feat(n-vm): in-VM test infrastructure (testn absorption + e1000)

Absorb the `n-vm`, `n-it`, `n-vm-macros`, and `n-vm-protocol` crates
from the external `testn` repository into the workspace and add the
supporting infrastructure for running tests inside a QEMU/cloud-hypervisor
guest.

This is a squashed revival of the `n-vm-again` branch, rebased onto the
current ACL/dpdk line.  The branch had forked before the ACL module
existed; its stale fork of `dpdk/`, `dpdk-sys/`, and `dpdk/src/acl/*` has
been dropped in favour of the authoritative versions on the base, keeping
only the orthogonal VM test infrastructure.

Contents:

- `n-vm` / `n-vm-protocol`: QEMU and cloud-hypervisor backends, dynamic
  vsock allocation, hugepage and NIC-model configuration, scratch-only
  container mode with nix-store bind mounts.
- `n-vm-macros`: the `#[in_vm]` attribute and companion attributes
  (`#[network]`, guest/hypervisor config), compile-fail trybuild tests.
- `n-it`: in-guest init system (PID 1) with mount-table-driven teardown.
- `nix`: `linux-fancy` kernel built from config fragments (VFIO, IOMMU,
  virtio, e1000/e1000e), `testroot`/`vmroot` derivations, `merge-config.nix`.
- `hardware` / `dpdk-sys`: e1000/e1000e NIC binding and `rte_net_e1000`
  PMD linkage; `driver()` returns `Ok(None)` for unbound devices.
- `mgmt`: re-enable `test_sample_config` under `#[in_vm]`.
- `justfile`: export `N_VM_TEST_ROOT`/`N_VM_VM_ROOT` for `#[in_vm]` tests.

The `hardware/tests/dpdk_in_vm.rs` integration test (virtio-net/e1000/
e1000e) is intentionally NOT carried forward: it was written against the
pre-rewrite dpdk device API (`StartedDev` queue handles, `RxOffloadConfig`,
public `Headers` fields) and needs a port to the current API.  It is
preserved on the `backup/n-vm-again` branch for a clean revival.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: daniel-noland

Cargo.lock

@@ -31,6 +31,10 @@ members = [
     "match-action",
     "match-action-derive",
     "mgmt",
+    "n-it",
+    "n-vm",
+    "n-vm-macros",
+    "n-vm-protocol",
     "nat",
     "net",
     "pipeline",
@@ -96,6 +100,10 @@ lpm = { path = "./lpm", package = "dataplane-lpm", features = [] }
 match-action = { path = "./match-action", package = "dataplane-match-action", features = [] }
 match-action-derive = { path = "./match-action-derive", package = "dataplane-match-action-derive", features = [] }
 mgmt = { path = "./mgmt", package = "dataplane-mgmt", features = [] }
+n-it = { path = "./n-it", package = "dataplane-n-it", features = [] }
+n-vm = { path = "./n-vm", package = "dataplane-n-vm", features = [] }
+n-vm-macros = { path = "./n-vm-macros", package = "dataplane-n-vm-macros", features = [] }
+n-vm-protocol = { path = "./n-vm-protocol", package = "dataplane-n-vm-protocol", features = [] }
 nat = { path = "./nat", package = "dataplane-nat", features = [] }
 net = { path = "./net", package = "dataplane-net", features = [] }
 pipeline = { path = "./pipeline", package = "dataplane-pipeline", features = [] }
@@ -109,6 +117,7 @@ validator = { path = "./validator", package = "dataplane-validator", features =
 vpcmap = { path = "./vpcmap", package = "dataplane-vpcmap", features = [] }
 
 # External
+
 afpacket = { version = "0.2.3", default-features = false, features = [] }
 ahash = { version = "0.8.12", default-features = false, features = [] }
 anyhow = { version = "1.0.102", default-features = false, features = [] }
@@ -122,13 +131,17 @@ bindgen = { version = "0.72.1", default-features = false, features = [] }
 bitflags = { version = "2.11.1", default-features = false, features = [] }
 bnum = { version = "0.14.4", default-features = false, features = [] }
 bolero = { version = "0.13.4", default-features = false, features = [] }
+bollard = { version = "0.20.2", default-features = false, features = [] }
 bytecheck = { version = "0.8.2", default-features = false, features = [] }
 bytes = { version = "1.11.1", default-features = false, features = [] }
+capctl = { version = "0.2.4", default-features = false, features = [] }
 caps = { version = "0.5.6", default-features = false, features = [] }
 chrono = { version = "0.4.44", default-features = false, features = [] }
 clap = { version = "4.6.1", default-features = true, features = [] }
+cloud-hypervisor-client = { version = "0.3.3", default-features = false, features = [] }
 color-eyre = { version = "0.6.5", default-features = false, features = [] }
 colored = { version = "3.1.1", default-features = false, features = [] }
+command-fds = { version = "0.3.2", default-features = false, features = [] }
 criterion = { version = "0.8.2", default-features = false, features = [] }
 crossbeam-utils = { version = "0.8.21", default-features = false, features = [] }
 dashmap = { version = "6.2.1", default-features = false, features = [] }
@@ -164,7 +177,6 @@ metrics-exporter-prometheus = { version = "0.18.3", default-features = false, fe
 miette = { version = "7.6.0", default-features = false, features = [] }
 mio = { version = "1.2.1", default-features = false, features = [] }
 multi_index_map = { version = "0.15.1", default-features = false, features = [] }
-n-vm = { git = "https://github.com/githedgehog/testn.git", tag = "v0.0.10", default-features = false, features = [], package = "n-vm" }
 netdev = { version = "0.43.0", default-features = false, features = [] }
 netgauze-bgp-pkt = { version = "0.12.1", features = [] }
 netgauze-bmp-pkt = { version = "0.12.1", features = [] }
@@ -182,6 +194,8 @@ proc-macro-crate = { version = "3.5.0", default-features = false, features = []
 proc-macro2 = { version = "1.0.106", default-features = false, features = [] }
 procfs = { version = "0.18.0", default-features = false, features = [] }
 pyroscope = { version = "2.0.6", default-features = false, features = [] }
+qapi-qmp = { version = "0.15.0", default-features = false, features = [] }
+qapi-spec = { version = "0.3.2", default-features = false, features = [] }
 quote = { version = "1.0.45", default-features = false, features = [] }
 rand = { version = "0.10.1", default-features = false, features = [] }
 rapidhash = { version = "4.4.1", default-features = false, features = [] }
@@ -211,16 +225,20 @@ thread_local = { version = "1.1.9", default-features = false, features = [] }
 # per-crate would buy is divergent runtime behaviour between test binaries
 # and the real dataplane.  Keep it global.
 tokio = { version = "1.52.3", default-features = false, features = ["parking_lot"] }
+tokio-stream = { version = "0.1.18", default-features = false, features = [] }
 tokio-util = { version = "0.7.18", default-features = false, features = [] }
+tokio-vsock = { version = "0.7.2", default-features = false, features = [] }
 tonic = { version = "0.14.6", default-features = false, features = [] }
 tracing = { version = "0.1.44", default-features = false, features = ["release_max_level_debug"] }
 tracing-error = { version = "0.2.1", default-features = false, features = [] }
 tracing-subscriber = { version = "0.3.23", default-features = false, features = [] }
 tracing-test = { version = "0.2.6", default-features = false, features = [] }
 tracing-throttle = { version = "0.4.2", default-features = false, features = [] }
+trybuild = { version = "1.0.116", default-features = false, features = [] }
 ureq = { version = "3.3.0", default-features = false, features = [] }
 url = { version = "2.5.8", default-features = false, features = [] }
 uuid = { version = "1.23.2", default-features = false, features = [] }
+vsock = { version = "0.5.4", default-features = false, features = [] }
 
 # NOTE: panic strategy is intentionally left unset here.
 #

Cargo.toml

@@ -184,6 +184,40 @@ let
       yq
     ]);
   };
+  # Minimal derivation containing only the kernel bzImage.
+  #
+  # The full linux-fancy output includes modules, headers, etc. that are
+  # not needed inside the test container — we extract just the bootable
+  # image so that symlinkJoin produces a top-level `bzImage` entry in
+  # testroot without pulling in the rest of the kernel tree.
+  kernel-image = pkgs.runCommand "kernel-image" { } ''
+    mkdir -p $out
+    cp ${pkgs.pkgsBuildHost.linux-fancy}/bzImage $out/bzImage
+  '';
+
+  # Container-tier tools for the scratch-container test infrastructure.
+  #
+  # This derivation provides the binaries needed inside the Docker
+  # container that launches the test VM: the hypervisor(s), virtiofsd,
+  # and a Linux kernel image (bzImage built from config fragments by
+  # the linux-fancy derivation in nix/overlays/dataplane-dev.nix).
+  #
+  # When used with a scratch container, subdirectories of this derivation
+  # (e.g. bin/, lib/) are volume-mounted at their standard container
+  # paths, and top-level files (e.g. bzImage) are bind-mounted at the
+  # container root.  The container also mounts /nix/store from the host
+  # so that the symlinks created by symlinkJoin resolve to the actual
+  # binaries and their transitive library dependencies.
+  #
+  # See development/ideam.md for the design rationale.
+  testroot = pkgs.symlinkJoin {
+    name = "dataplane-test-root";
+    paths = with pkgs.pkgsBuildHost; [
+      cloud-hypervisor
+      virtiofsd
+      qemu_kvm
+    ] ++ [ kernel-image ];
+  };
   devenv = pkgs.mkShell {
     name = "dataplane-dev-shell";
     packages = [ devroot ];
@@ -454,6 +488,92 @@ let
     }
   ) package-list;
 
+  # VM guest root filesystem for the scratch-container test infrastructure.
+  #
+  # This derivation is shared into the VM via virtiofsd and becomes the
+  # guest's root filesystem (mounted as virtiofs with tag "root").
+  #
+  # It contains:
+  # - The n-it init system binary (runs as PID 1 in the VM).
+  # - glibc and libgcc shared libraries (so dynamically linked test
+  #   binaries can run inside the VM).
+  #
+  # The test binary directory is bind-mounted by container.rs at
+  # /vm.root/test-bin (see VM_TEST_BIN_DIR in n-vm-protocol), so it
+  # appears at /test-bin in the VM guest.  The /test-bin directory is
+  # pre-created here so Docker can create the bind mount without needing
+  # to mkdir on the read-only nix store path.
+  #
+  # See development/ideam.md for the design rationale.
+  vmroot = pkgs.runCommand "dataplane-vm-root" { } ''
+    mkdir -p $out/bin $out/lib $out/test-bin
+
+    # Essential guest directories.
+    #
+    # The VM root filesystem is mounted read-only via virtiofs, so the
+    # kernel cannot create directories on demand.  These empty mount
+    # points must exist so that:
+    #
+    #   /dev   — kernel auto-mounts devtmpfs (provides /dev/console,
+    #            /dev/null, etc. needed by init and test processes)
+    #   /proc  — n-it mounts procfs (needed for /proc/cmdline parsing
+    #            and general process introspection)
+    #   /sys   — n-it mounts sysfs
+    #   /tmp   — n-it mounts tmpfs (writable scratch space)
+    #   /run   — n-it mounts tmpfs (runtime state)
+    #   /etc   — some libc/nss functions expect this to exist
+    #
+    # Without /dev in particular, the kernel logs
+    # "devtmpfs: error mounting -2" and init may fail with ENOEXEC (-8)
+    # because /dev/console cannot be opened.
+    mkdir -p $out/dev $out/proc $out/sys $out/tmp $out/run $out/etc $out/var
+
+    # /var/run → /run symlink.
+    #
+    # Many daemons (including DPDK) default to writing runtime state
+    # under /var/run.  On a conventional Linux system /var/run is
+    # either a symlink to /run or a tmpfs in its own right.  Since our
+    # root filesystem is read-only via virtiofs, we bake the symlink
+    # into the image so that /var/run/dpdk (and friends) resolve to
+    # the writable /run tmpfs mounted by n-it.
+    #
+    # This mirrors what the dataplane container image already does
+    # (see the `dataplane.tar` buildPhase above).
+    ln -s /run $out/var/run
+
+    # n-it init system binary.
+    # The cargo package is "dataplane-n-it" but the VM expects the
+    # binary at /bin/n-it (see INIT_BINARY_PATH in n-vm-protocol).
+    ln -s ${workspace."n-it"}/bin/dataplane-n-it $out/bin/n-it
+
+    # glibc runtime libraries -- needed by dynamically linked test
+    # binaries running inside the VM.
+    for f in ${pkgs.pkgsHostHost.libc.out}/lib/*.so*; do
+      [ -e "$f" ] || continue
+      ln -s "$f" "$out/lib/$(basename "$f")"
+    done
+
+    # libgcc runtime libraries (libgcc_s.so, etc.)
+    for f in ${pkgs.pkgsHostHost.glibc.libgcc}/lib/*.so*; do
+      [ -e "$f" ] || continue
+      ln -s "$f" "$out/lib/$(basename "$f")"
+    done
+
+    # Create a real /nix/store directory (empty mount point).
+    #
+    # The container tier bind-mounts the host's /nix/store here so that
+    # virtiofsd serves it as a real directory to the VM guest.  This
+    # replaces the previous /nix -> /nix absolute symlink, which caused
+    # ELOOP (error -40) inside the guest: the FUSE protocol returns
+    # symlinks to the guest kernel for resolution, and /nix -> /nix is
+    # self-referential from the guest's VFS perspective.
+    #
+    # Nix-built test binaries have rpaths like
+    # /nix/store/{hash}-glibc-X.Y/lib; with /nix/store bind-mounted
+    # through virtiofsd, those paths resolve correctly inside the VM.
+    mkdir -p $out/nix/store
+  '';
+
   workspace-check =
     {
       pname ? null,
@@ -1013,7 +1133,9 @@ in
     pkgs
     sources
     sysroot
+    testroot
     tests
+    vmroot
     workspace
     ;
   profile = profile';

default.nix

@@ -76,6 +76,7 @@ fn main() {
         "rte_net_virtio",
         "rte_net_vhost",
         "rte_net_i40e",
+        "rte_net_e1000",
         "rte_vhost",
         "rte_net_mlx5",
         "rte_common_mlx5",

dpdk-sys/build.rs

@@ -73,7 +73,18 @@ impl GetDriver for PciNic {
     fn driver(&self) -> Result<Option<PciDriver>, DriverErr> {
         let device_path = self.device_path().map_err(DriverErr::Sysfs)?;
         info!("found device {self} under device path {:?}", device_path);
-        let driver_path = device_path.relative("driver").map_err(DriverErr::Sysfs)?;
+        let driver_path = match device_path.relative("driver") {
+            Ok(p) => p,
+            Err(SysfsErr::IoError(e)) if e.kind() == ErrorKind::NotFound => {
+                // The `driver` symlink does not exist — no kernel driver
+                // is currently bound to this device.  This is normal for
+                // NIC types whose kernel driver was not loaded or was
+                // already unbound.
+                info!("no driver symlink for {self} (no driver bound)");
+                return Ok(None);
+            }
+            Err(e) => return Err(DriverErr::Sysfs(e)),
+        };
         info!("{self} is using driver path {driver_path:?}");
         match driver_path.inner().file_name() {
             Some(os_str) => match os_str.to_str() {
@@ -99,6 +110,12 @@ impl std::fmt::Display for PciNic {
 /// Enum describing supported PCI drivers.
 #[derive(Debug, Copy, Clone, PartialEq, Eq, strum::EnumString, strum::IntoStaticStr)]
 pub enum PciDriver {
+    /// Intel's e1000 driver (82540EM — QEMU `e1000` device).
+    #[strum(serialize = "e1000")]
+    E1000,
+    /// Intel's e1000e driver (82574L — QEMU `e1000e` device).
+    #[strum(serialize = "e1000e")]
+    E1000E,
     /// Intel's i40e driver.
     #[strum(serialize = "i40e")]
     I40e,
@@ -318,14 +335,11 @@ impl BindToVfioPci for PciNic {
                 }
             }
             Ok(None) => {
-                let msg = format!(
-                    "device {self} is unknown to the operating system.  You may need to load (modprobe) a driver"
-                );
-                error!("{msg}");
-                return Err(DriverErr::Sysfs(SysfsErr::IoError(std::io::Error::new(
-                    ErrorKind::Unsupported,
-                    msg,
-                ))));
+                // No driver is currently bound.  This is normal for NIC
+                // types whose kernel driver was not loaded (e.g. e1000e
+                // without CONFIG_E1000E) or was already manually unbound.
+                // Proceed directly to override + bind.
+                info!("device {self} has no driver bound; proceeding to vfio-pci bind");
             }
             Err(err) => {
                 error!("failed to get device driver: {:?}", err);

hardware/src/nic/mod.rs

@@ -155,9 +155,15 @@ pre-flight: (check-dependencies) (fmt "--check") (test) (lint) (doctest)
     echo "pre flight checks pass"
 
 [script]
-test package="tests.all" *args: (build (if package == "tests.all" { "tests.all" } else { "tests.pkg." + package }) args)
+test package="tests.all" *args: (setup-roots) (build (if package == "tests.all" { "tests.all" } else { "tests.pkg." + package }) args)
     {{ _just_debuggable_ }}
     declare -r target="{{ if package == "tests.all" { "tests.all" } else { "tests.pkg." + package } }}"
+    # Export scratch-container roots when the symlinks exist so that
+    # #[in_vm] tests use the nix-built testroot/vmroot automatically.
+    if [[ -e testroot && -e vmroot ]]; then
+        export N_VM_TEST_ROOT="$(pwd)/testroot"
+        export N_VM_VM_ROOT="$(pwd)/vmroot"
+    fi
     cargo nextest run --archive-file results/${target}/*.tar.zst --workspace-remap $(pwd) {{ filter }}
 
 # Build and run the criterion benches. The rte_acl benches are gated behind the
@@ -199,11 +205,11 @@ test-each *args: (build "tests.pkg" args)
 docs package="" *args: (build (if package == "" { "docs.all" } else { "docs.pkg." + package }) args)
     {{ _just_debuggable_ }}
 
-# Create devroot and sysroot symlinks for local development
+# Create devroot, sysroot, testroot, and vmroot symlinks for local development
 [script]
 setup-roots *args:
     {{ _just_debuggable_ }}
-    for root in devroot sysroot; do
+    for root in devroot sysroot testroot vmroot; do
       nix build -f default.nix "${root}" \
         --argstr default-features '{{ default_features }}' \
         --argstr features '{{ features }}' \
@@ -370,6 +376,12 @@ doctest *args:
 coverage target="tests.all" *args: (build (if target == "tests.all" { "tests.all" } else { "tests.pkg." + target }) args)
     {{ _just_debuggable_ }}
     declare -r target="{{ if target == "tests.all" { "tests.all" } else { "tests.pkg." + target } }}"
+    # Export scratch-container roots when the symlinks exist so that
+    # #[in_vm] tests use the nix-built testroot/vmroot automatically.
+    if [[ -e testroot && -e vmroot ]]; then
+      export N_VM_TEST_ROOT="$(pwd)/testroot"
+      export N_VM_VM_ROOT="$(pwd)/vmroot"
+    fi
     export LLVM_COV="$(pwd)/devroot/bin/llvm-cov"
     export LLVM_PROFDATA="$(pwd)/devroot/bin/llvm-profdata"
     export CARGO_LLVM_COV_TARGET_DIR="$(pwd)/target/llvm-cov"