Re: [PATCH RFC v4 5/5] vm/sys/net: integrate xdp-forwarder

[Yureka <yuka@yuka.dev>]

I just noticed some unresolved conflicts ended up in this one, so it'll 
definitely need to be re-done (although it's not ready to be pulled 
anyways).

On 9/23/25 15:20, Yureka Lilian wrote:
> ---
> vm/sys/net/Makefile | 19 +++++++++++--
> vm/sys/net/default.nix | 21 ++++++++-------
> vm/sys/net/image/etc/fstab | 2 ++
> vm/sys/net/image/etc/mdev/iface | 27 ++++++-------------
> vm/sys/net/image/etc/nftables.conf | 8 ------
> vm/sys/net/image/etc/s6-rc/connman/type | 1 -
> .../net/image/etc/s6-rc/connman/type.license | 2 --
> .../net/image/etc/s6-rc/mdevd-coldplug/type | 1 -
> .../net/image/etc/s6-rc/nftables/type.license | 2 --
> vm/sys/net/image/etc/s6-rc/nftables/up | 6 -----
> 10 files changed, 39 insertions(+), 50 deletions(-)
> delete mode 100644 vm/sys/net/image/etc/nftables.conf
> delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type
> delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type.license
> delete mode 100644 vm/sys/net/image/etc/s6-rc/mdevd-coldplug/type
> delete mode 100644 vm/sys/net/image/etc/s6-rc/nftables/type.license
> delete mode 100644 vm/sys/net/image/etc/s6-rc/nftables/up
>
> diff --git a/vm/sys/net/Makefile b/vm/sys/net/Makefile
> index 0193cc8..28e924b 100644
> --- a/vm/sys/net/Makefile
> +++ b/vm/sys/net/Makefile
> @@ -34,12 +34,11 @@ VM_FILES = \
> image/etc/init \
> image/etc/mdev.conf \
> image/etc/mdev/iface \
> - image/etc/nftables.conf \
> image/etc/passwd \
> image/etc/s6-linux-init/run-image/service/getty-hvc0/run \
> image/etc/s6-linux-init/scripts/rc.init \
> image/etc/sysctl.conf
> -VM_DIRS = dev etc/s6-linux-init/env run proc sys var/lib/connman
> +VM_DIRS = dev etc/s6-linux-init/env proc run sys
> # These are separate because they need to be included, but putting
> # them as make dependencies would confuse make.
> @@ -59,6 +58,7 @@ build/rootfs.erofs: ../../../scripts/make-erofs.sh 
> $(PACKAGES_FILE) $(VM_FILES)
> ) | ../../../scripts/make-erofs.sh $@
> VM_S6_RC_FILES = \
> +<<<<<<< HEAD
> image/etc/s6-rc/connman/dependencies.d/dbus \
> image/etc/s6-rc/connman/run \
> image/etc/s6-rc/connman/type \
> @@ -77,6 +77,21 @@ VM_S6_RC_FILES = \
> image/etc/s6-rc/ok-all/type \
> image/etc/s6-rc/sysctl/type \
> image/etc/s6-rc/sysctl/up
> +=======
> + etc/s6-rc/dbus/notification-fd \
> + etc/s6-rc/dbus/run \
> + etc/s6-rc/dbus/type \
> + etc/s6-rc/mdevd-coldplug/dependencies \
> + etc/s6-rc/mdevd-coldplug/type \
> + etc/s6-rc/mdevd-coldplug/up \
> + etc/s6-rc/mdevd/notification-fd \
> + etc/s6-rc/mdevd/run \
> + etc/s6-rc/mdevd/type \
> + etc/s6-rc/ok-all/contents \
> + etc/s6-rc/ok-all/type \
> + etc/s6-rc/sysctl/type \
> + etc/s6-rc/sysctl/up
> +>>>>>>> 45850c5 (vm/sys/net: integrate xdp-forwarder)
> build/etc/s6-rc: $(VM_S6_RC_FILES)
> mkdir -p $$(dirname $@)
> diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix
> index 2953c3a..8159247 100644
> --- a/vm/sys/net/default.nix
> +++ b/vm/sys/net/default.nix
> @@ -1,13 +1,14 @@
> # SPDX-License-Identifier: MIT
> # SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi@alyssa.is>
> +# SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>
> -import ../../../lib/call-package.nix ({ lseek, src, terminfo, pkgsMusl }:
> +import ../../../lib/call-package.nix ({ lseek, spectrum-driver-tools, 
> src, terminfo, pkgsMusl }:
> pkgsMusl.callPackage (
> { lib, stdenvNoCC, nixos, runCommand, writeClosure
> , erofs-utils, jq, s6-rc, util-linux, xorg
> -, busybox, connmanMinimal, dbus, execline, kmod, linux_latest, mdevd, 
> nftables
> -, s6, s6-linux-init
> +, busybox, dbus, execline, kmod, linux_latest, mdevd
> +, s6, s6-linux-init, xdp-tools
> }:
> let
> @@ -50,10 +51,8 @@ let
> ];
> });
> - connman = connmanMinimal;
> -
> packages = [
> - connman dbus execline kmod mdevd s6 s6-linux-init s6-rc
> + dbus execline kmod mdevd s6 s6-linux-init s6-rc xdp-tools
> (busybox.override {
> extraConfig = ''
> @@ -66,13 +65,16 @@ let
> CONFIG_RMMOD n
> '';
> })
> -
> - (nftables.override { withCli = false; })
> ];
> # Packages that should be fully linked into /usr,
> # (not just their bin/* files).
> - usrPackages = [ connman dbus firmware kernel.modules terminfo ];
> + usrPackages = [
> + dbus firmware kernel terminfo
> +
> + # for xdp-forwarder
> + spectrum-driver-tools
> + ];
> packagesSysroot = runCommand "packages-sysroot" {
> inherit packages;
> @@ -94,6 +96,7 @@ let
> system.stateVersion = lib.trivial.release;
> });
> +
> in
> stdenvNoCC.mkDerivation {
> diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab
> index 6a82ecc..5a1bbf4 100644
> --- a/vm/sys/net/image/etc/fstab
> +++ b/vm/sys/net/image/etc/fstab
> @@ -1,6 +1,8 @@
> # SPDX-License-Identifier: CC0-1.0
> # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
> +# SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>
> proc /proc proc defaults 0 0
> devpts /dev/pts devpts defaults,gid=4,mode=620 0 0
> tmpfs /dev/shm tmpfs defaults 0 0
> sysfs /sys sysfs defaults 0 0
> +bpffs /sys/fs/bpf bpf defaults 0 0
> diff --git a/vm/sys/net/image/etc/mdev/iface 
> b/vm/sys/net/image/etc/mdev/iface
> index 2306575..ff4bf53 100755
> --- a/vm/sys/net/image/etc/mdev/iface
> +++ b/vm/sys/net/image/etc/mdev/iface
> @@ -1,36 +1,25 @@
> #!/bin/execlineb -P
> # SPDX-License-Identifier: EUPL-1.2+
> # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
> +# SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>
> importas -Si INTERFACE
> ifte
> {
> - # This interface is connected to another VM.
> -
> - # The other VM's IP is encoded in the NIC-specific portion of the
> - # interface's MAC address.
> - backtick -E CLIENT_IP {
> - awk -F: "{printf \"100.64.%d.%d\\n\", \"0x\" $5, \"0x\" $6}"
> - /sys/class/net/${INTERFACE}/address
> - }
> -
> - if { ip address add 169.254.0.1/32 dev $INTERFACE }
> - if { ip link set $INTERFACE up }
> - ip route add $CLIENT_IP dev $INTERFACE
> + # This interface is connected to the router
> + if { xdp-loader load $INTERFACE /usr/lib/xdp/prog_router.o -m skb -p 
> /sys/fs/bpf }
> + if { ip link set $INTERFACE promisc on }
> + if { set-router-iface $INTERFACE }
> + ip link set $INTERFACE up
> }
> {
> if { test $INTERFACE != lo }
> # This is a physical connection to a network device.
> - background { s6-rc -bu change connman }
> - if { s6-rc -bu change nftables }
> - if {
> - forx -pE module { nft_counter nft_masq }
> - modprobe $module
> - }
> - nft add rule ip nat postrouting oifname $INTERFACE counter masquerade
> + if { xdp-loader load $INTERFACE /usr/lib/xdp/prog_physical.o -m skb 
> -p /sys/fs/bpf }
> + ip link set $INTERFACE up
> }
> grep -iq ^02:01: /sys/class/net/${INTERFACE}/address
> diff --git a/vm/sys/net/image/etc/nftables.conf 
> b/vm/sys/net/image/etc/nftables.conf
> deleted file mode 100644
> index 296d92c..0000000
> --- a/vm/sys/net/image/etc/nftables.conf
> +++ /dev/null
> @@ -1,8 +0,0 @@
> -# SPDX-License-Identifier: EUPL-1.2+
> -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
> -
> -table nat {
> - chain postrouting {
> - type nat hook postrouting priority 100;
> - }
> -}
> diff --git a/vm/sys/net/image/etc/s6-rc/connman/type 
> b/vm/sys/net/image/etc/s6-rc/connman/type
> deleted file mode 100644
> index 5883cff..0000000
> --- a/vm/sys/net/image/etc/s6-rc/connman/type
> +++ /dev/null
> @@ -1 +0,0 @@
> -longrun
> diff --git a/vm/sys/net/image/etc/s6-rc/connman/type.license 
> b/vm/sys/net/image/etc/s6-rc/connman/type.license
> deleted file mode 100644
> index 2b3b032..0000000
> --- a/vm/sys/net/image/etc/s6-rc/connman/type.license
> +++ /dev/null
> @@ -1,2 +0,0 @@
> -SPDX-License-Identifier: CC0-1.0
> -SPDX-FileCopyrightText: 2020 Alyssa Ross <hi@alyssa.is>
> diff --git a/vm/sys/net/image/etc/s6-rc/mdevd-coldplug/type 
> b/vm/sys/net/image/etc/s6-rc/mdevd-coldplug/type
> deleted file mode 100644
> index bdd22a1..0000000
> --- a/vm/sys/net/image/etc/s6-rc/mdevd-coldplug/type
> +++ /dev/null
> @@ -1 +0,0 @@
> -oneshot
> diff --git a/vm/sys/net/image/etc/s6-rc/nftables/type.license 
> b/vm/sys/net/image/etc/s6-rc/nftables/type.license
> deleted file mode 100644
> index c49c11b..0000000
> --- a/vm/sys/net/image/etc/s6-rc/nftables/type.license
> +++ /dev/null
> @@ -1,2 +0,0 @@
> -SPDX-License-Identifier: CC0-1.0
> -SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
> diff --git a/vm/sys/net/image/etc/s6-rc/nftables/up 
> b/vm/sys/net/image/etc/s6-rc/nftables/up
> deleted file mode 100644
> index 7d5f141..0000000
> --- a/vm/sys/net/image/etc/s6-rc/nftables/up
> +++ /dev/null
> @@ -1,6 +0,0 @@
> -# SPDX-License-Identifier: EUPL-1.2+
> -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
> -
> -if { modprobe nft_chain_nat }
> -
> -nft -f /etc/nftables.conf