[Intel-wired-lan] [PATCH iwl-net] ice: enable NETIF_F_HW_CSUM for GSO packets

[Intel-wired-lan] [PATCH iwl-net] ice: enable NETIF_F_HW_CSUM for GSO packets

[Jakub Ramaseuski]

IPv4 over IPv6 GRE currently fails on E810 with skb_warn_bad_offload,
while IPv6 over IPv6 GRE falls back to software segmentation.
This happens because the kernel's GSO engine requires the generic HW_CSUM
flag to trust the hardware with complex encapsulation offloads.

Add NETIF_F_HW_CSUM to the device's csumo_features to satisfy the network
stack and unlock full hardware segmentation for GRE tunnels.
To prevent checksum corruption on standard traffic, evaluate the packet
in ice_features_check() and dynamically clear the NETIF_F_HW_CSUM bit
if it is not a GSO frame. This forces the driver to fall back to safe,
protocol-specific checksum features for non-GSO packets
while preserving the generic offload for tunnels.

Signed-off-by: Jakub Ramaseuski <jramaseu@redhat.com>
---
 drivers/net/ethernet/intel/ice/ice_main.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index e7308e381e2f..9b4ad03e1a32 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -3565,6 +3565,7 @@ void ice_set_netdev_features(struct net_device *netdev)
 
 	csumo_features = NETIF_F_RXCSUM	  |
 			 NETIF_F_IP_CSUM  |
+			 NETIF_F_HW_CSUM  |
 			 NETIF_F_SCTP_CRC |
 			 NETIF_F_IPV6_CSUM;
 
@@ -9789,6 +9790,14 @@ ice_features_check(struct sk_buff *skb,
 	if (skb->ip_summed != CHECKSUM_PARTIAL)
 		return features;
 
+	/* Hardware requires strictly-typed Tx descriptors for non-GSO frames.
+	 * Leaving generic NETIF_F_HW_CSUM enabled corrupts checksums,
+	 * causing TCP drops. We strip it here to force safe,
+	 * protocol-specific IPv4/IPv6 offloads instead.
+	 */
+	if (!gso)
+		features &= ~NETIF_F_HW_CSUM;
+
 	/* We cannot support GSO if the MSS is going to be less than
 	 * 64 bytes. If it is then we need to drop support for GSO.
 	 */
-- 
2.52.0

Re: [Intel-wired-lan] [PATCH iwl-net] ice: enable NETIF_F_HW_CSUM for GSO packets

[Paul Menzel]

Dear Jakub,


Thank you for your patch.

Am 10.03.26 um 12:55 schrieb Jakub Ramaseuski:
> IPv4 over IPv6 GRE currently fails on E810 with skb_warn_bad_offload,
> while IPv6 over IPv6 GRE falls back to software segmentation.
> This happens because the kernel's GSO engine requires the generic HW_CSUM
> flag to trust the hardware with complex encapsulation offloads.
> 
> Add NETIF_F_HW_CSUM to the device's csumo_features to satisfy the network
> stack and unlock full hardware segmentation for GRE tunnels.
> To prevent checksum corruption on standard traffic, evaluate the packet
> in ice_features_check() and dynamically clear the NETIF_F_HW_CSUM bit
> if it is not a GSO frame. This forces the driver to fall back to safe,
> protocol-specific checksum features for non-GSO packets
> while preserving the generic offload for tunnels.

Do you have a test case, you could document in the commit message?

> Signed-off-by: Jakub Ramaseuski <jramaseu@redhat.com>
> ---
>   drivers/net/ethernet/intel/ice/ice_main.c | 9 +++++++++
>   1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
> index e7308e381e2f..9b4ad03e1a32 100644
> --- a/drivers/net/ethernet/intel/ice/ice_main.c
> +++ b/drivers/net/ethernet/intel/ice/ice_main.c
> @@ -3565,6 +3565,7 @@ void ice_set_netdev_features(struct net_device *netdev)
>   
>   	csumo_features = NETIF_F_RXCSUM	  |
>   			 NETIF_F_IP_CSUM  |
> +			 NETIF_F_HW_CSUM  |

Should this be sorted?

>   			 NETIF_F_SCTP_CRC |
>   			 NETIF_F_IPV6_CSUM;
>   
> @@ -9789,6 +9790,14 @@ ice_features_check(struct sk_buff *skb,
>   	if (skb->ip_summed != CHECKSUM_PARTIAL)
>   		return features;
>   
> +	/* Hardware requires strictly-typed Tx descriptors for non-GSO frames.
> +	 * Leaving generic NETIF_F_HW_CSUM enabled corrupts checksums,
> +	 * causing TCP drops. We strip it here to force safe,
> +	 * protocol-specific IPv4/IPv6 offloads instead.
> +	 */
> +	if (!gso)
> +		features &= ~NETIF_F_HW_CSUM;
> +
>   	/* We cannot support GSO if the MSS is going to be less than
>   	 * 64 bytes. If it is then we need to drop support for GSO.
>   	 */

The diff looks good.

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul

RE: [Intel-wired-lan] [PATCH iwl-net] ice: enable NETIF_F_HW_CSUM for GSO packets

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Jakub Ramaseuski
> Sent: Tuesday, March 10, 2026 12:56 PM
> To: intel-wired-lan@lists.osuosl.org
> Cc: netdev@vger.kernel.org; Nguyen, Anthony L
> <anthony.l.nguyen@intel.com>; Kitszel, Przemyslaw
> <przemyslaw.kitszel@intel.com>; Korba, Przemyslaw
> <przemyslaw.korba@intel.com>; Jakub Ramaseuski <jramaseu@redhat.com>
> Subject: [Intel-wired-lan] [PATCH iwl-net] ice: enable NETIF_F_HW_CSUM
> for GSO packets
> 
> IPv4 over IPv6 GRE currently fails on E810 with skb_warn_bad_offload,
> while IPv6 over IPv6 GRE falls back to software segmentation.
> This happens because the kernel's GSO engine requires the generic
> HW_CSUM flag to trust the hardware with complex encapsulation
> offloads.
> 
> Add NETIF_F_HW_CSUM to the device's csumo_features to satisfy the
> network stack and unlock full hardware segmentation for GRE tunnels.
> To prevent checksum corruption on standard traffic, evaluate the
> packet in ice_features_check() and dynamically clear the
> NETIF_F_HW_CSUM bit if it is not a GSO frame. This forces the driver
> to fall back to safe, protocol-specific checksum features for non-GSO
> packets while preserving the generic offload for tunnels.
> 
Please update commit message with exact commands for reproduction if possible.

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

> Signed-off-by: Jakub Ramaseuski <jramaseu@redhat.com>
> ---
>  drivers/net/ethernet/intel/ice/ice_main.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_main.c
> b/drivers/net/ethernet/intel/ice/ice_main.c
> index e7308e381e2f..9b4ad03e1a32 100644
> --- a/drivers/net/ethernet/intel/ice/ice_main.c
> +++ b/drivers/net/ethernet/intel/ice/ice_main.c
> @@ -3565,6 +3565,7 @@ void ice_set_netdev_features(struct net_device
> *netdev)
> 
>  	csumo_features = NETIF_F_RXCSUM	  |
>  			 NETIF_F_IP_CSUM  |
> +			 NETIF_F_HW_CSUM  |
>  			 NETIF_F_SCTP_CRC |
>  			 NETIF_F_IPV6_CSUM;
> 
> @@ -9789,6 +9790,14 @@ ice_features_check(struct sk_buff *skb,
>  	if (skb->ip_summed != CHECKSUM_PARTIAL)
>  		return features;
> 
> +	/* Hardware requires strictly-typed Tx descriptors for non-GSO
> frames.
> +	 * Leaving generic NETIF_F_HW_CSUM enabled corrupts checksums,
> +	 * causing TCP drops. We strip it here to force safe,
> +	 * protocol-specific IPv4/IPv6 offloads instead.
> +	 */
> +	if (!gso)
> +		features &= ~NETIF_F_HW_CSUM;
> +
>  	/* We cannot support GSO if the MSS is going to be less than
>  	 * 64 bytes. If it is then we need to drop support for GSO.
>  	 */
> --
> 2.52.0

Re: [Intel-wired-lan] [PATCH iwl-net] ice: enable NETIF_F_HW_CSUM for GSO packets

[Jakub Ramaseuski]

Dear Aleksandr,

> Please update commit message with exact commands for reproduction if possible.
that is sure to be done in v2, for now try

for the side acting as iperf3 server:
```
#!/bin/bash
# tunnel creation
# IPv4 addr         192.168.42.11/24
# IPv6 addr         2011::11/64
# IPv4oIP6GRE addr  192.168.44.11/24
# IPv6oIP6GRE addr  2023::11/64

ip l a gre1 type ip6gre remote 2011::12 local 2011::11 dev enp65s0f0np0
ip l s ip6tnl0 up
ip l s ip6gre0 up
ip l s gre1 up


# gre tunnel addresses
ip a a 2001:db8:1::1/64 dev gre1
ip a a 2023::11/64 dev gre1
ip a a 192.168.44.11/24 dev gre1

# device addresses
ip a a 2011::11/64 dev enp65s0f0np0
ip a a 192.168.42.11/24 dev enp65s0f0np0

iperf3 -s
```

for the side acting as iperf3 client:
```
#!/bin/bash
# tunnel creation
# IPv4 addr         192.168.42.12/24
# IPv6 addr         2011::12/64
# IPv4oIP6GRE addr  192.168.44.12/24
# IPv6oIP6GRE addr  2023::12/64

ip l a gre1 type ip6gre remote 2011::11 local 2011::12 dev enp65s0f0np0
ip l s ip6tnl0 up
ip l s ip6gre0 up
ip l s gre1 up

# gre tunnel addresses
ip a a 2001:db8:1::2/64 dev gre1
ip a a 2023::12/64 dev gre1
ip a a 192.168.44.12/24 dev gre1

# device addresses
ip a a 2011::12/64 dev enp65s0f0np0
ip a a 192.168.42.12/24 dev enp65s0f0np0

# tests with single stream
# test gre throughput
iperf3 -c 192.168.44.11 -t 20 -P 1
iperf3 -c 2023::11 -t 20 -P 1
# test normal throughput
iperf3 -c 192.168.42.11 -t 20 -P 1
iperf3 -c 2011::11 -t 20 -P 1
```
I hope this is expected answer.

Best regards,
Jakub Ramaseuski

Re: [Intel-wired-lan] [PATCH iwl-net] ice: enable NETIF_F_HW_CSUM for GSO packets

[Jakub Kicinski]

On Tue, 10 Mar 2026 12:55:56 +0100 Jakub Ramaseuski wrote:
> IPv4 over IPv6 GRE currently fails on E810 with skb_warn_bad_offload,
> while IPv6 over IPv6 GRE falls back to software segmentation.
> This happens because the kernel's GSO engine requires the generic HW_CSUM
> flag to trust the hardware with complex encapsulation offloads.
> 
> Add NETIF_F_HW_CSUM to the device's csumo_features to satisfy the network
> stack and unlock full hardware segmentation for GRE tunnels.
> To prevent checksum corruption on standard traffic, evaluate the packet
> in ice_features_check() and dynamically clear the NETIF_F_HW_CSUM bit
> if it is not a GSO frame. This forces the driver to fall back to safe,
> protocol-specific checksum features for non-GSO packets
> while preserving the generic offload for tunnels.

If you're CCing netdev on iwl submissions you have to follow the 24h
min reposting period.
-- 
pv-bot: 24h