
> +	};
>  
>  	/* new value of cwnd after loss (required) */
>  	u32  (*undo_cwnd)(struct sock *sk);
> diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index d7c1444b5e30..0de27a87c39e 100644
> --- a/net/ipv4/tcp_output.c
> +++ b/net/ipv4/tcp_output.c
> @@ -2278,11 +2278,20 @@ static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now)
>  	const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
>  	u32 min_tso, tso_segs;
>  
> -	min_tso = ca_ops->min_tso_segs ?
> -			ca_ops->min_tso_segs(sk) :
> -			READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
> +	min_tso = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
> +
> +	if (ca_ops->flags & TCP_CONG_EXACT_TSO_SEGS) {
> +		if (WARN_ON_ONCE(!ca_ops->tso_segs))
> +			tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
> +		else
> +			tso_segs = ca_ops->tso_segs(sk, mss_now);
> +	} else {
> +		if (ca_ops->min_tso_segs)
> +			min_tso = ca_ops->min_tso_segs(sk);
> +
> +		tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
> +	}
>  
> -	tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
>  	return min_t(u32, tso_segs, sk->sk_gso_max_segs);  }

Hello,

I see this commit is marked as Changes Requested; however, I do not see any request yet.

Could anyone let me know which specific request it is?

This commit updated our previously submitted v3 https://lore.kernel.org/all/20260630120145.286497-1-chia-yu.chang@nokia-bell-labs.com/ to have no impact on BPF.

Thanks!
Chia-Yu

Re: [PATCH v4 net-next 1/1] tcp: allow congestion controls to override TSO autosizing

[Jakub Kicinski]

On Mon, 27 Jul 2026 08:02:00 +0000 Chia-Yu Chang (Nokia) wrote:
> I see this commit is marked as Changes Requested; however, I do not see any request yet.
> 
> Could anyone let me know which specific request it is?
> 
> This commit updated our previously submitted v3 https://lore.kernel.org/all/20260630120145.286497-1-chia-yu.chang@nokia-bell-labs.com/ to have no impact on BPF.

The BPF CI has failed with your patch applied, that's why it was
auto-ejected. You need to fix up the BPF selftests to use the new
callback.

Re: [PATCH v4 net-next 1/1] tcp: allow congestion controls to override TSO autosizing

[Emil Tsalapatis]

On Mon Jul 27, 2026 at 4:02 AM EDT, Chia-Yu Chang (Nokia) wrote:
>> -----Original Message-----
>> From: Chia-Yu Chang (Nokia) <chia-yu.chang@nokia-bell-labs.com> 
>> Sent: Sunday, July 26, 2026 9:38 PM
>> To: horms@kernel.org; dsahern@kernel.org; bpf@vger.kernel.org; netdev@vger.kernel.org; pabeni@redhat.com; jhs@mojatatu.com; kuba@kernel.org; stephen@networkplumber.org; davem@davemloft.net; edumazet@google.com; andrew+netdev@lunn.ch; donald.hunter@gmail.com; kuniyu@google.com; ij@kernel.org; ncardwell@google.com; Koen De Schepper (Nokia) <koen.de_schepper@nokia-bell-labs.com>; g.white@cablelabs.com; ingemar.s.johansson@ericsson.com; mirja.kuehlewind@ericsson.com; cheshire@apple.com; rs.ietf@gmx.at; Jason_Livingood@comcast.com; vidhi_goel@apple.com
>> Cc: Chia-Yu Chang (Nokia) <chia-yu.chang@nokia-bell-labs.com>
>> Subject: [PATCH v4 net-next 1/1] tcp: allow congestion controls to override TSO autosizing
>> 
>> From: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>
>> 

Hi Chia-Yu,

Sorry for the late reply. From the BPF side we had a discussion and
concluded that going ahead with the original change to the struct_ops
without adding a union is fine. AFAIU this is the main delta between v3
and v4, in which case we can go ahead with v3.

>> Today, congestion control algorithms influence TSO sizing through the
>> min_tso_segs() callback, which provides the minimum number of segments used by tcp_tso_autosize(). However, Prague congestion control requires finer control and needs to determine the final TSO segment count directly rather than only providing a minimum bound.
>>  
>> This patch introduces TCP_CONG_EXACT_TSO_SEGS flag and extends tcp_congestion_ops with an alternative tso_segs() callback. When the flag is set, the congestion control algorithm supplies the final TSO segment count directly and bypasses tcp_tso_autosize(). Otherwise, the existing min_tso_segs() callback continues to provide the minimum segment count used by tcp_tso_autosize().
>> 
>> This preserves the existing behavior of current congestion control algorithms without introducing additional callbacks while enabling future algorithms to implement custom TSO sizing policies.
>> 
>> Signed-off-by: Ilpo Järvinen <ij@kernel.org>
>> Signed-off-by: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>
>> ---
>>  include/net/tcp.h     | 16 +++++++++++++---
>>  net/ipv4/tcp_output.c | 17 +++++++++++++----
>>  2 files changed, 26 insertions(+), 7 deletions(-)
>> 
>> diff --git a/include/net/tcp.h b/include/net/tcp.h index 2c5b889530b5..82cd82a19ff9 100644
>> --- a/include/net/tcp.h
>> +++ b/include/net/tcp.h
>> @@ -1283,9 +1283,11 @@ enum tcp_ca_ack_event_flags {
>>  #define TCP_CONG_ECT_1_NEGOTIATION	BIT(3)
>>  /* Cannot fallback to RFC3168 during AccECN negotiation */
>>  #define TCP_CONG_NO_FALLBACK_RFC3168	BIT(4)
>> +/* Congestion cotnrol provides the exact TSO segment numbers  */
>> +#define TCP_CONG_EXACT_TSO_SEGS		BIT(5)
>>  #define TCP_CONG_MASK  (TCP_CONG_NON_RESTRICTED | TCP_CONG_NEEDS_ECN | \
>>  			TCP_CONG_NEEDS_ACCECN | TCP_CONG_ECT_1_NEGOTIATION | \
>> -			TCP_CONG_NO_FALLBACK_RFC3168)
>> +			TCP_CONG_NO_FALLBACK_RFC3168 | TCP_CONG_EXACT_TSO_SEGS)
>>  
>>  union tcp_cc_info;
>>  
>> @@ -1361,8 +1363,16 @@ struct tcp_congestion_ops {
>>  	/* hook for packet ack accounting (optional) */
>>  	void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample);
>>  
>> -	/* override sysctl_tcp_min_tso_segs (optional) */
>> -	u32 (*min_tso_segs)(struct sock *sk);
>> +	union {
>> +		/* Used when TCP_CONG_EXACT_TSO_SEGS is not set,
>> +		 * override sysctl_tcp_min_tso_segs (optional)
>> +		 */
>> +		u32 (*min_tso_segs)(struct sock *sk);
>> +		/* Used when TCP_CONG_EXACT_TSO_SEGS is set,
>> +		 * override tcp_tso_autosize (optional)
>> +		 */
>> +		u32 (*tso_segs)(struct sock *sk, u32 mss_now);
>> +	};
>>  
>>  	/* new value of cwnd after loss (required) */
>>  	u32  (*undo_cwnd)(struct sock *sk);
>> diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index d7c1444b5e30..0de27a87c39e 100644
>> --- a/net/ipv4/tcp_output.c
>> +++ b/net/ipv4/tcp_output.c
>> @@ -2278,11 +2278,20 @@ static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now)
>>  	const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
>>  	u32 min_tso, tso_segs;
>>  
>> -	min_tso = ca_ops->min_tso_segs ?
>> -			ca_ops->min_tso_segs(sk) :
>> -			READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
>> +	min_tso = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
>> +
>> +	if (ca_ops->flags & TCP_CONG_EXACT_TSO_SEGS) {
>> +		if (WARN_ON_ONCE(!ca_ops->tso_segs))
>> +			tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
>> +		else
>> +			tso_segs = ca_ops->tso_segs(sk, mss_now);
>> +	} else {
>> +		if (ca_ops->min_tso_segs)
>> +			min_tso = ca_ops->min_tso_segs(sk);
>> +
>> +		tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
>> +	}
>>  
>> -	tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
>>  	return min_t(u32, tso_segs, sk->sk_gso_max_segs);  }
>
> Hello,
>
> I see this commit is marked as Changes Requested; however, I do not see any request yet.
>
> Could anyone let me know which specific request it is?
>
> This commit updated our previously submitted v3 https://lore.kernel.org/all/20260630120145.286497-1-chia-yu.chang@nokia-bell-labs.com/ to have no impact on BPF.

>
> Thanks!
> Chia-Yu

Re: [PATCH v4 net-next 1/1] tcp: allow congestion controls to override TSO autosizing

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] Moving `min_tso_segs` into an anonymous union breaks the registration and map updates of BPF TCP congestion controls, rendering the BPF CA subsystem unusable.
- [High] Aliasing function pointers with different signatures inside a union creates severe Control Flow Integrity (CFI) hazards and breaks BPF stub generation.
- [High] Returning 0 from `ca_ops->tso_segs()` causes a permanent stall in the TCP write queue.
--

--- Patch [1]: [PATCH v4 net-next 1/1] tcp: allow congestion controls to override TSO autosizing ---
commit 986d64ed9a398f1ef7247d7b653292cb0b6d25f3
Author: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>

tcp: allow congestion controls to override TSO autosizing

This patch introduces the TCP_CONG_EXACT_TSO_SEGS flag and adds an alternative
tso_segs() callback to tcp_congestion_ops. It allows congestion control
algorithms to provide an exact TSO segment count instead of just a minimum.
This is implemented by placing the new callback in a union with the existing
min_tso_segs() callback.

Link: None

> diff --git a/include/net/tcp.h b/include/net/tcp.h
> index 2c5b889530b55..82cd82a19ff91 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
[ ... ]
> @@ -1361,8 +1363,16 @@ struct tcp_congestion_ops {
>  	/* hook for packet ack accounting (optional) */
>  	void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample);
>  
> -	/* override sysctl_tcp_min_tso_segs (optional) */
> -	u32 (*min_tso_segs)(struct sock *sk);
> +	union {
> +		/* Used when TCP_CONG_EXACT_TSO_SEGS is not set,
> +		 * override sysctl_tcp_min_tso_segs (optional)
> +		 */
> +		u32 (*min_tso_segs)(struct sock *sk);
> +		/* Used when TCP_CONG_EXACT_TSO_SEGS is set,
> +		 * override tcp_tso_autosize (optional)
> +		 */
> +		u32 (*tso_segs)(struct sock *sk, u32 mss_now);
> +	};

[Severity: High]
Does this anonymous union prevent the BPF TCP congestion control subsystem from
initializing?

Looking at bpf_struct_ops_desc_init() in kernel/bpf/bpf_struct_ops.c, the BPF
framework iterates over the members of the struct. If it encounters an
anonymous member, it explicitly rejects it with an "anon member in struct is
not supported" warning and aborts the registration:

kernel/bpf/bpf_struct_ops.c:bpf_struct_ops_desc_init() {
    ...
    if (!*mname) {
        pr_warn("anon member in struct %s is not supported\n",
            st_ops->name);
        err = -EOPNOTSUPP;
        goto errout;
    }
    ...
}

[Severity: High]
Can aliasing function pointers with different signatures inside a union create
Control Flow Integrity (CFI) hazards?

The union aliases min_tso_segs (1 argument) and tso_segs (2 arguments). If a
congestion control module misconfigures the TCP_CONG_EXACT_TSO_SEGS flag, the
kernel might execute an indirect call using a signature that does not match the
target function's compiled kCFI hash. Would this trigger a kernel panic?

Additionally, does this break BPF stub generation since the static stub
structure __bpf_ops_tcp_congestion_ops can only populate a single pointer for
this memory offset?

> diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
> index d7c1444b5e304..0de27a87c39e7 100644
> --- a/net/ipv4/tcp_output.c
> +++ b/net/ipv4/tcp_output.c
[ ... ]
> @@ -2278,11 +2278,20 @@ static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now)
>  	const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
>  	u32 min_tso, tso_segs;
>  
> -	min_tso = ca_ops->min_tso_segs ?
> -			ca_ops->min_tso_segs(sk) :
> -			READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
> +	min_tso = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
> +
> +	if (ca_ops->flags & TCP_CONG_EXACT_TSO_SEGS) {
> +		if (WARN_ON_ONCE(!ca_ops->tso_segs))
> +			tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
> +		else
> +			tso_segs = ca_ops->tso_segs(sk, mss_now);
> +	} else {
> +		if (ca_ops->min_tso_segs)
> +			min_tso = ca_ops->min_tso_segs(sk);
> +
> +		tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
> +	}
>  
> -	tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
>  	return min_t(u32, tso_segs, sk->sk_gso_max_segs);
>  }

[Severity: High]
Does this code allow ca_ops->tso_segs() to return 0 and stall the socket?

While tcp_tso_autosize() is guaranteed to return at least 1 (because
sysctl_tcp_min_tso_segs is strictly clamped to >= 1), the new callback has no
minimum bounds check.

If ca_ops->tso_segs() returns 0, tcp_tso_segs() returns 0. When processed in
tcp_write_xmit(), this forces max_segs = 0, bounding cwnd_quota to 0:

net/ipv4/tcp_output.c:tcp_write_xmit() {
    ...
    cwnd_quota = min(cwnd_quota, max_segs);
    ...
}

This causes tcp_mss_split_point() to receive max_segs = 0 and return a limit of
0. Then tso_fragment() shrinks the original head SKB to 0 bytes:

net/ipv4/tcp_output.c:tcp_write_xmit() {
    ...
    if (skb->len > limit &&
        unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
        break;
    ...
}

This 0-length SKB appears to permanently trigger the break condition, skipping
dequeue and stalling the write queue on all subsequent calls:

net/ipv4/tcp_output.c:tcp_write_xmit() {
    ...
    if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq)
        break;
    ...
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260726193802.397321-1-chia-yu.chang@nokia-bell-labs.com?part=1