December 2025 - dev

[PATCH v2] tcp: Enable SO_KEEPALIVE if we see keep-alive segments from container / guest
by Stefano Brivio 06 Dec '25

06 Dec '25

This is an approximation, as enabling SO_KEEPALIVE doesn't mean that a keep-alive segment will be sent right away, rather that keep-alive segments will start being sent if the connection is idle. On the other hand, we don't have direct control over the host-side TCP, so this is probably the best approximation we can get. By default, namespaces inherit keep-alive parameters from their parent namespace, so we can assume that, in case of a container, we'll wait for the same interval it took for the container to start sending us keep-alives, effectively doubling that interval. To keep this simple, set SO_KEEPALIVE whenever we see a keep-alive segment, instead of tracking its state. Keep-alive segments are relatively infrequent, so we don't expect any substantial cost from doing that. Reported-by: Dominic Kohls <Dominic.Wenzler(a)rewe-group.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: Coverity Scan just reminded me that we shouldn't ignore setsockopt() return codes. It doesn't really matter if this fails as we can't do much else in that case, but a trace-level message is a good idea anyway (not that I've ever seen this failing). tcp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tcp.c b/tcp.c index 8357c0e..d6a5337 100644 --- a/tcp.c +++ b/tcp.c @@ -1838,6 +1838,10 @@ static int tcp_data_from_tap(const struct ctx *c, struct tcp_tap_conn *conn, tcp_send_flag(c, conn, ACK); tcp_timer_ctl(c, conn); + if (setsockopt(conn->sock, SOL_SOCKET, SO_KEEPALIVE, + &((int){ 1 }), sizeof(int))) + flow_trace(conn, "failed to set SO_KEEPALIVE"); + if (p->count == 1) { tcp_tap_window_update(c, conn, ntohs(th->window)); -- 2.43.0

2 1

[PATCH v3 0/5] Pad all inbound frames to 802.3 minimum size if needed
by Stefano Brivio 06 Dec '25

06 Dec '25

Patch 1/5 handles the easy non-batched case with a copy to a padded buffer (only if needed). Patches 2/5 and 3/5 clean coding style up before further changes. Patch 4/5 deals with TCP and UDP batched frames in non-vhost-user modes. Patch 5/5 is for batched frames in vhost-user mode instead. v3: * in 4/5, add calls to tap_hdr_update() from UDP and TCP code to actually update the frame length descriptors after padding * refactor 5/5 entirely based on David's feedback: assume that the first buffer supplied by the guest is at least 60 bytes long, and introduce a vu_pad() common function for both TCP and UDP. Don't recalculate l2len in it, as all the callers already do. v2: * in 1/5, calculate vnet_len *after* padding * in 5/5: - pass the right pointers to memset() - explicitly request at least ETH_ZLEN bytes from vu_collect() Stefano Brivio (5): tap: Pad non-batched frames to 802.3 minimum (60 bytes) if needed tcp: Fix coding style for comment to enum tcp_iov_parts udp: Fix coding style for comment to enum udp_iov_idx tcp, udp: Pad batched frames to 60 bytes (802.3 minimum) in non-vhost-user modes tcp, udp: Pad batched frames for vhost-user modes to 60 bytes (802.3 minimum) tap.c | 11 ++++++++++- tcp.c | 2 +- tcp_buf.c | 23 +++++++++++++++++++++++ tcp_internal.h | 4 +++- tcp_vu.c | 17 ++++++++++++----- udp.c | 43 +++++++++++++++++++++++++++++++++++-------- udp_vu.c | 8 ++++++-- util.c | 3 +++ util.h | 3 +++ vu_common.c | 14 ++++++++++++++ vu_common.h | 1 + 11 files changed, 111 insertions(+), 18 deletions(-) -- 2.43.0

1 5

[PATCH v2 0/5] Pad all inbound frames to 802.3 minimum size if needed
by Stefano Brivio 06 Dec '25

06 Dec '25

Patch 1/5 handles the easy non-batched case with a copy to a padded buffer (only if needed). Patches 2/5 and 3/5 clean coding style up before further changes. Patch 4/5 deals with TCP and UDP batched frames in non-vhost-user modes. Patch 5/5 is for batched frames in vhost-user mode instead. v2: * in 1/5, calculate vnet_len *after* padding * in 5/5: - pass the right pointers to memset() - explicitly request at least ETH_ZLEN bytes from vu_collect() Stefano Brivio (5): tap: Pad non-batched frames to 802.3 minimum (60 bytes) if needed tcp: Fix coding style for comment to enum tcp_iov_parts udp: Fix coding style for comment to enum udp_iov_idx tcp, udp: Pad batched frames to 60 bytes (802.3 minimum) in non-vhost-user modes tcp, udp: Pad batched frames for vhost-user modes to 60 bytes (802.3 minimum) tap.c | 11 ++++++++++- tcp.c | 2 -- tcp_buf.c | 23 +++++++++++++++++++++++ tcp_internal.h | 5 ++++- tcp_vu.c | 32 ++++++++++++++++++++++++++++---- udp.c | 31 ++++++++++++++++++++++++++----- udp_vu.c | 13 ++++++++++++- util.c | 3 +++ util.h | 3 +++ 9 files changed, 109 insertions(+), 14 deletions(-) -- 2.43.0

2 10

PASST/PASST Dynamic Networking Features
by Jon Maloy 05 Dec '25

05 Dec '25

Hi all, Before going further with the implementation, I spent some time to understand the contents and implications of the various bugs/texts we have in this area. I then tried, to the best of my ability, to compile them into user stories, which I think might be a good format for our users to evaluate this. https://pad.passt.top/p/NetlinkMonitor Please have a look and give feedback! ///jon

1 0

[PATCH] conf: Separate local mode for each IP version, don't enable disabled IP version
by Stefano Brivio 05 Dec '25

05 Dec '25

This fixes an issue and introduces a feature: - in local mode, we accidentally ignored the -4 / --ipv4-only and -6 / --ipv6-only command line options - if no template interface is available for a given IP version, instead of disabling that IP version, use local mode, separately, for it Link: https://bugs.passt.top/show_bug.cgi?id=129 Link: https://bugs.passt.top/show_bug.cgi?id=128 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 19 +++++++++++-------- passt.1 | 15 ++++++++------- 2 files changed, 19 insertions(+), 15 deletions(-) diff --git a/conf.c b/conf.c index 02a4b65..fdc19e8 100644 --- a/conf.c +++ b/conf.c @@ -1109,7 +1109,7 @@ static void conf_print(const struct ctx *c) info("Template interface: %s%s%s%s%s", c->ifi4 > 0 ? if_indextoname(c->ifi4, ifn) : "", c->ifi4 > 0 ? " (IPv4)" : "", - (c->ifi4 && c->ifi6) ? ", " : "", + (c->ifi4 > 0 && c->ifi6 > 0) ? ", " : "", c->ifi6 > 0 ? if_indextoname(c->ifi6, ifn) : "", c->ifi6 > 0 ? " (IPv6)" : ""); } @@ -2001,20 +2001,23 @@ void conf(struct ctx *c, int argc, char **argv) (*c->ip6.ifname_out && !c->ifi6)) die("External interface not usable"); + if (!c->ifi4 && !c->ifi6 && !*c->pasta_ifn) { + strncpy(c->pasta_ifn, pasta_default_ifn, + sizeof(c->pasta_ifn) - 1); + } - if (!c->ifi4 && !c->ifi6) { - info("No external interface as template, switch to local mode"); + if (!c->ifi4 && !v6_only) { + info("IPv4: no external interface as template, use local mode"); conf_ip4_local(&c->ip4); c->ifi4 = -1; + } + + if (!c->ifi6 && !v4_only) { + info("IPv6: no external interface as template, use local mode"); conf_ip6_local(&c->ip6); c->ifi6 = -1; - - if (!*c->pasta_ifn) { - strncpy(c->pasta_ifn, pasta_default_ifn, - sizeof(c->pasta_ifn) - 1); - } } if (c->ifi4 && !no_map_gw && diff --git a/passt.1 b/passt.1 index 0c17454..db0d662 100644 --- a/passt.1 +++ b/passt.1 @@ -166,8 +166,8 @@ By default, assigned IPv4 and IPv6 addresses are taken from the host interfaces with the first default route, if any, for the corresponding IP version. If no default routes are available and there is any interface with any route for a given IP version, the first of these interfaces will be chosen instead. If no -such interface exists, the link-local address 169.254.2.1 is assigned for IPv4, -and no additional address will be assigned for IPv6. +such interface exists for a given IP version, the link-local address 169.254.2.1 +is assigned for IPv4, and no additional address will be assigned for IPv6. .TP .BR \-n ", " \-\-netmask " " \fImask @@ -194,9 +194,9 @@ first default route, if any, for the corresponding IP version. If the default route is a multipath one, the gateway is the first nexthop router returned by the kernel which has the highest weight in the set of paths. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. If no such interface exists, the link-local -address 169.254.2.2 is used for IPv4, and the link-local address fe80::1 is used -for IPv6. +interface will be chosen instead. If no such interface exists for a given IP +version, the link-local address 169.254.2.2 is used for IPv4, and the link-local +address fe80::1 is used for IPv6. Note: these addresses are also used as source address for packets directed to the guest or to the target namespace having a loopback or local source address, @@ -1117,8 +1117,9 @@ throughput of TCP connections. .SS Local mode for disconnected setups If \fBpasst\fR and \fBpasta\fR fail to find a host interface with a configured -address, other than loopback addresses, they will, obviously, not attempt to -source addresses or routes from the host. +address for a given IP version, other than loopback addresses, they will, +obviously, not attempt to source addresses or routes from the host, for that +IP version. In this case, unless configured otherwise, they will assign the IPv4 link-local address 169.254.2.1 to the guest or target namespace, and no IPv6 address. The -- 2.43.0

3 5

[PATCH v3 0/6] vhost-user: Add multiqueue support
by Laurent Vivier 05 Dec '25

05 Dec '25

This series implements multiqueue support for vhost-user mode, allowing passt to utilize multiple queue pairs for improved network throughput when used with multi-CPU guest VMs. While this version uses a single thread for packet processing, it enables the guest kernel to distribute network traffic across multiple queues and vCPUs. The implementation advertises support for up to 16 queue pairs (32 virtqueues) by setting VIRTIO_NET_F_MQ and VHOST_USER_PROTOCOL_F_MQ feature flags. Packets are routed to the appropriate RX queue based on which TX queue they originated from, following the virtio specification's automatic receive steering requirements. This series adds: - Multiqueue capability advertisement (VIRTIO_NET_F_MQ and VHOST_USER_PROTOCOL_F_MQ features) - Per-queue-pair packet pools to support concurrent queue operations - Queue pair parameter throughout the network stack, propagated through all protocol handlers (TCP, UDP, ICMP, ARP, DHCP, DHCPv6, NDP) - Flow-aware queue routing that tracks the originating TX queue for each flow and routes return packets to the corresponding RX queue - Test coverage with VHOST_USER_MQ environment variable to validate multiqueue functionality across all protocols (TCP, UDP, ICMP) and services (DHCP, NDP) Current behavior: - TX queue selection is controlled by the guest kernel's networking stack - RX packets are routed to queues based on their associated flows, with the queue assignment updated on each packet from TX to maintain affinity - Host-initiated flows (e.g., from socket-side connections) currently default to queue pair 0 The changes are transparent to single-queue operation - passt/pasta modes and single-queue vhost-user configurations continue to work unchanged, always using queue pair 0. v3: - Removed --max-qpairs configuration option - multiqueue support is now always enabled up to 16 queue pairs without requiring explicit configuration - Replaced "tap: Add queue pair parameter throughout the packet processing path" with "tap: Convert packet pools to per-queue-pair arrays for multiqueue" - simplified implementation by converting global pools to arrays rather than passing pool parameters throughout - Changed qpair parameter type from int to unsigned int throughout the codebase - Simplified test infrastructure - queues parameter is always set on netdev, mq=true added to virtio-net only when VHOST_USER_MQ > 1 - Updated QEMU usage hints to always show multiqueue-capable command line v2: - New patch: "tap: Remove pool parameter from tap4_handler() and tap6_handler()" to clean up unused parameters before adding queue pair parameter - Changed to one packet pool per queue pair instead of shared pools across all queue pairs - Split "multiqueue: Add queue-aware flow management..." into two patches: - "tap: Add queue pair parameter throughout the packet processing path" - "flow: Add queue pair tracking to flow management" - Updated test infrastructure patch with refined implementation Laurent Vivier (6): tap: Remove pool parameter from tap4_handler() and tap6_handler() vhost-user: Enable multiqueue test: Add multiqueue support to vhost-user test infrastructure vhost-user: Add queue pair parameter throughout the network stack tap: Convert packet pools to per-queue-pair arrays for multiqueue flow: Add queue pair tracking to flow management arp.c | 15 +++-- arp.h | 6 +- dhcp.c | 5 +- dhcp.h | 2 +- dhcpv6.c | 12 ++-- dhcpv6.h | 2 +- flow.c | 33 +++++++++ flow.h | 17 +++++ fwd.c | 18 ++--- fwd.h | 5 +- icmp.c | 25 ++++--- icmp.h | 4 +- ndp.c | 35 ++++++---- ndp.h | 7 +- netlink.c | 2 +- tap.c | 177 ++++++++++++++++++++++++++++--------------------- tap.h | 20 +++--- tcp.c | 47 +++++++------ tcp.h | 7 +- tcp_vu.c | 8 ++- test/lib/setup | 21 +++--- test/run | 23 +++++++ udp.c | 47 +++++++------ udp.h | 6 +- udp_flow.c | 8 ++- udp_flow.h | 2 +- udp_internal.h | 4 +- udp_vu.c | 4 +- vhost_user.c | 10 +-- virtio.h | 2 +- vu_common.c | 15 +++-- vu_common.h | 3 +- 32 files changed, 374 insertions(+), 218 deletions(-) -- 2.51.1

2 7

[RFC PATCH 0/5] Pad all inbound frames to 802.3 minimum size if needed
by Stefano Brivio 05 Dec '25

05 Dec '25

Patch 1/5 handles the easy non-batched case with a copy to a padded buffer (only if needed). Patches 2/5 and 3/5 clean coding style up before further changes. Patch 4/5 deals with TCP and UDP batched frames in non-vhost-user modes. Patch 5/5 is for batched frames in vhost-user mode instead, and this is the part I'm the least confident about, in particular with regard to the size assumptions on vhost-user provided buffers. Stefano Brivio (5): tap: Pad non-batched frames to 802.3 minimum (60 bytes) if needed tcp: Fix coding style for comment to enum tcp_iov_parts udp: Fix coding style for comment to enum udp_iov_idx tcp, udp: Pad batched frames to 60 bytes (802.3 minimum) in non-vhost-user modes tcp, udp: Pad batched frames for vhost-user modes to 60 bytes (802.3 minimum) tap.c | 7 +++++++ tcp.c | 2 -- tcp_buf.c | 23 +++++++++++++++++++++++ tcp_internal.h | 5 ++++- tcp_vu.c | 27 +++++++++++++++++++++++++++ udp.c | 31 ++++++++++++++++++++++++++----- udp_vu.c | 11 ++++++++++- util.c | 3 +++ util.h | 3 +++ 9 files changed, 103 insertions(+), 9 deletions(-) -- 2.43.0

3 22

[PATCH] iov: Fix coding style of basic (non-IOV_TAIL) parts
by Stefano Brivio 05 Dec '25

05 Dec '25

I happened to touch these functions for a change that turned out to be unnecessary, but coding style and documentation could still benefit from some rephrasing and fixes. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- iov.c | 68 +++++++++++++++++++++++++---------------------------------- 1 file changed, 29 insertions(+), 39 deletions(-) diff --git a/iov.c b/iov.c index 8c74a59..d31464d 100644 --- a/iov.c +++ b/iov.c @@ -20,24 +20,21 @@ * Contributions after 2012-01-13 are licensed under the terms of the * GNU GPL, version 2 or (at your option) any later version. */ + #include <sys/socket.h> #include "util.h" #include "iov.h" - /** - * iov_skip_bytes() - Skip leading bytes of an IO vector - * @iov: IO vector + * iov_skip_bytes() - Find index and offset in iovec array given byte offset + * @iov: iovec array * @n: Number of entries in @iov - * @skip: Number of leading bytes of @iov to skip - * @offset: Offset of first unskipped byte in its @iov entry + * @skip: Byte offset: leading bytes of @iov to skip + * @offset: Offset within matching @iov entry, set on return, can be NULL * - * Return: index I of individual struct iovec which contains the byte at @skip - * bytes into the vector (as though all its buffers were contiguous). - * If @offset is non-NULL, update it to the offset of that byte within - * @iov[I] (guaranteed to be less than @iov[I].iov_len) If the whole - * vector has <= @skip bytes, return @n. + * Return: index of iovec array containing the @skip byte counted as if buffers + * were contiguous. If iovec has less than @skip bytes, return @n. */ size_t iov_skip_bytes(const struct iovec *iov, size_t n, size_t skip, size_t *offset) @@ -57,17 +54,14 @@ size_t iov_skip_bytes(const struct iovec *iov, size_t n, } /** - * iov_from_buf() - Copy data from a buffer to an I/O vector (struct iovec) - * efficiently. - * - * @iov: Pointer to the array of struct iovec describing the - * scatter/gather I/O vector. - * @iov_cnt: Number of elements in the iov array. - * @offset: Byte offset in the iov array where copying should start. - * @buf: Pointer to the source buffer containing the data to copy. - * @bytes: Total number of bytes to copy from buf to iov. + * iov_from_buf() - Copy from flat buffer to iovec array + * @iov: Destination iovec array + * @iov_cnt: Number of elements in the iovec array + * @offset: Destination offset in iovec array + * @buf: Source buffer + * @bytes: Bytes to copy * - * Return: the number of bytes successfully copied. + * Return: number of bytes copied */ size_t iov_from_buf(const struct iovec *iov, size_t iov_cnt, size_t offset, const void *buf, size_t bytes) @@ -78,12 +72,12 @@ size_t iov_from_buf(const struct iovec *iov, size_t iov_cnt, if (__builtin_constant_p(bytes) && iov_cnt && offset <= iov[0].iov_len && bytes <= iov[0].iov_len - offset) { memcpy((char *)iov[0].iov_base + offset, buf, bytes); + return bytes; } i = iov_skip_bytes(iov, iov_cnt, offset, &offset); - /* copying data */ for (copied = 0; copied < bytes && i < iov_cnt; i++) { size_t len = MIN(iov[i].iov_len - offset, bytes - copied); @@ -97,17 +91,14 @@ size_t iov_from_buf(const struct iovec *iov, size_t iov_cnt, } /** - * iov_to_buf() - Copy data from a scatter/gather I/O vector (struct iovec) to - * a buffer efficiently. - * - * @iov: Pointer to the array of struct iovec describing the scatter/gather - * I/O vector. - * @iov_cnt: Number of elements in the iov array. - * @offset: Offset within the first element of iov from where copying should start. - * @buf: Pointer to the destination buffer where data will be copied. - * @bytes: Total number of bytes to copy from iov to buf. + * iov_to_buf() - Copy from iovec to flat buffer + * @iov: Source iovec array + * @iov_cnt: Number of elements in iovec array + * @offset: Source offset in @iov, counted as if buffers were contiguous + * @buf: Destination buffer + * @bytes: Bytes to copy * - * Return: the number of bytes successfully copied. + * Return: number of bytes copied */ size_t iov_to_buf(const struct iovec *iov, size_t iov_cnt, size_t offset, void *buf, size_t bytes) @@ -118,15 +109,17 @@ size_t iov_to_buf(const struct iovec *iov, size_t iov_cnt, if (__builtin_constant_p(bytes) && iov_cnt && offset <= iov[0].iov_len && bytes <= iov[0].iov_len - offset) { memcpy(buf, (char *)iov[0].iov_base + offset, bytes); + return bytes; } i = iov_skip_bytes(iov, iov_cnt, offset, &offset); - /* copying data */ for (copied = 0; copied < bytes && i < iov_cnt; i++) { size_t len = MIN(iov[i].iov_len - offset, bytes - copied); + ASSERT(iov[i].iov_base); + memcpy((char *)buf + copied, (char *)iov[i].iov_base + offset, len); copied += len; @@ -137,14 +130,11 @@ size_t iov_to_buf(const struct iovec *iov, size_t iov_cnt, } /** - * iov_size() - Calculate the total size of a scatter/gather I/O vector - * (struct iovec). + * iov_size() - Calculate total data size of iovec + * @iov: Source iovec array + * @iov_cnt: Number of elements in iovec array * - * @iov: Pointer to the array of struct iovec describing the - * scatter/gather I/O vector. - * @iov_cnt: Number of elements in the iov array. - * - * Return: the total size in bytes. + * Return: total size in bytes */ size_t iov_size(const struct iovec *iov, size_t iov_cnt) { -- 2.43.0

2 1

[PATCH] vu_common: Clarify prototype of vu_collect()
by Stefano Brivio 05 Dec '25

05 Dec '25

The last argument of vu_collect() can't exceed @size, but this isn't documented and it wasn't obvious to me, to the point that I actually proposed a change to "fix" callers so that they wouldn't overrun input buffers. Rename @frame_size to @collected, and clarify that it can only be up to @size bytes. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- vu_common.c | 8 ++++---- vu_common.h | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/vu_common.c b/vu_common.c index b13b7c3..ce61fa6 100644 --- a/vu_common.c +++ b/vu_common.c @@ -76,13 +76,13 @@ void vu_init_elem(struct vu_virtq_element *elem, struct iovec *iov, int elem_cnt * in the in_sg array. * @max_elem: Number of virtqueue elements in the array * @size: Maximum size of the data in the frame - * @frame_size: The total size of the buffers (output) + * @collected: Collected buffer length, up to @size, set on return * * Return: number of elements used to contain the frame */ int vu_collect(const struct vu_dev *vdev, struct vu_virtq *vq, struct vu_virtq_element *elem, int max_elem, - size_t size, size_t *frame_size) + size_t size, size_t *collected) { size_t current_size = 0; int elem_cnt = 0; @@ -113,8 +113,8 @@ int vu_collect(const struct vu_dev *vdev, struct vu_virtq *vq, break; } - if (frame_size) - *frame_size = current_size; + if (collected) + *collected = current_size; return elem_cnt; } diff --git a/vu_common.h b/vu_common.h index f538f23..c0883b2 100644 --- a/vu_common.h +++ b/vu_common.h @@ -48,7 +48,7 @@ void vu_init_elem(struct vu_virtq_element *elem, struct iovec *iov, int elem_cnt); int vu_collect(const struct vu_dev *vdev, struct vu_virtq *vq, struct vu_virtq_element *elem, int max_elem, size_t size, - size_t *frame_size); + size_t *collected); void vu_set_vnethdr(const struct vu_dev *vdev, struct virtio_net_hdr_mrg_rxbuf *vnethdr, int num_buffers); -- 2.43.0

2 1

[PATCH] test: Expand tmux right status bar to fit pass/fail/skipped counter and time
by Stefano Brivio 05 Dec '25

05 Dec '25

I recently realised I couldn't see seconds elapsing in asciinema test recordings. That's because now that we display a SKIPPED counter, we need some extra room for characters, 64 in total: PASS: xxx | FAIL: xxx | SKIPPED: xxx | YYYY-MM-DDThh:mm:ss+00:00 Fixes: 4234ace84cdf ("test: Display count of skipped tests in status and summary") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/lib/term | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/lib/term b/test/lib/term index 79aa2b7..f596364 100755 --- a/test/lib/term +++ b/test/lib/term @@ -707,7 +707,7 @@ term() { tmux set window-status-current-style 'bg=colour1 fg=colour233 bold' tmux set status-right '#(TZ="UTC" date -Iseconds)' - tmux set status-right-length 50 + tmux set status-right-length 64 tmux set status-right-style 'bg=colour1 fg=colour233 bold' tmux set history-limit 500000 -- 2.43.0

2 1