- dev - passt

[PATCH v2] conf: Add command line switch to enable IP_FREEBIND socket option
by David Gibson 03 Oct '24

03 Oct '24

In a couple of recent reports, we've seen that it can be useful for pasta to forward ports from addresses which are not currently configured on the host, but might be in future. That can be done with the sysctl net.ipv4.ip_nonlocal_bind, but that does require CAP_NET_ADMIN to set in the first place. We can allow the same thing on a per-socket basis with the IP_FREEBIND (or IPV6_FREEBIND) socket option. Add a --freebind command line argument to enable this socket option on all listening sockets. Link: https://bugs.passt.top/show_bug.cgi?id=101 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 2 ++ passt.1 | 10 ++++++++++ passt.h | 2 ++ util.c | 15 +++++++++++++++ 4 files changed, 29 insertions(+) Changes since v1: * Reworded --help and man page additions for clarity * Added missing structure comment * Fixed some incorrect indentation diff --git a/conf.c b/conf.c index 6e62510..e360fb9 100644 --- a/conf.c +++ b/conf.c @@ -836,6 +836,7 @@ static void usage(const char *name, FILE *f, int status) " --no-ndp Disable NDP responses\n" " --no-dhcpv6 Disable DHCPv6 server\n" " --no-ra Disable router advertisements\n" + " --freebind Bind to any address for forwarding\n" " --no-map-gw Don't map gateway address to host\n" " -4, --ipv4-only Enable IPv4 operation only\n" " -6, --ipv6-only Enable IPv6 operation only\n"); @@ -1255,6 +1256,7 @@ void conf(struct ctx *c, int argc, char **argv) {"no-dhcpv6", no_argument, &c->no_dhcpv6, 1 }, {"no-ndp", no_argument, &c->no_ndp, 1 }, {"no-ra", no_argument, &c->no_ra, 1 }, + {"freebind", no_argument, &c->freebind, 1 }, {"no-map-gw", no_argument, &no_map_gw, 1 }, {"ipv4-only", no_argument, NULL, '4' }, {"ipv6-only", no_argument, NULL, '6' }, diff --git a/passt.1 b/passt.1 index 79d134d..5ac2962 100644 --- a/passt.1 +++ b/passt.1 @@ -327,6 +327,16 @@ namespace will be silently dropped. Disable Router Advertisements. Router Solicitations coming from guest or target namespace will be ignored. +.TP +.BR \-\-freebind +Allow any binding address to be specified for \fB-t\fR and \fB-u\fR +options. Usually binding addresses must be addresses currently +configured on the host. With \fB\-\-freebind\fR, the +\fBIP_FREEBIND\fR or \fBIPV6_FREEBIND\fR socket option is enabled +allowing any address to be used. This is typically used to bind +addresses which might be configured on the host in future, at which +point the forwarding will immediately start operating. + .TP .BR \-\-map-host-loopback " " \fIaddr Translate \fIaddr\fR to refer to the host. Packets from the guest to diff --git a/passt.h b/passt.h index 031c9b6..4908ed9 100644 --- a/passt.h +++ b/passt.h @@ -225,6 +225,7 @@ struct ip6_ctx { * @no_dhcpv6: Disable DHCPv6 server * @no_ndp: Disable NDP handler altogether * @no_ra: Disable router advertisements + * @freebind: Allow binding of non-local addresses for forwarding * @low_wmem: Low probed net.core.wmem_max * @low_rmem: Low probed net.core.rmem_max */ @@ -284,6 +285,7 @@ struct ctx { int no_dhcpv6; int no_ndp; int no_ra; + int freebind; int low_wmem; int low_rmem; diff --git a/util.c b/util.c index ebd93ed..96e3de8 100644 --- a/util.c +++ b/util.c @@ -52,6 +52,7 @@ int sock_l4_sa(const struct ctx *c, enum epoll_type type, { sa_family_t af = ((const struct sockaddr *)sa)->sa_family; union epoll_ref ref = { .type = type, .data = data }; + bool freebind = false; struct epoll_event ev; int fd, y = 1, ret; uint8_t proto; @@ -61,8 +62,11 @@ int sock_l4_sa(const struct ctx *c, enum epoll_type type, case EPOLL_TYPE_TCP_LISTEN: proto = IPPROTO_TCP; socktype = SOCK_STREAM | SOCK_NONBLOCK; + freebind = c->freebind; break; case EPOLL_TYPE_UDP_LISTEN: + freebind = c->freebind; + /* fallthrough */ case EPOLL_TYPE_UDP_REPLY: proto = IPPROTO_UDP; socktype = SOCK_DGRAM | SOCK_NONBLOCK; @@ -127,6 +131,17 @@ int sock_l4_sa(const struct ctx *c, enum epoll_type type, } } + if (freebind) { + int level = af == AF_INET ? IPPROTO_IP : IPPROTO_IPV6; + int opt = af == AF_INET ? IP_FREEBIND : IPV6_FREEBIND; + + if (setsockopt(fd, level, opt, &y, sizeof(y))) { + err_perror("Failed to set %s on socket %i", + af == AF_INET ? "IP_FREEBIND" : "IPV6_FREEBIND", + fd); + } + } + if (bind(fd, sa, sl) < 0) { /* We'll fail to bind to low ports if we don't have enough * capabilities, and we'll fail to bind on already bound ports, -- 2.46.2

1 0

[PATCH] conf: Add command line switch to enable IP_FREEBIND socket option
by David Gibson 03 Oct '24

03 Oct '24

In a couple of recent reports, we've seen that it can be useful for pasta to forward ports from addresses which are not currently configured on the host, but might be in future. That can be done with the sysctl net.ipv4.ip_nonlocal_bind, but that does require CAP_NET_ADMIN to set in the first place. We can allow the same thing on a per-socket basis with the IP_FREEBIND (or IPV6_FREEBIND) socket option. Add a --freebind command line argument to enable this socket option on all listening sockets. Link: https://bugs.passt.top/show_bug.cgi?id=101 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 2 ++ passt.1 | 6 ++++++ passt.h | 1 + util.c | 15 +++++++++++++++ 4 files changed, 24 insertions(+) diff --git a/conf.c b/conf.c index 6e62510..84aa89d 100644 --- a/conf.c +++ b/conf.c @@ -836,6 +836,7 @@ static void usage(const char *name, FILE *f, int status) " --no-ndp Disable NDP responses\n" " --no-dhcpv6 Disable DHCPv6 server\n" " --no-ra Disable router advertisements\n" + " --freebind Allow forwarding from any address\n" " --no-map-gw Don't map gateway address to host\n" " -4, --ipv4-only Enable IPv4 operation only\n" " -6, --ipv6-only Enable IPv6 operation only\n"); @@ -1255,6 +1256,7 @@ void conf(struct ctx *c, int argc, char **argv) {"no-dhcpv6", no_argument, &c->no_dhcpv6, 1 }, {"no-ndp", no_argument, &c->no_ndp, 1 }, {"no-ra", no_argument, &c->no_ra, 1 }, + {"freebind", no_argument, &c->freebind, 1 }, {"no-map-gw", no_argument, &no_map_gw, 1 }, {"ipv4-only", no_argument, NULL, '4' }, {"ipv6-only", no_argument, NULL, '6' }, diff --git a/passt.1 b/passt.1 index 79d134d..a2547f8 100644 --- a/passt.1 +++ b/passt.1 @@ -327,6 +327,12 @@ namespace will be silently dropped. Disable Router Advertisements. Router Solicitations coming from guest or target namespace will be ignored. +.TP +.BR \-\-freebind +Allow forwarding from addresses which are not configured on the host, +but might be in future. This enables the \fBIP_FREEBIND\fR or +\fBIPB6_FREEBIND\fR option on listening sockets. + .TP .BR \-\-map-host-loopback " " \fIaddr Translate \fIaddr\fR to refer to the host. Packets from the guest to diff --git a/passt.h b/passt.h index 031c9b6..e00049e 100644 --- a/passt.h +++ b/passt.h @@ -284,6 +284,7 @@ struct ctx { int no_dhcpv6; int no_ndp; int no_ra; + int freebind; int low_wmem; int low_rmem; diff --git a/util.c b/util.c index ebd93ed..96e3de8 100644 --- a/util.c +++ b/util.c @@ -52,6 +52,7 @@ int sock_l4_sa(const struct ctx *c, enum epoll_type type, { sa_family_t af = ((const struct sockaddr *)sa)->sa_family; union epoll_ref ref = { .type = type, .data = data }; + bool freebind = false; struct epoll_event ev; int fd, y = 1, ret; uint8_t proto; @@ -61,8 +62,11 @@ int sock_l4_sa(const struct ctx *c, enum epoll_type type, case EPOLL_TYPE_TCP_LISTEN: proto = IPPROTO_TCP; socktype = SOCK_STREAM | SOCK_NONBLOCK; + freebind = c->freebind; break; case EPOLL_TYPE_UDP_LISTEN: + freebind = c->freebind; + /* fallthrough */ case EPOLL_TYPE_UDP_REPLY: proto = IPPROTO_UDP; socktype = SOCK_DGRAM | SOCK_NONBLOCK; @@ -127,6 +131,17 @@ int sock_l4_sa(const struct ctx *c, enum epoll_type type, } } + if (freebind) { + int level = af == AF_INET ? IPPROTO_IP : IPPROTO_IPV6; + int opt = af == AF_INET ? IP_FREEBIND : IPV6_FREEBIND; + + if (setsockopt(fd, level, opt, &y, sizeof(y))) { + err_perror("Failed to set %s on socket %i", + af == AF_INET ? "IP_FREEBIND" : "IPV6_FREEBIND", + fd); + } + } + if (bind(fd, sa, sl) < 0) { /* We'll fail to bind to low ports if we don't have enough * capabilities, and we'll fail to bind on already bound ports, -- 2.46.2

2 2

[PATCH v2 0/4] Don't expose container loopback services to the host
by David Gibson 02 Oct '24

02 Oct '24

podman issue #24045 pointed out that pasta's spliced forwarding logic can expose services within the namespace bound only to 127.0.0.1 or ::1 to the host. However, the namespace probably expects those to only be accessible to itself, so that's probably not what we want. This changes our forwarding logic so as not to do this. Note that the podman tests will currently fail with this series, I've submitted podman PR https://github.com/containers/podman/pull/24064 to fix that. Link: https://github.com/containers/podman/issues/24045 Changes since v1: * Add --host-lo-to-ns-lo option to preserve the old behaviour * Clarify the new behaviour in the man page * Add some extra patches making some other corrections to the man page David Gibson (4): passt.1: Mark --stderr as deprecated more prominently passt.1: Clarify and update "Handling of local addresses" section test: Clarify test for spliced inbound transfers fwd: Direct inbound spliced forwards to the guest's external address conf.c | 9 ++++++ fwd.c | 31 +++++++++++++----- passt.1 | 75 +++++++++++++++++++++++++++----------------- passt.h | 1 + test/passt_in_ns/tcp | 8 ++--- test/passt_in_ns/udp | 4 +-- test/pasta/tcp | 16 +++++----- test/pasta/udp | 8 ++--- 8 files changed, 97 insertions(+), 55 deletions(-) -- 2.46.2

2 7

[PATCH] test: Add tests for passt in vhost-user mode
by Stefano Brivio 30 Sep '24

30 Sep '24

Run functional and performance tests for vhost-user mode as well. For functional tests, we add passt_vu and passt_vu_in_ns as symbolic links to their non-vhost-user counterparts, as no differences are intended but we want to distinguish them in test logs. For performance tests, instead, we add separate perf/passt_vu_tcp and perf/passt_vu_udp files, as we need longer test duration, as well as higher UDP sending bandwidths and larger TCP windows, to actually get the highest throughput vhost-user mode offers. For valgrind tests, vhost-user mode needs two extra system calls: statx and readlink. Add them as EXTRA_SYSCALLS for the valgrind target. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- This is based on: [PATCH v5 0/4] Add vhost-user support to passt. (part 3) [PATCH] test: Kernel binary can now be passed via the KERNEL environmental variable and currently shows an issue reported by valgrind, as passt starts and gets a connection from QEMU: accepted connection from PID 4806 ==4804== Conditional jump or move depends on uninitialised value(s) ==4804== at 0x13AE26: vu_set_mem_table_exec (vhost_user.c:459) ==4804== by 0x13C756: vu_control_handler (vhost_user.c:1232) ==4804== by 0x10CE46: main (passt.c:380) ==4804== which I didn't really investigate. This is the relevant code: static bool vu_set_mem_table_exec(struct vu_dev *vdev, struct vhost_user_msg *msg) { struct vhost_user_memory m = msg->payload.memory, *memory = &m; unsigned int i; for (i = 0; i < vdev->nregions; i++) { <-- on top of that, once the tests terminate QEMU, we get: qemu-system-x86_64: Failed to set msg fds. qemu-system-x86_64: vhost VQ 0 ring restore failed: -22: Invalid argument (22) qemu-system-x86_64: Failed to set msg fds. qemu-system-x86_64: vhost VQ 1 ring restore failed: -22: Invalid argument (22) qemu-system-x86_64: terminating on signal 15 from pid 4220 (<unknown process>) About performance tests: I didn't try hard to get throughput figures as good as the ones Laurent reported by running iperf3 without arguments on his setup. We should probably play with that a bit more. Laurent, please feel free to carry this as part of your vhost-user series. Makefile | 3 +- test/lib/perf_report | 15 +++++++++ test/lib/setup | 77 ++++++++++++++++++++++++++++++++++++-------- test/run | 21 ++++++++++++ 4 files changed, 101 insertions(+), 15 deletions(-) diff --git a/Makefile b/Makefile index 1e8910d..ce8aa43 100644 --- a/Makefile +++ b/Makefile @@ -138,7 +138,8 @@ qrap: $(QRAP_SRCS) passt.h valgrind: EXTRA_SYSCALLS += rt_sigprocmask rt_sigtimedwait rt_sigaction \ rt_sigreturn getpid gettid kill clock_gettime mmap \ - mmap2 munmap open unlink gettimeofday futex + mmap2 munmap open unlink gettimeofday futex statx \ + readlink valgrind: FLAGS += -g -DVALGRIND valgrind: all diff --git a/test/lib/perf_report b/test/lib/perf_report index d1ef50b..c4ec817 100755 --- a/test/lib/perf_report +++ b/test/lib/perf_report @@ -49,6 +49,21 @@ td:empty { visibility: hidden; } __passt_tcp_LINE__ __passt_udp_LINE__ </table> +</li><li><p>passt with vhost-user support</p> +<table class="passt" width="70%"> + <tr> + <th/> + <th id="perf_passt_vu_tcp" colspan="__passt_vu_tcp_cols__">TCP, __passt_vu_tcp_threads__ at __passt_vu_tcp_freq__ GHz</th> + <th id="perf_passt_vu_udp" colspan="__passt_vu_udp_cols__">UDP, __passt_vu_udp_threads__ at __passt_vu_udp_freq__ GHz</th> + </tr> + <tr> + <td align="right">MTU:</td> + __passt_vu_tcp_header__ + __passt_vu_udp_header__ + </tr> + __passt_vu_tcp_LINE__ __passt_vu_udp_LINE__ +</table> + <style type="text/CSS"> table.pasta_local td { border: 0px solid; padding: 6px; line-height: 1; } table.pasta_local td { text-align: right; } diff --git a/test/lib/setup b/test/lib/setup index 5338393..3409bd2 100755 --- a/test/lib/setup +++ b/test/lib/setup @@ -15,8 +15,7 @@ INITRAMFS="${BASEPATH}/mbuto.img" VCPUS="$( [ $(nproc) -ge 8 ] && echo 6 || echo $(( $(nproc) / 2 + 1 )) )" -__mem_kib="$(sed -n 's/MemTotal:[ ]*$[0-9]*$ kB/\1/p' /proc/meminfo)" -VMEM="$((${__mem_kib} / 1024 / 4))" +MEM_KIB="$(sed -n 's/MemTotal:[ ]*$[0-9]*$ kB/\1/p' /proc/meminfo)" QEMU_ARCH="$(uname -m)" [ "${QEMU_ARCH}" = "i686" ] && QEMU_ARCH=i386 @@ -46,6 +45,7 @@ setup_passt() { [ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" + [ ${VHOST_USER} -eq 1 ] && __opts="${__opts} --vhost-user" context_run passt "make clean" context_run passt "make valgrind" @@ -54,16 +54,29 @@ setup_passt() { # pidfile isn't created until passt is listening wait_for [ -f "${STATESETUP}/passt.pid" ] + __vmem="$((${MEM_KIB} / 1024 / 4))" + if [ ${VHOST_USER} -eq 1 ]; then + __vmem="$(((${__vmem} + 500) / 1000))G" + __qemu_netdev=" \ + -chardev socket,id=c,path=${STATESETUP}/passt.socket \ + -netdev vhost-user,id=v,chardev=c \ + -device virtio-net,netdev=v \ + -object memory-backend-memfd,id=m,share=on,size=${__vmem} \ + -numa node,memdev=m" + else + __qemu_netdev="-device virtio-net-pci,netdev=s \ + -netdev stream,id=s,server=off,addr.type=unix,addr.path=${STATESETUP}/passt.socket" + fi + GUEST_CID=94557 context_run_bg qemu 'qemu-system-'"${QEMU_ARCH}" \ ' -machine accel=kvm' \ - ' -m '${VMEM}' -cpu host -smp '${VCPUS} \ + ' -m '${__vmem}' -cpu host -smp '${VCPUS} \ ' -kernel '"${KERNEL}" \ ' -initrd '${INITRAMFS}' -nographic -serial stdio' \ ' -nodefaults' \ ' -append "console=ttyS0 mitigations=off apparmor=0" ' \ - ' -device virtio-net-pci,netdev=s0 ' \ - " -netdev stream,id=s0,server=off,addr.type=unix,addr.path=${STATESETUP}/passt.socket " \ + " ${__qemu_netdev}" \ " -pidfile ${STATESETUP}/qemu.pid" \ " -device vhost-vsock-pci,guest-cid=$GUEST_CID" @@ -142,6 +155,7 @@ setup_passt_in_ns() { [ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_in_pasta.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" + [ ${VHOST_USER} -eq 1 ] && __opts="${__opts} --vhost-user" if [ ${VALGRIND} -eq 1 ]; then context_run passt "make clean" @@ -154,17 +168,30 @@ setup_passt_in_ns() { fi wait_for [ -f "${STATESETUP}/passt.pid" ] + __vmem="$((${MEM_KIB} / 1024 / 4))" + if [ ${VHOST_USER} -eq 1 ]; then + __vmem="$(((${__vmem} + 500) / 1000))G" + __qemu_netdev=" \ + -chardev socket,id=c,path=${STATESETUP}/passt.socket \ + -netdev vhost-user,id=v,chardev=c \ + -device virtio-net,netdev=v \ + -object memory-backend-memfd,id=m,share=on,size=${__vmem} \ + -numa node,memdev=m" + else + __qemu_netdev="-device virtio-net-pci,netdev=s \ + -netdev stream,id=s,server=off,addr.type=unix,addr.path=${STATESETUP}/passt.socket" + fi + GUEST_CID=94557 context_run_bg qemu 'qemu-system-'"${QEMU_ARCH}" \ ' -machine accel=kvm' \ ' -M accel=kvm:tcg' \ - ' -m '${VMEM}' -cpu host -smp '${VCPUS} \ + ' -m '${__vmem}' -cpu host -smp '${VCPUS} \ ' -kernel '"${KERNEL}" \ ' -initrd '${INITRAMFS}' -nographic -serial stdio' \ ' -nodefaults' \ ' -append "console=ttyS0 mitigations=off apparmor=0" ' \ - ' -device virtio-net-pci,netdev=s0 ' \ - " -netdev stream,id=s0,server=off,addr.type=unix,addr.path=${STATESETUP}/passt.socket " \ + " ${__qemu_netdev}" \ " -pidfile ${STATESETUP}/qemu.pid" \ " -device vhost-vsock-pci,guest-cid=$GUEST_CID" @@ -214,6 +241,7 @@ setup_two_guests() { [ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_1.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" + [ ${VHOST_USER} -eq 1 ] && __opts="${__opts} --vhost-user" context_run_bg passt_1 "./passt -s ${STATESETUP}/passt_1.socket -P ${STATESETUP}/passt_1.pid -f ${__opts} -t 10001 -u 10001" wait_for [ -f "${STATESETUP}/passt_1.pid" ] @@ -222,33 +250,54 @@ setup_two_guests() { [ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_2.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" + [ ${VHOST_USER} -eq 1 ] && __opts="${__opts} --vhost-user" context_run_bg passt_2 "./passt -s ${STATESETUP}/passt_2.socket -P ${STATESETUP}/passt_2.pid -f ${__opts} -t 10004 -u 10004" wait_for [ -f "${STATESETUP}/passt_2.pid" ] + __vmem="$((${MEM_KIB} / 1024 / 4))" + if [ ${VHOST_USER} -eq 1 ]; then + __vmem="$(((${__vmem} + 500) / 1000))G" + __qemu_netdev1=" \ + -chardev socket,id=c,path=${STATESETUP}/passt_1.socket \ + -netdev vhost-user,id=v,chardev=c \ + -device virtio-net,netdev=v \ + -object memory-backend-memfd,id=m,share=on,size=${__vmem} \ + -numa node,memdev=m" + __qemu_netdev1=" \ + -chardev socket,id=c,path=${STATESETUP}/passt_2.socket \ + -netdev vhost-user,id=v,chardev=c \ + -device virtio-net,netdev=v \ + -object memory-backend-memfd,id=m,share=on,size=${__vmem} \ + -numa node,memdev=m" + else + __qemu_netdev1="-device virtio-net-pci,netdev=s \ + -netdev stream,id=s,server=off,addr.type=unix,addr.path=${STATESETUP}/passt_1.socket" + __qemu_netdev2="-device virtio-net-pci,netdev=s \ + -netdev stream,id=s,server=off,addr.type=unix,addr.path=${STATESETUP}/passt_2.socket" + fi + GUEST_1_CID=94557 context_run_bg qemu_1 'qemu-system-'"${QEMU_ARCH}" \ ' -M accel=kvm:tcg' \ - ' -m '${VMEM}' -cpu host -smp '${VCPUS} \ + ' -m '${__vmem}' -cpu host -smp '${VCPUS} \ ' -kernel '"${KERNEL}" \ ' -initrd '${INITRAMFS}' -nographic -serial stdio' \ ' -nodefaults' \ ' -append "console=ttyS0 mitigations=off apparmor=0" ' \ - ' -device virtio-net-pci,netdev=s0 ' \ - " -netdev stream,id=s0,server=off,addr.type=unix,addr.path=${STATESETUP}/passt_1.socket " \ + " ${__qemu_netdev1}" \ " -pidfile ${STATESETUP}/qemu_1.pid" \ " -device vhost-vsock-pci,guest-cid=$GUEST_1_CID" GUEST_2_CID=94558 context_run_bg qemu_2 'qemu-system-'"${QEMU_ARCH}" \ ' -M accel=kvm:tcg' \ - ' -m '${VMEM}' -cpu host -smp '${VCPUS} \ + ' -m '${__vmem}' -cpu host -smp '${VCPUS} \ ' -kernel '"${KERNEL}" \ ' -initrd '${INITRAMFS}' -nographic -serial stdio' \ ' -nodefaults' \ ' -append "console=ttyS0 mitigations=off apparmor=0" ' \ - ' -device virtio-net-pci,netdev=s0 ' \ - " -netdev stream,id=s0,server=off,addr.type=unix,addr.path=${STATESETUP}/passt_2.socket " \ + " ${__qemu_netdev2}" \ " -pidfile ${STATESETUP}/qemu_2.pid" \ " -device vhost-vsock-pci,guest-cid=$GUEST_2_CID" diff --git a/test/run b/test/run index 547a729..662a29c 100755 --- a/test/run +++ b/test/run @@ -93,6 +93,7 @@ run() { test memory/passt teardown memory + VHOST_USER=0 setup passt test passt/ndp test passt/dhcp @@ -115,7 +116,18 @@ run() { test two_guests/basic teardown two_guests + VHOST_USER=1 + setup passt_in_ns + test passt_vu/ndp + test passt_vu_in_ns/dhcp + test passt_vu_in_ns/icmp + test passt_vu_in_ns/tcp + test passt_vu_in_ns/udp + test passt_vu_in_ns/shutdown + teardown passt_in_ns + VALGRIND=0 + VHOST_USER=0 setup passt_in_ns test passt/ndp test passt_in_ns/dhcp @@ -126,6 +138,15 @@ run() { test passt_in_ns/shutdown teardown passt_in_ns + VHOST_USER=1 + setup passt_in_ns + test passt_vu/ndp + test passt_vu_in_ns/dhcp + test perf/passt_vu_tcp + test perf/passt_vu_udp + test passt_vu_in_ns/shutdown + teardown passt_in_ns + # TODO: Make those faster by at least pre-installing gcc and make on # non-x86 images, then re-enable. skip_distro() { -- 2.43.0

1 0

[PATCH] test: Kernel binary can now be passed via the KERNEL environmental variable
by Stefano Brivio 30 Sep '24

30 Sep '24

This is quite useful at least for myself as I'm usually running tests using a guest kernel that's not the same as the one on the host. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/lib/setup | 8 ++++---- test/lib/term | 2 +- test/run | 3 +++ 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/test/lib/setup b/test/lib/setup index d764138..5338393 100755 --- a/test/lib/setup +++ b/test/lib/setup @@ -58,7 +58,7 @@ setup_passt() { context_run_bg qemu 'qemu-system-'"${QEMU_ARCH}" \ ' -machine accel=kvm' \ ' -m '${VMEM}' -cpu host -smp '${VCPUS} \ - ' -kernel ' "/boot/vmlinuz-$(uname -r)" \ + ' -kernel '"${KERNEL}" \ ' -initrd '${INITRAMFS}' -nographic -serial stdio' \ ' -nodefaults' \ ' -append "console=ttyS0 mitigations=off apparmor=0" ' \ @@ -159,7 +159,7 @@ setup_passt_in_ns() { ' -machine accel=kvm' \ ' -M accel=kvm:tcg' \ ' -m '${VMEM}' -cpu host -smp '${VCPUS} \ - ' -kernel ' "/boot/vmlinuz-$(uname -r)" \ + ' -kernel '"${KERNEL}" \ ' -initrd '${INITRAMFS}' -nographic -serial stdio' \ ' -nodefaults' \ ' -append "console=ttyS0 mitigations=off apparmor=0" ' \ @@ -230,7 +230,7 @@ setup_two_guests() { context_run_bg qemu_1 'qemu-system-'"${QEMU_ARCH}" \ ' -M accel=kvm:tcg' \ ' -m '${VMEM}' -cpu host -smp '${VCPUS} \ - ' -kernel ' "/boot/vmlinuz-$(uname -r)" \ + ' -kernel '"${KERNEL}" \ ' -initrd '${INITRAMFS}' -nographic -serial stdio' \ ' -nodefaults' \ ' -append "console=ttyS0 mitigations=off apparmor=0" ' \ @@ -243,7 +243,7 @@ setup_two_guests() { context_run_bg qemu_2 'qemu-system-'"${QEMU_ARCH}" \ ' -M accel=kvm:tcg' \ ' -m '${VMEM}' -cpu host -smp '${VCPUS} \ - ' -kernel ' "/boot/vmlinuz-$(uname -r)" \ + ' -kernel '"${KERNEL}" \ ' -initrd '${INITRAMFS}' -nographic -serial stdio' \ ' -nodefaults' \ ' -append "console=ttyS0 mitigations=off apparmor=0" ' \ diff --git a/test/lib/term b/test/lib/term index 3834092..0fa0936 100755 --- a/test/lib/term +++ b/test/lib/term @@ -664,7 +664,7 @@ pause_continue() { # run_term() - Start tmux session, running entry point, with recording if needed run_term() { - TMUX="tmux new-session -s passt_test -eSTATEBASE=$STATEBASE -ePCAP=$PCAP -eDEBUG=$DEBUG" + TMUX="tmux new-session -s passt_test -eSTATEBASE=$STATEBASE -ePCAP=$PCAP -eDEBUG=$DEBUG -eKERNEL=$KERNEL" if [ ${CI} -eq 1 ]; then printf '\e[8;50;240t' diff --git a/test/run b/test/run index cd6d707..547a729 100755 --- a/test/run +++ b/test/run @@ -38,6 +38,9 @@ TRACE=${TRACE:-0} # If set, tell passt and pasta to take packet captures PCAP=${PCAP:-0} +# Custom kernel to boot guests with, if given +KERNEL=${KERNEL:-"/boot/vmlinuz-$(uname -r)"} + COMMIT="$(git log --oneline --no-decorate -1)" . lib/util -- 2.43.0

2 2

[PATCH v2 0/4] tcp: use csum_iov() in tcp_update_check_tcp[4|6]()
by Laurent Vivier 30 Sep '24

30 Sep '24

For vhost-user, we will need to spread TCP payload over several buffers. To re-use tcp_update_check_tcp[4|6](), provide an iovec rather than a pointer to a buffer. This series updates also csum_iov() and pcap_iov() to add an offset of bytes to skip in the iovec array. It's based on top of "tcp: Use tcp_payload_t rather than tcphdr" that is added in the series for convenience. Laurent Vivier (4): tcp: Use tcp_payload_t rather than tcphdr pcap: Add an offset argument in pcap_iov() checksum: Add an offset argument in csum_iov() tcp: Update TCP checksum using an iovec array checksum.c | 17 +++++-- checksum.h | 3 +- pcap.c | 5 +- pcap.h | 2 +- tcp.c | 134 ++++++++++++++++++++++++++++++++++++------------- tcp_buf.c | 29 ----------- tcp_internal.h | 29 +++++++++++ 7 files changed, 147 insertions(+), 72 deletions(-) -- 2.46.0

3 12

[PATCH v4 0/5] tcp: use csum_iov() in tcp_update_check_tcp[4|6]()
by Laurent Vivier 27 Sep '24

27 Sep '24

For vhost-user, we will need to spread TCP payload over several buffers. To re-use tcp_update_check_tcp[4|6](), provide an iovec rather than a pointer to a buffer. This series updates also csum_iov() and pcap_iov() to add an offset of bytes to skip in the iovec array. It's based on top of "tcp: Use tcp_payload_t rather than tcphdr" that is added in the series for convenience. v3 adds "udp: Update UDP checksum using an iovec array" that modifies csum_udp4() and csum_udp6() in the same way. Laurent Vivier (5): tcp: Use tcp_payload_t rather than tcphdr pcap: Add an offset argument in pcap_iov() checksum: Add an offset argument in csum_iov() tcp: Update TCP checksum using an iovec array udp: Update UDP checksum using an iovec array checksum.c | 46 ++++++++++----- checksum.h | 7 ++- pcap.c | 5 +- pcap.h | 2 +- tap.c | 14 ++++- tap.h | 2 +- tcp.c | 156 +++++++++++++++++++++++++++++++++++++------------ tcp_buf.c | 29 --------- tcp_internal.h | 29 +++++++++ udp.c | 17 ++++-- 10 files changed, 214 insertions(+), 93 deletions(-) -- 2.46.0

2 6

[PATCH v3 0/5] tcp: use csum_iov() in tcp_update_check_tcp[4|6]()
by Laurent Vivier 26 Sep '24

26 Sep '24

For vhost-user, we will need to spread TCP payload over several buffers. To re-use tcp_update_check_tcp[4|6](), provide an iovec rather than a pointer to a buffer. This series updates also csum_iov() and pcap_iov() to add an offset of bytes to skip in the iovec array. It's based on top of "tcp: Use tcp_payload_t rather than tcphdr" that is added in the series for convenience. v3 adds "udp: Update UDP checksum using an iovec array" that modifies csum_udp4() and csum_udp6() in the same way. Laurent Vivier (5): tcp: Use tcp_payload_t rather than tcphdr pcap: Add an offset argument in pcap_iov() checksum: Add an offset argument in csum_iov() tcp: Update TCP checksum using an iovec array udp: Update UDP checksum using an iovec array checksum.c | 46 +++++++++++----- checksum.h | 7 ++- pcap.c | 5 +- pcap.h | 2 +- tap.c | 14 ++++- tap.h | 2 +- tcp.c | 145 +++++++++++++++++++++++++++++++++++++------------ tcp_buf.c | 29 ---------- tcp_internal.h | 29 ++++++++++ udp.c | 17 ++++-- 10 files changed, 203 insertions(+), 93 deletions(-) -- 2.46.0

1 6

Problematic throughput numbers
by Jon Maloy 26 Sep '24

26 Sep '24

I made many runs with iperf3 ns->host, and the results are puzzling me. Over and over again, I see throughput practically collapse, with a two orders of magnitude decrease. Just to make sure this wasn't something introduced by me, I went back to the master branch and disabled the SO_PEEK_OFF feature. The result was the same. The below log shows typical run, but it is highly variable. Sometimes almost the whole series is in the 50-70 Gb/s range, and sometimes almost all in the 100-300 Mb/s range. When I added the kernel fix it didn't seem to make any difference. To me this is really worrying, and should be investigated. ///jon pasta NS->host (master branch, SO_PEEK_OFF disabled ----------------------------------------------------------- Server listening on 5201 (test #2) ----------------------------------------------------------- Accepted connection from 127.0.0.1, port 48354 [ 5] local 127.0.0.1 port 5201 connected to 127.0.0.1 port 48360 [ ID] Interval Transfer Bitrate [ 5] 0.00-1.00 sec 7.61 GBytes 65.3 Gbits/sec [ 5] 1.00-2.00 sec 7.59 GBytes 65.2 Gbits/sec [ 5] 2.00-3.00 sec 7.55 GBytes 64.8 Gbits/sec [ 5] 3.00-4.00 sec 7.69 GBytes 66.1 Gbits/sec [ 5] 4.00-5.00 sec 7.55 GBytes 64.8 Gbits/sec [ 5] 5.00-6.00 sec 7.60 GBytes 65.3 Gbits/sec [ 5] 6.00-7.00 sec 7.52 GBytes 64.6 Gbits/sec [ 5] 7.00-8.00 sec 1.02 GBytes 8.73 Gbits/sec [ 5] 8.00-9.00 sec 3.50 MBytes 29.4 Mbits/sec [ 5] 9.00-10.00 sec 17.2 MBytes 145 Mbits/sec [ 5] 10.00-11.00 sec 64.0 MBytes 537 Mbits/sec [ 5] 11.00-12.00 sec 24.1 MBytes 202 Mbits/sec [ 5] 12.00-13.00 sec 25.4 MBytes 213 Mbits/sec [ 5] 13.00-14.00 sec 24.9 MBytes 209 Mbits/sec [ 5] 14.00-15.00 sec 21.4 MBytes 179 Mbits/sec [ 5] 15.00-16.00 sec 32.0 MBytes 268 Mbits/sec [ 5] 16.00-17.00 sec 10.9 MBytes 91.2 Mbits/sec [ 5] 17.00-18.00 sec 27.6 MBytes 232 Mbits/sec [ 5] 18.00-19.00 sec 75.6 MBytes 634 Mbits/sec [ 5] 19.00-20.00 sec 21.1 MBytes 177 Mbits/sec [ 5] 20.00-21.00 sec 109 MBytes 912 Mbits/sec [ 5] 21.00-22.00 sec 23.9 MBytes 200 Mbits/sec [ 5] 22.00-23.00 sec 62.6 MBytes 525 Mbits/sec [ 5] 23.00-24.00 sec 34.5 MBytes 289 Mbits/sec [ 5] 24.00-25.00 sec 54.4 MBytes 456 Mbits/sec [ 5] 25.00-26.00 sec 14.1 MBytes 118 Mbits/sec [ 5] 26.00-27.00 sec 38.8 MBytes 325 Mbits/sec [ 5] 27.00-28.00 sec 95.0 MBytes 797 Mbits/sec [ 5] 28.00-29.00 sec 23.2 MBytes 195 Mbits/sec [ 5] 29.00-30.00 sec 71.9 MBytes 603 Mbits/sec [ 5] 30.00-31.00 sec 28.8 MBytes 241 Mbits/sec [ 5] 31.00-32.00 sec 34.8 MBytes 292 Mbits/sec [ 5] 32.00-33.00 sec 19.4 MBytes 163 Mbits/sec [ 5] 33.00-34.00 sec 39.1 MBytes 328 Mbits/sec [ 5] 34.00-35.00 sec 31.4 MBytes 263 Mbits/sec [ 5] 35.00-36.00 sec 28.2 MBytes 237 Mbits/sec [ 5] 36.00-37.00 sec 48.5 MBytes 407 Mbits/sec [ 5] 37.00-38.00 sec 23.4 MBytes 196 Mbits/sec [ 5] 38.00-39.00 sec 71.4 MBytes 599 Mbits/sec [ 5] 39.00-40.00 sec 41.4 MBytes 347 Mbits/sec [ 5] 40.00-41.00 sec 15.2 MBytes 128 Mbits/sec [ 5] 41.00-42.00 sec 34.1 MBytes 286 Mbits/sec [ 5] 42.00-43.00 sec 31.1 MBytes 261 Mbits/sec [ 5] 43.00-44.00 sec 61.5 MBytes 516 Mbits/sec [ 5] 44.00-45.00 sec 38.2 MBytes 321 Mbits/sec [ 5] 45.00-46.00 sec 34.2 MBytes 287 Mbits/sec [ 5] 46.00-47.00 sec 33.8 MBytes 283 Mbits/sec [ 5] 47.00-48.00 sec 7.12 MBytes 59.8 Mbits/sec [ 5] 48.00-49.00 sec 97.4 MBytes 817 Mbits/sec [ 5] 49.00-50.00 sec 13.6 MBytes 114 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate [ 5] 0.00-50.00 sec 55.7 GBytes 9.57 Gbits/sec receiver ----------------------------------------------------------- Server listening on 5201 (test #3) -----------------------------------------------------------

3 4

[PATCH 0/2] Don't expose container loopback services to the host
by David Gibson 26 Sep '24

26 Sep '24

podman issue #24045 pointed out that pasta's spliced forwarding logic can expose services within the namespace bound only to 127.0.0.1 or ::1 to the host. However, the namespace probably expects those to only be accessible to itself, so that's probably not what we want. This changes our forwarding logic so as not to do this. Note that the podman tests will currently fail with this series, I've submitted podman PR https://github.com/containers/podman/pull/24064 to fix that. Link: https://github.com/containers/podman/issues/24045 David Gibson (2): test: Clarify test for spliced inbound transfers fwd: Direct inbound spliced forwards to the guest's external address fwd.c | 24 +++++++++++++++--------- test/passt_in_ns/tcp | 8 ++++---- test/passt_in_ns/udp | 4 ++-- test/pasta/tcp | 16 ++++++++-------- test/pasta/udp | 8 ++++---- 5 files changed, 33 insertions(+), 27 deletions(-) -- 2.46.1

2 5

2024

2023

2022

2021

dev