September 2024 - dev

[PATCH v2 00/10] RFC: Clean up TCP epoll mask handling
by David Gibson 18 Sep '24

18 Sep '24

This is a draft series culminating in greatly simplifying the handling of the epoll event mask for TCP sockets. Doing that requires two major preliminaries: 1) We also need to alter event mask handling for the tap interface, to track and report when it's ready to accept more data. We need this to "unstick" connections where we have pending data on the socket, but weren't able to forward it because we ran out of tap interface buffer space. 2) We need to alter handling of ack sequence numbers to the tap device. Without this, the event mask changes expose a fragility where depending on the precise order things are called we could update the ack pointer without actually sending an ack to the tap interface. This is not ready to go yet. For one thing it tanks some of the throughput numbers for reasons I haven't yet diagnosed. It could also certainly do with another set of eyes looking critically over the event logic changes. In addition, the fragility of the ack-to-tap handling remains. The series fixes the specific problem, but it remains non-obviously unsafe to call tcp_update_seqack_from_tap() if a packet isn't going to be immediately and unconditionally sent to the guest. I've been trying to figure out how to make that more robust without introducing additional TCP_INFO calls, but my brain's seizing up a bit at this point. Patches 1..4/10 are preliminary cleanups which should be safe, though. Feel free to apply as many of those ones as you're happy with. David Gibson (10): tcp: Make some extra functions private tcp: Clean up tcpi_snd_wnd probing tcp: Simplify ifdef logic in tcp_update_seqack_wnd() tcp: Make tcp_update_seqack_wnd()s force_seq parameter explicitly boolean tcp: On socket EPOLLOUT, send new ACK to tap immediately tap: Re-introduce EPOLLET for tap connections tap: Keep track of whether there might be space in the tap buffers tcp: Keep track of connections blocked due to a full tap interface tcp: Move deferred handling functions later in tcp.c tcp: Simplify epoll event mask management tap.c | 58 ++++++++--- tap.h | 1 + tcp.c | 265 ++++++++++++++++++++++++++++--------------------- tcp.h | 13 +-- tcp_buf.c | 15 +-- tcp_buf.h | 6 +- tcp_conn.h | 1 + tcp_internal.h | 6 +- 8 files changed, 222 insertions(+), 143 deletions(-) -- 2.46.0

2 14

[PATCH v2 0/2] tcp: unify IPv4 and IPv6 tap queues
by Jon Maloy 18 Sep '24

18 Sep '24

This should save us some memory and code. --- v2: - Setting pointers to pre-set IP and MAC headers on the fly instead of copying them. - Merged patch #2 and #3 from v1 Jon Maloy (2): tcp: set ip and eth headers in l2 tap queues on the fly tcp: unify l2 TCPv4 and TCPv6 queues and structures tcp.c | 6 +- tcp_buf.c | 257 ++++++++++++++++++------------------------------------ tcp_buf.h | 3 +- 3 files changed, 88 insertions(+), 178 deletions(-) -- 2.45.2

3 6

[PATCH 0/2] Allow UDP and TCP checksum to be disabled
by Laurent Vivier 17 Sep '24

17 Sep '24

With vhost-user we can disable the checksum of UDP and TCP. Add a generic parameter for each of them to disable the checksum. Laurent Vivier (2): udp: Allow checksum to be disabled tcp: Allow checksum to be disabled tcp.c | 24 +++++++++++++++++------- tcp_buf.c | 8 +++++--- tcp_internal.h | 3 ++- udp.c | 41 +++++++++++++++++++++++++++++++---------- 4 files changed, 55 insertions(+), 21 deletions(-) -- 2.46.0

2 4

[PATCH v4 0/4] Add vhost-user support to passt. (part 3)
by Laurent Vivier 12 Sep '24

12 Sep '24

This series of patches adds vhost-user support to passt and then allows passt to connect to QEMU network backend using virtqueue rather than a socket. With QEMU, rather than using to connect: -netdev stream,id=s,server=off,addr.type=unix,addr.path=/tmp/passt_1.socket we will use: -chardev socket,id=chr0,path=/tmp/passt_1.socket -netdev vhost-user,id=netdev0,chardev=chr0 -device virtio-net,netdev=netdev0 -object memory-backend-memfd,id=memfd0,share=on,size=$RAMSIZE -numa node,memdev=memfd0 The memory backend is needed to share data between passt and QEMU. Performance comparison between "-netdev stream" and "-netdev vhost-user": $ iperf3 -c localhost -p 10001 -t 60 -6 -u -b 50G socket: [ 5] 0.00-60.05 sec 95.6 GBytes 13.7 Gbits/sec 0.017 ms 6998988/10132413 (69%) receiver vhost-user: [ 5] 0.00-60.04 sec 237 GBytes 33.9 Gbits/sec 0.006 ms 53673/7813770 (0.69%) receiver $ iperf3 -c localhost -p 10001 -t 60 -4 -u -b 50G socket: [ 5] 0.00-60.05 sec 98.9 GBytes 14.1 Gbits/sec 0.018 ms 6260735/9501832 (66%) receiver vhost-user: [ 5] 0.00-60.05 sec 235 GBytes 33.7 Gbits/sec 0.008 ms 37581/7752699 (0.48%) receiver $ iperf3 -c localhost -p 10001 -t 60 -6 socket: [ 5] 0.00-60.00 sec 17.3 GBytes 2.48 Gbits/sec 0 sender [ 5] 0.00-60.06 sec 17.3 GBytes 2.48 Gbits/sec receiver vhost-user: [ 5] 0.00-60.00 sec 191 GBytes 27.4 Gbits/sec 0 sender [ 5] 0.00-60.05 sec 191 GBytes 27.3 Gbits/sec receiver $ iperf3 -c localhost -p 10001 -t 60 -4 socket: [ 5] 0.00-60.00 sec 15.6 GBytes 2.24 Gbits/sec 0 sender [ 5] 0.00-60.06 sec 15.6 GBytes 2.24 Gbits/sec receiver vhost-user: [ 5] 0.00-60.00 sec 189 GBytes 27.1 Gbits/sec 0 sender [ 5] 0.00-60.04 sec 189 GBytes 27.0 Gbits/sec receiver v4: - rebase on top of 2024_08_21.1d6142f (rebasing on top of 620e19a1b48a ("udp: Merge udp[46]_mh_recv arrays") introduces a regression in the measure of the latency with UDP because I think I don't replace correctly ref.udp.v6 that is removed by this commit) - Addressed most of the comments from David and Stefano (I didn't want to postpone this version to next week, so I'll address the remaining comments in the next version). v3: - rebase on top of flow table - update tcp_vu.c to look like udp_vu.c (recv()/prepare()/send_frame()) - address comments from Stefano and David on version 2 v2: - remove PATCH 4 - rewrite PATCH 2 and 3 to follow passt coding style - move some code from PATCH 3 to PATCH 4 (previously PATCH 5) - partially addressed David's comment on PATCH 5 Laurent Vivier (4): packet: replace struct desc by struct iovec vhost-user: introduce virtio API vhost-user: introduce vhost-user API vhost-user: add vhost-user Makefile | 6 +- checksum.c | 1 - conf.c | 23 +- epoll_type.h | 4 + iov.c | 1 - isolation.c | 15 +- packet.c | 91 ++-- packet.h | 22 +- passt.1 | 10 +- passt.c | 26 +- passt.h | 6 + pcap.c | 1 - tap.c | 111 ++++- tap.h | 5 +- tcp.c | 31 +- tcp_buf.c | 8 +- tcp_internal.h | 3 +- tcp_vu.c | 656 +++++++++++++++++++++++++ tcp_vu.h | 12 + udp.c | 76 +-- udp.h | 8 +- udp_internal.h | 34 ++ udp_vu.c | 386 +++++++++++++++ udp_vu.h | 13 + util.h | 8 + vhost_user.c | 1267 ++++++++++++++++++++++++++++++++++++++++++++++++ vhost_user.h | 203 ++++++++ virtio.c | 659 +++++++++++++++++++++++++ virtio.h | 185 +++++++ vu_common.c | 35 ++ vu_common.h | 34 ++ 31 files changed, 3801 insertions(+), 139 deletions(-) create mode 100644 tcp_vu.c create mode 100644 tcp_vu.h create mode 100644 udp_internal.h create mode 100644 udp_vu.c create mode 100644 udp_vu.h create mode 100644 vhost_user.c create mode 100644 vhost_user.h create mode 100644 virtio.c create mode 100644 virtio.h create mode 100644 vu_common.c create mode 100644 vu_common.h -- 2.46.0

2 14

[PATCH 0/2] Avoid overlapping mempcy() in DUP_ACK handling
by David Gibson 12 Sep '24

12 Sep '24

Spotted this so-far harmless, but technically undefined behaviour while looking at other things. Fixed one other nit at the same time. David Gibson (2): tcp: Remove redundant initialisation of iov[TCP_IOV_ETH].iov_base tcp: Avoid overlapping memcpy() in DUP_ACK handling tcp_buf.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) -- 2.46.0

2 3

Re: Porting to macOS
by DUO Labs 12 Sep '24

12 Sep '24

Question: In icmp.c:110, the line reads `ih6->icmp6_identifier = htons(ini->eport);`, where `ih6` is of type icmp6hdr *. However, this field does not exist --- ih6->u_echo.icmp6_identifier does. Is this intended?

2 4

Porting to macOS
by DUO Labs 10 Sep '24

10 Sep '24

I started doing some preliminary work on porting passt to macOS (I would have responded to issue 6 directly, but I can't seem to make an account); however, I wanted to know how exactly the system works --- does it _require_ a tap device, or can I safely remove that file from the compilation target (I know that pasta requires it, though)?

2 1

[PATCH 0/4] tcp: unify IPv4 and IPv6 l2 tap queues
by Jon Maloy 09 Sep '24

09 Sep '24

This should save us some memory and code. Jon Maloy (4): tcp: create unified struct for IPv4 and IPv6 header tcp: update ip address in l2 tap queues on the fly tcp: unify l2 TCPv4 and TCPv6 queues and structures tcp: change prefix tcp4_ to tcp_ where applicable tcp.c | 22 ++--- tcp_buf.c | 259 +++++++++++++++++------------------------------------- tcp_buf.h | 3 + 3 files changed, 98 insertions(+), 186 deletions(-) -- 2.45.2

3 8

passt: new version 2024_09_06.6b38f07 available
by Stefano Brivio 06 Sep '24

06 Sep '24

The new version with tag 2024_09_06.6b38f07 includes the following changes: 6b38f07 apparmor: Allow read access to /proc/sys/net/ipv4/ip_local_port_range 116bc82 selinux: Allow read access to /proc/sys/net/ipv4/ip_local_port_range a33ecaf tap: Don't risk truncating frames on full buffer in tap_pasta_input() d2a1dc7 tap: Restructure in tap_pasta_input() 11e2905 tap: Improve handling of EINTR in tap_passt_input() 49fc4e0 tap: Split out handling of EPOLLIN events 63513e5 util: Fix order of operands and carry of one second in timespec_diff_us() 748ef4c cppcheck: Work around some cppcheck 2.15.0 redundantInitialization warnings afedc24 tcp: Use EPOLLET for any state of not established connections aff5a49 udp: Handle more error conditions in udp_sock_errs() bd99f02 udp: Treat errors getting errors as unrecoverable bd092ca udp: Split socket error handling out from udp_sock_recv() 88bfa38 flow: Helpers to log details of a flow 1166401 udp: Allow UDP flows to be prematurely closed 7ad9f9b flow: Fix incorrect hash probe in flowside_lookup() 0ea60e5 log: Don't prefix log file messages with time and severity if they're continuations 3836396 Makefile: Enable _FORTIFY_SOURCE iff needed eedc81b fwd, conf: Probe host's ephemeral ports 4a41dc5 conf, fwd: Don't attempt to forward port 0 1daf6f4 conf, fwd: Make ephemeral port logic more flexible 712ca32 seccomp.sh: Try to account for terminal width while formatting list of system calls e0be6bc udp: Use dual stack sockets for port forwarding when possible c78b194 udp: Remove unnnecessary local from udp_sock_init() 620e19a udp: Merge udp[46]_mh_recv arrays 418feb3 test: Look for possible sshd-session paths (if it's there at all) in mbuto's profile https://passt.top/passt/log/?qt=range&q=2024_08_21.1d6142f..2024_09_06.6b38… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7989588/ permanent mirror: https://passt.top/builds/copr/0^20240906.g6b38f07/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g6b38f07-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_6b38f07-1_all.deb -- Stefano

1 0

[PATCH 0/2] LSM rules for /proc/sys/net/ipv4/ip_local_port_range
by Stefano Brivio 06 Sep '24

06 Sep '24

I just applied these because we break (at least) Debian and Fedora packages otherwise, but I'm posting this here if anybody wants to review. Stefano Brivio (2): selinux: Allow read access to /proc/sys/net/ipv4/ip_local_port_range apparmor: Allow read access to /proc/sys/net/ipv4/ip_local_port_range contrib/apparmor/abstractions/passt | 2 ++ contrib/selinux/passt.te | 3 +++ contrib/selinux/pasta.te | 2 +- 3 files changed, 6 insertions(+), 1 deletion(-) -- 2.43.0

1 2