- dev - passt

[PATCH] Add basic .gitignore files
by Stefano Brivio 19 May '22

19 May '22

From: David Gibson <david(a)gibson.dropbear.id.au> Ignore various files generated during build or test. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- .gitignore | 8 ++++++++ test/.gitignore | 2 ++ 2 files changed, 10 insertions(+) create mode 100644 .gitignore create mode 100644 test/.gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..89d9919 --- /dev/null +++ b/.gitignore @@ -0,0 +1,8 @@ +*~ +/passt +/passt.avx2 +/pasta +/pasta.avx2 +/qrap +/pasta.1 +/seccomp.h diff --git a/test/.gitignore b/test/.gitignore new file mode 100644 index 0000000..edb2221 --- /dev/null +++ b/test/.gitignore @@ -0,0 +1,2 @@ +perf.js +test_logs/ -- 2.35.1

2 1

[PATCH] conf: Add --runas option, changing to given UID and GID if started as root
by Stefano Brivio 19 May '22

19 May '22

On some systems, user and group "nobody" might not be available. The new --runas option allows to override the default "nobody" choice if started as root. Now that we allow this, drop the initgroups() call that was used to add any additional groups for the given user, as that might now grant unnecessarily broad permissions. For instance, several distributions have a "kvm" group to allow regular user access to /dev/kvm, and we don't need that in passt or pasta. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ passt.1 | 7 ++++++ passt.c | 36 ++++++++++++++++++------------ passt.h | 5 +++++ 4 files changed, 102 insertions(+), 14 deletions(-) diff --git a/conf.c b/conf.c index 0baf4fa..2e6e3c4 100644 --- a/conf.c +++ b/conf.c @@ -22,6 +22,8 @@ #include <sys/stat.h> #include <libgen.h> #include <limits.h> +#include <grp.h> +#include <pwd.h> #include <stdlib.h> #include <stdint.h> #include <unistd.h> @@ -614,6 +616,9 @@ static void usage(const char *name) info( " default: run in background if started from a TTY"); info( " -e, --stderr Log to stderr too"); info( " default: log to system logger only if started from a TTY"); + info( " --runas UID|UID:GID Use given UID, GID if started as root" + info( " UID and GID can be numeric, or login and group names"); + info( " default: drop to user \"nobody\""); info( " -h, --help Display this help message and exit"); if (strstr(name, "pasta")) { @@ -837,6 +842,57 @@ dns6: } } +/** + * conf_runas() - Handle --runas: look up desired UID and GID + * @opt: Passed option value + * @uid: User ID, set on return if valid + * @gid: Group ID, set on return if valid + * + * Return: 0 on success, negative error code on failure + */ +static int conf_runas(const char *opt, unsigned int *uid, unsigned int *gid) +{ + char ubuf[LOGIN_NAME_MAX], gbuf[LOGIN_NAME_MAX], *endptr; + struct passwd *pw; + struct group *gr; + + /* NOLINTNEXTLINE(cert-err34-c): 2 if conversion succeeds */ + if (sscanf(opt, "%u:%u", uid, gid) == 2 && uid && gid) + return 0; + + *uid = strtol(opt, &endptr, 0); + if (!*endptr && (*gid = *uid)) + return 0; + +#ifdef GLIBC_NO_STATIC_NSS + (void)ubuf; + (void)gbuf; + (void)pw; + + return -EINVAL; +#else + /* NOLINTNEXTLINE(cert-err34-c): 2 if conversion succeeds */ + if (sscanf(opt, "%" STR(LOGIN_NAME_MAX) "[^:]:" + "%" STR(LOGIN_NAME_MAX) "s", ubuf, gbuf) == 2) { + pw = getpwnam(ubuf); + if (!pw || !(*uid = pw->pw_uid)) + return -ENOENT; + + gr = getgrnam(gbuf); + if (!gr || !(*gid = gr->gr_gid)) + return -ENOENT; + + return 0; + } + + pw = getpwnam(ubuf); + if (!pw || !(*uid = pw->pw_uid) || !(*gid = pw->pw_gid)) + return -ENOENT; + + return 0; +#endif /* !GLIBC_NO_STATIC_NSS */ +} + /** * conf() - Process command-line arguments and set configuration * @c: Execution context @@ -889,6 +945,7 @@ void conf(struct ctx *c, int argc, char **argv) {"dns-forward", required_argument, NULL, 9 }, {"no-netns-quit", no_argument, NULL, 10 }, {"trace", no_argument, NULL, 11 }, + {"runas", required_argument, NULL, 12 }, { 0 }, }; struct get_bound_ports_ns_arg ns_ports_arg = { .c = c }; @@ -1032,6 +1089,17 @@ void conf(struct ctx *c, int argc, char **argv) c->trace = c->debug = c->foreground = 1; break; + case 12: + if (c->uid || c->gid) { + err("Multiple --runas options given"); + usage(argv[0]); + } + + if (conf_runas(optarg, &c->uid, &c->gid)) { + err("Invalid --runas option: %s", optarg); + usage(argv[0]); + } + break; case 'd': if (c->debug) { err("Multiple --debug options given"); diff --git a/passt.1 b/passt.1 index cdca3e9..d3af916 100644 --- a/passt.1 +++ b/passt.1 @@ -95,6 +95,13 @@ Log to standard error too. Default is to log to system logger only, if started from an interactive terminal, and to both system logger and standard error otherwise. +.TP +.BR \-\-runas " " \fIUID\fR|\fIUID:GID\fR|\fILOGIN\fR|\fILOGIN:GROUP\fR +If started as root, change to given UID and corresponding group if UID is given, +or to given UID and given GID if both are given. Alternatively, login name, or +login name and group name can be passed. +Default is to change to user \fInobody\fR if started as root. + .TP .BR \-h ", " \-\-help Display a help message and exit. diff --git a/passt.c b/passt.c index e5064f8..0732176 100644 --- a/passt.c +++ b/passt.c @@ -191,9 +191,9 @@ static void seccomp(const struct ctx *c) } /** - * check_root() - Warn if root in init, exit if we can't drop to nobody + * check_root() - Check if root in init ns, exit if we can't drop to user */ -static void check_root(void) +static void check_root(struct ctx *c) { const char root_uid_map[] = " 0 0 4294967295"; struct passwd *pw; @@ -214,22 +214,29 @@ static void check_root(void) close(fd); - fprintf(stderr, "Don't run this as root. Changing to nobody...\n"); + if (!c->uid) { + fprintf(stderr, "Don't run as root. Changing to nobody...\n"); #ifndef GLIBC_NO_STATIC_NSS - pw = getpwnam("nobody"); - if (!pw) { - perror("getpwnam"); - exit(EXIT_FAILURE); - } + pw = getpwnam("nobody"); + if (!pw) { + perror("getpwnam"); + exit(EXIT_FAILURE); + } - if (!initgroups(pw->pw_name, pw->pw_gid) && - !setgid(pw->pw_gid) && !setuid(pw->pw_uid)) - return; + c->uid = pw->pw_uid; + c->gid = pw->pw_gid; #else - (void)pw; + (void)pw; + + /* Common value for 'nobody', not really specified */ + c->uid = c->gid = 65534; #endif + } - fprintf(stderr, "Can't change to user/group nobody, exiting"); + if (!setgid(c->gid) && !setuid(c->uid)) + return; + + fprintf(stderr, "Can't change user/group, exiting"); exit(EXIT_FAILURE); } @@ -336,7 +343,6 @@ int main(int argc, char **argv) arch_avx2_exec(argv); - check_root(); drop_caps(); c.pasta_userns_fd = c.pasta_netns_fd = c.fd_tap = c.fd_tap_listen = -1; @@ -391,6 +397,8 @@ int main(int argc, char **argv) conf(&c, argc, argv); trace_init(c.trace); + check_root(&c); + if (!c.debug && (c.stderr || isatty(fileno(stdout)))) __openlog(log_name, LOG_PERROR, LOG_DAEMON); diff --git a/passt.h b/passt.h index 69e334d..e541341 100644 --- a/passt.h +++ b/passt.h @@ -106,6 +106,8 @@ enum passt_modes { * @sock_path: Path for UNIX domain socket * @pcap: Path for packet capture file * @pid_file: Path to PID file, empty string if not configured + * @uid: UID we should drop to, if started as root + * @gid: GID we should drop to, if started as root * @pasta_netns_fd: File descriptor for network namespace in pasta mode * @pasta_userns_fd: Descriptor for user namespace to join, -1 once joined * @netns_only: In pasta mode, don't join or create a user namespace @@ -170,6 +172,9 @@ struct ctx { char pcap[PATH_MAX]; char pid_file[PATH_MAX]; + uid_t uid; + uid_t gid; + int pasta_netns_fd; int pasta_userns_fd; int netns_only; -- 2.35.1

2 1

[PATCH 0/3] tests: A few fixes for demos
by Stefano Brivio 19 May '22

19 May '22

This series fixes issues that came with the previous test clean-up series, or that were made visible by it. Stefano Brivio (3): demo/pasta: Fix bad sleep directive tests: Don't count number of test units for demos tests: Don't check exit code for every command in demo mode test/demo/pasta | 2 +- test/lib/term | 3 +++ test/lib/test | 6 ++++-- 3 files changed, 8 insertions(+), 3 deletions(-) -- 2.35.1

2 6

[PATCH 00/12] Tests fixes and clean-ups
by Stefano Brivio 18 May '22

18 May '22

This series, mostly from David, cleans up a number of atrocities in the test suite, makes it more observable by reporting test failures whenever a command fails, and a bit more robust by improving filtering in pane_parse(). Further, the whole script now fails if an unhandled failure occurs. A few assorted fixes are included as well. David Gibson (9): tests: Remove unused XVFB variable tests: Add some debugging output for the test scripts themselves tests: Don't use tmux update-environment tests: Don't globally set tmux default-shell tests: Improve control character filtering in pane_parse tests: Don't ignore errors during script tests: Add pane_status command to check for success of issued commands tests: Simplify *tools commands using pane_status tests: Simplify explicit checks for command success Stefano Brivio (3): tests: Update mbuto git URLs test/perf/pasta_udp: Drop redundant assignment of ::1 to loopback interface test/run: Return 0 from run(), exit value already reflects failures test/build/static_checkers | 6 ++-- test/demo/passt | 2 +- test/distro/debian | 33 +++++++------------ test/distro/opensuse | 18 ++++------- test/distro/ubuntu | 15 +++------ test/icmp/passt_in_ns | 4 --- test/lib/setup | 59 ++++++++++++++++------------------ test/lib/term | 30 ++++++++++++++---- test/lib/test | 65 ++++++++++++++++++-------------------- test/perf/pasta_udp | 1 - test/run | 7 ++-- 11 files changed, 108 insertions(+), 132 deletions(-) -- 2.35.1

2 14

[PATCH 00/16] Fix issues reported by Coverity
by Stefano Brivio 05 Apr '22

05 Apr '22

Most of these are formal issues with no actual effect, some are false positives, but it looks sensible to fix all of them and there's also an interesting finding in udp_timer(). Stefano Brivio (16): treewide: Invalid type in argument to printf format specifier, CWE-686 passt: Ignoring number of bytes read, CWE-252 tcp: False "Untrusted loop bound" positive, CWE-606 treewide: Unchecked return value from library, CWE-252 tap: Resource leak, CWE-404 conf, packet: Operands don't affect result, CWE-569 passt: Improper use of negative value (CWE-394) treewide: Argument cannot be negative, CWE-687 conf: False "Assign instead of compare" positive, CWE-481 conf, tap: False "Buffer not null terminated" positives, CWE-170 tcp: Dereference null return value, CWE-476 tcp_splice: Logically dead code, CWE-561 tcp, tcp_splice: False "Negative array index read" positives, CWE-129 tcp: False "Out-of-bounds read" positive, CWE-125 udp: Out-of-bounds read, CWE-125 in udp_timer() arch: Pointer to local outside scope, CWE-562 arch.c | 10 +++--- conf.c | 15 +++++---- icmp.c | 13 +++++--- netlink.c | 40 ++++++++++++++--------- packet.c | 8 ++--- passt.c | 24 ++++++++++---- pasta.c | 25 +++++---------- pcap.c | 6 ++-- qrap.c | 15 ++++++--- tap.c | 35 +++++++++++++------- tcp.c | 75 ++++++++++++++++++++++++++----------------- tcp_splice.c | 91 ++++++++++++++++++++++++++++++++++------------------ udp.c | 5 +-- util.c | 11 ++++--- util.h | 9 ++++++ 15 files changed, 238 insertions(+), 144 deletions(-) -- 2.35.1

1 16

[PATCH 00/24] Boundary-checked "packets", TCP timerfd timeouts, assorted fixes
by Stefano Brivio 25 Mar '22

25 Mar '22

Stefano Brivio (24): conf, util, tap: Implement --trace option for extra verbose logging pcap: Fix mistake in printed string util: Drop CHECK_SET_MIN_MAX{,_PROTO_FD} macros util: Use standard int types tcp: Refactor to use events instead of states, split out spliced implementation test/lib/video: Fill in href attributes of video shortcuts udp: Drop _splice from recv, send, sendto static buffer names udp: Split buffer queueing/writing parts of udp_sock_handler() dhcpv6, tap, tcp: Use IN6_ARE_ADDR_EQUAL instead of open-coded memcmp() udp: Use flags for local, loopback, and configured unicast binds Makefile: Enable a few hardening flags test: Add asciinema(1) as requirement for CI in README test, seccomp, Makefile: Switch to valgrind runs for passt functional tests tcp, udp, util: Enforce 24-bit limit on socket numbers tcp: Rework timers to use timerfd instead of periodic bitmap scan tcp_splice: Close sockets right away on high number of open files test/perf: Work-around for virtio_net hang before long streams from guest README: Avoid "here" links README: Update Interfaces and Availability sections tcp: Fit struct tcp_conn into a single 64-byte cacheline dhcp: Minimum option length implied by RFC 951 is 60 bytes, not 62 tcp, tcp_splice: Use less awkward syntax to swap in/out sockets from pools util: Fix function declaration style of write_pidfile() treewide: Packet abstraction with mandatory boundary checks Makefile | 18 +- README.md | 58 +- arp.c | 51 +- arp.h | 2 +- conf.c | 15 + dhcp.c | 62 +- dhcp.h | 2 +- dhcpv6.c | 151 +- dhcpv6.h | 3 +- icmp.c | 28 +- icmp.h | 4 +- ndp.c | 59 +- ndp.h | 3 +- packet.c | 134 ++ packet.h | 77 + passt.1 | 5 + passt.c | 13 +- passt.h | 9 +- pcap.c | 2 +- seccomp.sh | 1 + tap.c | 331 ++-- tcp.c | 3023 +++++++++++++++---------------------- tcp.h | 27 +- tcp_splice.c | 888 +++++++++++ tcp_splice.h | 15 + test/README.md | 10 +- test/lib/setup | 52 +- test/lib/video | 2 +- test/perf/passt_tcp | 15 + test/perf/passt_udp | 15 + test/run | 9 + test/valgrind.supp | 9 + test/valgrind/passt | 22 + test/valgrind/passt_in_ns | 22 + udp.c | 501 +++--- udp.h | 6 +- util.c | 95 +- util.h | 43 +- 38 files changed, 3313 insertions(+), 2469 deletions(-) create mode 100644 packet.c create mode 100644 packet.h create mode 100644 tcp_splice.c create mode 100644 tcp_splice.h create mode 100644 test/valgrind.supp create mode 100644 test/valgrind/passt create mode 100644 test/valgrind/passt_in_ns -- 2.35.1

1 24

[PATCH] test/lib/setup: Unshare PID namespace in pasta_setup()
by Stefano Brivio 02 Mar '22

02 Mar '22

...otherwise, we'll leave processes (dhclient) around. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/lib/setup | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/test/lib/setup b/test/lib/setup index b076eff..f04949e 100755 --- a/test/lib/setup +++ b/test/lib/setup @@ -69,12 +69,16 @@ setup_pasta() { layout_pasta - pane_run NS "unshare -rUn /bin/sh " + pane_run NS 'echo $$' pane_wait NS + __tty_pid="$(pane_parse NS)" - pane_run NS 'echo $$' + pane_run NS "unshare -rUnpf /bin/sh" pane_wait NS - __pasta_pid="$(pane_parse NS)" + + pane_run PASST "pstree -p ${__tty_pid} | sed -n 's/.*($[0-9].*$)$/\1/p'" + pane_wait PASST + __target_pid="$(pane_parse PASST)" # Ports: # @@ -87,7 +91,7 @@ setup_pasta() { [ ${PCAP} -eq 1 ] && __opts="${__opts} -p /tmp/pasta.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" - pane_run PASST "./pasta ${__opts} -f -t 10002 -T 10003 -u 10002 -U 10003 ${__pasta_pid}" + pane_run PASST "./pasta ${__opts} -f -t 10002 -T 10003 -u 10002 -U 10003 ${__target_pid}" sleep 1 } -- 2.34.1

1 0

[PATCH] arp, dhcp: Fix strict aliasing warnings reported by gcc 4.9 with -Ofast
by Stefano Brivio 28 Feb '22

28 Feb '22

Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- arp.c | 3 ++- dhcp.c | 14 +++++++------- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/arp.c b/arp.c index b5af49f..3195692 100644 --- a/arp.c +++ b/arp.c @@ -58,7 +58,8 @@ int arp(struct ctx *c, struct ethhdr *eh, size_t len) /* Discard announcements (but not 0.0.0.0 "probes"): we might have the * same IP address, hide that. */ - if (*((uint32_t *)&am->sip) && !memcmp(am->sip, am->tip, 4)) + if (memcmp(am->sip, (unsigned char[4]){ 0, 0, 0, 0 }, 4) && + !memcmp(am->sip, am->tip, 4)) return 1; /* Don't resolve our own address, either. */ diff --git a/dhcp.c b/dhcp.c index ab1249c..197a515 100644 --- a/dhcp.c +++ b/dhcp.c @@ -40,9 +40,9 @@ struct opt { int sent; int slen; - unsigned char s[255]; + uint8_t s[255]; int clen; - unsigned char c[255]; + uint8_t c[255]; }; static struct opt opts[255]; @@ -312,9 +312,9 @@ int dhcp(struct ctx *c, struct ethhdr *eh, size_t len) m->chaddr[3], m->chaddr[4], m->chaddr[5]); m->yiaddr = c->addr4; - *(unsigned long *)opts[1].s = c->mask4; - *(unsigned long *)opts[3].s = c->gw4; - *(unsigned long *)opts[54].s = c->gw4; + memcpy(opts[1].s, &c->mask4, sizeof(c->mask4)); + memcpy(opts[3].s, &c->gw4, sizeof(c->gw4)); + memcpy(opts[54].s, &c->gw4, sizeof(c->gw4)); /* If the gateway is not on the assigned subnet, send an option 121 * (Classless Static Routing) adding a dummy route to it. @@ -323,8 +323,8 @@ int dhcp(struct ctx *c, struct ethhdr *eh, size_t len) /* a.b.c.d/32:0.0.0.0, 0:a.b.c.d */ opts[121].slen = 14; opts[121].s[0] = 32; - *(unsigned long *)&opts[121].s[1] = c->gw4; - *(unsigned long *)&opts[121].s[10] = c->gw4; + memcpy(opts[121].s + 1, &c->gw4, sizeof(c->gw4)); + memcpy(opts[121].s + 10, &c->gw4, sizeof(c->gw4)); } if (c->mtu != -1) { -- 2.34.1

1 0

[PATCH v2] passt, pasta: Run-time selection of AVX2 build
by Stefano Brivio 28 Feb '22

28 Feb '22

Build-time selection of AVX2 flags and routines is not practical for distributions, but limiting AVX2 usage to checksum routines with specific run-time detection doesn't allow for easy performance gains from auto-vectorisation of batched packet handling routines. For x86_64, build non-AVX2 and AVX2 binaries, and implement a simple wrapper replacing the current executable with the AVX2 build if it's available, and if AVX2 is supported by the current CPU. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: Add arch.c and arch.h to commit Makefile | 38 ++++++++++++++++++++++++++++---------- README.md | 28 +++++++++++----------------- arch.c | 42 ++++++++++++++++++++++++++++++++++++++++++ arch.h | 6 ++++++ hooks/pre-push | 9 --------- passt.c | 3 +++ test/build/all | 10 ---------- test/demo/passt | 2 +- test/demo/pasta | 2 +- 9 files changed, 92 insertions(+), 48 deletions(-) create mode 100644 arch.c create mode 100644 arch.h diff --git a/Makefile b/Makefile index 031b684..8387719 100644 --- a/Makefile +++ b/Makefile @@ -14,8 +14,11 @@ ifeq ($(RLIMIT_STACK_VAL),unlimited) RLIMIT_STACK_VAL := 1024 endif -AUDIT_ARCH := $(shell uname -m | tr [a-z] [A-Z]) -AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/^ARM.*/ARM/') +# Get 'uname -m'-like architecture description for target +TARGET_ARCH := $(shell $(CC) -dumpmachine | cut -f1 -d- | tr [a-z] [A-Z]) +TARGET_ARCH := $(shell echo $(TARGET_ARCH) | sed 's/POWERPC/PPC/') + +AUDIT_ARCH := $(shell echo $(TARGET_ARCH) | sed 's/^ARM.*/ARM/') AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/I[456]86/I386/') AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/PPC64/PPC/') AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/PPCLE/PPC64LE/') @@ -25,7 +28,7 @@ CFLAGS += -DPAGE_SIZE=$(shell getconf PAGE_SIZE) CFLAGS += -DNETNS_RUN_DIR=\"/run/netns\" CFLAGS += -DPASST_AUDIT_ARCH=AUDIT_ARCH_$(AUDIT_ARCH) CFLAGS += -DRLIMIT_STACK_VAL=$(RLIMIT_STACK_VAL) -CFLAGS += -DARCH=\"$(shell uname -m)\" +CFLAGS += -DARCH=\"$(TARGET_ARCH)\" # On gcc 11.2, with -O2 and -flto, tcp_hash() and siphash_20b(), if inlined, # seem to be hitting something similar to: @@ -63,10 +66,13 @@ endif prefix ?= /usr/local +ifeq ($(TARGET_ARCH),X86_64) +all: passt passt.avx2 pasta pasta.avx2 qrap +BIN := passt passt.avx2 pasta pasta.avx2 qrap +else all: passt pasta qrap - -avx2: CFLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops -avx2: clean all +BIN := passt pasta qrap +endif static: CFLAGS += -static -DGLIBC_NO_STATIC_NSS static: clean all @@ -78,6 +84,16 @@ passt: $(filter-out qrap.c,$(wildcard *.c)) \ $(filter-out qrap.h,$(wildcard *.h)) seccomp.h $(CC) $(CFLAGS) $(filter-out qrap.c,$(wildcard *.c)) -o passt +passt.avx2: CFLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops +passt.avx2: $(filter-out qrap.c,$(wildcard *.c)) \ + $(filter-out qrap.h,$(wildcard *.h)) seccomp.h + $(CC) $(CFLAGS) $(filter-out qrap.c,$(wildcard *.c)) -o passt.avx2 + +passt.avx2: passt + +pasta.avx2: passt.avx2 + ln -s passt.avx2 pasta.avx2 + pasta: passt ln -s passt pasta ln -s passt.1 pasta.1 @@ -88,24 +104,26 @@ qrap: qrap.c passt.h .PHONY: clean clean: - -${RM} passt *.o seccomp.h qrap pasta pasta.1 \ + -${RM} passt passt.avx2 *.o seccomp.h qrap pasta pasta.avx2 pasta.1 \ passt.tar passt.tar.gz *.deb *.rpm -install: passt pasta qrap +install: $(BIN) mkdir -p $(DESTDIR)$(prefix)/bin $(DESTDIR)$(prefix)/share/man/man1 - cp -d passt pasta qrap $(DESTDIR)$(prefix)/bin + cp -d $(BIN) $(DESTDIR)$(prefix)/bin cp -d passt.1 pasta.1 qrap.1 $(DESTDIR)$(prefix)/share/man/man1 uninstall: -${RM} $(DESTDIR)$(prefix)/bin/passt + -${RM} $(DESTDIR)$(prefix)/bin/passt.avx2 -${RM} $(DESTDIR)$(prefix)/bin/pasta + -${RM} $(DESTDIR)$(prefix)/bin/pasta.avx2 -${RM} $(DESTDIR)$(prefix)/bin/qrap -${RM} $(DESTDIR)$(prefix)/share/man/man1/passt.1 -${RM} $(DESTDIR)$(prefix)/share/man/man1/pasta.1 -${RM} $(DESTDIR)$(prefix)/share/man/man1/qrap.1 pkgs: - tar cf passt.tar -P --xform 's//\/usr\/bin\//' passt pasta qrap + tar cf passt.tar -P --xform 's//\/usr\/bin\//' $(BIN) tar rf passt.tar -P --xform 's//\/usr\/share\/man\/man1\//' \ passt.1 pasta.1 qrap.1 gzip passt.tar diff --git a/README.md b/README.md index 14e1777..4966e15 100644 --- a/README.md +++ b/README.md @@ -220,7 +220,7 @@ speeding up local connections, and usually requiring NAT. _pasta_: * Linux * ✅ starting from 4.18 kernel version * ✅ starting from 3.13 kernel version -* 🛠 build-time selection of AVX2 instructions (as much as possible) +* ✅ run-time selection of AVX2 build * ⌚ [_musl_](https://bugs.passt.top/show_bug.cgi?id=4) and [_uClibc-ng_](https://bugs.passt.top/show_bug.cgi?id=5) * ⌚ [FreeBSD](https://bugs.passt.top/show_bug.cgi?id=6), @@ -467,15 +467,12 @@ Test logs [here](/builds/latest/test/). cd passt make - * alternatively, static builds for x86_64, with or without AVX2 instructions, - as of the latest commit are also available for convenience - [here](/builds/latest/x86_64/avx2/) and - [here](/builds/latest/x86_64/). Convenience, non-official - packages for Debian (and derivatives) and RPM-based distributions are also - available there. These binaries and packages are simply built with: + * alternatively, static builds for x86_64 as of the latest commit are also + available for convenience [here](/builds/latest/x86_64/). Convenience, + non-official packages for Debian (and derivatives) and RPM-based + distributions are also available there. These binaries and packages are + simply built with: - CFLAGS="-static" make avx2 - make pkgs make static make pkgs @@ -530,15 +527,12 @@ Test logs [here](/builds/latest/test/). cd passt make - * alternatively, static builds for x86_64, with or without AVX2 instructions, - as of the latest commit are also available for convenience - [here](/builds/latest/x86_64/avx2/) and - [here](/builds/latest/x86_64/). Convenience, non-official - packages for Debian (and derivatives) and RPM-based distributions are also - available there. These binaries and packages are simply built with: + * alternatively, static builds for x86_64 as of the latest commit are also + available for convenience [here](/builds/latest/x86_64/). Convenience, + non-official packages for Debian (and derivatives) and RPM-based + distributions are also available there. These binaries and packages are + simply built with: - CFLAGS="-static" make avx2 - make pkgs make static make pkgs diff --git a/arch.c b/arch.c new file mode 100644 index 0000000..b8e1db5 --- /dev/null +++ b/arch.c @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: AGPL-3.0-or-later + +/* PASST - Plug A Simple Socket Transport + * for qemu/UNIX domain socket mode + * + * PASTA - Pack A Subtle Tap Abstraction + * for network namespace/tap device mode + * + * arch.c - Architecture-specific implementations + * + * Copyright (c) 2022 Red Hat GmbH + * Author: Stefano Brivio <sbrivio(a)redhat.com> + */ + +#include <limits.h> +#include <stdio.h> +#include <string.h> +#include <unistd.h> + +/** + * arch_avx2_exec() - Run AVX2 build if supported, drop suffix from argv[0] + * @argv: Arguments from command line + */ +#ifdef __x86_64__ +void arch_avx2_exec(char **argv) +{ + char *p = strstr(argv[0], ".avx2"); + + if (p) { + *p = 0; + } else if (__builtin_cpu_supports("avx2")) { + char path[PATH_MAX]; + + snprintf(path, PATH_MAX, "%s.avx2", argv[0]); + argv[0] = path; + execve(path, argv, environ); + perror("Can't run AVX2 build, using non-AVX2 version"); + } +} +#else +void arch_avx2_exec(char **argv) { (void)argv; } +#endif diff --git a/arch.h b/arch.h new file mode 100644 index 0000000..ce1c01b --- /dev/null +++ b/arch.h @@ -0,0 +1,6 @@ +/* SPDX-License-Identifier: AGPL-3.0-or-later + * Copyright (c) 2022 Red Hat GmbH + * Author: Stefano Brivio <sbrivio(a)redhat.com> + */ + +void arch_avx2_exec(char **argv); diff --git a/hooks/pre-push b/hooks/pre-push index a3f67f4..6a9b712 100755 --- a/hooks/pre-push +++ b/hooks/pre-push @@ -58,15 +58,6 @@ ssh "${USER_HOST}" "rm -f ${BIN}/*.deb" ssh "${USER_HOST}" "rm -f ${BIN}/*.rpm" scp *.deb *.rpm "${USER_HOST}:${BIN}/" -CFLAGS="-static -DGLIBC_NO_STATIC_NSS" make avx2 -ssh "${USER_HOST}" "mkdir -p ${BIN}/avx2" -scp passt pasta qrap passt.1 pasta.1 qrap.1 "${USER_HOST}:${BIN}/avx2/" - -make pkgs -ssh "${USER_HOST}" "rm -f ${BIN}/avx2/*.deb" -ssh "${USER_HOST}" "rm -f ${BIN}/avx2/*.rpm" -scp *.deb *.rpm "${USER_HOST}:${BIN}/avx2/" - ssh "${USER_HOST}" "mv ${LATEST} ${AWAY}" ssh "${USER_HOST}" "mv ${TEMP} ${LATEST}" ssh "${USER_HOST}" "rm -rf ${AWAY}" diff --git a/passt.c b/passt.c index e7dd108..40d3e57 100644 --- a/passt.c +++ b/passt.c @@ -69,6 +69,7 @@ #include "tap.h" #include "conf.h" #include "pasta.h" +#include "arch.h" #define EPOLL_EVENTS 8 @@ -313,6 +314,8 @@ int main(int argc, char **argv) struct sigaction sa; char *log_name; + arch_avx2_exec(argv); + check_root(); drop_caps(); diff --git a/test/build/all b/test/build/all index 9aa6c61..6043793 100644 --- a/test/build/all +++ b/test/build/all @@ -40,13 +40,3 @@ host CFLAGS="-Werror" make check [ -f passt ] check [ -h pasta ] check [ -f qrap ] - -test Build AVX2 -host make clean -check ! [ -e passt ] -check ! [ -e pasta ] -check ! [ -e qrap ] -host CFLAGS="-Werror" make avx2 -check [ -f passt ] -check [ -h pasta ] -check [ -f qrap ] diff --git a/test/demo/passt b/test/demo/passt index 76aac86..8838363 100644 --- a/test/demo/passt +++ b/test/demo/passt @@ -29,7 +29,7 @@ sleep 1 say and build it. sleep 1 host cd passt -host make avx2 +host make sleep 1 nl diff --git a/test/demo/pasta b/test/demo/pasta index b2dd327..74fca85 100644 --- a/test/demo/pasta +++ b/test/demo/pasta @@ -169,7 +169,7 @@ say more in the "Performance" section below. sleep 3 ns exit passt exit -passt CFLAGS="-g" make avx2 +passt CFLAGS="-g" make sleep 2 passtb perf record -g ./pasta sleep 2 -- 2.34.1

1 0

[PATCH] passt, pasta: Run-time selection of AVX2 build
by Stefano Brivio 28 Feb '22

28 Feb '22

Build-time selection of AVX2 flags and routines is not practical for distributions, but limiting AVX2 usage to checksum routines with specific run-time detection doesn't allow for easy performance gains from auto-vectorisation of batched packet handling routines. For x86_64, build non-AVX2 and AVX2 binaries, and implement a simple wrapper replacing the current executable with the AVX2 build if it's available, and if AVX2 is supported by the current CPU. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- Makefile | 38 ++++++++++++++++++++++++++++---------- README.md | 28 +++++++++++----------------- hooks/pre-push | 9 --------- passt.c | 3 +++ test/build/all | 10 ---------- test/demo/passt | 2 +- test/demo/pasta | 2 +- 7 files changed, 44 insertions(+), 48 deletions(-) diff --git a/Makefile b/Makefile index 031b684..8387719 100644 --- a/Makefile +++ b/Makefile @@ -14,8 +14,11 @@ ifeq ($(RLIMIT_STACK_VAL),unlimited) RLIMIT_STACK_VAL := 1024 endif -AUDIT_ARCH := $(shell uname -m | tr [a-z] [A-Z]) -AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/^ARM.*/ARM/') +# Get 'uname -m'-like architecture description for target +TARGET_ARCH := $(shell $(CC) -dumpmachine | cut -f1 -d- | tr [a-z] [A-Z]) +TARGET_ARCH := $(shell echo $(TARGET_ARCH) | sed 's/POWERPC/PPC/') + +AUDIT_ARCH := $(shell echo $(TARGET_ARCH) | sed 's/^ARM.*/ARM/') AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/I[456]86/I386/') AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/PPC64/PPC/') AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/PPCLE/PPC64LE/') @@ -25,7 +28,7 @@ CFLAGS += -DPAGE_SIZE=$(shell getconf PAGE_SIZE) CFLAGS += -DNETNS_RUN_DIR=\"/run/netns\" CFLAGS += -DPASST_AUDIT_ARCH=AUDIT_ARCH_$(AUDIT_ARCH) CFLAGS += -DRLIMIT_STACK_VAL=$(RLIMIT_STACK_VAL) -CFLAGS += -DARCH=\"$(shell uname -m)\" +CFLAGS += -DARCH=\"$(TARGET_ARCH)\" # On gcc 11.2, with -O2 and -flto, tcp_hash() and siphash_20b(), if inlined, # seem to be hitting something similar to: @@ -63,10 +66,13 @@ endif prefix ?= /usr/local +ifeq ($(TARGET_ARCH),X86_64) +all: passt passt.avx2 pasta pasta.avx2 qrap +BIN := passt passt.avx2 pasta pasta.avx2 qrap +else all: passt pasta qrap - -avx2: CFLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops -avx2: clean all +BIN := passt pasta qrap +endif static: CFLAGS += -static -DGLIBC_NO_STATIC_NSS static: clean all @@ -78,6 +84,16 @@ passt: $(filter-out qrap.c,$(wildcard *.c)) \ $(filter-out qrap.h,$(wildcard *.h)) seccomp.h $(CC) $(CFLAGS) $(filter-out qrap.c,$(wildcard *.c)) -o passt +passt.avx2: CFLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops +passt.avx2: $(filter-out qrap.c,$(wildcard *.c)) \ + $(filter-out qrap.h,$(wildcard *.h)) seccomp.h + $(CC) $(CFLAGS) $(filter-out qrap.c,$(wildcard *.c)) -o passt.avx2 + +passt.avx2: passt + +pasta.avx2: passt.avx2 + ln -s passt.avx2 pasta.avx2 + pasta: passt ln -s passt pasta ln -s passt.1 pasta.1 @@ -88,24 +104,26 @@ qrap: qrap.c passt.h .PHONY: clean clean: - -${RM} passt *.o seccomp.h qrap pasta pasta.1 \ + -${RM} passt passt.avx2 *.o seccomp.h qrap pasta pasta.avx2 pasta.1 \ passt.tar passt.tar.gz *.deb *.rpm -install: passt pasta qrap +install: $(BIN) mkdir -p $(DESTDIR)$(prefix)/bin $(DESTDIR)$(prefix)/share/man/man1 - cp -d passt pasta qrap $(DESTDIR)$(prefix)/bin + cp -d $(BIN) $(DESTDIR)$(prefix)/bin cp -d passt.1 pasta.1 qrap.1 $(DESTDIR)$(prefix)/share/man/man1 uninstall: -${RM} $(DESTDIR)$(prefix)/bin/passt + -${RM} $(DESTDIR)$(prefix)/bin/passt.avx2 -${RM} $(DESTDIR)$(prefix)/bin/pasta + -${RM} $(DESTDIR)$(prefix)/bin/pasta.avx2 -${RM} $(DESTDIR)$(prefix)/bin/qrap -${RM} $(DESTDIR)$(prefix)/share/man/man1/passt.1 -${RM} $(DESTDIR)$(prefix)/share/man/man1/pasta.1 -${RM} $(DESTDIR)$(prefix)/share/man/man1/qrap.1 pkgs: - tar cf passt.tar -P --xform 's//\/usr\/bin\//' passt pasta qrap + tar cf passt.tar -P --xform 's//\/usr\/bin\//' $(BIN) tar rf passt.tar -P --xform 's//\/usr\/share\/man\/man1\//' \ passt.1 pasta.1 qrap.1 gzip passt.tar diff --git a/README.md b/README.md index 14e1777..4966e15 100644 --- a/README.md +++ b/README.md @@ -220,7 +220,7 @@ speeding up local connections, and usually requiring NAT. _pasta_: * Linux * ✅ starting from 4.18 kernel version * ✅ starting from 3.13 kernel version -* 🛠 build-time selection of AVX2 instructions (as much as possible) +* ✅ run-time selection of AVX2 build * ⌚ [_musl_](https://bugs.passt.top/show_bug.cgi?id=4) and [_uClibc-ng_](https://bugs.passt.top/show_bug.cgi?id=5) * ⌚ [FreeBSD](https://bugs.passt.top/show_bug.cgi?id=6), @@ -467,15 +467,12 @@ Test logs [here](/builds/latest/test/). cd passt make - * alternatively, static builds for x86_64, with or without AVX2 instructions, - as of the latest commit are also available for convenience - [here](/builds/latest/x86_64/avx2/) and - [here](/builds/latest/x86_64/). Convenience, non-official - packages for Debian (and derivatives) and RPM-based distributions are also - available there. These binaries and packages are simply built with: + * alternatively, static builds for x86_64 as of the latest commit are also + available for convenience [here](/builds/latest/x86_64/). Convenience, + non-official packages for Debian (and derivatives) and RPM-based + distributions are also available there. These binaries and packages are + simply built with: - CFLAGS="-static" make avx2 - make pkgs make static make pkgs @@ -530,15 +527,12 @@ Test logs [here](/builds/latest/test/). cd passt make - * alternatively, static builds for x86_64, with or without AVX2 instructions, - as of the latest commit are also available for convenience - [here](/builds/latest/x86_64/avx2/) and - [here](/builds/latest/x86_64/). Convenience, non-official - packages for Debian (and derivatives) and RPM-based distributions are also - available there. These binaries and packages are simply built with: + * alternatively, static builds for x86_64 as of the latest commit are also + available for convenience [here](/builds/latest/x86_64/). Convenience, + non-official packages for Debian (and derivatives) and RPM-based + distributions are also available there. These binaries and packages are + simply built with: - CFLAGS="-static" make avx2 - make pkgs make static make pkgs diff --git a/hooks/pre-push b/hooks/pre-push index a3f67f4..6a9b712 100755 --- a/hooks/pre-push +++ b/hooks/pre-push @@ -58,15 +58,6 @@ ssh "${USER_HOST}" "rm -f ${BIN}/*.deb" ssh "${USER_HOST}" "rm -f ${BIN}/*.rpm" scp *.deb *.rpm "${USER_HOST}:${BIN}/" -CFLAGS="-static -DGLIBC_NO_STATIC_NSS" make avx2 -ssh "${USER_HOST}" "mkdir -p ${BIN}/avx2" -scp passt pasta qrap passt.1 pasta.1 qrap.1 "${USER_HOST}:${BIN}/avx2/" - -make pkgs -ssh "${USER_HOST}" "rm -f ${BIN}/avx2/*.deb" -ssh "${USER_HOST}" "rm -f ${BIN}/avx2/*.rpm" -scp *.deb *.rpm "${USER_HOST}:${BIN}/avx2/" - ssh "${USER_HOST}" "mv ${LATEST} ${AWAY}" ssh "${USER_HOST}" "mv ${TEMP} ${LATEST}" ssh "${USER_HOST}" "rm -rf ${AWAY}" diff --git a/passt.c b/passt.c index e7dd108..40d3e57 100644 --- a/passt.c +++ b/passt.c @@ -69,6 +69,7 @@ #include "tap.h" #include "conf.h" #include "pasta.h" +#include "arch.h" #define EPOLL_EVENTS 8 @@ -313,6 +314,8 @@ int main(int argc, char **argv) struct sigaction sa; char *log_name; + arch_avx2_exec(argv); + check_root(); drop_caps(); diff --git a/test/build/all b/test/build/all index 9aa6c61..6043793 100644 --- a/test/build/all +++ b/test/build/all @@ -40,13 +40,3 @@ host CFLAGS="-Werror" make check [ -f passt ] check [ -h pasta ] check [ -f qrap ] - -test Build AVX2 -host make clean -check ! [ -e passt ] -check ! [ -e pasta ] -check ! [ -e qrap ] -host CFLAGS="-Werror" make avx2 -check [ -f passt ] -check [ -h pasta ] -check [ -f qrap ] diff --git a/test/demo/passt b/test/demo/passt index 76aac86..8838363 100644 --- a/test/demo/passt +++ b/test/demo/passt @@ -29,7 +29,7 @@ sleep 1 say and build it. sleep 1 host cd passt -host make avx2 +host make sleep 1 nl diff --git a/test/demo/pasta b/test/demo/pasta index b2dd327..74fca85 100644 --- a/test/demo/pasta +++ b/test/demo/pasta @@ -169,7 +169,7 @@ say more in the "Performance" section below. sleep 3 ns exit passt exit -passt CFLAGS="-g" make avx2 +passt CFLAGS="-g" make sleep 2 passtb perf record -g ./pasta sleep 2 -- 2.34.1

1 0