bge: disable TXCSUM if UDP transmit checksum offloading is disabled

The bge interface is special with respect to transmit checksumi
offloading. In the default settings, an bge interface announces TXCSUM
capabilities, but only supports TCP/IPv4 and not UDP/IPv4 due to
limitations of some of the NICs. This results in problems when the bge
interface becomes a member of a bridge. Since currently only the
TXCSUM capabilities are synced when a member is added to a bridge and
not the protocol specific capabilities, this can result in a situation
where UDP packets are sent out using a bge interface without having a
correct checksum.
To mitigate this problem, initially don't announce TXCSUM capabilities,
when UDP transmit checksum is disabled. It is still possible to enable
TXCSUM capabilities via ifconfig.

PR:			291420
Reviewed by:		Timo Voelker
MFC after:		3 days
Differential Revision:	https://reviews.freebsd.org/D54486

2 files changed, 22 insertions, 2 deletions

diff --git a/share/man/man4/bge.4 b/share/man/man4/bge.4
index de559c16df3c..fdf46fec0073 100644
--- a/share/man/man4/bge.4
+++ b/share/man/man4/bge.4
@@ -29,7 +29,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 .\" THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd August 18, 2017
+.Dd January 16, 2026
 .Dt BGE 4
 .Os
 .Sh NAME
@@ -276,3 +276,11 @@ Also, due to the lack of hotplug support, Thunderbolt-based interfaces must not
 while the system is up as the kernel is currently unable to cope with a
 .Nm
 interface disappearing.
+.Pp
+The UDP transmit checksum offloading is disabled by default, see
+.Va dev.bge.%d.forced_udpcsum .
+To avoid problems when the interface is a member of a
+.Xr bridge 4
+interface, all transmit checksum offloading is initially disabled in this case.
+Transmit checksum offloading can be enabled using
+.Xr ifconfig 8 .
diff --git a/sys/dev/bge/if_bge.c b/sys/dev/bge/if_bge.c
index cf3084f9b768..2feb19bff677 100644
--- a/sys/dev/bge/if_bge.c
+++ b/sys/dev/bge/if_bge.c
@@ -3721,7 +3721,12 @@ bge_attach(device_t dev)
 	if_setgetcounterfn(ifp, bge_get_counter);
 	if_setsendqlen(ifp, BGE_TX_RING_CNT - 1);
 	if_setsendqready(ifp);
-	if_sethwassist(ifp, sc->bge_csum_features);
+	/* Initially enable checksum offloading either for all of IPv4, TCP/IPv4
+	 * and UDP/IPv4, or for none. This avoids problems when the interface
+	 * is added to a bridge.
+	 */
+	if (sc->bge_csum_features & CSUM_UDP)
+		if_sethwassist(ifp, sc->bge_csum_features);
 	if_setcapabilities(ifp, IFCAP_HWCSUM | IFCAP_VLAN_HWTAGGING |
 	    IFCAP_VLAN_MTU);
 	if ((sc->bge_flags & (BGE_FLAG_TSO | BGE_FLAG_TSO3)) != 0) {
@@ -3732,6 +3737,13 @@ bge_attach(device_t dev)
 	if_setcapabilitiesbit(ifp, IFCAP_VLAN_HWCSUM, 0);
 #endif
 	if_setcapenable(ifp, if_getcapabilities(ifp));
+	/*
+	 * Disable TXCSUM capability initially, if UDP checksum offloading is
+	 * not enabled. This avoids problems when the interface is added to a
+	 * bridge.
+	 */
+	if ((sc->bge_csum_features & CSUM_UDP) == 0)
+		if_setcapenablebit(ifp, 0, IFCAP_TXCSUM);
 #ifdef DEVICE_POLLING
 	if_setcapabilitiesbit(ifp, IFCAP_POLLING, 0);
 #endif