>Synopsis: ix(4): X553 (Denverton SoC) emits IPv4 frames with uncomputed
>(zero) IP header checksums on the wire
>Category: system kernel amd64
>Environment:
System : OpenBSD 7.9
Details : OpenBSD 7.9 (GENERIC.MP) #15: Sun Sep 27 02:47:36 MDT 2026
[email protected]:/usr/src/sys/arch/amd64/compile/GENERIC.MP
Architecture: OpenBSD.amd64
Machine : amd64
>Description:
Every IPv4 frame transmitted by ix(4) on this hardware reaches the wire
with the IP header checksum field = 0x0000
Evidence: switch SPAN of the modem-facing port (byte-faithful,
store-and-forward; received on a sibling X553 port of the same box;
inbound frames on the same mirror arrive with valid checksums, so the
capture path is not the cause).
- Census: 8411/8411 egress IPv4 frames have ip[10:2] == 0 (100%), across
all traffic classes: pf-NAT'd forwarded TCP (ttl < initial), forwarded
traffic from a TTL-255 embedded device, locally originated UDP
(unbound -> 9.9.9.9), and 1997/1997 WireGuard outer packets.
- L4 behavior differs by path: forwarded TCP shows valid TCP checksums
(pf fixes L4 in software during NAT). Locally originated UDP shows
systematically WRONG but non-zero UDP checksums: the low byte is
0x2b in every sample across many different packets (e.g. 8d2b vs
correct 8c45). So the L4 fill appears to be attempted with incorrect
context, while the IPv4 header fill never occurs at all.
- Real consequence observed: a forwarded TCP segment went unacked, the
identical segment was retransmitted 45 ms later, both copies with
zero IP checksums -- at least some receivers drop these frames at
IP input.
- General Internet traffic and a WireGuard tunnel nonetheless function,
consistent with far-end stacks tolerating zero checksums (RX-offload
verify-good false positives?) rather than the frames being correct.
Runtime state:
- hwfeatures shows CSUM_IPv4, CSUM_TCPv4, CSUM_UDPv4 armed on ix3 and
inherited by the vlan child (vlan13, WAN/egress). TSO not enabled,
LRO enabled (RX only).
- There is no runtime lever: `ifconfig ix3 -txcsum` and
`ifconfig vlan13 -txcsum` both fail with "-txcsum: bad value".
CVS status: no commits to sys/dev/pci/if_ix.c for ~6 months; annotate
for the capability registration:
1.85 (mikeb 17-Dec-12) IFCAP_CSUM_TCPv4 | IFCAP_CSUM_UDPv4
1.182 (dlg 08-Feb-22) IFCAP_CSUM_TCPv6 | IFCAP_CSUM_UDPv6
1.185 (jan 15-Mar-22) IFCAP_CSUM_IPv4
The IFCAP_CSUM_IPv4 capability dates to 7.1-current. I have no evidence
it has ever worked on X553 silicon -- possibly the capability is
advertised without an X553-specific check, or the X553 TX checksum path
needs NVM/feature configuration that appliance boards do not provide.
A full capture ( pcap ) is available on request.
dmesg output follows:
OpenBSD 7.9 (GENERIC.MP) #15: Sun Sep 27 02:47:36 MDT 2026
[email protected]:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 8527990784 (8132MB)
avail mem = 8241938432 (7860MB)
random: good seed from bootblocks
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 3.0 @ 0x7f0c0000 (36 entries)
bios0: vendor American Megatrends Inc. version "2.3" date 04/14/2025
bios0: Supermicro Super Server
efi0 at bios0: UEFI 2.6
efi0: American Megatrends rev 0x5000d
acpi0 at bios0: ACPI 6.1
acpi0: sleep states S0 S4 S5
acpi0: tables DSDT FACP FPDT FIDT SPMI MCFG WDAT APIC BDAT HPET UEFI SSDT DMAR
HEST BERT ERST EINJ WSMT
acpi0: wakeup devices XHC1(S4) OBL1(S4) LAN1(S4) PEX0(S4) LAN2(S4) LAN3(S4)
PEX1(S4) PEX6(S4) PEX7(S4)
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpimcfg0 at acpi0
acpimcfg0: addr 0xe0000000, bus 0-255
acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
cpu0 at mainbus0: apid 4 (boot processor)
cpu0: Intel(R) Atom(TM) CPU C3558 @ 2.20GHz, 2200.01 MHz, 06-5f-01, patch
0000003e
cpu0: cpuid 1
edx=bfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
ecx=47f8ebbf<SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,RDRAND>
cpu0: cpuid 6 eax=55<SENSOR,ARAT,PTS> ecx=9<EFFFREQ>
cpu0: cpuid 7.0
ebx=2294e283<FSGSBASE,TSC_ADJUST,SMEP,ERMS,MPX,RDSEED,SMAP,CLFLUSHOPT,PT,SHA>
edx=ac000400<MD_CLEAR,IBRS,IBPB,STIBP,SSBD>
cpu0: cpuid a vers=4, gp=4, gpwidth=48, ff=3, ffwidth=48
cpu0: cpuid d.1 eax=f<XSAVEOPT,XSAVEC,XGETBV1,XSAVES>
cpu0: cpuid 80000001 edx=2c100800<NXE,PAGE1GB,RDTSCP,LONG> ecx=101<LAHF,3DNOWP>
cpu0: cpuid 80000007 edx=100<ITSC>
cpu0: msr
10a=14000c69<SKIP_L1DFL,MDS_NO,IF_PSCHANGE,MISC_PKG_CT,ENERGY_FILT,GDS_NO,RFDS_CLEAR>
cpu0: 24KB 64b/line 6-way D-cache, 32KB 64b/line 8-way I-cache, 2MB 64b/line
16-way L2 cache
cpu0: smt 0, core 2, package 0, type P
mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges
cpu0: apic clock running at 25MHz
cpu0: mwait min=64, max=64, C-substates=0.2.0.2, IBE
cpu1 at mainbus0: apid 12 (application processor)
cpu1: Intel(R) Atom(TM) CPU C3558 @ 2.20GHz, 2200.00 MHz, 06-5f-01, patch
0000003e
cpu1: smt 0, core 6, package 0, type P
cpu2 at mainbus0: apid 16 (application processor)
cpu2: Intel(R) Atom(TM) CPU C3558 @ 2.20GHz, 2200.00 MHz, 06-5f-01, patch
0000003e
cpu2: smt 0, core 8, package 0, type P
cpu3 at mainbus0: apid 24 (application processor)
cpu3: Intel(R) Atom(TM) CPU C3558 @ 2.20GHz, 2200.00 MHz, 06-5f-01, patch
0000003e
cpu3: smt 0, core 12, package 0, type P
ioapic0 at mainbus0: apid 2 pa 0xfec00000, version 20, 24 pins
acpihpet0 at acpi0: 23999999 Hz
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus 6 (VRP0)
acpiprt2 at acpi0: bus -1 (PEX0)
acpiprt3 at acpi0: bus 1 (VRP2)
acpiprt4 at acpi0: bus 7 (VRP1)
acpiprt5 at acpi0: bus 2 (PEX1)
acpiprt6 at acpi0: bus 3 (PEX6)
acpiprt7 at acpi0: bus 4 (PEX7)
acpiprt8 at acpi0: bus 5 (BR28)
acpipci0 at acpi0 PCI0: 0x00000010 0x00000011 0x00000000
"PNP0003" at acpi0 not configured
acpicmos0 at acpi0
com0 at acpi0 UAR1 addr 0x3f8/0x8 irq 4: ns16550a, 16 byte fifo
com1 at acpi0 UAR2 addr 0x2f8/0x8 irq 3: ns16550a, 16 byte fifo
"IPI0001" at acpi0 not configured
"PNP0C33" at acpi0 not configured
acpicpu0 at acpi0: C2(10@50 mwait.1@0x21), C1(1000@1 mwait.1@0x1), PSS
acpicpu1 at acpi0: C2(10@50 mwait.1@0x21), C1(1000@1 mwait.1@0x1), PSS
acpicpu2 at acpi0: C2(10@50 mwait.1@0x21), C1(1000@1 mwait.1@0x1), PSS
acpicpu3 at acpi0: C2(10@50 mwait.1@0x21), C1(1000@1 mwait.1@0x1), PSS
ipmi at mainbus0 not configured
cpu0: using VERW MDS workaround
cpu0: Enhanced SpeedStep 2200 MHz: speeds: 2200, 2100, 2000, 1900, 1800, 1700,
1600, 1500, 1400, 1300, 1200, 1100, 1000, 900, 800 MHz
pci0 at mainbus0 bus 0
pchb0 at pci0 dev 0 function 0 "Intel C3000 Host" rev 0x11
pchb1 at pci0 dev 4 function 0 "Intel C3000 GLREG" rev 0x11
"Intel C3000 RCEC" rev 0x11 at pci0 dev 5 function 0 not configured
ppb0 at pci0 dev 6 function 0 "Intel C3000 PCIE" rev 0x11
pci1 at ppb0 bus 1
"Intel C3000 QAT" rev 0x11 at pci1 dev 0 function 0 not configured
ppb1 at pci0 dev 10 function 0 "Intel C3000 PCIE" rev 0x11: msi
pci2 at ppb1 bus 2
ppb2 at pci0 dev 16 function 0 "Intel C3000 PCIE" rev 0x11
pci3 at ppb2 bus 3
nvme0 at pci3 dev 0 function 0 "Samsung SM981/PM981" rev 0x00: msix, NVMe 1.3
nvme0: Samsung SSD 970 PRO 512GB, firmware 1B2QEXP7, serial S5JYNS0NA05050P
scsibus1 at nvme0: 2 targets, initiator 0
sd0 at scsibus1 targ 1 lun 0: <NVMe, Samsung SSD 970, 1B2Q>
sd0: 488386MB, 512 bytes/sector, 1000215216 sectors
ppb3 at pci0 dev 17 function 0 "Intel C3000 PCIE" rev 0x11
pci4 at ppb3 bus 4
ppb4 at pci4 dev 0 function 0 "ASPEED Technology AST1150 PCI" rev 0x03
pci5 at ppb4 bus 5
"ASPEED Technology AST2000" rev 0x30 at pci5 dev 0 function 0 not configured
"Intel C3000 SMBus" rev 0x11 at pci0 dev 18 function 0 not configured
ahci0 at pci0 dev 19 function 0 "Intel C3000 AHCI" rev 0x11: msi, AHCI 1.3.1
scsibus2 at ahci0: 32 targets
ahci1 at pci0 dev 20 function 0 "Intel C3000 AHCI" rev 0x11: msi, AHCI 1.3.1
scsibus3 at ahci1: 32 targets
xhci0 at pci0 dev 21 function 0 "Intel C3000 xHCI" rev 0x11: msi, xHCI 1.0
usb0 at xhci0: USB revision 3.0
uhub0 at usb0 configuration 1 interface 0 "Intel xHCI root hub" rev 3.00/1.00
addr 1
ppb5 at pci0 dev 22 function 0 "Intel C3000 PCIE" rev 0x11
pci6 at ppb5 bus 6
ix0 at pci6 dev 0 function 0 "Intel X553 SGMII" rev 0x11, msix, 4 queues,
address ac:1f:6b:b1:c5:94
ix1 at pci6 dev 0 function 1 "Intel X553 SGMII" rev 0x11, msix, 4 queues,
address ac:1f:6b:b1:c5:95
ppb6 at pci0 dev 23 function 0 "Intel C3000 PCIE" rev 0x11
pci7 at ppb6 bus 7
ix2 at pci7 dev 0 function 0 "Intel X553 SGMII" rev 0x11, msix, 4 queues,
address ac:1f:6b:b1:c5:96
ix3 at pci7 dev 0 function 1 "Intel X553 SGMII" rev 0x11, msix, 4 queues,
address ac:1f:6b:b1:c5:97
"Intel C3000 ME HECI" rev 0x11 at pci0 dev 24 function 0 not configured
pcib0 at pci0 dev 31 function 0 "Intel C3000 LPC" rev 0x11
"Intel C3000 PMC" rev 0x11 at pci0 dev 31 function 2 not configured
ichiic0 at pci0 dev 31 function 4 "Intel C3000 SMBus" rev 0x11: apic 2 int 23
iic0 at ichiic0
sdtemp0 at iic0 addr 0x18: tse2004gb2
sdtemp1 at iic0 addr 0x1a: tse2004gb2
spdmem0 at iic0 addr 0x50: 4GB DDR4 SDRAM registered ECC PC4-21300 with thermal
sensor
spdmem1 at iic0 addr 0x52: 4GB DDR4 SDRAM registered ECC PC4-21300 with thermal
sensor
"Intel C3000 SPI" rev 0x11 at pci0 dev 31 function 5 not configured
isa0 at pcib0
isadma0 at isa0
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
vmm0 at mainbus0: VMX/EPT
efifb0 at mainbus0: 1024x768, 32bpp
wsdisplay0 at efifb0 mux 1: console (std, vt100 emulation)
wsdisplay0: screen 1-5 added (std, vt100 emulation)
uhub1 at uhub0 port 3 configuration 1 interface 0 "Genesys Logic USB2.0 Hub"
rev 2.00/32.98 addr 2
uhub2 at uhub1 port 1 configuration 1 interface 0 "ATEN International product
0x7000" rev 2.00/0.00 addr 3
uhidev0 at uhub2 port 1 configuration 1 interface 0 "ATEN International product
0x2419" rev 1.10/1.00 addr 4
uhidev0: iclass 3/1
ukbd0 at uhidev0: 8 variable keys, 6 key codes
wskbd0 at ukbd0: console keyboard, using wsdisplay0
uhidev1 at uhub2 port 1 configuration 1 interface 1 "ATEN International product
0x2419" rev 1.10/1.00 addr 4
uhidev1: iclass 3/1
ums0 at uhidev1: 3 buttons, Z dir
wsmouse0 at ums0 mux 0
uhub3 at uhub1 port 2 configuration 1 interface 0 "Genesys Logic USB2.0 Hub"
rev 2.00/32.98 addr 5
vscsi0 at root
scsibus4 at vscsi0: 256 targets
softraid0 at root
scsibus5 at softraid0: 256 targets
root on sd0a (a59a2cdc5f365a2f.a) swap on sd0b dump on sd0b
>How-To-Repeat:
Sample outbound traffic by mirroring the switch port connecting the
modem
>Fix:
I have not tested a hand-patched kernel (dropping the IFCAP_CSUM_*_Tx
bits from if_capabilities): 8.0 release is imminent.
