September 2025 - Spectrum Development

[PATCH] Prefer definition-before-use in Nix
by Demi Marie Obenour 09 Sep '25

09 Sep '25

Nix does not require this, but it is easier to read. No functional change intended. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- img/app/default.nix | 74 ++++++++++++++++++++++++-------------------------- vm/sys/net/default.nix | 72 ++++++++++++++++++++++++------------------------ 2 files changed, 72 insertions(+), 74 deletions(-) diff --git a/img/app/default.nix b/img/app/default.nix index d3eed1f0accdc8968d1ba5bdec74ab597789082f..71a939c1c053ebd37fc02fa4eed49b883d50ef49 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -12,6 +12,42 @@ pkgsStatic.callPackage ( }: let + kernelTarget = + if stdenvNoCC.hostPlatform.isx86 then + # vmlinux.bin is the stripped version of vmlinux. + # Confusingly, compressed/vmlinux.bin is the stripped version of + # the top-level vmlinux target, while the top-level vmlinux.bin + # is the stripped version of compressed/vmlinux. So we use + # compressed/vmlinux.bin, since we want a stripped version of + # the kernel that *hasn't* been built to be compressed. Weird! + "compressed/vmlinux.bin" + else + stdenvNoCC.hostPlatform.linux-kernel.target; + + kernel = (linux_latest.override { + structuredExtraConfig = with lib.kernel; { + DRM_FBDEV_EMULATION = lib.mkForce no; + EROFS_FS = yes; + FONTS = lib.mkForce unset; + FONT_8x8 = lib.mkForce unset; + FONT_TER16x32 = lib.mkForce unset; + FRAMEBUFFER_CONSOLE = lib.mkForce unset; + FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = lib.mkForce unset; + FRAMEBUFFER_CONSOLE_DETECT_PRIMARY = lib.mkForce unset; + FRAMEBUFFER_CONSOLE_ROTATION = lib.mkForce unset; + RC_CORE = lib.mkForce unset; + VIRTIO = yes; + VIRTIO_BLK = yes; + VIRTIO_CONSOLE = yes; + VIRTIO_PCI = yes; + VT = no; + }; + }).overrideAttrs ({ installFlags ? [], ... }: { + installFlags = installFlags ++ [ + "KBUILD_IMAGE=$(boot)/${kernelTarget}" + ]; + }); + appimageFhsenv = (buildFHSEnv (appimageTools.defaultFhsEnvArgs // { name = "vm-fhs-env"; targetPkgs = pkgs: appimageTools.defaultFhsEnvArgs.targetPkgs pkgs ++ [ @@ -53,50 +89,12 @@ let pkgs.wireplumber ]; })).fhsenv; -in -let packagesSysroot = runCommand "packages-sysroot" {} '' mkdir -p $out/etc/ssl/certs ln -s ${appimageFhsenv}/{lib64,usr} ${kernel}/lib $out ln -s ${cacert}/etc/ssl/certs/* $out/etc/ssl/certs ''; - - kernelTarget = - if stdenvNoCC.hostPlatform.isx86 then - # vmlinux.bin is the stripped version of vmlinux. - # Confusingly, compressed/vmlinux.bin is the stripped version of - # the top-level vmlinux target, while the top-level vmlinux.bin - # is the stripped version of compressed/vmlinux. So we use - # compressed/vmlinux.bin, since we want a stripped version of - # the kernel that *hasn't* been built to be compressed. Weird! - "compressed/vmlinux.bin" - else - stdenvNoCC.hostPlatform.linux-kernel.target; - - kernel = (linux_latest.override { - structuredExtraConfig = with lib.kernel; { - DRM_FBDEV_EMULATION = lib.mkForce no; - EROFS_FS = yes; - FONTS = lib.mkForce unset; - FONT_8x8 = lib.mkForce unset; - FONT_TER16x32 = lib.mkForce unset; - FRAMEBUFFER_CONSOLE = lib.mkForce unset; - FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = lib.mkForce unset; - FRAMEBUFFER_CONSOLE_DETECT_PRIMARY = lib.mkForce unset; - FRAMEBUFFER_CONSOLE_ROTATION = lib.mkForce unset; - RC_CORE = lib.mkForce unset; - VIRTIO = yes; - VIRTIO_BLK = yes; - VIRTIO_CONSOLE = yes; - VIRTIO_PCI = yes; - VT = no; - }; - }).overrideAttrs ({ installFlags ? [], ... }: { - installFlags = installFlags ++ [ - "KBUILD_IMAGE=$(boot)/${kernelTarget}" - ]; - }); in stdenvNoCC.mkDerivation { diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix index b5873ebe1e80dd88c1ba997f7ebd3ee7369bb40f..7b2b8b1fbb9b9027781812307bed0551b80f5a78 100644 --- a/vm/sys/net/default.nix +++ b/vm/sys/net/default.nix @@ -14,6 +14,42 @@ let inherit (lib) concatMapStringsSep; inherit (nixosAllHardware.config.hardware) firmware; + kernelTarget = + if stdenvNoCC.hostPlatform.isx86 then + # vmlinux.bin is the stripped version of vmlinux. + # Confusingly, compressed/vmlinux.bin is the stripped version of + # the top-level vmlinux target, while the top-level vmlinux.bin + # is the stripped version of compressed/vmlinux. So we use + # compressed/vmlinux.bin, since we want a stripped version of + # the kernel that *hasn't* been built to be compressed. Weird! + "compressed/vmlinux.bin" + else + stdenvNoCC.hostPlatform.linux-kernel.target; + + kernel = (linux_latest.override { + structuredExtraConfig = with lib.kernel; { + DRM_FBDEV_EMULATION = lib.mkForce no; + EROFS_FS = yes; + FONTS = lib.mkForce unset; + FONT_8x8 = lib.mkForce unset; + FONT_TER16x32 = lib.mkForce unset; + FRAMEBUFFER_CONSOLE = lib.mkForce unset; + FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = lib.mkForce unset; + FRAMEBUFFER_CONSOLE_DETECT_PRIMARY = lib.mkForce unset; + FRAMEBUFFER_CONSOLE_ROTATION = lib.mkForce unset; + RC_CORE = lib.mkForce unset; + VIRTIO = yes; + VIRTIO_BLK = yes; + VIRTIO_CONSOLE = yes; + VIRTIO_PCI = yes; + VT = no; + }; + }).overrideAttrs ({ installFlags ? [], ... }: { + installFlags = installFlags ++ [ + "KBUILD_IMAGE=$(boot)/${kernelTarget}" + ]; + }); + connman = connmanMinimal; packages = [ @@ -58,42 +94,6 @@ let system.stateVersion = lib.trivial.release; }); - - kernelTarget = - if stdenvNoCC.hostPlatform.isx86 then - # vmlinux.bin is the stripped version of vmlinux. - # Confusingly, compressed/vmlinux.bin is the stripped version of - # the top-level vmlinux target, while the top-level vmlinux.bin - # is the stripped version of compressed/vmlinux. So we use - # compressed/vmlinux.bin, since we want a stripped version of - # the kernel that *hasn't* been built to be compressed. Weird! - "compressed/vmlinux.bin" - else - stdenvNoCC.hostPlatform.linux-kernel.target; - - kernel = (linux_latest.override { - structuredExtraConfig = with lib.kernel; { - DRM_FBDEV_EMULATION = lib.mkForce no; - EROFS_FS = yes; - FONTS = lib.mkForce unset; - FONT_8x8 = lib.mkForce unset; - FONT_TER16x32 = lib.mkForce unset; - FRAMEBUFFER_CONSOLE = lib.mkForce unset; - FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = lib.mkForce unset; - FRAMEBUFFER_CONSOLE_DETECT_PRIMARY = lib.mkForce unset; - FRAMEBUFFER_CONSOLE_ROTATION = lib.mkForce unset; - RC_CORE = lib.mkForce unset; - VIRTIO = yes; - VIRTIO_BLK = yes; - VIRTIO_CONSOLE = yes; - VIRTIO_PCI = yes; - VT = no; - }; - }).overrideAttrs ({ installFlags ? [], ... }: { - installFlags = installFlags ++ [ - "KBUILD_IMAGE=$(boot)/${kernelTarget}" - ]; - }); in stdenvNoCC.mkDerivation { --- base-commit: 8ce6039b6dde7fda98ceea018addecb8bee0e7b3 change-id: 20250908-nix-cleanup-8496862dfee9 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH] Sort file lists in makefiles
by Demi Marie Obenour 09 Sep '25

09 Sep '25

No functional change. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/Makefile | 8 ++++---- vm/sys/net/Makefile | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index f677fe580f2e2be58113457e63468d97f49a49f6..e96458dba06ae31129b115b2b649962f8d88187a 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -54,7 +54,6 @@ FILES = \ etc/s6-linux-init/scripts/rc.init \ etc/xdg/weston/autolaunch \ etc/xdg/weston/weston.ini \ - usr/share/dbus-1/services/org.freedesktop.portal.Documents.service \ usr/bin/assign-devices \ usr/bin/create-vm-dependencies \ usr/bin/run-appimage \ @@ -63,7 +62,8 @@ FILES = \ usr/bin/vm-import \ usr/bin/vm-start \ usr/bin/vm-stop \ - usr/bin/xdg-open + usr/bin/xdg-open \ + usr/share/dbus-1/services/org.freedesktop.portal.Documents.service DIRS = \ dev \ @@ -155,8 +155,8 @@ S6_RC_FILES = \ etc/s6-rc/vmm-env/type \ etc/s6-rc/weston/dependencies \ etc/s6-rc/weston/notification-fd \ - etc/s6-rc/weston/type \ - etc/s6-rc/weston/run + etc/s6-rc/weston/run \ + etc/s6-rc/weston/type # s6-rc-compile's input is a directory, but that doesn't play nice # with Make, because it won't know to update if some file in the diff --git a/vm/sys/net/Makefile b/vm/sys/net/Makefile index e6819400b2079e3eaa9d24737b2fc4b816a592c8..755b145175199aa97049dbd7feadc0e76230cf30 100644 --- a/vm/sys/net/Makefile +++ b/vm/sys/net/Makefile @@ -39,7 +39,7 @@ VM_FILES = \ etc/s6-linux-init/run-image/service/getty-hvc0/run \ etc/s6-linux-init/scripts/rc.init \ etc/sysctl.conf -VM_DIRS = dev etc/s6-linux-init/env run proc sys var/lib/connman +VM_DIRS = dev etc/s6-linux-init/env proc run sys var/lib/connman # These are separate because they need to be included, but putting # them as make dependencies would confuse make. --- base-commit: 8ce6039b6dde7fda98ceea018addecb8bee0e7b3 change-id: 20250908-sorting-c24fb3b2bf2a -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH] scripts/make-erofs.sh: Ensure that / is world-readable
by Demi Marie Obenour 09 Sep '25

09 Sep '25

Previously it had 0700 permissions, which was hidden because everything ran as root anyway. However, dbus-broker fails to start in this case because it always drops privileges. Also set umask to 0022 to ensure that the permissions of other directories are correct. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- scripts/make-erofs.sh | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/scripts/make-erofs.sh b/scripts/make-erofs.sh index b47048ad747bd7dfcc28e0f1dfd75ec090fa7e09..5b620be77f2967e45fa1c2b06c6acfc3329e46c0 100755 --- a/scripts/make-erofs.sh +++ b/scripts/make-erofs.sh @@ -1,6 +1,7 @@ #!/bin/sh -eu # # SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> # SPDX-License-Identifier: EUPL-1.2+ # # FIXME: It would be nice to replace this script with a program that @@ -8,6 +9,7 @@ # single directory structure, and could generate an EROFS image # based on source:dest mappings directly. +umask 0022 # for permissions ex_usage() { echo "Usage: make-erofs.sh [options]... img < srcdest.txt" >&2 exit 1 @@ -18,8 +20,12 @@ if [ -z "${img-}" ]; then ex_usage fi -root="$(mktemp -d -- "$img.tmp.XXXXXXXXXX")" -trap 'chmod -R +w -- "$root" && rm -rf -- "$root"' EXIT +superroot="$(mktemp -d -- "$img.tmp.XXXXXXXXXX")" +trap 'chmod -R +w -- "$root" && rm -rf -- "$superroot"' EXIT +# $superroot has 0700 permissions, so create a subdirectory +# with correct (0755) permissions and do all work there. +root=$superroot/real_root +mkdir -- "$root" while read -r arg1; do read -r arg2 || ex_usage --- base-commit: 8ce6039b6dde7fda98ceea018addecb8bee0e7b3 change-id: 20250908-world-readable-root-87176a94d3cc -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[DO_NOT_APPLY v3 0/3] xdp-forwarder
by Yureka Lilian 08 Sep '25

08 Sep '25

Same as v1, it doesn't make sense to apply this without the router. Changes since v2: - Switch xdp-forwarder build to meson - Add guest build variant of spectrum-tools Changes since v1: - rebased - apply new uncrustify config - moved xdp-forwarder to tools/ - split integration into separate commit - use linuxHeaders instead of vmlinux.h - use original xdp-tutorial {parsing,rewrite}_helpers.h - inlined the load scripts into /etc/iface/mdev, using /usr/lib/xdp as fixed prefix for finding the XDP progs - removed the README, added a paragraph to architecture doc instead Yureka Lilian (3): add xdp-forwarder integrate xdp-forwarder into net-vm docs/architecture: add paragraph about networking Documentation/about/architecture.adoc | 20 ++ pkgs/default.nix | 5 + tools/default.nix | 15 +- tools/meson.build | 5 + tools/meson_options.txt | 4 + tools/xdp-forwarder/include/parsing_helpers.h | 273 ++++++++++++++++++ tools/xdp-forwarder/include/rewrite_helpers.h | 145 ++++++++++ tools/xdp-forwarder/prog_physical.c | 37 +++ tools/xdp-forwarder/prog_router.c | 43 +++ tools/xdp-forwarder/set_router_iface.c | 32 ++ vm/sys/net/Makefile | 8 +- vm/sys/net/default.nix | 22 +- vm/sys/net/etc/fstab | 2 + vm/sys/net/etc/mdev/iface | 27 +- vm/sys/net/etc/nftables.conf | 8 - vm/sys/net/etc/s6-rc/connman/dependencies | 4 - vm/sys/net/etc/s6-rc/connman/type | 1 - vm/sys/net/etc/s6-rc/connman/type.license | 2 - vm/sys/net/etc/s6-rc/nftables/type | 1 - vm/sys/net/etc/s6-rc/nftables/type.license | 2 - vm/sys/net/etc/s6-rc/nftables/up | 6 - 21 files changed, 599 insertions(+), 63 deletions(-) create mode 100644 tools/xdp-forwarder/include/parsing_helpers.h create mode 100644 tools/xdp-forwarder/include/rewrite_helpers.h create mode 100644 tools/xdp-forwarder/prog_physical.c create mode 100644 tools/xdp-forwarder/prog_router.c create mode 100644 tools/xdp-forwarder/set_router_iface.c delete mode 100644 vm/sys/net/etc/nftables.conf delete mode 100644 vm/sys/net/etc/s6-rc/connman/dependencies delete mode 100644 vm/sys/net/etc/s6-rc/connman/type delete mode 100644 vm/sys/net/etc/s6-rc/connman/type.license delete mode 100644 vm/sys/net/etc/s6-rc/nftables/type delete mode 100644 vm/sys/net/etc/s6-rc/nftables/type.license delete mode 100644 vm/sys/net/etc/s6-rc/nftables/up -- 2.50.1

4 8

[PATCH] tools: add xdp-forwarder
by Yureka Lilian 08 Sep '25

08 Sep '25

The xdp-forwarder's purpose is implementing the functionality needed within the net-vm (a VM running the Linux drivers for any physical interfaces on the spectrum system). In the future, the net-vm will load the included XDP programs on the passed-through physical interfaces as well as the downstream virtio interface going into the router (recognized by its special MAC address). The net-vm needs to multiplex between the physical interfaces, as there might be several interfaces in the same IOMMU-group. For this, the XDP program loaded on the physical interfaces (`prog_physical.o`) applies a VLAN tag corresponding to the interface id and redirects the packets to the router interface (identified by the `router_iface` bpf map). In the other direction the XDP program loaded on the router interface (`prog_router.o`) removes one layer of VLAN tagging and redirects the packets to the interface read from the VLAN tag. The helper program `set_router_iface` is used to update the `router_iface` bpf map to point to the interface passed as argument to the program. Signed-off-by: Yureka Lilian <yureka(a)cyberchaos.dev> --- pkgs/default.nix | 5 + tools/default.nix | 15 +- tools/meson.build | 5 + tools/meson_options.txt | 4 + tools/xdp-forwarder/include/parsing_helpers.h | 273 ++++++++++++++++++ tools/xdp-forwarder/include/rewrite_helpers.h | 145 ++++++++++ tools/xdp-forwarder/meson.build | 38 +++ tools/xdp-forwarder/prog_physical.c | 37 +++ tools/xdp-forwarder/prog_router.c | 43 +++ tools/xdp-forwarder/set_router_iface.c | 29 ++ 10 files changed, 591 insertions(+), 3 deletions(-) create mode 100644 tools/xdp-forwarder/include/parsing_helpers.h create mode 100644 tools/xdp-forwarder/include/rewrite_helpers.h create mode 100644 tools/xdp-forwarder/meson.build create mode 100644 tools/xdp-forwarder/prog_physical.c create mode 100644 tools/xdp-forwarder/prog_router.c create mode 100644 tools/xdp-forwarder/set_router_iface.c diff --git a/pkgs/default.nix b/pkgs/default.nix index 3b81339..76b2a5c 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -1,4 +1,5 @@ # SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> # SPDX-License-Identifier: MIT { ... } @ args: @@ -42,6 +43,10 @@ let guestSupport = false; hostSupport = true; }; + spectrum-driver-tools = self.callSpectrumPackage ../tools { + guestSupport = false; + driverSupport = true; + }; xdg-desktop-portal-spectrum-host = self.callSpectrumPackage ../tools/xdg-desktop-portal-spectrum-host {}; diff --git a/tools/default.nix b/tools/default.nix index 95d76a1..e664f47 100644 --- a/tools/default.nix +++ b/tools/default.nix @@ -1,13 +1,16 @@ # SPDX-License-Identifier: MIT # SPDX-FileCopyrightText: 2022-2025 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> import ../lib/call-package.nix ( { src, lib, stdenv, fetchCrate, fetchurl, runCommand, buildPackages , meson, ninja, pkg-config, rustc , clang-tools, clippy , dbus +, clang, libbpf , guestSupport ? true , hostSupport ? false +, driverSupport ? false }: let @@ -70,15 +73,18 @@ stdenv.mkDerivation (finalAttrs: { ./lsvm ./start-vmm ./subprojects + ] ++ lib.optionals driverSupport [ + ./xdp-forwarder ])); }; sourceRoot = "source/tools"; depsBuildBuild = lib.optionals hostSupport [ buildPackages.stdenv.cc ]; nativeBuildInputs = [ meson ninja ] - ++ lib.optionals guestSupport [ pkg-config ] - ++ lib.optionals hostSupport [ rustc ]; - buildInputs = lib.optionals guestSupport [ dbus ]; + ++ lib.optionals (guestSupport || driverSupport) [ pkg-config ] + ++ lib.optionals hostSupport [ rustc ] + ++ lib.optionals driverSupport [ clang ]; + buildInputs = lib.optionals guestSupport [ dbus ] ++ lib.optionals driverSupport [ libbpf ]; postPatch = lib.optionals hostSupport (lib.concatMapStringsSep "\n" (crate: '' mkdir -p subprojects/packagecache @@ -88,12 +94,15 @@ stdenv.mkDerivation (finalAttrs: { mesonFlags = [ (lib.mesonBool "guest" guestSupport) (lib.mesonBool "host" hostSupport) + (lib.mesonBool "driver" driverSupport) "-Dhostfsrootdir=/run/virtiofs/virtiofs0" "-Dtests=false" "-Dunwind=false" "-Dwerror=true" ]; + hardeningDisable = lib.optionals driverSupport [ "zerocallusedregs" ]; + passthru.tests = { clang-tidy = finalAttrs.finalPackage.overrideAttrs ( { name, src, nativeBuildInputs ? [], ... }: diff --git a/tools/meson.build b/tools/meson.build index 9cebd03..e49f27c 100644 --- a/tools/meson.build +++ b/tools/meson.build @@ -1,5 +1,6 @@ # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> project('spectrum-tools', 'c', default_options : { @@ -26,3 +27,7 @@ endif if get_option('guest') subdir('xdg-desktop-portal-spectrum') endif + +if get_option('driver') + subdir('xdp-forwarder') +endif diff --git a/tools/meson_options.txt b/tools/meson_options.txt index 4af0031..887e388 100644 --- a/tools/meson_options.txt +++ b/tools/meson_options.txt @@ -1,5 +1,6 @@ # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022-2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> option('host', type : 'boolean', value : false, description : 'Build tools for the Spectrum host') @@ -7,6 +8,9 @@ option('host', type : 'boolean', value : false, option('guest', type : 'boolean', description : 'Build tools for Spectrum guests') +option('driver', type : 'boolean', + description : 'Build tools for Spectrum driver VMs') + option('hostfsrootdir', type : 'string', value : '/run/host', description : 'Path where the virtio-fs provided by the host will be mounted') diff --git a/tools/xdp-forwarder/include/parsing_helpers.h b/tools/xdp-forwarder/include/parsing_helpers.h new file mode 100644 index 0000000..3d240cd --- /dev/null +++ b/tools/xdp-forwarder/include/parsing_helpers.h @@ -0,0 +1,273 @@ +/* SPDX-License-Identifier: (GPL-2.0-or-later OR BSD-2-clause) */ +/* Vendored from https://github.com/xdp-project/xdp-tutorial/blob/d3d3eed6ea9a63d1302bfa8b5a… */ +/* + * This file contains parsing functions that are used in the packetXX XDP + * programs. The functions are marked as __always_inline, and fully defined in + * this header file to be included in the BPF program. + * + * Each helper parses a packet header, including doing bounds checking, and + * returns the type of its contents if successful, and -1 otherwise. + * + * For Ethernet and IP headers, the content type is the type of the payload + * (h_proto for Ethernet, nexthdr for IPv6), for ICMP it is the ICMP type field. + * All return values are in host byte order. + * + * The versions of the functions included here are slightly expanded versions of + * the functions in the packet01 lesson. For instance, the Ethernet header + * parsing has support for parsing VLAN tags. + */ + +#ifndef __PARSING_HELPERS_H +#define __PARSING_HELPERS_H + +#include <stddef.h> +#include <linux/if_ether.h> +#include <linux/if_packet.h> +#include <linux/ip.h> +#include <linux/ipv6.h> +#include <linux/icmp.h> +#include <linux/icmpv6.h> +#include <linux/udp.h> +#include <linux/tcp.h> + +/* Header cursor to keep track of current parsing position */ +struct hdr_cursor { + void *pos; +}; + +/* + * struct vlan_hdr - vlan header + * @h_vlan_TCI: priority and VLAN ID + * @h_vlan_encapsulated_proto: packet type ID or len + */ +struct vlan_hdr { + __be16 h_vlan_TCI; + __be16 h_vlan_encapsulated_proto; +}; + +/* + * Struct icmphdr_common represents the common part of the icmphdr and icmp6hdr + * structures. + */ +struct icmphdr_common { + __u8 type; + __u8 code; + __sum16 cksum; +}; + +/* Allow users of header file to redefine VLAN max depth */ +#ifndef VLAN_MAX_DEPTH +#define VLAN_MAX_DEPTH 2 +#endif + +#define VLAN_VID_MASK 0x0fff /* VLAN Identifier */ +/* Struct for collecting VLANs after parsing via parse_ethhdr_vlan */ +struct collect_vlans { + __u16 id[VLAN_MAX_DEPTH]; +}; + +static __always_inline int proto_is_vlan(__u16 h_proto) +{ + return !!(h_proto == bpf_htons(ETH_P_8021Q) || + h_proto == bpf_htons(ETH_P_8021AD)); +} + +/* Notice, parse_ethhdr() will skip VLAN tags, by advancing nh->pos and returns + * next header EtherType, BUT the ethhdr pointer supplied still points to the + * Ethernet header. Thus, caller can look at eth->h_proto to see if this was a + * VLAN tagged packet. + */ +static __always_inline int parse_ethhdr_vlan(struct hdr_cursor *nh, + void *data_end, + struct ethhdr **ethhdr, + struct collect_vlans *vlans) +{ + struct ethhdr *eth = nh->pos; + int hdrsize = sizeof(*eth); + struct vlan_hdr *vlh; + __u16 h_proto; + int i; + + /* Byte-count bounds check; check if current pointer + size of header + * is after data_end. + */ + if (nh->pos + hdrsize > data_end) + return -1; + + nh->pos += hdrsize; + *ethhdr = eth; + vlh = nh->pos; + h_proto = eth->h_proto; + + /* Use loop unrolling to avoid the verifier restriction on loops; + * support up to VLAN_MAX_DEPTH layers of VLAN encapsulation. + */ + #pragma unroll + for (i = 0; i < VLAN_MAX_DEPTH; i++) { + if (!proto_is_vlan(h_proto)) + break; + + if (vlh + 1 > data_end) + break; + + h_proto = vlh->h_vlan_encapsulated_proto; + if (vlans) /* collect VLAN ids */ + vlans->id[i] = + (bpf_ntohs(vlh->h_vlan_TCI) & VLAN_VID_MASK); + + vlh++; + } + + nh->pos = vlh; + return h_proto; /* network-byte-order */ +} + +static __always_inline int parse_ethhdr(struct hdr_cursor *nh, + void *data_end, + struct ethhdr **ethhdr) +{ + /* Expect compiler removes the code that collects VLAN ids */ + return parse_ethhdr_vlan(nh, data_end, ethhdr, NULL); +} + +static __always_inline int parse_ip6hdr(struct hdr_cursor *nh, + void *data_end, + struct ipv6hdr **ip6hdr) +{ + struct ipv6hdr *ip6h = nh->pos; + + /* Pointer-arithmetic bounds check; pointer +1 points to after end of + * thing being pointed to. We will be using this style in the remainder + * of the tutorial. + */ + if (ip6h + 1 > data_end) + return -1; + + nh->pos = ip6h + 1; + *ip6hdr = ip6h; + + return ip6h->nexthdr; +} + +static __always_inline int parse_iphdr(struct hdr_cursor *nh, + void *data_end, + struct iphdr **iphdr) +{ + struct iphdr *iph = nh->pos; + int hdrsize; + + if (iph + 1 > data_end) + return -1; + + hdrsize = iph->ihl * 4; + /* Sanity check packet field is valid */ + if(hdrsize < sizeof(*iph)) + return -1; + + /* Variable-length IPv4 header, need to use byte-based arithmetic */ + if (nh->pos + hdrsize > data_end) + return -1; + + nh->pos += hdrsize; + *iphdr = iph; + + return iph->protocol; +} + +static __always_inline int parse_icmp6hdr(struct hdr_cursor *nh, + void *data_end, + struct icmp6hdr **icmp6hdr) +{ + struct icmp6hdr *icmp6h = nh->pos; + + if (icmp6h + 1 > data_end) + return -1; + + nh->pos = icmp6h + 1; + *icmp6hdr = icmp6h; + + return icmp6h->icmp6_type; +} + +static __always_inline int parse_icmphdr(struct hdr_cursor *nh, + void *data_end, + struct icmphdr **icmphdr) +{ + struct icmphdr *icmph = nh->pos; + + if (icmph + 1 > data_end) + return -1; + + nh->pos = icmph + 1; + *icmphdr = icmph; + + return icmph->type; +} + +static __always_inline int parse_icmphdr_common(struct hdr_cursor *nh, + void *data_end, + struct icmphdr_common **icmphdr) +{ + struct icmphdr_common *h = nh->pos; + + if (h + 1 > data_end) + return -1; + + nh->pos = h + 1; + *icmphdr = h; + + return h->type; +} + +/* + * parse_udphdr: parse the udp header and return the length of the udp payload + */ +static __always_inline int parse_udphdr(struct hdr_cursor *nh, + void *data_end, + struct udphdr **udphdr) +{ + int len; + struct udphdr *h = nh->pos; + + if (h + 1 > data_end) + return -1; + + nh->pos = h + 1; + *udphdr = h; + + len = bpf_ntohs(h->len) - sizeof(struct udphdr); + if (len < 0) + return -1; + + return len; +} + +/* + * parse_tcphdr: parse and return the length of the tcp header + */ +static __always_inline int parse_tcphdr(struct hdr_cursor *nh, + void *data_end, + struct tcphdr **tcphdr) +{ + int len; + struct tcphdr *h = nh->pos; + + if (h + 1 > data_end) + return -1; + + len = h->doff * 4; + /* Sanity check packet field is valid */ + if(len < sizeof(*h)) + return -1; + + /* Variable-length TCP header, need to use byte-based arithmetic */ + if (nh->pos + len > data_end) + return -1; + + nh->pos += len; + *tcphdr = h; + + return len; +} + +#endif /* __PARSING_HELPERS_H */ diff --git a/tools/xdp-forwarder/include/rewrite_helpers.h b/tools/xdp-forwarder/include/rewrite_helpers.h new file mode 100644 index 0000000..2deae9a --- /dev/null +++ b/tools/xdp-forwarder/include/rewrite_helpers.h @@ -0,0 +1,145 @@ +/* SPDX-License-Identifier: (GPL-2.0-or-later OR BSD-2-clause) */ +/* Vendored from https://github.com/xdp-project/xdp-tutorial/blob/d3d3eed6ea9a63d1302bfa8b5a… */ +/* + * This file contains functions that are used in the packetXX XDP programs to + * manipulate on packets data. The functions are marked as __always_inline, and + * fully defined in this header file to be included in the BPF program. + */ + +#ifndef __REWRITE_HELPERS_H +#define __REWRITE_HELPERS_H + +#include <linux/bpf.h> +#include <linux/ip.h> +#include <linux/ipv6.h> +#include <linux/if_ether.h> + +#include <bpf/bpf_helpers.h> +#include <bpf/bpf_endian.h> + +/* Pops the outermost VLAN tag off the packet. Returns the popped VLAN ID on + * success or negative errno on failure. + */ +static __always_inline int vlan_tag_pop(struct xdp_md *ctx, struct ethhdr *eth) +{ + void *data_end = (void *)(long)ctx->data_end; + struct ethhdr eth_cpy; + struct vlan_hdr *vlh; + __be16 h_proto; + int vlid; + + if (!proto_is_vlan(eth->h_proto)) + return -1; + + /* Careful with the parenthesis here */ + vlh = (void *)(eth + 1); + + /* Still need to do bounds checking */ + if (vlh + 1 > data_end) + return -1; + + /* Save vlan ID for returning, h_proto for updating Ethernet header */ + vlid = bpf_ntohs(vlh->h_vlan_TCI); + h_proto = vlh->h_vlan_encapsulated_proto; + + /* Make a copy of the outer Ethernet header before we cut it off */ + __builtin_memcpy(&eth_cpy, eth, sizeof(eth_cpy)); + + /* Actually adjust the head pointer */ + if (bpf_xdp_adjust_head(ctx, (int)sizeof(*vlh))) + return -1; + + /* Need to re-evaluate data *and* data_end and do new bounds checking + * after adjusting head + */ + eth = (void *)(long)ctx->data; + data_end = (void *)(long)ctx->data_end; + if (eth + 1 > data_end) + return -1; + + /* Copy back the old Ethernet header and update the proto type */ + __builtin_memcpy(eth, &eth_cpy, sizeof(*eth)); + eth->h_proto = h_proto; + + return vlid; +} + +/* Pushes a new VLAN tag after the Ethernet header. Returns 0 on success, + * -1 on failure. + */ +static __always_inline int vlan_tag_push(struct xdp_md *ctx, + struct ethhdr *eth, int vlid) +{ + void *data_end = (void *)(long)ctx->data_end; + struct ethhdr eth_cpy; + struct vlan_hdr *vlh; + + /* First copy the original Ethernet header */ + __builtin_memcpy(&eth_cpy, eth, sizeof(eth_cpy)); + + /* Then add space in front of the packet */ + if (bpf_xdp_adjust_head(ctx, 0 - (int)sizeof(*vlh))) + return -1; + + /* Need to re-evaluate data_end and data after head adjustment, and + * bounds check, even though we know there is enough space (as we + * increased it). + */ + data_end = (void *)(long)ctx->data_end; + eth = (void *)(long)ctx->data; + + if (eth + 1 > data_end) + return -1; + + /* Copy back Ethernet header in the right place, populate VLAN tag with + * ID and proto, and set outer Ethernet header to VLAN type. + */ + __builtin_memcpy(eth, &eth_cpy, sizeof(*eth)); + + vlh = (void *)(eth + 1); + + if (vlh + 1 > data_end) + return -1; + + vlh->h_vlan_TCI = bpf_htons(vlid); + vlh->h_vlan_encapsulated_proto = eth->h_proto; + + eth->h_proto = bpf_htons(ETH_P_8021Q); + return 0; +} + +/* + * Swaps destination and source MAC addresses inside an Ethernet header + */ +static __always_inline void swap_src_dst_mac(struct ethhdr *eth) +{ + __u8 h_tmp[ETH_ALEN]; + + __builtin_memcpy(h_tmp, eth->h_source, ETH_ALEN); + __builtin_memcpy(eth->h_source, eth->h_dest, ETH_ALEN); + __builtin_memcpy(eth->h_dest, h_tmp, ETH_ALEN); +} + +/* + * Swaps destination and source IPv6 addresses inside an IPv6 header + */ +static __always_inline void swap_src_dst_ipv6(struct ipv6hdr *ipv6) +{ + struct in6_addr tmp = ipv6->saddr; + + ipv6->saddr = ipv6->daddr; + ipv6->daddr = tmp; +} + +/* + * Swaps destination and source IPv4 addresses inside an IPv4 header + */ +static __always_inline void swap_src_dst_ipv4(struct iphdr *iphdr) +{ + __be32 tmp = iphdr->saddr; + + iphdr->saddr = iphdr->daddr; + iphdr->daddr = tmp; +} + +#endif /* __REWRITE_HELPERS_H */ diff --git a/tools/xdp-forwarder/meson.build b/tools/xdp-forwarder/meson.build new file mode 100644 index 0000000..7e60c11 --- /dev/null +++ b/tools/xdp-forwarder/meson.build @@ -0,0 +1,38 @@ +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> + +libbpf = dependency('libbpf', version : '1.6.2') + +executable('set_router_iface', 'set_router_iface.c', + dependencies : libbpf, + install : true) + +clang = find_program('clang') + +bpf_o_cmd = [ + clang.full_path(), + '-fno-stack-protector', + '-O2', + '-target', 'bpf', + '-I', meson.current_source_dir() + '/include', + '-g', + '-c', + '@INPUT@', + '-o', + '@OUTPUT@', +] + +prog_router_o = custom_target( + input : 'prog_router.c', + output : 'prog_router.o', + command : bpf_o_cmd, + install: true, + install_dir: 'lib/xdp') + +prog_physical_o = custom_target( + input : 'prog_physical.c', + output : 'prog_physical.o', + command : bpf_o_cmd, + install: true, + install_dir: 'lib/xdp') + diff --git a/tools/xdp-forwarder/prog_physical.c b/tools/xdp-forwarder/prog_physical.c new file mode 100644 index 0000000..04b5131 --- /dev/null +++ b/tools/xdp-forwarder/prog_physical.c @@ -0,0 +1,37 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> + +#define VLAN_MAX_DEPTH 1 + +#include <linux/bpf.h> +#include <bpf/bpf_endian.h> +#include "parsing_helpers.h" +#include "rewrite_helpers.h" + +struct { + __uint(type, BPF_MAP_TYPE_DEVMAP); + __type(key, int); + __type(value, int); + __uint(max_entries, 1); + __uint(pinning, LIBBPF_PIN_BY_NAME); +} router_iface SEC(".maps"); + +SEC("xdp") +int physical(struct xdp_md *ctx) +{ + void *data_end = (void *)(long)ctx->data_end; + void *data = (void *)(long)ctx->data; + + struct hdr_cursor nh; + nh.pos = data; + + struct ethhdr *eth; + if (parse_ethhdr(&nh, data_end, &eth) < 0) + return XDP_DROP; + + if (ctx->ingress_ifindex < 1 || ctx->ingress_ifindex > 4096) + return XDP_DROP; + + vlan_tag_push(ctx, eth, ctx->ingress_ifindex); + return bpf_redirect_map(&router_iface, 0, 0); +} diff --git a/tools/xdp-forwarder/prog_router.c b/tools/xdp-forwarder/prog_router.c new file mode 100644 index 0000000..fe6a6b5 --- /dev/null +++ b/tools/xdp-forwarder/prog_router.c @@ -0,0 +1,43 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> + +#define VLAN_MAX_DEPTH 1 + +#include <linux/bpf.h> +#include <bpf/bpf_endian.h> +#include "parsing_helpers.h" +#include "rewrite_helpers.h" + +// The map is actually not used by this program, but just included +// to keep the reference-counted pin alive before any physical interfaces +// are added. +struct { + __uint(type, BPF_MAP_TYPE_DEVMAP); + __type(key, int); + __type(value, int); + __uint(max_entries, 1); + __uint(pinning, LIBBPF_PIN_BY_NAME); +} router_iface SEC(".maps"); + + +SEC("xdp") +int router(struct xdp_md *ctx) +{ + void *data_end = (void *)(long)ctx->data_end; + void *data = (void *)(long)ctx->data; + + struct hdr_cursor nh; + nh.pos = data; + + struct ethhdr *eth; + int r; + if (r = parse_ethhdr(&nh, data_end, &eth) < 0) + return XDP_DROP; + + int vlid = vlan_tag_pop(ctx, eth); + if (vlid < 0) { + return XDP_DROP; + } + + return bpf_redirect(vlid, 0); +} diff --git a/tools/xdp-forwarder/set_router_iface.c b/tools/xdp-forwarder/set_router_iface.c new file mode 100644 index 0000000..32835f9 --- /dev/null +++ b/tools/xdp-forwarder/set_router_iface.c @@ -0,0 +1,29 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> + +#include <stdio.h> +#include <net/if.h> +#include <bpf/bpf.h> +#include <err.h> + +int main(int argc, char **argv) +{ + if (argc < 2) { + err(EXIT_FAILURE, "missing interface name"); + } + + int router_idx = if_nametoindex(argv[1]); + if (router_idx <= 0) { + err(EXIT_FAILURE, "error getting router interface"); + } + + int map_fd = bpf_obj_get("/sys/fs/bpf/router_iface"); + if (map_fd < 0) { + err(EXIT_FAILURE, "failed to open bpf map"); + } + + int id = 0; + if (bpf_map_update_elem(map_fd, &id, &router_idx, 0) < 0) { + err(EXIT_FAILURE, "failed to update bpf map"); + } +} -- 2.50.1

4 4

Re: [DO_NOT_APPLY v3 1/3] add xdp-forwarder
by Alyssa Ross 06 Sep '25

06 Sep '25

Yureka <yuka(a)yuka.dev> writes: >>> @@ -7,6 +8,9 @@ option('host', type : 'boolean', value : false, >>> option('guest', type : 'boolean', >>> description : 'Build tools for Spectrum guests') >>> >>> +option('driver', type : 'boolean', >>> + description : 'Build tools for Spectrum driver VMs') >>> + >> Should be grouped with host and guest (no blank line between). > > There is a blank line in between host and guest, so I don't know what > you mean exactly. I think I was confused by the diff output, sorry. Let's default it to false though — the most likely way for this to be reused would be for people running custom application VMs, so that's what should be built by default. Should also rename "guest" to "app", I think — I can do that myself before applying, if you prefer.

1 0

Arranging groups of services
by Demi Marie Obenour 05 Sep '25

05 Sep '25

I'm working on Spectrum OS (https://spectrum-os.org/) and am currently porting it from s6 (https://skarnet.org/software/s6-linux-init/) to systemd. Spectrum OS's host (which is what is being ported) is rather different from a normal system: - The root filesystem is completely read-only. There's no writable /var. I decided to put a tmpfs there for now. - There is no network access, so /etc/resolv.conf isn't needed. - The real work happens in VMs, each of which depends on a few services: - Cloud Hypervisor (https://www.cloudhypervisor.org) which runs the VM. - crosvm (https://crosvm.dev/book/) used for graphics. - virtiofsd (https://virtio-fs.gitlab.io) to provide a filesystem - Spectrum OS's own proxy for the XDG desktop portals - In the future, an instance of vhost-device-sound (https://github.com/rust-vmm/vhost-device/blob/main/vhost-device-sound/READM…) used for sound - A per-VM D-Bus daemon - An instance of xdg-desktop-portal If the Cloud Hypervisor instance is stopped or exits, the others should be stopped automatically, as they have no other use. Having BindsTo=, After=, PropagatesStopTo=, and PropagatesReloadTo= should handle most cases, but I don't know if that is sufficient if Cloud Hypervisor exits spontaneously (because the guest shut down) or crashes. Additionally, these services have different sandboxing needs. Cloud Hypervisor should only be able to connect to its own instance of the daemons that serve it, rather than to any instance. crosvm needs GPU and Wayland access and vhost-device-sound needs to connect to PipeWire. virtiofsd needs an id-mapped mount. I would also like to block abstract AF_UNIX socket access. Are there existing systemd features that can easily meet these needs? For the sockets I am thinking of placing them in RuntimeDirectory= and only giving the correct units access to those directories. Also, I would like to use `DynamicUser=` for everything where that is possible. -- Sincerely, Demi Marie Obenour (she/her/hers)

3 2

Starting programs before udev is running
by Demi Marie Obenour 02 Sep '25

02 Sep '25

Is it dangerous to start programs before udev is running, so long as all of the other dependencies of these programs (such as /var and /home being read-write) have been satisfied? Or do programs assume that udev has actually started, not merely bound to its sockets connections? The reason I ask is that I'm using systemd-udevd with a non-systemd service manager (s6 + s6-rc) and it has an incompatible method for readiness notification (writing a newline to a file descriptor). s6-rc has full support for dependencies, so I can easily have udev write to a FIFO when it picks up /dev/zero and have other things depend on that, but I'm curious if there are any other problems with this approach. In case it matters, the only programs running on the machine will be some VMs, a few programs to support them, a Wayland compositor (now Weston, eventually COSMIC), some XDG portals, and possibly a couple of others. No code not included in the (signed and dm-verity protected) root filesystem will be allowed to execute. -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

Generating file lists from a script
by Demi Marie Obenour 01 Sep '25

01 Sep '25

Maintaining the lists of files and directories in the makefiles is error-prone. Would it make sense to use a script to generate them from the git repository? The script would get it right every time, whereas I tend to get it wrong more times than not. -- Sincerely, Demi Marie Obenour (she/her/hers)

2 2

[DO_NOT_APPLY v2 0/3] xdp-forwarder
by Yureka Lilian 01 Sep '25

01 Sep '25

Same as v1, it doesn't make sense to apply this without the router. Changes since v1: - rebased - apply new uncrustify config - moved xdp-forwarder to tools/ - split integration into separate commit - use linuxHeaders instead of vmlinux.h - use original xdp-tutorial {parsing,rewrite}_helpers.h - inlined the load scripts into /etc/iface/mdev, using /usr/lib/xdp as fixed prefix for finding the XDP progs - removed the README, added a paragraph to architecture doc instead Yureka Lilian (3): add xdp-forwarder integrate xdp-forwarder into net-vm docs/architecture: add paragraph about networking Documentation/about/architecture.adoc | 20 ++ pkgs/default.nix | 1 + tools/xdp-forwarder/Makefile | 28 ++ tools/xdp-forwarder/default.nix | 24 ++ tools/xdp-forwarder/include/parsing_helpers.h | 273 ++++++++++++++++++ tools/xdp-forwarder/include/rewrite_helpers.h | 145 ++++++++++ tools/xdp-forwarder/prog_physical.c | 37 +++ tools/xdp-forwarder/prog_router.c | 43 +++ tools/xdp-forwarder/set_router_iface.c | 32 ++ vm/sys/net/Makefile | 8 +- vm/sys/net/default.nix | 19 +- vm/sys/net/etc/fstab | 2 + vm/sys/net/etc/mdev/iface | 27 +- vm/sys/net/etc/nftables.conf | 8 - vm/sys/net/etc/s6-rc/connman/dependencies | 4 - vm/sys/net/etc/s6-rc/connman/type | 1 - vm/sys/net/etc/s6-rc/connman/type.license | 2 - vm/sys/net/etc/s6-rc/nftables/type | 1 - vm/sys/net/etc/s6-rc/nftables/type.license | 2 - vm/sys/net/etc/s6-rc/nftables/up | 6 - 20 files changed, 623 insertions(+), 60 deletions(-) create mode 100644 tools/xdp-forwarder/Makefile create mode 100644 tools/xdp-forwarder/default.nix create mode 100644 tools/xdp-forwarder/include/parsing_helpers.h create mode 100644 tools/xdp-forwarder/include/rewrite_helpers.h create mode 100644 tools/xdp-forwarder/prog_physical.c create mode 100644 tools/xdp-forwarder/prog_router.c create mode 100644 tools/xdp-forwarder/set_router_iface.c delete mode 100644 vm/sys/net/etc/nftables.conf delete mode 100644 vm/sys/net/etc/s6-rc/connman/dependencies delete mode 100644 vm/sys/net/etc/s6-rc/connman/type delete mode 100644 vm/sys/net/etc/s6-rc/connman/type.license delete mode 100644 vm/sys/net/etc/s6-rc/nftables/type delete mode 100644 vm/sys/net/etc/s6-rc/nftables/type.license delete mode 100644 vm/sys/net/etc/s6-rc/nftables/up -- 2.50.1

3 6