March 2026 - dev

[PATCH v5 00/13] Introduce multiple addresses and late binding
by Jon Maloy 02 Mar '26

02 Mar '26

This series adds handling of multiple addresses into a unified address array, so that a guest can see the same addresses on his own interface. o All addresses are stored as union inany_addr o User configured addresses are marked with a USER flag. o Host provided addresses are marked with a HOST flag. o Link local addresses are also marked with a LINKLOCAL flag. o Addresses the guest is actually using are marked with an OBSERVED flag. o The address selected for IPv4 DHCP offers is marked with a DHCP flag. We also include a commit to support late binding of interfaces, addresses, and routes. v2: - Added the earlier standalone CIDR commit to the head of the series. - Replaced the guest namespace interface subscriptions with just an address observation feature, so that it works with both PASTA and PASST. - Unified 'no_copy_addrs' and 'copy_addrs' code paths, as suggested by David G. - Multiple other changes, also based on feedback from David. - Removed the host interface subscription patches, -for now. I intend to re-add them once this series is applied. - Outstanding question: When do we add an IPv4 link local address to the guest? Only in local/opaque mode? Only when explicitly requested? Always? v3: - Unified the IPv4 and IPv6 arrays into one array - Changed prefix_len to always be in IPv6/IpV4 mapped format - Updated migration protocol to v3, handling multiple addresses - Many other smaller changes, based on feedback from the PASST team v4: - Numerous changes based on feedback - Added several new commits, mostly broken out of the pre-existing ones. v5: - Re-introduced multiple OBSERVED addresses. This actually turned out to be cleaner and with more predictable behaviour than allowing only one. - Included the DHCP and NDP patches from previous versions, improved and updated according to feedback from the team. - Likewise re-included the host-side netlink commit to support late binding. Jon Maloy (13): ip: Introduce unified multi-address data structures ip: Introduce for_each_addr() macro for address iteration fwd: Unify guest accessibility checks with unified address array arp: Check all configured addresses in ARP filtering netlink: Return prefix length for IPv6 addresses in nl_addr_get() conf: Allow multiple -a/--address options per address family ip: Track observed guest IPv4 addresses in unified address array ip: Track observed guest IPv6 addresses in unified address array migrate: Rename v1 address functions to v2 for clarity migrate: Update protocol to v3 for multi-address support dhcp, dhcpv6: Select addresses for DHCP distribution ndp: Support advertising multiple prefixes in Router Advertisement netlink: Add host-side monitoring for late template interface binding arp.c | 15 +- conf.c | 200 +++++++++++++++---------- conf.h | 9 ++ dhcp.c | 30 ++-- dhcp.h | 2 +- dhcpv6.c | 78 +++++++--- dhcpv6.h | 2 +- epoll_type.h | 2 + fwd.c | 263 +++++++++++++++++++++++++-------- fwd.h | 9 ++ inany.h | 3 + ip.h | 5 + isolation.c | 5 + migrate.c | 183 ++++++++++++++++++++--- ndp.c | 134 ++++++++++++----- netlink.c | 401 ++++++++++++++++++++++++++++++++++++++++++++++++++- netlink.h | 3 + passt.c | 5 + passt.h | 104 +++++++++++-- pasta.c | 39 +++-- tap.c | 67 ++++++--- 21 files changed, 1282 insertions(+), 277 deletions(-) -- 2.52.0

2 19

[PATCH v2 2/4] tcp: Re-introduce inactivity timeouts based on a clock algorithm
by David Gibson 02 Mar '26

02 Mar '26

We previously had a mechanism to remove TCP connections which were inactive for 2 hours. That was broken for a long time, due to poor interactions with the timerfd handling, so we removed it. Adding this long scale timer onto the timerfd handling, which mostly handles much shorter timeouts is tricky to reason about. However, for the inactivity timeouts, we don't require precision. Instead, we can use a 1-bit page replacement / "clock" algorithm. Every INACTIVITY_INTERVAL (2 hours), a global timer marks every TCP connection as tentatively inactive. That flag is cleared if we get any events, either tap side or socket side. If the inactive flag is still set when the next INACTIVITY_INTERVAL expires then the connection has been inactive for an extended period and we reset and close it. In practice this means that connections will be removed after 2-4 hours of inactivity. This is not a true fix for bug 179, but it does mitigate the damage, by limiting the time that inactive connections will remain around, Link: https://bugs.passt.top/show_bug.cgi?id=179 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tcp.c | 53 +++++++++++++++++++++++++++++++++++++++++++++++++---- tcp.h | 4 +++- tcp_conn.h | 3 +++ 3 files changed, 55 insertions(+), 5 deletions(-) diff --git a/tcp.c b/tcp.c index f8663369..09929ee9 100644 --- a/tcp.c +++ b/tcp.c @@ -198,6 +198,13 @@ * TCP_INFO, with a representable range from RTT_STORE_MIN (100 us) to * RTT_STORE_MAX (3276.8 ms). The timeout value is clamped accordingly. * + * We also use a global interval timer for an activity timeout which doesn't + * require precision: + * + * - INACTIVITY_INTERVAL: if a connection has had no activity for an entire + * interval, close and reset it. This means that idle connections (without + * keepalives) will be removed between INACTIVITY_INTERVAL seconds and + * 2*INACTIVITY_INTERVAL seconds after the last activity. * * Summary of data flows (with ESTABLISHED event) * ---------------------------------------------- @@ -333,7 +340,8 @@ enum { #define RTO_INIT 1 /* s, RFC 6298 */ #define RTO_INIT_AFTER_SYN_RETRIES 3 /* s, RFC 6298 */ -#define ACT_TIMEOUT 7200 + +#define INACTIVITY_INTERVAL 7200 /* s */ #define LOW_RTT_TABLE_SIZE 8 #define LOW_RTT_THRESHOLD 10 /* us */ @@ -2254,6 +2262,8 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, return 1; } + conn->inactive = false; + if (th->ack && !(conn->events & ESTABLISHED)) tcp_update_seqack_from_tap(c, conn, ntohl(th->ack_seq)); @@ -2622,6 +2632,8 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, return; } + conn->inactive = false; + if ((conn->events & TAP_FIN_ACKED) && (events & EPOLLHUP)) { conn_event(c, conn, CLOSED); return; @@ -2872,18 +2884,51 @@ int tcp_init(struct ctx *c) return 0; } +/** + * tcp_inactivity() - Scan for and close long-inactive connections + * @c: Execution context + * @now: Current timestamp + */ +static void tcp_inactivity(struct ctx *c, const struct timespec *now) +{ + union flow *flow; + + if (now->tv_sec - c->tcp.inactivity_run < INACTIVITY_INTERVAL) + return; + + debug("TCP inactivity scan"); + c->tcp.inactivity_run = now->tv_sec; + + flow_foreach(flow) { + struct tcp_tap_conn *conn = &flow->tcp; + + if (flow->f.type != FLOW_TCP) + continue; + + if (conn->inactive) { + /* No activity in this interval, reset */ + flow_dbg(conn, "Inactive for at least %us, resetting", + INACTIVITY_INTERVAL); + tcp_rst(c, conn); + } + + /* Ready to check for next interval */ + conn->inactive = true; + } +} + /** * tcp_timer() - Periodic tasks: port detection, closed connections, pool refill * @c: Execution context * @now: Current timestamp */ -void tcp_timer(const struct ctx *c, const struct timespec *now) +void tcp_timer(struct ctx *c, const struct timespec *now) { - (void)now; - tcp_sock_refill_init(c); if (c->mode == MODE_PASTA) tcp_splice_refill(c); + + tcp_inactivity(c, now); } /** diff --git a/tcp.h b/tcp.h index 24b90870..e104d453 100644 --- a/tcp.h +++ b/tcp.h @@ -21,7 +21,7 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, int tcp_listen(const struct ctx *c, uint8_t pif, unsigned rule, const union inany_addr *addr, const char *ifname, in_port_t port); int tcp_init(struct ctx *c); -void tcp_timer(const struct ctx *c, const struct timespec *now); +void tcp_timer(struct ctx *c, const struct timespec *now); void tcp_defer_handler(struct ctx *c); void tcp_update_l2_buf(const unsigned char *eth_d); @@ -38,6 +38,7 @@ extern bool peek_offset_cap; * @rto_max: Maximum retry timeout (in s) * @syn_retries: SYN retries using exponential backoff timeout * @syn_linear_timeouts: SYN retries before using exponential backoff timeout + * @inactivity_run: Time we last scanned for inactive connections */ struct tcp_ctx { struct fwd_ports fwd_in; @@ -47,6 +48,7 @@ struct tcp_ctx { int rto_max; uint8_t syn_retries; uint8_t syn_linear_timeouts; + time_t inactivity_run; }; #endif /* TCP_H */ diff --git a/tcp_conn.h b/tcp_conn.h index 21cea109..7197ff63 100644 --- a/tcp_conn.h +++ b/tcp_conn.h @@ -16,6 +16,7 @@ * @ws_from_tap: Window scaling factor advertised from tap/guest * @ws_to_tap: Window scaling factor advertised to tap/guest * @tap_mss: MSS advertised by tap/guest, rounded to 2 ^ TCP_MSS_BITS + * @inactive: No activity within the current INACTIVITY_INTERVAL * @sock: Socket descriptor number * @events: Connection events, implying connection states * @timer: timerfd descriptor for timeout events @@ -57,6 +58,8 @@ struct tcp_tap_conn { (conn->rtt_exp = MIN(RTT_EXP_MAX, ilog2(MAX(1, rtt / RTT_STORE_MIN)))) #define RTT_GET(conn) (RTT_STORE_MIN << conn->rtt_exp) + bool inactive :1; + int sock :FD_REF_BITS; uint8_t events; -- 2.53.0

2 2

[PATCH] Avoid clang warnings in fwd.h
by Peter Foley 02 Mar '26

02 Mar '26

e.g. ./fwd.h:65:63: warning: '_Static_assert' with no message is a C23 extension [-Wc23-extensions] 65 | static_assert(sizeof(union fwd_listen_ref) == sizeof(uint32_t)); Signed-off-by: Peter Foley <pefoley(a)google.com> --- fwd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fwd.h b/fwd.h index 1607011..7d299b6 100644 --- a/fwd.h +++ b/fwd.h @@ -62,7 +62,7 @@ union fwd_listen_ref { }; uint32_t u32; }; -static_assert(sizeof(union fwd_listen_ref) == sizeof(uint32_t)); +static_assert(sizeof(union fwd_listen_ref) == sizeof(uint32_t), ""); enum fwd_ports_mode { FWD_UNSET = 0, -- 2.53.0.371.g1d285c8824-goog

3 3

[PATCH 3/3] clang-tidy: Don't insist on #ifdef over #if defined()
by David Gibson 02 Mar '26

02 Mar '26

Commit 036fb8770 ("checksum: add VSX fast path for POWER8/POWER9") changed an #ifdef to #if defined, in order to match a newly introduced #if which needs to check two different symbols. This causes clang-tidy to complain that the directive could be written more concisely. In this case consistency with the other #if branch seems more important, and in general insisting on #ifdef over #if seems unhelpfully pedantic. Suppress that warning globally. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- .clang-tidy | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.clang-tidy b/.clang-tidy index 9d346ec2..773121f5 100644 --- a/.clang-tidy +++ b/.clang-tidy @@ -81,6 +81,11 @@ Checks: # precedence over addition in modern mathematical notation. Adding # parentheses to reinforce that certainly won't improve readability. - "-readability-math-missing-parentheses" + + # #if defined(FOO) is fine, and can be more consistent with other + # #if directives. Don't insist on #ifdef instead. + - "-readability-use-concise-preprocessor-directives" + WarningsAsErrors: "*" HeaderFileExtensions: - h -- 2.53.0

1 0

[PATCH 2/3] fwd, pif: Replace with pif_sock_l4() with pif_listen()
by David Gibson 02 Mar '26

02 Mar '26

It turns out all users of pif_sock_l4() use it for "listening" sockets, which now all have a common epoll reference format. We can take advantage of that to pass the necessary epoll information into pif_sock_l4() in a more natural way, rather than as an opaque u32. That in turn allows union fwd_listen_ref can become a struct, since the union only exist to allow the meaningful fields to be coerced into a u32 for pif_sock_l4(). Rename pif_sock_l4() to pif_listen() to reflect the new semantics. While we're there, remove the static_assert() on the fwd_listen_ref's size. We do still need it to fit into 32 bits, but that constraint is imposed only by the fact that it needs to fit into the whole, epoll_ref structure, which we already check with a static_assert() in epoll_ctl.h. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- epoll_ctl.h | 2 +- fwd.h | 14 +++++--------- pif.c | 14 ++++++++------ pif.h | 6 +++--- tcp.c | 8 +------- udp.c | 8 +------- 6 files changed, 19 insertions(+), 33 deletions(-) diff --git a/epoll_ctl.h b/epoll_ctl.h index 2c103cde..879763cb 100644 --- a/epoll_ctl.h +++ b/epoll_ctl.h @@ -35,7 +35,7 @@ union epoll_ref { union { uint32_t flow; flow_sidx_t flowside; - union fwd_listen_ref listen; + struct fwd_listen_ref listen; uint32_t data; int nsdir_fd; int queue; diff --git a/fwd.h b/fwd.h index 16070111..b0e2373d 100644 --- a/fwd.h +++ b/fwd.h @@ -49,20 +49,16 @@ struct fwd_rule { #define FWD_NO_HINT (-1) /** - * union fwd_listen_ref - information about a single listening socket + * struct fwd_listen_ref - information about a single listening socket * @port: Bound port number of the socket * @pif: pif in which the socket is listening * @rule: Index of forwarding rule */ -union fwd_listen_ref { - struct { - in_port_t port; - uint8_t pif; - unsigned rule :FWD_RULE_BITS; - }; - uint32_t u32; +struct fwd_listen_ref { + in_port_t port; + uint8_t pif; + unsigned rule :FWD_RULE_BITS; }; -static_assert(sizeof(union fwd_listen_ref) == sizeof(uint32_t)); enum fwd_ports_mode { FWD_UNSET = 0, diff --git a/pif.c b/pif.c index 6ae970a0..82a3b5e4 100644 --- a/pif.c +++ b/pif.c @@ -62,23 +62,23 @@ void pif_sockaddr(const struct ctx *c, union sockaddr_inany *sa, } } -/** pif_sock_l4() - Open a socket bound to an address on a specified interface +/** pif_listen() - Open a listening socket on a specified pif * @c: Execution context * @type: Socket epoll type * @pif: Interface for this socket * @addr: Address to bind to, or NULL for dual-stack any * @ifname: Interface for binding, NULL for any * @port: Port number to bind to (host byte order) - * @data: epoll reference portion for protocol handlers + * @rule: Forwarding rule index this socket belongs to * * NOTE: For namespace pifs, this must be called having already entered the * relevant namespace. * * Return: newly created socket, negative error code on failure */ -int pif_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, - const union inany_addr *addr, const char *ifname, - in_port_t port, uint32_t data) +int pif_listen(const struct ctx *c, enum epoll_type type, uint8_t pif, + const union inany_addr *addr, const char *ifname, + in_port_t port, unsigned rule) { union epoll_ref ref; int ret; @@ -98,7 +98,9 @@ int pif_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, return ref.fd; ref.type = type; - ref.data = data; + ref.listen.port = port; + ref.listen.pif = pif; + ref.listen.rule = rule; ret = epoll_add(c->epollfd, EPOLLIN, ref); if (ret < 0) { diff --git a/pif.h b/pif.h index 0f7f6672..0eb3626a 100644 --- a/pif.h +++ b/pif.h @@ -59,8 +59,8 @@ static inline bool pif_is_socket(uint8_t pif) void pif_sockaddr(const struct ctx *c, union sockaddr_inany *sa, uint8_t pif, const union inany_addr *addr, in_port_t port); -int pif_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, - const union inany_addr *addr, const char *ifname, - in_port_t port, uint32_t data); +int pif_listen(const struct ctx *c, enum epoll_type type, uint8_t pif, + const union inany_addr *addr, const char *ifname, + in_port_t port, unsigned rule); #endif /* PIF_H */ diff --git a/tcp.c b/tcp.c index 16470703..a0d7cd86 100644 --- a/tcp.c +++ b/tcp.c @@ -2698,11 +2698,6 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, int tcp_listen(const struct ctx *c, uint8_t pif, unsigned rule, const union inany_addr *addr, const char *ifname, in_port_t port) { - union fwd_listen_ref ref = { - .port = port, - .pif = pif, - .rule = rule, - }; int s; ASSERT(!c->no_tcp); @@ -2722,8 +2717,7 @@ int tcp_listen(const struct ctx *c, uint8_t pif, unsigned rule, return -EAFNOSUPPORT; } - s = pif_sock_l4(c, EPOLL_TYPE_TCP_LISTEN, pif, addr, ifname, - port, ref.u32); + s = pif_listen(c, EPOLL_TYPE_TCP_LISTEN, pif, addr, ifname, port, rule); return s; } diff --git a/udp.c b/udp.c index 19adda06..464aa093 100644 --- a/udp.c +++ b/udp.c @@ -1139,11 +1139,6 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, int udp_listen(const struct ctx *c, uint8_t pif, unsigned rule, const union inany_addr *addr, const char *ifname, in_port_t port) { - union fwd_listen_ref ref = { - .pif = pif, - .port = port, - .rule = rule, - }; int s; ASSERT(!c->no_udp); @@ -1163,8 +1158,7 @@ int udp_listen(const struct ctx *c, uint8_t pif, unsigned rule, return -EAFNOSUPPORT; } - s = pif_sock_l4(c, EPOLL_TYPE_UDP_LISTEN, pif, - addr, ifname, port, ref.u32); + s = pif_listen(c, EPOLL_TYPE_UDP_LISTEN, pif, addr, ifname, port, rule); return s; } -- 2.53.0

1 0

[PATCH 1/3] tcp: Use flow_foreach_of_type() in tcp_{keepalive,inactivity}
by David Gibson 02 Mar '26

02 Mar '26

These functions step through all TCP flows. I forgot there was already a flow_foreach_of_type() macro which makes this easier. Use it. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tcp.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/tcp.c b/tcp.c index 88ad886d..16470703 100644 --- a/tcp.c +++ b/tcp.c @@ -2907,12 +2907,9 @@ static void tcp_keepalive(struct ctx *c, const struct timespec *now) c->tcp.keepalive_run = now->tv_sec; - flow_foreach(flow) { + flow_foreach_of_type(flow, FLOW_TCP) { struct tcp_tap_conn *conn = &flow->tcp; - if (flow->f.type != FLOW_TCP) - continue; - if (conn->tap_inactive) { flow_dbg(conn, "No tap activity for least %us, send keepalive", KEEPALIVE_INTERVAL); @@ -2938,12 +2935,9 @@ static void tcp_inactivity(struct ctx *c, const struct timespec *now) debug("TCP inactivity scan"); c->tcp.inactivity_run = now->tv_sec; - flow_foreach(flow) { + flow_foreach_of_type(flow, FLOW_TCP) { struct tcp_tap_conn *conn = &flow->tcp; - if (flow->f.type != FLOW_TCP) - continue; - if (conn->inactive) { /* No activity in this interval, reset */ flow_dbg(conn, "Inactive for at least %us, resetting", -- 2.53.0

1 0

[PATCH 0/3] Miscellaneous minor fixes
by David Gibson 02 Mar '26

02 Mar '26

I've just gotten back from holiday, so getting back into things with a collection of minor fixes, for things that arose while I was away. David Gibson (3): tcp: Use flow_foreach_of_type() in tcp_{keepalive,inactivity} fwd, pif: Replace with pif_sock_l4() with pif_listen() clang-tidy: Don't insist on #ifdef over #if defined() .clang-tidy | 5 +++++ epoll_ctl.h | 2 +- fwd.h | 14 +++++--------- pif.c | 14 ++++++++------ pif.h | 6 +++--- tcp.c | 18 +++--------------- udp.c | 8 +------- 7 files changed, 26 insertions(+), 41 deletions(-) -- 2.53.0

1 0

[PATCH v2 0/4] Reworks and improvements to TCP activity timers
by David Gibson 02 Mar '26

02 Mar '26

Here's a bunch of patches aimed at fixing bug 179, and reworking the currently broken inactivity timer along the way. I believe patches 1..2/4 are ready to go - I've tested them, and I'm happy with how they're behaving. Patches 3..4/4 I think are correct, but I've been getting bogged down in details trying to test them in the specific FIN_WAIT_2 situation that occurs in bug 179. I'm sending this out for comment, while I look at some other things to clear my head. Caveats: * Currently the inactivity timer uses an interval of 2h to match the intended behaviour of the existing non-working activity timeout. Arguably it should be much longer (several days), like the kernel NAT timeout for idle connection tracking. * This introduces two new fields in the connection structure, as the clock values for the two new timers. These are new 1-bit bool fields slotted into a 3-bit gap. Arguably these would be cleaner as new bits in the 'flags' field. However, since we only have one spare bit there at the moment, that would require some more complex reorganization which I didn't want to tackle right now. Changes in v2: * Set keepalive interval to 300s * Fix an inordinate number of typos and other cosmetic errors David Gibson (4): tcp: Remove non-working activity timeout mechanism tcp: Re-introduce inactivity timeouts based on a clock algorithm tcp: Extend tcp_send_flag() to send TCP keepalive segments tcp: Send TCP keepalive segments after a period of tap-side inactivity tcp.c | 118 ++++++++++++++++++++++++++++++++++++++----------- tcp.h | 6 ++- tcp_buf.c | 4 ++ tcp_conn.h | 5 +++ tcp_internal.h | 2 + tcp_vu.c | 3 ++ 6 files changed, 112 insertions(+), 26 deletions(-) -- 2.53.0

2 3

[PATCH 00/12] vhost-user,udp: Handle multiple iovec entries per virtqueue element
by Laurent Vivier 02 Mar '26

02 Mar '26

Some virtio-net drivers (notably iPXE) provide descriptors where the vnet header and the frame payload are in separate buffers, resulting in two iovec entries per virtqueue element. Currently, the RX (host to guest) path assumes a single iovec per element, which triggers: ASSERTION FAILED in virtqueue_map_desc (virtio.c:403): num_sg < max_num_sg This series reworks the UDP vhost-user receive path to support multiple iovec entries per element, fixing the iPXE crash. This series only addresses the UDP path. TCP vhost-user will be updated to use multi-iov elements in a subsequent series. Laurent Vivier (12): iov: Add iov_tail_truncate() and iov_tail_zero_end() vhost-user: Use ARRAY_SIZE(elem) instead of VIRTQUEUE_MAX_SIZE udp_vu: Use iov_tail to manage virtqueue buffers udp_vu: Move virtqueue management from udp_vu_sock_recv() to its caller iov: Add IOV_PUT_HEADER() to write header data back to iov_tail udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6() udp_vu: Use iov_tail in udp_vu_prepare() vu_common: Pass iov_tail to vu_set_vnethdr() vu_common: Accept explicit iovec counts in vu_set_element() vu_common: Accept explicit iovec count per element in vu_init_elem() vu_common: Prepare to use multibuffer with guest RX vhost-user,udp: Use 2 iovec entries per element iov.c | 58 +++++++++++++++ iov.h | 16 +++- tcp_vu.c | 18 +++-- udp.c | 65 ++++++++--------- udp_internal.h | 10 ++- udp_vu.c | 194 +++++++++++++++++++++++++------------------------ vu_common.c | 82 +++++++++++++-------- vu_common.h | 20 +++-- 8 files changed, 282 insertions(+), 181 deletions(-) -- 2.53.0

2 24