Re: [PATCH net-next v2] amt: make the per-tunnel group and source limits configurable

[Paolo Abeni]

On 10/16/26 01:18, Omar Ramadan wrote:
> A relay caps the state one gateway tunnel can hold at AMT_MAX_GROUP (32)
> group records and AMT_MAX_SOURCE (128) source records, counted across
> all of the tunnel's groups. Both are compile-time constants. An SSM
> receiver uses a source record for every (S,G) it joins, so a gateway that
> needs more than 32 groups or 128 channels through one tunnel has the
> excess joins dropped, and the relay operator cannot raise either limit.
>
> Add IFLA_AMT_MAX_GROUPS and IFLA_AMT_MAX_SOURCES, read when the link is
> created, like IFLA_AMT_MAX_TUNNELS. Zero or an absent attribute keeps the
> current defaults. Gateways drive these allocations, so the policy caps
> them at 1024 groups and 4096 sources per tunnel, and strict_start_type
> has it validate them, and any attribute added after them, strictly.
> Report both limits in amt_fill_info().
>
> Assisted-by: LLM
> Signed-off-by: Omar Ramadan <omar@xxxxxxxxxxxxx>
> ---
> v2:
> - No code change. Rebased on net-next 518bf436318e.
> - The amt_policy[] hunk now carries one line of context. In v1 that
>    context included the IFLA_AMT_DISCOVERY_IP entry, which patch 3 of
>    the pending net series [1] rewrites, so v1 did not apply to NIPA's
>    combined net + net-next branch. This version applies to net-next
>    with or without that series; with it, the result matches a 3-way
>    merge of the two.
> - v1: https://lore.kernel.org/netdev/20261014221334.2443184-1-omar@xxxxxxxxxxxxx/
>
> [1] https://lore.kernel.org/netdev/20261015220648.1545576-1-omar@xxxxxxxxxxxxx/
>
> Notes:
> - At the policy ceilings, with 256 source buckets per group, one tunnel
>    can hold up to 1024 * 4 KiB group records (176 bytes plus 2 KiB of
>    buckets, a kmalloc-4k object) and 4096 * 192 bytes of source records,
>    about 4.75 MiB. At the defaults it is about 152 KiB.
> - The IPv6 outer transport series ("amt: add an IPv6 outer transport",
>    posted 2026-10-09) also appends attributes after IFLA_AMT_MAX_TUNNELS
>    and sets strict_start_type at its first one. Whichever is applied
>    second will be renumbered after the other and drop its own
>    strict_start_type line.
> - Tested on net-next 518bf436318e, alone and with the net series [1]
>    applied, in an x86_64 KVM guest with the iproute2 companion patch,
>    which follows once this is applied. The defaults read back as 32 and
>    128, 1024 and 4096 round-trip in text and JSON output, zero keeps the
>    defaults, and 1025 or 4097 is rejected by the policy without creating
>    a device. An 8-byte IFLA_AMT_MAX_GROUPS is rejected as an invalid
>    attribute length, and the same request with 4 bytes creates the link.
>    tools/testing/selftests/net/amt.sh passes 6/6. W=1 builds with IPV6=y
>    and =n, sparse, and kernel-doc report nothing new.
>
>   drivers/net/amt.c        | 15 +++++++++++++--
>   include/net/amt.h        |  5 +++++
>   include/uapi/linux/amt.h |  8 ++++++++
>   3 files changed, 26 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/amt.c b/drivers/net/amt.c
> index 81d26ef82..30cff8de4 100644
> --- a/drivers/net/amt.c
> +++ b/drivers/net/amt.c
> @@ -3162,6 +3162,7 @@ static void amt_link_setup(struct net_device *dev)
>   }
>   
>   static const struct nla_policy amt_policy[IFLA_AMT_MAX + 1] = {
> +	[IFLA_AMT_UNSPEC]	= { .strict_start_type = IFLA_AMT_MAX_GROUPS },
>   	[IFLA_AMT_MODE]		= { .type = NLA_U32 },
>   	[IFLA_AMT_RELAY_PORT]	= { .type = NLA_U16 },
>   	[IFLA_AMT_GATEWAY_PORT]	= { .type = NLA_U16 },
> @@ -3172,2 +3173,4 @@ static const struct nla_policy amt_policy[IFLA_AMT_MAX + 1] = {
>   	[IFLA_AMT_MAX_TUNNELS]	= { .type = NLA_U32 },
> +	[IFLA_AMT_MAX_GROUPS]	= NLA_POLICY_MAX(NLA_U32, AMT_MAX_GROUP_LIMIT),
> +	[IFLA_AMT_MAX_SOURCES]	= NLA_POLICY_MAX(NLA_U32, AMT_MAX_SOURCE_LIMIT),
>   };
> @@ -3235,8 +3238,10 @@ static int amt_newlink(struct net_device *dev,
>   		amt->max_tunnels = AMT_MAX_TUNNELS;
>   
>   	spin_lock_init(&amt->lock);
> -	amt->max_groups = AMT_MAX_GROUP;
> -	amt->max_sources = AMT_MAX_SOURCE;
> +	amt->max_groups = nla_get_u32_default(data[IFLA_AMT_MAX_GROUPS], 0) ?:
> +			  AMT_MAX_GROUP;
> +	amt->max_sources = nla_get_u32_default(data[IFLA_AMT_MAX_SOURCES], 0) ?:
> +			   AMT_MAX_SOURCE;
>   	amt->hash_buckets = AMT_HSIZE;

Sashiko noted that with this setting is very easy to livelock the host.
At very least you should scale `hash_buckets` accordingly, possibly move some
processing out of the RX path.

/P