net_tap: enable vnet header and TX/RX offloads

[jstarks]

Enable IFF_VNET_HDR on TAP device creation and translate between net_backend's protocol-specific TxMetadata/RxMetadata and the virtio net header's general csum_start/csum_offset representation.

linux_net_bindings:

• Add ioctl wrappers: TUNSETOFFLOAD, TUNSETVNETHDRSZ (write), TUNGETIFF, TUNGETVNETHDRSZ (read)
• Remove VirtioNetHdr and zerocopy dependency (moved to net_tap)

net_tap/tap:

• Split into open_tap() (opens /dev/net/tun, returns OwnedFd) and Tap::new(OwnedFd) (validates IFF_VNET_HDR via TUNGETIFF, sets vnet header size to 12-byte v1 format)
• Tap::set_offloads() method for TUNSETOFFLOAD
• Prepares for accepting pre-opened fds (e.g. Kata fd passing)

net_tap:

• VirtioNetHdr struct and constants in inline vnet_hdr module
• TapEndpoint::new(Tap) sets offloads (CSUM|TSO4|TSO6|TSO_ECN) and returns Result; advertises full TxOffloadSupport as a constant
• build_vnet_hdr (TxMetadata -> VirtioNetHdr) and parse_vnet_hdr (VirtioNetHdr -> RxMetadata) translation functions
• Software IPv4 header checksum for non-TSO packets when offload_ip_header_checksum is set (virtio net header has no mechanism for this; needed for netvsp/NDIS guests in bridged configurations)
• TX path uses writev with vnet header; RX path strips vnet header
• Resolver simplified to open_tap -> Tap::new -> TapEndpoint::new
• 9 new unit tests covering offload translation paths

[github-actions]

⚠️ Unsafe Code Detected

This PR modifies files containing unsafe Rust code. Extra scrutiny is required during review.

For more on why we check whole files, instead of just diffs, check out the Rustonomicon

[Copilot]

Pull request overview

Enables TAP IFF_VNET_HDR and configures TAP TX/RX offloads, adding translation between net_backend’s TxMetadata/RxMetadata and the Linux virtio-net TAP header format to support checksum/TSO behaviors.

Changes:

• Add new linux_net_bindings ioctl wrappers and restructure TAP creation/validation around OwnedFd.
• Add virtio-net header prepend/strip on TX/RX, advertise offload support, and implement IPv4 header checksum fixup for specific guest offload requests.
• Update resolver + unit tests (including a new TX-offloads test) and add zerocopy dependency for header parsing/serialization.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
vm/devices/net/net_tap/tests/tap_tests.rs	Switch tests to new TAP open/construct flow; add TX offload coverage.
vm/devices/net/net_tap/src/tap.rs	Split TAP open vs. validate/wrap; add vnet hdr size validation and offload ioctl.
vm/devices/net/net_tap/src/resolver.rs	Resolve TAP endpoints via open_tap + Tap::new + TapEndpoint::new.
vm/devices/net/net_tap/src/lib.rs	Implement vnet header handling + offload support + checksum fixup; update TX/RX paths.
vm/devices/net/net_tap/Cargo.toml	Add zerocopy dependency.
vm/devices/net/linux_net_bindings/src/lib.rs	Add ioctl wrappers for offloads and vnet header configuration/query.
Cargo.lock	Lockfile update for zerocopy dependency.

---

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Enables TAP IFF_VNET_HDR support in net_tap and adds translation between net_backend TX/RX offload metadata and the Linux virtio-net header format, so the TAP backend can pass checksum/GSO intent via the vnet header.

Changes:

• Add new linux_net_bindings ioctl wrappers for TAP/TUN offload + vnet header configuration/query.
• Refactor TAP creation/validation (open_tap + Tap::new(OwnedFd)) and update resolver/tests to use the new flow.
• Implement vnet header build/parse logic, switch TX to writev (hdr + packet), and strip vnet header on RX; add unit + integration tests.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
vm/devices/net/net_tap/tests/tap_tests.rs	Update TAP integration tests to the new open/validate/endpoint construction flow; add offload TX test.
vm/devices/net/net_tap/src/tap.rs	Split TAP open vs. validate/configure; add vnet header size validation and offload ioctl setter; add vectored write support.
vm/devices/net/net_tap/src/resolver.rs	Update resource resolver to open + validate TAP fd before constructing the endpoint.
vm/devices/net/net_tap/src/lib.rs	Add virtio-net header definitions + translation, implement TX/RX vnet header handling, and advertise TX offload support.
vm/devices/net/net_tap/Cargo.toml	Add dependencies needed for vnet header bitfields and zerocopy serialization.
vm/devices/net/linux_net_bindings/src/lib.rs	Add new TAP/TUN ioctl wrappers for offload and vnet header sizing/queries.
Cargo.lock	Lockfile updates for newly-added crate dependencies.

---

You can also share your feedback on Copilot code review. Take the survey.