- dev - passt

[PATCH] vhost_user: Reset vq enable flag in vu_cleanup()
by Laurent Vivier 08 Sep '26

08 Sep '26

vu_cleanup() resets most virtqueue state (started, notification, file descriptors) but does not reset the enable flag. After a QEMU disconnect and reconnect, the stale enable flag causes vu_set_vring_enable_exec() to hit its early return check (vq->enable == enable). Reset vq->enable to false in vu_cleanup() alongside the other virtqueue state. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> --- vhost_user.c | 1 + 1 file changed, 1 insertion(+) diff --git a/vhost_user.c b/vhost_user.c index a1259c2624c0..272295f29db4 100644 --- a/vhost_user.c +++ b/vhost_user.c @@ -1081,6 +1081,7 @@ void vu_cleanup(struct vu_dev *vdev) struct vu_virtq *vq = &vdev->vq[i]; vq->started = false; + vq->enable = false; vq->notification = true; if (vq->call_fd != -1) { -- 2.55.0

2 1

[PATCH 0/5] Settings for Zed editor and minor fixups
by David Gibson 08 Sep '26

08 Sep '26

I've been playing with the Zed editor again. It's default settings don't quite match passt's style, so add a config file to make it do the right thing. Also update some of the config for clangd to suppress bogus warnings the way Zed invokes it. Between them these also found a handful of minor but real code warts, so fix those, too. David Gibson (5): clangd: Add _GNU_SOURCE to default clangd options util: Eliminate a stray trailing whitespace util: Add missing O_CLOEXEC for !HAS_GETRANDOM path util, pasta: Remove some unneeded #includes Add Zed editor settings .clangd | 2 +- .zed/settings.json | 4 ++++ pasta.c | 1 - util.c | 7 ++----- 4 files changed, 7 insertions(+), 7 deletions(-) create mode 100644 .zed/settings.json -- 2.53.0

3 6

[PATCH] udp_flow: Remove obsolete comment
by David Gibson 08 Sep '26

08 Sep '26

This comment was true - although the upshot was not particularly clear - when it was introduced. However, for other reaosns we now *do* always populate ini->oaddr from flow_initiate_sa(). So rather than explaning why we can't, we can actually validate ini->oaddr. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- udp_flow.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/udp_flow.c b/udp_flow.c index f59649f6..a29f3562 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -247,11 +247,8 @@ flow_sidx_t udp_flow_from_sock(const struct ctx *c, uint8_t pif, ini = flow_initiate_sa(flow, pif, s_in, dst, port); if (!inany_is_unicast(&ini->eaddr) || + inany_is_unspecified(&ini->oaddr) || ini->eport == 0 || ini->oport == 0) { - /* In principle ini->oddr also must be specified, but when we've - * been initiated from a socket bound to 0.0.0.0 or ::, we don't - * know our address, so we have to leave it unpopulated. - */ flow_err_ratelimit(flow, now, "Invalid endpoint on UDP recvfrom()"); flow_alloc_cancel(flow); -- 2.55.0

2 1

[PATCH 0/1] Leftover parsing patch
by David Gibson 08 Sep '26

08 Sep '26

I'm not sure if this patch is particularly useful, however it was already complete, left over from the earlier parsing rework. So, I thought I might as well post it in case it's interesting. David Gibson (1): parse: Convert parse_mac() to conventions of parse.c Makefile | 1 + conf.c | 43 ++++++++----------------------------------- parse.c | 30 ++++++++++++++++++++++++++++++ parse.h | 1 + 4 files changed, 40 insertions(+), 35 deletions(-) -- 2.55.0

2 2

[PATCH] netlink: Don't warn about multiple interfaces when there's only one
by Hayato Kiwata 01 Sep '26

01 Sep '26

Suppose there is a single network interface on the host, with two addresses of different prefixes assigned to it. In this situation, running pasta to create an isolated netns prints "Multiple interfaces with %s routes, picked first", even though there is in fact only one candidate interface. Reproducer: sudo ip link add dummy42 type dummy sudo ip link set dev dummy42 up sudo ip addr add fdaa:aaaa:aaaa::1/64 dev dummy42 sudo ip addr add fdbb:bbbb:bbbb::1/64 dev dummy42 pasta --config-net -- true This message is meant to indicate that there are multiple candidate interfaces, but in fact there is only one, which can mislead users. Therefore, avoid printing this message when there are multiple non-default routes that all belong to the same interface. Fixes: 450a6131beab ("netlink: With no default route, pick the first interface with a route") Signed-off-by: Hayato Kiwata <dev(a)haytok.jp> --- netlink.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/netlink.c b/netlink.c index 8d20dbb..225b666 100644 --- a/netlink.c +++ b/netlink.c @@ -271,6 +271,7 @@ unsigned int nl_get_ext_if(int s, sa_family_t af) }; unsigned defifi = 0, anyifi = 0; unsigned ndef = 0, nany = 0; + bool multi_anyif = false; struct nlmsghdr *nh; struct rtattr *rta; char buf[NLBUFSIZ]; @@ -330,6 +331,8 @@ unsigned int nl_get_ext_if(int s, sa_family_t af) nany++; if (!anyifi) anyifi = thisifi; + else if (anyifi != thisifi) + multi_anyif = true; } } @@ -345,7 +348,7 @@ unsigned int nl_get_ext_if(int s, sa_family_t af) } if (anyifi) { - if (nany > 1) { + if (multi_anyif) { info("Multiple interfaces with %s routes, picked first", af_name(af)); } -- 2.39.5 (Apple Git-154)

2 1

[PATCH 3/5] util: Add missing O_CLOEXEC for !HAS_GETRANDOM path
by David Gibson 21 Aug '26

21 Aug '26

It rarely matters, since we usually have getrandom(), but in case we don't our open() of /dev/random was missing O_CLOEXEC, which can cause clang warnings. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util.c b/util.c index 500e8f55..df972a05 100644 --- a/util.c +++ b/util.c @@ -964,7 +964,7 @@ void raw_random(void *buf, size_t buflen) { size_t random_read = 0; #ifndef HAS_GETRANDOM - int fd = open(DEV_RANDOM, O_RDONLY); + int fd = open(DEV_RANDOM, O_RDONLY | O_CLOEXEC); if (fd < 0) die_perror("Couldn't open %s", DEV_RANDOM); -- 2.53.0

2 1

[PATCH 2/5] util: Eliminate a stray trailing whitespace
by David Gibson 21 Aug '26

21 Aug '26

We generally avoid trailing whitespace, but one slipped in. Fix it. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util.c b/util.c index 28c32e43..500e8f55 100644 --- a/util.c +++ b/util.c @@ -1072,7 +1072,7 @@ void passt_exit(int status) /* Make sure we don't leave any messages incomplete */ (void)fflush(stderr); (void)fflush(stdout); - + _exit(status); } -- 2.53.0

2 1

[PATCH 0/5] Add AFL++ fuzzing support for passt
by Anshu Kumari 18 Aug '26

18 Aug '26

This series adds integrated AFL++ fuzzing support for passt, extending the earlier work by AbdAlRahman Gad with persistent mode, bidirectional protocol fuzzing, and real TCP connection coverage via a companion test server. Architecture ------------ The fuzzer runs passt in AFL++ persistent mode (__AFL_LOOP) with shared memory fuzzing. A separate test server process connects to passt's UNIX socket and listens on 127.0.0.1:9999 for real TCP connections: Deterministic wrappers replace clock_gettime, getrandom, getsockopt, and recv-family calls to eliminate kernel-level non-determinism. Per-iteration reset of the flow table, epoll instance, and clock. *** BLURB HERE *** Anshu Kumari (5): fuzz: Add deterministic wrappers for system calls fuzz: Add flow type guards for fuzzing stability fuzz: Bypass isolation and adapt sockets for AFL++ fuzz: Add AFL++ persistent mode fuzz loop fuzz: Add test server for bidirectional protocol fuzzing Makefile | 28 +- fuzz-server.c | 490 +++++++++++++++++++++++++++++++++ fuzz.c | 275 ++++++++++++++++++ fuzz.h | 62 +++++ fuzzing/README.fuzzing.md | 95 +++++++ fuzzing/testcase_dir/empty.bin | Bin 0 -> 12 bytes icmp.c | 14 +- isolation.c | 11 + passt.c | 189 +++++++++++++ passt.h | 4 + tap.c | 21 ++ tcp.c | 19 +- tcp_buf.c | 1 + tcp_splice.c | 10 + udp.c | 29 +- udp_flow.c | 5 + util.c | 10 + 17 files changed, 1251 insertions(+), 12 deletions(-) create mode 100644 fuzz-server.c create mode 100644 fuzz.c create mode 100644 fuzz.h create mode 100644 fuzzing/README.fuzzing.md create mode 100644 fuzzing/testcase_dir/empty.bin -- 2.55.0

3 22

[PATCH 0/2] Allow users to give source address with --gateway also for IPv6
by Stefano Brivio 18 Aug '26

18 Aug '26

...just like it happens with IPv4. This offers a solution for https://bugs.passt.top/show_bug.cgi?id=217, as Podman can specify --address and --gateway for IPv6 local mode, and provide a unique local address, without the need to introduce other options. Further options might be more appropriate, strictly speaking, but as the future perspective is to eventually generalise NAT tables, it would be nice to avoid them right now. Stefano Brivio (2): conf: Honour --address, --gateway, --netmask in local mode as well conf, fwd: Prefer same-scope address as inbound source address from host conf.c | 23 +++++++++++++++++++---- fwd.c | 6 +++++- passt.h | 2 ++ 3 files changed, 26 insertions(+), 5 deletions(-) -- 2.43.0

2 8

[RFC v3 0/8] Add vhost-net kernel support to pasta
by Ammar Yasser 17 Aug '26

17 Aug '26

This work is based on the original v2 RFC by Eugenio Perez, and continues its version numbering. Link: https://archives.passt.top/passt-dev/20250709174748.3514693-1-eperezma@redh… vhost-net is a kernel device that allows reading and writing packets to a tap device using virtqueues instead of read(2) and write(2) and their vectored counterparts. Frames are handed over through a shared descriptor ring, so several of them can be passed to the kernel at once rather than issuing a syscall per frame. This RFC introduces an option to pasta, --vhost, which if specified will leverage this mode of acceleration. I haven't benchmarked this against the existing path yet, so the performance argument above is so far unquantified. TODO: test what happens when the namespace wants to send data but we don't have available rx descriptors, and vice versa for tx. TODO: tap_send_frames() currently carries an implicit contract that it is synchronous: once it returns, the caller is free to reuse its frame buffers. That holds for writev() and for vhost-user, but not for vhost-kernel, where returning only means the descriptors have been queued. pasta can overwrite a buffer while the kernel vhost worker thread is still reading the descriptor pointing at it. I haven't settled on how to restore that contract, and would appreciate direction before building further on top of it. Ammar Yasser (8): tap: Move the tap_hdr file to a separate file udp,tcp: Make protocol specific buffers public conf: Add context fields, epoll types and the --vhost flag to pasta virtio: Define the pasta vhost interface virtio: Implement the pasta vhost functions virtio: Implement pasta vhost acceleration guest->pasta path pasta: Implement pasta vhost TX (pasta->guest) prerequisites tap: Implement pasta vhost TX conf.c | 6 + epoll_type.h | 4 + passt.c | 9 ++ passt.h | 17 ++- tap.c | 317 +++++++++++++++++++++++++++++++++++++++++-------- tap.h | 10 +- tap_hdr.h | 19 +++ tcp_buf.c | 51 +++++--- tcp_buf.h | 14 +++ udp.c | 68 ++++++----- udp.h | 53 +++++++++ udp_internal.h | 13 -- virtio.c | 283 ++++++++++++++++++++++++++++++++++++++++++- virtio.h | 76 ++++++++++++ 14 files changed, 827 insertions(+), 113 deletions(-) create mode 100644 tap_hdr.h -- 2.34.1

2 32