Unable to establish TCP sessions between guests using virtio-net on Linux 3.12 and above

Unable to establish TCP sessions between guests using virtio-net on Linux 3.12 and above

[Peter Kieser]

[-- Attachment #1: Type: text/plain, Size: 858 bytes --]

Hello,

Kernel versions tested: 3.13, 3.14, 3.15
Related debian bug report: 
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738863

I'm not sure if this is a problem specific to openvswitch or KVM. I have 
a network setup where I have one openvswitch bridge setup, with various 
ports with VLAN tags and a firewall running as a guest. After upgrading 
to Linux 3.13, all guests with virtio interfaces with TSO enabled (the 
default) are unable to establish TCP connections via the guest firewall. 
ICMP ping works fine. If I disable TSO on the vnet interfaces (as 
outlined in the bug report above) guests are then able to communicate 
with each other.

Is there a patch for this issue that hasn't made it into mainline that I 
should test out? Is this an issue specific to KVM, or is it an 
openvswitch issue?

Than kyou,

-Peter


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4504 bytes --]

Re: Unable to establish TCP sessions between guests using virtio-net on Linux 3.12 and above

[Peter Kieser]

[-- Attachment #1: Type: text/plain, Size: 1155 bytes --]


On 2014-06-27 12:19 PM, Peter Kieser wrote:
> Hello,
>
> Kernel versions tested: 3.13, 3.14, 3.15
> Related debian bug report: 
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738863
>
> I'm not sure if this is a problem specific to openvswitch or KVM. I 
> have a network setup where I have one openvswitch bridge setup, with 
> various ports with VLAN tags and a firewall running as a guest. After 
> upgrading to Linux 3.13, all guests with virtio interfaces with TSO 
> enabled (the default) are unable to establish TCP connections via the 
> guest firewall. ICMP ping works fine. If I disable TSO on the vnet 
> interfaces (as outlined in the bug report above) guests are then able 
> to communicate with each other.
>
> Is there a patch for this issue that hasn't made it into mainline that 
> I should test out? Is this an issue specific to KVM, or is it an 
> openvswitch issue?
>
> Than kyou,
>
> -Peter
>

Hello,

Some further testing:

* Disabling vhost-net (vhost=off) for a particular VM has no effect to 
this issue
* Changing from virtio to e1000 for the NIC completely resolves this issue

-Peter


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4504 bytes --]