On Fri, Feb 27, 2026 at 03:03:21PM +0100, Laurent Vivier wrote:
> Replace direct iovec pointer arithmetic in UDP vhost-user handling with
> iov_tail operations introduced in the previous commit.
> 
> udp_vu_sock_recv() now takes a struct iov_tail and returns the received
> data length rather than the number of iov entries used.  It uses
> iov_drop_header() to skip past L2/L3/L4 headers before receiving socket
> data, iov_tail_truncate() to trim unused buffer space, and
> iov_tail_zero_end() to zero-pad short frames instead of vu_pad().
> 
> udp_vu_prepare() and udp_vu_csum() take a const struct iov_tail instead
> of referencing the file-scoped iov_vu array directly, making data flow
> explicit.
> 
> udp_vu_csum() uses iov_drop_header() and IOV_REMOVE_HEADER() to locate
> the UDP header and payload, replacing manual offset calculations via
> vu_payloadv4()/vu_payloadv6().
> 
> Signed-off-by: Laurent Vivier <lvivier@redhat.com>
> ---
>  iov.c    |   2 -
>  udp_vu.c | 121 +++++++++++++++++++++++++++----------------------------
>  2 files changed, 60 insertions(+), 63 deletions(-)
> 
> diff --git a/iov.c b/iov.c
> index cb4d6fef5567..8836305fb701 100644
> --- a/iov.c
> +++ b/iov.c
> @@ -175,7 +175,6 @@ bool iov_tail_prune(struct iov_tail *tail)
>   * @tail:	IO vector tail (modified in place, including backing iovecs)
>   * @size:	Maximum number of bytes to keep, relative to current tail offset
>   */
> -/* cppcheck-suppress unusedFunction */
>  void iov_tail_truncate(struct iov_tail *tail, size_t size)
>  {
>  	size_t i, off;
> @@ -195,7 +194,6 @@ void iov_tail_truncate(struct iov_tail *tail, size_t size)
>   * @tail:	IO vector tail (backing buffers modified in place)
>   * @size:	Number of leading bytes to preserve
>   */
> -/* cppcheck-suppress unusedFunction */
>  void iov_tail_zero_end(struct iov_tail *tail, size_t size)
>  {
>  	size_t i, off;
> diff --git a/udp_vu.c b/udp_vu.c
> index 6f6477f7d046..8f4d0aedac10 100644
> --- a/udp_vu.c
> +++ b/udp_vu.c
> @@ -59,21 +59,23 @@ static size_t udp_vu_hdrlen(bool v6)
>  /**
>   * udp_vu_sock_recv() - Receive datagrams from socket into vhost-user buffers
>   * @c:		Execution context
> + * @data:	IO vector tail for the frame (modified on output)
>   * @vq:		virtqueue to use to receive data
>   * @s:		Socket to receive from
>   * @v6:		Set for IPv6 connections
> - * @dlen:	Size of received data (output)
>   *
> - * Return: number of iov entries used to store the datagram, 0 if the datagram
> + * Return: size of received data, 0 if the datagram
>   *         was discarded because the virtqueue is not ready, -1 on error
>   */
> -static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s,
> -			    bool v6, ssize_t *dlen)
> +static ssize_t udp_vu_sock_recv(const struct ctx *c, struct iov_tail *data,
> +				struct vu_virtq *vq, int s, bool v6)
>  {
>  	const struct vu_dev *vdev = c->vdev;
> -	int iov_cnt, idx, iov_used;
> -	size_t off, hdrlen, l2len;
>  	struct msghdr msg  = { 0 };
> +	struct iov_tail payload;
> +	size_t hdrlen;
> +	ssize_t dlen;
> +	int iov_cnt;
>  
>  	ASSERT(!c->no_udp);
>  
> @@ -83,82 +85,77 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s,
>  		if (recvmsg(s, &msg, MSG_DONTWAIT) < 0)
>  			debug_perror("Failed to discard datagram");
>  
> +		data->cnt = 0;
>  		return 0;
>  	}
>  
>  	/* compute L2 header length */
>  	hdrlen = udp_vu_hdrlen(v6);
>  
> -	vu_init_elem(elem, iov_vu, ARRAY_SIZE(elem));
> +	vu_init_elem(elem, (struct iovec *)data->iov, data->cnt);
>  
>  	iov_cnt = vu_collect(vdev, vq, elem, ARRAY_SIZE(elem),
>  			     IP_MAX_MTU + ETH_HLEN + VNET_HLEN, NULL);
>  	if (iov_cnt == 0)
>  		return -1;
>  
> +	data->cnt = iov_cnt;

Does something limit iov_cnt to be <= data->cnt?  If so, it's not very
obvious from here.  If not, then the line above is clearly dangerous.

> +
>  	/* reserve space for the headers */
> -	ASSERT(iov_vu[0].iov_len >= MAX(hdrlen, ETH_ZLEN + VNET_HLEN));
> -	iov_vu[0].iov_base = (char *)iov_vu[0].iov_base + hdrlen;
> -	iov_vu[0].iov_len -= hdrlen;
> +	ASSERT(iov_tail_size(data) >= MAX(hdrlen, ETH_ZLEN + VNET_HLEN));
>  
> -	/* read data from the socket */
> -	msg.msg_iov = iov_vu;
> -	msg.msg_iovlen = iov_cnt;
> +	payload = *data;
> +	iov_drop_header(&payload, hdrlen);
> +
> +	struct iovec msg_iov[payload.cnt];
> +	msg.msg_iov = msg_iov;
> +	msg.msg_iovlen = iov_tail_clone(msg.msg_iov, payload.cnt, &payload);
>  
> -	*dlen = recvmsg(s, &msg, 0);
> -	if (*dlen < 0) {
> +	/* read data from the socket */
> +	dlen = recvmsg(s, &msg, 0);
> +	if (dlen < 0) {
>  		vu_queue_rewind(vq, iov_cnt);
>  		return -1;
>  	}
>  
> -	/* restore the pointer to the headers address */
> -	iov_vu[0].iov_base = (char *)iov_vu[0].iov_base - hdrlen;
> -	iov_vu[0].iov_len += hdrlen;
> -
> -	/* count the numbers of buffer filled by recvmsg() */
> -	idx = iov_skip_bytes(iov_vu, iov_cnt, *dlen + hdrlen, &off);
> -
> -	/* adjust last iov length */
> -	if (idx < iov_cnt)
> -		iov_vu[idx].iov_len = off;
> -	iov_used = idx + !!off;
> -
> -	/* pad frame to 60 bytes: first buffer is at least ETH_ZLEN long */
> -	l2len = *dlen + hdrlen - VNET_HLEN;
> -	vu_pad(&iov_vu[0], l2len);
> +	iov_tail_truncate(data, MAX(dlen + hdrlen, ETH_ZLEN + VNET_HLEN));
> +	iov_tail_zero_end(data, dlen + hdrlen);
> +	iov_tail_truncate(data, dlen + hdrlen);

Zeroing the tail, then truncating it seems kind of weird.

> -	vu_set_vnethdr(vdev, iov_vu[0].iov_base, iov_used);
> +	vu_set_vnethdr(vdev, data->iov[0].iov_base, data->cnt);
>  
>  	/* release unused buffers */
> -	vu_queue_rewind(vq, iov_cnt - iov_used);
> +	vu_queue_rewind(vq, iov_cnt - data->cnt);
>  
> -	return iov_used;
> +	return dlen;
>  }
>  
>  /**
>   * udp_vu_prepare() - Prepare the packet header
>   * @c:		Execution context
> + * @data:	IO vector tail for the frame
>   * @toside:	Address information for one side of the flow
>   * @dlen:	Packet data length
>   *
>   * Return: Layer-4 length
>   */
> -static size_t udp_vu_prepare(const struct ctx *c,
> +static size_t udp_vu_prepare(const struct ctx *c, const struct iov_tail *data,
>  			     const struct flowside *toside, ssize_t dlen)
>  {
> +	const struct iovec *iov = data->iov;
>  	struct ethhdr *eh;
>  	size_t l4len;
>  
>  	/* ethernet header */
> -	eh = vu_eth(iov_vu[0].iov_base);
> +	eh = vu_eth(iov[0].iov_base);

Now that you have an iov_tail, could you clone it and use
IOV_{PEEK,REMOVE}_HEADER() instead of the more specific vu_eth(),
vu_ip() etc?

>  
>  	memcpy(eh->h_dest, c->guest_mac, sizeof(eh->h_dest));
>  	memcpy(eh->h_source, c->our_tap_mac, sizeof(eh->h_source));
>  
>  	/* initialize header */
>  	if (inany_v4(&toside->eaddr) && inany_v4(&toside->oaddr)) {
> -		struct iphdr *iph = vu_ip(iov_vu[0].iov_base);
> -		struct udp_payload_t *bp = vu_payloadv4(iov_vu[0].iov_base);
> +		struct iphdr *iph = vu_ip(iov[0].iov_base);
> +		struct udp_payload_t *bp = vu_payloadv4(iov[0].iov_base);
>  
>  		eh->h_proto = htons(ETH_P_IP);
>  
> @@ -166,8 +163,8 @@ static size_t udp_vu_prepare(const struct ctx *c,
>  
>  		l4len = udp_update_hdr4(iph, bp, toside, dlen, true);
>  	} else {
> -		struct ipv6hdr *ip6h = vu_ip(iov_vu[0].iov_base);
> -		struct udp_payload_t *bp = vu_payloadv6(iov_vu[0].iov_base);
> +		struct ipv6hdr *ip6h = vu_ip(iov[0].iov_base);
> +		struct udp_payload_t *bp = vu_payloadv6(iov[0].iov_base);
>  
>  		eh->h_proto = htons(ETH_P_IPV6);
>  
> @@ -182,25 +179,25 @@ static size_t udp_vu_prepare(const struct ctx *c,
>  /**
>   * udp_vu_csum() - Calculate and set checksum for a UDP packet
>   * @toside:	Address information for one side of the flow
> - * @iov_used:	Number of used iov_vu items
> + * @data:	IO vector tail for the frame
>   */
> -static void udp_vu_csum(const struct flowside *toside, int iov_used)
> +static void udp_vu_csum(const struct flowside *toside,
> +			const struct iov_tail *data)
>  {
>  	const struct in_addr *src4 = inany_v4(&toside->oaddr);
>  	const struct in_addr *dst4 = inany_v4(&toside->eaddr);
> -	char *base = iov_vu[0].iov_base;
> -	struct udp_payload_t *bp;
> -	struct iov_tail data;
> +	struct iov_tail payload = *data;
> +	struct udphdr *uh, uh_storage;
> +	bool ipv4 = src4 && dst4;
>  
> -	if (src4 && dst4) {
> -		bp = vu_payloadv4(base);
> -		data = IOV_TAIL(iov_vu, iov_used, (char *)&bp->data - base);
> -		csum_udp4(&bp->uh, *src4, *dst4, &data);
> -	} else {
> -		bp = vu_payloadv6(base);
> -		data = IOV_TAIL(iov_vu, iov_used, (char *)&bp->data - base);
> -		csum_udp6(&bp->uh, &toside->oaddr.a6, &toside->eaddr.a6, &data);
> -	}
> +	iov_drop_header(&payload,
> +			udp_vu_hdrlen(!ipv4) - sizeof(struct udphdr));
> +	uh = IOV_REMOVE_HEADER(&payload, uh_storage);
> +
> +	if (ipv4)
> +		csum_udp4(uh, *src4, *dst4, &payload);
> +	else
> +		csum_udp6(uh, &toside->oaddr.a6, &toside->eaddr.a6, &payload);
>  }
>  
>  /**
> @@ -216,23 +213,25 @@ void udp_vu_sock_to_tap(const struct ctx *c, int s, int n, flow_sidx_t tosidx)
>  	bool v6 = !(inany_v4(&toside->eaddr) && inany_v4(&toside->oaddr));
>  	struct vu_dev *vdev = c->vdev;
>  	struct vu_virtq *vq = &vdev->vq[VHOST_USER_RX_QUEUE];
> +	struct iov_tail data;
>  	int i;
>  
>  	for (i = 0; i < n; i++) {
>  		ssize_t dlen;
> -		int iov_used;
>  
> -		iov_used = udp_vu_sock_recv(c, vq, s, v6, &dlen);
> -		if (iov_used < 0)
> +		data = IOV_TAIL(iov_vu, VIRTQUEUE_MAX_SIZE, 0);
> +
> +		dlen = udp_vu_sock_recv(c, &data, vq, s, v6);
> +		if (dlen < 0)
>  			break;
>  
> -		if (iov_used > 0) {
> -			udp_vu_prepare(c, toside, dlen);
> +		if (data.cnt > 0) {
> +			udp_vu_prepare(c, &data, toside, dlen);
>  			if (*c->pcap) {
> -				udp_vu_csum(toside, iov_used);
> -				pcap_iov(iov_vu, iov_used, VNET_HLEN);
> +				udp_vu_csum(toside, &data);
> +				pcap_iov(data.iov, data.cnt, VNET_HLEN);
>  			}
> -			vu_flush(vdev, vq, elem, iov_used);
> +			vu_flush(vdev, vq, elem, data.cnt);
>  		}
>  	}
>  }
> -- 
> 2.53.0
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson