- dev - passt

[PATCH] test: Fix printf error when debug is enabled
by Yumei Huang 30 Sep '25

30 Sep '25

Running test pasta/tcp with debug enabled would get stuck with below error: + printf 'DEBUG: ns socat -u OPEN:__BASEPATH__/big.bin TCP6:[__GW6__%__IFNAME__]:10003\n' lib/term: line 38: printf: `_': invalid format character The error occurs because printf interprets the % character as the start of a format specifier, and the following '_' isn't one of them. Fix it by replacing 'printf "${*}\n"' with 'printf "%s\n" "$*"'. Also update the docstring. Link: https://bugs.passt.top/show_bug.cgi?id=154 Fixes: de28c20d8051 ("test: Update lib/term for clearer output when DEBUG is enabled") Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/lib/term | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/test/lib/term b/test/lib/term index 6400746..2293474 100755 --- a/test/lib/term +++ b/test/lib/term @@ -29,32 +29,32 @@ PR_NC='\033[0m' PR_DELAY_INIT=100 # ms # info() - Highlight test log pane, print message to it and to log file -# $@: Message to print +# $*: Message to print info() { tmux select-pane -t ${PANE_INFO} - printf "${*}\n" >> $STATEBASE/log_pipe - printf "${*}\n" >> "${LOGFILE}" + printf "%s\n" "$*" >> $STATEBASE/log_pipe + printf "%s\n" "$*" >> "${LOGFILE}" } # info_n() - Highlight, print message to pane and to log file without newline -# $@: Message to print +# $*: Message to print info_n() { tmux select-pane -t ${PANE_INFO} - printf "${*}" >> $STATEBASE/log_pipe - printf "${*}" >> "${LOGFILE}" + printf "%s\n" "$*" >> $STATEBASE/log_pipe + printf "%s\n" "$*" >> "${LOGFILE}" } # info_nolog() - Highlight test log pane, print message to it -# $@: Message to print +# $*: Message to print info_nolog() { tmux select-pane -t ${PANE_INFO} - printf "${*}\n" >> $STATEBASE/log_pipe + printf "%s\n" "$*" >> $STATEBASE/log_pipe } # info_nolog() - Print message to log file -# $@: Message to print +# $*: Message to print log() { - printf "${*}\n" >> "${LOGFILE}" + printf "%s\n" "$*" >> "${LOGFILE}" } # info_nolog_n() - Send message to pane without highlighting it, without newline @@ -363,8 +363,8 @@ status_test_start() { info_check() { switch_pane ${PANE_INFO} - printf "${PR_YELLOW}?${PR_NC} ${*}" >> $STATEBASE/log_pipe - printf "? ${*}" >> "${LOGFILE}" + printf "%s" "${PR_YELLOW}?${PR_NC} ${*}" >> $STATEBASE/log_pipe + printf "? %s" "${*}" >> "${LOGFILE}" } # info_check_passed() - Display and log a new line when a check passes -- 2.47.0

3 5

[PATCH 0/2] Retry SYNs for inbound connections
by Yumei Huang 30 Sep '25

30 Sep '25

When a client connects, SYN would be sent to guest only once. If the guest is not connected or ready at that time, the connection will be reset in 10s. These patches introduce the SYN retry mechanism similar to retransmits. Tested two scenarios: 1) A guest is connected in a few seconds, the client connects to the guest successfully. 2) No guest connects at all, the client gets "Connection reset" in 80s. Also ran the testsuits, no regression issue introduced. Yumei Huang (2): tcp: Rename "retrans" of struct tcp_tap_conn and tcp_tap_transfer tcp: Resend SYN for inbound connections tcp.c | 21 ++++++++++++++------- tcp_conn.h | 8 ++++---- 2 files changed, 18 insertions(+), 11 deletions(-) -- 2.47.0

3 8

[PATCH v9 0/9] Use true MAC address of LAN local remote hosts
by Jon Maloy 30 Sep '25

30 Sep '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. --- v3: Updated according to feedback from Stefano and David: - Made the ARP/NDP lookup call filter out the requested address by itself, qualified by the index if the template interface - Moved the flow specific MAC address from struct flowside to struct flow_common. v4: - Updated according to feedback from David and Stefan - Added a cache table for ARP/NDP table contents v5: - Updated according to feedback from David and Stefan - Added cache table entries to FIFO/LRU queue - New criteria for when to consult ARP/NDP v6: - Simplified and merged mac cache table commits - Other changes after feedback from David. v7: - Fixes in patch #2 based on feedback from David and Stefano. v8: - Redesigned netlink and cache table part to be based on a subscription model. v8: - Small fix to patch #2 so that we cover the case when a MAC addess for a host has changed. - Added a commit where we send a gratuitous ARP/ unsolicitated NA to the guest when a new host is added to the neighbour cache table. Jon Maloy (8): netlink: add subsciption on changes in NDP/ARP table fwd: Add cache table for ARP/NDP contents arp/ndp: respond with true MAC address of LAN local remote hosts flow: add MAC address of LAN local remote hosts to flow udp: forward external source MAC address through tap interface tcp: forward external source MAC address through tap interface tap: change signature of function tap_push_l2h() icmp: let icmp use mac address from flowside structure arp.c | 9 ++- conf.c | 1 + epoll_type.h | 2 + flow.c | 2 + flow.h | 2 + fwd.c | 167 +++++++++++++++++++++++++++++++++++++++++++++++-- fwd.h | 9 +++ icmp.c | 8 ++- inany.c | 1 + ndp.c | 10 ++- netlink.c | 119 +++++++++++++++++++++++++++++++++++ netlink.h | 4 ++ passt.c | 17 +++-- passt.h | 3 +- pasta.c | 2 +- tap.c | 24 ++++--- tap.h | 7 ++- tcp.c | 18 ++++-- tcp.h | 2 +- tcp_buf.c | 37 +++++------ tcp_internal.h | 4 +- tcp_vu.c | 5 +- udp.c | 57 ++++++++++------- udp.h | 2 +- 24 files changed, 429 insertions(+), 83 deletions(-) -- 2.50.1

3 33

[PATCH v2] test: Update README.md
by Yumei Huang 30 Sep '25

30 Sep '25

Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/README.md | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) diff --git a/test/README.md b/test/README.md index 91ca603..0df7533 100644 --- a/test/README.md +++ b/test/README.md @@ -32,7 +32,7 @@ Example for Debian, and possibly most Debian-based distributions: git go iperf3 isc-dhcp-common jq libgpgme-dev libseccomp-dev linux-cpupower lm-sensors lz4 netavark netcat-openbsd psmisc qemu-efi-aarch64 qemu-system-arm qemu-system-misc qemu-system-ppc qemu-system-x86 - qemu-system-x86 sipcalc socat strace tmux uidmap valgrind + sipcalc socat strace tmux uidmap valgrind NOTE: the tests need a qemu version >= 7.2, or one that contains commit 13c6be96618c ("net: stream: add unix socket"): this change introduces support @@ -81,7 +81,12 @@ The following additional packages are commonly needed: ## Regular test -Just issue: +Before running the tests, you need to prepare the required assets: + + cd test + make assets + +Then issue: ./run @@ -91,6 +96,32 @@ variable settings: DEBUG=1 enables debugging messages, TRACE=1 enables tracing PCAP=1 TRACE=1 ./run +**Note:** + +* Don't run the tests as root, the whole point of passt is not to run as root. + +* If you switch users before running the tests, you may hit "Permission denied" + error. It's probably due to + [Bug 967509](https://bugzilla.redhat.com/show_bug.cgi?id=967509). + If you switch users with `su` or `sudo`, the directory `/run/user/ID` may + not be created, and `XDG_RUNTIME_DIR` points to the /run/user directory of + the previous user rather than the target user. + + **Workaround:** Log out and log back in as the intended user to ensure the + correct runtime directory is set up. Or use `machinectl shell --uid=$user`. + +* SELinux may prevent the tests from running correctly. To avoid this, + temporarily disable it by running: + + setenforce 0 + +* Some tests require a QEMU version >= 10.0.0, or a build that includes the + following commits: + + 60f543ad917f ("virtio-net: vhost-user: Implement internal migration") + 3f65357313e0 ("vhost: Add stubs for the migration state transfer + interface") + ## Running selected tests Rudimentary support to run a list of selected tests, without support for -- 2.47.0

3 2

[PATCH] test: Update lib/term for clearer output when DEBUG is enabled
by Yumei Huang 28 Sep '25

28 Sep '25

When running tests with DEBUG=1, we used to get some "DEBUG:DEBUG:DEBUG:" in logs, which is not very helpful for debugging. With this patch, the log would show the steps like below: DEBUG: g1tools ip jq dhclient socat cat DEBUG: htools ip jq DEBUG: DEBUG: set MAP_HOST4 192.0.2.1 DEBUG: set MAP_HOST6 2001:db8:9a55::1 Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/lib/term | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/test/lib/term b/test/lib/term index 089364c..6400746 100755 --- a/test/lib/term +++ b/test/lib/term @@ -32,29 +32,29 @@ PR_DELAY_INIT=100 # ms # $@: Message to print info() { tmux select-pane -t ${PANE_INFO} - printf "${@}\n" >> $STATEBASE/log_pipe - printf "${@}\n" >> "${LOGFILE}" + printf "${*}\n" >> $STATEBASE/log_pipe + printf "${*}\n" >> "${LOGFILE}" } # info_n() - Highlight, print message to pane and to log file without newline # $@: Message to print info_n() { tmux select-pane -t ${PANE_INFO} - printf "${@}" >> $STATEBASE/log_pipe - printf "${@}" >> "${LOGFILE}" + printf "${*}" >> $STATEBASE/log_pipe + printf "${*}" >> "${LOGFILE}" } # info_nolog() - Highlight test log pane, print message to it # $@: Message to print info_nolog() { tmux select-pane -t ${PANE_INFO} - printf "${@}\n" >> $STATEBASE/log_pipe + printf "${*}\n" >> $STATEBASE/log_pipe } # info_nolog() - Print message to log file # $@: Message to print log() { - printf "${@}\n" >> "${LOGFILE}" + printf "${*}\n" >> "${LOGFILE}" } # info_nolog_n() - Send message to pane without highlighting it, without newline @@ -363,8 +363,8 @@ status_test_start() { info_check() { switch_pane ${PANE_INFO} - printf "${PR_YELLOW}?${PR_NC} ${@}" >> $STATEBASE/log_pipe - printf "? ${@}" >> "${LOGFILE}" + printf "${PR_YELLOW}?${PR_NC} ${*}" >> $STATEBASE/log_pipe + printf "? ${*}" >> "${LOGFILE}" } # info_check_passed() - Display and log a new line when a check passes -- 2.47.0

3 4

[PATCH v10 0/9] Use true MAC address of LAN local remote hosts
by Jon Maloy 27 Sep '25

27 Sep '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. --- v3: Updated according to feedback from Stefano and David: - Made the ARP/NDP lookup call filter out the requested address by itself, qualified by the index if the template interface - Moved the flow specific MAC address from struct flowside to struct flow_common. v4: - Updated according to feedback from David and Stefan - Added a cache table for ARP/NDP table contents v5: - Updated according to feedback from David and Stefan - Added cache table entries to FIFO/LRU queue - New criteria for when to consult ARP/NDP v6: - Simplified and merged mac cache table commits - Other changes after feedback from David. v7: - Fixes in patch #2 based on feedback from David and Stefano. v8: - Redesigned netlink and cache table part to be based on a subscription model. v8: - Small fix to patch #2 so that we cover the case when a MAC addess for a host has changed. - Added a commit where we send a gratuitous ARP/ unsolicitated NA to the guest when a new host is added to the neighbour cache table. c10: - Some fixes after feedback from David Gibson - Reordered: Moved patch #9 to position #3. - Added synchronization step between ARP/NDP table contents and the neigbour table at initialization. This reduces the number of "false" ARP/NDP replies drastically, but not completly. - (Next step could be to scan over the flow table and update affeced entries when we receive a MAC address update.) Jon Maloy (8): netlink: add subsciption on changes in NDP/ARP table fwd: Add cache table for ARP/NDP contents arp/ndp: respond with true MAC address of LAN local remote hosts flow: add MAC address of LAN local remote hosts to flow udp: forward external source MAC address through tap interface tcp: forward external source MAC address through tap interface tap: change signature of function tap_push_l2h() icmp: let icmp use mac address from flowside structure arp.c | 9 ++- conf.c | 1 + epoll_type.h | 2 + flow.c | 2 + flow.h | 2 + fwd.c | 167 +++++++++++++++++++++++++++++++++++++++++++++++-- fwd.h | 9 +++ icmp.c | 8 ++- inany.c | 1 + ndp.c | 10 ++- netlink.c | 119 +++++++++++++++++++++++++++++++++++ netlink.h | 4 ++ passt.c | 17 +++-- passt.h | 3 +- pasta.c | 2 +- tap.c | 24 ++++--- tap.h | 7 ++- tcp.c | 18 ++++-- tcp.h | 2 +- tcp_buf.c | 37 +++++------ tcp_internal.h | 4 +- tcp_vu.c | 5 +- udp.c | 57 ++++++++++------- udp.h | 2 +- 24 files changed, 429 insertions(+), 83 deletions(-) -- 2.50.1

1 9

[PATCH] test: Update mbuto profile to fix the symlink of /bin
by Yumei Huang 26 Sep '25

26 Sep '25

When running test 'migrate/rampstream_out' on fedora, test fails with error like this: guest_1$ socat -u EXEC:"rampstream send 6000000" TCP4:192.0.2.1:10006 2025/09/24 04:06:12 socat[405] E execvp("rampstream", "rampstream", "send", "6000000", ...): No such file or directory It's because on fedora, /bin is not in the PATH, and some binaries are under /usr/bin. mbuto will find the binaries on the host and put them into the guest under same directories. As a result, /usr/bin in mbuto guest are not empty, causing creating /usr/bin symlink failed. Thus, the script 'rampstream' under /bin is not found during testing. This patch fixes the issue and creates the symlink for consistency with /sbin. Link: https://bugs.passt.top/show_bug.cgi?id=151 Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/passt.mbuto | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/passt.mbuto b/test/passt.mbuto index 176cf3f..231b9c9 100755 --- a/test/passt.mbuto +++ b/test/passt.mbuto @@ -64,7 +64,9 @@ set >> \$LOG exit 0 EOF chmod 755 /sbin/dhclient-script - ln -s /bin /usr/bin + mv /bin/* /usr/bin || : + rm -rf /bin + ln -s /usr/bin /bin ln -s /run /var/run :> /etc/fstab -- 2.47.0

2 1

[PATCH v2] test: fix 'make assets' failure as root
by Yumei Huang 26 Sep '25

26 Sep '25

Running `make assets` under `test` as root fails with a "Permission denied" error when `prepare-distro-img.sh` invokes `virt-edit` and `guestfish`. This is due to a known bug in libvirt. Work around the issue by switching to the direct backend. Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/prepare-distro-img.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/test/prepare-distro-img.sh b/test/prepare-distro-img.sh index 0d967c9..be2386e 100755 --- a/test/prepare-distro-img.sh +++ b/test/prepare-distro-img.sh @@ -3,6 +3,10 @@ IMG="$1" PASST_FILES="$(echo ../*.c ../*.h ../*.sh ../*.1 ../Makefile ../README.md)" +# This is just a workaround for Fedora and related distributions. +# Once it gets fixed, we can drop this. +export LIBGUESTFS_BACKEND=direct + virt-edit -a $IMG /lib/systemd/system/serial-getty@.service -e 's/ExecStart=.*/ExecStart=\/sbin\/agetty --autologin root -8 --keep-baud 115200,38400,9600 %I $TERM/g' guestfish --rw -a $IMG -i <<EOF -- 2.47.0

3 2

[PATCH] test: fix 'make assets' failure as root
by Yumei Huang 26 Sep '25

26 Sep '25

Running `make assets` under `test` as root fails with a "Permission denied" error when `prepare-distro-img.sh` invokes `virt-edit` and `guestfish`. This is due to a known bug in libvirt. Work around the issue by switching to the direct backend. Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/prepare-distro-img.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/prepare-distro-img.sh b/test/prepare-distro-img.sh index 0d967c9..423eea7 100755 --- a/test/prepare-distro-img.sh +++ b/test/prepare-distro-img.sh @@ -3,6 +3,8 @@ IMG="$1" PASST_FILES="$(echo ../*.c ../*.h ../*.sh ../*.1 ../Makefile ../README.md)" +export LIBGUESTFS_BACKEND=direct + virt-edit -a $IMG /lib/systemd/system/serial-getty@.service -e 's/ExecStart=.*/ExecStart=\/sbin\/agetty --autologin root -8 --keep-baud 115200,38400,9600 %I $TERM/g' guestfish --rw -a $IMG -i <<EOF -- 2.47.0

4 6

[PATCH v2] tap: Drop frames if no client connected
by Yumei Huang 25 Sep '25

25 Sep '25

If no client is attached, discard outgoing frames and report them as sent. Without this we will get an EBADF in either writev() (pasta) or sendmsg() (passt). That's basically harmless, but a bit ugly. Explicitly catching this case results in behaviour that's probably a bit clearer to debug if we hit it. There are several different approaches we can take here. Here's some reasoning as David explained: * Don't listen() until the tap connection is ready - It's not clear that the host rejecting the connection is better than the host accepting, then the connection stalling until the guest is ready. - Would require substantial rework because we currently listen() as we parse the command line and don't store the information we'd need to do it later. * Don't accept() until the tap connection is ready - To the peer, will behave basically the same as this patch - the host will complete the TCP handshake, then the connection will stall until the guest is ready. - More work to implement, because essentially every sock-side handler has to check fd_tap and abort early * Drop packets in tap_send_frames(), but return 0 - To the peer, would behave basically the same - Would make the TCP code do a bunch of busy work attempting to resend, probably to no avail - Handling of errors returned by tap_send_frames() is on the basis that it's probably a transient fault (buffer full) and we want to resend very soon. That approach doesn't make sense for a missing guest. Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- tap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tap.c b/tap.c index 7ba6399..2e371b3 100644 --- a/tap.c +++ b/tap.c @@ -507,13 +507,16 @@ static size_t tap_send_frames_passt(const struct ctx *c, * @iov must have total length @bufs_per_frame * @nframes, with each set of * @bufs_per_frame contiguous buffers representing a single frame. * - * Return: number of frames actually sent + * Return: number of frames actually sent, or accounted as sent */ size_t tap_send_frames(const struct ctx *c, const struct iovec *iov, size_t bufs_per_frame, size_t nframes) { size_t m; + if (c->fd_tap == -1) + return nframes; + if (!nframes) return 0; -- 2.47.0

3 2