- dev - passt

[PATCH v9 00/30] Introduce discontiguous frames management
by Laurent Vivier 13 Aug '25

13 Aug '25

This series introduces iov_tail to convey frame information between functions. v9: - address comments from David v8: - rebase - rework the two last patches to store the iovec in the p->pkt array v7: - Add a patch to fix comment style of 'Return:' - Fix ignore_arp()/accept_arp() - Fix coverity error - Fix several comments v6: - Replaced iov_slice() with the clearer iov_tail_clone() for creating iovec subsets. - Standardized local header variable names (to *_storage suffix). - Renamed functions for better semantics (e.g., ignore_arp to accept_arp, packet_data to packet_get). - Corrected OPTLEN_MAX definition in TCP. - Addressed minor logic issues (e.g., DHCPv6 FQDN flags, NDP null check). - Updated ipv6_l4hdr() return type to boolean. - Improved comments and documentation across several modules. v5: - store in the pool iovec array with several entries v4: Prepare to introduce iovec array in the pool: - passe iov_tail rather than pool to ndp,icmp, dhcp, dhcpv6 and arp - remove unused pool macros - add memory regions in the pool structure, this will allow us to use the buf pointer to store the iovec array for vhost-user v3: Address comments from David Laurent Vivier (30): arp: Don't mix incoming and outgoing buffers iov: Introduce iov_tail_clone() and iov_tail_drop(). iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_data() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail packet: rename packet_data() to packet_get() arp: use iov_tail rather than pool dhcp: use iov_tail rather than pool dhcpv6: use iov_tail rather than pool icmp: use iov_tail rather than pool ndp: use iov_tail rather than pool packet: remove PACKET_POOL() and PACKET_POOL_P() packet: remove unused parameter from PACKET_POOL_DECL() packet: Refactor vhost-user memory region handling packet: Add support for multi-vector packets arp.c | 86 +++++++++++++------- arp.h | 2 +- dhcp.c | 48 ++++++----- dhcp.h | 2 +- dhcpv6.c | 223 +++++++++++++++++++++++++++++++-------------------- dhcpv6.h | 2 +- icmp.c | 40 +++++---- icmp.h | 2 +- iov.c | 102 ++++++++++++++++++++--- iov.h | 58 ++++++++++---- ip.c | 33 ++++---- ip.h | 3 +- ndp.c | 16 +++- ndp.h | 4 +- packet.c | 142 +++++++++++++++++--------------- packet.h | 45 ++++------- pcap.c | 1 + tap.c | 119 +++++++++++++++------------ tap.h | 4 +- tcp.c | 61 +++++++++----- tcp_buf.c | 2 +- udp.c | 33 +++++--- vhost_user.c | 28 +++---- virtio.c | 4 +- virtio.h | 18 ++++- vu_common.c | 48 ++++------- 26 files changed, 691 insertions(+), 435 deletions(-) -- 2.49.0

2 41

passt: new version 2025_08_05.309eefd available
by Stefano Brivio 06 Aug '25

06 Aug '25

The new version with tag 2025_08_05.309eefd includes the following changes: 309eefd selinux: pasta accesses /etc/resolv.conf a878286 treewide: By default, don't quit source after migration, keep sockets open 79de81e test: Deal with /bin, /sbin unification in Fedora 3757ea3 style: Add parentheses to function names in comments 9e0423e style: Fix 'Return' comment style https://passt.top/passt/log/?qt=range&q=2025_06_11.0293c6f..2025_08_05.309e… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9381856/ permanent mirror: https://passt.top/builds/copr/0^20250805.g309eefd/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g309eefd-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_309eefd-1_all.deb -- Stefano

1 0

[PATCH v3 0/8] use true MAC address of LAN local remote hosts
by Jon Maloy 06 Aug '25

06 Aug '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. --- v3: Updated according to feedback from Stefano and David: - Made the ARP/NDP lookup call filter out the requested address by itself, qualified by the index if the template interface - Moved the flow specific MAC address from struct flowside to struct flow_common. Jon Maloy (8): netlink: Add function to extract MAC addresses from NDP/ARP table arp/ndp: respond with true MAC address of LAN local remote hosts flow: add MAC address of LAN local remote hosts to flow udp: forward external source MAC address through tap interface tcp: forward external source MAC address through tap interface tap: change signature of function tap_push_l2h() tcp: make tcp_rst_no_conn() respond with correct MAC address icmp: let icmp use mac address from flowside structure arp.c | 9 ++++++++ flow.c | 21 ++++++++++++++++- flow.h | 2 ++ fwd.c | 2 +- fwd.h | 3 ++- icmp.c | 4 ++-- inany.c | 15 ++++++++++++ inany.h | 1 + ndp.c | 11 ++++++++- netlink.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++ netlink.h | 2 ++ tap.c | 24 +++++++++++-------- tap.h | 7 +++--- tcp.c | 22 +++++++++++++++--- tcp_buf.c | 27 +++++++++++----------- tcp_internal.h | 2 +- tcp_vu.c | 5 ++-- udp.c | 49 +++++++++++++++++++++------------------ 18 files changed, 207 insertions(+), 61 deletions(-) -- 2.48.1

3 20

[PATCH] selinux: pasta accesses /etc/resolv.conf
by Cathy Hu 05 Aug '25

05 Aug '25

From: Cathy Hu <cathy.hu(a)suse.com> pasta accesses /etc/resolv.conf, which needs search permissions Adresses: ---- time->Fri Jul 25 15:57:16 2025 type=AVC msg=audit(1753451836.581:16831): avc: denied { search } for pid=44182 comm="pasta" name="netconfig" dev="tmpfs" ino=2449 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir permissive=0 ---- time->Fri Jul 25 15:58:10 2025 type=AVC msg=audit(1753451890.317:17123): avc: denied { search } for pid=45022 comm="pasta" name="netconfig" dev="tmpfs" ino=2449 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir permissive=0 ---- time->Fri Jul 25 16:01:53 2025 type=AVC msg=audit(1753452113.557:17289): avc: denied { search } for pid=45999 comm="pasta" name="netconfig" dev="tmpfs" ino=2449 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir permissive=0 --- contrib/selinux/pasta.te | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 9440d05..c0a1e9b 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -159,10 +159,11 @@ logging_send_syslog_msg(pasta_t) allow syslogd_t self:cap_userns sys_ptrace; allow pasta_t proc_net_t:file { open read }; -allow pasta_t net_conf_t:file { open read }; allow pasta_t self:netlink_route_socket { bind create nlmsg_read nlmsg_write setopt read write }; kernel_search_network_sysctl(pasta_t) +sysnet_read_config(pasta_t) + allow pasta_t tmp_t:sock_file { create unlink write }; allow pasta_t self:tcp_socket create_stream_socket_perms; @@ -221,7 +222,6 @@ allow pasta_t kernel_t:system module_request; allow pasta_t proc_t:dir mounton; allow pasta_t proc_t:filesystem mount; -allow pasta_t net_conf_t:lnk_file read; allow pasta_t proc_net_t:lnk_file read; allow pasta_t unconfined_t:process { noatsecure rlimitinh siginh }; -- 2.50.1

2 3

[RFC v2 00/11] Add vhost-net kernel support
by Eugenio Pérez 04 Aug '25

04 Aug '25

vhost-net is a kernel device that allows to read packets from a tap device using virtio queues instead of regular read(2) and write(2). This enables a more eficient packet processing, as the memory can be written directly by the kernel to the userspace and back, instead of wasting bandwith on copies, and it enables to batch many packets in a single notification (through eventfds) both tx and rx. Namespace tx performance improves from ~26.3Gbit/s to ~36.9Gbit/s. Namespace rx performance improves from ~16BGbit/s to ~17.26Gbit/s. RFC: At this moment only these are supported: * Receive l2 packets from the vhost kernel to pasta * Send l4 tcp socket received data through vhost-kernel to namespace. TODO: Add vhost zerocopy in the tests, and compare with veth. TODO: Implement at least UDP tx. Or maybe we want UDP to be write(2) because of latency? TODO: Check style for variable declarations in for loops and use of curly brackets as long as they wrap more than a line. TODO: kerneldoc style function header comments -- v2: Add TCP tx, and integrated some comments from the previous series. Please check each patch message for details. Eugenio Pérez (11): tap: implement vhost_call_cb tap: add die() on vhost error Replace tx tap hdr with virtio_nethdr_mrg_rxbuf tcp: export memory regions to vhost virtio: Fill .next in tx queue tap: move static iov_sock to tcp_buf_data_from_sock tap: support tx through vhost tap: add tap_free_old_xmit tcp: start conversion to circular buffer Add poll(2) to used_idx tcp_buf: adding TCP tx circular buffer arp.c | 2 +- epoll_type.h | 4 + passt.c | 12 +- passt.h | 11 +- tap.c | 489 +++++++++++++++++++++++++++++++++++++++++++++++++-- tap.h | 13 +- tcp.c | 2 +- tcp_buf.c | 179 +++++++++++++++---- tcp_buf.h | 19 ++ udp.c | 2 +- 10 files changed, 675 insertions(+), 58 deletions(-) -- 2.50.0

4 45

[PATCH v3] treewide: By default, don't quit source after migration, keep sockets open
by Stefano Brivio 28 Jul '25

28 Jul '25

We are hitting an issue in the KubeVirt integration where some data is still sent to the source instance even after migration is complete. As we exit, the kernel closes our sockets and resets connections. The resulting RST segments are sent to peers, effectively terminating connections that were meanwhile migrated. At the moment, this is not done intentionally, but in the future KubeVirt might enable OVN-Kubernetes features where source and destination nodes are explicitly getting mirrored traffic for a while, in order to decrease migration downtime. By default, don't quit after migration is completed on the source: the previous behaviour can be enabled with the new, but deprecated, --migrate-exit option. After migration (as source), the -1 / --one-off option has no effect. Also, by default, keep migrated TCP sockets open (in repair mode) as long as we're running, and ignore events on any epoll descriptor representing data channels. The previous behaviour can be enabled with the new, equally deprecated, --migrate-no-linger option. By keeping sockets open, and not exiting, we prevent the kernel running on the source node to send out RST segments if further data reaches us. Reported-by: Nir Dothan <ndothan(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: - assorted changes in commit message - context variable ignore_linger becomes ignore_no_linger - new options are deprecated - don't ignore events on some descriptors, drop them from epoll v3: - Nir reported occasional failures (connections being reset) with both v1 and v2, because, in KubeVirt's usage, we quit as QEMU exits. Disable --one-off after migration as source, and document this exception conf.c | 22 ++++++++++++++++++++++ flow.c | 2 +- passt.1 | 29 +++++++++++++++++++++++++++++ passt.h | 4 ++++ tcp.c | 9 +++++++-- tcp_conn.h | 3 ++- test/lib/setup | 4 ++-- vhost_user.c | 9 +++++++-- 8 files changed, 74 insertions(+), 8 deletions(-) diff --git a/conf.c b/conf.c index 6c747aa..f47f48e 100644 --- a/conf.c +++ b/conf.c @@ -864,6 +864,14 @@ static void usage(const char *name, FILE *f, int status) FPRINTF(f, " --repair-path PATH path for passt-repair(1)\n" " default: append '.repair' to UNIX domain path\n"); + FPRINTF(f, + " --migrate-exit DEPRECATED:\n" + " source quits after migration\n" + " default: source keeps running after migration\n"); + FPRINTF(f, + " --migrate-no-linger DEPRECATED:\n" + " close sockets on migration\n" + " default: keep sockets open, ignore events\n"); } FPRINTF(f, @@ -1470,6 +1478,8 @@ void conf(struct ctx *c, int argc, char **argv) {"socket-path", required_argument, NULL, 's' }, {"fqdn", required_argument, NULL, 27 }, {"repair-path", required_argument, NULL, 28 }, + {"migrate-exit", no_argument, NULL, 29 }, + {"migrate-no-linger", no_argument, NULL, 30 }, { 0 }, }; const char *optstring = "+dqfel:hs:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1686,6 +1696,18 @@ void conf(struct ctx *c, int argc, char **argv) optarg)) die("Invalid passt-repair path: %s", optarg); + break; + case 29: + if (c->mode != MODE_VU) + die("--migrate-exit is for vhost-user mode only"); + c->migrate_exit = true; + + break; + case 30: + if (c->mode != MODE_VU) + die("--migrate-no-linger is for vhost-user mode only"); + c->migrate_no_linger = true; + break; case 'd': c->debug = 1; diff --git a/flow.c b/flow.c index 00885f6..feefda3 100644 --- a/flow.c +++ b/flow.c @@ -1091,7 +1091,7 @@ int flow_migrate_source(struct ctx *c, const struct migrate_stage *stage, * as EIO). */ foreach_established_tcp_flow(flow) { - rc = tcp_flow_migrate_source_ext(fd, &flow->tcp); + rc = tcp_flow_migrate_source_ext(c, fd, &flow->tcp); if (rc) { flow_err(flow, "Can't send extended data: %s", strerror_(-rc)); diff --git a/passt.1 b/passt.1 index 60066c2..cef98b2 100644 --- a/passt.1 +++ b/passt.1 @@ -439,6 +439,30 @@ Default, for \-\-vhost-user mode only, is to append \fI.repair\fR to the path chosen for the hypervisor UNIX domain socket. No socket is created if not in \-\-vhost-user mode. +.TP +.BR \-\-migrate-exit (DEPRECATED) +Exit after a completed migration as source. By default, \fBpasst\fR keeps +running and the migrated guest can continue using its connection, or a new guest +can connect. + +Note that this configuration option is \fBdeprecated\fR and will be removed in a +future version. It is not expected to be of any use, and it simply reflects a +legacy behaviour. If you have any use for this, refer to \fBREPORTING BUGS\fR +below. + +.TP +.BR \-\-migrate-no-linger (DEPRECATED) +Close TCP sockets on the source instance once migration completes. + +By default, sockets are kept open, and events on data sockets are ignored, so +that any further message reaching sockets after the source migrated is silently +ignored, to avoid connection resets in case data is received after migration. + +Note that this configuration option is \fBdeprecated\fR and will be removed in a +future version. It is not expected to be of any use, and it simply reflects a +legacy behaviour. If you have any use for this, refer to \fBREPORTING BUGS\fR +below. + .TP .BR \-F ", " \-\-fd " " \fIFD Pass a pre-opened, connected socket to \fBpasst\fR. Usually the socket is opened @@ -454,6 +478,11 @@ is closed. Quit after handling a single client connection, that is, once the client closes the socket, or once we get a socket error. +\fBNote\fR: this option has no effect after \fBpasst\fR completes a migration as +source, because, in that case, exiting would close sockets for active +connections, which would in turn cause connection resets if any further data is +received. See also the description of \fI\-\-migrate-no-linger\fR. + .TP .BR \-t ", " \-\-tcp-ports " " \fIspec Configure TCP port forwarding to guest. \fIspec\fR can be one of: diff --git a/passt.h b/passt.h index 8693794..4cfd6eb 100644 --- a/passt.h +++ b/passt.h @@ -241,6 +241,8 @@ struct ip6_ctx { * @device_state_fd: Device state migration channel * @device_state_result: Device state migration result * @migrate_target: Are we the target, on the next migration request? + * @migrate_no_linger: Close sockets as we migrate them + * @migrate_exit: Exit (on source) once migration is complete */ struct ctx { enum passt_modes mode; @@ -318,6 +320,8 @@ struct ctx { int device_state_fd; int device_state_result; bool migrate_target; + bool migrate_no_linger; + bool migrate_exit; }; void proto_update_l2_buf(const unsigned char *eth_d, diff --git a/tcp.c b/tcp.c index 2b88466..b10ad8a 100644 --- a/tcp.c +++ b/tcp.c @@ -3286,12 +3286,14 @@ int tcp_flow_migrate_source(int fd, struct tcp_tap_conn *conn) /** * tcp_flow_migrate_source_ext() - Dump queues, close sockets, send final data + * @c: Execution context * @fd: Descriptor for state migration * @conn: Pointer to the TCP connection structure * * Return: 0 on success, negative (not -EIO) on failure, -EIO on sending failure */ -int tcp_flow_migrate_source_ext(int fd, const struct tcp_tap_conn *conn) +int tcp_flow_migrate_source_ext(struct ctx *c, + int fd, const struct tcp_tap_conn *conn) { uint32_t peek_offset = conn->seq_to_tap - conn->seq_ack_from_tap; struct tcp_tap_transfer_ext *t = &migrate_ext[FLOW_IDX(conn)]; @@ -3336,7 +3338,10 @@ int tcp_flow_migrate_source_ext(int fd, const struct tcp_tap_conn *conn) if ((rc = tcp_flow_dump_seq(conn, &t->seq_rcv))) goto fail; - close(s); + if (c->migrate_no_linger) + close(s); + else + epoll_del(c, s); /* Adjustments unrelated to FIN segments: sequence numbers we dumped are * based on the end of the queues. diff --git a/tcp_conn.h b/tcp_conn.h index 35d813d..d49ae88 100644 --- a/tcp_conn.h +++ b/tcp_conn.h @@ -236,7 +236,8 @@ int tcp_flow_repair_on(struct ctx *c, const struct tcp_tap_conn *conn); int tcp_flow_repair_off(struct ctx *c, const struct tcp_tap_conn *conn); int tcp_flow_migrate_source(int fd, struct tcp_tap_conn *conn); -int tcp_flow_migrate_source_ext(int fd, const struct tcp_tap_conn *conn); +int tcp_flow_migrate_source_ext(struct ctx *c, int fd, + const struct tcp_tap_conn *conn); int tcp_flow_migrate_target(struct ctx *c, int fd); int tcp_flow_migrate_target_ext(struct ctx *c, struct tcp_tap_conn *conn, int fd); diff --git a/test/lib/setup b/test/lib/setup index 575bc21..5994598 100755 --- a/test/lib/setup +++ b/test/lib/setup @@ -350,7 +350,7 @@ setup_migrate() { sleep 1 - __opts="--vhost-user" + __opts="--vhost-user --migrate-exit --migrate-no-linger" [ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_1.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" @@ -360,7 +360,7 @@ setup_migrate() { context_run_bg passt_repair_1 "./passt-repair ${STATESETUP}/passt_1.socket.repair" - __opts="--vhost-user" + __opts="--vhost-user --migrate-exit --migrate-no-linger" [ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_2.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" diff --git a/vhost_user.c b/vhost_user.c index e7fb049..c1522d5 100644 --- a/vhost_user.c +++ b/vhost_user.c @@ -1207,7 +1207,12 @@ void vu_control_handler(struct vu_dev *vdev, int fd, uint32_t events) if (vmsg.hdr.request == VHOST_USER_CHECK_DEVICE_STATE && vdev->context->device_state_result == 0 && !vdev->context->migrate_target) { - info("Migration complete, exiting"); - _exit(EXIT_SUCCESS); + if (vdev->context->migrate_exit) { + info("Migration complete, exiting"); + _exit(EXIT_SUCCESS); + } + + info("Migration complete"); + vdev->context->one_off = false; } } -- 2.43.0

2 5

[PATCH v7 00/31] Introduce discontiguous frames management
by Laurent Vivier 25 Jul '25

25 Jul '25

This series introduces iov_tail to convey frame information between functions. This is only an API change, for the moment the memory pool is only able to store contiguous buffer, so, except for vhost-user in a special case, we only play with iovec array with only one entry. v7: - Add a patch to fix comment style of 'Return:' - Fix ignore_arp()/accept_arp() - Fix coverity error - Fix several comments v6: - Replaced iov_slice() with the clearer iov_tail_clone() for creating iovec subsets. - Standardized local header variable names (to *_storage suffix). - Renamed functions for better semantics (e.g., ignore_arp to accept_arp, packet_data to packet_get). - Corrected OPTLEN_MAX definition in TCP. - Addressed minor logic issues (e.g., DHCPv6 FQDN flags, NDP null check). - Updated ipv6_l4hdr() return type to boolean. - Improved comments and documentation across several modules. v5: - store in the pool iovec array with several entries v4: Prepare to introduce iovec array in the pool: - passe iov_tail rather than pool to ndp,icmp, dhcp, dhcpv6 and arp - remove unused pool macros - add memory regions in the pool structure, this will allow us to use the buf pointer to store the iovec array for vhost-user v3: Address comments from David Laurent Vivier (31): style: Fix 'Return' comment style arp: Don't mix incoming and outgoing buffers iov: Introduce iov_tail_clone() and iov_tail_drop(). iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_data() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail packet: rename packet_data() to packet_get() arp: use iov_tail rather than pool dhcp: use iov_tail rather than pool dhcpv6: use iov_tail rather than pool icmp: use iov_tail rather than pool ndp: use iov_tail rather than pool packet: remove PACKET_POOL() and PACKET_POOL_P() packet: remove unused parameter from PACKET_POOL_DECL() packet: add memory regions information into pool packet: use buf to store iovec array arp.c | 86 ++++++++++++------- arp.h | 2 +- checksum.c | 4 +- conf.c | 12 +-- dhcp.c | 48 ++++++----- dhcp.h | 2 +- dhcpv6.c | 223 +++++++++++++++++++++++++++++++------------------- dhcpv6.h | 2 +- flow.c | 4 +- flow_table.h | 2 +- icmp.c | 43 ++++++---- icmp.h | 2 +- inany.c | 4 +- iov.c | 118 ++++++++++++++++++++++---- iov.h | 58 +++++++++---- ip.c | 32 ++++---- ip.h | 3 +- lineread.c | 2 +- ndp.c | 16 +++- ndp.h | 4 +- packet.c | 227 ++++++++++++++++++++++++++++++++++++++------------- packet.h | 57 ++++++------- pcap.c | 1 + tap.c | 134 +++++++++++++++++------------- tap.h | 8 +- tcp.c | 67 ++++++++++----- tcp_buf.c | 2 +- tcp_splice.c | 4 +- tcp_vu.c | 4 +- udp.c | 37 ++++++--- udp_vu.c | 6 +- util.c | 6 +- util.h | 4 +- vhost_user.c | 72 ++++++++-------- virtio.c | 6 +- virtio.h | 24 ++++-- vu_common.c | 48 ++++------- 37 files changed, 870 insertions(+), 504 deletions(-) -- 2.49.0

2 36

[PATCH] treewide: By default, don't quit source after migration, keep sockets open
by Stefano Brivio 24 Jul '25

24 Jul '25

We are hitting an issue in the KubeVirt integration where some data is still sent to the source instance even after migration is complete. As we exit, the kernel closes our sockets and resets connections. The resulting RST segments are sent to peers, effectively terminating connections that were meanwhile migrated. At the moment, this is not done intentionally, but in the future KubeVirt might enable OVN-Kubernetes features where source and destination nodes are explicitly getting mirrored traffic for a while, in order to decrease migration downtime. By default, don't quit after migration is completed on the source: the previous behaviour can be enabled with the new --migrate-exit option. Also, by default, keep migrated TCP sockets open (in repair mode) as long as we're running, and ignore events on any epoll descriptor representing data channels. The previous (and, strictly speaking, correct) behaviour can be enabled with the new --migrate-no-linger option. Reported-by: Nir Dothan <ndothan(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 23 +++++++++++++++++++++++ epoll_type.h | 12 ++++++++---- flow.c | 2 +- passt.1 | 14 ++++++++++++++ passt.c | 6 +++++- passt.h | 6 ++++++ tcp.c | 7 +++++-- tcp_conn.h | 3 ++- test/lib/setup | 4 ++-- vhost_user.c | 10 ++++++++-- 10 files changed, 74 insertions(+), 13 deletions(-) diff --git a/conf.c b/conf.c index 6c747aa..5e69014 100644 --- a/conf.c +++ b/conf.c @@ -864,6 +864,12 @@ static void usage(const char *name, FILE *f, int status) FPRINTF(f, " --repair-path PATH path for passt-repair(1)\n" " default: append '.repair' to UNIX domain path\n"); + FPRINTF(f, + " --migrate-exit source quits after migration\n" + " default: source keeps running after migration\n"); + FPRINTF(f, + " --migrate-no-linger close sockets on migration\n" + " default: keep sockets open, ignore data events\n"); } FPRINTF(f, @@ -1470,6 +1476,8 @@ void conf(struct ctx *c, int argc, char **argv) {"socket-path", required_argument, NULL, 's' }, {"fqdn", required_argument, NULL, 27 }, {"repair-path", required_argument, NULL, 28 }, + {"migrate-exit", no_argument, NULL, 29 }, + {"migrate-no-linger", no_argument, NULL, 30 }, { 0 }, }; const char *optstring = "+dqfel:hs:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1495,6 +1503,9 @@ void conf(struct ctx *c, int argc, char **argv) fwd_default = FWD_AUTO; } + if (c->mode == MODE_VU) + c->migrate_linger = true; + if (tap_l2_max_len(c) - ETH_HLEN < max_mtu) max_mtu = tap_l2_max_len(c) - ETH_HLEN; c->mtu = ROUND_DOWN(max_mtu, sizeof(uint32_t)); @@ -1686,6 +1697,18 @@ void conf(struct ctx *c, int argc, char **argv) optarg)) die("Invalid passt-repair path: %s", optarg); + break; + case 29: + if (c->mode != MODE_VU) + die("--migrate-exit is for vhost-user mode only"); + c->migrate_exit = true; + + break; + case 30: + if (c->mode != MODE_VU) + die("--migrate-no-linger is for vhost-user mode only"); + c->migrate_linger = false; + break; case 'd': c->debug = 1; diff --git a/epoll_type.h b/epoll_type.h index 12ac59b..f2991b6 100644 --- a/epoll_type.h +++ b/epoll_type.h @@ -12,6 +12,7 @@ enum epoll_type { /* Special value to indicate an invalid type */ EPOLL_TYPE_NONE = 0, + /* Connected TCP sockets */ EPOLL_TYPE_TCP, /* Connected TCP sockets (spliced) */ @@ -26,16 +27,19 @@ enum epoll_type { EPOLL_TYPE_UDP, /* ICMP/ICMPv6 ping sockets */ EPOLL_TYPE_PING, - /* inotify fd watching for end of netns (pasta) */ - EPOLL_TYPE_NSQUIT_INOTIFY, - /* timer fd watching for end of netns, fallback for inotify (pasta) */ - EPOLL_TYPE_NSQUIT_TIMER, /* tuntap character device */ EPOLL_TYPE_TAP_PASTA, /* socket connected to qemu */ EPOLL_TYPE_TAP_PASST, /* socket listening for qemu socket connections */ EPOLL_TYPE_TAP_LISTEN, + /* End of event types involving data transfers or connections */ + EPOLL_TYPE_DATA_MAX = EPOLL_TYPE_TAP_LISTEN, + + /* inotify fd watching for end of netns (pasta) */ + EPOLL_TYPE_NSQUIT_INOTIFY, + /* timer fd watching for end of netns, fallback for inotify (pasta) */ + EPOLL_TYPE_NSQUIT_TIMER, /* vhost-user command socket */ EPOLL_TYPE_VHOST_CMD, /* vhost-user kick event socket */ diff --git a/flow.c b/flow.c index 00885f6..feefda3 100644 --- a/flow.c +++ b/flow.c @@ -1091,7 +1091,7 @@ int flow_migrate_source(struct ctx *c, const struct migrate_stage *stage, * as EIO). */ foreach_established_tcp_flow(flow) { - rc = tcp_flow_migrate_source_ext(fd, &flow->tcp); + rc = tcp_flow_migrate_source_ext(c, fd, &flow->tcp); if (rc) { flow_err(flow, "Can't send extended data: %s", strerror_(-rc)); diff --git a/passt.1 b/passt.1 index 60066c2..b85aaa0 100644 --- a/passt.1 +++ b/passt.1 @@ -439,6 +439,20 @@ Default, for \-\-vhost-user mode only, is to append \fI.repair\fR to the path chosen for the hypervisor UNIX domain socket. No socket is created if not in \-\-vhost-user mode. +.TP +.BR \-\-migrate-exit +Exit after a completed migration as source. By default, \fBpasst\fR keeps +running and the migrated guest can continue using its connection, or a new guest +can connect. + +.TP +.BR \-\-migrate-no-linger +Close TCP sockets on the source instance once migration completes. + +By default, sockets are kept open, and events on data sockets are ignored, so +that any further message reaching sockets after the source migrated is silently +ignored, to avoid connection resets in case data is received after migration. + .TP .BR \-F ", " \-\-fd " " \fIFD Pass a pre-opened, connected socket to \fBpasst\fR. Usually the socket is opened diff --git a/passt.c b/passt.c index 388d10f..f4c108f 100644 --- a/passt.c +++ b/passt.c @@ -308,6 +308,9 @@ loop: c.mode == MODE_PASTA ? "pasta" : "passt", EPOLL_TYPE_STR(ref.type), ref.fd, eventmask); + if (c.ignore_data_events && ref.type <= EPOLL_TYPE_DATA_MAX) + continue; + switch (ref.type) { case EPOLL_TYPE_TAP_PASTA: tap_handler_pasta(&c, eventmask, &now); @@ -363,7 +366,8 @@ loop: } } - post_handler(&c, &now); + if (!c.ignore_data_events) + post_handler(&c, &now); migrate_handler(&c); diff --git a/passt.h b/passt.h index 8693794..636b3c3 100644 --- a/passt.h +++ b/passt.h @@ -241,6 +241,9 @@ struct ip6_ctx { * @device_state_fd: Device state migration channel * @device_state_result: Device state migration result * @migrate_target: Are we the target, on the next migration request? + * @migrate_linger: Keep sockets open after migration, ignore data events + * @migrate_exit: Exit (on source) once migration is complete + * @ignore_data_events: Ignore data events (for migration, source instance) */ struct ctx { enum passt_modes mode; @@ -318,6 +321,9 @@ struct ctx { int device_state_fd; int device_state_result; bool migrate_target; + bool migrate_linger; + bool migrate_exit; + bool ignore_data_events; }; void proto_update_l2_buf(const unsigned char *eth_d, diff --git a/tcp.c b/tcp.c index 2b88466..1f7a6ab 100644 --- a/tcp.c +++ b/tcp.c @@ -3286,12 +3286,14 @@ int tcp_flow_migrate_source(int fd, struct tcp_tap_conn *conn) /** * tcp_flow_migrate_source_ext() - Dump queues, close sockets, send final data + * @c: Execution context * @fd: Descriptor for state migration * @conn: Pointer to the TCP connection structure * * Return: 0 on success, negative (not -EIO) on failure, -EIO on sending failure */ -int tcp_flow_migrate_source_ext(int fd, const struct tcp_tap_conn *conn) +int tcp_flow_migrate_source_ext(struct ctx *c, + int fd, const struct tcp_tap_conn *conn) { uint32_t peek_offset = conn->seq_to_tap - conn->seq_ack_from_tap; struct tcp_tap_transfer_ext *t = &migrate_ext[FLOW_IDX(conn)]; @@ -3336,7 +3338,8 @@ int tcp_flow_migrate_source_ext(int fd, const struct tcp_tap_conn *conn) if ((rc = tcp_flow_dump_seq(conn, &t->seq_rcv))) goto fail; - close(s); + if (!c->migrate_linger) + close(s); /* Adjustments unrelated to FIN segments: sequence numbers we dumped are * based on the end of the queues. diff --git a/tcp_conn.h b/tcp_conn.h index 35d813d..d49ae88 100644 --- a/tcp_conn.h +++ b/tcp_conn.h @@ -236,7 +236,8 @@ int tcp_flow_repair_on(struct ctx *c, const struct tcp_tap_conn *conn); int tcp_flow_repair_off(struct ctx *c, const struct tcp_tap_conn *conn); int tcp_flow_migrate_source(int fd, struct tcp_tap_conn *conn); -int tcp_flow_migrate_source_ext(int fd, const struct tcp_tap_conn *conn); +int tcp_flow_migrate_source_ext(struct ctx *c, int fd, + const struct tcp_tap_conn *conn); int tcp_flow_migrate_target(struct ctx *c, int fd); int tcp_flow_migrate_target_ext(struct ctx *c, struct tcp_tap_conn *conn, int fd); diff --git a/test/lib/setup b/test/lib/setup index 575bc21..5994598 100755 --- a/test/lib/setup +++ b/test/lib/setup @@ -350,7 +350,7 @@ setup_migrate() { sleep 1 - __opts="--vhost-user" + __opts="--vhost-user --migrate-exit --migrate-no-linger" [ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_1.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" @@ -360,7 +360,7 @@ setup_migrate() { context_run_bg passt_repair_1 "./passt-repair ${STATESETUP}/passt_1.socket.repair" - __opts="--vhost-user" + __opts="--vhost-user --migrate-exit --migrate-no-linger" [ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_2.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" diff --git a/vhost_user.c b/vhost_user.c index e7fb049..7fd27dc 100644 --- a/vhost_user.c +++ b/vhost_user.c @@ -1207,7 +1207,13 @@ void vu_control_handler(struct vu_dev *vdev, int fd, uint32_t events) if (vmsg.hdr.request == VHOST_USER_CHECK_DEVICE_STATE && vdev->context->device_state_result == 0 && !vdev->context->migrate_target) { - info("Migration complete, exiting"); - _exit(EXIT_SUCCESS); + if (vdev->context->migrate_exit) { + info("Migration complete, exiting"); + _exit(EXIT_SUCCESS); + } + + info("Migration complete"); + if (vdev->context->migrate_linger) + vdev->context->ignore_data_events = true; } } -- 2.43.0

2 5

[PATCH v2] treewide: By default, don't quit source after migration, keep sockets open
by Stefano Brivio 23 Jul '25

23 Jul '25

We are hitting an issue in the KubeVirt integration where some data is still sent to the source instance even after migration is complete. As we exit, the kernel closes our sockets and resets connections. The resulting RST segments are sent to peers, effectively terminating connections that were meanwhile migrated. At the moment, this is not done intentionally, but in the future KubeVirt might enable OVN-Kubernetes features where source and destination nodes are explicitly getting mirrored traffic for a while, in order to decrease migration downtime. By default, don't quit after migration is completed on the source: the previous behaviour can be enabled with the new, but deprecated, --migrate-exit option. Also, by default, keep migrated TCP sockets open (in repair mode) as long as we're running, and ignore events on any epoll descriptor representing data channels. The previous behaviour can be enabled with the new, equally deprecated, --migrate-no-linger option. By keeping sockets open, and not exiting, we prevent the kernel running on the source node to send out RST segments if further data reaches us. Reported-by: Nir Dothan <ndothan(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: - assorted changes in commit message - context variable ignore_linger becomes ignore_no_linger - new options are deprecated - don't ignore events on some descriptors, drop them from epoll conf.c | 22 ++++++++++++++++++++++ flow.c | 2 +- passt.1 | 24 ++++++++++++++++++++++++ passt.h | 4 ++++ tcp.c | 9 +++++++-- tcp_conn.h | 3 ++- test/lib/setup | 4 ++-- vhost_user.c | 8 ++++++-- 8 files changed, 68 insertions(+), 8 deletions(-) diff --git a/conf.c b/conf.c index 6c747aa..f47f48e 100644 --- a/conf.c +++ b/conf.c @@ -864,6 +864,14 @@ static void usage(const char *name, FILE *f, int status) FPRINTF(f, " --repair-path PATH path for passt-repair(1)\n" " default: append '.repair' to UNIX domain path\n"); + FPRINTF(f, + " --migrate-exit DEPRECATED:\n" + " source quits after migration\n" + " default: source keeps running after migration\n"); + FPRINTF(f, + " --migrate-no-linger DEPRECATED:\n" + " close sockets on migration\n" + " default: keep sockets open, ignore events\n"); } FPRINTF(f, @@ -1470,6 +1478,8 @@ void conf(struct ctx *c, int argc, char **argv) {"socket-path", required_argument, NULL, 's' }, {"fqdn", required_argument, NULL, 27 }, {"repair-path", required_argument, NULL, 28 }, + {"migrate-exit", no_argument, NULL, 29 }, + {"migrate-no-linger", no_argument, NULL, 30 }, { 0 }, }; const char *optstring = "+dqfel:hs:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1686,6 +1696,18 @@ void conf(struct ctx *c, int argc, char **argv) optarg)) die("Invalid passt-repair path: %s", optarg); + break; + case 29: + if (c->mode != MODE_VU) + die("--migrate-exit is for vhost-user mode only"); + c->migrate_exit = true; + + break; + case 30: + if (c->mode != MODE_VU) + die("--migrate-no-linger is for vhost-user mode only"); + c->migrate_no_linger = true; + break; case 'd': c->debug = 1; diff --git a/flow.c b/flow.c index 00885f6..feefda3 100644 --- a/flow.c +++ b/flow.c @@ -1091,7 +1091,7 @@ int flow_migrate_source(struct ctx *c, const struct migrate_stage *stage, * as EIO). */ foreach_established_tcp_flow(flow) { - rc = tcp_flow_migrate_source_ext(fd, &flow->tcp); + rc = tcp_flow_migrate_source_ext(c, fd, &flow->tcp); if (rc) { flow_err(flow, "Can't send extended data: %s", strerror_(-rc)); diff --git a/passt.1 b/passt.1 index 60066c2..94363b7 100644 --- a/passt.1 +++ b/passt.1 @@ -439,6 +439,30 @@ Default, for \-\-vhost-user mode only, is to append \fI.repair\fR to the path chosen for the hypervisor UNIX domain socket. No socket is created if not in \-\-vhost-user mode. +.TP +.BR \-\-migrate-exit (DEPRECATED) +Exit after a completed migration as source. By default, \fBpasst\fR keeps +running and the migrated guest can continue using its connection, or a new guest +can connect. + +Note that this configuration option is \fBdeprecated\fR and will be removed in a +future version. It is not expected to be of any use, and it simply reflects a +legacy behaviour. If you have any use for this, refer to \fBREPORTING BUGS\fR +below. + +.TP +.BR \-\-migrate-no-linger (DEPRECATED) +Close TCP sockets on the source instance once migration completes. + +By default, sockets are kept open, and events on data sockets are ignored, so +that any further message reaching sockets after the source migrated is silently +ignored, to avoid connection resets in case data is received after migration. + +Note that this configuration option is \fBdeprecated\fR and will be removed in a +future version. It is not expected to be of any use, and it simply reflects a +legacy behaviour. If you have any use for this, refer to \fBREPORTING BUGS\fR +below. + .TP .BR \-F ", " \-\-fd " " \fIFD Pass a pre-opened, connected socket to \fBpasst\fR. Usually the socket is opened diff --git a/passt.h b/passt.h index 8693794..4cfd6eb 100644 --- a/passt.h +++ b/passt.h @@ -241,6 +241,8 @@ struct ip6_ctx { * @device_state_fd: Device state migration channel * @device_state_result: Device state migration result * @migrate_target: Are we the target, on the next migration request? + * @migrate_no_linger: Close sockets as we migrate them + * @migrate_exit: Exit (on source) once migration is complete */ struct ctx { enum passt_modes mode; @@ -318,6 +320,8 @@ struct ctx { int device_state_fd; int device_state_result; bool migrate_target; + bool migrate_no_linger; + bool migrate_exit; }; void proto_update_l2_buf(const unsigned char *eth_d, diff --git a/tcp.c b/tcp.c index 2b88466..b10ad8a 100644 --- a/tcp.c +++ b/tcp.c @@ -3286,12 +3286,14 @@ int tcp_flow_migrate_source(int fd, struct tcp_tap_conn *conn) /** * tcp_flow_migrate_source_ext() - Dump queues, close sockets, send final data + * @c: Execution context * @fd: Descriptor for state migration * @conn: Pointer to the TCP connection structure * * Return: 0 on success, negative (not -EIO) on failure, -EIO on sending failure */ -int tcp_flow_migrate_source_ext(int fd, const struct tcp_tap_conn *conn) +int tcp_flow_migrate_source_ext(struct ctx *c, + int fd, const struct tcp_tap_conn *conn) { uint32_t peek_offset = conn->seq_to_tap - conn->seq_ack_from_tap; struct tcp_tap_transfer_ext *t = &migrate_ext[FLOW_IDX(conn)]; @@ -3336,7 +3338,10 @@ int tcp_flow_migrate_source_ext(int fd, const struct tcp_tap_conn *conn) if ((rc = tcp_flow_dump_seq(conn, &t->seq_rcv))) goto fail; - close(s); + if (c->migrate_no_linger) + close(s); + else + epoll_del(c, s); /* Adjustments unrelated to FIN segments: sequence numbers we dumped are * based on the end of the queues. diff --git a/tcp_conn.h b/tcp_conn.h index 35d813d..d49ae88 100644 --- a/tcp_conn.h +++ b/tcp_conn.h @@ -236,7 +236,8 @@ int tcp_flow_repair_on(struct ctx *c, const struct tcp_tap_conn *conn); int tcp_flow_repair_off(struct ctx *c, const struct tcp_tap_conn *conn); int tcp_flow_migrate_source(int fd, struct tcp_tap_conn *conn); -int tcp_flow_migrate_source_ext(int fd, const struct tcp_tap_conn *conn); +int tcp_flow_migrate_source_ext(struct ctx *c, int fd, + const struct tcp_tap_conn *conn); int tcp_flow_migrate_target(struct ctx *c, int fd); int tcp_flow_migrate_target_ext(struct ctx *c, struct tcp_tap_conn *conn, int fd); diff --git a/test/lib/setup b/test/lib/setup index 575bc21..5994598 100755 --- a/test/lib/setup +++ b/test/lib/setup @@ -350,7 +350,7 @@ setup_migrate() { sleep 1 - __opts="--vhost-user" + __opts="--vhost-user --migrate-exit --migrate-no-linger" [ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_1.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" @@ -360,7 +360,7 @@ setup_migrate() { context_run_bg passt_repair_1 "./passt-repair ${STATESETUP}/passt_1.socket.repair" - __opts="--vhost-user" + __opts="--vhost-user --migrate-exit --migrate-no-linger" [ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_2.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" diff --git a/vhost_user.c b/vhost_user.c index e7fb049..4bfa941 100644 --- a/vhost_user.c +++ b/vhost_user.c @@ -1207,7 +1207,11 @@ void vu_control_handler(struct vu_dev *vdev, int fd, uint32_t events) if (vmsg.hdr.request == VHOST_USER_CHECK_DEVICE_STATE && vdev->context->device_state_result == 0 && !vdev->context->migrate_target) { - info("Migration complete, exiting"); - _exit(EXIT_SUCCESS); + if (vdev->context->migrate_exit) { + info("Migration complete, exiting"); + _exit(EXIT_SUCCESS); + } + + info("Migration complete"); } } -- 2.43.0

2 1

[PATCH] test: Deal with /bin, /sbin unification in Fedora
by David Gibson 22 Jul '25

22 Jul '25

Fedora is apparently merging /bin and /sbin together [0]. At least some of this has landed in Fedora 42, with sshd and dhclient now being in /bin. They are symlinked from /sbin, but mbuto doesn't preserve that symlink when it builds its image, it just puts them in /bin. That breaks later parts of the script which expects to find sshd and dhclient in /sbin. Other parts of the test also expect sysctl in /sbin. Use mbuto's LINKS feature to deal with these cases. [0] https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/passt.mbuto | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/test/passt.mbuto b/test/passt.mbuto index 5e00132b..176cf3f7 100755 --- a/test/passt.mbuto +++ b/test/passt.mbuto @@ -28,7 +28,10 @@ KMODS="${KMODS:- virtio_net virtio_pci vmw_vsock_virtio_transport}" LINKS="${LINKS:- ash,dash,bash /init - ash,dash,bash /bin/sh}" + ash,dash,bash /bin/sh + sshd /usr/sbin/sshd + dhclient /usr/sbin/dhclient + sysctl /usr/sbin/sysctl}" DIRS="${DIRS} /tmp /usr/sbin /usr/share /var/log /var/lib /etc/ssh /run/sshd /root/.ssh" -- 2.50.1

2 1