[Devel] [PATCH vz10 1/4] selftests/bpf: Use local type for bpf_fou_encap in test_tunnel_kern

[Devel] [PATCH vz10 1/4] selftests/bpf: Use local type for bpf_fou_encap in test_tunnel_kern

[Eva Kurchatova]

From: Gregory Bell <grbell@redhat.com>

Replace the forward-declared struct bpf_fou_encap with the existing
bpf_fou_encap___local type in the bpf_skb_set_fou_encap and
bpf_skb_get_fou_encap declarations. This removes the need for
the forward declaration and the explicit casts at each call.

Fixes: d17f9b370df6 ("selftests/bpf: Fix compilation failure when CONFIG_NET_FOU!=y")
Signed-off-by: Gregory Bell <grbell@redhat.com>
Link: https://lore.kernel.org/r/20260417154122.2558890-3-grbell@redhat.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
(cherry picked from commit afb0450be061907a0f5d36bd8b010ca30eda3d3b)

https://virtuozzo.atlassian.net/browse/VSTOR-139677
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 .../testing/selftests/bpf/progs/test_tunnel_kern.c  | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
index 32127f1cd687..30f1de458669 100644
--- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
@@ -6,6 +6,7 @@
  * modify it under the terms of version 2 of the GNU General Public
  * License as published by the Free Software Foundation.
  */
+#define BPF_NO_KFUNC_PROTOTYPES
 #include "vmlinux.h"
 #include <bpf/bpf_core_read.h>
 #include <bpf/bpf_helpers.h>
@@ -36,12 +37,10 @@ enum bpf_fou_encap_type___local {
 	FOU_BPF_ENCAP_GUE___local,
 };
 
-struct bpf_fou_encap;
-
 int bpf_skb_set_fou_encap(struct __sk_buff *skb_ctx,
-			  struct bpf_fou_encap *encap, int type) __ksym;
+			  struct bpf_fou_encap___local *encap, int type) __ksym;
 int bpf_skb_get_fou_encap(struct __sk_buff *skb_ctx,
-			  struct bpf_fou_encap *encap) __ksym;
+			  struct bpf_fou_encap___local *encap) __ksym;
 struct xfrm_state *
 bpf_xdp_get_xfrm_state(struct xdp_md *ctx, struct bpf_xfrm_state_opts *opts,
 		       u32 opts__sz) __ksym;
@@ -781,7 +780,7 @@ int ipip_gue_set_tunnel(struct __sk_buff *skb)
 	encap.sport = 0;
 	encap.dport = bpf_htons(5555);
 
-	ret = bpf_skb_set_fou_encap(skb, (struct bpf_fou_encap *)&encap,
+	ret = bpf_skb_set_fou_encap(skb, &encap,
 				    bpf_core_enum_value(enum bpf_fou_encap_type___local,
 							FOU_BPF_ENCAP_GUE___local));
 	if (ret < 0) {
@@ -820,7 +819,7 @@ int ipip_fou_set_tunnel(struct __sk_buff *skb)
 	encap.sport = 0;
 	encap.dport = bpf_htons(5555);
 
-	ret = bpf_skb_set_fou_encap(skb, (struct bpf_fou_encap *)&encap,
+	ret = bpf_skb_set_fou_encap(skb, &encap,
 				    FOU_BPF_ENCAP_FOU___local);
 	if (ret < 0) {
 		log_err(ret);
@@ -843,7 +842,7 @@ int ipip_encap_get_tunnel(struct __sk_buff *skb)
 		return TC_ACT_SHOT;
 	}
 
-	ret = bpf_skb_get_fou_encap(skb, (struct bpf_fou_encap *)&encap);
+	ret = bpf_skb_get_fou_encap(skb, &encap);
 	if (ret < 0) {
 		log_err(ret);
 		return TC_ACT_SHOT;
-- 
2.55.0

[Devel] [PATCH vz10 2/4] selftests/bpf: run the network tests in their own netns

[Eva Kurchatova]

Three tests use the initial namespace and fail on what the machine has
in it rather than on the kernel under test.

test_sock binds 127.0.0.1:5000, which a web server on the machine holds,
and test_xdp_features binds an IPv6 control socket that the machine's
firewall refuses:

  Failed connecting to the Device Under Test control socket

test_xdp_features also always names its device v1 and traps cleanup for
signals only, not for a normal exit, so a failed run leaves the device
and the namespace behind and every later run stops in setup with nothing
printed at all.  Five namespaces were left over after one suite run here.

test_tunnel has the same problem and two more of its own: it needs the
fou module, which nothing loads, and it asks for encapsulations this
kernel may not have.  Load the module, and let check() probe the kernel
so the callers skip an encapsulation that is missing instead of failing.

Run all three in a namespace of their own: no rule and no service of the
machine applies, and whatever they leave behind goes away with it.

https://virtuozzo.atlassian.net/browse/VSTOR-139677
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/bpf/test_sock.c       | 17 +++++++
 tools/testing/selftests/bpf/test_tunnel.sh    | 50 +++++++++++++++----
 .../selftests/bpf/test_xdp_features.sh        | 13 +++++
 3 files changed, 69 insertions(+), 11 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
index 810c3740b2cc..0298ff2e5cf7 100644
--- a/tools/testing/selftests/bpf/test_sock.c
+++ b/tools/testing/selftests/bpf/test_sock.c
@@ -1,7 +1,10 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (c) 2018 Facebook
 
+#define _GNU_SOURCE
+#include <sched.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <unistd.h>
 
 #include <arpa/inet.h>
@@ -536,6 +539,20 @@ int main(int argc, char **argv)
 	int cgfd = -1;
 	int err = 0;
 
+	/* The tests bind fixed ports on the loopback address, and one of
+	 * them retries on 5000, which a service on the machine may well be
+	 * listening on.  Take a network namespace of our own so that only
+	 * the sockets of this test are in it.
+	 */
+	if (unshare(CLONE_NEWNET)) {
+		log_err("unshare(CLONE_NEWNET)");
+		return -1;
+	}
+	if (system("ip link set lo up")) {
+		log_err("bringing loopback up");
+		return -1;
+	}
+
 	cgfd = cgroup_setup_and_join(CG_PATH);
 	if (cgfd < 0)
 		goto err;
diff --git a/tools/testing/selftests/bpf/test_tunnel.sh b/tools/testing/selftests/bpf/test_tunnel.sh
index d9661b9988ba..172aac4dae4f 100755
--- a/tools/testing/selftests/bpf/test_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tunnel.sh
@@ -45,6 +45,22 @@
 # 5) Tunnel protocol handler, ex: vxlan_rcv, decap the packet
 # 6) Forward the packet to the overlay tnl dev
 
+# The tunnels are built between this namespace and at_ns0, so a firewall
+# on the machine filters the encapsulated traffic: our nodes reject IPv6
+# with admin-prohibited, which the ip6geneve case never survives.  A
+# namespace of our own has no such rules, and takes the devices with it
+# when the test ends.
+if [ -z "${BPF_TUNNEL_NETNS:-}" ]; then
+	BPF_TUNNEL_NETNS=1 export BPF_TUNNEL_NETNS
+	exec unshare -n sh -c 'ip link set lo up; exec "$0" "$@"' "$0" "$@"
+fi
+
+# The BPF object refers to the FOU kfuncs, and libbpf has to resolve them
+# against kernel or module BTF before it can load the object at all, also
+# for the tunnel types that do not use FOU.  Nothing to do where FOU is
+# built in.
+modprobe fou 2>/dev/null
+
 BPF_FILE="test_tunnel_kern.bpf.o"
 BPF_PIN_TUNNEL_DIR="/sys/fs/bpf/tc/tunnel"
 PING_ARG="-c 3 -w 10 -q"
@@ -241,7 +257,7 @@ test_gre()
 	DEV=gretap11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_gre_tunnel 2
 	attach_bpf $DEV gre_set_tunnel gre_get_tunnel
@@ -265,7 +281,7 @@ test_gre_no_tunnel_key()
 	DEV=gre11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_gre_tunnel
 	attach_bpf $DEV gre_set_tunnel_no_key gre_get_tunnel
@@ -289,7 +305,7 @@ test_ip6gre()
 	DEV=ip6gre11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	# reuse the ip6gretap function
 	add_ip6gretap_tunnel
@@ -319,7 +335,7 @@ test_ip6gretap()
 	DEV=ip6gretap11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_ip6gretap_tunnel
 	attach_bpf $DEV ip6gretap_set_tunnel ip6gretap_get_tunnel
@@ -348,7 +364,7 @@ test_erspan()
 	DEV=erspan11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_erspan_tunnel $1
 	attach_bpf $DEV erspan_set_tunnel erspan_get_tunnel
@@ -372,7 +388,7 @@ test_ip6erspan()
 	DEV=ip6erspan11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_ip6erspan_tunnel $1
 	attach_bpf $DEV ip4ip6erspan_set_tunnel ip4ip6erspan_get_tunnel
@@ -395,7 +411,7 @@ test_geneve()
 	DEV=geneve11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_geneve_tunnel
 	attach_bpf $DEV geneve_set_tunnel geneve_get_tunnel
@@ -419,7 +435,7 @@ test_ip6geneve()
 	DEV=ip6geneve11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_ip6geneve_tunnel
 	attach_bpf $DEV ip6geneve_set_tunnel ip6geneve_get_tunnel
@@ -443,7 +459,7 @@ test_ipip()
 	DEV=ipip11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_ipip_tunnel
 	ip link set dev veth1 mtu 1500
@@ -468,7 +484,7 @@ test_ipip6()
 	DEV=ipip6tnl11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_ip6tnl_tunnel
 	ip link set dev veth1 mtu 1500
@@ -496,7 +512,7 @@ test_ip6ip6()
 	DEV=ip6ip6tnl11
 	ret=0
 
-	check $TYPE
+	check $TYPE || return 0
 	config_device
 	add_ip6tnl_tunnel
 	ip link set dev veth1 mtu 1500
@@ -563,6 +579,18 @@ check()
 	cleanup
 	return 1
 	fi
+
+	# The kernel can be built without a tunnel type, and then rtnetlink
+	# has no ops for it and says so.
+	if ip link add dev "probe_$1" type "$1" 2>&1 | \
+	   grep -q "Unknown device type"; then
+		echo "SKIP $1: kernel does not support $1"
+		cleanup
+		return 1
+	fi
+	ip link del dev "probe_$1" 2>/dev/null
+
+	return 0
 }
 
 enable_debug()
diff --git a/tools/testing/selftests/bpf/test_xdp_features.sh b/tools/testing/selftests/bpf/test_xdp_features.sh
index 0aa71c4455c0..1f6be4af6718 100755
--- a/tools/testing/selftests/bpf/test_xdp_features.sh
+++ b/tools/testing/selftests/bpf/test_xdp_features.sh
@@ -1,6 +1,19 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+# The device under test listens on the veth address of the namespace this
+# script runs in and the tester connects to it, so a firewall on the
+# machine can refuse the control connection:
+#   Failed connecting to the Device Under Test control socket
+# That side of the pair is also always called v1, and cleanup only runs
+# on a signal, so a failed run leaves the device behind and every later
+# run stops in setup.  A namespace of our own has no such rules, and
+# takes the leftovers with it when the test ends.
+if [ -z "${XDP_FEATURES_NETNS:-}" ]; then
+	XDP_FEATURES_NETNS=1 export XDP_FEATURES_NETNS
+	exec unshare -n sh -c 'ip link set lo up; exec "$0" "$@"' "$0" "$@"
+fi
+
 readonly NS="ns1-$(mktemp -u XXXXXX)"
 readonly V0_IP4=10.10.0.11
 readonly V1_IP4=10.10.0.1
-- 
2.55.0

[Devel] [PATCH vz10 3/4] selftests/bpf: use the bpftool built with the tests in test_bpftool_map

[Eva Kurchatova]

The test loads a program that denies write access to a map and then
checks that reading it still works.  Reading it through a bpftool that
opens the map for writing therefore fails:

  Error: can't get map by id (68627): Operation not permitted
   Read access to 0 0 0 0 in prot_map failed

which is what the bpftool of the distribution does here, v7.5.0 against
the v7.7.0 built from this tree.  Prefer the one next to the test, and
fall back to $PATH when it is not there.

https://virtuozzo.atlassian.net/browse/VSTOR-139677
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/bpf/test_bpftool_map.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/test_bpftool_map.sh b/tools/testing/selftests/bpf/test_bpftool_map.sh
index 515b1df0501e..e5f5e3b8dc02 100755
--- a/tools/testing/selftests/bpf/test_bpftool_map.sh
+++ b/tools/testing/selftests/bpf/test_bpftool_map.sh
@@ -18,7 +18,16 @@ BPF_DIR="$BPF_FS_PARENT/test_$TESTNAME"
 SCRIPT_DIR=$(dirname $(realpath "$0"))
 BPF_FILE_PATH="$SCRIPT_DIR/$BPF_FILE"
 BPF_ITER_FILE_PATH="$SCRIPT_DIR/$BPF_ITER_FILE"
-BPFTOOL_PATH="bpftool"
+# Prefer the bpftool that was built together with these tests.  The
+# protection checked here needs one that opens a map read only to look
+# it up, and the bpftool of the distribution can be too old for that:
+# it opens the map for writing, the fmod_ret program denies that, and
+# the read is reported as failed.
+if [ -x "$SCRIPT_DIR/bpftool" ]; then
+	BPFTOOL_PATH="$SCRIPT_DIR/bpftool"
+else
+	BPFTOOL_PATH="bpftool"
+fi
 # Assume the script is located under tools/testing/selftests/bpf/
 KDIR_ROOT_DIR=$(realpath "$SCRIPT_DIR"/../../../../)
 
-- 
2.55.0

[Devel] [PATCH vz10 4/4] selftests/bpf: size the map in test_lru_sanity3 to whole refills

[Eva Kurchatova]

The test fills a map of tgt_free * 2 elements and then reads back all
but the last few, which fails on a machine with six cpus:

  test_lru_sanity3 (map_type:9 map_flags:0x0): test_lru_map.c:463:
  test_lru_sanity3: Assertion `!bpf_map_lookup_elem_with_ref_bit(
  lru_map_fd, key, value)' failed.

The elements are handed out in refills of lru->target_free, which the
kernel derives from the map size as clamp((size / nr_cpus) / 2, 1,
LOCAL_FREE_TARGET), 21 for a 256 element map and six cpus.  A refill
the global free list cannot satisfy in full does not stop there, it
calls __bpf_lru_list_shrink() for the remainder, and that evicts
elements which are still live.  256 is not a multiple of 21, so filling
the map ends on a partial refill that drops 17 of the elements the test
goes on to reference, and the lookup fails on the first of them.

Whether the size divides evenly depends on the cpu count alone, which
is why this passes on two and on sixty four cpus and fails on six.

batch_size is already __tgt_size(tgt_free), the refill size of a map
of __map_size(batch_size) elements, so size the map that way and the
fill consumes whole refills and evicts nothing.  Start the keys of the
last insert at map_size + 1, they were placed just past the old size.

Fixes: 5e9388f7984a ("selftests/bpf: adapt one more case in test_lru_map to the new target_free")
https://virtuozzo.atlassian.net/browse/VSTOR-139677
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/bpf/test_lru_map.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_lru_map.c b/tools/testing/selftests/bpf/test_lru_map.c
index 0921939532c6..fc67a337d3c1 100644
--- a/tools/testing/selftests/bpf/test_lru_map.c
+++ b/tools/testing/selftests/bpf/test_lru_map.c
@@ -441,8 +441,18 @@ static void test_lru_sanity3(int map_type, int map_flags, unsigned int tgt_free)
 	assert(sched_next_online(0, &next_cpu) != -1);
 
 	batch_size = __tgt_size(tgt_free);
+	if (!batch_size)
+		batch_size = 1;
+
+	/* The local free list is refilled lru->target_free elements at a
+	 * time, and a refill the global free list cannot satisfy in full
+	 * shrinks the LRU list, which evicts elements that are still live.
+	 * Size the map so that target_free divides it, otherwise filling it
+	 * ends on a partial refill and evicts the elements referenced below.
+	 */
+	map_size = __map_size(batch_size);
+	assert(__tgt_size(map_size) == batch_size);
 
-	map_size = tgt_free * 2;
 	lru_map_fd = create_map(map_type, map_flags, map_size);
 	assert(lru_map_fd != -1);
 
@@ -466,7 +476,7 @@ static void test_lru_sanity3(int map_type, int map_flags, unsigned int tgt_free)
 	}
 
 	/* Insert new batch_size: replaces the non-referenced elements */
-	key = 2 * tgt_free + 1;
+	key = 1 + map_size;
 	end_key = key + batch_size;
 	for (; key < end_key; key++) {
 		assert(!bpf_map_update_elem(lru_map_fd, &key, value,
-- 
2.55.0

Re: [Devel] [PATCH vz10 1/4] selftests/bpf: Use local type for bpf_fou_encap in test_tunnel_kern

[Eva Kurchatova (Virtuozzo)]

On 8/21/26 18:09, Eva Kurchatova wrote:
> From: Gregory Bell <grbell@redhat.com>
>
> Replace the forward-declared struct bpf_fou_encap with the existing
> bpf_fou_encap___local type in the bpf_skb_set_fou_encap and
> bpf_skb_get_fou_encap declarations. This removes the need for
> the forward declaration and the explicit casts at each call.
>
> Fixes: d17f9b370df6 ("selftests/bpf: Fix compilation failure when CONFIG_NET_FOU!=y")
> Signed-off-by: Gregory Bell <grbell@redhat.com>
> Link: https://lore.kernel.org/r/20260417154122.2558890-3-grbell@redhat.com
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> (cherry picked from commit afb0450be061907a0f5d36bd8b010ca30eda3d3b)
>
> https://virtuozzo.atlassian.net/browse/VSTOR-139677
> Feature: fix selftests
> Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
> ---
>   .../testing/selftests/bpf/progs/test_tunnel_kern.c  | 13 ++++++-------
>   1 file changed, 6 insertions(+), 7 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
> index 32127f1cd687..30f1de458669 100644
> --- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
> +++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
> @@ -6,6 +6,7 @@
>    * modify it under the terms of version 2 of the GNU General Public
>    * License as published by the Free Software Foundation.
>    */
> +#define BPF_NO_KFUNC_PROTOTYPES
>   #include "vmlinux.h"
>   #include <bpf/bpf_core_read.h>
>   #include <bpf/bpf_helpers.h>
> @@ -36,12 +37,10 @@ enum bpf_fou_encap_type___local {
>   	FOU_BPF_ENCAP_GUE___local,
>   };
>   
> -struct bpf_fou_encap;
> -
>   int bpf_skb_set_fou_encap(struct __sk_buff *skb_ctx,
> -			  struct bpf_fou_encap *encap, int type) __ksym;
> +			  struct bpf_fou_encap___local *encap, int type) __ksym;
>   int bpf_skb_get_fou_encap(struct __sk_buff *skb_ctx,
> -			  struct bpf_fou_encap *encap) __ksym;
> +			  struct bpf_fou_encap___local *encap) __ksym;
>   struct xfrm_state *
>   bpf_xdp_get_xfrm_state(struct xdp_md *ctx, struct bpf_xfrm_state_opts *opts,
>   		       u32 opts__sz) __ksym;
> @@ -781,7 +780,7 @@ int ipip_gue_set_tunnel(struct __sk_buff *skb)
>   	encap.sport = 0;
>   	encap.dport = bpf_htons(5555);
>   
> -	ret = bpf_skb_set_fou_encap(skb, (struct bpf_fou_encap *)&encap,
> +	ret = bpf_skb_set_fou_encap(skb, &encap,
>   				    bpf_core_enum_value(enum bpf_fou_encap_type___local,
>   							FOU_BPF_ENCAP_GUE___local));
>   	if (ret < 0) {
> @@ -820,7 +819,7 @@ int ipip_fou_set_tunnel(struct __sk_buff *skb)
>   	encap.sport = 0;
>   	encap.dport = bpf_htons(5555);
>   
> -	ret = bpf_skb_set_fou_encap(skb, (struct bpf_fou_encap *)&encap,
> +	ret = bpf_skb_set_fou_encap(skb, &encap,
>   				    FOU_BPF_ENCAP_FOU___local);
>   	if (ret < 0) {
>   		log_err(ret);
> @@ -843,7 +842,7 @@ int ipip_encap_get_tunnel(struct __sk_buff *skb)
>   		return TC_ACT_SHOT;
>   	}
>   
> -	ret = bpf_skb_get_fou_encap(skb, (struct bpf_fou_encap *)&encap);
> +	ret = bpf_skb_get_fou_encap(skb, &encap);
>   	if (ret < 0) {
>   		log_err(ret);
>   		return TC_ACT_SHOT;

Sent v2 patchset: 
https://lists.openvz.org/pipermail/devel/2026-September/084967.html

Added "ms/" prefix for upstream cherry-pick, split the upstreamable 
commit from commit to test_sock.c and test_tunnel.sh which are gone 
upstream.

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel