summaryrefslogtreecommitdiff
path: root/cmake
diff options
context:
space:
mode:
Diffstat (limited to 'cmake')
-rw-r--r--cmake/config/global.cmake12
-rw-r--r--cmake/config/ipcp/broadcast.cmake3
-rw-r--r--cmake/config/ipcp/common.cmake9
-rw-r--r--cmake/config/ipcp/eth.cmake18
-rw-r--r--cmake/config/ipcp/local.cmake32
-rw-r--r--cmake/config/ipcp/udp.cmake12
-rw-r--r--cmake/config/ipcp/unicast.cmake21
-rw-r--r--cmake/config/irmd.cmake10
-rw-r--r--cmake/config/lib.cmake94
-rw-r--r--cmake/config/lib/common.cmake58
-rw-r--r--cmake/config/lib/crypt.cmake41
-rw-r--r--cmake/config/lib/frct.cmake43
-rw-r--r--cmake/config/lib/poa.cmake37
-rw-r--r--cmake/config/lib/ssm.cmake (renamed from cmake/config/ssm.cmake)111
-rw-r--r--cmake/config/tests.cmake6
-rw-r--r--cmake/dependencies.cmake13
-rw-r--r--cmake/dependencies/crypt/openssl.cmake58
-rw-r--r--cmake/dependencies/eth/netmap.cmake24
-rw-r--r--cmake/dependencies/system/liburcu.cmake45
-rw-r--r--cmake/dependencies/udp/ddns.cmake31
-rw-r--r--cmake/tags.cmake21
-rw-r--r--cmake/utils/CPUUtils.cmake82
22 files changed, 556 insertions, 225 deletions
diff --git a/cmake/config/global.cmake b/cmake/config/global.cmake
index 0ac256bb..1e172724 100644
--- a/cmake/config/global.cmake
+++ b/cmake/config/global.cmake
@@ -25,8 +25,16 @@ set(SHM_LOCKFILE_NAME "/${SHM_PREFIX}.lockfile" CACHE INTERNAL
# Secure memory configuration
set(IRMD_SECMEM_MAX 1048576 CACHE STRING "IRMd secure heap size")
-set(PROC_SECMEM_MAX 1048576 CACHE STRING "Process secure heap size")
-set(SECMEM_GUARD 32 CACHE STRING "Secure heap min size")
+# ~8 KiB secure heap per encrypted flow (cur+prev node slabs); the total
+# is rounded up to a power of two for the OpenSSL secure-heap allocator.
+set(PROC_SECMEM_FLOWS 512 CACHE STRING
+ "Max concurrent encrypted flows the per-process secure heap is sized for")
+math(EXPR PROC_SECMEM_NEED "${PROC_SECMEM_FLOWS} * 8192")
+set(PROC_SECMEM_MAX 4096)
+while(PROC_SECMEM_MAX LESS PROC_SECMEM_NEED)
+ math(EXPR PROC_SECMEM_MAX "${PROC_SECMEM_MAX} * 2")
+endwhile()
+set(SECMEM_MINSIZE 32 CACHE STRING "Secure heap min alloc size")
# Container/deployment options
set(BUILD_CONTAINER FALSE CACHE BOOL
diff --git a/cmake/config/ipcp/broadcast.cmake b/cmake/config/ipcp/broadcast.cmake
index 79f41d10..f521ed8e 100644
--- a/cmake/config/ipcp/broadcast.cmake
+++ b/cmake/config/ipcp/broadcast.cmake
@@ -4,3 +4,6 @@ set(IPCP_BROADCAST_TARGET ipcpd-broadcast)
set(IPCP_BROADCAST_MPL 100 CACHE STRING
"Default maximum packet lifetime for the Broadcast IPCP, in ms")
+
+set(IPCP_BROADCAST_MTU 1400 CACHE STRING
+ "Layer MTU advertised by the Broadcast IPCP, in bytes")
diff --git a/cmake/config/ipcp/common.cmake b/cmake/config/ipcp/common.cmake
index ffd5dc32..79c822a3 100644
--- a/cmake/config/ipcp/common.cmake
+++ b/cmake/config/ipcp/common.cmake
@@ -41,3 +41,12 @@ if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
set(IPCP_LINUX_TIMERSLACK_NS 100 CACHE STRING
"Slack value for high resolution timers on Linux systems.")
endif()
+
+# Per-flow statistics exposed via the RIB (requires FUSE).
+if(HAVE_FUSE)
+ set(IPCP_FLOW_STATS TRUE CACHE BOOL
+ "Enable per-flow statistics via the RIB")
+ if(IPCP_FLOW_STATS)
+ message(STATUS "IPCP flow statistics enabled")
+ endif()
+endif()
diff --git a/cmake/config/ipcp/eth.cmake b/cmake/config/ipcp/eth.cmake
deleted file mode 100644
index 4b9007d2..00000000
--- a/cmake/config/ipcp/eth.cmake
+++ /dev/null
@@ -1,18 +0,0 @@
-# Ethernet IPCP configuration options for Ouroboros
-# Options for eth-llc and eth-dix IPCPs
-
-set(IPCP_ETH_LLC_TARGET ipcpd-eth-llc)
-set(IPCP_ETH_DIX_TARGET ipcpd-eth-dix)
-
-set(IPCP_ETH_RD_THR 1 CACHE STRING
- "Number of reader threads in Ethernet IPCP")
-set(IPCP_ETH_WR_THR 1 CACHE STRING
- "Number of writer threads in Ethernet IPCP")
-set(IPCP_ETH_QDISC_BYPASS false CACHE BOOL
- "Bypass the Qdisc in the kernel when using raw sockets")
-set(IPCP_ETH_LO_MTU 9000 CACHE STRING
- "Restrict Ethernet MTU over loopback interfaces")
-set(IPCP_ETH_MGMT_FRAME_SIZE 9000 CACHE STRING
- "Management frame buffer size for Ethernet IPCPs")
-set(IPCP_ETH_MPL 100 CACHE STRING
- "Default maximum packet lifetime for the Ethernet IPCPs, in ms")
diff --git a/cmake/config/ipcp/local.cmake b/cmake/config/ipcp/local.cmake
index 88ee8998..70423cd1 100644
--- a/cmake/config/ipcp/local.cmake
+++ b/cmake/config/ipcp/local.cmake
@@ -2,8 +2,38 @@
set(IPCP_LOCAL_TARGET ipcpd-local)
-set(IPCP_LOCAL_MPL 100 CACHE STRING
+set(IPCP_LOCAL_MPL 50 CACHE STRING
"Default maximum packet lifetime for the Local IPCP, in ms")
+set(IPCP_LOCAL_MTU 65000 CACHE STRING
+ "Layer MTU advertised by the Local IPCP, in bytes")
+
set(IPCP_LOCAL_POLLING FALSE CACHE BOOL
"Enable active polling in the Local IPCP for low-latency mode")
+
+# IPCP_LOCAL_MTU must fit in the largest enabled GSPP and PUP class
+# (sender-side allocation: daemons use GSPP, apps use PUP). Reserve a
+# margin for sizeof(struct ssm_pk_buff) + HEADSPACE + TAILSPACE.
+math(EXPR _ssm_pk_overhead
+ "${SSM_PK_BUFF_HEADSPACE} + ${SSM_PK_BUFF_TAILSPACE} + 64")
+
+foreach(_pool GSPP PUP)
+ set(_largest 0)
+ foreach(_pair "256;256" "512;512" "1K;1024" "2K;2048" "4K;4096"
+ "16K;16384" "64K;65536" "256K;262144" "1M;1048576")
+ list(GET _pair 0 _name)
+ list(GET _pair 1 _bytes)
+ if(SSM_${_pool}_${_name}_BLOCKS GREATER 0
+ AND _bytes GREATER _largest)
+ set(_largest ${_bytes})
+ endif()
+ endforeach()
+ math(EXPR _avail "${_largest} - ${_ssm_pk_overhead}")
+ if(IPCP_LOCAL_MTU GREATER _avail)
+ message(FATAL_ERROR
+ "IPCP_LOCAL_MTU (${IPCP_LOCAL_MTU}) exceeds largest enabled "
+ "SSM_${_pool} class minus per-block overhead "
+ "(${_largest} - ${_ssm_pk_overhead} = ${_avail} bytes). "
+ "Lower IPCP_LOCAL_MTU or enable a larger SSM_${_pool}_*_BLOCKS.")
+ endif()
+endforeach()
diff --git a/cmake/config/ipcp/udp.cmake b/cmake/config/ipcp/udp.cmake
deleted file mode 100644
index 0124c261..00000000
--- a/cmake/config/ipcp/udp.cmake
+++ /dev/null
@@ -1,12 +0,0 @@
-# UDP IPCP configuration options for Ouroboros
-# Options for udp4 and udp6 IPCPs
-
-set(IPCP_UDP4_TARGET ipcpd-udp4)
-set(IPCP_UDP6_TARGET ipcpd-udp6)
-
-set(IPCP_UDP_RD_THR 3 CACHE STRING
- "Number of reader threads in UDP IPCPs")
-set(IPCP_UDP_WR_THR 3 CACHE STRING
- "Number of writer threads in UDP IPCPs")
-set(IPCP_UDP_MPL 5000 CACHE STRING
- "Default maximum packet lifetime for the UDP IPCPs, in ms")
diff --git a/cmake/config/ipcp/unicast.cmake b/cmake/config/ipcp/unicast.cmake
index 3b5b0ce7..92eeae65 100644
--- a/cmake/config/ipcp/unicast.cmake
+++ b/cmake/config/ipcp/unicast.cmake
@@ -4,9 +4,30 @@ set(IPCP_UNICAST_TARGET ipcpd-unicast)
set(IPCP_UNICAST_MPL 100 CACHE STRING
"Default maximum packet lifetime for the Unicast IPCP, in ms")
+set(IPCP_UNICAST_MTU 1400 CACHE STRING
+ "Layer MTU advertised by the Unicast IPCP, in bytes (TODO: derive per-flow from n-1 path MTU minus DT PCI)")
set(PFT_SIZE 256 CACHE STRING
"Prefix forwarding table size for the Unicast IPCP")
+# Aggregate congestion-avoidance context interning. One ctx is shared
+# per (peer, qos cube); this is the hash table bucket count. Must be a
+# power of two (the bucket index masks with CA_BUCKETS - 1).
+set(IPCP_CA_BUCKETS 64 CACHE STRING
+ "Hash buckets for aggregate CA context interning (power of two)")
+math(EXPR IPCP_CA_BUCKETS_POW2 "${IPCP_CA_BUCKETS} & (${IPCP_CA_BUCKETS} - 1)")
+if((IPCP_CA_BUCKETS LESS 1) OR (NOT IPCP_CA_BUCKETS_POW2 EQUAL 0))
+ message(FATAL_ERROR "IPCP_CA_BUCKETS must be a positive power of two")
+endif()
+
+# Per-flow (non-aggregated) congestion avoidance. Aggregate CA per
+# (peer, qos cube) is the production behaviour; enable this only to
+# build the legacy per-flow reference for A/B testing and bisection.
+set(IPCP_CA_PER_FLOW FALSE CACHE BOOL
+ "Use per-flow congestion avoidance (testing only)")
+if(IPCP_CA_PER_FLOW)
+ message(STATUS "IPCP per-flow congestion avoidance (testing build)")
+endif()
+
# Protocol debugging
set(DEBUG_PROTO_DHT FALSE CACHE BOOL
"Add DHT protocol debug logging")
diff --git a/cmake/config/irmd.cmake b/cmake/config/irmd.cmake
index b86a40c5..bbb73bec 100644
--- a/cmake/config/irmd.cmake
+++ b/cmake/config/irmd.cmake
@@ -10,8 +10,8 @@ set(ENROLL_TIMEOUT 20000 CACHE STRING
"Timeout for an IPCP to enroll (ms)")
set(REG_TIMEOUT 20000 CACHE STRING
"Timeout for registering a name (ms)")
-set(QUERY_TIMEOUT 200 CACHE STRING
- "Timeout to query a name with an IPCP (ms)")
+set(QUERY_TIMEOUT 2000 CACHE STRING
+ "Timeout to query a name with an IPCP (ms); must exceed PoA retries")
set(CONNECT_TIMEOUT 20000 CACHE STRING
"Timeout to connect an IPCP to another IPCP (ms)")
set(FLOW_ALLOC_TIMEOUT 20000 CACHE STRING
@@ -20,6 +20,12 @@ set(FLOW_ALLOC_TIMEOUT 20000 CACHE STRING
# OAP (Ouroboros Authentication Protocol)
set(OAP_REPLAY_TIMER 20 CACHE STRING
"OAP replay protection window (s)")
+set(OAP_REPLAY_MAX 4096 CACHE STRING
+ "Maximum entries in the OAP replay cache (bounds memory/CPU under flood)")
+set(OAP_REKEY_TIMER 120 CACHE STRING
+ "Tier-2 re-key interval (s); bounds key age / PCS healing, 0 disables")
+set(OAP_CLIENT_AUTH_DEFAULT TRUE CACHE BOOL
+ "Client requires the server to authenticate by default")
set(DEBUG_PROTO_OAP FALSE CACHE BOOL
"Add Flow allocation protocol message output to IRMd debug logging")
diff --git a/cmake/config/lib.cmake b/cmake/config/lib.cmake
deleted file mode 100644
index 287f30dc..00000000
--- a/cmake/config/lib.cmake
+++ /dev/null
@@ -1,94 +0,0 @@
-# Library configuration options for Ouroboros
-# Options affecting libouroboros-common, libouroboros-dev, libouroboros-irm
-
-# Flow limits
-set(SYS_MAX_FLOWS 10240 CACHE STRING
- "Maximum number of total flows for this system")
-set(PROG_MAX_FLOWS 4096 CACHE STRING
- "Maximum number of flows in an application")
-set(PROG_RES_FDS 64 CACHE STRING
- "Number of reserved flow descriptors per application")
-set(PROG_MAX_FQUEUES 32 CACHE STRING
- "Maximum number of flow sets per application")
-
-# Threading
-if(NOT APPLE)
- set(PTHREAD_COND_CLOCK "CLOCK_MONOTONIC" CACHE STRING
- "Clock to use for condition variable timing")
-else()
- set(PTHREAD_COND_CLOCK "CLOCK_REALTIME" CACHE INTERNAL
- "Clock to use for condition variable timing")
-endif()
-
-# Timeouts
-set(SOCKET_TIMEOUT 500 CACHE STRING
- "Default timeout for responses from IPCPs (ms)")
-
-# QoS settings
-set(QOS_DISABLE_CRC TRUE CACHE BOOL
- "Ignores ber setting on all QoS cubes")
-
-# Delta-t protocol timers
-set(DELTA_T_MPL 60 CACHE STRING
- "Maximum packet lifetime (s)")
-set(DELTA_T_ACK 10 CACHE STRING
- "Maximum time to acknowledge a packet (s)")
-set(DELTA_T_RTX 120 CACHE STRING
- "Maximum time to retransmit a packet (s)")
-
-# FRCT configuration
-set(FRCT_REORDER_QUEUE_SIZE 256 CACHE STRING
- "Size of the reordering queue, must be a power of 2")
-set(FRCT_START_WINDOW 64 CACHE STRING
- "Start window, must be a power of 2")
-set(FRCT_LINUX_RTT_ESTIMATOR TRUE CACHE BOOL
- "Use Linux RTT estimator formula instead of the TCP RFC formula")
-set(FRCT_RTO_MDEV_MULTIPLIER 2 CACHE STRING
- "Multiplier for deviation term in the RTO: RTO = sRTT + (mdev << X)")
-set(FRCT_RTO_INC_FACTOR 0 CACHE STRING
- "Divisor for RTO increase after timeout: RTO += RTX >> X, 0: Karn/Partridge")
-set(FRCT_RTO_MIN 250 CACHE STRING
- "Minimum Retransmission Timeout (RTO) for FRCT (us)")
-set(FRCT_TICK_TIME 5000 CACHE STRING
- "Tick time for FRCT activity (retransmission, acknowledgments) (us)")
-
-# Retransmission (RXM) configuration
-set(RXM_BUFFER_ON_HEAP FALSE CACHE BOOL
- "Store packets for retransmission on the heap instead of in packet buffer")
-set(RXM_BLOCKING TRUE CACHE BOOL
- "Use blocking writes for retransmission")
-set(RXM_MIN_RESOLUTION 20 CACHE STRING
- "Minimum retransmission delay (ns), as a power to 2")
-set(RXM_WHEEL_MULTIPLIER 4 CACHE STRING
- "Factor for retransmission wheel levels as a power to 2")
-set(RXM_WHEEL_LEVELS 3 CACHE STRING
- "Number of levels in the retransmission wheel")
-set(RXM_WHEEL_SLOTS_PER_LEVEL 256 CACHE STRING
- "Number of slots per level in the retransmission wheel, must be a power of 2")
-
-# Acknowledgment wheel configuration
-set(ACK_WHEEL_SLOTS 256 CACHE STRING
- "Number of slots in the acknowledgment wheel, must be a power of 2")
-set(ACK_WHEEL_RESOLUTION 18 CACHE STRING
- "Minimum acknowledgment delay (ns), as a power to 2")
-
-# Thread pool manager (TPM) debugging
-set(TPM_DEBUG_REPORT_INTERVAL 0 CACHE STRING
- "Interval at wich the TPM will report long running threads (s), 0 disables")
-set(TPM_DEBUG_ABORT_TIMEOUT 0 CACHE STRING
- "TPM abort process after a thread reaches this timeout (s), 0 disables")
-
-# Encryption
-set(KEY_ROTATION_BIT 20 CACHE STRING
- "Bit position in packet counter that triggers key rotation (default 20 = every 2^20 packets)")
-
-# Flow statistics (requires FUSE)
-if(HAVE_FUSE)
- set(PROC_FLOW_STATS TRUE CACHE BOOL
- "Enable flow statistics tracking for application flows")
- if(PROC_FLOW_STATS)
- message(STATUS "Application flow statistics enabled")
- else()
- message(STATUS "Application flow statistics disabled")
- endif()
-endif()
diff --git a/cmake/config/lib/common.cmake b/cmake/config/lib/common.cmake
new file mode 100644
index 00000000..ebdc3196
--- /dev/null
+++ b/cmake/config/lib/common.cmake
@@ -0,0 +1,58 @@
+# Library configuration options for Ouroboros Options affecting libouroboros-common,
+# libouroboros-dev and libouroboros-irm as a whole; per-subsystem options sit beside this file
+
+# Flow limits
+set(SYS_MAX_FLOWS 10240 CACHE STRING
+ "Maximum number of total flows for this system")
+set(PROC_MAX_FLOWS 4096 CACHE STRING
+ "Maximum number of flows in an application")
+set(PROC_RES_FDS 64 CACHE STRING
+ "Number of reserved flow descriptors per application")
+set(PROC_MAX_FQUEUES 32 CACHE STRING
+ "Maximum number of flow sets per application")
+
+# Threading
+if(NOT APPLE)
+ set(PTHREAD_COND_CLOCK "CLOCK_MONOTONIC" CACHE STRING
+ "Clock to use for condition variable timing")
+else()
+ set(PTHREAD_COND_CLOCK "CLOCK_REALTIME" CACHE INTERNAL
+ "Clock to use for condition variable timing")
+endif()
+
+# Timeouts
+set(SOCKET_TIMEOUT 500 CACHE STRING
+ "Default timeout for responses from IPCPs (ms)")
+
+# QoS settings
+set(QOS_DISABLE_CRC TRUE CACHE BOOL
+ "Ignores ber setting on all QoS cubes")
+
+include(utils/CPUUtils)
+detect_pclmul()
+detect_pmull()
+if(HAVE_PCLMUL)
+ message(STATUS "CRC-64/NVMe backend: PCLMUL (x86 SSE4.1+PCLMUL)")
+elseif(HAVE_PMULL)
+ message(STATUS "CRC-64/NVMe backend: PMULL (aarch64 crypto)")
+else()
+ message(STATUS "CRC-64/NVMe backend: byte table (no acceleration)")
+endif()
+
+# Thread pool manager (TPM) debugging
+set(TPM_DEBUG_REPORT_INTERVAL 0 CACHE STRING
+ "Interval at wich the TPM will report long running threads (s), 0 disables")
+set(TPM_DEBUG_ABORT_TIMEOUT 0 CACHE STRING
+ "TPM abort process after a thread reaches this timeout (s), 0 disables")
+
+# Flow statistics (requires FUSE)
+if(HAVE_FUSE)
+ set(PROC_FLOW_STATS TRUE CACHE BOOL
+ "Enable flow statistics tracking for application flows")
+ if(PROC_FLOW_STATS)
+ message(STATUS "Application flow statistics enabled")
+ else()
+ message(STATUS "Application flow statistics disabled")
+ endif()
+endif()
+
diff --git a/cmake/config/lib/crypt.cmake b/cmake/config/lib/crypt.cmake
new file mode 100644
index 00000000..45fdaaed
--- /dev/null
+++ b/cmake/config/lib/crypt.cmake
@@ -0,0 +1,41 @@
+# Encryption configuration for Ouroboros Options for the key schedule and packet protection in
+# src/lib/crypt/
+
+# Encryption
+set(KEY_LEAF_BITS 20 CACHE STRING
+ "Packets per leaf key as a power of two (2^20 = AEAD-safe default)")
+set(KEY_NODE_BITS 6 CACHE STRING
+ "Leaf keys per node key, power of two (2^6 = 64; leak compartment)")
+set(KEY_NODE_COUNT 128 CACHE STRING
+ "Node keys per batch (N); <= 4096, the 12-bit on-wire node index")
+set(KEY_REKEY_WATERMARK 4 CACHE STRING
+ "Re-key when this many node keys remain; 0 disables the count trigger")
+set(KEY_REPLAY_WINDOW 2048 CACHE STRING
+ "RX replay window in packets; power of two, >= 128")
+set(KEY_REKEY_WM_CHECK_BITS 16 CACHE STRING
+ "Re-key watermark is consulted once per 2^n flow writes")
+if(NOT KEY_REPLAY_WINDOW MATCHES "^[0-9]+$")
+ message(FATAL_ERROR "KEY_REPLAY_WINDOW must be a positive integer")
+endif()
+math(EXPR _krw_p2 "${KEY_REPLAY_WINDOW} & (${KEY_REPLAY_WINDOW} - 1)")
+if(KEY_REPLAY_WINDOW LESS 128 OR NOT _krw_p2 EQUAL 0)
+ message(FATAL_ERROR "KEY_REPLAY_WINDOW must be a power of two >= 128")
+endif()
+
+# Re-key must finish within its lead window - KEY_REKEY_WATERMARK node keys worth of packets -
+# before the batch exhausts and TX fails closed. dev.c only evaluates the watermark once per
+# FLOW_WM_CHECK writes, so a lead below ~2x that leaves a high-rate flow no room to complete the
+# exchange. Production defaults are vast; this guards under-sized (test) geometries.
+if(KEY_REKEY_WATERMARK GREATER 0)
+ math(EXPR _rk_wm_check "1 << ${KEY_REKEY_WM_CHECK_BITS}")
+ math(EXPR _rk_lead
+ "${KEY_REKEY_WATERMARK} << (${KEY_LEAF_BITS} + ${KEY_NODE_BITS})")
+ math(EXPR _rk_min "2 * ${_rk_wm_check}")
+ if(_rk_lead LESS _rk_min)
+ message(WARNING
+ "Re-key lead is ${_rk_lead} packets vs the watermark check interval "
+ "${_rk_wm_check}; a high-rate flow may exhaust its key batch before the "
+ "re-key completes (TX fails closed until it does). Raise KEY_LEAF_BITS, "
+ "KEY_NODE_BITS, or KEY_REKEY_WATERMARK.")
+ endif()
+endif()
diff --git a/cmake/config/lib/frct.cmake b/cmake/config/lib/frct.cmake
new file mode 100644
index 00000000..1bd60aa0
--- /dev/null
+++ b/cmake/config/lib/frct.cmake
@@ -0,0 +1,43 @@
+# FRCT configuration for Ouroboros Options for the flow and retransmission control protocol in
+# src/lib/frct.c
+
+# Delta-t protocol timers (Watson bound: 3*MPL + A + R).
+# MPL is reported per IPCP (IPCP_*_MPL); A and R are FRCT-wide.
+set(DELTA_T_ACK 1000 CACHE STRING
+ "Maximum time to acknowledge a packet (ms)")
+set(DELTA_T_RTX 32000 CACHE STRING
+ "Maximum time to retransmit a packet (ms)")
+
+# FRCT configuration
+set(FRCT_REORDER_QUEUE_SIZE 128 CACHE STRING
+ "Size of the reordering queue, must be a power of 2")
+set(FRCT_START_WINDOW 128 CACHE STRING
+ "Start window, must be a power of 2")
+set(FRCT_LINUX_RTT_ESTIMATOR TRUE CACHE BOOL
+ "Use Linux RTT estimator formula instead of the TCP RFC formula")
+set(FRCT_RTO_MDEV_MULTIPLIER 2 CACHE STRING
+ "Multiplier for deviation term in the RTO: RTO = sRTT + (mdev << X)")
+set(FRCT_RTO_INC_FACTOR 0 CACHE STRING
+ "Divisor for RTO increase after timeout: RTO += RTX >> X, 0: Karn/Partridge")
+set(FRCT_RTO_MIN 250 CACHE STRING
+ "Hard floor for Retransmission Timeout (RTO) for FRCT (us)")
+set(FRCT_TICK_TIME 5000 CACHE STRING
+ "Tick time for FRCT activity (retransmission, acknowledgments) (us)")
+set(FRCT_DEBUG_STDOUT FALSE CACHE BOOL
+ "Print FRCT final counters to stdout at flow teardown")
+
+# Retransmission (RXM) configuration
+set(RXM_MIN_RESOLUTION 20 CACHE STRING
+ "Minimum retransmission delay (ns), as a power to 2")
+set(RXM_WHEEL_MULTIPLIER 4 CACHE STRING
+ "Factor for retransmission wheel levels as a power to 2")
+set(RXM_WHEEL_LEVELS 3 CACHE STRING
+ "Number of levels in the retransmission wheel")
+set(RXM_WHEEL_SLOTS_PER_LEVEL 256 CACHE STRING
+ "Number of slots per level in the retransmission wheel, must be a power of 2")
+
+# Acknowledgment wheel configuration
+set(ACK_WHEEL_SLOTS 256 CACHE STRING
+ "Number of slots in the acknowledgment wheel, must be a power of 2")
+set(ACK_WHEEL_RESOLUTION 18 CACHE STRING
+ "Minimum acknowledgment delay (ns), as a power to 2")
diff --git a/cmake/config/lib/poa.cmake b/cmake/config/lib/poa.cmake
new file mode 100644
index 00000000..c1ca10a8
--- /dev/null
+++ b/cmake/config/lib/poa.cmake
@@ -0,0 +1,37 @@
+# Flow Point of attachment (poa) configuration for Ouroboros
+
+set(POA_MGMT_FRAME_SIZE 16384 CACHE STRING
+ "Maximum size of a flow endpoint management frame, in bytes")
+
+# Management frames are retried or repeated, so a send never waits long.
+set(POA_MGMT_SND_TIMEO 100 CACHE STRING
+ "Deadline for sending a management frame, in ms")
+
+# Flows on one PoA share its transmit queue, so congestion avoidance keys its link estimator on the
+# PoA and needs a bound on their number.
+set(POA_MAX_POAS 16 CACHE STRING
+ "Maximum number of points of attachment per IPCP")
+
+# UDP endpoints
+set(POA_UDP_MPL 5000 CACHE STRING
+ "Default maximum packet lifetime for UDP flow endpoints, in ms")
+set(POA_UDP4_MTU 1472 CACHE STRING
+ "Fallback UDP4 endpoint MTU when getsockopt(IP_MTU) is unavailable")
+set(POA_UDP6_MTU 1452 CACHE STRING
+ "Fallback UDP6 endpoint MTU when getsockopt(IPV6_MTU) is unavailable")
+set(POA_UDP_RD_BUF 65535 CACHE STRING
+ "UDP endpoint receive buffer in bytes. Bounds the advertised MTU")
+
+# Ethernet endpoints
+set(POA_ETH_MPL 100 CACHE STRING
+ "Default maximum packet lifetime for Ethernet flow endpoints, in ms")
+set(POA_ETH_QDISC_BYPASS false CACHE BOOL
+ "Bypass the Qdisc in the kernel when using raw sockets")
+set(POA_ETH_SNDBUF 0 CACHE STRING
+ "Raw socket SO_SNDBUF in bytes (floored to one frame). 0 = kernel default")
+set(POA_ETH_RCVBUF 0 CACHE STRING
+ "Raw socket SO_RCVBUF in bytes. 0 = kernel default")
+set(POA_ETH_LO_MTU 9000 CACHE STRING
+ "Restrict Ethernet flow endpoint MTU over loopback interfaces")
+set(POA_ETH_RD_BUF 16384 CACHE STRING
+ "Cap on the Ethernet endpoint receive buffer and MTU, in bytes")
diff --git a/cmake/config/ssm.cmake b/cmake/config/lib/ssm.cmake
index c1f34655..aa9c4f75 100644
--- a/cmake/config/ssm.cmake
+++ b/cmake/config/lib/ssm.cmake
@@ -1,6 +1,5 @@
-# Secure Shared Memory (SSM) pool configuration for Ouroboros
-# This file defines the allocation parameters for the secure shared memory
-# pool allocator
+# Secure Shared Memory (SSM) pool configuration for Ouroboros This file defines the allocation
+# parameters for the secure shared memory pool allocator
# Shared memory pool naming configuration
set(SSM_PREFIX "ouroboros" CACHE STRING
@@ -15,14 +14,18 @@ set(SSM_PUP_NAME_FMT "/${SSM_PREFIX}.pup.%d" CACHE INTERNAL
# Packet buffer configuration
set(SSM_POOL_NAME "/${SHM_PREFIX}.pool" CACHE INTERNAL
"Name for the main POSIX shared memory pool")
-set(SSM_POOL_BLOCKS 16384 CACHE STRING
- "Number of blocks in SSM packet pool, must be a power of 2")
set(SSM_PK_BUFF_HEADSPACE 256 CACHE STRING
"Bytes of headspace to reserve for future headers")
set(SSM_PK_BUFF_TAILSPACE 32 CACHE STRING
"Bytes of tailspace to reserve for future tails")
set(SSM_RBUFF_SIZE 1024 CACHE STRING
- "Number of blocks in rbuff buffer, must be a power of 2")
+ "Number of slots in a flow's rbuff ring; must be a power of 2")
+set(SSM_RBUFF_TXQ_DELAY 10 CACHE STRING
+ "Queueing delay a flow's tx ring may hold (ms); 0 is unlimited")
+set(SSM_RBUFF_TXQ_PRIO_MUL 2 CACHE STRING
+ "Retransmissions get this multiple of the tx occupancy limit")
+set(SSM_RBUFF_TXQ_PRIO_DIV 16 CACHE STRING
+ "Ring fraction (1/N) new data leaves to retransmissions")
set(SSM_RBUFF_PREFIX "/${SHM_PREFIX}.rbuff." CACHE INTERNAL
"Prefix for rbuff POSIX shared memory filenames")
set(SSM_FLOW_SET_PREFIX "/${SHM_PREFIX}.set." CACHE INTERNAL
@@ -31,12 +34,14 @@ set(SSM_FLOW_SET_PREFIX "/${SHM_PREFIX}.set." CACHE INTERNAL
# Number of shards per size class for reducing contention
set(SSM_POOL_SHARDS 4 CACHE STRING
"Number of allocator shards per size class")
+set(SSM_POOL_RECLAIM_AGE_S 60 CACHE STRING
+ "Minimum age in seconds before a block is presumed stale and reclaimed")
-# Global Shared Packet Pool (GSPP) - for privileged processes
-# Shared by all processes in 'ouroboros' group (~60 MB total)
+# Global Shared Packet Pool (GSPP) - for privileged processes Shared by all processes in 'ouroboros'
+# group (~60 MB total)
set(SSM_GSPP_256_BLOCKS 1024 CACHE STRING
"GSPP: Number of 256B blocks")
-set(SSM_GSPP_512_BLOCKS 768 CACHE STRING
+set(SSM_GSPP_512_BLOCKS 2048 CACHE STRING
"GSPP: Number of 512B blocks")
set(SSM_GSPP_1K_BLOCKS 512 CACHE STRING
"GSPP: Number of 1KB blocks")
@@ -53,15 +58,15 @@ set(SSM_GSPP_256K_BLOCKS 32 CACHE STRING
set(SSM_GSPP_1M_BLOCKS 16 CACHE STRING
"GSPP: Number of 1MB blocks")
-# Per-User Pool (PUP) - for unprivileged applications
-# Each unprivileged app gets its own smaller pool (~7.5 MB total)
-set(SSM_PUP_256_BLOCKS 128 CACHE STRING
+# Per-User Pool (PUP) - for unprivileged applications Each unprivileged app gets its own smaller
+# pool (~7.5 MB total)
+set(SSM_PUP_256_BLOCKS 512 CACHE STRING
"PUP: Number of 256B blocks")
-set(SSM_PUP_512_BLOCKS 96 CACHE STRING
+set(SSM_PUP_512_BLOCKS 512 CACHE STRING
"PUP: Number of 512B blocks")
-set(SSM_PUP_1K_BLOCKS 64 CACHE STRING
+set(SSM_PUP_1K_BLOCKS 512 CACHE STRING
"PUP: Number of 1KB blocks")
-set(SSM_PUP_2K_BLOCKS 48 CACHE STRING
+set(SSM_PUP_2K_BLOCKS 512 CACHE STRING
"PUP: Number of 2KB blocks")
set(SSM_PUP_4K_BLOCKS 32 CACHE STRING
"PUP: Number of 4KB blocks")
@@ -74,6 +79,23 @@ set(SSM_PUP_256K_BLOCKS 2 CACHE STRING
set(SSM_PUP_1M_BLOCKS 0 CACHE STRING
"PUP: Number of 1MB blocks")
+# Zero classes too small for spb header + HEADSPACE + TAILSPACE + 1 B.
+math(EXPR _SSM_MIN_USEFUL_CLASS
+ "32 + ${SSM_PK_BUFF_HEADSPACE} + ${SSM_PK_BUFF_TAILSPACE}")
+foreach(_pair "256:256" "512:512" "1K:1024" "2K:2048")
+ string(REPLACE ":" ";" _p "${_pair}")
+ list(GET _p 0 _suffix)
+ list(GET _p 1 _size)
+ if(_size LESS _SSM_MIN_USEFUL_CLASS)
+ set(SSM_GSPP_${_suffix}_BLOCKS 0)
+ set(SSM_PUP_${_suffix}_BLOCKS 0)
+ endif()
+endforeach()
+unset(_SSM_MIN_USEFUL_CLASS)
+unset(_p)
+unset(_suffix)
+unset(_size)
+
# SSM pool size calculations
include(utils/HumanReadable)
@@ -129,3 +151,62 @@ message(STATUS " Blocks: ${SSM_PUP_256_BLOCKS}, ${SSM_PUP_512_BLOCKS}, "
"${SSM_PUP_1K_BLOCKS}, ${SSM_PUP_2K_BLOCKS}, ${SSM_PUP_4K_BLOCKS}, "
"${SSM_PUP_16K_BLOCKS}, ${SSM_PUP_64K_BLOCKS}, ${SSM_PUP_256K_BLOCKS}, "
"${SSM_PUP_1M_BLOCKS}")
+
+math(EXPR SSM_RBUFF_TXQ_RESERVE
+ "${SSM_RBUFF_SIZE} / ${SSM_RBUFF_TXQ_PRIO_DIV}")
+
+set(SSM_RBUFF_TXQ_RESERVE ${SSM_RBUFF_TXQ_RESERVE} CACHE INTERNAL
+ "Top-of-ring slots new data may not use")
+
+math(EXPR SSM_RBUFF_TXQ_DATA_MAX
+ "${SSM_RBUFF_SIZE} - 1 - ${SSM_RBUFF_TXQ_RESERVE}")
+
+# The limiter asserts its target fits SSM_RBUFF_TXQ_MAX_DELAY (1 s).
+if(SSM_RBUFF_TXQ_DELAY LESS 0 OR SSM_RBUFF_TXQ_DELAY GREATER 1000)
+ message(FATAL_ERROR
+ "SSM_RBUFF_TXQ_DELAY (${SSM_RBUFF_TXQ_DELAY}) must be in "
+ "[0, 1000] ms; a longer target trips the limiter's own bound.")
+endif()
+
+# What the reserve leaves new data must still clear the 4-slot floor.
+if(SSM_RBUFF_TXQ_DATA_MAX LESS 4)
+ message(FATAL_ERROR
+ "SSM_RBUFF_TXQ_PRIO_DIV (${SSM_RBUFF_TXQ_PRIO_DIV}) leaves new "
+ "data ${SSM_RBUFF_TXQ_DATA_MAX} of ${SSM_RBUFF_SIZE} slots, "
+ "below the 4-slot floor: every write would be refused.")
+endif()
+
+# Both bounds keep the retransmission headroom above zero: the divisor
+# reserves it at saturation, the multiplier below it.
+if(SSM_RBUFF_TXQ_PRIO_DIV LESS 2 OR SSM_RBUFF_TXQ_RESERVE LESS 1)
+ message(FATAL_ERROR
+ "SSM_RBUFF_TXQ_PRIO_DIV (${SSM_RBUFF_TXQ_PRIO_DIV}) must be in "
+ "[2, SSM_RBUFF_SIZE (${SSM_RBUFF_SIZE})]: it reserves "
+ "${SSM_RBUFF_TXQ_RESERVE} of ${SSM_RBUFF_SIZE} slots for "
+ "retransmissions.")
+endif()
+
+if(SSM_RBUFF_TXQ_PRIO_MUL LESS 2)
+ message(FATAL_ERROR
+ "SSM_RBUFF_TXQ_PRIO_MUL (${SSM_RBUFF_TXQ_PRIO_MUL}) must be >= 2: "
+ "at 1 a retransmission gets the ceiling new data already has.")
+endif()
+
+# FRCT reorder queue must fit in every enabled size class. If RQ_SIZE >= any backing pool, the
+# receiver advertises a window the pool cannot back; np1_flow_write fails under load and a single
+# dropped fragment wedges the flow. Auto-zeroed classes are skipped.
+foreach(_class 256 512 1K 2K)
+ if(SSM_PUP_${_class}_BLOCKS GREATER 0
+ AND NOT FRCT_REORDER_QUEUE_SIZE LESS SSM_PUP_${_class}_BLOCKS)
+ message(FATAL_ERROR
+ "FRCT_REORDER_QUEUE_SIZE (${FRCT_REORDER_QUEUE_SIZE}) must be "
+ "< SSM_PUP_${_class}_BLOCKS (${SSM_PUP_${_class}_BLOCKS}): "
+ "the FC window cannot exceed the pool that backs OOO stashing.")
+ endif()
+ if(SSM_GSPP_${_class}_BLOCKS GREATER 0
+ AND NOT FRCT_REORDER_QUEUE_SIZE LESS SSM_GSPP_${_class}_BLOCKS)
+ message(FATAL_ERROR
+ "FRCT_REORDER_QUEUE_SIZE (${FRCT_REORDER_QUEUE_SIZE}) must be "
+ "< SSM_GSPP_${_class}_BLOCKS (${SSM_GSPP_${_class}_BLOCKS}).")
+ endif()
+endforeach()
diff --git a/cmake/config/tests.cmake b/cmake/config/tests.cmake
index 37c06ca9..c0d0ed84 100644
--- a/cmake/config/tests.cmake
+++ b/cmake/config/tests.cmake
@@ -15,3 +15,9 @@ if(DISABLE_TESTS_CORE_DUMPS)
else()
message(STATUS "Core dumps in tests enabled")
endif()
+
+set(MB_ECN_LAB_FULL FALSE CACHE BOOL
+ "Run the full mb-ecn lab rate sweep, up to 10 Gb/s")
+if(MB_ECN_LAB_FULL)
+ message(STATUS "Full mb-ecn lab rate sweep enabled")
+endif()
diff --git a/cmake/dependencies.cmake b/cmake/dependencies.cmake
index 109fe1d6..93c9c0de 100644
--- a/cmake/dependencies.cmake
+++ b/cmake/dependencies.cmake
@@ -7,6 +7,7 @@ include(dependencies/system/libraries)
include(dependencies/system/explicit_bzero)
include(dependencies/system/robustmutex)
include(dependencies/system/fuse)
+include(dependencies/system/liburcu)
include(dependencies/system/sysrandom)
# Cryptography
@@ -16,19 +17,19 @@ include(dependencies/crypt/libgcrypt)
# IRMd
include(dependencies/irmd/libtoml)
-# Ethernet IPCP backends
+# Ethernet PoA backends. netmap is last: it overrides the others.
include(dependencies/eth/rawsockets)
include(dependencies/eth/bpf)
include(dependencies/eth/netmap)
+
+# The Ethernet PoA needs a backend to send and receive frames.
if(HAVE_RAW_SOCKETS OR HAVE_BPF OR HAVE_NETMAP)
- set(HAVE_ETH TRUE CACHE INTERNAL "Ethernet IPCP support available")
+ set(HAVE_ETH TRUE)
else()
- unset(HAVE_ETH CACHE)
+ message(STATUS "No Ethernet backend, Ethernet PoAs disabled")
+ unset(HAVE_ETH)
endif()
-# UDP IPCP
-include(dependencies/udp/ddns)
-
# Coverage tools
include(dependencies/coverage/gcov)
include(dependencies/coverage/lcov)
diff --git a/cmake/dependencies/crypt/openssl.cmake b/cmake/dependencies/crypt/openssl.cmake
index 38eb826f..04451357 100644
--- a/cmake/dependencies/crypt/openssl.cmake
+++ b/cmake/dependencies/crypt/openssl.cmake
@@ -25,49 +25,39 @@ message(STATUS "OpenSSL support enabled, found version ${OPENSSL_VERSION}")
set(HAVE_OPENSSL TRUE CACHE INTERNAL
"OpenSSL cryptography support available")
-if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.4.0")
- set(DISABLE_ML_KEM FALSE CACHE BOOL
- "Disable ML-KEM support")
- set(DISABLE_ML_DSA FALSE CACHE BOOL
- "Disable ML-DSA support")
- if(NOT DISABLE_ML_KEM)
- set(HAVE_OPENSSL_ML_KEM TRUE CACHE INTERNAL
- "OpenSSL ML-KEM available")
- message(STATUS "OpenSSL ML-KEM support enabled")
- else()
- message(STATUS "OpenSSL ML-KEM support disabled")
- unset(HAVE_OPENSSL_ML_KEM CACHE)
- endif()
- if(NOT DISABLE_ML_DSA)
- set(HAVE_OPENSSL_ML_DSA TRUE CACHE INTERNAL
- "OpenSSL ML-DSA available")
- message(STATUS "OpenSSL ML-DSA support enabled")
- else()
- message(STATUS "OpenSSL ML-DSA support disabled")
- unset(HAVE_OPENSSL_ML_DSA CACHE)
- endif()
-else()
- message(STATUS
- "Install OpenSSL >= 3.4.0 for ML-KEM/ML-DSA")
- unset(HAVE_OPENSSL_ML_KEM CACHE)
- unset(HAVE_OPENSSL_ML_DSA CACHE)
-endif()
-
if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.5.0")
- set(DISABLE_SLH_DSA FALSE CACHE BOOL
+ set(DISABLE_ML FALSE CACHE BOOL
+ "Disable ML-KEM/ML-DSA support")
+ set(DISABLE_SLH FALSE CACHE BOOL
"Disable SLH-DSA support")
- if(NOT DISABLE_SLH_DSA)
- set(HAVE_OPENSSL_SLH_DSA TRUE CACHE INTERNAL
+ if(NOT DISABLE_ML)
+ set(HAVE_ML TRUE CACHE INTERNAL
+ "OpenSSL ML-KEM/ML-DSA available")
+ message(STATUS "OpenSSL ML-KEM/ML-DSA support enabled")
+ else()
+ message(STATUS "OpenSSL ML-KEM/ML-DSA support disabled")
+ unset(HAVE_ML CACHE)
+ endif()
+ if(NOT DISABLE_SLH)
+ set(HAVE_SLH TRUE CACHE INTERNAL
"OpenSSL SLH-DSA available")
message(STATUS "OpenSSL SLH-DSA support enabled")
else()
message(STATUS "OpenSSL SLH-DSA support disabled")
- unset(HAVE_OPENSSL_SLH_DSA CACHE)
+ unset(HAVE_SLH CACHE)
endif()
else()
message(STATUS
- "Install OpenSSL >= 3.5.0 for SLH-DSA")
- unset(HAVE_OPENSSL_SLH_DSA CACHE)
+ "Install OpenSSL >= 3.5.0 for PQC (ML-KEM/ML-DSA/SLH-DSA)")
+ unset(HAVE_ML CACHE)
+ unset(HAVE_SLH CACHE)
+endif()
+
+if(OPENSSL_VERSION VERSION_GREATER_EQUAL "4.1.0")
+ set(HAVE_OPENSSL_4_1 TRUE CACHE INTERNAL
+ "OpenSSL 4.1 or later")
+else()
+ unset(HAVE_OPENSSL_4_1 CACHE)
endif()
# Secure memory options are in cmake/config/global.cmake
diff --git a/cmake/dependencies/eth/netmap.cmake b/cmake/dependencies/eth/netmap.cmake
index 94ecd634..b31c4d03 100644
--- a/cmake/dependencies/eth/netmap.cmake
+++ b/cmake/dependencies/eth/netmap.cmake
@@ -1,18 +1,22 @@
-# netmap support (optional acceleration)
+# netmap support (kernel bypass). Explicit opt-in.
find_path(NETMAP_C_INCLUDE_DIR
net/netmap_user.h
HINTS /usr/include /usr/local/include)
mark_as_advanced(NETMAP_C_INCLUDE_DIR)
-if(NOT HAVE_RAW_SOCKETS AND NOT HAVE_BPF AND NETMAP_C_INCLUDE_DIR)
- set(DISABLE_NETMAP FALSE CACHE BOOL
- "Disable netmap support for ETH IPCPs")
- if(NOT DISABLE_NETMAP)
- message(STATUS "Netmap support for Ethernet IPCPs enabled")
- set(HAVE_NETMAP TRUE)
- else()
- message(STATUS "Netmap support for Ethernet IPCPs disabled by user")
- unset(HAVE_NETMAP)
+set(ENABLE_NETMAP FALSE CACHE BOOL
+ "Use netmap for Ethernet PoAs, overriding raw sockets or BPF")
+
+if(ENABLE_NETMAP)
+ if(NOT NETMAP_C_INCLUDE_DIR)
+ message(FATAL_ERROR "ENABLE_NETMAP is set, but netmap was not found.")
endif()
+
+ message(STATUS "Netmap support for Ethernet PoAs enabled")
+
+ set(HAVE_NETMAP TRUE)
+
+ unset(HAVE_RAW_SOCKETS)
+ unset(HAVE_BPF)
endif()
diff --git a/cmake/dependencies/system/liburcu.cmake b/cmake/dependencies/system/liburcu.cmake
new file mode 100644
index 00000000..89a7ab12
--- /dev/null
+++ b/cmake/dependencies/system/liburcu.cmake
@@ -0,0 +1,45 @@
+# Userspace RCU (liburcu) - optional. Enables lock-free data-plane key
+# rotation; absent => per-flow rwlock fallback. The "bulletproof" flavour
+# (urcu-bp) auto-registers reader threads, so application threads need no
+# RCU lifecycle plumbing.
+if(PkgConfig_FOUND)
+ pkg_check_modules(URCU_PKG QUIET IMPORTED_TARGET liburcu-bp)
+ if(URCU_PKG_FOUND AND NOT TARGET Urcu::Urcu)
+ add_library(Urcu::Urcu ALIAS PkgConfig::URCU_PKG)
+ endif()
+endif()
+
+if(NOT URCU_PKG_FOUND)
+ find_library(URCU_BP_LIBRARY urcu-bp QUIET)
+ find_library(URCU_COMMON_LIBRARY urcu-common QUIET)
+ find_path(URCU_INCLUDE_DIR urcu-bp.h QUIET)
+ if(URCU_BP_LIBRARY AND URCU_COMMON_LIBRARY AND URCU_INCLUDE_DIR)
+ set(URCU_PKG_FOUND TRUE)
+ if(NOT TARGET Urcu::Urcu)
+ add_library(Urcu::Urcu INTERFACE IMPORTED)
+ set_target_properties(Urcu::Urcu PROPERTIES
+ INTERFACE_LINK_LIBRARIES "${URCU_BP_LIBRARY};${URCU_COMMON_LIBRARY}"
+ INTERFACE_INCLUDE_DIRECTORIES "${URCU_INCLUDE_DIR}")
+ endif()
+ endif()
+endif()
+
+if(URCU_PKG_FOUND)
+ set(DISABLE_LIBURCU FALSE CACHE BOOL "Disable liburcu (RCU) support")
+ if(NOT DISABLE_LIBURCU)
+ if(URCU_PKG_VERSION)
+ message(STATUS "liburcu (RCU) support enabled (version ${URCU_PKG_VERSION})")
+ else()
+ message(STATUS "liburcu (RCU) support enabled")
+ endif()
+ set(HAVE_LIBURCU TRUE CACHE INTERNAL "Userspace RCU (liburcu) available")
+ else()
+ message(STATUS "liburcu (RCU) support disabled by user")
+ unset(HAVE_LIBURCU CACHE)
+ endif()
+else()
+ message(STATUS "Install liburcu (urcu-bp) for lock-free data-plane re-keying")
+ unset(HAVE_LIBURCU CACHE)
+endif()
+
+mark_as_advanced(URCU_BP_LIBRARY URCU_COMMON_LIBRARY URCU_INCLUDE_DIR)
diff --git a/cmake/dependencies/udp/ddns.cmake b/cmake/dependencies/udp/ddns.cmake
deleted file mode 100644
index e8208e47..00000000
--- a/cmake/dependencies/udp/ddns.cmake
+++ /dev/null
@@ -1,31 +0,0 @@
-# DDNS (Dynamic DNS) support detection
-# Requires nsupdate and nslookup tools
-
-find_program(NSUPDATE_EXECUTABLE
- NAMES nsupdate
- DOC "The nsupdate tool that enables DDNS")
-
-find_program(NSLOOKUP_EXECUTABLE
- NAMES nslookup
- DOC "The nslookup tool that resolves DNS names")
-
-mark_as_advanced(NSLOOKUP_EXECUTABLE NSUPDATE_EXECUTABLE)
-
-if(NSLOOKUP_EXECUTABLE AND NSUPDATE_EXECUTABLE)
- set(DISABLE_DDNS FALSE CACHE BOOL "Disable DDNS support")
- if(NOT DISABLE_DDNS)
- message(STATUS "DDNS support enabled")
- set(HAVE_DDNS TRUE CACHE INTERNAL "Dynamic DNS support available")
- else()
- message(STATUS "DDNS support disabled by user")
- unset(HAVE_DDNS CACHE)
- endif()
-else()
- if(NSLOOKUP_EXECUTABLE)
- message(STATUS "Install nsupdate to enable DDNS support")
- elseif(NSUPDATE_EXECUTABLE)
- message(STATUS "Install nslookup to enable DDNS support")
- else()
- message(STATUS "Install nslookup and nsupdate to enable DDNS support")
- endif()
-endif()
diff --git a/cmake/tags.cmake b/cmake/tags.cmake
new file mode 100644
index 00000000..00e6f0d6
--- /dev/null
+++ b/cmake/tags.cmake
@@ -0,0 +1,21 @@
+find_program(CTAGS_EXECUTABLE
+ NAMES ctags-universal universal-ctags ctags
+ DOC "Generate a ctags index for source navigation: make tags")
+mark_as_advanced(CTAGS_EXECUTABLE)
+
+if(CTAGS_EXECUTABLE)
+ add_custom_target(tags
+ COMMAND ${CTAGS_EXECUTABLE}
+ -R
+ --languages=C
+ --c-kinds=+p
+ --fields=+S
+ --exclude=build
+ --exclude=build-claude
+ --exclude=build_tmp
+ --exclude=.git
+ -f ${CMAKE_SOURCE_DIR}/tags
+ ${CMAKE_SOURCE_DIR}
+ WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+ COMMENT "Generating ctags index at ${CMAKE_SOURCE_DIR}/tags")
+endif()
diff --git a/cmake/utils/CPUUtils.cmake b/cmake/utils/CPUUtils.cmake
new file mode 100644
index 00000000..8ca7683a
--- /dev/null
+++ b/cmake/utils/CPUUtils.cmake
@@ -0,0 +1,82 @@
+include(CheckCSourceRuns)
+
+# Compile + run a probe so we only enable a feature the host CPU
+# actually implements (toolchains accept flags the silicon may lack).
+# Cross-compile without an emulator: feature off.
+function(detect_cpu_feature _result_var _flags _source)
+ set(_save_flags "${CMAKE_REQUIRED_FLAGS}")
+ set(_save_quiet "${CMAKE_REQUIRED_QUIET}")
+ set(CMAKE_REQUIRED_FLAGS "${_save_flags} ${_flags}")
+ set(CMAKE_REQUIRED_QUIET TRUE)
+ if(CMAKE_CROSSCOMPILING AND NOT CMAKE_CROSSCOMPILING_EMULATOR)
+ set(${_result_var} FALSE CACHE INTERNAL
+ "${_result_var} (cross-compile without emulator: off)")
+ else()
+ check_c_source_runs("${_source}" ${_result_var})
+ endif()
+ set(CMAKE_REQUIRED_FLAGS "${_save_flags}")
+ set(CMAKE_REQUIRED_QUIET "${_save_quiet}")
+endfunction()
+
+# x86 PCLMULQDQ + SSE4.1. argc-derived input defeats constant folding;
+# SIGILL handler exits cleanly so the kernel skips the core dump.
+function(detect_pclmul)
+ detect_cpu_feature(_HAVE_PCLMUL "-mpclmul"
+"#include <wmmintrin.h>
+#include <signal.h>
+#include <unistd.h>
+static void on_sigill(int sig) { (void) sig; _exit(1); }
+int main(int argc, char ** argv) {
+ __m128i a;
+ __m128i b;
+ (void) argv;
+ signal(SIGILL, on_sigill);
+ a = _mm_set1_epi32(argc);
+ b = _mm_clmulepi64_si128(a, a, 0);
+ return _mm_cvtsi128_si32(b) & 0;
+}")
+ detect_cpu_feature(_HAVE_SSE41 "-msse4.1"
+"#include <smmintrin.h>
+#include <signal.h>
+#include <unistd.h>
+static void on_sigill(int sig) { (void) sig; _exit(1); }
+int main(int argc, char ** argv) {
+ __m128i a;
+ (void) argv;
+ signal(SIGILL, on_sigill);
+ a = _mm_set1_epi32(argc);
+ return _mm_extract_epi32(a, 0) & 0;
+}")
+ if(_HAVE_PCLMUL AND _HAVE_SSE41)
+ set(HAVE_PCLMUL TRUE CACHE INTERNAL
+ "x86 PCLMUL + SSE4.1 intrinsics available")
+ else()
+ unset(HAVE_PCLMUL CACHE)
+ endif()
+endfunction()
+
+# aarch64 FEAT_PMULL (vmull_p64). Pi 4's BCM2711 accepts +crypto at
+# compile time but lacks the hardware — the runtime probe catches that.
+function(detect_pmull)
+ detect_cpu_feature(_HAVE_PMULL "-march=armv8-a+crypto"
+"#include <arm_neon.h>
+#include <signal.h>
+#include <stdint.h>
+#include <unistd.h>
+static void on_sigill(int sig) { (void) sig; _exit(1); }
+int main(int argc, char ** argv) {
+ poly64_t a;
+ poly128_t c;
+ (void) argv;
+ signal(SIGILL, on_sigill);
+ a = (poly64_t) (uint64_t) argc;
+ c = vmull_p64(a, a);
+ return (int) (vgetq_lane_u64((uint64x2_t) c, 0) & 0);
+}")
+ if(_HAVE_PMULL)
+ set(HAVE_PMULL TRUE CACHE INTERNAL
+ "aarch64 PMULL intrinsics available")
+ else()
+ unset(HAVE_PMULL CACHE)
+ endif()
+endfunction()
generated by cgit v1.2.3 (git 2.46.0) at 2026-09-11 20:54:12 +0000