gazagnaire.org
Commits
An 0xFFFF_FFFF (or 0x7FFF_FFFF) int literal folds into the bytecode
as an out-of-range constant on a narrow-int target, and wasm_of_ocaml
truncates it with an integer-overflow warning in every wasm build.
Int64.to_int at binding time produces the identical mask on every
backend - the wide mask where int is wide, the all-ones no-op where
the value cannot exceed the width anyway - with no constant left to
warn about. Bound once per module on the packet-hot paths (ip
checksum folding, firewall conntrack keys).
The hash already handles IPv6 (a 36-byte tuple); pin it with a unit test
and a fuzz property (symmetric both directions, asymmetric directional,
owner in range). Document that symmetry comes from ordering the endpoints,
not the key, so a per-process random key defends against an attacker
steering a chosen flow onto one owner -- the default key is the fixed
public hardware key.
obs showed 80% of a flow-hashing run's CPU in the per-bit Toeplitz walk.
Fold the key windows for each byte value once into a 40x256 table (built
lazily for the default key) so the hash is one lookup and XOR per input
byte instead of eight per bit. A 10M-flow steering loop drops from 5.14s to
1.0s (~5x); the 82599 verification vectors still hold, so the table path is
exact. A caller-supplied key keeps the per-bit reference path. Adds a bench
for obs run.
Match the flow-id encoding a share-nothing stack needs before adopting the
package: 1-based (((local-1)*count)+owner+1) so an edge-owned negative
identifier routes by its magnitude, and let owner take the RSS indirection
table size (buckets) rather than fixing it at 128.
Flow-to-owner steering is currently entangled in Tcp.Shard, so anything
else that wants it (the firewall's sharded NAT) would drag in the whole
TCP stack. Factor the concern into a dependency-light package (ipaddr
only) that the TCP stack and the firewall both consume: the Toeplitz hash
(Microsoft RSS / Intel 82599, verified against the canonical verification
vectors) exposed asymmetric and symmetric, an owner reduction, and the RFC
6335 dynamic-port lanes that keep a flow's return traffic on its owner. The
opam name is nox-rss because rss is the RSS-feed library.
An 0xFFFF_FFFF (or 0x7FFF_FFFF) int literal folds into the bytecode
as an out-of-range constant on a narrow-int target, and wasm_of_ocaml
truncates it with an integer-overflow warning in every wasm build.
Int64.to_int at binding time produces the identical mask on every
backend - the wide mask where int is wide, the all-ones no-op where
the value cannot exceed the width anyway - with no constant left to
warn about. Bound once per module on the packet-hot paths (ip
checksum folding, firewall conntrack keys).
The hash already handles IPv6 (a 36-byte tuple); pin it with a unit test
and a fuzz property (symmetric both directions, asymmetric directional,
owner in range). Document that symmetry comes from ordering the endpoints,
not the key, so a per-process random key defends against an attacker
steering a chosen flow onto one owner -- the default key is the fixed
public hardware key.
obs showed 80% of a flow-hashing run's CPU in the per-bit Toeplitz walk.
Fold the key windows for each byte value once into a 40x256 table (built
lazily for the default key) so the hash is one lookup and XOR per input
byte instead of eight per bit. A 10M-flow steering loop drops from 5.14s to
1.0s (~5x); the 82599 verification vectors still hold, so the table path is
exact. A caller-supplied key keeps the per-bit reference path. Adds a bench
for obs run.
Flow-to-owner steering is currently entangled in Tcp.Shard, so anything
else that wants it (the firewall's sharded NAT) would drag in the whole
TCP stack. Factor the concern into a dependency-light package (ipaddr
only) that the TCP stack and the firewall both consume: the Toeplitz hash
(Microsoft RSS / Intel 82599, verified against the canonical verification
vectors) exposed asymmetric and symmetric, an owner reduction, and the RFC
6335 dynamic-port lanes that keep a flow's return traffic on its owner. The
opam name is nox-rss because rss is the RSS-feed library.