- dev - passt

[PATCH v2 3/3] test: For missing static checkers, skip rather than failing tests
by David Gibson 10 Oct '25

10 Oct '25

We run a bunch of static checkers as part of our testsuite. That's useful, but it means that if a user doesn't have one of them installed, it fails the entire testsuite. Alter our scripts to skip the test, rather than failing outright if the checker tool is not installed. This requires exeter v0.4.4 or later. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/build/static_checkers.sh | 24 ++++++++++++++++++------ test/lib/exeter | 10 +++++++++- 2 files changed, 27 insertions(+), 7 deletions(-) diff --git a/test/build/static_checkers.sh b/test/build/static_checkers.sh index 228b99ae..96679fb2 100755 --- a/test/build/static_checkers.sh +++ b/test/build/static_checkers.sh @@ -13,18 +13,30 @@ # Copyright Red Hat # Author: David Gibson <david(a)gibson.dropbear.id.au> -. $(dirname $0)/../exeter/sh/exeter.sh +. $(dirname ${0})/../exeter/sh/exeter.sh -exeter_register cppcheck make -C .. cppcheck +# do_check() - Run static checker as a test if the binary is available +# $1: Static checker (uased as both executable name and make target) +# $@: Any additional arguments required to make +do_check() { + checker="${1}" + shift + if ! which "${checker}" >/dev/null 2>/dev/null; then + exeter_skip "${checker} not available" + fi + make "${@}" "${checker}" +} + +exeter_register cppcheck do_check cppcheck -C .. exeter_set_description cppcheck "passt sources pass cppcheck" -exeter_register clang_tidy make -C .. clang-tidy +exeter_register clang_tidy do_check clang-tidy -C .. exeter_set_description clang_tidy "passt sources pass clang-tidy" -exeter_register flake8 make flake8 +exeter_register flake8 do_check flake8 exeter_set_description flake8 "passt tests in Python pass flake8" -exeter_register mypy make mypy +exeter_register mypy do_check mypy exeter_set_description mypy "passt tests in Python pass mypy --strict" -exeter_main "$@" +exeter_main "${@}" diff --git a/test/lib/exeter b/test/lib/exeter index 7ea084a4..ccdb19c2 100644 --- a/test/lib/exeter +++ b/test/lib/exeter @@ -49,7 +49,15 @@ exeter() { for __testid in $(${EXETOOL} list -- "${@}"); do __desc="$(${EXETOOL} desc -- "${@}" -- "${__testid}")" status_test_start "${__desc}" - context_run host "${*} '${__testid}'" && status_test_ok || status_test_fail + status=0 + context_run host "${*} '${__testid}'" || status="${?}" + if [ "${status}" = 0 ]; then + status_test_ok + elif [ "${status}" = 77 ]; then + status_test_skip + else + status_test_fail + fi done cd .. -- 2.51.0

1 0

[PATCH v2 2/3] test: Add some missing quoting in exeter runner
by David Gibson 10 Oct '25

10 Oct '25

exeter() quoted ${__testid}, but in some places we use it there's an extra level of shell, which needs another layer of quoting. This breaks if testids include ';', which is quite common in exeter tests created as a composition/pipeline of two functions. Add the required extra quoting. While we're there, improve consistency with other scripts by always using the optional {} around variable names. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/lib/exeter | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/lib/exeter b/test/lib/exeter index 0b361599..7ea084a4 100644 --- a/test/lib/exeter +++ b/test/lib/exeter @@ -47,9 +47,9 @@ exeter() { [ ${CI} -eq 1 ] && video_link "${1}" for __testid in $(${EXETOOL} list -- "${@}"); do - __desc="$(${EXETOOL} desc -- "${@}" -- ${__testid})" + __desc="$(${EXETOOL} desc -- "${@}" -- "${__testid}")" status_test_start "${__desc}" - context_run host "${@}" "${__testid}" && status_test_ok || status_test_fail + context_run host "${*} '${__testid}'" && status_test_ok || status_test_fail done cd .. -- 2.51.0

1 0

[PATCH v2 1/3] test: Use ${} consistently in lib/exeter
by David Gibson 10 Oct '25

10 Oct '25

Most of the test shell scripts use {} around variable names even when it's not required, for consistency. lib/exeter didn't do so consistently, however. Correct that. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/lib/exeter | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/test/lib/exeter b/test/lib/exeter index 3b19beaa..0b361599 100644 --- a/test/lib/exeter +++ b/test/lib/exeter @@ -13,18 +13,18 @@ # Copyright Red Hat # Author: David Gibson <david(a)gibson.dropbear.id.au> -EXETOOL="$BASEPATH/exeter/exetool/exetool" +EXETOOL="${BASEPATH}/exeter/exetool/exetool" # is_exeter() - Determine if a test file is an exeter program # $@: Command line to invoke test program is_exeter() { - $EXETOOL probe -- "$@" + ${EXETOOL} probe -- "${@}" } # exeter() - Run each test in an exeter program, logging each test separately # $@: Command line to invoke exeter test program exeter() { - STATESETUP="${STATEBASE}/$1" + STATESETUP="${STATEBASE}/${1}" mkdir -p "${STATESETUP}" context_setup_host host @@ -32,9 +32,9 @@ exeter() { cd test - __ntests=$($EXETOOL list -- "$@" | wc -l) - if [ $? != 0 ]; then - info "Failed to get exeter manifest for $@" + __ntests=$(${EXETOOL} list -- "${@}" | wc -l) + if [ ${?} != 0 ]; then + info "Failed to get exeter manifest for ${@}" pause_continue \ "Press any key to pause test session" \ "Resuming in " \ @@ -43,13 +43,13 @@ exeter() { return fi - status_file_start "$* (exeter)" ${__ntests} + status_file_start "${*} (exeter)" ${__ntests} [ ${CI} -eq 1 ] && video_link "${1}" - for __testid in $($EXETOOL list -- "$@"); do - __desc="$($EXETOOL desc -- "$@" -- ${__testid})" + for __testid in $(${EXETOOL} list -- "${@}"); do + __desc="$(${EXETOOL} desc -- "${@}" -- ${__testid})" status_test_start "${__desc}" - context_run host "$@" "${__testid}" && status_test_ok || status_test_fail + context_run host "${@}" "${__testid}" && status_test_ok || status_test_fail done cd .. -- 2.51.0

1 0

[PATCH 0/2] Fixes to exeter test integration
by David Gibson 10 Oct '25

10 Oct '25

In advance of the tunbridge work, here are some further small fixes to the test logic, specifically how we interface with exeter tests. David Gibson (2): test: Add some missing quoting in exeter runner test: For missing static checkers, skip rather than failing tests test/build/static_checkers.sh | 17 +++++++++++++---- test/lib/exeter | 12 ++++++++++-- 2 files changed, 23 insertions(+), 6 deletions(-) -- 2.51.0

2 6

[PATCH v12 0/9] Use true MAC address of LAN local remote hosts
by Jon Maloy 10 Oct '25

10 Oct '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. --- v3: Updated according to feedback from Stefano and David: - Made the ARP/NDP lookup call filter out the requested address by itself, qualified by the index if the template interface - Moved the flow specific MAC address from struct flowside to struct flow_common. v4: - Updated according to feedback from David and Stefan - Added a cache table for ARP/NDP table contents v5: - Updated according to feedback from David and Stefan - Added cache table entries to FIFO/LRU queue - New criteria for when to consult ARP/NDP v6: - Simplified and merged mac cache table commits - Other changes after feedback from David. v7: - Fixes in patch #2 based on feedback from David and Stefano. v8: - Redesigned netlink and cache table part to be based on a subscription model. v8: - Small fix to patch #2 so that we cover the case when a MAC addess for a host has changed. - Added a commit where we send a gratuitous ARP/ unsolicitated NA to the guest when a new host is added to the neighbour cache table. v10: - Some fixes after feedback from David Gibson - Reordered: Moved patch #9 to position #3. - Added synchronization step between ARP/NDP table contents and the neigbour table at initialization. This reduces the number of "false" ARP/NDP replies drastically, but not completly. - (Next step could be to scan over the flow table and update affeced entries when we receive a MAC address update.) v11: - Corrected the gratuitous ARP implementation to use the "ARP Announcement" model instead of the "Gratuitous ARP reply" model. v12: - Updated based on feedback from David and Stefano - Added special handling of default GW and loopback addresses. Jon Maloy (8): netlink: add subsciption on changes in NDP/ARP table fwd: Add cache table for ARP/NDP contents arp/ndp: respond with true MAC address of LAN local remote hosts flow: add MAC address of LAN local remote hosts to flow udp: forward external source MAC address through tap interface tcp: forward external source MAC address through tap interface tap: change signature of function tap_push_l2h() icmp: let icmp use mac address from flowside structure arp.c | 9 ++- conf.c | 1 + epoll_type.h | 2 + flow.c | 2 + flow.h | 2 + fwd.c | 167 +++++++++++++++++++++++++++++++++++++++++++++++-- fwd.h | 9 +++ icmp.c | 8 ++- inany.c | 1 + ndp.c | 10 ++- netlink.c | 119 +++++++++++++++++++++++++++++++++++ netlink.h | 4 ++ passt.c | 17 +++-- passt.h | 3 +- pasta.c | 2 +- tap.c | 24 ++++--- tap.h | 7 ++- tcp.c | 18 ++++-- tcp.h | 2 +- tcp_buf.c | 37 +++++------ tcp_internal.h | 4 +- tcp_vu.c | 5 +- udp.c | 57 ++++++++++------- udp.h | 2 +- 24 files changed, 429 insertions(+), 83 deletions(-) -- 2.50.1

3 32

[PATCH 0/4] tcp: Fix bad switch to CLOSE-WAIT state and surrounding issues
by Stefano Brivio 09 Oct '25

09 Oct '25

The most important fix here is 3/4, the other ones are either fixes for issues that weren't actually observed in practice, but I mistook them as the case fixed by 3/4, or for minor details. Stefano Brivio (4): tcp: Fix ACK sequence on FIN to tap tcp: Completely ignore data segment in CLOSE-WAIT state, log a message tcp: Don't consider FIN flags with mismatching sequence tcp: On partial send (incomplete sendmsg()), request a retransmission right away tcp.c | 12 +++++++++--- tcp_buf.c | 14 +++++++++++++- tcp_vu.c | 7 ++++++- 3 files changed, 28 insertions(+), 5 deletions(-) -- 2.43.0

2 24

[PATCH v2] isolation: keep CAP_DAC_OVERRIDE initially
by Cole Robinson 09 Oct '25

09 Oct '25

Reproducer that I'd expect to work: $ cd $HOME $ sudo passt --runas $UID --socket foo.sock Failed to bind UNIX domain socket: Permission denied A more practical example is for libguestfs apps when run as user=root: + libguestfs connects to libvirt qemu:///system + libvirt qemu:///system defaults to user=qemu + libvirt chowns /run/libvirt/qemu/passt dir to user=qemu + libguestfs instead requests the VM run as user=root + patches in progress but we are blocked by this issue + passt is launched as root, but because CAP_DAC_OVERRIDE has been dropped, passt fails to create socket in qemu owned /run/libvirt/qemu/passt Fix it by not dropping CAP_DAC_OVERRIDE in isolate_initial. This might look sketchy, but isolate_initial already keeps CAP_SYS_ADMIN and CAP_NET_ADMIN, so we are probably no worse off. Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- v2: improve commit message isolation.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/isolation.c b/isolation.c index bbcd23b..b25f349 100644 --- a/isolation.c +++ b/isolation.c @@ -188,6 +188,9 @@ void isolate_initial(int argc, char **argv) * We have to keep CAP_SETUID and CAP_SETGID at this stage, so * that we can switch user away from root. * + * CAP_DAC_OVERRIDE may be required for socket setup when combined + * with --runas. + * * We have to keep some capabilities for the --netns-only case: * - CAP_SYS_ADMIN, so that we can setns() to the netns. * - Keep CAP_NET_ADMIN, so that we can configure interfaces @@ -198,7 +201,7 @@ void isolate_initial(int argc, char **argv) * isolate_prefork(). */ keep = BIT(CAP_NET_BIND_SERVICE) | BIT(CAP_SETUID) | BIT(CAP_SETGID) | - BIT(CAP_SYS_ADMIN) | BIT(CAP_NET_ADMIN); + BIT(CAP_SYS_ADMIN) | BIT(CAP_NET_ADMIN) | BIT(CAP_DAC_OVERRIDE); /* Since Linux 5.12, if we want to update /proc/self/uid_map to create * a mapping from UID 0, which only happens with pasta spawning a child -- 2.51.0

2 1

[PATCH 0/5] Refactor epoll handling in preparation for multithreading
by Laurent Vivier 09 Oct '25

09 Oct '25

This series refactors how epoll file descriptors are managed throughout the codebase in preparation for introducing multithreading support. Currently, passt uses a single global epollfd accessed through the context structure. With multithreading, each thread will have its own epollfd managing its subset of flows. The key changes are: 1. Simplify epoll_del() to take the epollfd directly rather than extracting it from the context structure, reducing tight coupling. 2. Move epoll registration out of the socket creation function (sock_l4_sa()) into protocol-specific code, giving callers explicit control over which epoll instance manages each socket. 3. Replace the boolean in_epoll flag in TCP connection structures with an epollfd field in flow_common. This serves dual purposes: tracking whether a flow is registered (zero = not registered) and which epoll instance owns it (non-zero = specific epollfd). 4. Apply this pattern consistently across all protocol handlers (TCP, ICMP, UDP), storing the managing epollfd in each flow's common structure. These changes make the epoll ownership model explicit in the flow tracking system, allowing flows to be managed by different epoll instances - a prerequisite for the per-thread epollfd design in the upcoming multithreading work. Laurent Vivier (5): util: Simplify epoll_del() interface to take epollfd directly util: Move epoll registration out of sock_l4_sa() tcp, flow: Replace per-connection in_epoll flag with epollfd in flow_common icmp: Use epollfd from flow_common structure udp: Use epollfd from flow_common structure flow.c | 12 +++++------- flow.h | 4 +++- icmp.c | 23 ++++++++++++++++++----- pif.c | 34 ++++++++++++++++++++++++++++------ tap.c | 2 +- tcp.c | 36 ++++++++++++++++++------------------ tcp_conn.h | 8 +------- tcp_splice.c | 23 +++++++++++------------ udp_flow.c | 23 ++++++++++++++++++++--- util.c | 21 ++++----------------- util.h | 4 ++-- vhost_user.c | 6 +++--- 12 files changed, 114 insertions(+), 82 deletions(-) -- 2.50.1

3 15

[PATCH] test: Update passt.mbuto and passt.mem.mbuto
by Yumei Huang 09 Oct '25

09 Oct '25

If /bin is in the PATH of host, /usr/bin may not exist in mbuto guest, which causes some binaries failing to move to /usr/bin. As a result, tests fail as binaries not found. Fix it by adding /usr/bin to DIRS. Also create the same symlink for mbuto.mem.img. Link: https://bugs.passt.top/show_bug.cgi?id=158 Fixes: f4729be7a56b("test: Update mbuto profile to fix the symlink of /bin") Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/passt.mbuto | 2 +- test/passt.mem.mbuto | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/test/passt.mbuto b/test/passt.mbuto index 231b9c9..598c254 100755 --- a/test/passt.mbuto +++ b/test/passt.mbuto @@ -33,7 +33,7 @@ LINKS="${LINKS:- dhclient /usr/sbin/dhclient sysctl /usr/sbin/sysctl}" -DIRS="${DIRS} /tmp /usr/sbin /usr/share /var/log /var/lib /etc/ssh /run/sshd /root/.ssh" +DIRS="${DIRS} /tmp /usr/sbin /usr/bin /usr/share /var/log /var/lib /etc/ssh /run/sshd /root/.ssh" COPIES="${COPIES} small.bin,/root/small.bin medium.bin,/root/medium.bin big.bin,/root/big.bin rampstream,/bin/rampstream rampstream-check.sh,/bin/rampstream-check.sh" diff --git a/test/passt.mem.mbuto b/test/passt.mem.mbuto index 532eae0..7554a43 100755 --- a/test/passt.mem.mbuto +++ b/test/passt.mem.mbuto @@ -12,7 +12,7 @@ PROGS="${PROGS:-ash,dash,bash chmod ip mount insmod mkdir ln cat chmod modprobe grep mknod sed chown sleep bc ls ps mount unshare chroot cp kill diff - head tail sort tr tee cut nm which switch_root}" + head tail sort tr tee cut nm which switch_root mv rm}" KMODS="${KMODS:- dummy}" @@ -22,12 +22,14 @@ LINKS="${LINKS:- ash,dash,bash /init ash,dash,bash /bin/sh}" -DIRS="${DIRS} /tmp /sbin" +DIRS="${DIRS} /tmp /sbin /usr/bin" COPIES="${COPIES} ../passt.avx2,/bin/passt.avx2" FIXUP="${FIXUP}"' -ln -s /bin /usr/bin +mv /bin/* /usr/bin || : +rm -rf /bin +ln -s /usr/bin /bin chmod 777 /tmp sh +m ' -- 2.47.0

3 6

[PATCH v2] tcp: Clarify logic calculating how much guest data to ack
by David Gibson 08 Oct '25

08 Oct '25

This is fairly complex, because we have a method we prefer but we need to fall back to a simpler one in a bunch of cases. Slightly reorganise the code to make the flow clearer, and add a large comment giving the rationale. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tcp.c | 72 ++++++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 46 insertions(+), 26 deletions(-) diff --git a/tcp.c b/tcp.c index 91aa3301..0f9e9b3f 100644 --- a/tcp.c +++ b/tcp.c @@ -1014,35 +1014,55 @@ int tcp_update_seqack_wnd(const struct ctx *c, struct tcp_tap_conn *conn, uint32_t new_wnd_to_tap = prev_wnd_to_tap; int s = conn->sock; - if (!bytes_acked_cap) { - conn->seq_ack_to_tap = conn->seq_from_tap; - if (SEQ_LT(conn->seq_ack_to_tap, prev_ack_to_tap)) - conn->seq_ack_to_tap = prev_ack_to_tap; - } else { - if ((unsigned)SNDBUF_GET(conn) < SNDBUF_SMALL || - tcp_rtt_dst_low(conn) || CONN_IS_CLOSING(conn) || - (conn->flags & LOCAL) || force_seq) { - conn->seq_ack_to_tap = conn->seq_from_tap; - } else if (conn->seq_ack_to_tap != conn->seq_from_tap) { - if (!tinfo) { - tinfo = &tinfo_new; - if (getsockopt(s, SOL_TCP, TCP_INFO, tinfo, &sl)) - return 0; - } - - /* This trips a cppcheck bug in some versions, including - * cppcheck 2.18.3. - * https://sourceforge.net/p/cppcheck/discussion/general/thread/fecde59085/ - */ - /* cppcheck-suppress [uninitvar,unmatchedSuppression] */ - conn->seq_ack_to_tap = tinfo->tcpi_bytes_acked + - conn->seq_init_from_tap; - - if (SEQ_LT(conn->seq_ack_to_tap, prev_ack_to_tap)) - conn->seq_ack_to_tap = prev_ack_to_tap; + /* At this point we could ack all the data we've accepted for forwarding + * (seq_from_tap). When possible, however, we want to only acknowledge + * what the peer has acknowledged. This makes it appear to the guest + * more like a direct connection to the peer, and may improve flow + * control behaviour. + * + * For it to be possible and worth it we need: + * - The TCP_INFO Linux extension which gives us the peer acked bytes + * - Not to be told not to (force_seq) + * - Not half-closed in the peer->guest direction + * With no data coming from the peer, we might not get events which + * would prompt us to recheck bytes_acked. We could poll on a + * timer, but that's more trouble than it's worth. + * - Not a host local connection + * Data goes from socket to socket, with nothing meaningfully "in + * flight". + * - Not a pseudo-local connection (e.g. to a VM on the same host) + * - Large enough send buffer + * In these cases, there's not enough in flight to bother. + */ + if (bytes_acked_cap && !force_seq && + !CONN_IS_CLOSING(conn) && + !(conn->flags & LOCAL) && !tcp_rtt_dst_low(conn) && + (unsigned)SNDBUF_GET(conn) >= SNDBUF_SMALL) { + if (!tinfo) { + tinfo = &tinfo_new; + if (getsockopt(s, SOL_TCP, TCP_INFO, tinfo, &sl)) + return 0; } + + /* This trips a cppcheck bug in some versions, including + * cppcheck 2.18.3. + * https://sourceforge.net/p/cppcheck/discussion/general/thread/fecde59085/ + */ + /* cppcheck-suppress [uninitvar,unmatchedSuppression] */ + conn->seq_ack_to_tap = tinfo->tcpi_bytes_acked + + conn->seq_init_from_tap; + } else { + /* Fall back to acknowledging everything we got */ + conn->seq_ack_to_tap = conn->seq_from_tap; } + /* It's occasionally possible for us to go from using the fallback above + * to the tcpi_bytes_acked method. In that case, we must be careful not + * to let our ACKed sequence go backwards. + */ + if (SEQ_LT(conn->seq_ack_to_tap, prev_ack_to_tap)) + conn->seq_ack_to_tap = prev_ack_to_tap; + if (!snd_wnd_cap) { tcp_get_sndbuf(conn); new_wnd_to_tap = MIN(SNDBUF_GET(conn), MAX_WINDOW); -- 2.51.0

2 1