From: Ralf Lici <ralf@mandelbit.com>
To: openvpn-devel@lists.sourceforge.net
Date: Wed, 16 Sep 2026 08:52:41 +0200
Message-ID: <cover.1789540779.git.ralf@mandelbit.com>
MIME-Version: 1.0
Subject: [Openvpn-devel] [RFC ovpn net-next v2 0/9] ovpn: preserve GSO and
 GRO batching
Precedence: list
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: openvpn-devel-bounces@lists.sourceforge.net

Hi,

This series adds support for preserving GSO and GRO batching across
ovpn, including forwarded TCP traffic. The transmit patches let GSO skbs
reach ovpn, complete each inner packet's checksum before encryption,
and, when the layout permits, put the encrypted records into a UDP GSO
skb. Ordinary packets and frag-list GSO children retain the existing
in-place path.

On receive, ovpn uses UDP GRO to collect compatible encrypted records in
a frag-list and then decrypts them individually. The series also
includes an AEAD helper refactor and small transmit and receive prefetch
changes. The patch messages contain the measurements.

The final patch adds an opt-in direct GRO mode for discussion. Unlike
the default full-stack mode, it consumes DATA_V2 records in the GRO
callback and bypasses parts of the outer receive stack, including TC,
netfilter, socket XFRM policy and normal UDP accounting. Its advantage
over the prefetched full-stack path is small in my latest 100-Gbit/s
tests.

Direct GRO also depends on a generic GRO ownership change in the
preceding patch. That change, the skb_gro_receive_list export and UDP
tunnel GRO callback accounting touch broader networking code. These
prerequisites would need discussion on netdev before any merge (this RFC
is first for feedback on the ovpn design).

Thanks,

Ralf Lici
Mandelbit Srl

---
Changes since v1 https://lore.kernel.org/openvpn-devel/cover.1789485693.git.ralf@mandelbit.com/
- Fix a couple of wrong assumptions in 5/9 ("ovpn: coalesce UDP data
  records with GRO"). (Sashiko)

Ralf Lici (9):
  ovpn: advertise checksum offload for GSO packets
  ovpn: accept frag-list GSO input
  ovpn: refactor AEAD encryption helpers
  ovpn: convert GSO input into UDP GSO output
  ovpn: coalesce UDP data records with GRO
  ovpn: prefetch encrypted records before GRO batch decryption
  ovpn: prefetch GSO segments before in-place encryption
  net: gro: honor skbs consumed by protocol callbacks
  ovpn: add opt-in direct GRO receive mode

 Documentation/netlink/specs/rt-link.yaml      |  12 +
 drivers/net/ovpn/crypto_aead.c                | 182 +++++++---
 drivers/net/ovpn/crypto_aead.h                |   4 +
 drivers/net/ovpn/io.c                         | 281 +++++++++++++--
 drivers/net/ovpn/io.h                         |  17 +-
 drivers/net/ovpn/main.c                       |  20 +-
 drivers/net/ovpn/ovpnpriv.h                   |   2 +
 drivers/net/ovpn/proto.h                      |   4 +
 drivers/net/ovpn/skb.h                        |  27 +-
 drivers/net/ovpn/stats.h                      |  16 +-
 drivers/net/ovpn/tcp.c                        |   4 +-
 drivers/net/ovpn/udp.c                        | 321 ++++++++++++++++--
 include/net/gro.h                             |  19 +-
 include/uapi/linux/if_link.h                  |   6 +
 net/core/gro.c                                |   1 +
 net/ipv4/udp_offload.c                        |   3 +-
 tools/testing/selftests/net/ovpn/Makefile     |   1 +
 tools/testing/selftests/net/ovpn/common.sh    |   4 +-
 tools/testing/selftests/net/ovpn/ovpn-cli.c   |  38 ++-
 .../selftests/net/ovpn/test-gro-direct.sh     |  10 +
 tools/testing/selftests/net/ovpn/test.sh      |  65 ++++
 21 files changed, 906 insertions(+), 131 deletions(-)
 create mode 100755 tools/testing/selftests/net/ovpn/test-gro-direct.sh


base-commit: b8e9e7d82e7eefd5d2d528469d94ec20e96b38c3
-- 
2.55.0


_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel