[PATCH 0/3] net/tap, virtio-net: auto-detect MTU from host tap device

[PATCH 0/3] net/tap, virtio-net: auto-detect MTU from host tap device

[Nariman Sayed]

This series adds automatic detection of the host tap device's MTU
and exposes it to the guest via VIRTIO_NET_F_MTU, addressing
gitlab.com/qemu-project/qemu/-/issues/3155.

Currently, host_mtu= must be set manually on the virtio-net-pci
device, duplicating the MTU already configured on the host's tap
interface. This series adds a new mtu-from-tap boolean property
(default off) that, when enabled, automatically reads the tap
device's MTU via SIOCGIFMTU and uses it for the guest, avoiding
the need to specify the value twice.

The series is split into three patches:
 - patch 1 adds a helper to query a tap fd's host MTU (Linux only,
   with build-safe stubs for BSD/Solaris/stub backends)
 - patch 2 exposes this via NetClientState for use by device models
 - patch 3 adds the new virtio-net property and wires it up,
   including a note on a config-space sizing timing issue
   discovered during testing

Tested manually with a tap device configured for MTU 9000 and an
Alpine Linux guest, confirming the guest correctly negotiates
VIRTIO_NET_F_MTU and reports the expected MTU.

This patch series is part of my effort to get more familiar with
QEMU's networking stack ahead of GSoC 2027.

Nariman Sayed (3):
  net/tap: add tap_fd_get_mtu() to query host tap MTU
  net/tap: expose tap_get_mtu() via NetClientState
  virtio-net: add mtu-from-tap property for automatic MTU detection

 hw/net/virtio-net.c            | 12 ++++++++++++
 include/hw/virtio/virtio-net.h |  1 +
 include/net/tap.h              |  1 +
 net/tap-bsd.c                  |  5 +++++
 net/tap-linux.c                | 30 ++++++++++++++++++++++++++++++
 net/tap-solaris.c              |  5 +++++
 net/tap-stub.c                 |  5 +++++
 net/tap.c                      |  7 +++++++
 net/tap_int.h                  |  1 +
 9 files changed, 67 insertions(+)

-- 
2.34.1

[PATCH 1/3] net/tap: add tap_fd_get_mtu() to query host tap MTU

[Nariman Sayed]

Add a helper function to read the host tap device's configured
MTU via SIOCGIFMTU. Since this ioctl requires a socket rather than
the tap character device fd itself, a separate control socket is
opened to perform the query, following the same pattern used by
net/can/can_socketcan.c.

This is implemented for Linux only, with stub implementations
returning -1 for BSD, Solaris, and the tap-stub backend, matching
the existing pattern used by tap_fd_get_ifname() and
tap_fd_set_steering_ebpf() in those files.

This is a preparatory patch; the function is not yet called from
anywhere.

Signed-off-by: Nariman Sayed <narimansayed28@gmail.com>
---
 net/tap-bsd.c     |  5 +++++
 net/tap-linux.c   | 30 ++++++++++++++++++++++++++++++
 net/tap-solaris.c |  5 +++++
 net/tap-stub.c    |  5 +++++
 net/tap_int.h     |  1 +
 5 files changed, 46 insertions(+)

diff --git a/net/tap-bsd.c b/net/tap-bsd.c
index c39daf9385..17cedccf9e 100644
--- a/net/tap-bsd.c
+++ b/net/tap-bsd.c
@@ -264,6 +264,11 @@ int tap_fd_get_ifname(int fd, char *ifname)
     return -1;
 }
 
+int tap_fd_get_mtu(int fd)
+{
+    return -1;
+}
+
 int tap_fd_set_steering_ebpf(int fd, int prog_fd)
 {
     return -1;
diff --git a/net/tap-linux.c b/net/tap-linux.c
index 3cd7d26710..23a10151c1 100644
--- a/net/tap-linux.c
+++ b/net/tap-linux.c
@@ -34,6 +34,7 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/cutils.h"
+#include "qemu/sockets.h"
 
 #define PATH_NET_TUN "/dev/net/tun"
 
@@ -346,6 +347,35 @@ int tap_fd_get_ifname(int fd, char *ifname)
     return 0;
 }
 
+int tap_fd_get_mtu(int fd)
+{
+    struct ifreq ifr;
+    int s, ret, mtu;
+
+    memset(&ifr, 0, sizeof(ifr));
+    if (tap_fd_get_ifname(fd, ifr.ifr_name) != 0) {
+        return -1;
+    }
+
+    s = qemu_socket(AF_INET, SOCK_DGRAM, 0);
+    if (s < 0) {
+        error_report("could not create control socket: %s",
+                      strerror(errno));
+        return -1;
+    }
+
+    ret = ioctl(s, SIOCGIFMTU, &ifr);
+    if (ret != 0) {
+        error_report("SIOCGIFMTU ioctl() failed: %s", strerror(errno));
+        close(s);
+        return -1;
+    }
+
+    mtu = ifr.ifr_mtu;
+    close(s);
+    return mtu;
+}
+
 int tap_fd_set_steering_ebpf(int fd, int prog_fd)
 {
     if (ioctl(fd, TUNSETSTEERINGEBPF, (void *) &prog_fd) != 0) {
diff --git a/net/tap-solaris.c b/net/tap-solaris.c
index 8704b1084b..d3bd6e6b48 100644
--- a/net/tap-solaris.c
+++ b/net/tap-solaris.c
@@ -266,6 +266,11 @@ int tap_fd_get_ifname(int fd, char *ifname)
     return -1;
 }
 
+int tap_fd_get_mtu(int fd)
+{
+    return -1;
+}
+
 int tap_fd_set_steering_ebpf(int fd, int prog_fd)
 {
     return -1;
diff --git a/net/tap-stub.c b/net/tap-stub.c
index 6aa60d96ad..756ce882a7 100644
--- a/net/tap-stub.c
+++ b/net/tap-stub.c
@@ -91,6 +91,11 @@ int tap_fd_get_ifname(int fd, char *ifname)
     return -1;
 }
 
+int tap_fd_get_mtu(int fd)
+{
+    return -1;
+}
+
 int tap_fd_set_steering_ebpf(int fd, int prog_fd)
 {
     return -1;
diff --git a/net/tap_int.h b/net/tap_int.h
index dc4f484006..360d61c889 100644
--- a/net/tap_int.h
+++ b/net/tap_int.h
@@ -45,6 +45,7 @@ int tap_fd_set_vnet_be(int fd, int vnet_is_be);
 int tap_fd_enable(int fd);
 int tap_fd_disable(int fd);
 int tap_fd_get_ifname(int fd, char *ifname);
+int tap_fd_get_mtu(int fd);
 int tap_fd_set_steering_ebpf(int fd, int prog_fd);
 
 #endif /* NET_TAP_INT_H */
-- 
2.34.1

[PATCH 2/3] net/tap: expose tap_get_mtu() via NetClientState

[Nariman Sayed]

Add a public tap_get_mtu() function, following the same pattern
as the existing tap_get_fd(), to allow other subsystems (such as
virtio-net) to query a tap netdev's host MTU via its
NetClientState without depending on tap-internal headers.

This is a preparatory patch; the function is not yet called from
anywhere.

Signed-off-by: Nariman Sayed <narimansayed28@gmail.com>
---
 include/net/tap.h | 1 +
 net/tap.c         | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/include/net/tap.h b/include/net/tap.h
index 6f34f13eae..6b478acbfb 100644
--- a/include/net/tap.h
+++ b/include/net/tap.h
@@ -32,5 +32,6 @@ int tap_enable(NetClientState *nc);
 int tap_disable(NetClientState *nc);
 
 int tap_get_fd(NetClientState *nc);
+int tap_get_mtu(NetClientState *nc);
 
 #endif /* QEMU_NET_TAP_H */
diff --git a/net/tap.c b/net/tap.c
index 57ffb09885..122319d5f3 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -379,6 +379,13 @@ int tap_get_fd(NetClientState *nc)
     return s->fd;
 }
 
+int tap_get_mtu(NetClientState *nc)
+{
+    TAPState *s = DO_UPCAST(TAPState, nc, nc);
+    assert(nc->info->type == NET_CLIENT_DRIVER_TAP);
+    return tap_fd_get_mtu(s->fd);
+}
+
 /*
  * tap_get_vhost_net() can return NULL if a tap net-device backend is
  * created with 'vhost=off' option, 'vhostforce=off' or no vhost or
-- 
2.34.1

[PATCH 3/3] virtio-net: add mtu-from-tap property for automatic MTU detection

[Nariman Sayed]

Currently, exposing the host tap device's MTU to the guest via
VIRTIO_NET_F_MTU requires manually specifying host_mtu= on the
virtio-net-pci device, duplicating the MTU already configured on
the host's tap interface.

Add a new mtu-from-tap boolean property (default off, preserving
existing behavior). When enabled and the device's netdev peer is
a tap client, the host tap's MTU is queried via tap_get_mtu() and
used to set net_conf.mtu and enable VIRTIO_NET_F_MTU.

This detection must happen in virtio_net_device_realize(), before
virtio_net_set_config_size() computes the virtio config space
size from host_features. Performing the detection later (e.g. in
the get_features_ex() callback, which runs after the NIC and its
config space are already sized) results in the mtu config field
falling outside the sized config space, and the guest reading
back an unmapped garbage value (0xffff) instead of the intended
MTU.

Since qemu_new_nic() has not yet been called at this point in
realize(), the tap peer is accessed via n->nic_conf.peers.ncs[0]
(populated during property parsing, before realize() runs, via
the netdev= property) rather than through n->nic.

Signed-off-by: Nariman Sayed <narimansayed28@gmail.com>
---
 hw/net/virtio-net.c            | 12 ++++++++++++
 include/hw/virtio/virtio-net.h |  1 +
 2 files changed, 13 insertions(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 814b99a43d..6faeca87d4 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -3901,6 +3901,17 @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
         n->host_features |= (1ULL << VIRTIO_NET_F_MTU);
     }
 
+    if (n->net_conf.mtu_from_tap) {
+        NetClientState *tap_peer = n->nic_conf.peers.ncs[0];
+        if (tap_peer && tap_peer->info->type == NET_CLIENT_DRIVER_TAP) {
+            int mtu = tap_get_mtu(tap_peer);
+            if (mtu > 0) {
+                n->net_conf.mtu = mtu;
+                n->host_features |= (1ULL << VIRTIO_NET_F_MTU);
+            }
+        }
+    }
+
     if (n->net_conf.duplex_str) {
         if (strncmp(n->net_conf.duplex_str, "half", 5) == 0) {
             n->net_conf.duplex = DUPLEX_HALF;
@@ -4275,6 +4286,7 @@ static const Property virtio_net_properties[] = {
     DEFINE_PROP_UINT16("tx_queue_size", VirtIONet, net_conf.tx_queue_size,
                        VIRTIO_NET_TX_QUEUE_DEFAULT_SIZE),
     DEFINE_PROP_UINT16("host_mtu", VirtIONet, net_conf.mtu, 0),
+    DEFINE_PROP_BOOL("mtu-from-tap", VirtIONet, net_conf.mtu_from_tap, false),
     DEFINE_PROP_INT32("speed", VirtIONet, net_conf.speed, SPEED_UNKNOWN),
     DEFINE_PROP_STRING("duplex", VirtIONet, net_conf.duplex_str),
     DEFINE_PROP_BOOL("failover", VirtIONet, failover, false),
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index 371e376428..11044b6d27 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -52,6 +52,7 @@ typedef struct virtio_net_conf
     uint16_t rx_queue_size;
     uint16_t tx_queue_size;
     uint16_t mtu;
+    bool mtu_from_tap;
     int32_t speed;
     char *duplex_str;
     uint8_t duplex;
-- 
2.34.1