* [Devel] [PATCH vz10 v2 2/5] selftests: bpf: run test_xdp_features in its own netns
2026-08-31 23:41 [Devel] [PATCH vz10 v2 1/5] ms/selftests/bpf: Use local type for bpf_fou_encap in test_tunnel_kern Eva Kurchatova
@ 2026-08-31 23:41 ` Eva Kurchatova
2026-08-31 23:41 ` [Devel] [PATCH vz10 v2 3/5] selftests: bpf: size the map in test_lru_sanity3 to whole refills Eva Kurchatova
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Eva Kurchatova @ 2026-08-31 23:41 UTC (permalink / raw)
To: khorenko; +Cc: devel
The device under test listens on the veth address of the namespace the
script runs in and the tester connects to it, so a firewall on the
machine refuses the control connection:
Failed connecting to the Device Under Test control socket
That side of the pair is also always called v1, and cleanup is trapped
for signals only, not for a normal exit, so a failed run leaves the
device behind and every later run stops in setup with nothing printed
at all.
Run the test in a namespace of its own, the way nft_audit.sh and
nft_concat_range.sh already do: no rule of the machine applies, and
what the test leaves behind goes away with the namespace.
https://virtuozzo.atlassian.net/browse/VSTOR-139677
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
tools/testing/selftests/bpf/test_xdp_features.sh | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/tools/testing/selftests/bpf/test_xdp_features.sh b/tools/testing/selftests/bpf/test_xdp_features.sh
index 0aa71c4455c0..75acacee701d 100755
--- a/tools/testing/selftests/bpf/test_xdp_features.sh
+++ b/tools/testing/selftests/bpf/test_xdp_features.sh
@@ -1,6 +1,14 @@
#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
+# The device under test listens on the veth address of the namespace
+# this script runs in, so a firewall on the machine can refuse the
+# control connection, and cleanup is trapped for signals only, so a
+# failed run leaves the device behind and stops every later one. Run
+# in a fresh network namespace, like the netfilter tests do.
+[ "${1}" != "run" ] && { unshare -n "${0}" run; exit $?; }
+ip link set lo up
+
readonly NS="ns1-$(mktemp -u XXXXXX)"
readonly V0_IP4=10.10.0.11
readonly V1_IP4=10.10.0.1
--
2.55.0
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
^ permalink raw reply [flat|nested] 5+ messages in thread* [Devel] [PATCH vz10 v2 3/5] selftests: bpf: size the map in test_lru_sanity3 to whole refills
2026-08-31 23:41 [Devel] [PATCH vz10 v2 1/5] ms/selftests/bpf: Use local type for bpf_fou_encap in test_tunnel_kern Eva Kurchatova
2026-08-31 23:41 ` [Devel] [PATCH vz10 v2 2/5] selftests: bpf: run test_xdp_features in its own netns Eva Kurchatova
@ 2026-08-31 23:41 ` Eva Kurchatova
2026-08-31 23:41 ` [Devel] [PATCH vz10 v2 4/5] selftests: bpf: run test_sock and test_tunnel in their own netns Eva Kurchatova
2026-08-31 23:41 ` [Devel] [PATCH vz10 v2 5/5] selftests: bpf: use the bpftool built with the tests in test_bpftool_map Eva Kurchatova
3 siblings, 0 replies; 5+ messages in thread
From: Eva Kurchatova @ 2026-08-31 23:41 UTC (permalink / raw)
To: khorenko; +Cc: devel
The test fills a map of tgt_free * 2 elements and then reads back all
but the last few, which fails on a machine with six cpus:
test_lru_sanity3 (map_type:9 map_flags:0x0): test_lru_map.c:463:
test_lru_sanity3: Assertion `!bpf_map_lookup_elem_with_ref_bit(
lru_map_fd, key, value)' failed.
The elements are handed out in refills of lru->target_free, which the
kernel derives from the map size as clamp((size / nr_cpus) / 2, 1,
LOCAL_FREE_TARGET), 21 for a 256 element map and six cpus. A refill
the global free list cannot satisfy in full does not stop there, it
calls __bpf_lru_list_shrink() for the remainder, and that evicts
elements which are still live. 256 is not a multiple of 21, so filling
the map ends on a partial refill that drops 17 of the elements the test
goes on to reference, and the lookup fails on the first of them.
Whether the size divides evenly depends on the cpu count alone, which
is why this passes on two and on sixty four cpus and fails on six.
batch_size is already __tgt_size(tgt_free), the refill size of a map
of __map_size(batch_size) elements, so size the map that way and the
fill consumes whole refills and evicts nothing. Start the keys of the
last insert at map_size + 1, they were placed just past the old size.
Fixes: 5e9388f7984a ("selftests/bpf: adapt one more case in test_lru_map to the new target_free")
https://virtuozzo.atlassian.net/browse/VSTOR-139677
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
tools/testing/selftests/bpf/test_lru_map.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/test_lru_map.c b/tools/testing/selftests/bpf/test_lru_map.c
index 0921939532c6..fc67a337d3c1 100644
--- a/tools/testing/selftests/bpf/test_lru_map.c
+++ b/tools/testing/selftests/bpf/test_lru_map.c
@@ -441,8 +441,18 @@ static void test_lru_sanity3(int map_type, int map_flags, unsigned int tgt_free)
assert(sched_next_online(0, &next_cpu) != -1);
batch_size = __tgt_size(tgt_free);
+ if (!batch_size)
+ batch_size = 1;
+
+ /* The local free list is refilled lru->target_free elements at a
+ * time, and a refill the global free list cannot satisfy in full
+ * shrinks the LRU list, which evicts elements that are still live.
+ * Size the map so that target_free divides it, otherwise filling it
+ * ends on a partial refill and evicts the elements referenced below.
+ */
+ map_size = __map_size(batch_size);
+ assert(__tgt_size(map_size) == batch_size);
- map_size = tgt_free * 2;
lru_map_fd = create_map(map_type, map_flags, map_size);
assert(lru_map_fd != -1);
@@ -466,7 +476,7 @@ static void test_lru_sanity3(int map_type, int map_flags, unsigned int tgt_free)
}
/* Insert new batch_size: replaces the non-referenced elements */
- key = 2 * tgt_free + 1;
+ key = 1 + map_size;
end_key = key + batch_size;
for (; key < end_key; key++) {
assert(!bpf_map_update_elem(lru_map_fd, &key, value,
--
2.55.0
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
^ permalink raw reply [flat|nested] 5+ messages in thread* [Devel] [PATCH vz10 v2 4/5] selftests: bpf: run test_sock and test_tunnel in their own netns
2026-08-31 23:41 [Devel] [PATCH vz10 v2 1/5] ms/selftests/bpf: Use local type for bpf_fou_encap in test_tunnel_kern Eva Kurchatova
2026-08-31 23:41 ` [Devel] [PATCH vz10 v2 2/5] selftests: bpf: run test_xdp_features in its own netns Eva Kurchatova
2026-08-31 23:41 ` [Devel] [PATCH vz10 v2 3/5] selftests: bpf: size the map in test_lru_sanity3 to whole refills Eva Kurchatova
@ 2026-08-31 23:41 ` Eva Kurchatova
2026-08-31 23:41 ` [Devel] [PATCH vz10 v2 5/5] selftests: bpf: use the bpftool built with the tests in test_bpftool_map Eva Kurchatova
3 siblings, 0 replies; 5+ messages in thread
From: Eva Kurchatova @ 2026-08-31 23:41 UTC (permalink / raw)
To: khorenko; +Cc: devel
Both use the initial namespace and fail on what the machine has in it
rather than on the kernel under test.
test_sock binds 127.0.0.1:5000 and fails if anything already listens
there.
test_tunnel needs the fou module, which nothing loads, and asks for
encapsulations this kernel may not have. Run both in a namespace of
their own, load the module, and let check() probe the kernel so the
callers skip an encapsulation that is missing instead of failing.
Upstream carries neither test any more: commit eea6c14c10ce
("selftests/bpf: Retire test_sock.c") and commit a54e7006967f
("selftests/bpf: test_tunnel: Remove test_tunnel.sh") dropped them once
their cases had moved to test_progs. Both are still in this tree and
still run, so they are fixed in this tree.
https://virtuozzo.atlassian.net/browse/VSTOR-139677
Feature: fix vz selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
tools/testing/selftests/bpf/test_sock.c | 17 ++++++++
tools/testing/selftests/bpf/test_tunnel.sh | 50 +++++++++++++++++-----
2 files changed, 56 insertions(+), 11 deletions(-)
diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
index 810c3740b2cc..0298ff2e5cf7 100644
--- a/tools/testing/selftests/bpf/test_sock.c
+++ b/tools/testing/selftests/bpf/test_sock.c
@@ -1,7 +1,10 @@
// SPDX-License-Identifier: GPL-2.0
// Copyright (c) 2018 Facebook
+#define _GNU_SOURCE
+#include <sched.h>
#include <stdio.h>
+#include <stdlib.h>
#include <unistd.h>
#include <arpa/inet.h>
@@ -536,6 +539,20 @@ int main(int argc, char **argv)
int cgfd = -1;
int err = 0;
+ /* The tests bind fixed ports on the loopback address, and one of
+ * them retries on 5000, which a service on the machine may well be
+ * listening on. Take a network namespace of our own so that only
+ * the sockets of this test are in it.
+ */
+ if (unshare(CLONE_NEWNET)) {
+ log_err("unshare(CLONE_NEWNET)");
+ return -1;
+ }
+ if (system("ip link set lo up")) {
+ log_err("bringing loopback up");
+ return -1;
+ }
+
cgfd = cgroup_setup_and_join(CG_PATH);
if (cgfd < 0)
goto err;
diff --git a/tools/testing/selftests/bpf/test_tunnel.sh b/tools/testing/selftests/bpf/test_tunnel.sh
index d9661b9988ba..172aac4dae4f 100755
--- a/tools/testing/selftests/bpf/test_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tunnel.sh
@@ -45,6 +45,22 @@
# 5) Tunnel protocol handler, ex: vxlan_rcv, decap the packet
# 6) Forward the packet to the overlay tnl dev
+# The tunnels are built between this namespace and at_ns0, so a firewall
+# on the machine filters the encapsulated traffic: our nodes reject IPv6
+# with admin-prohibited, which the ip6geneve case never survives. A
+# namespace of our own has no such rules, and takes the devices with it
+# when the test ends.
+if [ -z "${BPF_TUNNEL_NETNS:-}" ]; then
+ BPF_TUNNEL_NETNS=1 export BPF_TUNNEL_NETNS
+ exec unshare -n sh -c 'ip link set lo up; exec "$0" "$@"' "$0" "$@"
+fi
+
+# The BPF object refers to the FOU kfuncs, and libbpf has to resolve them
+# against kernel or module BTF before it can load the object at all, also
+# for the tunnel types that do not use FOU. Nothing to do where FOU is
+# built in.
+modprobe fou 2>/dev/null
+
BPF_FILE="test_tunnel_kern.bpf.o"
BPF_PIN_TUNNEL_DIR="/sys/fs/bpf/tc/tunnel"
PING_ARG="-c 3 -w 10 -q"
@@ -241,7 +257,7 @@ test_gre()
DEV=gretap11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_gre_tunnel 2
attach_bpf $DEV gre_set_tunnel gre_get_tunnel
@@ -265,7 +281,7 @@ test_gre_no_tunnel_key()
DEV=gre11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_gre_tunnel
attach_bpf $DEV gre_set_tunnel_no_key gre_get_tunnel
@@ -289,7 +305,7 @@ test_ip6gre()
DEV=ip6gre11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
# reuse the ip6gretap function
add_ip6gretap_tunnel
@@ -319,7 +335,7 @@ test_ip6gretap()
DEV=ip6gretap11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_ip6gretap_tunnel
attach_bpf $DEV ip6gretap_set_tunnel ip6gretap_get_tunnel
@@ -348,7 +364,7 @@ test_erspan()
DEV=erspan11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_erspan_tunnel $1
attach_bpf $DEV erspan_set_tunnel erspan_get_tunnel
@@ -372,7 +388,7 @@ test_ip6erspan()
DEV=ip6erspan11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_ip6erspan_tunnel $1
attach_bpf $DEV ip4ip6erspan_set_tunnel ip4ip6erspan_get_tunnel
@@ -395,7 +411,7 @@ test_geneve()
DEV=geneve11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_geneve_tunnel
attach_bpf $DEV geneve_set_tunnel geneve_get_tunnel
@@ -419,7 +435,7 @@ test_ip6geneve()
DEV=ip6geneve11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_ip6geneve_tunnel
attach_bpf $DEV ip6geneve_set_tunnel ip6geneve_get_tunnel
@@ -443,7 +459,7 @@ test_ipip()
DEV=ipip11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_ipip_tunnel
ip link set dev veth1 mtu 1500
@@ -468,7 +484,7 @@ test_ipip6()
DEV=ipip6tnl11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_ip6tnl_tunnel
ip link set dev veth1 mtu 1500
@@ -496,7 +512,7 @@ test_ip6ip6()
DEV=ip6ip6tnl11
ret=0
- check $TYPE
+ check $TYPE || return 0
config_device
add_ip6tnl_tunnel
ip link set dev veth1 mtu 1500
@@ -563,6 +579,18 @@ check()
cleanup
return 1
fi
+
+ # The kernel can be built without a tunnel type, and then rtnetlink
+ # has no ops for it and says so.
+ if ip link add dev "probe_$1" type "$1" 2>&1 | \
+ grep -q "Unknown device type"; then
+ echo "SKIP $1: kernel does not support $1"
+ cleanup
+ return 1
+ fi
+ ip link del dev "probe_$1" 2>/dev/null
+
+ return 0
}
enable_debug()
--
2.55.0
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
^ permalink raw reply [flat|nested] 5+ messages in thread* [Devel] [PATCH vz10 v2 5/5] selftests: bpf: use the bpftool built with the tests in test_bpftool_map
2026-08-31 23:41 [Devel] [PATCH vz10 v2 1/5] ms/selftests/bpf: Use local type for bpf_fou_encap in test_tunnel_kern Eva Kurchatova
` (2 preceding siblings ...)
2026-08-31 23:41 ` [Devel] [PATCH vz10 v2 4/5] selftests: bpf: run test_sock and test_tunnel in their own netns Eva Kurchatova
@ 2026-08-31 23:41 ` Eva Kurchatova
3 siblings, 0 replies; 5+ messages in thread
From: Eva Kurchatova @ 2026-08-31 23:41 UTC (permalink / raw)
To: khorenko; +Cc: devel
The test loads a program that denies write access to a map and then
checks that reading it still works. Reading it through a bpftool that
opens the map for writing therefore fails:
Error: can't get map by id (68627): Operation not permitted
Read access to 0 0 0 0 in prot_map failed
An installed bpftool v7.5.0 opens the map that way, where the v7.7.0
built alongside the test does not. Prefer the one next to the test and
fall back to $PATH when it is absent.
Commit 2d96bbdfd3b5 ("selftests/bpf: convert
test_bpftool_map_access.sh into test_progs framework") removed this
script upstream, so the change applies to this tree only.
https://virtuozzo.atlassian.net/browse/VSTOR-139677
Feature: fix vz selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
tools/testing/selftests/bpf/test_bpftool_map.sh | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/test_bpftool_map.sh b/tools/testing/selftests/bpf/test_bpftool_map.sh
index 515b1df0501e..e5f5e3b8dc02 100755
--- a/tools/testing/selftests/bpf/test_bpftool_map.sh
+++ b/tools/testing/selftests/bpf/test_bpftool_map.sh
@@ -18,7 +18,16 @@ BPF_DIR="$BPF_FS_PARENT/test_$TESTNAME"
SCRIPT_DIR=$(dirname $(realpath "$0"))
BPF_FILE_PATH="$SCRIPT_DIR/$BPF_FILE"
BPF_ITER_FILE_PATH="$SCRIPT_DIR/$BPF_ITER_FILE"
-BPFTOOL_PATH="bpftool"
+# Prefer the bpftool that was built together with these tests. The
+# protection checked here needs one that opens a map read only to look
+# it up, and the bpftool of the distribution can be too old for that:
+# it opens the map for writing, the fmod_ret program denies that, and
+# the read is reported as failed.
+if [ -x "$SCRIPT_DIR/bpftool" ]; then
+ BPFTOOL_PATH="$SCRIPT_DIR/bpftool"
+else
+ BPFTOOL_PATH="bpftool"
+fi
# Assume the script is located under tools/testing/selftests/bpf/
KDIR_ROOT_DIR=$(realpath "$SCRIPT_DIR"/../../../../)
--
2.55.0
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
^ permalink raw reply [flat|nested] 5+ messages in thread