From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=gF08caJB; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by passt.top (Postfix) with ESMTPS id 45FC65A026F for ; Mon, 13 Oct 2025 12:22:16 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1760350935; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=PWNgYHA+7TgBz6abj5f4peudxgZFVVbnSmeaSrsHev8=; b=gF08caJByiQAMGP9TXQ7CnUgogn0+yXRXaNGG8tp5gVpLUEOuQ6qxUlHqEj07XW9Gd6OL2 lEAE0vt2TAk7ldSZwJZIi4vQAa1JxmFYAttJbHalB/AWq6Wd/vMVfg0+5kC+aZbVDB1xx+ 5Nzd+q8T3SaqlMgH4bsSURKjwS/ckWw= Received: from mail-ed1-f69.google.com (mail-ed1-f69.google.com [209.85.208.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-492-a5wUB35RP_OJPiTaKO5ecA-1; Mon, 13 Oct 2025 06:22:13 -0400 X-MC-Unique: a5wUB35RP_OJPiTaKO5ecA-1 X-Mimecast-MFC-AGG-ID: a5wUB35RP_OJPiTaKO5ecA_1760350932 Received: by mail-ed1-f69.google.com with SMTP id 4fb4d7f45d1cf-6344e493258so4714275a12.2 for ; Mon, 13 Oct 2025 03:22:13 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1760350932; x=1760955732; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=PWNgYHA+7TgBz6abj5f4peudxgZFVVbnSmeaSrsHev8=; b=LeViuN15AzgCfHUMR5DmM4/X4DEfXi1OG9NNMOj4HM4t8NyNm24SZVFR0ps7Afo1MW IOtS+gARN56mWJW3t3g8awztBQYZesuaixVokT4otqzb9JDnApCHdva11FfCnVy7MnRa AN/zNi0cXoakX124HvsoDOOpG7N8yh6pomd3YkiD+PfYMYTevaKZX02MY9ja4re0XKZ1 bWTEEwCBbGynZ45nN2FPdAoJ0NLPMwq0aBDbAliOMoj5mZDqd7ew2/Z0dzql1pw8tp54 boREyKLCIx2OkgjthyP7K/h9WI4bXsdwf6Ycs7P8SdiOqVI8jXDSff36cjKFwk+rQfe2 n3Dg== X-Gm-Message-State: AOJu0Yy6xaCkIao5GtujujjCrUM2dFZSLGiHltNTBhoQMtjzsSHv5Wll jjsT0BzU1Ms5hs05DBKVXLWcgwwLg7gqoyIoM1u42Xgnko8uGEPFlknVErF/QnX3ZO+sCKzgOt7 KTZTT356Q5CM1siT1GjRYFhT5A+pqwBH2GzfGrVMQKiCFISkTJygxc7cTcco61ZniYvz0I0tS5k ctDpdhXLvU0Nmxaai+iJ+87L4Sca14 X-Gm-Gg: ASbGnctoENYNW9ZdCasKyU2rT4dv+q+9C9xuxktZmnnqlw2JlX/6KOrJpgfGnnOT1Tp C/uQ1nORb8PmO2IQMLHWDRC9rYX5zjLAXLmLQIKfjTNULHhcgg+OIAobBgIfNfUKM9zA8YIWf9Z FSGLedzaVNkEFrULbl5sw7Xg== X-Received: by 2002:a05:6402:35c3:b0:639:fac4:bf35 with SMTP id 4fb4d7f45d1cf-639fac4fb33mr14107245a12.12.1760350932000; Mon, 13 Oct 2025 03:22:12 -0700 (PDT) X-Google-Smtp-Source: AGHT+IE5DczLAjEww/QrxRV1zV4N7l3eiuRJd1PZ9tYM7RPzmlhVRLCEcN0cpg4UvDuP8GgorvhUlQ9QLi3JIiEADTs= X-Received: by 2002:a05:6402:35c3:b0:639:fac4:bf35 with SMTP id 4fb4d7f45d1cf-639fac4fb33mr14107229a12.12.1760350931468; Mon, 13 Oct 2025 03:22:11 -0700 (PDT) MIME-Version: 1.0 References: <20251010074700.22177-1-yuhuang@redhat.com> <20251010074700.22177-3-yuhuang@redhat.com> In-Reply-To: From: Yumei Huang Date: Mon, 13 Oct 2025 18:22:00 +0800 X-Gm-Features: AS18NWA9gZKXmLeyXei-7FPUFp8cGsM5l2xRrlSGE_L6W2vI70jUjfaSAy1aNzc Message-ID: Subject: Re: [PATCH v2 2/3] tcp: Resend SYN for inbound connections To: David Gibson X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: z_cwfy5mj3j10vjRKITHKVA5shKsa1bmkYdPxm_9KbM_1760350932 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Message-ID-Hash: YCJODJONZ6GFZIJXQGQAKYVOU3G6Y7TB X-Message-ID-Hash: YCJODJONZ6GFZIJXQGQAKYVOU3G6Y7TB X-MailFrom: yuhuang@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, sbrivio@redhat.com X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Mon, Oct 13, 2025 at 8:21=E2=80=AFAM David Gibson wrote: > > On Fri, Oct 10, 2025 at 03:46:59PM +0800, Yumei Huang wrote: > > If a client connects while guest is not connected or ready yet, > > resend SYN instead of just resetting connection after 10 seconds. > > > > Use the same backoff calculation for the timeout as linux kernel. > > > > Signed-off-by: Yumei Huang > > --- > > tcp.c | 95 ++++++++++++++++++++++++++++++++++++++++++++++++++++++----- > > tcp.h | 2 ++ > > 2 files changed, 89 insertions(+), 8 deletions(-) > > > > diff --git a/tcp.c b/tcp.c > > index 2ec4b0c..85bbdac 100644 > > --- a/tcp.c > > +++ b/tcp.c > > @@ -179,9 +179,11 @@ > > * > > * Timeouts are implemented by means of timerfd timers, set based on f= lags: > > * > > - * - SYN_TIMEOUT: if no ACK is received from tap/guest during handshak= e (flag > > - * ACK_FROM_TAP_DUE without ESTABLISHED event) within this time, res= et the > > - * connection > > + * - SYN_TIMEOUT_INIT: if no ACK is received from tap/guest during han= dshake > > + * (flag ACK_FROM_TAP_DUE without ESTABLISHED event) within this tim= e, resend > > + * SYN. It's the starting timeout for the first SYN retry. If this p= ersists > > + * for more than TCP_MAX_RETRIES or (tcp_syn_retries + > > + * tcp_syn_linear_timeouts) times in a row, reset the connection > > * > > * - ACK_TIMEOUT: if no ACK segment was received from tap/guest, after= sending > > * data (flag ACK_FROM_TAP_DUE with ESTABLISHED event), re-send data= from the > > @@ -309,6 +311,7 @@ > > #include "tcp_internal.h" > > #include "tcp_buf.h" > > #include "tcp_vu.h" > > +#include "lineread.h" > > > > /* > > * The size of TCP header (including options) is given by doff (Data O= ffset) > > @@ -340,7 +343,7 @@ enum { > > #define WINDOW_DEFAULT 14600 /* RFC 69= 28 */ > > > > #define ACK_INTERVAL 10 /* ms */ > > -#define SYN_TIMEOUT 10 /* s */ > > +#define SYN_TIMEOUT_INIT 1 /* s */ > > #define ACK_TIMEOUT 2 > > As we've discussed in some places, the RFCs largely treat SYN retries > the same as data retransmits. ACK_TIMEOUT controls the latter. 2s is > a little odd, IIRC the RFC suggests 3, I'm not sure what Linux does by > default. In any case, I'm wondering if we should use a single define > for the initial value of both timeouts. Well, as Stefano pointed out, according to Appendix A in RFC 6298, the initial value is suggested to be one second. BTW, as this is for data retransmits which is addressed by the third patch, I kept it not changed in this second patch. I agree we could use one single define for both timeouts. Just not sure how we are supposed to split the patches. Maybe we could remove the SYN_TIMEOUT_INIT in the third patch? What do you think? > > > #define FIN_TIMEOUT 60 > > #define ACT_TIMEOUT 7200 > > @@ -365,6 +368,10 @@ uint8_t tcp_migrate_rcv_queue [TCP_MIGR= ATE_RCV_QUEUE_MAX]; > > > > #define TCP_MIGRATE_RESTORE_CHUNK_MIN 1024 /* Try smaller when = above this */ > > > > +#define TCP_SYN_RETRIES_SYSCTL "/proc/sys/net/ipv4/tcp_s= yn_retries" > > +#define TCP_SYN_LINEAR_TIMEOUTS_SYSCTL = \ > > + "/proc/sys/net/ipv4/tcp_syn_linear_timeouts" > > + > > /* "Extended" data (not stored in the flow table) for TCP flow migrati= on */ > > static struct tcp_tap_transfer_ext migrate_ext[FLOW_MAX]; > > > > @@ -581,8 +588,13 @@ static void tcp_timer_ctl(const struct ctx *c, str= uct tcp_tap_conn *conn) > > if (conn->flags & ACK_TO_TAP_DUE) { > > it.it_value.tv_nsec =3D (long)ACK_INTERVAL * 1000 * 1000; > > } else if (conn->flags & ACK_FROM_TAP_DUE) { > > - if (!(conn->events & ESTABLISHED)) > > - it.it_value.tv_sec =3D SYN_TIMEOUT; > > + if (!(conn->events & ESTABLISHED)) { > > + if (conn->retries < c->tcp.syn_linear_timeouts) > > + it.it_value.tv_sec =3D SYN_TIMEOUT_INIT; > > + else > > + it.it_value.tv_sec =3D SYN_TIMEOUT_INIT <= < > > + (conn->retries - c->tcp.syn_linea= r_timeouts); > > + } > > else > > it.it_value.tv_sec =3D ACK_TIMEOUT; > > } else if (CONN_HAS(conn, SOCK_FIN_SENT | TAP_FIN_ACKED)) { > > @@ -1961,6 +1973,7 @@ static void tcp_conn_from_sock_finish(const struc= t ctx *c, > > } > > > > tcp_send_flag(c, conn, ACK); > > + conn->retries =3D 0; > > I know Stefano said you needed to add this, but on a closer > examination I don't think you do. tcp_tap_handler() calls > tcp_update_seqack_from_tap() if !ESTABLISHED. That will clear > retrans/retries if the ack number from the guest has advanced. That > will occur when the guest SYN-ACKs our SYN, which is exactly the point > at which we should clear the retries count. I see, thanks. Will remove it in v3. > > > > > /* The client might have sent data already, which we didn't > > * dequeue waiting for SYN,ACK from tap -- check now. > > @@ -2409,8 +2422,16 @@ void tcp_timer_handler(const struct ctx *c, unio= n epoll_ref ref) > > tcp_timer_ctl(c, conn); > > } else if (conn->flags & ACK_FROM_TAP_DUE) { > > if (!(conn->events & ESTABLISHED)) { > > - flow_dbg(conn, "handshake timeout"); > > - tcp_rst(c, conn); > > + if (conn->retries =3D=3D MIN(TCP_MAX_RETRIES, > > + (c->tcp.tcp_syn_retries + c->tcp.tcp_syn_= retries))) { > > Should this be tcp_syn_retries + linear_timeouts? Yes, sorry, there must be a copy error. I should have double checked before sending out. > > Also, probably safer to use a >=3D rather than =3D=3D - if we somehow sen= d > an extra retry, we don't want to then retry forever. > > > + flow_dbg(conn, "handshake timeout"); > > + tcp_rst(c, conn); > > + } else { > > + flow_dbg(conn, "SYN timeout, retry"); > > + tcp_send_flag(c, conn, SYN); > > + conn->retries++; > > + tcp_timer_ctl(c, conn); > > + } > > } else if (CONN_HAS(conn, SOCK_FIN_SENT | TAP_FIN_ACKED))= { > > flow_dbg(conn, "FIN timeout"); > > tcp_rst(c, conn); > > @@ -2766,6 +2787,62 @@ static socklen_t tcp_probe_tcp_info(void) > > return sl; > > } > > > > +/** > > + * get_tcp_syn_param() - Read SYN parameters from /proc/sys > > + * @path: Path to the sysctl file > > + * @fallback: Default value if file can't be read > > + * > > + * Return: Parameter value, fallback on failure > > +*/ > > +int get_tcp_syn_param(const char *path, int fallback) > > I wonder if it might be worth making a new function in util.c to read > a file containing a single number. I can do that. So it could be reused in the future. > > > +{ > > + char *line, *end; > > + struct lineread lr; > > + long value; > > + ssize_t len; > > + int fd; > > + > > + fd =3D open(path, O_RDONLY | O_CLOEXEC); > > + if (fd < 0) { > > + debug("Unable to open %s", path); > > + return fallback; > > + } > > + > > + lineread_init(&lr, fd); > > + len =3D lineread_get(&lr, &line); > > + close(fd); > > + > > + if (len < 0) { > > + debug("Unable to read %s", path); > > + return fallback; > > + } > > + > > + errno =3D 0; > > + value =3D strtol(line, &end, 10); > > + if (*end && *end !=3D '\n') { > > + debug("Invalid format in %s", path); > > + return fallback; > > + } > > + if (errno || value < 0 || value > INT_MAX) { > > + debug("Invalid value in %s: %ld", path, value); > > + return fallback; > > + } > > + return (int)value; > > You return an (int) here, but store the value into a uint8_t in the > caller. That will cause unexpected results if the value you read is > greater than 255. Somewhere you need to check for this and clamp the > value. I'd suggest the function actually reading /proc return a long > long (for reuseability), then clamp it in the caller. Yeah, I noticed that. Seems tcp_syn_retries should not be higher than 127 according to Documentation/networking/ip-sysctl.rst, but tcp_syn_linear_timeouts is not limited. Anyway, I should check them. Will update in v3. > > > +} > > + > > +/** > > + * tcp_syn_params_init() - Get initial syn params for inbound connecti= on > > + * @c: Execution context > > +*/ > > +void tcp_syn_params_init(struct ctx *c) > > +{ > > + c->tcp.tcp_syn_retries =3D get_tcp_syn_param(TCP_SYN_RETRIES_SYSC= TL, 8); > > + c->tcp.syn_linear_timeouts =3D > > + get_tcp_syn_param(TCP_SYN_LINEAR_TIMEOUTS_SYSCTL, 1); > > + debug("TCP SYN parameters: retries=3D%d, linear_timeouts=3D%d", > > + c->tcp.tcp_syn_retries, c->tcp.syn_linear_timeouts); > > +} > > + > > /** > > * tcp_init() - Get initial sequence, hash secret, initialise per-sock= et data > > * @c: Execution context > > @@ -2776,6 +2853,8 @@ int tcp_init(struct ctx *c) > > { > > ASSERT(!c->no_tcp); > > > > + tcp_syn_params_init(c); > > + > > tcp_sock_iov_init(c); > > > > memset(init_sock_pool4, 0xff, sizeof(init_sock_pool4)); > > diff --git a/tcp.h b/tcp.h > > index 234a803..df699a4 100644 > > --- a/tcp.h > > +++ b/tcp.h > > @@ -65,6 +65,8 @@ struct tcp_ctx { > > struct fwd_ports fwd_out; > > struct timespec timer_run; > > size_t pipe_size; > > + uint8_t tcp_syn_retries; > > + uint8_t syn_linear_timeouts; > > }; > > > > #endif /* TCP_H */ > > -- > > 2.47.0 > > > > -- > David Gibson (he or they) | I'll have my music baroque, and my code > david AT gibson.dropbear.id.au | minimalist, thank you, not the other wa= y > | around. > http://www.ozlabs.org/~dgibson --=20 Thanks, Yumei Huang