net_tap: include the L4 length in the LSO checksum seed

A segmentation-offload frame carries a partial TCP/UDP checksum in the
checksum field. The netvsp LSO path supplies a length-less pseudo-header
there, because the guest cannot know the per-segment length. The kernel
GSO path expects the opposite: th->check is the pseudo-header over the
full L4 length, as __tcp_v4_send_check writes for a GSO skb, which
tcp_gso_segment and the hardware TSO drivers adjust down per segment.

Passing the length-less seed straight through leaves the per-segment
adjustment short by the segment length, so every emitted segment carries
a wrong checksum and an off-host receiver drops it. A guest TCP stream
over TSO to an off-host peer collapses to a few Mbit/s of retransmits.
Checksum offload without segmentation and same-host traffic are
unaffected, since their seed already includes the length.

Recompute the seed for segmentation frames from the packet's own IP
header. The payload is untouched; the kernel or NIC still completes the
per-segment checksum.

Author: bitranox

vm/devices/net/net_tap/src/lib.rs

@@ -337,6 +337,13 @@ impl Queue for TapQueue {
                     fixup_ipv6_payload_length(&mut packet, meta.l2_len as usize);
                 }
 
+                // Convert the LSO length-less pseudo-header seed to the convention the
+                // kernel's GSO path expects (pseudo-header with the full L4 length) so
+                // segmentation produces correct per-segment checksums.
+                if meta.flags.offload_tcp_segmentation() || meta.flags.offload_udp_segmentation() {
+                    fixup_gso_pseudo_header(&mut packet, meta.l2_len as usize);
+                }
+
                 let bufs = [
                     std::io::IoSlice::new(hdr_bytes),
                     std::io::IoSlice::new(&packet),
@@ -456,6 +463,71 @@ fn fixup_ipv6_payload_length(packet: &mut [u8], l2_len: usize) {
     packet[l2_len + 4..l2_len + 6].copy_from_slice(&payload_len.to_be_bytes());
 }
 
+/// Rewrite the L4 checksum field of a segmentation-offload (GSO) frame to the
+/// pseudo-header checksum that includes the full L4 segment length.
+///
+/// NDIS/netvsp LSO hands us a length-less pseudo-header seed: the guest cannot know
+/// the per-segment length, so it leaves it out. The kernel's GSO path expects the
+/// opposite. The stack's own `__tcp_v4_send_check` writes `th->check =
+/// ~tcp_v4_check(skb->len, ...)`, the pseudo-header computed over the full skb L4
+/// length, and `tcp_gso_segment` (and the hardware TSO drivers) then adjust it down
+/// per segment. Passing the length-less seed straight through leaves that adjustment
+/// off by the segment length, so every emitted segment carries a wrong checksum and
+/// the far end drops it. Recompute the seed here from the packet's own IP header so
+/// it does not depend on the value the guest supplied; the data is untouched, the
+/// kernel or NIC still completes the per-segment checksum.
+fn fixup_gso_pseudo_header(packet: &mut [u8], l2_len: usize) {
+    if packet.len() < l2_len + 1 {
+        return;
+    }
+    let (l4_off, proto, mut sum) = match packet[l2_len] >> 4 {
+        4 => {
+            if packet.len() < l2_len + 20 {
+                return;
+            }
+            let ihl = ((packet[l2_len] & 0x0f) as usize) * 4;
+            if !(20..=60).contains(&ihl) || packet.len() < l2_len + ihl {
+                return;
+            }
+            let proto = packet[l2_len + 9];
+            let mut sum: u32 = 0;
+            for chunk in packet[l2_len + 12..l2_len + 20].chunks_exact(2) {
+                sum += u16::from_be_bytes([chunk[0], chunk[1]]) as u32;
+            }
+            (l2_len + ihl, proto, sum)
+        }
+        6 => {
+            const IPV6_HEADER_LEN: usize = 40;
+            if packet.len() < l2_len + IPV6_HEADER_LEN {
+                return;
+            }
+            let proto = packet[l2_len + 6];
+            let mut sum: u32 = 0;
+            for chunk in packet[l2_len + 8..l2_len + IPV6_HEADER_LEN].chunks_exact(2) {
+                sum += u16::from_be_bytes([chunk[0], chunk[1]]) as u32;
+            }
+            (l2_len + IPV6_HEADER_LEN, proto, sum)
+        }
+        _ => return,
+    };
+    let csum_field = match proto {
+        6 => l4_off + 16,
+        17 => l4_off + 6,
+        _ => return,
+    };
+    if packet.len() < csum_field + 2 {
+        return;
+    }
+    // Pseudo-header: src and dst addresses, protocol, and the L4 length (header plus
+    // payload). The folded, non-complemented sum is the CHECKSUM_PARTIAL seed.
+    let l4_len = packet.len() - l4_off;
+    sum += proto as u32 + l4_len as u32;
+    while sum >> 16 != 0 {
+        sum = (sum & 0xffff) + (sum >> 16);
+    }
+    packet[csum_field..csum_field + 2].copy_from_slice(&(sum as u16).to_be_bytes());
+}
+
 /// Build a `VirtioNetHdr` from transmit metadata for the TAP device.
 ///
 /// The virtio net header uses fully general `csum_start` / `csum_offset` fields
@@ -702,6 +774,25 @@ mod tests {
         assert_eq!(hdr.csum_offset, 6);
     }
 
+    #[test]
+    fn gso_pseudo_header_seed_includes_length() {
+        // 14 eth + 20 IPv4 (TCP) + 20 TCP + 100 payload; the seed must be rewritten to
+        // the pseudo-header that includes the full L4 length (header plus payload).
+        let mut pkt = vec![0u8; 14 + 20 + 20 + 100];
+        pkt[14] = 0x45; // IPv4, ihl = 5
+        pkt[14 + 9] = 6; // protocol = TCP
+        pkt[14 + 12..14 + 16].copy_from_slice(&[192, 168, 168, 156]); // src
+        pkt[14 + 16..14 + 20].copy_from_slice(&[192, 168, 168, 17]); // dst
+        fixup_gso_pseudo_header(&mut pkt, 14);
+        let seed = u16::from_be_bytes([pkt[50], pkt[51]]); // TCP checksum field
+        let l4_len: u32 = 20 + 100;
+        let mut want: u32 = 0xc0a8 + 0xa89c + 0xc0a8 + 0xa811 + 6 + l4_len;
+        while want >> 16 != 0 {
+            want = (want & 0xffff) + (want >> 16);
+        }
+        assert_eq!(seed, want as u16);
+    }
+
     #[test]
     fn ipv4_header_checksum_fixup() {
         // Ethernet (14) + IPv4 header (20) with zero checksum field.