- dev - passt

[PATCH] tcp: Suppress false positive cppcheck warning in tcp_update_seqack_wnd()
by Laurent Vivier 09 Dec '25

09 Dec '25

Cppcheck doesn't track that tinfo is reassigned to &tinfo_new when NULL, leading to a false uninitvar warning at line 1099. Add inline suppression. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tcp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tcp.c b/tcp.c index 17fda5dcd7db..8dabfd3042d2 100644 --- a/tcp.c +++ b/tcp.c @@ -1132,6 +1132,7 @@ int tcp_update_seqack_wnd(const struct ctx *c, struct tcp_tap_conn *conn, return 0; } + /* cppcheck-suppress uninitvar */ if ((unsigned)SNDBUF_GET(conn) > (long long)tinfo->tcpi_rtt * tinfo->tcpi_delivery_rate / 1000 / 1000 * -- 2.51.1

1 0

[PATCH v3 00/10] tcp: Fix throughput issues with non-local peers
by Stefano Brivio 09 Dec '25

09 Dec '25

Patch 3/10 is the most relevant fix here, as we currently advertise a window that might be too big for what we can write to the socket, causing retransmissions right away and occasional high latency on short transfers to non-local peers. Mostly as a consequence of fixing that, we now need several improvements and small fixes, including, most notably, an adaptive approach to pick the interval between checks for socket-side ACKs (patch 4/10), and several tricks to reliably trigger TCP buffer size auto-tuning as implemented by the Linux kernel (patches 6/10 and 8/10). These changes make some existing issues more relevant, fixed by the other patches. With this series, I'm getting the expected (wirespeed) throughput for transfers between peers with varying non-local RTTs: I checked different guests bridged on the same machine (~500 us) and hosts with increasing distance using iperf3, as well as HTTP transfers only for some hosts I have control over (500 us and 5 ms case). With increasing RTTs, I can finally see the throughput converging to the available bandwidth reasonably fast: * 500 us RTT, ~10 Gbps available: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 785 MBytes 6.57 Gbits/sec 13 1.84 MBytes [ 5] 1.00-2.00 sec 790 MBytes 6.64 Gbits/sec 0 1.92 MBytes * 5 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 4.88 MBytes 40.9 Mbits/sec 22 240 KBytes [ 5] 1.00-2.00 sec 46.2 MBytes 388 Mbits/sec 34 900 KBytes [ 5] 2.00-3.00 sec 110 MBytes 923 Mbits/sec 0 1.11 MBytes * 10 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 67.9 MBytes 569 Mbits/sec 2 960 KBytes [ 5] 1.00-2.00 sec 110 MBytes 926 Mbits/sec 0 1.05 MBytes [ 5] 2.00-3.00 sec 111 MBytes 934 Mbits/sec 0 1.17 MBytes * 24 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 2.50 MBytes 20.9 Mbits/sec 16 240 KBytes [ 5] 1.00-2.00 sec 1.50 MBytes 12.6 Mbits/sec 9 120 KBytes [ 5] 2.00-3.00 sec 99.2 MBytes 832 Mbits/sec 4 2.40 MBytes [ 5] 3.00-4.00 sec 122 MBytes 1.03 Gbits/sec 1 3.16 MBytes [ 5] 4.00-5.00 sec 119 MBytes 1.00 Gbits/sec 0 4.16 MBytes * 40 ms, ~600 Mbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 2.12 MBytes 17.8 Mbits/sec 0 600 KBytes [ 5] 1.00-2.00 sec 3.25 MBytes 27.3 Mbits/sec 14 420 KBytes [ 5] 2.00-3.00 sec 31.5 MBytes 264 Mbits/sec 11 1.29 MBytes [ 5] 3.00-4.00 sec 72.5 MBytes 608 Mbits/sec 0 1.46 MBytes * 100 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 4.88 MBytes 40.9 Mbits/sec 1 840 KBytes [ 5] 1.00-2.00 sec 1.62 MBytes 13.6 Mbits/sec 9 240 KBytes [ 5] 2.00-3.00 sec 5.25 MBytes 44.0 Mbits/sec 5 780 KBytes [ 5] 3.00-4.00 sec 9.75 MBytes 81.8 Mbits/sec 0 1.29 MBytes [ 5] 4.00-5.00 sec 15.8 MBytes 132 Mbits/sec 0 1.99 MBytes [ 5] 5.00-6.00 sec 22.9 MBytes 192 Mbits/sec 0 3.05 MBytes [ 5] 6.00-7.00 sec 132 MBytes 1.11 Gbits/sec 0 7.62 MBytes * 114 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.62 MBytes 13.6 Mbits/sec 8 420 KBytes [ 5] 1.00-2.00 sec 2.12 MBytes 17.8 Mbits/sec 15 120 KBytes [ 5] 2.00-3.00 sec 26.0 MBytes 218 Mbits/sec 50 1.82 MBytes [ 5] 3.00-4.00 sec 103 MBytes 865 Mbits/sec 31 5.10 MBytes [ 5] 4.00-5.00 sec 111 MBytes 930 Mbits/sec 0 5.92 MBytes * 153 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.12 MBytes 9.43 Mbits/sec 2 180 KBytes [ 5] 1.00-2.00 sec 2.12 MBytes 17.8 Mbits/sec 11 180 KBytes [ 5] 2.00-3.00 sec 12.6 MBytes 106 Mbits/sec 40 1.29 MBytes [ 5] 3.00-4.00 sec 44.5 MBytes 373 Mbits/sec 22 2.75 MBytes [ 5] 4.00-5.00 sec 86.0 MBytes 721 Mbits/sec 0 6.68 MBytes [ 5] 5.00-6.00 sec 120 MBytes 1.01 Gbits/sec 119 6.97 MBytes [ 5] 6.00-7.00 sec 110 MBytes 927 Mbits/sec 0 6.97 MBytes * 186 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.12 MBytes 9.43 Mbits/sec 3 180 KBytes [ 5] 1.00-2.00 sec 512 KBytes 4.19 Mbits/sec 4 120 KBytes [ 5] 2.00-3.00 sec 2.12 MBytes 17.8 Mbits/sec 6 360 KBytes [ 5] 3.00-4.00 sec 27.1 MBytes 228 Mbits/sec 6 1.11 MBytes [ 5] 4.00-5.00 sec 38.2 MBytes 321 Mbits/sec 0 1.99 MBytes [ 5] 5.00-6.00 sec 38.2 MBytes 321 Mbits/sec 0 2.46 MBytes [ 5] 6.00-7.00 sec 69.2 MBytes 581 Mbits/sec 71 3.63 MBytes [ 5] 7.00-8.00 sec 110 MBytes 919 Mbits/sec 0 5.92 MBytes * 271 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.12 MBytes 9.43 Mbits/sec 0 320 KBytes [ 5] 1.00-2.00 sec 0.00 Bytes 0.00 bits/sec 0 600 KBytes [ 5] 2.00-3.00 sec 512 KBytes 4.19 Mbits/sec 7 420 KBytes [ 5] 3.00-4.00 sec 896 KBytes 7.34 Mbits/sec 8 60.0 KBytes [ 5] 4.00-5.00 sec 2.62 MBytes 22.0 Mbits/sec 13 420 KBytes [ 5] 5.00-6.00 sec 12.1 MBytes 102 Mbits/sec 7 1020 KBytes [ 5] 6.00-7.00 sec 19.9 MBytes 167 Mbits/sec 0 1.82 MBytes [ 5] 7.00-8.00 sec 17.9 MBytes 150 Mbits/sec 44 1.76 MBytes [ 5] 8.00-9.00 sec 57.4 MBytes 481 Mbits/sec 30 2.70 MBytes [ 5] 9.00-10.00 sec 88.0 MBytes 738 Mbits/sec 0 6.45 MBytes * 292 ms, ~ 600 Mbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.12 MBytes 9.43 Mbits/sec 0 450 KBytes [ 5] 1.00-2.00 sec 0.00 Bytes 0.00 bits/sec 3 180 KBytes [ 5] 2.00-3.00 sec 640 KBytes 5.24 Mbits/sec 4 120 KBytes [ 5] 3.00-4.00 sec 384 KBytes 3.15 Mbits/sec 2 120 KBytes [ 5] 4.00-5.00 sec 4.50 MBytes 37.7 Mbits/sec 1 660 KBytes [ 5] 5.00-6.00 sec 13.0 MBytes 109 Mbits/sec 3 960 KBytes [ 5] 6.00-7.00 sec 64.5 MBytes 541 Mbits/sec 0 2.17 MBytes * 327 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.12 MBytes 9.43 Mbits/sec 0 600 KBytes [ 5] 1.00-2.00 sec 0.00 Bytes 0.00 bits/sec 4 240 KBytes [ 5] 2.00-3.00 sec 768 KBytes 6.29 Mbits/sec 4 120 KBytes [ 5] 3.00-4.00 sec 1.62 MBytes 13.6 Mbits/sec 5 120 KBytes [ 5] 4.00-5.00 sec 1.88 MBytes 15.7 Mbits/sec 0 480 KBytes [ 5] 5.00-6.00 sec 17.6 MBytes 148 Mbits/sec 14 1.05 MBytes [ 5] 6.00-7.00 sec 35.1 MBytes 295 Mbits/sec 0 2.58 MBytes [ 5] 7.00-8.00 sec 45.2 MBytes 380 Mbits/sec 0 4.63 MBytes [ 5] 8.00-9.00 sec 27.0 MBytes 226 Mbits/sec 96 3.93 MBytes [ 5] 9.00-10.00 sec 85.9 MBytes 720 Mbits/sec 67 4.22 MBytes [ 5] 10.00-11.00 sec 118 MBytes 986 Mbits/sec 0 9.67 MBytes [ 5] 11.00-12.00 sec 124 MBytes 1.04 Gbits/sec 0 15.9 MBytes For short transfers, we strictly stick to the available sending buffer size to (almost) make sure we avoid local retransmissions, and significantly decrease transfer time as a result: from 1.2 s to 60 ms for a 5 MB HTTP transfer from a container hosted in a virtual machine to another guest. v3: - split 1/9 into 1/10 and 2/10 (one adding the function, one changing the usage factor) - in 1/10, rename function and clarify that the factor can be less than 100% - fix timer expiration formatting in 4/10 - in 6/10, use tcpi_rtt directly instead of its stored approximation v2: - Add 1/9, factoring out a generic version of the scaling function we already use for tcp_get_sndbuf(), as I'm now using it in 7/9 as well - in 3/9, use 4 bits instead of 3 to represent the RTT, which is important as we now use RTT values for more than just the ACK checks - in 5/9, instead of just comparing the sending buffer to SNDBUF_BIG to decide when to acknowledge data, use an adaptive approach based on the bandwidth-delay product - in 6/9, clarify the relationship between SWS avoidance and Nagle's algorithm, and introduce a reference to RFC 813, Section 4 - in 7/9, use an adaptive approach based on the product of bytes sent (and acknowledged) so far and RTT, instead of the previous approach based on bytes sent only, as it allows us to converge to the expected throughput much quicker with high RTT destinations *** BLURB HERE *** Stefano Brivio (10): tcp, util: Add function for scaling to linearly interpolated factor, use it tcp: Change usage factor of sending buffer in tcp_get_sndbuf() to 75% tcp: Limit advertised window to available, not total sending buffer size tcp: Adaptive interval based on RTT for socket-side acknowledgement checks tcp: Don't clear ACK_TO_TAP_DUE if we're advertising a zero-sized window tcp: Acknowledge everything if it looks like bulk traffic, not interactive tcp: Don't limit window to less-than-MSS values, use zero instead tcp: Allow exceeding the available sending buffer size in window advertisements tcp: Send a duplicate ACK also on complete sendmsg() failure tcp: Skip redundant ACK on partial sendmsg() failure README.md | 2 +- tcp.c | 170 ++++++++++++++++++++++++++++++++++++++++++----------- tcp_conn.h | 9 +++ util.c | 52 ++++++++++++++++ util.h | 2 + 5 files changed, 199 insertions(+), 36 deletions(-) -- 2.43.0

3 21

passt: new version 2025_12_09.c3f1ba7 available
by Stefano Brivio 09 Dec '25

09 Dec '25

The new version with tag 2025_12_09.c3f1ba7 includes the following changes: c3f1ba7 tcp_splice, flow: Add socket to epoll set before connect(), drop assert e8b56a3 fedora: Fix build on Fedora 43, selinux_requires_min not available on Copr builders c93515c tcp: Skip redundant ACK on partial sendmsg() failure e0f1330 tcp: Send a duplicate ACK also on complete sendmsg() failure 2b5c906 tcp: Allow exceeding the available sending buffer size in window advertisements cf1925f tcp: Don't limit window to less-than-MSS values, use zero instead 9139e60 tcp: Acknowledge everything if it looks like bulk traffic, not interactive 28f413d tcp: Don't clear ACK_TO_TAP_DUE if we're advertising a zero-sized window 000601b tcp: Adaptive interval based on RTT for socket-side acknowledgement checks 920a479 tcp: Limit advertised window to available, not total sending buffer size f423e12 tcp: Change usage factor of sending buffer in tcp_get_sndbuf() to 75% 6305b6c tcp, util: Add function for scaling to linearly interpolated factor, use it 5d83844 iov: Fix coding style of basic (non-IOV_TAIL) parts 0cb8f90 tcp, udp: Pad batched frames for vhost-user modes to 60 bytes (802.3 minimum) 68b0a36 tcp, udp: Pad batched frames to 60 bytes (802.3 minimum) in non-vhost-user modes b9cd36f udp: Fix coding style for comment to enum udp_iov_idx e3e8af7 tcp: Fix coding style for comment to enum tcp_iov_parts 1e51971 tap: Pad non-batched frames to 802.3 minimum (60 bytes) if needed 822ce09 test: Update Makefile to avoid failing on missing images 4ddd59b conf: Separate local mode for each IP version, don't enable disabled IP version 834982c vu_common: Clarify prototype of vu_collect() 7c7be67 test: Expand tmux right status bar to fit pass/fail/skipped counter and time aa809d3 tcp: Enable SO_KEEPALIVE if we see keep-alive segments from container / guest 9e2e381 seccomp: Fix build and operation on 32-bit musl targets fdbb4ef fwd: Preserve non-standard loopback address when splice forwarding e3c4c41 tcp: Always populate oaddr field for socket initiated flows cec1ca8 util: Rename sock_l4_dualstack() to sock_l4_dualstack_any() 653705c tcp, udp: Bind outbound listening sockets by interface instead of address e77cbf0 tcp, udp: Remove fallback if creating dual stack socket fails e6f6eb2 util: Fix setting of IPV6_V6ONLY socket option 74e6f12 udp: Move udp_sock_init() special case to its caller c8d4683 udp: Unify some more inbound/outbound parts of udp_sock_init() 860d3b1 tcp: Merge tcp_ns_sock_init[46]() into tcp_sock_init_one() 3b8b834 util, flow, pif: Simplify sock_l4_sa() interface b0523f6 inany: Let length of sockaddr_inany be implicit from the family 484dcfa flow: Remove bogus @path field from flowside_sock_args f37db87 conf: More useful errors for kernels without SO_BINDTODEVICE 0ae7b8c util: Extend sock_probe_mem() to sock_probe_features() 10e850a util: Correct error message on SO_BINDTODEVICE failure 1a83487 tcp: Clamp the retry timeout 3dde0e0 tcp: Update data retransmission timeout 0e8df13 tcp: Resend SYN for inbound connections ffecfaf util: Introduce read_file() and read_file_integer() function 785214c tcp: Rename "retrans" to "retries" 2002c7d arp/ndp: don't send messages on uninitialized tap interface 391c15a test: Fix IPv6 address/prefix mismatch error 95ab87b spec: use %selinux_requires_min macro, drop overlapping dependencies be1583f fwd: Don't explicitly exclude reverse-direction TCP ports for UDP fd3fc8d fwd: Exclude ports based on prior mapping state bdbdf4e Revert "fwd: Update all port maps before applying exclusions" 2c6590d udp: Use IP_FREEBIND for flow sockets as well as listening sockets 75b8bb9 tcp: Properly remove sockets from epoll loop when connection is closed a36031a seccomp.sh: Quote tr character ranges to prevent glob expansion 1d16439 contrib/selinux: use regex instead of SELinux template f6b6118 tcp, udp: Don't exclude ports in {tcp,udp}_port_rebind() 81942a2 fwd: Update all port maps before applying exclusions 942bfdb fwd: Check forwarding mode in fwd_scan_ports_*() rather than caller 06c3dcc fwd: Share port scanning logic between init and timer cases 1754f61 fwd: Move port exclusion handling from procfs_scan_listen() to callers 1bc7d54 fwd: Consolidate scans (not rebinds) in fwd.c 260075b tcp, udp, fwd: Run all port scanning from a single timer 1f2c08b icmp: Remove vestiges of ICMP timer 57446ca passt: Move main event loop processing into passt_worker() aaa8f34 udp: Use epoll instance management for UDP flows ca93124 icmp: Use epoll instance management for ICMP flows dd5302d tcp, flow: Replace per-connection in_epoll flag with an epollid in flow_common 05972c7 util: Move epoll registration out of sock_l4_sa() 965ea66 epoll_ctl: Extract epoll operations 8bfa47a util: Simplify epoll_del() interface to take epollfd directly 3a9dbe0 icmp: let icmp use mac address from flowside structure ad72098 tap: change signature of function tap_push_l2h() 860a487 tcp: forward external source MAC address through tap interface 627d5f7 udp: forward external source MAC address through tap interface 5d35ac3 flow: add MAC address of LAN local remote hosts to flow 7917155 arp/ndp: send ARP announcement / unsolicited NA when neigbour entry added e456c02 arp/ndp: respond with true MAC address of LAN local remote hosts 45869d6 fwd: Add cache table for ARP/NDP contents 3c46901 netlink: add subscription on changes in NDP/ARP table 3b9c7f8 Add reverse Christmas tree to CONTRIBUTING.md 7bb150c fwd: Fix misspelling b2ccb6d test: Fix the escaping issue in memory/passt test 812a7c6 test: Update the threshold value for some perf tests 4fb4c31 tap: Update some function comments for accuracy 8a6def6 passt: Rename EPOLL_EVENTS to NUM_EPOLL_EVENTS 720cc0b Fix the wrong command in CONTRIBUTING.md 6d84c90 test: For missing static checkers, skip rather than failing tests 5149f34 test: Add some missing quoting in exeter runner 898cf50 test: Use ${} consistently in lib/exeter 5da0316 isolation: keep CAP_DAC_OVERRIDE initially 518d8c1 tcp: Clarify logic calculating how much guest data to ack a947839 tcp: On partial send (incomplete sendmsg()), request a retransmission right away b145441 tcp: Don't consider FIN flags with mismatching sequence 8efa80b tcp: Completely ignore data segment in CLOSE-WAIT state, log a message b3217aa tcp: Fix ACK sequence on FIN to tap 2a16cdf test: Add linting of Python test scripts 81fd66a test: Don't delete exetool on make clean 2274c3a cppcheck: Suppress variable scope warnings in dhcpv6() ee9b236 cppcheck: Suppress a buggy cppcheck warning 065d199 cppcheck: Suppress the suppression of a suppression b4b3b08 clang-tidy: Suppress redundant expression warning 4d9c35b test: Update passt.mbuto and passt.mem.mbuto a96a962 netlink: Don't require address to be global, just not link local 7086781 test: Fix printf error when debug is enabled c54ef9e test: Update README.md f4729be test: Update mbuto profile to fix the symlink of /bin de28c20 test: Update lib/term for clearer output when DEBUG is enabled f07d7b0 test: fix 'make assets' failure as root e81c692 tap: Drop frames if no client connected https://passt.top/passt/log/?qt=range&q=2025_09_19.623dbf6..2025_12_09.c3f1… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9888020/ permanent mirror: https://passt.top/builds/copr/0^20251209.gc3f1ba7/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gc3f1ba7-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0c3f1ba7-1_all.deb -- Stefano

1 0

[PATCH] fedora: Fix build on Fedora 43, selinux_requires_min not available on Copr builders
by Stefano Brivio 09 Dec '25

09 Dec '25

For some reason, on Copr: Building target platforms: aarch64 Building for target aarch64 error: line 42: Unknown tag: %selinux_requires_min Child return code was: 1 Use %selinux_requires_min starting from current Rawhide / Fedora 44, there it works. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- I just merged this as I needed to fix Fedora 43 builds, feel free to propose changes on top if you see a better way / have a proper explanation. contrib/fedora/passt.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index bcbe1f7..38b06b0 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -37,7 +37,7 @@ requiring any capabilities or privileges. %package selinux BuildArch: noarch Summary: SELinux support for passt and pasta -%if 0%{?fedora} >= 43 +%if 0%{?fedora} > 43 BuildRequires: selinux-policy-devel %selinux_requires_min %else -- 2.43.0

2 4

[PATCH] tcp_splice, flow: Add socket to epoll set before connect(), drop assert
by Stefano Brivio 09 Dec '25

09 Dec '25

...otherwise, if we have a real error on connect() (that is, not EINPROGRESS), we'll return early from tcp_splice_connect() and later try to fetch the epoll file descriptor: ASSERTION FAILED in flow_epollfd (flow.c:362): f->epollid < ((1 << 8) - 1) which is still (correctly) EPOLLFD_ID_INVALID. Replace the ASSERT() in flow_epollfd() with a warning, as it looks like there might be harmless cases where the socket is not in the epoll set yet, and we'll just crash for nothing. We can turn this back to an ASSERT() once we audit these paths in more detail. Link: https://bodhi.fedoraproject.org/updates/FEDORA-2025-93b4eb64c3#comment-4473… Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- I might merge this in a bit even without review as we might now have broken distribution packages around. flow.c | 7 ++++++- tcp_splice.c | 4 ++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/flow.c b/flow.c index 8d72965..4f53486 100644 --- a/flow.c +++ b/flow.c @@ -359,7 +359,12 @@ bool flow_in_epoll(const struct flow_common *f) */ int flow_epollfd(const struct flow_common *f) { - ASSERT(f->epollid < EPOLLFD_ID_MAX); + if (f->epollid >= EPOLLFD_ID_MAX) { + flow_log_(f, true, LOG_WARNING, + "Invalid epollid %i for flow, assuming default", + f->epollid); + return epoll_id_to_fd[EPOLLFD_ID_DEFAULT]; + } return epoll_id_to_fd[f->epollid]; } diff --git a/tcp_splice.c b/tcp_splice.c index 717766a..4405224 100644 --- a/tcp_splice.c +++ b/tcp_splice.c @@ -381,14 +381,14 @@ static int tcp_splice_connect(const struct ctx *c, struct tcp_splice_conn *conn) pif_sockaddr(c, &sa, tgtpif, &tgt->eaddr, tgt->eport); + conn_event(c, conn, SPLICE_CONNECT); + if (connect(conn->s[1], &sa.sa, socklen_inany(&sa))) { if (errno != EINPROGRESS) { flow_trace(conn, "Couldn't connect socket for splice: %s", strerror_(errno)); return -errno; } - - conn_event(c, conn, SPLICE_CONNECT); } else { conn_event(c, conn, SPLICE_ESTABLISHED); return tcp_splice_connect_finish(c, conn); -- 2.43.0

2 3

[PATCH] flow: Set EPOLLFD_ID_DEFAULT on newly allocated flows, not EPOLLFD_ID_INVALID
by Stefano Brivio 09 Dec '25

09 Dec '25

We're somehow hitting: ASSERTION FAILED in flow_epollfd (flow.c:362): f->epollid < ((1 << 8) - 1) on an inbound spliced connection, with a single forwarded port, an HTTP server in a Podman container, and a GET request. Reproducer at https://bodhi.fedoraproject.org/updates/FEDORA-2025-93b4eb64c3#comment-4473… printf 'FROM registry.fedoraproject.org/fedora:latest\nRUN /usr/bin/dnf install -y httpd\nEXPOSE 80\nCMD ["-D", "FOREGROUND"]\nENTRYPOINT ["/usr/sbin/httpd"]\n' > Containerfile podman build -t fedora-httpd $(pwd) podman run -d -p 8080:80 localhost/fedora-httpd curl http://localhost:8080 I guess we don't set EPOLLFD_ID_DEFAULT early enough on inbound spliced sockets for some reason and we get a socket event while we still have EPOLLFD_ID_INVALID set. As we're not really using epoll identifiers yet, set EPOLLFD_ID_DEFAULT right away on newly allocated flows, while we figure this out. Link: https://bodhi.fedoraproject.org/updates/FEDORA-2025-93b4eb64c3#comment-4473… Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- I just merged this, posting for awareness / review. flow.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/flow.c b/flow.c index 8d72965..f1bde9a 100644 --- a/flow.c +++ b/flow.c @@ -382,7 +382,8 @@ void flow_epollid_set(struct flow_common *f, int epollid) */ void flow_epollid_clear(struct flow_common *f) { - f->epollid = EPOLLFD_ID_INVALID; + /* FIXME: Use EPOLLFD_ID_INVALID instead once it's safe to do so */ + f->epollid = EPOLLFD_ID_DEFAULT; } /** -- 2.43.0

2 5

do *not* upgrade to 2025_12_08.e8b56a3
by Stefano Brivio 08 Dec '25

08 Dec '25

...or derived packages. Fedora's OpenQA just caught a breaking issue: https://bodhi.fedoraproject.org/updates/FEDORA-2025-93b4eb64c3#comment-4473… which I'm investigating right now. -- Stefano

1 0

[PATCH] spec: use %selinux_requires macro, drop overlapping dependencies
by Danish Prakash 08 Dec '25

08 Dec '25

Also, drop unused preun policycoreutils requires. Signed-off-by: Danish Prakash <contact(a)danishpraka.sh> --- contrib/fedora/passt.spec | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index d1bcf4a74338..cab2bb4c409b 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -34,19 +34,15 @@ for network namespaces: traffic is forwarded using a tap interface inside the namespace, without the need to create further interfaces on the host, hence not requiring any capabilities or privileges. -%package selinux -BuildArch: noarch -Summary: SELinux support for passt and pasta -Requires: selinux-policy-%{selinuxtype} -Requires: container-selinux -Requires(post): selinux-policy-%{selinuxtype} +%package selinux +BuildArch: noarch +Summary: SELinux support for passt and pasta +%selinux_requires +Requires: container-selinux +Requires: selinux-policy-%{selinuxtype} Requires(post): container-selinux -Requires(post): policycoreutils -Requires(post): libselinux-utils -Requires(preun): policycoreutils -BuildRequires: selinux-policy-devel -BuildRequires: pkgconfig(systemd) -Recommends: selinux-policy-%{selinuxtype} >= %{selinux_policy_version} +Requires(post): selinux-policy-%{selinuxtype} +Recommends: selinux-policy-%{selinuxtype} >= %{selinux_policy_version} %description selinux This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1). -- 2.51.0

4 8

[PATCH] test: Update Makefile to avoid failing on missing images
by Yumei Huang 08 Dec '25

08 Dec '25

2 1

[PATCH v2 0/9] tcp: Fix throughput issues with non-local peers
by Stefano Brivio 08 Dec '25

08 Dec '25

Patch 2/9 is the most relevant fix here, as we currently advertise a window that might be too big for what we can write to the socket, causing retransmissions right away and occasional high latency on short transfers to non-local peers. Mostly as a consequence of fixing that, we now need several improvements and small fixes, including, most notably, an adaptive approach to pick the interval between checks for socket-side ACKs (patch 3/9), and several tricks to reliably trigger TCP buffer size auto-tuning as implemented by the Linux kernel (patches 5/9 and 7/9). These changes make some existing issues more relevant, fixed by the other patches. With this series, I'm getting the expected (wirespeed) throughput for transfers between peers with varying non-local RTTs: I checked different guests bridged on the same machine (~500 us) and hosts with increasing distance using iperf3, as well as HTTP transfers only for some hosts I have control over (500 us and 5 ms case). With increasing RTTs, I can finally see the throughput converging to the available bandwidth reasonably fast: * 500 us RTT, ~10 Gbps available: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 785 MBytes 6.57 Gbits/sec 13 1.84 MBytes [ 5] 1.00-2.00 sec 790 MBytes 6.64 Gbits/sec 0 1.92 MBytes * 5 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 4.88 MBytes 40.9 Mbits/sec 22 240 KBytes [ 5] 1.00-2.00 sec 46.2 MBytes 388 Mbits/sec 34 900 KBytes [ 5] 2.00-3.00 sec 110 MBytes 923 Mbits/sec 0 1.11 MBytes * 10 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 67.9 MBytes 569 Mbits/sec 2 960 KBytes [ 5] 1.00-2.00 sec 110 MBytes 926 Mbits/sec 0 1.05 MBytes [ 5] 2.00-3.00 sec 111 MBytes 934 Mbits/sec 0 1.17 MBytes * 24 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 2.50 MBytes 20.9 Mbits/sec 16 240 KBytes [ 5] 1.00-2.00 sec 1.50 MBytes 12.6 Mbits/sec 9 120 KBytes [ 5] 2.00-3.00 sec 99.2 MBytes 832 Mbits/sec 4 2.40 MBytes [ 5] 3.00-4.00 sec 122 MBytes 1.03 Gbits/sec 1 3.16 MBytes [ 5] 4.00-5.00 sec 119 MBytes 1.00 Gbits/sec 0 4.16 MBytes * 40 ms, ~600 Mbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 2.12 MBytes 17.8 Mbits/sec 0 600 KBytes [ 5] 1.00-2.00 sec 3.25 MBytes 27.3 Mbits/sec 14 420 KBytes [ 5] 2.00-3.00 sec 31.5 MBytes 264 Mbits/sec 11 1.29 MBytes [ 5] 3.00-4.00 sec 72.5 MBytes 608 Mbits/sec 0 1.46 MBytes * 100 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 4.88 MBytes 40.9 Mbits/sec 1 840 KBytes [ 5] 1.00-2.00 sec 1.62 MBytes 13.6 Mbits/sec 9 240 KBytes [ 5] 2.00-3.00 sec 5.25 MBytes 44.0 Mbits/sec 5 780 KBytes [ 5] 3.00-4.00 sec 9.75 MBytes 81.8 Mbits/sec 0 1.29 MBytes [ 5] 4.00-5.00 sec 15.8 MBytes 132 Mbits/sec 0 1.99 MBytes [ 5] 5.00-6.00 sec 22.9 MBytes 192 Mbits/sec 0 3.05 MBytes [ 5] 6.00-7.00 sec 132 MBytes 1.11 Gbits/sec 0 7.62 MBytes * 114 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.62 MBytes 13.6 Mbits/sec 8 420 KBytes [ 5] 1.00-2.00 sec 2.12 MBytes 17.8 Mbits/sec 15 120 KBytes [ 5] 2.00-3.00 sec 26.0 MBytes 218 Mbits/sec 50 1.82 MBytes [ 5] 3.00-4.00 sec 103 MBytes 865 Mbits/sec 31 5.10 MBytes [ 5] 4.00-5.00 sec 111 MBytes 930 Mbits/sec 0 5.92 MBytes * 153 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.12 MBytes 9.43 Mbits/sec 2 180 KBytes [ 5] 1.00-2.00 sec 2.12 MBytes 17.8 Mbits/sec 11 180 KBytes [ 5] 2.00-3.00 sec 12.6 MBytes 106 Mbits/sec 40 1.29 MBytes [ 5] 3.00-4.00 sec 44.5 MBytes 373 Mbits/sec 22 2.75 MBytes [ 5] 4.00-5.00 sec 86.0 MBytes 721 Mbits/sec 0 6.68 MBytes [ 5] 5.00-6.00 sec 120 MBytes 1.01 Gbits/sec 119 6.97 MBytes [ 5] 6.00-7.00 sec 110 MBytes 927 Mbits/sec 0 6.97 MBytes * 186 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.12 MBytes 9.43 Mbits/sec 3 180 KBytes [ 5] 1.00-2.00 sec 512 KBytes 4.19 Mbits/sec 4 120 KBytes [ 5] 2.00-3.00 sec 2.12 MBytes 17.8 Mbits/sec 6 360 KBytes [ 5] 3.00-4.00 sec 27.1 MBytes 228 Mbits/sec 6 1.11 MBytes [ 5] 4.00-5.00 sec 38.2 MBytes 321 Mbits/sec 0 1.99 MBytes [ 5] 5.00-6.00 sec 38.2 MBytes 321 Mbits/sec 0 2.46 MBytes [ 5] 6.00-7.00 sec 69.2 MBytes 581 Mbits/sec 71 3.63 MBytes [ 5] 7.00-8.00 sec 110 MBytes 919 Mbits/sec 0 5.92 MBytes * 271 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.12 MBytes 9.43 Mbits/sec 0 320 KBytes [ 5] 1.00-2.00 sec 0.00 Bytes 0.00 bits/sec 0 600 KBytes [ 5] 2.00-3.00 sec 512 KBytes 4.19 Mbits/sec 7 420 KBytes [ 5] 3.00-4.00 sec 896 KBytes 7.34 Mbits/sec 8 60.0 KBytes [ 5] 4.00-5.00 sec 2.62 MBytes 22.0 Mbits/sec 13 420 KBytes [ 5] 5.00-6.00 sec 12.1 MBytes 102 Mbits/sec 7 1020 KBytes [ 5] 6.00-7.00 sec 19.9 MBytes 167 Mbits/sec 0 1.82 MBytes [ 5] 7.00-8.00 sec 17.9 MBytes 150 Mbits/sec 44 1.76 MBytes [ 5] 8.00-9.00 sec 57.4 MBytes 481 Mbits/sec 30 2.70 MBytes [ 5] 9.00-10.00 sec 88.0 MBytes 738 Mbits/sec 0 6.45 MBytes * 292 ms, ~ 600 Mbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.12 MBytes 9.43 Mbits/sec 0 450 KBytes [ 5] 1.00-2.00 sec 0.00 Bytes 0.00 bits/sec 3 180 KBytes [ 5] 2.00-3.00 sec 640 KBytes 5.24 Mbits/sec 4 120 KBytes [ 5] 3.00-4.00 sec 384 KBytes 3.15 Mbits/sec 2 120 KBytes [ 5] 4.00-5.00 sec 4.50 MBytes 37.7 Mbits/sec 1 660 KBytes [ 5] 5.00-6.00 sec 13.0 MBytes 109 Mbits/sec 3 960 KBytes [ 5] 6.00-7.00 sec 64.5 MBytes 541 Mbits/sec 0 2.17 MBytes * 327 ms, 1 Gbps: [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.12 MBytes 9.43 Mbits/sec 0 600 KBytes [ 5] 1.00-2.00 sec 0.00 Bytes 0.00 bits/sec 4 240 KBytes [ 5] 2.00-3.00 sec 768 KBytes 6.29 Mbits/sec 4 120 KBytes [ 5] 3.00-4.00 sec 1.62 MBytes 13.6 Mbits/sec 5 120 KBytes [ 5] 4.00-5.00 sec 1.88 MBytes 15.7 Mbits/sec 0 480 KBytes [ 5] 5.00-6.00 sec 17.6 MBytes 148 Mbits/sec 14 1.05 MBytes [ 5] 6.00-7.00 sec 35.1 MBytes 295 Mbits/sec 0 2.58 MBytes [ 5] 7.00-8.00 sec 45.2 MBytes 380 Mbits/sec 0 4.63 MBytes [ 5] 8.00-9.00 sec 27.0 MBytes 226 Mbits/sec 96 3.93 MBytes [ 5] 9.00-10.00 sec 85.9 MBytes 720 Mbits/sec 67 4.22 MBytes [ 5] 10.00-11.00 sec 118 MBytes 986 Mbits/sec 0 9.67 MBytes [ 5] 11.00-12.00 sec 124 MBytes 1.04 Gbits/sec 0 15.9 MBytes For short transfers, we strictly stick to the available sending buffer size to (almost) make sure we avoid local retransmissions, and significantly decrease transfer time as a result: from 1.2 s to 60 ms for a 5 MB HTTP transfer from a container hosted in a virtual machine to another guest. v2: - Add 1/9, factoring out a generic version of the scaling function we already use for tcp_get_sndbuf(), as I'm now using it in 7/9 as well - in 3/9, use 4 bits instead of 3 to represent the RTT, which is important as we now use RTT values for more than just the ACK checks - in 5/9, instead of just comparing the sending buffer to SNDBUF_BIG to decide when to acknowledge data, use an adaptive approach based on the bandwidth-delay product - in 6/9, clarify the relationship between SWS avoidance and Nagle's algorithm, and introduce a reference to RFC 813, Section 4 - in 7/9, use an adaptive approach based on the product of bytes sent (and acknowledged) so far and RTT, instead of the previous approach based on bytes sent only, as it allows us to converge to the expected throughput much quicker with high RTT destinations Stefano Brivio (9): tcp, util: Add function for scaling to linearly interpolated factor, use it tcp: Limit advertised window to available, not total sending buffer size tcp: Adaptive interval based on RTT for socket-side acknowledgement checks tcp: Don't clear ACK_TO_TAP_DUE if we're advertising a zero-sized window tcp: Acknowledge everything if it looks like bulk traffic, not interactive tcp: Don't limit window to less-than-MSS values, use zero instead tcp: Allow exceeding the available sending buffer size in window advertisements tcp: Send a duplicate ACK also on complete sendmsg() failure tcp: Skip redundant ACK on partial sendmsg() failure README.md | 2 +- tcp.c | 168 ++++++++++++++++++++++++++++++++++++++++++----------- tcp_conn.h | 9 +++ util.c | 52 +++++++++++++++++ util.h | 2 + 5 files changed, 197 insertions(+), 36 deletions(-) -- 2.43.0

2 22