On Tue, Mar 03, 2026 at 04:17:34PM +0100, Laurent Vivier wrote:

Legacy virtio used two different header formats: struct virtio_net_hdr (10 bytes) when VIRTIO_NET_F_MRG_RXBUF was not negotiated, and struct virtio_net_hdr_mrg_rxbuf (12 bytes) when it was. The num_buffers field only existed in the larger header.

Modern virtio (VIRTIO_F_VERSION_1, i.e. virtio 1.0+) always uses the 12-byte struct virtio_net_hdr_mrg_rxbuf header regardless of whether VIRTIO_NET_F_MRG_RXBUF is negotiated, so num_buffers is always present in the header. passt only supports modern virtio and dies if VIRTIO_F_VERSION_1 is not negotiated (vhost_user.c), and VNET_HLEN is unconditionally defined as sizeof(struct virtio_net_hdr_mrg_rxbuf).

The virtio specification (v1.1, section 5.1.6) requires that:

"The device MUST set num_buffers to 1 if VIRTIO_NET_F_MRG_RXBUF has not been negotiated."

vu_set_vnethdr() only set num_buffers when VIRTIO_NET_F_MRG_RXBUF was negotiated. When it was not, num_buffers was left uninitialised, violating the spec.

Since vu_collect() already limits buffer collection to a single element when VIRTIO_NET_F_MRG_RXBUF is not negotiated, num_buffers passed by callers is guaranteed to be 1 in that case. We can therefore unconditionally set num_buffers, which makes the vdev parameter unnecessary.

Drop the vdev parameter from vu_set_vnethdr() and update all callers.

Signed-off-by: Laurent Vivier

Reviewed-by: David Gibson

--- tcp_vu.c | 4 ++-- udp_vu.c | 2 +- vu_common.c | 13 ++++++------- vu_common.h | 4 +--- 4 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/tcp_vu.c b/tcp_vu.c index bb05fbf45826..88be232dca66 100644 --- a/tcp_vu.c +++ b/tcp_vu.c @@ -97,7 +97,7 @@ int tcp_vu_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags) ASSERT(flags_elem[0].in_sg[0].iov_len >= MAX(hdrlen + sizeof(*opts), ETH_ZLEN + VNET_HLEN));

- vu_set_vnethdr(vdev, flags_elem[0].in_sg[0].iov_base, 1); + vu_set_vnethdr(flags_elem[0].in_sg[0].iov_base, 1);

eh = vu_eth(flags_elem[0].in_sg[0].iov_base);

@@ -452,7 +452,7 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) bool push = i == head_cnt - 1; size_t l2len;

- vu_set_vnethdr(vdev, iov->iov_base, buf_cnt); + vu_set_vnethdr(iov->iov_base, buf_cnt);

/* The IPv4 header checksum varies only with dlen */ if (previous_dlen != dlen) diff --git a/udp_vu.c b/udp_vu.c index 51f3718f5925..3520f89e5671 100644 --- a/udp_vu.c +++ b/udp_vu.c @@ -127,7 +127,7 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, l2len = *dlen + hdrlen - VNET_HLEN; vu_pad(&iov_vu[0], l2len);

- vu_set_vnethdr(vdev, iov_vu[0].iov_base, iov_used); + vu_set_vnethdr(iov_vu[0].iov_base, iov_used);

/* release unused buffers */ vu_queue_rewind(vq, iov_cnt - iov_used); diff --git a/vu_common.c b/vu_common.c index aa14598ea028..5f2ce18e5b71 100644 --- a/vu_common.c +++ b/vu_common.c @@ -121,17 +121,16 @@ int vu_collect(const struct vu_dev *vdev, struct vu_virtq *vq,

/** * vu_set_vnethdr() - set virtio-net headers - * @vdev: vhost-user device * @vnethdr: Address of the header to set * @num_buffers: Number of guest buffers of the frame */ -void vu_set_vnethdr(const struct vu_dev *vdev, - struct virtio_net_hdr_mrg_rxbuf *vnethdr, - int num_buffers) +void vu_set_vnethdr(struct virtio_net_hdr_mrg_rxbuf *vnethdr, int num_buffers) { vnethdr->hdr = VU_HEADER; - if (vu_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF)) - vnethdr->num_buffers = htole16(num_buffers); + /* Note: if VIRTIO_NET_F_MRG_RXBUF is not negotiated, + * num_buffers must be 1 + */ + vnethdr->num_buffers = htole16(num_buffers); }

/** @@ -269,7 +268,7 @@ int vu_send_single(const struct ctx *c, const void *buf, size_t size) goto err; }

- vu_set_vnethdr(vdev, in_sg[0].iov_base, elem_cnt); + vu_set_vnethdr(in_sg[0].iov_base, elem_cnt);

total -= VNET_HLEN;

diff --git a/vu_common.h b/vu_common.h index 052aff710502..20868a7f62ce 100644 --- a/vu_common.h +++ b/vu_common.h @@ -49,9 +49,7 @@ void vu_init_elem(struct vu_virtq_element *elem, struct iovec *iov, int vu_collect(const struct vu_dev *vdev, struct vu_virtq *vq, struct vu_virtq_element *elem, int max_elem, size_t size, size_t *collected); -void vu_set_vnethdr(const struct vu_dev *vdev, - struct virtio_net_hdr_mrg_rxbuf *vnethdr, - int num_buffers); +void vu_set_vnethdr(struct virtio_net_hdr_mrg_rxbuf *vnethdr, int num_buffers); void vu_flush(const struct vu_dev *vdev, struct vu_virtq *vq, struct vu_virtq_element *elem, int elem_cnt); void vu_kick_cb(struct vu_dev *vdev, union epoll_ref ref, -- 2.53.0

-- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson