- dev - passt

[PATCH 0/5] Add vhost-user support to passt. (part 3)
by Laurent Vivier 15 Jul '24

15 Jul '24

This series of patches adds vhost-user support to passt and then allows passt to connect to QEMU network backend using virtqueue rather than a socket. With QEMU, rather than using to connect: -netdev stream,id=s,server=off,addr.type=unix,addr.path=/tmp/passt_1.socket we will use: -chardev socket,id=chr0,path=/tmp/passt_1.socket -netdev vhost-user,id=netdev0,chardev=chr0 -device virtio-net,netdev=netdev0 -object memory-backend-memfd,id=memfd0,share=on,size=$RAMSIZE -numa node,memdev=memfd0 The memory backend is needed to share data between passt and QEMU. Performance comparison between "-netdev stream" and "-netdev vhost-user": $ iperf3 -c localhost -p 10001 -t 60 -6 -u -b 50G socket: [ 5] 0.00-60.05 sec 95.6 GBytes 13.7 Gbits/sec 0.017 ms 6998988/10132413 (69%) receiver vhost-user: [ 5] 0.00-60.04 sec 237 GBytes 33.9 Gbits/sec 0.006 ms 53673/7813770 (0.69%) receiver $ iperf3 -c localhost -p 10001 -t 60 -4 -u -b 50G socket: [ 5] 0.00-60.05 sec 98.9 GBytes 14.1 Gbits/sec 0.018 ms 6260735/9501832 (66%) receiver vhost-user: [ 5] 0.00-60.05 sec 235 GBytes 33.7 Gbits/sec 0.008 ms 37581/7752699 (0.48%) receiver $ iperf3 -c localhost -p 10001 -t 60 -6 socket: [ 5] 0.00-60.00 sec 17.3 GBytes 2.48 Gbits/sec 0 sender [ 5] 0.00-60.06 sec 17.3 GBytes 2.48 Gbits/sec receiver vhost-user: [ 5] 0.00-60.00 sec 191 GBytes 27.4 Gbits/sec 0 sender [ 5] 0.00-60.05 sec 191 GBytes 27.3 Gbits/sec receiver $ iperf3 -c localhost -p 10001 -t 60 -4 socket: [ 5] 0.00-60.00 sec 15.6 GBytes 2.24 Gbits/sec 0 sender [ 5] 0.00-60.06 sec 15.6 GBytes 2.24 Gbits/sec receiver vhost-user: [ 5] 0.00-60.00 sec 189 GBytes 27.1 Gbits/sec 0 sender [ 5] 0.00-60.04 sec 189 GBytes 27.0 Gbits/sec receiver Laurent Vivier (5): packet: replace struct desc by struct iovec vhost-user: introduce virtio API vhost-user: introduce vhost-user API iov: add iov_count() vhost-user: add vhost-user Makefile | 4 +- checksum.c | 1 - conf.c | 18 +- iov.c | 35 +- iov.h | 2 + packet.c | 81 ++-- packet.h | 16 +- passt.c | 14 +- passt.h | 10 + pcap.c | 1 - tap.c | 106 ++++- tap.h | 5 +- tcp.c | 17 +- tcp_vu.c | 547 ++++++++++++++++++++++++ tcp_vu.h | 9 + udp.c | 54 ++- udp_internal.h | 39 ++ udp_vu.c | 237 +++++++++++ udp_vu.h | 8 + util.h | 11 + vhost_user.c | 1077 ++++++++++++++++++++++++++++++++++++++++++++++++ vhost_user.h | 137 ++++++ virtio.c | 442 ++++++++++++++++++++ virtio.h | 122 ++++++ 24 files changed, 2886 insertions(+), 107 deletions(-) create mode 100644 tcp_vu.c create mode 100644 tcp_vu.h create mode 100644 udp_internal.h create mode 100644 udp_vu.c create mode 100644 udp_vu.h create mode 100644 vhost_user.c create mode 100644 vhost_user.h create mode 100644 virtio.c create mode 100644 virtio.h -- 2.45.2

2 18

[PATCH v8 0/2] Add support for SO_PEEK_OFF
by Jon Maloy 12 Jul '24

12 Jul '24

We add support for the SO_PEEK_OFF option, plus work around a kernel bug discovered along the way. v8: Added better solution to the work-around. Jon Maloy (2): tcp: leverage support of SO_PEEK_OFF socket option when available tcp: handle shrunk window advertisemenst from guest tcp.c | 40 +++++++++++++++++++++++++++++++++++++++- tcp.h | 3 +++ tcp_buf.c | 22 ++++++++++++++++------ 3 files changed, 58 insertions(+), 7 deletions(-) -- 2.45.2

2 4

[PATCH 0/4] Small, assorted "hardening" fixes
by Stefano Brivio 08 Jul '24

08 Jul '24

All harmless issues as far as I can tell, but nice to fix. Stefano Brivio (4): conf: Copy up to MAXDNSRCH - 1 bytes, not MAXDNSRCH tcp_splice: Check return value of setsockopt() for SO_RCVLOWAT util, lineread, tap: Overflow checks on long signed sums and subtractions tap: Drop frames from guest whose length is more than remaining buffer conf.c | 2 +- lineread.c | 5 +++-- tap.c | 24 ++++++++++++++++++------ tcp_splice.c | 15 ++++++++++----- util.c | 7 +++++-- util.h | 46 +++++++++++++++++++++++++++++++++++++++++++++- 6 files changed, 82 insertions(+), 17 deletions(-) -- 2.43.0

2 20

Avocado, passt, etc.
by David Gibson 05 Jul '24

05 Jul '24

Hi again, Following on on your specific patch, I've done a little bit more thinking on how we might want to use Avocado for more extensive testing. I think I mentioned during some of our calls my idea of having some sort of test side library to automatically turn test code into executables that can be used from Avocado's extended exec stuff. I don't think I explained it very clearly though. I've made a super rudimentary draft of this idea here: https://gitlab.com/dgibson/exeter The "example.py" program, run without arguments lists all the ways you can run it, each of which constitutes a single test case. The idea is that that "list" mode would be extended to generate the json manifest that Avocado can consume. So first you run it to generate the json, then you feed that into avocado which will run each of the cases as a separate test. Ideally avocado could do both steps itself (this is what I was talking about with the "variant 2" of the extended exec stuff). But we can do it externally for the time being. Having things separated this way makes it super easy to manually re-run a specific test case. We can also allow the same library to emit the list of tests in other formats for other runners (being able to do this for meson seems like it might be pretty useful). Obviously, it would need a bunch more functionality to be really useful: ways of automatically generating matrices of tests, composing functions together to make test cases, as well as basic helper functions like assert variants. -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

1 0

[PATCH 00/11] Preliminaries for UDP flow support
by David Gibson 05 Jul '24

05 Jul '24

The redesign of UDP flows required (or at least, suggested) a new batch of prelininary changes that don't rely on the core of the flow table rework. David Gibson (11): util: sock_l4() determine protocol from epoll type rather than the reverse flow: Add flow_sidx_valid() helper udp: Pass full epoll reference through more of sock handler path udp: Rename IOV and mmsghdr arrays udp: Unify udp[46]_mh_splice udp: Unify udp[46]_l2_iov udp: Don't repeatedly initialise udp[46]_eth_hdr udp: Move some more of sock_handler tasks into sub-functions udp: Consolidate datagram batching contrib: Add program to document and test assumptions about SO_REUSEADDR contrib: Test behaviour of zero length datagram recv()s contrib/udp-behaviour/.gitignore | 2 + contrib/udp-behaviour/Makefile | 45 +++ contrib/udp-behaviour/common.c | 66 ++++ contrib/udp-behaviour/common.h | 47 +++ contrib/udp-behaviour/recv-zero.c | 74 +++++ contrib/udp-behaviour/reuseaddr-priority.c | 240 ++++++++++++++ epoll_type.h | 41 +++ flow.h | 11 + flow_table.h | 2 +- icmp.c | 2 +- passt.h | 32 -- tcp.c | 17 +- udp.c | 361 ++++++++++----------- util.c | 48 +-- util.h | 3 +- 15 files changed, 735 insertions(+), 256 deletions(-) create mode 100644 contrib/udp-behaviour/.gitignore create mode 100644 contrib/udp-behaviour/Makefile create mode 100644 contrib/udp-behaviour/common.c create mode 100644 contrib/udp-behaviour/common.h create mode 100644 contrib/udp-behaviour/recv-zero.c create mode 100644 contrib/udp-behaviour/reuseaddr-priority.c create mode 100644 epoll_type.h -- 2.45.2

2 23

[PATCH v2 0/5] Small, assorted "hardening" fixes
by Stefano Brivio 02 Jul '24

02 Jul '24

All harmless issues as far as I can tell, but nice to fix. v2: - in 3/5: - keep 'skip' in write_remainder() unsigned, and check for unsigned overflow instead - refactor sadd_overflow() and ssub_overflow() to use built-ins with automatic types, take ssize_t arguments, and deal with different ssize_t type widths - in 4/5: - switch l2len in tap_handler_passt() to uint32_t, as it really is unsigned and 32-bit wide - return if the length descriptor mismatches, instead of trying to proceed to the next frame - add 5/5 Stefano Brivio (5): conf: Copy up to MAXDNSRCH - 1 bytes, not MAXDNSRCH tcp_splice: Check return value of setsockopt() for SO_RCVLOWAT util, lineread, tap: Overflow checks on long signed sums and subtractions tap: Discard guest data on length descriptor mismatch conf: Use the right maximum buffer size for c->sock_path conf.c | 4 ++-- lineread.c | 5 +++-- tap.c | 31 +++++++++++++++++++---------- tcp_splice.c | 15 +++++++++----- util.c | 5 +++++ util.h | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 96 insertions(+), 19 deletions(-) -- 2.43.0

2 7

[PATCH v6 00/26] RFC: Unified flow table
by David Gibson 27 Jun '24

27 Jun '24

This is a sixth draft of an implementation of more general "connection" tracking, as described at: https://pad.passt.top/p/NewForwardingModel This series changes the TCP connection table and hash table into a more general flow table that can track other protocols as well. Each flow uniformly keeps track of all the relevant addresses and ports, which will allow for more robust control of NAT and port forwarding. ICMP and UDP are converted to use the new flow table. This is based on the most recent series of flowtable preliminaries. NOTE: this fails the pasta UDP perf tests. This is one aspect of a curly issue I'm not sure how to deail with yet. So, this isn't ready for merge yet, but I'm posting because there have been a *lot* of changes since v5, and it could do with another round of review, Other caveats: * We roughly double the size of a connection/flow entry * UDP still has a number of forwarding bugs because we don't consider the local address when looking for a socket to use. There are at least some FIXMEs noted for this. Changes since v5: * flowside_from_af() is now static * Small fixes to state verification * Pass protocol specific types into deferred/timer callbacks * No longer require complete forwarding address info for the hash table (we won't have it for UDP) * Fix bugs with logging of flow addresses * Make sure to initialise sin_zero field sockaddr_from_inany * Added patch better typing parameters to flow type specific callbacks * Terminology change "forwarded side" to "target side" * Assorted wording and style tweaks based on Stefano's review * Fold introduction of struct flowside and populating the initiating side together * Manage outbound addresses via the flow table as well * Support for UDP * Correct type of 'b' in flowside_lookup() (was a signed int) Changes since v4: * flowside_from_af() no longer fills in unspecified addresses when passed NULL * Split and rename flow hash lookup function * Clarified flow state transitions, and enforced where practical * Made side 0 always the initiating side of a flow, rather than letting the protocol specific code decide * Separated pifs from flowside addresses to allow better structure packing Changes since v3: * Complex rebase on top of the many things that have happened upstream since v2. * Assorted other changes. * Replace TAPFSIDE() and SOCKFSIDE() macros with local variables. Changes since v2: * Cosmetic fixes based on review * Extra doc comments for enum flow_type * Rename flowside to flowaddrs which turns out to make more sense in light of future changes * Fix bug where the socket flowaddrs for tap initiated connections wasn't initialised to match the socket address we were using in the case of map-gw NAT * New flowaddrs_from_sock() helper used in most cases which is cleaner and should avoid bugs like the above * Using newer centralised workarounds for clang-tidy issue 58992 * Remove duplicate definition of FLOW_MAX as maximum flow type and maximum number of tracked flows * Rebased on newer versions of preliminary work (ICMP, flow based dispatch and allocation, bind/address cleanups) * Unified hash table as well as base flow table * Integrated ICMP Changes since v1: * Terminology changes - "Endpoint" address/port instead of "correspondent" address/port - "flowside" instead of "demiflow" * Actually move the connection table to a new flow table structure in new files * Significant rearrangement of earlier patchs on top of that new table, to reduce churn David Gibson (26): flow: Common address information for initiating side flow: Common address information for target side tcp, flow: Remove redundant information, repack connection structures tcp: Obtain guest address from flowside tcp: Manage outbound address via flow table tcp: Simplify endpoint validation using flowside information tcp_splice: Eliminate SPLICE_V6 flag tcp, flow: Replace TCP specific hash function with general flow hash flow, tcp: Generalise TCP hash table to general flow hash table tcp: Re-use flow hash for initial sequence number generation icmp: Remove redundant id field from flow table entry icmp: Obtain destination addresses from the flowsides icmp: Look up ping flows using flow hash icmp: Eliminate icmp_id_map icmp: Manage outbound socket address via flow table flow, tcp: Flow based NAT and port forwarding for TCP flow, icmp: Use general flow forwarding rules for ICMP fwd: Update flow forwarding logic for UDP udp: Create flow table entries for UDP udp: Direct traffic from tap according to flow table udp: Direct traffic from host to guest tap according to flow table udp: Direct spliced traffic according to flow table udp: Remove 'splicesrc' tracking udp: Remove tap port flags field udp: Remove rdelta port forwarding maps udp: Eliminate 'splice' flag from epoll reference Makefile | 2 +- conf.c | 14 +- flow.c | 402 +++++++++++++++++++++++++- flow.h | 45 +++ flow_table.h | 45 ++- fwd.c | 177 +++++++++++- fwd.h | 9 + icmp.c | 105 +++---- icmp_flow.h | 2 - inany.h | 31 +- passt.h | 3 + tap.c | 11 - tap.h | 1 - tcp.c | 524 +++++++++------------------------- tcp_buf.c | 6 +- tcp_conn.h | 51 ++-- tcp_internal.h | 10 +- tcp_splice.c | 98 +------ tcp_splice.h | 5 +- udp.c | 757 +++++++++++++++++++++++-------------------------- udp.h | 22 +- udp_flow.h | 25 ++ util.c | 6 +- util.h | 3 + 24 files changed, 1328 insertions(+), 1026 deletions(-) create mode 100644 udp_flow.h -- 2.45.2

2 34

[PATCH v5 0/9] Fixes for early logging/prints and related cleanups
by Stefano Brivio 26 Jun '24

26 Jun '24

The most apparent issue fixed by this series is the one from 4/6: with a log file configured, we wouldn't print to standard error anymore, during initialisation, which means that users such as libvirt lost the ability to report meaningful error messages that occurred during initialisation, in that case. v5: - in 4/8, rename the new flag once more to 'log_runtime': we don't want to log to standard error if we're running in foreground, a log file is given, and initialisation is done, otherwise debugging pasta when it spawns its own shell becomes rather impractical - add 9/8, taking care of a direct stderr print left-over v4: - in 4/8, name the new flag 'log_daemonised' instead of 'log_daemon_ready' v3: - add 2/8: we don't really need --stderr anymore - in 5/8, save errno at the beginning of the _perror() helper - in 7/8, avoid assigning errno to whatever return code we have just for the sake of using the new helpers: strerror() is actually less convoluted than that - add 8/8: there's no need to call __openlog() with a log file v2: - turn flag bitmap into simple, separate boolean flags - move errno description after message in _perror() functions - make some of the old perror() messages more descriptive *** BLURB HERE *** Stefano Brivio (9): conf, passt: Don't try to log to stderr after we close it conf, passt: Make --stderr do nothing, and deprecate it conf, log: Instead of abusing log levels, add log_conf_parsed flag log, passt: Always print to stderr before initialisation is complete log: Add _perror() logging function variants treewide: Replace perror() calls with calls to logging functions treewide: Replace strerror() calls conf, passt: Don't call __openlog() if a log file is used log: Don't report syslog failures to stderr after initialisation arch.c | 10 ++++----- conf.c | 41 ++++++++++++--------------------- fwd.c | 2 +- isolation.c | 46 ++++++++++++++++--------------------- log.c | 65 ++++++++++++++++++++++++++++++++--------------------- log.h | 25 +++++++++++++++++---- netlink.c | 4 ++-- passt.1 | 9 ++++---- passt.c | 64 +++++++++++++++++++--------------------------------- passt.h | 2 -- pasta.c | 27 +++++++++------------- pcap.c | 8 +++---- tap.c | 14 ++++++------ tcp.c | 24 +++++++------------- util.c | 12 +++++----- 15 files changed, 164 insertions(+), 189 deletions(-) -- 2.43.0

2 16

[PATCH 0/2] Fix bug #80 again
by Stefano Brivio 24 Jun '24

24 Jun '24

Oops. Stefano Brivio (2): Revert "udp: Make rport calculation more local" udp: Reduce scope of rport in udp_invert_portmap() udp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) -- 2.43.0

2 5

passt: new version 2024_06_24.1ee2eca available
by Stefano Brivio 24 Jun '24

24 Jun '24

The new version with tag 2024_06_24.1ee2eca includes the following changes: 1ee2eca udp: Reduce scope of rport in udp_invert_portmap() 0546975 Revert "udp: Make rport calculation more local" c66f034 log: Don't report syslog failures to stderr after initialisation e7323e5 conf, passt: Don't call __openlog() if a log file is used dba7f0f treewide: Replace strerror() calls 92a22fe treewide: Replace perror() calls with calls to logging functions c1140df log: Add _perror() logging function variants afd9cdc log, passt: Always print to stderr before initialisation is complete 8c2f24a conf, log: Instead of abusing log levels, add log_conf_parsed flag bca0fef conf, passt: Make --stderr do nothing, and deprecate it b748016 conf, passt: Don't try to log to stderr after we close it 65923ba conf: Accept duplicate and conflicting options, the last one wins 62de614 netlink: Strip nexthop identifiers when duplicating routes 1544a43 passt.1, qrap.1: align license description with SPDX identifier f301bb1 netlink: Ignore EHOSTUNREACH failures when duplicating routes 450a613 netlink: With no default route, pick the first interface with a route 54a9d38 tcp: Don't rely on bind() to fail to decide that connection target is valid 020ff7a siphash: Remove stale prototypes 7e87bd9 udp: Move management of udp[46]_localname into udp_splice_send() ff57f8d udp: Rework how we divide queued datagrams between sending methods 63db7dc udp: Fold checking of splice flag into udp_mmh_splice_port() 523fbc5 util: Split construction of bind socket address from the rest of sock_l4() 4070bac tap: use in->buf_size rather than sizeof(pkt_buf) 7290335 iov: remove iov_copy() 0c335d7 vhost-user: compare mode MODE_PASTA and not MODE_PASST 377b666 udp: rename udp_sock_handler() to udp_buf_sock_handler() e7ac995 udp: refactor UDP header update functions 9ecf7fe tap: refactor packets handling functions fba2b54 tcp: move buffers management functions to their own file ec26fa0 tcp: extract buffer management from tcp_send_flag() d949667 cppcheck: Suppress constParameterCallback errors https://passt.top/passt/log/?qt=range&q=2024_06_07.8a83b53..2024_06_24.1ee2… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7661289/ permanent mirror: https://passt.top/builds/copr/0^20240624.g1ee2eca/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g1ee2eca-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_1ee2eca-1_all.deb -- Stefano

1 0