From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202510 header.b=kp9jy9Oq; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 474585A0619 for ; Fri, 17 Oct 2025 01:35:02 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202510; t=1760657700; bh=pq44grSsRTIyk2Lk5GhKnuTJy52lO5+jXRBy0GKxNZo=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=kp9jy9OqzQ1ZCxrkwGJmEkmOgNSmFqsFqV3C7dXQvuD9r3ojUyQZHFVFf6Q+nCLoV wkNkV3nrgeTOmhCwkGHkDiDgg9xJUiva0FLHcUbiCjwiIbktWGeXw2RbAr28t+ReOf 5931MNJ+Gtv8cFA5PLGAvgA1/vK9P9gwvpIZJGRqBe5Abfv0j6Zh2XSQ3qka314T5N c6bameWG6wFhKUQud8tpyHpHmRypveFEzZqDSQUAn+Afvb5xR06pYcPJI+SeziOJCP nY3ZGOcBQKkCBi8jI5W5BPmT/BedrGeCTBc5JL1U1rLVtNkjSHvyH2k8tUJUge79bu 8CZFJqtJhisNA== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4cnknw0XQHz4wCq; Fri, 17 Oct 2025 10:35:00 +1100 (AEDT) Date: Fri, 17 Oct 2025 10:34:55 +1100 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH v4 3/4] tcp: Resend SYN for inbound connections Message-ID: References: <20251016023423.8923-1-yuhuang@redhat.com> <20251016023423.8923-4-yuhuang@redhat.com> <20251017002246.20a6dc40@elisabeth> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="nYGwpDK8q5m0nY67" Content-Disposition: inline In-Reply-To: <20251017002246.20a6dc40@elisabeth> Message-ID-Hash: TLVF4U57E6YHAWWKUCTJWTMO7XKS7S77 X-Message-ID-Hash: TLVF4U57E6YHAWWKUCTJWTMO7XKS7S77 X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Yumei Huang , passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --nYGwpDK8q5m0nY67 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Oct 17, 2025 at 12:22:46AM +0200, Stefano Brivio wrote: > On Thu, 16 Oct 2025 10:34:22 +0800 > Yumei Huang wrote: >=20 > > If a client connects while guest is not connected or ready yet, > > resend SYN instead of just resetting connection after 10 seconds. > >=20 > > Use the same backoff calculation for the timeout as linux kernel. > >=20 > > Signed-off-by: Yumei Huang > > --- > > tcp.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++-------- > > tcp.h | 2 ++ > > 2 files changed, 49 insertions(+), 8 deletions(-) > >=20 > > diff --git a/tcp.c b/tcp.c > > index 2ec4b0c..3003333 100644 > > --- a/tcp.c > > +++ b/tcp.c > > @@ -179,9 +179,11 @@ > > * > > * Timeouts are implemented by means of timerfd timers, set based on f= lags: > > * > > - * - SYN_TIMEOUT: if no ACK is received from tap/guest during handshak= e (flag > > - * ACK_FROM_TAP_DUE without ESTABLISHED event) within this time, res= et the > > - * connection > > + * - SYN_TIMEOUT_INIT: if no ACK is received from tap/guest during han= dshake > > + * (flag ACK_FROM_TAP_DUE without ESTABLISHED event) within this tim= e, resend > > + * SYN. It's the starting timeout for the first SYN retry. If this p= ersists > > + * for more than TCP_MAX_RETRIES or (tcp_syn_retries + > > + * tcp_syn_linear_timeouts) times in a row, reset the connection > > * > > * - ACK_TIMEOUT: if no ACK segment was received from tap/guest, after= sending > > * data (flag ACK_FROM_TAP_DUE with ESTABLISHED event), re-send data= from the > > @@ -340,7 +342,7 @@ enum { > > #define WINDOW_DEFAULT 14600 /* RFC 6928 */ > > =20 > > #define ACK_INTERVAL 10 /* ms */ > > -#define SYN_TIMEOUT 10 /* s */ > > +#define SYN_TIMEOUT_INIT 1 /* s */ > > #define ACK_TIMEOUT 2 > > #define FIN_TIMEOUT 60 > > #define ACT_TIMEOUT 7200 > > @@ -365,6 +367,10 @@ uint8_t tcp_migrate_rcv_queue [TCP_MIGRATE_RCV_QU= EUE_MAX]; > > =20 > > #define TCP_MIGRATE_RESTORE_CHUNK_MIN 1024 /* Try smaller when above t= his */ > > =20 > > +#define TCP_SYN_RETRIES_SYSCTL "/proc/sys/net/ipv4/tcp_syn_retries" > > +#define TCP_SYN_LINEAR_TIMEOUTS_SYSCTL \ > > + "/proc/sys/net/ipv4/tcp_syn_linear_timeouts" >=20 > It's quite obvious those are names of sysctl entries, I think we can > drop the _SYSCTL suffix and keep this shorter without losing any > information/indication. >=20 > > + > > /* "Extended" data (not stored in the flow table) for TCP flow migrati= on */ > > static struct tcp_tap_transfer_ext migrate_ext[FLOW_MAX]; > > =20 > > @@ -581,8 +587,13 @@ static void tcp_timer_ctl(const struct ctx *c, str= uct tcp_tap_conn *conn) > > if (conn->flags & ACK_TO_TAP_DUE) { > > it.it_value.tv_nsec =3D (long)ACK_INTERVAL * 1000 * 1000; > > } else if (conn->flags & ACK_FROM_TAP_DUE) { > > - if (!(conn->events & ESTABLISHED)) > > - it.it_value.tv_sec =3D SYN_TIMEOUT; > > + if (!(conn->events & ESTABLISHED)) { > > + if (conn->retries < c->tcp.syn_linear_timeouts) > > + it.it_value.tv_sec =3D SYN_TIMEOUT_INIT; > > + else > > + it.it_value.tv_sec =3D SYN_TIMEOUT_INIT << > > + (conn->retries - c->tcp.syn_linear_timeouts); > > + } > > else > > it.it_value.tv_sec =3D ACK_TIMEOUT; > > } else if (CONN_HAS(conn, SOCK_FIN_SENT | TAP_FIN_ACKED)) { > > @@ -2409,8 +2420,16 @@ void tcp_timer_handler(const struct ctx *c, unio= n epoll_ref ref) > > tcp_timer_ctl(c, conn); > > } else if (conn->flags & ACK_FROM_TAP_DUE) { > > if (!(conn->events & ESTABLISHED)) { > > - flow_dbg(conn, "handshake timeout"); > > - tcp_rst(c, conn); > > + if (conn->retries >=3D MIN(TCP_MAX_RETRIES, > > + (c->tcp.tcp_syn_retries + c->tcp.syn_linear_timeouts))) { >=20 > That doesn't seem to match the sysctl documentation for > tcp_syn_retries, which should be the *total* number of retries, not > excluding the ones with "linear timeouts". No, but it does match the actual kernel behaviour (Yumei already experimented and discovered this). Confirmed it in the kernel code, here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net= /ipv4/tcp_timer.c#n258 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --nYGwpDK8q5m0nY67 Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmjxgR4ACgkQzQJF27ox 2Geolg//XqX1W6wufo9YyTFrT2aW1poMdU9ijxSa7zq/c7AcPw32RJncvqUL6hpJ zrEtjvwHa0wBx/o/1AGEjXWMXjNQUPTJ4Ot2RctcbYsr/V62q9i0fNf3I3/zk69j GbkdpI7msJc16fvVDeSnpO2NWJviPkw/OAg758DuibDQonJ2fLotPOUcm5b7I4PG 9W3/ItijSwwmqtD/u7t+U+c1dOPBvlUdc+V2Vcw1363bAthoc7XUYDc7EIdjP8qP IHXB6PkADVjyE55mQ5s6DO1FRQ+a61lwqzihJ5ZBuLEUQNwuNicq85LAW2gN24ns DlRDRLyz+RBz/00CX7Cgb8JaScx1dPv7OIzgxQgdf8IMRmpw0AcIjchxQBtRsT1I qf0WPKs6/SL3t+JU5ZZgnmN8MKXiWrqQie+z0U5QpsjfJLgrMFmOjdRfubk31iJF LuH0cQhPukMDRJCLKEUpETNM3JrTqlcXL6BIaqmNnO5+7p+krIUbdDQ7j3QBhWN6 N9JtsqjpTtZGbZ5wph04O832JHWmSeQvDJSdze2jzEa3ZwH/v9FULe8cC6aAguif 4kxPJP6DCBMzZDD89QCC1Usa1IOrheQaVOFWro9LAcIM9kfjGSoPI5mbYNDgagw7 S5JGCcvVhIfEfrtshkPW+gYGduS2X779DDCemgO/nUMZOueRm1I= =m7A+ -----END PGP SIGNATURE----- --nYGwpDK8q5m0nY67--