- dev - passt

[PATCH v5 00/13] Introduce multiple addresses and late binding
by Jon Maloy 10 Mar '26

10 Mar '26

This series adds handling of multiple addresses into a unified address array, so that a guest can see the same addresses on his own interface. o All addresses are stored as union inany_addr o User configured addresses are marked with a USER flag. o Host provided addresses are marked with a HOST flag. o Link local addresses are also marked with a LINKLOCAL flag. o Addresses the guest is actually using are marked with an OBSERVED flag. o The address selected for IPv4 DHCP offers is marked with a DHCP flag. We also include a commit to support late binding of interfaces, addresses, and routes. v2: - Added the earlier standalone CIDR commit to the head of the series. - Replaced the guest namespace interface subscriptions with just an address observation feature, so that it works with both PASTA and PASST. - Unified 'no_copy_addrs' and 'copy_addrs' code paths, as suggested by David G. - Multiple other changes, also based on feedback from David. - Removed the host interface subscription patches, -for now. I intend to re-add them once this series is applied. - Outstanding question: When do we add an IPv4 link local address to the guest? Only in local/opaque mode? Only when explicitly requested? Always? v3: - Unified the IPv4 and IPv6 arrays into one array - Changed prefix_len to always be in IPv6/IpV4 mapped format - Updated migration protocol to v3, handling multiple addresses - Many other smaller changes, based on feedback from the PASST team v4: - Numerous changes based on feedback - Added several new commits, mostly broken out of the pre-existing ones. v5: - Re-introduced multiple OBSERVED addresses. This actually turned out to be cleaner and with more predictable behaviour than allowing only one. - Included the DHCP and NDP patches from previous versions, improved and updated according to feedback from the team. - Likewise re-included the host-side netlink commit to support late binding. Jon Maloy (13): ip: Introduce unified multi-address data structures ip: Introduce for_each_addr() macro for address iteration fwd: Unify guest accessibility checks with unified address array arp: Check all configured addresses in ARP filtering netlink: Return prefix length for IPv6 addresses in nl_addr_get() conf: Allow multiple -a/--address options per address family ip: Track observed guest IPv4 addresses in unified address array ip: Track observed guest IPv6 addresses in unified address array migrate: Rename v1 address functions to v2 for clarity migrate: Update protocol to v3 for multi-address support dhcp, dhcpv6: Select addresses for DHCP distribution ndp: Support advertising multiple prefixes in Router Advertisement netlink: Add host-side monitoring for late template interface binding arp.c | 15 +- conf.c | 200 +++++++++++++++---------- conf.h | 9 ++ dhcp.c | 30 ++-- dhcp.h | 2 +- dhcpv6.c | 78 +++++++--- dhcpv6.h | 2 +- epoll_type.h | 2 + fwd.c | 263 +++++++++++++++++++++++++-------- fwd.h | 9 ++ inany.h | 3 + ip.h | 5 + isolation.c | 5 + migrate.c | 183 ++++++++++++++++++++--- ndp.c | 134 ++++++++++++----- netlink.c | 401 ++++++++++++++++++++++++++++++++++++++++++++++++++- netlink.h | 3 + passt.c | 5 + passt.h | 104 +++++++++++-- pasta.c | 39 +++-- tap.c | 67 ++++++--- 21 files changed, 1282 insertions(+), 277 deletions(-) -- 2.52.0

3 29

[PATCH v3] netlink: Return prefix length for IPv6 addresses in nl_addr_get()
by Jon Maloy 10 Mar '26

10 Mar '26

nl_addr_get() was not setting the prefix_len output parameter for IPv6 addresses, only for IPv4. This meant callers always got 0 for IPv6, forcing them to use a hardcoded default (64). Fix by assigning *prefix_len even in the IPv6 case. We also add another functional change. We now check for if an AF_INET address is link local, in which case we have to skip it. Although it is conventional to set the scope of such addresses to RT_SCOPE_LINK, this is not stated in any RFC, and we cannot trust it to have been set correctly by the user, just as we cannot trust it to have been set correctly for any other AF_INET address. We therefore add this check explicitly on the address itself. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: - Simplified according to feedback from S. Brivio - Added test for AF_INET link local property v3: - Corrected claim about convention for IPv4 link local address scope in commit log. --- netlink.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/netlink.c b/netlink.c index 82a2f0c..f0e8fa7 100644 --- a/netlink.c +++ b/netlink.c @@ -752,7 +752,7 @@ int nl_addr_set_ll_nodad(int s, unsigned int ifi) * @ifi: Interface index in outer network namespace * @af: Address family * @addr: Global address to fill - * @prefix_len: Mask or prefix length, to fill (for IPv4) + * @prefix_len: Mask or prefix length, to fill * @addr_l: Link-scoped address to fill (for IPv6) * * Return: 0 on success, negative error code on failure @@ -777,6 +777,7 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, nl_foreach_oftype(nh, status, s, buf, seq, RTM_NEWADDR) { struct ifaddrmsg *ifa = (struct ifaddrmsg *)NLMSG_DATA(nh); struct rtattr *rta; + bool link_local; size_t na; if (ifa->ifa_index != ifi || ifa->ifa_flags & IFA_F_DEPRECATED) @@ -788,18 +789,14 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, (af == AF_INET6 && rta->rta_type != IFA_ADDRESS)) continue; - if (af == AF_INET && ifa->ifa_prefixlen > prefix_max) { - memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); + link_local = (af == AF_INET6) ? + ifa->ifa_scope >= RT_SCOPE_LINK : + IN4_IS_ADDR_LINKLOCAL(RTA_DATA(rta)); - prefix_max = *prefix_len = ifa->ifa_prefixlen; - } else if (af == AF_INET6 && addr && - ifa->ifa_scope < RT_SCOPE_LINK && - ifa->ifa_prefixlen > prefix_max) { + if (ifa->ifa_prefixlen > prefix_max && !link_local) { memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); - - prefix_max = ifa->ifa_prefixlen; + prefix_max = *prefix_len = ifa->ifa_prefixlen; } - if (addr_l && af == AF_INET6 && ifa->ifa_scope == RT_SCOPE_LINK && ifa->ifa_prefixlen > prefix_max_ll) { -- 2.52.0

3 6

[PATCH v2] netlink: Return prefix length for IPv6 addresses in nl_addr_get()
by Jon Maloy 06 Mar '26

06 Mar '26

nl_addr_get() was not setting the prefix_len output parameter for IPv6 addresses, only for IPv4. This meant callers always got 0 for IPv6, forcing them to use a hardcoded default (64). Fix by assigning *prefix_len even in the IPv6 case. We also add another functional change. We now check for if an AF_INET address is link local, in which case we have to skip it. Although it is conventional to set the scope of such addresses to RT_SCOPE_HOST, this is not stated in any RFC, and we cannot trust it to have been set correctly by the user, just as we cannot trust it to have been set correctly for any other AF_INET address. We therefore add this check explicitly on the address itself. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: - Simplified according to feedback from S. Brivio - Added test fo AF_INET link local property --- netlink.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/netlink.c b/netlink.c index 82a2f0c..f0e8fa7 100644 --- a/netlink.c +++ b/netlink.c @@ -752,7 +752,7 @@ int nl_addr_set_ll_nodad(int s, unsigned int ifi) * @ifi: Interface index in outer network namespace * @af: Address family * @addr: Global address to fill - * @prefix_len: Mask or prefix length, to fill (for IPv4) + * @prefix_len: Mask or prefix length, to fill * @addr_l: Link-scoped address to fill (for IPv6) * * Return: 0 on success, negative error code on failure @@ -777,6 +777,7 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, nl_foreach_oftype(nh, status, s, buf, seq, RTM_NEWADDR) { struct ifaddrmsg *ifa = (struct ifaddrmsg *)NLMSG_DATA(nh); struct rtattr *rta; + bool link_local; size_t na; if (ifa->ifa_index != ifi || ifa->ifa_flags & IFA_F_DEPRECATED) @@ -788,18 +789,14 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, (af == AF_INET6 && rta->rta_type != IFA_ADDRESS)) continue; - if (af == AF_INET && ifa->ifa_prefixlen > prefix_max) { - memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); + link_local = (af == AF_INET6) ? + ifa->ifa_scope >= RT_SCOPE_LINK : + IN4_IS_ADDR_LINKLOCAL(RTA_DATA(rta)); - prefix_max = *prefix_len = ifa->ifa_prefixlen; - } else if (af == AF_INET6 && addr && - ifa->ifa_scope < RT_SCOPE_LINK && - ifa->ifa_prefixlen > prefix_max) { + if (ifa->ifa_prefixlen > prefix_max && !link_local) { memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); - - prefix_max = ifa->ifa_prefixlen; + prefix_max = *prefix_len = ifa->ifa_prefixlen; } - if (addr_l && af == AF_INET6 && ifa->ifa_scope == RT_SCOPE_LINK && ifa->ifa_prefixlen > prefix_max_ll) { -- 2.52.0

1 0

Pesto Protocol Proposals, imProved
by David Gibson 06 Mar '26

06 Mar '26

Stefano convinced me that my earlier proposal for the dynamic update protocol was unnecessarily complex. Plus, I saw a much better way of handling socket continuity in the context of a "whole table" replacement. So here's an entirely revised protocol suggestion. # Outline I suggest that each connection to the control socket handles a single transaction. 1. Server hello - Server sends magic number, version - Possibly feature flags / limits (e.g. max number of rules allowed) 2. Client hello - Client sends magic number - Do we need anything else? 3. Server lists pifs - Server sends the number of pifs, their indices and names 4. Server lists rules - Server sends the list of rules, one pif at a time 5. Client gives new rules - Client sends the new list of rules, one pif at a time - Server loads them into the shadow table, and validates (no socket operations) 6. Server acknowledges - Either reports an error and disconnects, or acks waiting for client 7. Client signals apply - Server swaps shadow and active tables, and syncs sockets with new active table 8. Server gives error summary - Server reports bind/listen/whatever errors 9a. Client signals commit - Shadow table (now the old table) discarded or 9b. Client signals rollback - Shadow and active tables swapped back, syncs sockets - Discard shadow table (now the "new" table again) - New bind error report? 10. Server closes control connection # Client disconnects A client disconnect before step (7) is straightforward: discard the shadow table, nothing has changed. A client disconnect between (7) and (9) triggers a rollback, same as (9b). # Error reporting Error reporting at step (6) is fairly straightforward: we can send an error code and/or an error message. Error reporting at (8) is trickier. As a first cut, we could just report "yes" or "no" - taking into account the FWD_WEAK flag. But the client might be able to make better decisions or at least better messages to the user if we report more detailed information. Exactly how detailed is an open question: number of bind failures? number of failures per rule? specific ports which failed? # Interim steps I propose these steps toward implementing this: i. Merge TCP and UDP rule tables. The protocol above assumes a single rule table per-pif, which I think is an easier model to understand and more extensible for future protocol support. ii. Read-only client. Implement steps (1) to (4). Client can query and list the current rules, but not change them. iii. Rule updates. Implement remaining protocol steps, but with a "close and re-open" approach on the server, so unaltered listening sockets might briefly disappear iv. Socket continuity. Have the socket sync "steal" sockets from the old table in preference to re-opening them. If you have any time to work on (ii) while I work on (i), those should be parallelizable. # Concurrent updates Server guarantees that a single transaction as above is atomic in the sense that nothing else is allowed to change the rules between (4) and (9). The easiest way to do that initially is probably to only allow a single client connection at a time. If there's a reason to, we could alter that so that concurrent connections are allowed, but if another client changed anything after step (4), then we give an error on the next op (or maybe just close the control socket from the server side). # Tweaks / variants - I'm not sure that step (2) is necessary - I'm not certain that step (7) is necessary, although I do kind of prefer the client getting a chance to see a "so far, so good" before any socket operations happen. -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

2 3

Pesto protocol proposals
by David Gibson 06 Mar '26

06 Mar '26

Most of today and yesterday I've spent thinking about the dynamic update model and protocol. I certainly don't have all the details pinned down, let alone any implementation, but I have come to some conclusions. # Shadow forward table On further consideration, I think this is a bad idea. To avoid peer visible disruption, we don't want to destroy and recreate listening sockets that are associated with a forward rule that's not being altered. Doing that with a shadow table would mean we'd need to essentially diff the two tables as we switch. That seems moderately complex, and kind of silly when then client almost certainly have created the shadow table using specific adds/removes from the original table. # Rule states / active bit I think we *do* still want two stage activation of new rules: if the first stage fails we're guaranteed we can roll back with no peer visible consequences. The second stage (the actual bind()s and listen()s) doesn't have that property, but that's unavoidable. To implement that, I think each rule should have an "active" bit. Or, at least an active bit - it's possible that might not be enough, but we could extend it to a state field, loosely analagous to the state field in flow table entries. But let's assume just the active bit, until/unless a case shows up where it's insufficient. Entries are always inserted in inactive state. Entries must be moved to inactive state before deletion. fwd_listen_sync() would ignore inactive entries. Turning the active flag on triggers the actual bind() / listen() calls, but requires no rearrangement of the fwd table or socket array. Turning it off close()s the associated sockets, but again requires no rearrangement of the data structures. # Tentative client operations ## INSERT Parameters: rule specification + rule index Returns: error status Inserts the new rule (inactive) at the given index (moving later rules, if necessary). Fails with no effect, for a bad index or if there's no room in the table or socket array. Does *not* check for conflicts with other rules. NOTE: moving rules could mean thousands of epoll_ctl() calls to adjust rule indices. We don't expect those to fail, but if they did, what do we do? ## DELETE Parameters: rule index Returns: error status Deletes the given inactive rule (moving later rules, if necessary). Fails with no effect if it's a bad index, or the given rule is active. NOTE: As for INSERT ## ACTIVATE Parameters: rule index Returns: error status Enables the rule, bind()ing all the necessary listening sockets. Fails with no effect if the rule conflicts with another active rule. Completes, even if some bind()s fail (see later for handling of this). ## DEACTIVATE Parameters: rule index Returns: error status Disables the rule, close()ing any listening sockets. Fails with no effect for bad index or an already inactive rule. ## STATUS Parameters: rule index Returns: active/inactive bit + possible metadata Indicates whether the rule is currently active. Could also give limited metadata about the rule (see below for possible use in bind() error reporting). ## READ Parameters: rule index Returns: rule specification, or error code Reads out the rule spec and returns it. Fails for bad index. To dump the whole table, the client can READ each slot starting from 0, until it gets an error. # Suggested client workflow I suggest the client should: 1. Parse all rule modifications 2. INSERT all new rules -> On error, DELETE them again 3. DEACTIVATE all removed rules -> Should only fail if the client has done something wrong 4. ACTIVATE all new rules -> On error (rule conflict): DEACTIVATE rules we already ACTIVATEd ACTIVATE rules we already DEACTIVATEd DELETE rules we INSERTed 5. Check for bind errors (see details later) If there are failures we can't tolerate: DEACTIVATE rules we already ACTIVATEd ACTIVATE rules we already DEACTIVATEd DELETE rules we INSERTed 6. DELETE rules we DEACTIVATEd -> Should only fail if the client has done something wrong DEACTIVATE comes before ACTIVATE to avoid spurious conflicts between new rules and rules we're deleting. I think that gets us closeish to "as atomic as we can be", at least from the perspective of peers. The main case it doesn't catch is that we don't detect rule conflicts until after we might have removed some rules. Is that good enough? # Bind error handling Note, in the below I'm considering pasta/passt's command line handling and conf path as a client rather than part of the backend. The distinction weak and non-weak entries is a bit clunky. How many failures is too many is kind of a question for the client, not the backend. So I'm suggesting we remove that concept from the backend. ACTIVATE completes even if some or all binds fail. However, we keep a count of how many sockets we got a bind() or listen() failure for in the rule, and it can be retrieved with STATUS. That lets the client make a decision as to whether to live with it or roll back as best it can. A client could also potentially poll later to see if some failures resolved themselves (we now reattempt bind()s on every fwd_listen_sync()). NOTE: the meaning of that count is pretty straightforward with regular rules, but with SCAN rules, we'd have to be more careful. # Concurrent updates I suggest we prevent concurrent updates by only allowing one client to connect to the control socket at a time. # Possible tweaks Not sure if these are improvements or not, but they're options to consider. ## Rule conflicts Currently fwd_rule_add() checks for rules with conflicts and rejects them. We can't really report that at INSERT, because we could get a bogus conflict with a rule we intend to DEACTIVATE/DELETE. But reporting at ACTIVATE is also a bit clunky. This could potentially be sidestepped by removing the notion of rule conflicts entirely. Instead overlapping rules are simply allowed, and the first rule to match a flow wins. ## Rollback in backend The proposal above has rollback essentially handled by the client. We could instead do it in the backend. - Instead of a single active bit, each rule has an "active now" and "active future" bit - On client connect, all active future bits are set equal to active now bits - INSERT adds a rule with active now false and active future true - If we conflict check, we check only against active future rules - DELETE clears the active future bit - ACTIVATE/DEACTIVATE no longer exist - ROLLBACK deletes all !active now rules and sets active future bits to active now bits again - COMMIT does the bind()s and close()s and on success, sets active now bits to active future bits. On failure... it's fairly complex, we'd need to think about it ## Persistent rule IDs Proposal above uses raw indices in the table to identify rules, which means INSERT and DELETE change the numbers of other rules. That in turn requires a bunch of epoll_ctl()s to update existing sockets. Here's one way we could avoid some of that with a persistent rule ID: - Each rule has an ID (say a u32), supplied by the client at INSERT - Rules still apply in ID order, so the order matters, but not the exact values - INSERT to an existing rule ID is not permitted - you must DELETE first Internally we still store the table packed, but sorted by ID. We could look up rule by ID either with a binary search, or maybe a radix lookup table. If we reduced the ID to a u16 (or so) we could potentially use a single level lookup table. I suspect binary search might be faster than a lookup table anyway, because of dcache impact. So, we still to memmove() things about for INSERT, and maybe update the lookup table, but that's relatively easy. epoll data holds the persistent ID, so that doesn't need to be altered. Clients (including the internal conf path) could choose to leave gaps in the IDs to leave space for future inserts. And/or certain ranges could be reserved by convention for different purposes. -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

2 4

[PATCH] tcp: Avoid comparison of expressions with different signedness in RTT_SET()
by Stefano Brivio 06 Mar '26

06 Mar '26

With gcc 14.2, building against musl 1.2.5 (slightly outdated Alpine on x86_64): tcp.c: In function 'tcp_update_seqack_wnd': util.h:40:39: warning: comparison of integer expressions of different signedness: 'unsigned int' and 'int' [-Wsign-compare] 40 | #define MIN(x, y) (((x) < (y)) ? (x) : (y)) | ^ tcp_conn.h:63:26: note: in expansion of macro 'MIN' 63 | (conn->rtt_exp = MIN(RTT_EXP_MAX, ilog2(MAX(1, rtt / RTT_STORE_MIN)))) | ^~~ tcp.c:1234:17: note: in expansion of macro 'RTT_SET' 1234 | RTT_SET(conn, tinfo->tcpi_rtt); | ^~~~~~~ util.h:40:54: warning: operand of '?:' changes signedness from 'int' to 'unsigned int' due to unsignedness of other operand [-Wsign-compare] 40 | #define MIN(x, y) (((x) < (y)) ? (x) : (y)) | ^~~ tcp_conn.h:63:26: note: in expansion of macro 'MIN' 63 | (conn->rtt_exp = MIN(RTT_EXP_MAX, ilog2(MAX(1, rtt / RTT_STORE_MIN)))) | ^~~ tcp.c:1234:17: note: in expansion of macro 'RTT_SET' 1234 | RTT_SET(conn, tinfo->tcpi_rtt); | ^~~~~~~ for some reason, that's not reported by gcc with glibc. Cast the result of ilog2() to unsigned before using it, as it's always positive the way we're using it. Should this ever break this for whatever unlikely reason, RTT_EXP_MAX is the fallback value we want to use anyway. Fixes: 000601ba86da ("tcp: Adaptive interval based on RTT for socket-side acknowledgement checks") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tcp_conn.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tcp_conn.h b/tcp_conn.h index b7b85c1..6418ac4 100644 --- a/tcp_conn.h +++ b/tcp_conn.h @@ -60,7 +60,8 @@ struct tcp_tap_conn { #define RTT_STORE_MIN 100 /* us, minimum representable */ #define RTT_STORE_MAX ((long)(RTT_STORE_MIN << RTT_EXP_MAX)) #define RTT_SET(conn, rtt) \ - (conn->rtt_exp = MIN(RTT_EXP_MAX, ilog2(MAX(1, rtt / RTT_STORE_MIN)))) + (conn->rtt_exp = MIN(RTT_EXP_MAX, \ + (unsigned)ilog2(MAX(1, rtt / RTT_STORE_MIN)))) #define RTT_GET(conn) (RTT_STORE_MIN << conn->rtt_exp) bool tap_inactive :1; -- 2.43.0

2 3

[PATCH v2] tcp: Avoid comparison of expressions with different signedness in RTT_SET()
by Stefano Brivio 06 Mar '26

06 Mar '26

With gcc 14.2, building against musl 1.2.5 (slightly outdated Alpine on x86_64): tcp.c: In function 'tcp_update_seqack_wnd': util.h:40:39: warning: comparison of integer expressions of different signedness: 'unsigned int' and 'int' [-Wsign-compare] 40 | #define MIN(x, y) (((x) < (y)) ? (x) : (y)) | ^ tcp_conn.h:63:26: note: in expansion of macro 'MIN' 63 | (conn->rtt_exp = MIN(RTT_EXP_MAX, ilog2(MAX(1, rtt / RTT_STORE_MIN)))) | ^~~ tcp.c:1234:17: note: in expansion of macro 'RTT_SET' 1234 | RTT_SET(conn, tinfo->tcpi_rtt); | ^~~~~~~ util.h:40:54: warning: operand of '?:' changes signedness from 'int' to 'unsigned int' due to unsignedness of other operand [-Wsign-compare] 40 | #define MIN(x, y) (((x) < (y)) ? (x) : (y)) | ^~~ tcp_conn.h:63:26: note: in expansion of macro 'MIN' 63 | (conn->rtt_exp = MIN(RTT_EXP_MAX, ilog2(MAX(1, rtt / RTT_STORE_MIN)))) | ^~~ tcp.c:1234:17: note: in expansion of macro 'RTT_SET' 1234 | RTT_SET(conn, tinfo->tcpi_rtt); | ^~~~~~~ for some reason, that's not reported by gcc with glibc. Cast the result of ilog2() to unsigned before using it, and introduce 0 as lower bound, to make it obvious that we expect the argument to be always valid, the way we're using it. Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Fixes: 000601ba86da ("tcp: Adaptive interval based on RTT for socket-side acknowledgement checks") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: Apply lower bound to the result of ilog2() instead of its argument, as suggested by David tcp_conn.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tcp_conn.h b/tcp_conn.h index b7b85c1..6985426 100644 --- a/tcp_conn.h +++ b/tcp_conn.h @@ -60,7 +60,8 @@ struct tcp_tap_conn { #define RTT_STORE_MIN 100 /* us, minimum representable */ #define RTT_STORE_MAX ((long)(RTT_STORE_MIN << RTT_EXP_MAX)) #define RTT_SET(conn, rtt) \ - (conn->rtt_exp = MIN(RTT_EXP_MAX, ilog2(MAX(1, rtt / RTT_STORE_MIN)))) + (conn->rtt_exp = MIN(RTT_EXP_MAX, \ + (unsigned)MAX(0, ilog2(rtt / RTT_STORE_MIN)))) #define RTT_GET(conn) (RTT_STORE_MIN << conn->rtt_exp) bool tap_inactive :1; -- 2.43.0

2 1

[PATCH v3] iov: Add iov_truncate() helper and use it in vu handlers
by Laurent Vivier 06 Mar '26

06 Mar '26

Add a generic iov_truncate() function that truncates an IO vector to a given number of bytes, returning the number of iov entries that contain data after truncation. Use it in udp_vu_sock_recv() and tcp_vu_sock_recv() to replace the open-coded truncation logic that adjusted iov entries after recvmsg(). Also convert the direct iov_len assignment in tcp_vu_send_flag() to use iov_truncate() for consistency. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- Notes: v3: use in tcp_vu_send_flag() too v2: use iov_truncate() in udp_vu_sock_recv() too iov.c | 22 ++++++++++++++++++++++ iov.h | 1 + tcp_vu.c | 14 +++----------- udp_vu.c | 12 +++--------- 4 files changed, 29 insertions(+), 20 deletions(-) diff --git a/iov.c b/iov.c index ad726daa4cd8..31a3f5bc29e5 100644 --- a/iov.c +++ b/iov.c @@ -147,6 +147,28 @@ size_t iov_size(const struct iovec *iov, size_t iov_cnt) return len; } +/** + * iov_truncate() - Truncate an IO vector to a given number of bytes + * @iov: IO vector (modified) + * @iov_cnt: Number of entries in @iov + * @size: Total number of bytes to keep + * + * Return: number of iov entries that contain data after truncation + */ +size_t iov_truncate(struct iovec *iov, size_t iov_cnt, size_t size) +{ + size_t i, offset; + + i = iov_skip_bytes(iov, iov_cnt, size, &offset); + + if (i < iov_cnt) { + iov[i].iov_len = offset; + i += !!offset; + } + + return i; +} + /** * iov_tail_prune() - Remove any unneeded buffers from an IOV tail * @tail: IO vector tail (modified) diff --git a/iov.h b/iov.h index d1ab91a94e22..b4e50b0fca5a 100644 --- a/iov.h +++ b/iov.h @@ -29,6 +29,7 @@ size_t iov_from_buf(const struct iovec *iov, size_t iov_cnt, size_t iov_to_buf(const struct iovec *iov, size_t iov_cnt, size_t offset, void *buf, size_t bytes); size_t iov_size(const struct iovec *iov, size_t iov_cnt); +size_t iov_truncate(struct iovec *iov, size_t iov_cnt, size_t size); /* * DOC: Theory of Operation, struct iov_tail diff --git a/tcp_vu.c b/tcp_vu.c index 88be232dca66..8ca4170f13f6 100644 --- a/tcp_vu.c +++ b/tcp_vu.c @@ -131,7 +131,7 @@ int tcp_vu_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags) return ret; } - flags_elem[0].in_sg[0].iov_len = hdrlen + optlen; + iov_truncate(&flags_iov[0], 1, hdrlen + optlen); payload = IOV_TAIL(flags_elem[0].in_sg, 1, hdrlen); if (flags & KEEPALIVE) @@ -192,9 +192,9 @@ static ssize_t tcp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, struct msghdr mh_sock = { 0 }; uint16_t mss = MSS_GET(conn); int s = conn->sock; - ssize_t ret, len; size_t hdrlen; int elem_cnt; + ssize_t ret; int i; *iov_cnt = 0; @@ -247,15 +247,7 @@ static ssize_t tcp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, ret -= already_sent; /* adjust iov number and length of the last iov */ - len = ret; - for (i = 0; len && i < elem_cnt; i++) { - struct iovec *iov = &elem[i].in_sg[0]; - - if (iov->iov_len > (size_t)len) - iov->iov_len = len; - - len -= iov->iov_len; - } + i = iov_truncate(&iov_vu[DISCARD_IOV_NUM], elem_cnt, ret); /* adjust head count */ while (*head_cnt > 0 && head[*head_cnt - 1] >= i) diff --git a/udp_vu.c b/udp_vu.c index 3520f89e5671..5effca777e0a 100644 --- a/udp_vu.c +++ b/udp_vu.c @@ -71,9 +71,9 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, bool v6, ssize_t *dlen) { const struct vu_dev *vdev = c->vdev; - int iov_cnt, idx, iov_used; - size_t off, hdrlen, l2len; struct msghdr msg = { 0 }; + int iov_cnt, iov_used; + size_t hdrlen, l2len; ASSERT(!c->no_udp); @@ -115,13 +115,7 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, iov_vu[0].iov_base = (char *)iov_vu[0].iov_base - hdrlen; iov_vu[0].iov_len += hdrlen; - /* count the numbers of buffer filled by recvmsg() */ - idx = iov_skip_bytes(iov_vu, iov_cnt, *dlen + hdrlen, &off); - - /* adjust last iov length */ - if (idx < iov_cnt) - iov_vu[idx].iov_len = off; - iov_used = idx + !!off; + iov_used = iov_truncate(iov_vu, iov_cnt, *dlen + hdrlen); /* pad frame to 60 bytes: first buffer is at least ETH_ZLEN long */ l2len = *dlen + hdrlen - VNET_HLEN; -- 2.53.0

3 9

[PATCH v2] iov: Add iov_truncate() helper and use it in vu handlers
by Laurent Vivier 05 Mar '26

05 Mar '26

Add a generic iov_truncate() function that truncates an IO vector to a given number of bytes, returning the number of iov entries that contain data after truncation. Use it in udp_vu_sock_recv() and tcp_vu_sock_recv() to replace the open-coded truncation logic that adjusted iov entries after recvmsg(). Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- Notes: v2: use iov_truncate() in udp_vu_sock_recv() too iov.c | 22 ++++++++++++++++++++++ iov.h | 1 + tcp_vu.c | 12 ++---------- udp_vu.c | 12 +++--------- 4 files changed, 28 insertions(+), 19 deletions(-) diff --git a/iov.c b/iov.c index ad726daa4cd8..31a3f5bc29e5 100644 --- a/iov.c +++ b/iov.c @@ -147,6 +147,28 @@ size_t iov_size(const struct iovec *iov, size_t iov_cnt) return len; } +/** + * iov_truncate() - Truncate an IO vector to a given number of bytes + * @iov: IO vector (modified) + * @iov_cnt: Number of entries in @iov + * @size: Total number of bytes to keep + * + * Return: number of iov entries that contain data after truncation + */ +size_t iov_truncate(struct iovec *iov, size_t iov_cnt, size_t size) +{ + size_t i, offset; + + i = iov_skip_bytes(iov, iov_cnt, size, &offset); + + if (i < iov_cnt) { + iov[i].iov_len = offset; + i += !!offset; + } + + return i; +} + /** * iov_tail_prune() - Remove any unneeded buffers from an IOV tail * @tail: IO vector tail (modified) diff --git a/iov.h b/iov.h index d1ab91a94e22..b4e50b0fca5a 100644 --- a/iov.h +++ b/iov.h @@ -29,6 +29,7 @@ size_t iov_from_buf(const struct iovec *iov, size_t iov_cnt, size_t iov_to_buf(const struct iovec *iov, size_t iov_cnt, size_t offset, void *buf, size_t bytes); size_t iov_size(const struct iovec *iov, size_t iov_cnt); +size_t iov_truncate(struct iovec *iov, size_t iov_cnt, size_t size); /* * DOC: Theory of Operation, struct iov_tail diff --git a/tcp_vu.c b/tcp_vu.c index 88be232dca66..15405a26c7c3 100644 --- a/tcp_vu.c +++ b/tcp_vu.c @@ -192,9 +192,9 @@ static ssize_t tcp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, struct msghdr mh_sock = { 0 }; uint16_t mss = MSS_GET(conn); int s = conn->sock; - ssize_t ret, len; size_t hdrlen; int elem_cnt; + ssize_t ret; int i; *iov_cnt = 0; @@ -247,15 +247,7 @@ static ssize_t tcp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, ret -= already_sent; /* adjust iov number and length of the last iov */ - len = ret; - for (i = 0; len && i < elem_cnt; i++) { - struct iovec *iov = &elem[i].in_sg[0]; - - if (iov->iov_len > (size_t)len) - iov->iov_len = len; - - len -= iov->iov_len; - } + i = iov_truncate(&iov_vu[DISCARD_IOV_NUM], elem_cnt, ret); /* adjust head count */ while (*head_cnt > 0 && head[*head_cnt - 1] >= i) diff --git a/udp_vu.c b/udp_vu.c index 3520f89e5671..5effca777e0a 100644 --- a/udp_vu.c +++ b/udp_vu.c @@ -71,9 +71,9 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, bool v6, ssize_t *dlen) { const struct vu_dev *vdev = c->vdev; - int iov_cnt, idx, iov_used; - size_t off, hdrlen, l2len; struct msghdr msg = { 0 }; + int iov_cnt, iov_used; + size_t hdrlen, l2len; ASSERT(!c->no_udp); @@ -115,13 +115,7 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, iov_vu[0].iov_base = (char *)iov_vu[0].iov_base - hdrlen; iov_vu[0].iov_len += hdrlen; - /* count the numbers of buffer filled by recvmsg() */ - idx = iov_skip_bytes(iov_vu, iov_cnt, *dlen + hdrlen, &off); - - /* adjust last iov length */ - if (idx < iov_cnt) - iov_vu[idx].iov_len = off; - iov_used = idx + !!off; + iov_used = iov_truncate(iov_vu, iov_cnt, *dlen + hdrlen); /* pad frame to 60 bytes: first buffer is at least ETH_ZLEN long */ l2len = *dlen + hdrlen - VNET_HLEN; -- 2.53.0

1 0

[PATCH] tcp: Avoid comparison of expressions with different signedness in tcp_timer_handler()
by Stefano Brivio 05 Mar '26

05 Mar '26

With gcc 14.2, building against musl 1.2.5 (slightly outdated Alpine on x86_64): tcp.c: In function 'tcp_timer_handler': util.h:40:39: warning: comparison of integer expressions of different signedness: 'unsigned int' and 'int' [-Wsign-compare] 40 | #define MIN(x, y) (((x) < (y)) ? (x) : (y)) | ^ tcp.c:2593:31: note: in expansion of macro 'MIN' 2593 | max = MIN(TCP_MAX_RETRIES, max); | ^~~ util.h:40:54: warning: operand of '?:' changes signedness from 'int' to 'unsigned int' due to unsignedness of other operand [-Wsign-compare] 40 | #define MIN(x, y) (((x) < (y)) ? (x) : (y)) | ^~~ tcp.c:2593:31: note: in expansion of macro 'MIN' 2593 | max = MIN(TCP_MAX_RETRIES, max); | ^~~ for some reason, that's not reported by gcc with glibc. Make the temporary 'max' variable unsigned, as we know it can't be negative anyway. While at it, add the customary blank line between variable declarations and code. Fixes: 3dde0e07804e ("tcp: Update data retransmission timeout") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tcp.c b/tcp.c index 88ad886..68c92da 100644 --- a/tcp.c +++ b/tcp.c @@ -2588,7 +2588,8 @@ void tcp_timer_handler(const struct ctx *c, union epoll_ref ref) tcp_timer_ctl(c, conn); } else if (conn->flags & ACK_FROM_TAP_DUE) { if (!(conn->events & ESTABLISHED)) { - int max; + unsigned int max; + max = c->tcp.syn_retries + c->tcp.syn_linear_timeouts; max = MIN(TCP_MAX_RETRIES, max); if (conn->retries >= max) { -- 2.43.0

2 1