- dev - passt

[PATCH 0/3] Fix broken build with -DNDEBUG
by David Gibson 17 May '26

17 May '26

Fix the trivial but nasty with -DNDEBUG builds recently reported by Jan Palus. While we're there, add a couple of extra build tests. These wouldn't actually catch this problem, but they're better than nothing and do catch the #include problem I also spotted. David Gibson (3): test: Extend exeter build tests to cover more recent binaries Fix build with -DNDEBUG test: Add test for builds with -DNDEBUG test/build/build.py | 25 +++++++++++++++++++++---- util.h | 3 ++- 2 files changed, 23 insertions(+), 5 deletions(-) -- 2.54.0

3 5

[PATCH] lib/term: Quote tr character ranges to prevent glob expansion
by Laurent Vivier 16 May '26

16 May '26

Single-letter files in the working directory cause glob expansion of unquoted tr character ranges like [A-Z] and [a-z]. When the shell expands these against matching filenames, tr receives wrong arguments and pane_or_context_run() hangs without errors. Apply the same fix as in a36031a4d807 ("seccomp.sh: Quote tr character ranges to prevent glob expansion"): quote all tr ranges in test/lib/term. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- test/lib/term | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/test/lib/term b/test/lib/term index 89e4fdbe591d..2d2d2182de14 100755 --- a/test/lib/term +++ b/test/lib/term @@ -198,7 +198,7 @@ pane_run() { # pane_wait() - Wait for command to be done in given pane name # $1: Pane name pane_wait() { - __lc="$(echo "${1}" | tr [A-Z] [a-z])" + __lc="$(echo "${1}" | tr '[A-Z]' '[a-z]')" sleep 0.01 || sleep 1 __done=0 @@ -213,7 +213,7 @@ pane_wait() { # pane_parse() - Print last line, @EMPTY@ if command had no output # $1: Pane name pane_parse() { - __pane_lc="$(echo "${1}" | tr [A-Z] [a-z])" + __pane_lc="$(echo "${1}" | tr '[A-Z]' '[a-z]')" __buf="$(tail -n2 ${LOGDIR}/pane_${__pane_lc}.log | head -n1 | sed 's/^[^\r]*\r$[^\r]$/\1/;s/[]][^]*[\]//g' | tr -d '\r\n')" @@ -267,7 +267,7 @@ pane_or_context_run() { # Redirect stdin to stop ssh from eating the test instructions file we have on stdin context_run "${__name}" "$@" >/dev/null 2>&1 < /dev/null else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_run "${__uc}" "$@" pane_status "${__uc}" fi @@ -283,7 +283,7 @@ pane_or_context_run_bg() { # Redirect stdin to stop ssh from eating the test instructions file we have on stdin context_run_bg "${__name}" "$@" >/dev/null 2>&1 < /dev/null else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_run "${__uc}" "$@" fi } @@ -303,7 +303,7 @@ pane_or_context_output() { echo "${__output}" fi else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_run "${__uc}" "$@" pane_wait "${__uc}" pane_parse "${__uc}" @@ -318,7 +318,7 @@ pane_or_context_wait() { if context_exists "${__name}"; then context_wait "${__name}" else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_wait "${__uc}" fi } -- 2.54.0

3 2

[PATCH 0/2] Fix regression when one IP version is disabled
by David Gibson 16 May '26

16 May '26

Fix for a simple but nasty regression caused by the recent forwarding table work. Plus a tiny feature in adjacent code. Link: https://bugs.passt.top/show_bug.cgi?id=205 David Gibson (2): fwd_rule: Don't attempt dual stack listen()s if only one IP family fwd_rule: Allow parsing * as a forwarding address fwd_rule.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) -- 2.54.0

2 3

Re: [PATCH 2/3] Fix build with -DNDEBUG
by David Gibson 16 May '26

16 May '26

On Fri, May 15, 2026 at 01:05:50PM +0200, Jan Palus wrote: > On 15.05.2026 14:13, David Gibson wrote: > > Since bc872d91765d, our assert() statements are omitted if we compile with > > -DNDEBUG, like the standard library assert(3). Unfortunately a trivial but > > embarrassing mistake in that patch means that instead of never aborting in > > this case, assert_with_msg() *always* aborts, breaking pretty much > > everything. > > > > There's also a missing #include that breaks the build with -DNDEBUG on at > > least some library versions. > > > > Reported-by: Jan Palus <jpalus(a)fastmail.com> > > Fixes: bc872d91765d ("treewide: Spell ASSERT() as assert()") > > Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> > > --- > > util.h | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/util.h b/util.h > > index 70aadeba..11f71d45 100644 > > --- a/util.h > > +++ b/util.h > > @@ -6,6 +6,7 @@ > > #ifndef UTIL_H > > #define UTIL_H > > > > +#include <assert.h> > > #include <stdlib.h> > > #include <stdarg.h> > > #include <stdbool.h> > > @@ -60,7 +61,7 @@ void abort_with_msg(const char *fmt, ...) > > __func__, __FILE__, __LINE__, STRINGIFY(expr)) > > #else > > #define assert_with_msg(expr, ...) \ > > - ((void)(expr), 0 ? (void)0 : abort_with_msg(__VA_ARGS__)) > > + ((void)(expr), 1 ? (void)0 : abort_with_msg(__VA_ARGS__)) > > There is a slight semantic difference between assert() and > assert_with_msg() when building with -DNDEBUG -- `expr` is still being > evaluated in abort_with_msg() although likely optimized out in most > builds. Right, I'm expecting the compiler to optimise this away. That won't be the case if the expression has side effects, but side effects in an assert() expression is already a bug, precisely because of the possibility NDEBUG. > I'm assuming you'd prefer to avoid cppcheck suppressions. cppcheck suppressions would be acceptable if we could put them inside the macro. But these are unused variable warnings, which show up at the site of variable declaration not (obviously) at the place the variable... isn't used. Putting suppressions on variables because they might become unused depending on a macro definition certainly isn't acceptable. Both for aesthetics, and because it means if we removed the assert we'd no longer get a warning that the variable now really isn't used. > How > about moving `expr` into branch which is never evaluated then? Would it > keep cppcheck happy? > > + (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) That does work. Not sure if it's worth the bother of a respin. Stefano, any opinion? -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

2 2

[PATCH 3/3] test: Add test for builds with -DNDEBUG
by David Gibson 15 May '26

15 May '26

Since bc872d91765d we omit assert()s if the NDEBUG preprocessor symbol is defined, as is the case with the standard library assert(3). However, none of our tests verify that we can actually build that way. Add an extra test to test/build/build.py tto verify this. Fixes: bc872d91765d ("treewide: Spell ASSERT() as assert()") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/build/build.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/test/build/build.py b/test/build/build.py index eeee5acc..59de014a 100755 --- a/test/build/build.py +++ b/test/build/build.py @@ -77,6 +77,20 @@ for bin in BINARIES: exeter.register('make_all', test_make, 'all', BINARIES) +(a)exeter.test +def test_ndebug() -> None: + """Test build with -NDEBUG + + Tests that we can build all binaries with -DNDEBUG (warnings are + expected, though). Doesn't test that they actually work. + """ + + with clone_sources(): + sh('make all CPPFLAGS="-DNDEBUG" CFLAGS="-w"') + for b in BINARIES: + assert Path(b).exists(), f"{b} wasn't made" + + @exeter.test def test_install_uninstall() -> None: """Test `make install` and `make uninstall` -- 2.54.0

1 0

[PATCH] ndp: Suppress Coverity false positive for random()
by Laurent Vivier 14 May '26

14 May '26

Coverity flags the random() call in ndp_timer() with the dont_call checker, warning that it should not be used for security-related applications. This is a false positive: random() is used here to jitter the interval between unsolicited Router Advertisements as required by RFC 4861, to prevent synchronisation between routers on a link. No cryptographic strength is needed. Suppress the warning with an inline Coverity annotation. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- ndp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/ndp.c b/ndp.c index 1f2bcb0cc7ea..614932ac5829 100644 --- a/ndp.c +++ b/ndp.c @@ -441,6 +441,7 @@ void ndp_timer(const struct ctx *c, const struct timespec *now) * again, it's close enough for our purposes. */ interval = min_rtr_adv_interval + + /* coverity[dont_call:FALSE] */ random() % (max_rtr_adv_interval - min_rtr_adv_interval); if (!next_ra) -- 2.54.0

3 2

[PATCH v3 00/10] vhost-user: Preparatory series for multiple iovec entries per virtqueue element
by Laurent Vivier 14 May '26

14 May '26

Currently, the vhost-user path assumes each virtqueue element contains exactly one iovec entry covering the entire frame. This assumption breaks as some virtio-net drivers (notably iPXE) provide descriptors where the vnet header and the frame payload are in separate buffers, resulting in two iovec entries per virtqueue element. This series refactors the vhost-user data path so that frame lengths, header sizes, and padding are tracked and passed explicitly rather than being derived from iovec sizes. This decoupling is a prerequisite for correctly handling padding of multi-buffer frames. The changes in this series can be split in 3 groups: - New iov helpers (patches 1-2): iov_memset() and iov_memcpy() operate across iovec boundaries. These are needed by the final patch to pad and copy frame data when a frame spans multiple iovec entries. - Structural refactoring (patches 3-5): Move vnethdr setup into vu_flush(), separate virtqueue management from socket I/O in the UDP path, and pass iov arrays explicitly instead of using file-scoped state. These changes make it possible to pass explicit frame lengths through the stack, which is required to pad frames independently of iovec layout. - Explicit length passing throughout the stack (patches 6-10): Thread explicit L4, L2, frame, and data lengths through checksum, pcap, vu_flush(), and tcp_fill_headers(), replacing lengths that were previously derived from iovec sizes. With lengths tracked explicitly, the final patch can centralise Ethernet frame padding into vu_collect() and a new vu_pad() helper that correctly pads frames spanning multiple iovec entries. v3: - csum_udp4()/csum_udp6()/udp_vu_csum receive payload length (dlen) rather than l4len - Add a length parameter to write_remainder() and use it in pcap_frame() v2: - Rename iov_memcopy() to iov_memcpy() and use clearer parameter names - Use clearer code in pcap_frame() - Add braces around bodies in pcap.c and tcp_vu.c for style consistency - Extract l2len variable in tap_add_packet() and tcp_vu_send_flag() to avoid repeating the same expression - Fix indentation alignment of iov_skip_bytes() arguments in tcp_vu_c - Introduce fill_size variable in vu_flush() - Reposition comment for ETH_ZLEN in vu_collect() Laurent Vivier (10): iov: Introduce iov_memset() iov: Add iov_memcpy() to copy data between iovec arrays vu_common: Move vnethdr setup into vu_flush() udp_vu: Move virtqueue management from udp_vu_sock_recv() to its caller udp_vu: Pass iov explicitly to helpers instead of using file-scoped array checksum: Pass explicit L4 length to checksum functions pcap: Pass explicit L2 length to pcap_iov() vu_common: Pass explicit frame length to vu_flush() tcp: Pass explicit data length to tcp_fill_headers() vhost-user: Centralise Ethernet frame padding in vu_collect() and vu_pad() checksum.c | 43 +++++++----- checksum.h | 6 +- iov.c | 78 ++++++++++++++++++++++ iov.h | 5 ++ pcap.c | 28 +++++--- pcap.h | 2 +- tap.c | 10 +-- tcp.c | 14 ++-- tcp_buf.c | 3 +- tcp_internal.h | 2 +- tcp_vu.c | 66 ++++++++++--------- udp.c | 5 +- udp_vu.c | 173 +++++++++++++++++++++++++------------------------ util.c | 31 +++++++-- util.h | 3 +- vu_common.c | 58 ++++++++++------- vu_common.h | 5 +- 17 files changed, 338 insertions(+), 194 deletions(-) -- 2.53.0

3 21

[PATCH v8 0/3] vhost-user,udp: Handle multiple iovec entries per virtqueue element
by Laurent Vivier 13 May '26

13 May '26

Some virtio-net drivers (notably iPXE) provide descriptors where the vnet header and the frame payload are in separate buffers, resulting in two iovec entries per virtqueue element. Currently, the RX (host to guest) path assumes a single iovec per element, which triggers: ASSERTION FAILED in virtqueue_map_desc (virtio.c:403): num_sg < max_num_sg This series reworks the UDP vhost-user receive path to support multiple iovec entries per element, fixing the iPXE crash. This series only addresses the UDP path. TCP vhost-user will be updated to use multi-iov elements in a subsequent series. Based-on: 20260416155721.3807225-1-lvivier(a)redhat.com v8: - Add Reviewed-by from David for 1/3 and 2/3 - Remove VLA to use fixed size (VIRTQUEUE_MAX_SIZE) - Rename udp_frame to datagram - Use sizeof(uh) instead of sizeof(struct udphdr) - Push back uh in memory in udp_vu_csum() v7: - In udp_vu_sock_to_tap(), introduce iov_still_needed variable - Fix iov_tail @data doc comments in udp_vu_prepare()/udp_vu_csum() - Don't rewrap the virtio checksum comment in udp_update_hdr6() - Add NULL check for uh in udp_vu_csum() v6: - Rebased on top of [PATCH 00/10] vhost-user: Preparatory series for multiple iovec entries per virtqueue element v5: - This version doesn't change the padding system regarding v4, it's a complex task that will be addressed in another version - reorder patches and add new patches - remove IOV_PUT_HEADER()/with_header() and introduce IOV_PUSH_HEADER() - don't use the iov_tail to provide the headers to the functions - move vu_set_vnethdr() to vu_flush(), extract vu_queue_notify() - move vu_flush() inside loop in tcp_vu_data_from_sock() to flush data by frame and not by full data length v4: - rebase - replace ASSERT() by assert() v3: - include the series "Decouple iovec management from virtqueues elements" - because of this series, drop: "vu_common: Accept explicit iovec counts in vu_set_element()" "vu_common: Accept explicit iovec count per element in vu_init_elem()" "vu_common: Prepare to use multibuffer with guest RX" "vhost-user,udp: Use 2 iovec entries per element" - drop "vu_common: Pass iov_tail to vu_set_vnethdr()" as the specs insures a buffer is big enough to contain vnet header - introduce "with_header()" and merge "udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6()" and "udp_vu: Use iov_tail in udp_vu_prepare()" to use it v2: - add iov_truncate(), iov_memset() - remove iov_tail_truncate() and iov_tail_zero_end() - manage 802.3 minimum frame size Laurent Vivier (3): udp_vu: Allow virtqueue elements with multiple iovec entries iov: Introduce IOV_PUSH_HEADER() macro udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6() iov.c | 22 ++++++++++ iov.h | 11 +++++ udp.c | 70 ++++++++++++++++------------- udp_internal.h | 4 +- udp_vu.c | 116 ++++++++++++++++++++++++++----------------------- 5 files changed, 135 insertions(+), 88 deletions(-) -- 2.53.0

3 8

[PATCH v3 04/12] Makefile: Remove unhelpful $(HEADERS) variable
by David Gibson 12 May '26

12 May '26

Confusingly HEADERS is not headers that are shared between our various binaries. Rather it's just the (non generated) headers for passt, plus seccomp.h. This isn't particularly useful, just open code it in the handful of places we need it. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- Makefile | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/Makefile b/Makefile index 88c8a15a..ff442fa2 100644 --- a/Makefile +++ b/Makefile @@ -50,14 +50,13 @@ SRCS = $(PASST_SRCS) $(QRAP_SRCS) $(PASST_REPAIR_SRCS) $(PESTO_SRCS) MANPAGES = passt.1 pasta.1 pesto.1 qrap.1 passt-repair.1 -PASST_HEADERS = arch.h arp.h bitmap.h checksum.h common.h conf.h dhcp.h \ - dhcpv6.h epoll_ctl.h flow.h fwd.h fwd_rule.h flow_table.h icmp.h \ - icmp_flow.h inany.h iov.h ip.h isolation.h lineread.h log.h migrate.h \ - ndp.h netlink.h packet.h passt.h pasta.h pcap.h pesto.h pif.h repair.h \ - serialise.h siphash.h tap.h tcp.h tcp_buf.h tcp_conn.h tcp_internal.h \ - tcp_splice.h tcp_vu.h udp.h udp_flow.h udp_internal.h udp_vu.h util.h \ - vhost_user.h virtio.h vu_common.h -HEADERS = $(PASST_HEADERS) seccomp.h +PASST_HEADERS = arch.h arp.h bitmap.h checksum.h conf.h dhcp.h dhcpv6.h \ + epoll_ctl.h flow.h fwd.h fwd_rule.h flow_table.h icmp.h icmp_flow.h \ + inany.h iov.h ip.h isolation.h lineread.h log.h migrate.h ndp.h \ + netlink.h packet.h passt.h pasta.h pcap.h pif.h repair.h serialise.h \ + siphash.h tap.h tcp.h tcp_buf.h tcp_conn.h tcp_internal.h tcp_splice.h \ + tcp_vu.h udp.h udp_flow.h udp_internal.h udp_vu.h util.h vhost_user.h \ + virtio.h vu_common.h C := \#include <sys/random.h>\nint main(){int a=getrandom(0, 0, 0);} ifeq ($(shell printf "$(C)" | $(CC) -S -xc - -o - >/dev/null 2>&1; echo $$?),0) @@ -103,10 +102,10 @@ seccomp_pesto.h: seccomp.sh $(PESTO_SRCS) $(BASEBIN): %: $(CC) $(FLAGS) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) $(filter %.c,$^) -o $@ -passt: $(PASST_SRCS) $(HEADERS) +passt: $(PASST_SRCS) $(PASST_HEADERS) seccomp.h passt.avx2: FLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops -passt.avx2: $(PASST_SRCS) $(HEADERS) +passt.avx2: $(PASST_SRCS) $(PASST_HEADERS) seccomp.h pasta.avx2 pasta.1 pasta: pasta%: passt% ln -sf $< $@ @@ -202,7 +201,7 @@ CPPCHECK_FLAGS = --std=c11 --error-exitcode=1 --enable=all --force \ --suppress=unusedStructMember \ -D CPPCHECK_6936 -cppcheck: $(PASST_SRCS) $(HEADERS) +cppcheck: $(PASST_SRCS) $(PASST_HEADERS) seccomp.h $(CPPCHECK) $(CPPCHECK_FLAGS) \ $(filter -D%,$(FLAGS) $(CFLAGS) $(CPPFLAGS)) $^ \ $^ -- 2.54.0

1 0

[PATCH v3 03/12] Makefile: Use common binary compilation rule
by David Gibson 12 May '26

12 May '26

Each of our binaries (passt, passt.avx2, qrap and passt-repair) has a separate Make rule instructing how to compile it, but they're all basically identical. Combine these all into a single pattern rule, just using different dependencies and variable overrides where necessary. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- Makefile | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/Makefile b/Makefile index d489a862..88c8a15a 100644 --- a/Makefile +++ b/Makefile @@ -76,9 +76,14 @@ docdir ?= $(datarootdir)/doc/passt mandir ?= $(datarootdir)/man man1dir ?= $(mandir)/man1 -BIN := passt pasta qrap passt-repair pesto +BASEBIN := passt qrap passt-repair pesto ifeq ($(TARGET_ARCH),x86_64) -BIN += passt.avx2 pasta.avx2 +BASEBIN += passt.avx2 +endif + +BIN = $(BASEBIN) pasta +ifeq ($(TARGET_ARCH),x86_64) +BIN += pasta.avx2 endif all: $(BIN) $(MANPAGES) docs @@ -95,27 +100,24 @@ seccomp_repair.h: seccomp.sh $(PASST_REPAIR_SRCS) seccomp_pesto.h: seccomp.sh $(PESTO_SRCS) @ ARCH="$(TARGET_ARCH)" CC="$(CC)" ./seccomp.sh seccomp_pesto.h $(PESTO_SRCS) +$(BASEBIN): %: + $(CC) $(FLAGS) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) $(filter %.c,$^) -o $@ + passt: $(PASST_SRCS) $(HEADERS) - $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(PASST_SRCS) -o passt $(LDFLAGS) passt.avx2: FLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops passt.avx2: $(PASST_SRCS) $(HEADERS) - $(CC) $(filter-out -O2,$(FLAGS)) $(CFLAGS) $(CPPFLAGS) \ - $(PASST_SRCS) -o passt.avx2 $(LDFLAGS) - -passt.avx2: passt pasta.avx2 pasta.1 pasta: pasta%: passt% ln -sf $< $@ +qrap: FLAGS += -DARCH=\"$(TARGET_ARCH)\" qrap: $(QRAP_SRCS) passt.h - $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) -DARCH=\"$(TARGET_ARCH)\" $(QRAP_SRCS) -o qrap $(LDFLAGS) passt-repair: $(PASST_REPAIR_SRCS) seccomp_repair.h - $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(PASST_REPAIR_SRCS) -o passt-repair $(LDFLAGS) +pesto: FLAGS += -DPESTO pesto: $(PESTO_SRCS) $(PESTO_HEADERS) seccomp_pesto.h - $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) -DPESTO $(PESTO_SRCS) -o pesto $(LDFLAGS) valgrind: EXTRA_SYSCALLS += rt_sigprocmask rt_sigtimedwait rt_sigaction \ rt_sigreturn getpid gettid kill clock_gettime \ -- 2.54.0

1 0