February 2024 - dev

[PATCH v2 00/14] Clean up checksum and header generation for inbound packets
by David Gibson 10 Oct '25

10 Oct '25

The main packet "fast paths" for UDP and TCP mostly just forward packets rather than generating them from scratch. However the control paths for ICMP and DHCP sometimes generate packets more or less from scratch. Because these are relatively rare, it's not performance critical. The paths for sending these packets have some duplication of the header generation. There's also some layering violation in tap_ip_send() which both generates IP headers and updates the L4 (UDP or UCMP) checksum. Finally that checksum generation is a little awkward: it temporarily generates the IP pseudo header (or something close enough to serve) in the place of the actual header, generates the checksum, then replaces it with the real IP header. This approach seems to be causing miscompiles with some LTO optimization, because the stores to the pseudo header are being moved or elided across the code calculating the checksum. This series addresses all of these. We consolidate and clarify the packet sending helpers, and use them in some places there was previously duplicated code. In the process we use new checksum generation helpers which take a different approach which should avoid the LTO problems (this aspect I haven't tested yet though). Changes since v1: * Numerous minor style changes * Rename header generation helpers to make their behaviour clearer * Added several missing function doc comments * Corrected some erroneous statements and terms in comments David Gibson (14): Add csum_icmp6() helper for calculating ICMPv6 checksums Add csum_icmp4() helper for calculating ICMP checksums Add csum_udp6() helper for calculating UDP over IPv6 checksums Add csum_udp4() helper for calculating UDP over IPv4 checksums Add csum_ip4_header() helper to calculate IPv4 header checksums Add helpers for normal inbound packet destination addresses Remove support for TCP packets from tap_ip_send() tap: Remove unhelpeful vnet_pre optimization from tap_send() Split tap_ip_send() into IPv4 and IPv6 specific functions tap: Split tap_ip6_send() into UDP and ICMP variants ndp: Remove unneeded eh_source parameter ndp: Use tap_icmp6_send() helper tap: Split tap_ip4_send() into UDP and ICMP variants dhcp: Use tap_udp4_send() helper in dhcp() arp.c | 2 +- checksum.c | 120 ++++++++++++++++----- checksum.h | 15 ++- dhcp.c | 19 +--- dhcpv6.c | 21 +--- icmp.c | 12 +-- ndp.c | 28 +---- ndp.h | 3 +- tap.c | 312 ++++++++++++++++++++++++++++++++++------------------- tap.h | 19 +++- 10 files changed, 345 insertions(+), 206 deletions(-) -- 2.37.3

2 17

[PATCH 0/3] Basic integration of ICMP with flow table
by David Gibson 13 Mar '24

13 Mar '24

I realized that even with the rudimentary form of the flow table we have now, it's possible to integrate ICMP (ping). This even simplifies a little bit of logic in the ICMP code. This is based on the address handling clean up series. David Gibson (3): icmp: Store ping socket information in flow table icmp: Flow based error reporting icmp: Use 'flowside' epoll references for ping sockets Makefile | 6 +- flow.c | 9 +++ flow.h | 4 ++ flow_table.h | 2 + icmp.c | 194 +++++++++++++++++++++++---------------------------- icmp.h | 15 +--- icmp_flow.h | 31 ++++++++ passt.c | 15 +--- passt.h | 7 +- util.c | 4 +- 10 files changed, 146 insertions(+), 141 deletions(-) create mode 100644 icmp_flow.h -- 2.44.0

2 11

[PATCH v3 0/9] Add vhost-user support to passt (part 1)
by Laurent Vivier 08 Mar '24

08 Mar '24

v3: - add a patch that has been extracted from: "tcp: extract buffer management from tcp_send_flag()" -> "tcp: Introduce ipv4_fill_headers()/ipv6_fill_headers()" - see detailed v3 history log in each patch - I didn't address the alignment problem when we provide a pointer to a sub-structure in the internal buffer structure. (for the last patches of the series). v2 comparing to vhost-user full part: - part 1 includes only preliminary patches (checksum, iovec, cleanup) - see detailed v2 history log in each patch. Full series v1 available at: [PATCH 00/24] Add vhost-user support to passt. https://url.corp.redhat.com/passt-vhost-user-v1 Thanks, Laurent Laurent Vivier (9): iov: add some functions to manage iovec pcap: add pcap_iov() checksum: align buffers checksum: add csum_iov() util: move IP stuff from util.[ch] to ip.[ch] checksum: use csum_ip4_header() in udp.c and tcp.c checksum: introduce functions to compute the header part checksum for TCP/UDP tap: make tap_update_mac() generic tcp: Introduce ipv4_fill_headers()/ipv6_fill_headers() Makefile | 12 +-- checksum.c | 171 ++++++++++++++++++++++++++++++----------- checksum.h | 9 ++- conf.c | 1 + dhcp.c | 1 + flow.c | 1 + icmp.c | 1 + iov.c | 171 +++++++++++++++++++++++++++++++++++++++++ iov.h | 29 +++++++ ip.c | 72 +++++++++++++++++ ip.h | 86 +++++++++++++++++++++ ndp.c | 1 + pcap.c | 62 +++++++++++++-- pcap.h | 1 + port_fwd.c | 1 + qrap.c | 1 + tap.c | 14 ++-- tap.h | 2 +- tcp.c | 213 +++++++++++++++++++++++++++++---------------------- tcp_splice.c | 1 + udp.c | 35 +++------ util.c | 55 ------------- util.h | 76 ------------------ 23 files changed, 703 insertions(+), 313 deletions(-) create mode 100644 iov.c create mode 100644 iov.h create mode 100644 ip.c create mode 100644 ip.h -- 2.42.0

3 37

[PATCH v4 0/8] Add vhost-user support to passt (part 1)
by Laurent Vivier 03 Mar '24

03 Mar '24

v4: - rebase - see detailed v4 history log in each patch v3: - add a patch that has been extracted from: "tcp: extract buffer management from tcp_send_flag()" -> "tcp: Introduce ipv4_fill_headers()/ipv6_fill_headers()" - see detailed v3 history log in each patch - I didn't address the alignment problem when we provide a pointer to a sub-structure in the internal buffer structure. (for the last patches of the series). v2 comparing to vhost-user full part: - part 1 includes only preliminary patches (checksum, iovec, cleanup) - see detailed v2 history log in each patch. Full series v1 available at: [PATCH 00/24] Add vhost-user support to passt. https://url.corp.redhat.com/passt-vhost-user-v1 Thanks, Laurent Laurent Vivier (8): pcap: add pcap_iov() checksum: align buffers checksum: add csum_iov() util: move IP stuff from util.[ch] to ip.[ch] checksum: use csum_ip4_header() in udp.c and tcp.c checksum: introduce functions to compute the header part checksum for TCP/UDP tap: make tap_update_mac() generic tcp: Introduce ipv4_fill_headers()/ipv6_fill_headers() Makefile | 10 +-- checksum.c | 173 ++++++++++++++++++++++++++++++----------- checksum.h | 9 ++- conf.c | 1 + dhcp.c | 1 + flow.c | 1 + fwd.c | 1 + icmp.c | 1 + inany.c | 1 + ip.c | 72 +++++++++++++++++ ip.h | 86 +++++++++++++++++++++ ndp.c | 1 + pcap.c | 26 ++++++- pcap.h | 1 + qrap.c | 1 + tap.c | 14 ++-- tap.h | 2 +- tcp.c | 214 +++++++++++++++++++++++++++++---------------------- tcp_splice.c | 1 + udp.c | 38 ++++----- util.c | 55 ------------- util.h | 76 ------------------ 22 files changed, 475 insertions(+), 310 deletions(-) create mode 100644 ip.c create mode 100644 ip.h -- 2.42.0

2 16

[PATCH v2 0/7] Allow more use of iovecs in pcap and tap interfaces
by David Gibson 01 Mar '24

01 Mar '24

While working on other stuff I stumbled across some patches I wrote quite a while back (part of a larger series on indefinite hiatus). These make it easier to use the pcap and tap functions with frames that aren't in a single contiguous buffer. This overlaps with some of the work in Laurent's vhost-user series, so I've included the first of his patches and integrated it with my changes. There will The first two patches have some overlap with the preliminary iovec patches in the vhost-user series (and will certainly conflict). I do think the pcap interface here is slightly better than the one in the vhost-user series, although I did ack that. Stefano, if you've already applied / run tests for Laurent's series then go ahead with it; I'll rework this on top of those. Changes since v1: * Stefano correctly pointed out that my iov_offset() function was unclear in its naming and description. Rename it to iov_skip_bytes() and change the wording around it to improve this. * Incorporate Laurent's iov helper patch, and also use iov_skip_bytes() to slightly simplify its functions. * Fix commit message for write_remainder() so that it correctly describes handling "short writes", not "sort writes", whatever that might mean. * Adjust parameter names and descriptions for pcap_multiple() for clarity. David Gibson (6): iov: Add helper to find skip over first n bytes of an io vector pcap: Update pcap_frame() to take an iovec and offset util: Add write_remainder() helper pcap: Handle short writes in pcap_frame() pcap: Allow pcap_frame() and pcap_multiple() to take multi-buffer frames tap: Use write_remainder() in tap_send_frames_passt() Laurent Vivier (1): iov: add some functions to manage iovec Makefile | 8 +-- iov.c | 198 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ iov.h | 31 +++++++++ pcap.c | 56 ++++++++-------- pcap.h | 3 +- tap.c | 41 +++--------- util.c | 33 ++++++++++ util.h | 1 + 8 files changed, 307 insertions(+), 64 deletions(-) create mode 100644 iov.c create mode 100644 iov.h -- 2.43.2

2 11

[PATCH v3 00/20] More flow table preliminaries: address handling improvements
by David Gibson 29 Feb '24

29 Feb '24

Here's another batch of cleanups and tweaks in preparation for the flow table. This set focuses on improved helpers for handling addresses, particularly in the TCP splice path. Based on my other series adding more iovecs to the tap and pcap code, however the only conflicts should be trivial Makefile collisions. Changes since v2: * Minor stylistic and formatting changes based on review * Some clarifying changes to the theory of operation notes on flow lifecycle * Rebased on top of new series cleaning up socket pool error handling. This removes a couple of patches from this series. * Small edits to commit message for improved clarity Changes since v1: * Rebased, and reordered in a way I hope is clearer * Add patch to rename port_fwd.[ch] * Added doc comments to clarify flow life cycle * Added uniform logging of flow start / end to match that lifecycle * union inany_addr typed special address constants * inany based tests for unspecified and multicast addresses, as well as loopback * Dropped patch allowing NULL parameter to inany_from_af(), turned out not to be that useful * Dropped sockaddr_any_init function, turned out not to be very useful in that form * Added patch enforcing no loopback addresses on tap interface * Added logic to sanity check TCP endpoint addresses * Moved socket creation into tcp_splice_connect() * Moved epoll ref parsing into tcp_listen_handler() * Allowed IN4_IS_*() helpers to work on void * addresses David Gibson (20): inany: Helper to test for various address types inany: Add inany_ntop() helper inany: Provide more conveniently typed constants for special addresses inany: Introduce union sockaddr_inany util: Allow IN4_IS_* macros to operate on untyped addresses tcp, udp: Don't precompute port remappings in epoll references flow: Add helper to determine a flow's protocol tcp_splice: Simplify clean up logic tcp_splice: Don't use flow_trace() before setting flow type flow: Clarify flow entry life cycle, introduce uniform logging tcp_splice: More specific variable names in new splice path tcp_splice: Merge tcp_splice_new() into its caller tcp_splice: Make tcp_splice_connect() create its own sockets tcp_splice: Improve error reporting on connect path tcp_splice: Improve logic deciding when to splice tcp, tcp_splice: Parse listening socket epoll ref in tcp_listen_handler() tcp: Validate TCP endpoint addresses tap: Disallow loopback addresses on tap interface port_fwd: Fix copypasta error in port_fwd_scan_udp() comments fwd: Rename port_fwd.[ch] and their contents Makefile | 12 ++-- conf.c | 8 +-- flow.c | 84 ++++++++++++++++++++++- flow.h | 9 +++ port_fwd.c => fwd.c | 32 ++++----- port_fwd.h => fwd.h | 24 +++---- icmp.c | 18 ++--- inany.c | 50 ++++++++++++++ inany.h | 96 ++++++++++++++++++++++---- passt.h | 2 +- tap.c | 19 ++++++ tcp.c | 119 +++++++++++++++++++++++--------- tcp.h | 6 +- tcp_splice.c | 162 +++++++++++++++++++++++++------------------- tcp_splice.h | 7 +- udp.c | 32 +++++---- udp.h | 10 +-- util.h | 8 +-- 18 files changed, 502 insertions(+), 196 deletions(-) rename port_fwd.c => fwd.c (83%) rename port_fwd.h => fwd.h (62%) create mode 100644 inany.c -- 2.43.2

2 21

[PATCH 0/6] udp: Small cleanups
by David Gibson 29 Feb '24

29 Feb '24

Following on from the recent set of small fixes for UDP, here are a number of small cleanups to the UDP code, which will simplify later more complex fixes and improvements. Laurent, I expect this will have some conflicts with part 2 of your vhost-user work, sorry. David Gibson (6): udp: Refactor udp_sock[46]_iov_init() udp: Tweak interface to udp_update_hdr[46] udp: Clarify setting of addresses inin udp_update_hdr[46]() udp: Consistent port variable names in udp_update_hdr[46] udp: Avoid unnecessary pointer in udp_update_hdr4() udp: Clean up UDP checksum generation for inbound IPv6 packets udp.c | 235 +++++++++++++++++++++++++++------------------------------- 1 file changed, 108 insertions(+), 127 deletions(-) -- 2.44.0

1 6

[PATCH v2 0/5] Assorted small fixes for UDP
by David Gibson 29 Feb '24

29 Feb '24

Partly in looking at flow table support, partly for other reasons, I've spotted a number of small fixes that can be made to the UDP code (in addition to the large fixes I'm still working on). These are ready to go now, so here they are. They'll go before the flow related addressing cleanups. Changes since v1: * Removed patch to unconditionally remove ACT flags, which was Just Plain Wrong. * Removed patch to sort out incorrect handling of port flags. While there's a real bug there, it interacts with at least two more bugs that I hadn't spotted, complicating the picture. I'll fix those some other day. David Gibson (5): udp: Don't attempt to translate a 0.0.0.0 source address udp: Set pif in epoll reference for ephemeral host sockets udp: Small streamline to udp_update_hdr4() udp: Fix incorrect usage of IPv6 state in IPv4 path udp: Remove unnecessary test for unspecified addr_out udp.c | 39 ++++++++++++++++++++++----------------- 1 file changed, 22 insertions(+), 17 deletions(-) -- 2.43.2

2 6

[PATCH RESEND v2] Makefile: check for cppcheck's --check-level option in cppcheck target
by Stefano Brivio 28 Feb '24

28 Feb '24

Don't run cppcheck to find out if the --check-level=exhaustive option is available, unless we're actually going to run cppcheck later. To avoid this, move this check under the cppcheck target, and implement it in shell script instead of using Makefile directives, because we can't easily implement conditionals in recipes. Reported-by: Rahil Bhimjiani <me(a)rahil.rocks> Link: https://bugs.gentoo.org/920795 Fixes: 8640d62af719 ("cppcheck: Use "exhaustive" level checking when available") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> --- Re-send to/with the right address for Rahil (Gentoo maintainer) v2: Actually fetch the shell variable for cppcheck's command line Makefile | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Makefile b/Makefile index af4fa87..75f49dc 100644 --- a/Makefile +++ b/Makefile @@ -287,20 +287,20 @@ clang-tidy: $(SRCS) $(HEADERS) -config='{CheckOptions: [{key: bugprone-suspicious-string-compare.WarnOnImplicitComparison, value: "false"}]}' \ --warnings-as-errors=* $(SRCS) -- $(filter-out -pie,$(FLAGS) $(CFLAGS) $(CPPFLAGS)) -DCLANG_TIDY_58992 -CPPCHECK_EXHAUSTIVE := -ifeq ($(shell cppcheck --check-level=exhaustive /dev/null > /dev/null 2>&1; echo $$?),0) - CPPCHECK_EXHAUSTIVE += --check-level=exhaustive -endif - SYSTEM_INCLUDES := /usr/include $(wildcard /usr/include/$(TARGET)) ifeq ($(shell $(CC) -v 2>&1 | grep -c "gcc version"),1) VER := $(shell $(CC) -dumpversion) SYSTEM_INCLUDES += /usr/lib/gcc/$(TARGET)/$(VER)/include endif cppcheck: $(SRCS) $(HEADERS) + if cppcheck --check-level=exhaustive /dev/null > /dev/null 2>&1; then \ + CPPCHECK_EXHAUSTIVE="--check-level=exhaustive"; \ + else \ + CPPCHECK_EXHAUSTIVE=; \ + fi; \ cppcheck --std=c11 --error-exitcode=1 --enable=all --force \ --inconclusive --library=posix --quiet \ - $(CPPCHECK_EXHAUSTIVE) \ + $${CPPCHECK_EXHAUSTIVE} \ $(SYSTEM_INCLUDES:%=-I%) \ $(SYSTEM_INCLUDES:%=--config-exclude=%) \ $(SYSTEM_INCLUDES:%=--suppress=*:%/*) \ -- 2.39.2

1 0

[PATCH] conf: If no interface with a default route was found, say it
by Stefano Brivio 28 Feb '24

28 Feb '24

...instead of implying that by stating that there's no routable interface for a given IP version. There might be interfaces with non-default routes. Suggested-by: Paul Holzinger <pholzing(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/conf.c b/conf.c index 17cf279..fb77272 100644 --- a/conf.c +++ b/conf.c @@ -565,7 +565,7 @@ static unsigned int conf_ip4(unsigned int ifi, ifi = nl_get_ext_if(nl_sock, AF_INET); if (!ifi) { - info("No routable interface for IPv4: IPv4 is disabled"); + info("No interface with a default route for IPv4: disabling IPv4"); return 0; } @@ -637,7 +637,7 @@ static unsigned int conf_ip6(unsigned int ifi, ifi = nl_get_ext_if(nl_sock, AF_INET6); if (!ifi) { - info("No routable interface for IPv6: IPv6 is disabled"); + info("No interface with a default route for IPv6: disabling IPv6"); return 0; } -- 2.39.2

3 2