From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=PAgUGXQb; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id 68E215A0619 for ; Tue, 28 Oct 2025 08:43:41 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761637420; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=zgVbO8D2p9mn/KFg9C7m5VEVsf6yEQr4wUe7KCdjFOM=; b=PAgUGXQbbCWsQRk7s3R8PPyeb54oKVQFPKMf1E2Ojv3G0Wl7bmlaVmaFbrWwgs9l3dhVLG ZiGoGB21SvRuURPPk94Ewf4GzrlQfO+8DDUf5/yzhaq1OvMFMk5SBgtKSJMKfYRnnfjiOC 8wS5+iQjtLYrWIoO0OOJ1K3hDSqwMkY= Received: from mail-ed1-f69.google.com (mail-ed1-f69.google.com [209.85.208.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-61-ml2_ceXAPEyNRLi1U0KODQ-1; Tue, 28 Oct 2025 03:43:39 -0400 X-MC-Unique: ml2_ceXAPEyNRLi1U0KODQ-1 X-Mimecast-MFC-AGG-ID: ml2_ceXAPEyNRLi1U0KODQ_1761637418 Received: by mail-ed1-f69.google.com with SMTP id 4fb4d7f45d1cf-63c276d535bso5687364a12.3 for ; Tue, 28 Oct 2025 00:43:38 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1761637417; x=1762242217; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=zgVbO8D2p9mn/KFg9C7m5VEVsf6yEQr4wUe7KCdjFOM=; b=f0lZ3cUm/5MfIqDkucEgn7zdzi3V+2VB1lcHCdjJHu/NPZk9gywnXm61kny+YbTlr2 Gvk2KSn8SsThnClxvUA67XHRVFOZ4PBNriRF0C+/DCTWT8WTUXpfOvtdSnXk47v5fbi7 zo18OrQdKmrhzSiF+4NlbW5Ugp/gc3/VhnHs2zXk8uluD8gXqamLt4k6ah2sIcvhG1o4 Vq16VhNJjz7vGXFTtB0OhG+LMKsvK3shAx2VO/ejD0X6jASFhDfTxlgowaqwM+Nb18GR NZfbKbQ/n6yABuA8mAbkcrUNH6Ds0zXvOcGJu4/H9vDqNVgnYnPgNhBaic+fo+kcU9Oi i7MA== X-Gm-Message-State: AOJu0YyT5U4QwRz9+vui34adq9lW9f54XoOput/CPyGTu5eAatv5jXfQ 9hY59NDV296GCpi+aSUlPzMFqbFXif7azGU4pBG0mt+Qy6IW5CVN3BTDkHOI7ZcYLZbrHtSevi0 /L/xpGGzYFp4wk6o1PhVcCrhje947OfqRfj7UufqfuqvTtJSaNk7oVHtHJRaggmXLjFwSfKnIZn lBcsnwaquVu9JcVEYj68y02l8620qYBnZVGuTmh1Q= X-Gm-Gg: ASbGncv8ctX8KAispYNhbORBV1rnLyf71rv9JmH5kIwNRb02U46DQRYzyqSa4rp4Lpb rZ3hsTF+vIkmOoGBcezPmS9VWwemMnoVEODzQvDjorKSDNWuReseGifWZJetWF9Fj0Nfzeq3dJJ o2o3q0JaW64X6pBX0Ivfjq7ydXW3D4it9PnOUaIUk++SVArnPtxFaLWVkx X-Received: by 2002:a05:6402:1456:b0:63e:7149:5155 with SMTP id 4fb4d7f45d1cf-63ed8266921mr2324287a12.2.1761637417264; Tue, 28 Oct 2025 00:43:37 -0700 (PDT) X-Google-Smtp-Source: AGHT+IF8mLs62lA+KcJVOrui/+I+q9YcNtx4ZBMpc1YfRFQkyHCiMAjHes5SYen2hGwd4+k4rTri5dyuhZeW2wWu/Dw= X-Received: by 2002:a05:6402:1456:b0:63e:7149:5155 with SMTP id 4fb4d7f45d1cf-63ed8266921mr2324272a12.2.1761637416808; Tue, 28 Oct 2025 00:43:36 -0700 (PDT) MIME-Version: 1.0 References: <20251017062838.21041-1-yuhuang@redhat.com> <20251017062838.21041-4-yuhuang@redhat.com> <20251024010431.4329a843@elisabeth> In-Reply-To: <20251024010431.4329a843@elisabeth> From: Yumei Huang Date: Tue, 28 Oct 2025 15:43:25 +0800 X-Gm-Features: AWmQ_bnwtgMw2rlo05rGwMOVwbJZP2vBaB021jYlHhBbGUw59lWU8giVChKTU0Y Message-ID: Subject: Re: [PATCH v6 3/4] tcp: Resend SYN for inbound connections To: Stefano Brivio X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: pLRvGviQCXazwAzYE0L-wEoMExS5Y1f0AoTdbMkDqKs_1761637418 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Message-ID-Hash: EK2MSTYDK2XVKNANHYG4RUYQHEJW2JCE X-Message-ID-Hash: EK2MSTYDK2XVKNANHYG4RUYQHEJW2JCE X-MailFrom: yuhuang@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, david@gibson.dropbear.id.au X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Fri, Oct 24, 2025 at 7:04=E2=80=AFAM Stefano Brivio = wrote: > > On Fri, 17 Oct 2025 14:28:37 +0800 > Yumei Huang wrote: > > > If a client connects while guest is not connected or ready yet, > > resend SYN instead of just resetting connection after 10 seconds. > > > > Use the same backoff calculation for the timeout as linux kernel. > > Linux. > > > > > Link: https://bugs.passt.top/show_bug.cgi?id=3D153 > > Signed-off-by: Yumei Huang > > --- > > tcp.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++-------- > > tcp.h | 5 +++++ > > 2 files changed, 52 insertions(+), 8 deletions(-) > > > > diff --git a/tcp.c b/tcp.c > > index 2ec4b0c..9385132 100644 > > --- a/tcp.c > > +++ b/tcp.c > > @@ -179,9 +179,11 @@ > > * > > * Timeouts are implemented by means of timerfd timers, set based on f= lags: > > * > > - * - SYN_TIMEOUT: if no ACK is received from tap/guest during handshak= e (flag > > - * ACK_FROM_TAP_DUE without ESTABLISHED event) within this time, res= et the > > - * connection > > + * - SYN_TIMEOUT_INIT: if no ACK is received from tap/guest during han= dshake > > + * (flag ACK_FROM_TAP_DUE without ESTABLISHED event) within this tim= e, resend > > + * SYN. It's the starting timeout for the first SYN retry. If this p= ersists > > "If this persists" makes sense for the existing ACK_TIMEOUT > description but not here, because it looks like it refers to "starting > timeout". > > Coupled with the next patch, it becomes increasingly difficult to > understand what "this" persisting thing is. > > Maybe directly say "Retry for ..., then reset the connection"? It's > shorter and clearer. > > > + * for more than TCP_MAX_RETRIES or (tcp_syn_retries + > > + * tcp_syn_linear_timeouts) times in a row, reset the connection > > * > > * - ACK_TIMEOUT: if no ACK segment was received from tap/guest, after= sending > > * data (flag ACK_FROM_TAP_DUE with ESTABLISHED event), re-send data= from the > > @@ -340,7 +342,7 @@ enum { > > #define WINDOW_DEFAULT 14600 /* RFC 69= 28 */ > > > > #define ACK_INTERVAL 10 /* ms */ > > -#define SYN_TIMEOUT 10 /* s */ > > +#define SYN_TIMEOUT_INIT 1 /* s */ > > Maybe mention RFC 6928 as done above? That's where this value comes > from. > > I just noticed you do that in 4/4, so it's slightly nicer if you do > that right away here for ease of future reference, but not really > needed. > > > #define ACK_TIMEOUT 2 > > #define FIN_TIMEOUT 60 > > #define ACT_TIMEOUT 7200 > > @@ -365,6 +367,9 @@ uint8_t tcp_migrate_rcv_queue [TCP_MIGR= ATE_RCV_QUEUE_MAX]; > > > > #define TCP_MIGRATE_RESTORE_CHUNK_MIN 1024 /* Try smaller when = above this */ > > > > +#define TCP_SYN_RETRIES "/proc/sys/net/ipv4/tcp_syn_retri= es" > > +#define TCP_SYN_LINEAR_TIMEOUTS "/proc/sys/net/ipv4/tcp_syn_linea= r_timeouts" \ > > This uses 121 columns. I'm not sure where all those tabs and \ come > from. My bad. I renamed the macro and it fits in 80 columns but I forgot to remove the '\' and the spaces before that. > > > + > > /* "Extended" data (not stored in the flow table) for TCP flow migrati= on */ > > static struct tcp_tap_transfer_ext migrate_ext[FLOW_MAX]; > > > > @@ -581,8 +586,13 @@ static void tcp_timer_ctl(const struct ctx *c, str= uct tcp_tap_conn *conn) > > if (conn->flags & ACK_TO_TAP_DUE) { > > it.it_value.tv_nsec =3D (long)ACK_INTERVAL * 1000 * 1000; > > } else if (conn->flags & ACK_FROM_TAP_DUE) { > > - if (!(conn->events & ESTABLISHED)) > > - it.it_value.tv_sec =3D SYN_TIMEOUT; > > + if (!(conn->events & ESTABLISHED)) { > > + if (conn->retries < c->tcp.syn_linear_timeouts) > > + it.it_value.tv_sec =3D SYN_TIMEOUT_INIT; > > + else > > + it.it_value.tv_sec =3D SYN_TIMEOUT_INIT <= < > > + (conn->retries - c->tcp.syn_linea= r_timeouts); > > Probably more readable, but I haven't tried: always start from > SYN_TIMEOUT_INIT, then multiply/shift if > conn->retries >=3D c->tcp.syn_linear_timeouts. I guess you meant: if (!(conn->events & ESTABLISHED)) { it.it_value.tv_sec =3D SYN_TIMEOUT_INIT; if (conn->retries >=3D c->tcp.syn_linear_timeouts) it.it_value.tv_sec =3D SYN_TIMEOUT_INIT << (conn->retries - c->tcp.syn_linear_timeouts); other than something like: it.it_value.tv_sec <<=3D 1 in above second if block, since the latter would cause it.it_value.tv_sec=3D2 always when retries>=3Dsyn_linear_timeouts, as it.it_value.tv_sec is set to SYN_TIMEOUT_INIT before the if condition. If I'm correct, I'm not sure if it's more readable to change to that. I feel the if/else clause quite matches the way the kernel handles it. What do you think? > > > + } > > else > > it.it_value.tv_sec =3D ACK_TIMEOUT; > > } else if (CONN_HAS(conn, SOCK_FIN_SENT | TAP_FIN_ACKED)) { > > @@ -2409,8 +2419,17 @@ void tcp_timer_handler(const struct ctx *c, unio= n epoll_ref ref) > > tcp_timer_ctl(c, conn); > > } else if (conn->flags & ACK_FROM_TAP_DUE) { > > if (!(conn->events & ESTABLISHED)) { > > - flow_dbg(conn, "handshake timeout"); > > - tcp_rst(c, conn); > > + if (conn->retries >=3D TCP_MAX_RETRIES || > > + conn->retries >=3D (c->tcp.tcp_syn_retries + > > + c->tcp.syn_linear_timeouts)= ) { > > + flow_dbg(conn, "handshake timeout"); > > + tcp_rst(c, conn); > > + } else { > > + flow_trace(conn, "SYN timeout, retry"); > > + tcp_send_flag(c, conn, SYN); > > + conn->retries++; > > I think I already raised this point on a previous revision: this needs > to be zeroed as the connection is established, but I don't see that in > the current version. > > > + tcp_timer_ctl(c, conn); > > + } > > } else if (CONN_HAS(conn, SOCK_FIN_SENT | TAP_FIN_ACKED))= { > > flow_dbg(conn, "FIN timeout"); > > tcp_rst(c, conn); > > @@ -2766,6 +2785,24 @@ static socklen_t tcp_probe_tcp_info(void) > > return sl; > > } > > > > +/** > > + * tcp_syn_params_init() - Get initial SYN parameters for inbound conn= ection > > They're not initial, they'll be used for all the connections if I > understand correctly. > > Maybe "Get SYN retries sysctl values"? > I think the _init() in the > function name is also somewhat misleading. Do you have a better idea for the function name? I named it just like other functions called in tcp_init(), such as tcp_sock_iov_init(), tcp_splice_init(). > > > + * @c: Execution context > > +*/ > > +void tcp_syn_params_init(struct ctx *c) > > +{ > > + intmax_t tcp_syn_retries, syn_linear_timeouts; > > + > > + tcp_syn_retries =3D read_file_integer(TCP_SYN_RETRIES, 8); > > Why 8? Perhaps a #define would help? The 8 actually comes from your suggestion in v1: " (optional, and might be in another series, but keeping it together with the rest might be more convenient): read tcp_syn_retries, limit to 8, and also read tcp_syn_linear_timeouts " I guess it can be replaced with 6 as it's the default value according to Documentation/networking/ip-sysctl.rst. We already have TCP_SYN_RETRIES for the sysctl file, maybe have another TCP_SYN_RETRIES_DEFAULT for the number? > > > + syn_linear_timeouts =3D read_file_integer(TCP_SYN_LINEAR_TIMEOUTS= , 1); The default value is 4 as Documentation/networking/ip-sysctl.rst. I don't quite remember where the 1 is from. Should we update it as well and add the similar macro as above? > > + > > + c->tcp.tcp_syn_retries =3D MIN(tcp_syn_retries, UINT8_MAX); > > + c->tcp.syn_linear_timeouts =3D MIN(syn_linear_timeouts, UINT8_MAX= ); > > + > > + debug("TCP SYN parameters: retries=3D%"PRIu8", linear_timeouts=3D= %"PRIu8, > > Similar to the comment above: these are not parameters of SYN segments > (which would seem to imply TCP options, such as the MSS). > > We typically don't print C assignments, rather human-readable messages, > so that could be "Read sysctl values tcp_syn_retries: ..., > syn_linear_timeouts: ...". Got it. > > > > + c->tcp.tcp_syn_retries, c->tcp.syn_linear_timeouts); > > +} > > + > > /** > > * tcp_init() - Get initial sequence, hash secret, initialise per-sock= et data > > * @c: Execution context > > @@ -2776,6 +2813,8 @@ int tcp_init(struct ctx *c) > > { > > ASSERT(!c->no_tcp); > > > > + tcp_syn_params_init(c); > > + > > tcp_sock_iov_init(c); > > > > memset(init_sock_pool4, 0xff, sizeof(init_sock_pool4)); > > diff --git a/tcp.h b/tcp.h > > index 234a803..4369b52 100644 > > --- a/tcp.h > > +++ b/tcp.h > > @@ -59,12 +59,17 @@ union tcp_listen_epoll_ref { > > * @fwd_out: Port forwarding configuration for outbound packet= s > > * @timer_run: Timestamp of most recent timer run > > * @pipe_size: Size of pipes for spliced connections > > + * @tcp_syn_retries: Number of SYN retries during handshake > > + * @syn_linear_timeouts: Number of SYN retries using linear backoff ti= meout > > + * before switching to exponential backoff timeout > > Maybe more compact: > > * @syn_linear_timeouts: SYN retries before using exponential time= out So we remove the '"Number of" as well? I guess we should make it consistent for both tcp_syn_retries and syn_linear_timeouts. > > > */ > > struct tcp_ctx { > > struct fwd_ports fwd_in; > > struct fwd_ports fwd_out; > > struct timespec timer_run; > > size_t pipe_size; > > + uint8_t tcp_syn_retries; > > + uint8_t syn_linear_timeouts; > > }; > > > > #endif /* TCP_H */ > > -- > Stefano > --=20 Thanks, Yumei Huang