[PATCH net-next v2 0/2] bareudp: Enable BIG TCP packets

[PATCH net-next v2 0/2] bareudp: Enable BIG TCP packets

[Haishuang Yan]

This series allows BIG TCP on bareudp, the same way as on vxlan and
geneve, and extends the big_tcp_tunnels.sh selftest to cover it.

Patch 1 bumps tso_max_size of bareudp devices to GSO_MAX_SIZE.

Patch 2 adds bareudp to big_tcp_tunnels.sh. bareudp only works in
external mode, so the test attaches the tunnel metadata with a tc
tunnel_key action on egress.

Patch 2 depends on "bareudp: set the inner protocol to the protocol of
the packet", posted to net:

https://lore.kernel.org/netdev/20261002153039.462663-1-yanhaishuang@cmss.chinamobile.com/

Until that fix reaches net-next, the bareudp cases of the selftest with
veth tx checksum offload disabled fail for IPv6 over IPv4 and for both
families over IPv6, because software GSO drops the packets. Everything
else passes without the fix.

v2:
- New patch 2, as Alice asked for selftest coverage.

v1: https://lore.kernel.org/netdev/20261001042336.224343-1-yanhaishuang@cmss.chinamobile.com/

Haishuang Yan (2):
  bareudp: Enable BIG TCP packets
  selftests: net: big_tcp_tunnels: Cover bareudp

 drivers/net/bareudp.c                         |  1 +
 .../testing/selftests/net/big_tcp_tunnels.sh  | 45 ++++++++++++++++---
 2 files changed, 39 insertions(+), 7 deletions(-)

-- 
2.43.0

[PATCH net-next v2 1/2] bareudp: Enable BIG TCP packets

[Haishuang Yan]

Commit f3d0f753f066 ("vxlan: Enable BIG TCP packets") and commit
03ebe91b0f61 ("geneve: Enable BIG TCP packets") allowed BIG TCP on vxlan
and geneve, after the preceding patches of that series made the common
UDP tunnel transmit path handle GSO packets larger than 64KB.

bareudp transmits through the same helpers, udp_tunnel_handle_offloads()
followed by udp_tunnel_xmit_skb() or udp_tunnel6_xmit_skb(), and does
not fill in any length field itself. Bump tso_max_size up to
GSO_MAX_SIZE so that the admin can use BIG TCP with bareudp too.

The default gso_max_size and gso_ipv4_max_size stay at 64KB, so nothing
changes unless they are raised explicitly.

iperf3 TCP over bareudp (ethertype ipv4, IPv4 outer) between two netns
connected by veth, MTU 1600 on veth, 3 runs of 20 seconds each. This
was measured in a QEMU TCG guest, so only the relative numbers are
meaningful:

  gso_max_size/gso_ipv4_max_size 65536:
    4380.6, 4404.2, 4354.5 Mbit/s, average 4379.8 Mbit/s

  gso_max_size/gso_ipv4_max_size 196608:
    5509.4, 5454.7, 5497.4 Mbit/s, average 5487.2 Mbit/s (+25%)

With 196608, about 90k to 100k packets larger than 64KB were
transmitted on the bareudp device per run, none with 65536. Without
this patch, setting gso_max_size to 196608 is rejected.

Assisted-by: LLM
Acked-by: Alice Mikityanska <alice.kernel@fastmail.im>
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
---
 drivers/net/bareudp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/bareudp.c b/drivers/net/bareudp.c
index c3b5ed52d877..fcc33e302b9c 100644
--- a/drivers/net/bareudp.c
+++ b/drivers/net/bareudp.c
@@ -589,6 +589,7 @@ static void bareudp_setup(struct net_device *dev)
 	dev->max_mtu = IP_MAX_MTU - BAREUDP_BASE_HLEN;
 	dev->type = ARPHRD_NONE;
 	netif_keep_dst(dev);
+	netif_set_tso_max_size(dev, GSO_MAX_SIZE);
 	dev->priv_flags |= IFF_NO_QUEUE;
 	dev->lltx = true;
 	dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
-- 
2.43.0

[PATCH net-next v2 2/2] selftests: net: big_tcp_tunnels: Cover bareudp

[Haishuang Yan]

Now that bareudp allows BIG TCP too, run the same checks over bareudp as
for vxlan and geneve.

bareudp only works in external mode, so attach the tunnel metadata to
all packets sent through the device with a tc tunnel_key action on
egress. The device uses ethertype ipv4 with multiproto, so that both
IPv4 and IPv6 traffic can go through it. Its MTU does not account for
the encapsulation, so lower it to leave room for the IPv6 and UDP
headers, otherwise the encapsulated packets would be fragmented.

Assisted-by: LLM
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
---
 .../testing/selftests/net/big_tcp_tunnels.sh  | 45 ++++++++++++++++---
 1 file changed, 38 insertions(+), 7 deletions(-)

diff --git a/tools/testing/selftests/net/big_tcp_tunnels.sh b/tools/testing/selftests/net/big_tcp_tunnels.sh
index cc0875e52fb9..cf38377f576b 100755
--- a/tools/testing/selftests/net/big_tcp_tunnels.sh
+++ b/tools/testing/selftests/net/big_tcp_tunnels.sh
@@ -53,6 +53,16 @@ setup() {
 	DEFAULT_TCP_MIN_TSO_SEGS=$(ip netns exec "$CLIENT_NS" sysctl -n net.ipv4.tcp_min_tso_segs)
 }
 
+# bareudp only works in external mode: attach the tunnel metadata to all
+# packets sent through the device. Its MTU does not account for the
+# encapsulation either, so leave room for IPv6 and UDP headers.
+setup_bareudp() {
+	ip -netns "$1" link set "$2" mtu 1452
+	tc -netns "$1" qdisc add dev "$2" clsact
+	tc -netns "$1" filter add dev "$2" egress matchall \
+		action tunnel_key set src_ip "$3" dst_ip "$4" id 0 ttl 64
+}
+
 setup_tunnel() {
 	if [ "$2" = 4 ]; then
 		SERVER_IP="$SERVER_IP4"
@@ -64,26 +74,42 @@ setup_tunnel() {
 		echo "Setting up ${1^^} over IPv6, veth tx csum offload $3"
 	fi
 
-	if [ "$1" = vxlan ]; then
+	case "$1" in
+	vxlan)
 		ip -netns "$CLIENT_NS" link add tun0 type vxlan \
 			id 5001 remote "$SERVER_IP" local "$CLIENT_IP" dev link0 dstport 4789
-	else
+		;;
+	geneve)
 		ip -netns "$CLIENT_NS" link add tun0 type geneve \
 			id 5001 remote "$SERVER_IP"
-	fi
+		;;
+	bareudp)
+		ip -netns "$CLIENT_NS" link add tun0 type bareudp \
+			dstport 6635 ethertype ipv4 multiproto
+		setup_bareudp "$CLIENT_NS" tun0 "$CLIENT_IP" "$SERVER_IP"
+		;;
+	esac
 	ip -netns "$CLIENT_NS" link set tun0 up
 	ip -netns "$CLIENT_NS" addr replace "$CLIENT_IP4_TUN/24" dev tun0
 	ip -netns "$CLIENT_NS" addr replace "$CLIENT_IP6_TUN/112" dev tun0 nodad
 	ip -netns "$CLIENT_NS" link set tun0 \
 		gso_max_size 196608 gso_ipv4_max_size 196608 \
 		gro_max_size 196608 gro_ipv4_max_size 196608
-	if [ "$1" = vxlan ]; then
+	case "$1" in
+	vxlan)
 		ip -netns "$SERVER_NS" link add tun1 type vxlan \
 			id 5001 remote "$CLIENT_IP" local "$SERVER_IP" dev link1 dstport 4789
-	else
+		;;
+	geneve)
 		ip -netns "$SERVER_NS" link add tun1 type geneve \
 			id 5001 remote "$CLIENT_IP"
-	fi
+		;;
+	bareudp)
+		ip -netns "$SERVER_NS" link add tun1 type bareudp \
+			dstport 6635 ethertype ipv4 multiproto
+		setup_bareudp "$SERVER_NS" tun1 "$SERVER_IP" "$CLIENT_IP"
+		;;
+	esac
 	ip -netns "$SERVER_NS" link set tun1 up
 	ip -netns "$SERVER_NS" addr replace "$SERVER_IP4_TUN/24" dev tun1
 	ip -netns "$SERVER_NS" addr replace "$SERVER_IP6_TUN/112" dev tun1 nodad
@@ -192,6 +218,11 @@ if ! iptables --version &> /dev/null; then
 	exit "$ksft_skip"
 fi
 
+if ! tc -V &> /dev/null; then
+	echo "SKIP: Could not run test without tc tool"
+	exit "$ksft_skip"
+fi
+
 if ! ethtool --version &> /dev/null; then
 	echo "SKIP: Could not run test without ethtool tool"
 	exit "$ksft_skip"
@@ -205,7 +236,7 @@ fi
 WORKDIR=$(mktemp -d)
 trap cleanup EXIT
 setup
-for tunnel in vxlan geneve; do
+for tunnel in vxlan geneve bareudp; do
 	for tun_family in 4 6; do
 		for traffic_family in 4 6; do
 			for csum_offload in on off; do
-- 
2.43.0

Re: [PATCH net-next v2 2/2] selftests: net: big_tcp_tunnels: Cover bareudp

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 3 potential
issue(s) to consider.

Critical: 0 · High: 1 · Medium: 0 · Low: 2

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [High] Seven of the twelve new bareudp test cases cannot pass, so
  tools/testing/selftests/net/big_tcp_tunnels.sh now always fails.
- [Low] Comments in tools/testing/selftests/net/big_tcp_tunnels.sh do not
  match the new coverage.
- [Low] The return status of the new bareudp setup commands is never
  checked.

--

selftests: net: big_tcp_tunnels: Cover bareudp

This patch adds bareudp to the tunnel types tested by big_tcp_tunnels.sh.
The bareudp devices run in external mode with ethertype ipv4 multiproto. A
tc tunnel_key action on egress supplies the tunnel metadata, and the device
MTU is lowered to leave room for the IPv6 and UDP headers.

> diff --git a/tools/testing/selftests/net/big_tcp_tunnels.sh b/tools/testing/selftests/net/big_tcp_tunnels.sh
> index cc0875e52fb9..cf38377f576b 100755
> --- a/tools/testing/selftests/net/big_tcp_tunnels.sh
> +++ b/tools/testing/selftests/net/big_tcp_tunnels.sh
> @@ -53,6 +53,16 @@ setup() {
>  	DEFAULT_TCP_MIN_TSO_SEGS=$(ip netns exec "$CLIENT_NS" sysctl -n net.ipv4.tcp_min_tso_segs)
>  }
>  
> +# bareudp only works in external mode: attach the tunnel metadata to all
> +# packets sent through the device. Its MTU does not account for the
> +# encapsulation either, so leave room for IPv6 and UDP headers.
> +setup_bareudp() {
> +	ip -netns "$1" link set "$2" mtu 1452
> +	tc -netns "$1" qdisc add dev "$2" clsact
> +	tc -netns "$1" filter add dev "$2" egress matchall \
> +		action tunnel_key set src_ip "$3" dst_ip "$4" id 0 ttl 64
> +}

[Severity: Low]
Should failures from these commands be passed back to the caller?
setup_bareudp() ignores the exit status of ip link set, tc qdisc add and tc
filter add. The same is true of the ip link add ... type bareudp ...
multiproto calls in setup_tunnel().

The exit status of setup_tunnel() comes from its last command:

    ip netns exec "$SERVER_NS" ethtool -K link1 tx-checksumming "$3" > /dev/null

As a result, setup_tunnel ... || exit "$?" never sees these failures. The
new tc -V check only shows that the tc binary exists. It does not show that
matchall or tunnel_key work.

Without the tunnel_key filter, bareudp_xmit() drops every packet:

drivers/net/bareudp.c:bareudp_xmit() {
    ...
	info = skb_tunnel_info(skb);
	if (unlikely(!info || !(info->mode & IP_TUNNEL_INFO_TX))) {
		err = -EINVAL;
		goto tx_error;
	}
    ...
}

The test then reports a packet-count FAIL rather than a SKIP or a clear
setup error. The vxlan and geneve setup ignores errors in the same way.

> @@ -64,26 +74,42 @@ setup_tunnel() {

[ ... ]

> +	bareudp)
> +		ip -netns "$CLIENT_NS" link add tun0 type bareudp \
> +			dstport 6635 ethertype ipv4 multiproto
> +		setup_bareudp "$CLIENT_NS" tun0 "$CLIENT_IP" "$SERVER_IP"
> +		;;
> +	esac

[Severity: High]
Can the bareudp cases that use IPv6, inner or outer, with csum offload off
pass in this configuration?

With tx-checksumming off on link0, every encapsulated GSO skb is segmented
in software by skb_udp_tunnel_segment(). That function chooses the inner
handler based on skb->inner_protocol:

net/ipv4/udp_offload.c:skb_udp_tunnel_segment() {
    ...
	case ENCAP_TYPE_ETHER:
		protocol = skb->inner_protocol;
		gso_inner_segment = skb_mac_gso_segment;
    ...
}

On the IPv4 underlay, bareudp_xmit_skb() always stores the configured
ethertype. It does this even for IPv6 inner traffic in multiproto mode:

drivers/net/bareudp.c:bareudp_xmit_skb() {
    ...
	skb_set_inner_protocol(skb, bareudp->ethertype);
    ...
}

The IPv6 header is then handed to inet_gso_segment(). There, iph->ihl * 4
reads the low nibble of the first IPv6 byte, and the ihl < sizeof(*iph)
check fails.

On the IPv6 underlay, bareudp6_xmit_skb() never sets inner_protocol. The
field stays 0, so skb_mac_gso_segment() fails:

net/core/gso.c:skb_mac_gso_segment() {
    ...
	__be16 type = skb_network_protocol(skb, &vlan_depth);

	if (unlikely(!type))
		return ERR_PTR(-EINVAL);
    ...
}

In both cases validate_xmit_skb() drops the GSO skbs. The bigtcp iptables
counter on tun1 stays below packets_threshold, and do_test ... || exit "$?"
stops the run at the first such case: bareudp, tun_family 4,
traffic_family 6, csum off.

vxlan and geneve are not affected because they set inner_protocol to
ETH_P_TEB.

This driver behaviour is older than this series. The previous patch,
"bareudp: Enable BIG TCP packets", only raises tso_max_size and does not
change it. As a result, the commit message goal to "run the same checks
over bareudp as for vxlan and geneve" cannot be met as written.

Could the bareudp inner_protocol handling be fixed first? That would mean
setting it from the actual inner protocol, and also setting it on the IPv6
path. Alternatively, the bareudp combinations could be limited to the
cases that work.

[ ... ]

> @@ -205,7 +236,7 @@ fi
>  WORKDIR=$(mktemp -d)
>  trap cleanup EXIT
>  setup
> -for tunnel in vxlan geneve; do
> +for tunnel in vxlan geneve bareudp; do

[Severity: Low]
This isn't a bug, but the comment at the top of the file still reads:

# Testing for IPv4 and IPv6 BIG TCP over VXLAN and GENEVE tunnels.

Should it mention bareudp now?

The comment in do_test() is also out of date:

	# packet to veth. Check BIG TCP packets inside the VXLAN tunnel to verify

That branch runs for every tunnel type. The wording was already wrong once
geneve was added, and adding bareudp makes it more misleading.

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261003100939.468181-1-yanhaishuang%40cmss.chinamobile.com

Re: [PATCH net-next v2 2/2] selftests: net: big_tcp_tunnels: Cover bareudp

[Haishuang Yan]

On Sun, Oct 04, 2026 at 10:11:32 +0000, netdev-bot+sashiko@kernel.org wrote:
> [Severity: High]
> Can the bareudp cases that use IPv6, inner or outer, with csum offload off
> pass in this configuration?
[...]
> Could the bareudp inner_protocol handling be fixed first? That would mean
> setting it from the actual inner protocol, and also setting it on the IPv6
> path. Alternatively, the bareudp combinations could be limited to the
> cases that work.

Right, and this is the dependency mentioned in the cover letter. The fix
does exactly that and is posted to net, reviewed by Willem:

https://lore.kernel.org/netdev/20261002153039.462663-1-yanhaishuang@cmss.chinamobile.com/

With it, all the bareudp cases pass. I will repost once the fix has
reached net-next.

> [Severity: Low]
> Should failures from these commands be passed back to the caller?

Yes, setup_bareudp() will create the device itself and return an error
with a message if any step fails, and setup_tunnel() will pass it on.

> [Severity: Low]
> This isn't a bug, but the comment at the top of the file still reads:
>
> # Testing for IPv4 and IPv6 BIG TCP over VXLAN and GENEVE tunnels.
>
> Should it mention bareudp now?

Yes, I will update both comments.

pw-bot: cr