HSR/PRP forward frames one by one: each wire frame gets its own tag
or RCT and sequence number, and duplicate discard is per frame. Two
aggregation mechanisms break that per-frame assumption:

* On RX, a lower device that aggregates frames into a GRO
  super-packet feeds the HSR receive and forward paths something
  they cannot handle: frames are dropped, and on memory-constrained
  devices processing super-skbs in softirq context also pressures
  atomic allocation.

* At the forward entry, a GSO super-packet (locally generated on
  the master, or delivered intact by software NICs such as veth)
  would be tagged and forwarded as a single frame, violating
  per-frame wire semantics.

Patch 1 adds netif_disable_gro() and dev_disable_gro() alongside
the existing LRO helpers.  HSR calls the public wrapper at
enslavement time, while the networking core handles the generic
feature update and recursive lower-device traversal. Enslavement to
an HSR/PRP master therefore strips NETIF_F_GRO and NETIF_F_GRO_HW
on the lower device.

Patch 2 is a preparatory locking change with forwarding semantics
unchanged: it shrinks hsr->seqnr_lock from whole hsr_forward_skb()
calls to the individual sequence counter updates, so that the
segmentation work of patch 3 (per-segment allocation, checksums and
forwarding) never runs with BH disabled under the global sequence
lock. Patch 3 depends on patch 2; please keep them together for
stable.

Patch 3 unfolds the remaining GSO super-packets at the forward
entry with the top-level GSO dispatch (__skb_gso_segment()), so
each wire frame still gets its own tag and sequence number.
Segmentation is offered only for ingress roles whose frames are
known to be plain Ethernet: the master (locally generated) and the
interlink (SAN side, untagged). A super-packet from a LAN slave may
carry per-frame HSR tags or PRP RCT trailers that software
segmentation cannot recover, and an already-tagged HSR/PRP
super-packet violates per-frame wire semantics; both are rejected
by ingress-port policy. The HSR master also stops advertising
NETIF_F_GSO_MASK so locally generated traffic is segmented as
early as possible.

Patch 4 adds a kselftest covering the above: GRO disabled on
enslaved devices, no GSO/TSO advertised by the HSR master, and a
TCP stream from a TSO-enabled SAN through an HSR DUT. The stream
evidence is direct: the SAN's TX frame-size average must exceed a
fixed super-packet threshold while the DUT LAN legs' averages stay
below a fixed per-frame guard, which is aggregate evidence that
super-packets entered the forward path and bulk output was
segmented (not a per-frame maximum proof); zero retransmits is
reported as a secondary health signal. The one-shot iperf3 server
is confined to a private mktemp workdir with its real exit status
propagated, so on every path exercised by the test itself (normal
completion, server startup failure, client failure, never-published
PID) no process or directory can leak.

Validation:
* build: W=1 allmodconfig and allyesconfig, base vs patched - no
  new warnings (evidence reused from the bound v1 run: kernel diffs
  are patch-id identical and every compiled input is byte-identical
  to the W=1-bound tree, so no build input changed; not a new
  execution).
* selftests: the final v2 hsr_gro_superpacket passes on QEMU
  x86_64 (the four paths under lifecycle above); hsr_ping,
  prp_ping and hsr_redbox results are reused from the v1 run on
  QEMU x86_64 and physical igb lower devices (kernel diffs are
  byte-identical to that validated set).
* functional: SAN TSO streams unfold per-frame (IPv4, IPv6, VLAN);
  LAN-side aggregates and already-tagged super-packets are dropped
  by ingress-port policy; master/interlink concurrency under
  PROVE_LOCKING is clean; the new counter assertions show
  super-packets entering the forward path and per-frame output on
  both LAN legs (the IPv4/IPv6/VLAN and concurrency results are
  reused v1 evidence; the counter assertions are new v2 evidence).
* lifecycle: normal completion, server startup failure, client
  failure and a never-published server PID all exit bounded with no
  leftover iperf3 or workdir.
* physical igb lower devices (reused v1 evidence, kernel diffs
  byte-identical): GRO stripped at enslavement; force-enabled
  generic GRO super-packets unfold at line rate with a clean dmesg.

Changes in v2:
- Harden the selftest's temporary-file and iperf3 process handling.
- Propagate the iperf3 server status and tighten output parsing.
- Add counter-based evidence that GSO packets enter the HSR forward
  path and are segmented before transmission on the LAN ports.
- Extend the GSO feature checks and fix shellcheck/style findings.
- Regenerate the complete mail set from real kernel commits
  (statistics now machine-generated).
- Kernel diffs in patches 1-3 are unchanged.

Previous posting (the linked RESEND is the complete v1 series):
  https://lore.kernel.org/netdev/20260722171836.196-1-xiexinet@gmail.com/


Xin Xie (4):
  net: hsr: fix packet drops caused by GRO superpackets
  net: hsr: shrink seqnr_lock to sequence counter updates
  net: hsr: unfold GSO super-packets at the forward entry
  selftests: net: hsr: add GRO super-packet forwarding test

 include/linux/netdevice.h                     |   2 +
 net/core/dev.c                                |  18 +
 net/core/dev_api.c                            |  16 +
 net/hsr/hsr_device.c                          |  17 +-
 net/hsr/hsr_forward.c                         |  53 ++-
 net/hsr/hsr_slave.c                           |  12 +-
 tools/testing/selftests/net/hsr/Makefile      |   1 +
 .../selftests/net/hsr/hsr_gro_superpacket.sh  | 437 ++++++++++++++++++
 8 files changed, 532 insertions(+), 24 deletions(-)
 create mode 100755 tools/testing/selftests/net/hsr/hsr_gro_superpacket.sh


base-commit: ba712ecfd942b68b21a4b0a5daaf72f6616cc66d
-- 
2.43.0