[Devel] [PATCH hci-8.1 v2 0/1] selftests/bpf: run the xsk veth tests in a network namespace of their own

[Devel] [PATCH hci-8.1 v2 0/1] selftests/bpf: run the xsk veth tests in a network namespace of their own

[Eva Kurchatova]

Changes in v2:

- -f is checked as the sysctl is, 1 to 45 and digits only, so a value
  that would wrap the fragment count or the packet array is refused.
- -f goes into the namespace only when the host's sysctl file could be
  read; a bare -f made getopts complain.
- No network namespace skips the tests, as no veth support does, rather
  than failing them.
- The -f description says the option tells the tests the kernel's limit
  and changes nothing in the kernel.
- The -d hint names the namespace in a usable form.
- test_exit() exits 1 for a skip as it does for the veth one; as the
  script has it.

Link to v1: http://lore.virtuozzo.com/kernel/20261020041218.1659392-1-eva.kurchatova@virtuozzo.com/T/#t

Eva Kurchatova (1):
  selftests/bpf: run the xsk veth tests in a network namespace of their
    own

 tools/testing/selftests/bpf/test_xsk.sh  | 32 ++++++++++++++++++++++--
 tools/testing/selftests/bpf/xskxceiver.c | 17 +++++++++++--
 2 files changed, 45 insertions(+), 4 deletions(-)

-- 
2.56.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 v2 1/1] selftests/bpf: run the xsk veth tests in a network namespace of their own

[Eva Kurchatova]

test_xsk.sh makes its veth pair in the namespace it runs in. Whatever
the host does with a new interface, address configuration, neighbour
discovery, happens on that pair, and the AF_XDP sockets under test
receive the host's packets among their own. The tests count and
inspect what they receive, so a preconfigured host fails some of them
in every mode, and a bare one passes.

Run the veth part in a network namespace of its own. The max_skb_frags
sysctl has no file outside the initial namespace, so xskxceiver takes
the limit from a new -f option ahead of the file, and the script hands
it the host's value, or the one given to its own -f; the option tells
the tests what the kernel's limit is and changes nothing in the kernel.
An interface given with -i is used where it is. Without network
namespaces the tests are skipped, as they are without veth.

https://virtuozzo.atlassian.net/browse/VSTOR-150731
Feature: fix selftests

Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/bpf/test_xsk.sh  | 32 ++++++++++++++++++++++--
 tools/testing/selftests/bpf/xskxceiver.c | 17 +++++++++++--
 2 files changed, 45 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
index 65aafe0003db..f6bff443ef1d 100755
--- a/tools/testing/selftests/bpf/test_xsk.sh
+++ b/tools/testing/selftests/bpf/test_xsk.sh
@@ -83,6 +83,10 @@
 # Run a specific test from the test suite
 #   sudo ./test_xsk.sh -t TEST_NAME
 #
+# Tell the tests the kernel's max_skb_frags where its sysctl file cannot
+# be read, in a network namespace other than the initial one say
+#   sudo ./test_xsk.sh -f FRAGS
+#
 # Display the available command line options
 #   ./test_xsk.sh -h
 
@@ -90,7 +94,7 @@
 
 ETH=""
 
-while getopts "vi:dm:lt:h" flag
+while getopts "vi:dm:lt:f:h" flag
 do
 	case "${flag}" in
 		v) verbose=1;;
@@ -99,6 +103,7 @@ do
 		m) MODE=${OPTARG};;
 		l) list=1;;
 		t) TEST=${OPTARG};;
+		f) FRAGS=${OPTARG};;
 		h) help=1;;
 	esac
 done
@@ -162,8 +167,27 @@ if [ ! -z $ETH ]; then
 	VETH1=${ETH}
 else
 	validate_root_exec
-	validate_veth_support ${VETH0}
 	validate_ip_utility
+	# The host configures and talks on any new interface in its namespace
+	if [ -z "$XSK_NETNS" ]; then
+		XSK_NETNS=xsk${VETH0_POSTFIX}
+		if ! ip netns add ${XSK_NETNS}; then
+			echo "skip all tests: cannot create a network namespace" >&2
+			test_exit $ksft_skip
+		fi
+		trap "ip netns del ${XSK_NETNS}" EXIT
+		# The max_skb_frags sysctl has no file outside the initial namespace
+		[ -n "$FRAGS" ] || FRAGS=$(cat /proc/sys/net/core/max_skb_frags 2>/dev/null)
+		XSK_NETNS=${XSK_NETNS} ip netns exec ${XSK_NETNS} \
+			bash "$0" "$@" ${FRAGS:+-f "${FRAGS}"}
+		retval=$?
+		# The pair stays up for a run by hand
+		[[ $debug -eq 1 ]] && trap - EXIT && \
+			echo "The pair is up in network namespace ${XSK_NETNS}," \
+				"use ip netns exec ${XSK_NETNS}"
+		exit $retval
+	fi
+	validate_veth_support ${VETH0}
 	setup_vethPairs
 
 	retval=$?
@@ -187,6 +211,10 @@ if [ -n "$TEST" ]; then
 	ARGS+="-t ${TEST} "
 fi
 
+if [ -n "$FRAGS" ]; then
+	ARGS+="-f ${FRAGS} "
+fi
+
 retval=$?
 test_status $retval "${TEST_NAME}"
 
diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c
index 11f047b8af75..37c0f3b6677a 100644
--- a/tools/testing/selftests/bpf/xskxceiver.c
+++ b/tools/testing/selftests/bpf/xskxceiver.c
@@ -113,6 +113,7 @@ static bool opt_verbose;
 static bool opt_print_tests;
 static enum test_mode opt_mode = TEST_MODE_ALL;
 static u32 opt_run_test = RUN_ALL_TESTS;
+static u32 opt_max_skb_frags;
 
 void test__fail(void) { /* for network_helpers.c */ }
 
@@ -351,6 +352,7 @@ static struct option long_options[] = {
 	{"mode", required_argument, 0, 'm'},
 	{"list", no_argument, 0, 'l'},
 	{"test", required_argument, 0, 't'},
+	{"frags", required_argument, 0, 'f'},
 	{"help", no_argument, 0, 'h'},
 	{0, 0, 0, 0}
 };
@@ -366,6 +368,7 @@ static void print_usage(char **argv)
 		"  -m, --mode           Run only mode skb, drv, or zc\n"
 		"  -l, --list           List all available tests\n"
 		"  -t, --test           Run a specific test. Enter number from -l option.\n"
+		"  -f, --frags          Take this as the kernel's max_skb_frags, not the sysctl's\n"
 		"  -h, --help           Display this help and exit\n";
 
 	ksft_print_msg(str, basename(argv[0]));
@@ -385,11 +388,13 @@ static void parse_command_line(struct ifobject *ifobj_tx, struct ifobject *ifobj
 	struct ifobject *ifobj;
 	u32 interface_nb = 0;
 	int option_index, c;
+	unsigned long frags;
+	char *end;
 
 	opterr = 0;
 
 	for (;;) {
-		c = getopt_long(argc, argv, "i:vbm:lt:", long_options, &option_index);
+		c = getopt_long(argc, argv, "i:vbm:lt:f:", long_options, &option_index);
 		if (c == -1)
 			break;
 
@@ -437,6 +442,14 @@ static void parse_command_line(struct ifobject *ifobj_tx, struct ifobject *ifobj
 			if (errno)
 				print_usage(argv);
 			break;
+		case 'f':
+			errno = 0;
+			frags = strtoul(optarg, &end, 0);
+			/* The sysctl's own range: 1 to MAX_SKB_FRAGS, which is 45 at most */
+			if (errno || *end || !frags || frags > 45)
+				print_usage(argv);
+			opt_max_skb_frags = frags;
+			break;
 		case 'h':
 		default:
 			print_usage(argv);
@@ -2271,7 +2284,7 @@ static int testapp_too_many_frags(struct test_spec *test)
 	if (test->mode == TEST_MODE_ZC) {
 		max_frags = test->ifobj_tx->xdp_zc_max_segs;
 	} else {
-		max_frags = get_max_skb_frags();
+		max_frags = opt_max_skb_frags ? : get_max_skb_frags();
 		if (!max_frags) {
 			ksft_print_msg("Couldn't retrieve MAX_SKB_FRAGS from system, using default (17) value\n");
 			max_frags = 17;
-- 
2.56.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2 1/1] selftests/bpf: run the xsk veth tests in a network namespace of their own

[no-reply]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] selftests/bpf: test_xsk.sh netns skip path exits 1 via test_exit()
--

commit 8857ec024ef596f27390842fbc1312e800d12531
Author: Eva Kurchatova <eva.kurchatova@virtuozzo.com>

selftests/bpf: run the xsk veth tests in a network namespace of their own

This patch makes test_xsk.sh create a network namespace and re-run itself
inside it, so the veth pair is isolated from the host's traffic. Because
the max_skb_frags sysctl isn't visible outside the initial namespace, it
also adds a -f option to xskxceiver and test_xsk.sh. The commit message
says the tests are skipped when network namespaces are unavailable.

> diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
> --- a/tools/testing/selftests/bpf/test_xsk.sh
> +++ b/tools/testing/selftests/bpf/test_xsk.sh

[ ... ]

> @@ -162,8 +167,27 @@ if [ ! -z $ETH ]; then
>  	VETH1=${ETH}
>  else
>  	validate_root_exec
> -	validate_veth_support ${VETH0}
>  	validate_ip_utility
> +	# The host configures and talks on any new interface in its namespace
> +	if [ -z "$XSK_NETNS" ]; then
> +		XSK_NETNS=xsk${VETH0_POSTFIX}
> +		if ! ip netns add ${XSK_NETNS}; then
> +			echo "skip all tests: cannot create a network namespace" >&2
> +			test_exit $ksft_skip
> +		fi

[Severity: Medium]
The commit message says "Without network namespaces the tests are
skipped", but can this path actually report a skip?

test_exit() is defined in xsk_prereqs.sh as:

    test_exit()
    {
        if [ $1 -ne 0 ]; then
            test_status $1 $(basename $0)
        fi
        exit 1
    }

It prints "[ SKIPPED ]" but then does an unconditional "exit 1" and
ignores its argument. When "ip netns add" fails (no netns support, no
permission, read-only /run/netns, name collision), test_xsk.sh will
therefore exit with status 1, not $ksft_skip (4). The kselftest runner
will then count that as a failure.

Before this patch, a host without netns support would still run the tests
in its current namespace. Now such a host reports a failure.

The test_exit() behaviour wasn't introduced by this patch. It already
affects the existing veth-missing and ip-missing skip paths. This patch
adds a new call site that depends on it, though, and that site is more
likely to be hit.

Should test_exit() be changed to "exit $1", or should this path exit with
$ksft_skip directly, so the skip is reported as the commit message
describes?

> +		trap "ip netns del ${XSK_NETNS}" EXIT

[ ... ]

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261022024816.2435565-1-eva.kurchatova@virtuozzo.com?part=1

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2 1/1] selftests/bpf: run the xsk veth tests in a network namespace of their own

[Eva Kurchatova (Virtuozzo)]

On 10/22/26 05:53, no-reply@sashiko.virtuozzo.com wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] selftests/bpf: test_xsk.sh netns skip path exits 1 via test_exit()
> --
>
> commit 8857ec024ef596f27390842fbc1312e800d12531
> Author: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
>
> selftests/bpf: run the xsk veth tests in a network namespace of their own
>
> This patch makes test_xsk.sh create a network namespace and re-run itself
> inside it, so the veth pair is isolated from the host's traffic. Because
> the max_skb_frags sysctl isn't visible outside the initial namespace, it
> also adds a -f option to xskxceiver and test_xsk.sh. The commit message
> says the tests are skipped when network namespaces are unavailable.
>
>> diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
>> --- a/tools/testing/selftests/bpf/test_xsk.sh
>> +++ b/tools/testing/selftests/bpf/test_xsk.sh
> [ ... ]
>
>> @@ -162,8 +167,27 @@ if [ ! -z $ETH ]; then
>>   	VETH1=${ETH}
>>   else
>>   	validate_root_exec
>> -	validate_veth_support ${VETH0}
>>   	validate_ip_utility
>> +	# The host configures and talks on any new interface in its namespace
>> +	if [ -z "$XSK_NETNS" ]; then
>> +		XSK_NETNS=xsk${VETH0_POSTFIX}
>> +		if ! ip netns add ${XSK_NETNS}; then
>> +			echo "skip all tests: cannot create a network namespace" >&2
>> +			test_exit $ksft_skip
>> +		fi
> [Severity: Medium]
> The commit message says "Without network namespaces the tests are
> skipped", but can this path actually report a skip?
>
> test_exit() is defined in xsk_prereqs.sh as:
>
>      test_exit()
>      {
>          if [ $1 -ne 0 ]; then
>              test_status $1 $(basename $0)
>          fi
>          exit 1
>      }
>
> It prints "[ SKIPPED ]" but then does an unconditional "exit 1" and
> ignores its argument. When "ip netns add" fails (no netns support, no
> permission, read-only /run/netns, name collision), test_xsk.sh will
> therefore exit with status 1, not $ksft_skip (4). The kselftest runner
> will then count that as a failure.
>
> Before this patch, a host without netns support would still run the tests
> in its current namespace. Now such a host reports a failure.
>
> The test_exit() behaviour wasn't introduced by this patch. It already
> affects the existing veth-missing and ip-missing skip paths. This patch
> adds a new call site that depends on it, though, and that site is more
> likely to be hit.
>
> Should test_exit() be changed to "exit $1", or should this path exit with
> $ksft_skip directly, so the skip is reported as the commit message
> describes?
>
>> +		trap "ip netns del ${XSK_NETNS}" EXIT
> [ ... ]

The changelog says so: test_exit() prints the status it is given and 
exits with 1.


It is not this patch's bug, originates in mainline and will take the fix 
to mainline first. This path will not be executed on vzkernel: It is 
only taken where a network namespace can't be created, which anyway is a 
problem for our CI.

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2 1/1] selftests/bpf: run the xsk veth tests in a network namespace of their own

[Konstantin Khorenko]

Hi Eva,

> +		trap "ip netns del ${XSK_NETNS}" EXIT

The parent still has "trap ctrl_c INT" from the top of the script. On
Ctrl-C it runs cleanup_exit ${VETH0} ${VETH1} in the host namespace,
for its own random ve#### names that it never created. If the host
happens to have an interface with that name, it gets deleted.

Fix: in the parent, before the re-exec, replace the INT trap with
"exit 1". The EXIT trap then deletes the namespace, and the pair goes
with it.

> +		# The pair stays up for a run by hand
> +		[[ $debug -eq 1 ]] && trap - EXIT && \
> +			echo "The pair is up in network namespace ${XSK_NETNS}," \
> +				"use ip netns exec ${XSK_NETNS}"

With -d the child prints "-i VETH0 -i VETH1" for the hand run, but not
-f. A hand run of xskxceiver inside the namespace cannot read the
sysctl and falls back to 17 frags, so on a kernel built with
CONFIG_MAX_SKB_FRAGS=45 too_many_frags fails.

Fix: add the value to the child's debug line:

	echo "-i" ${VETH0} "-i" ${VETH1} ${FRAGS:+"-f" ${FRAGS}}

Mainline
--------

Mainline has the same two problems, so please file a bug for sending
the fixes there and put the lore link to the mainline series into it.

The test in mainline is different: since v6.19-rc1 (d1aec26fce257
"selftests/bpf: test_xsk: Integrate test_xsk.c to test_progs
framework") most xsk tests run from test_progs, the rest stays in
test_xsk.sh. So the patches will not be a port of this one, but
please fix it now, while the details are fresh:

- test_xsk.sh creates the veth pair in the caller's namespace.
  Fix: run the veth part in a namespace of its own, as here.

- test_ns_xsk_skb and test_ns_xsk_drv (prog_tests/xsk.c) already run
  in a namespace that test_progs creates for every ns_ test. But they
  read /proc/sys/net/core/max_skb_frags from inside it, the file is
  not there, and they silently use 17.
  Fix: take the limit from vmlinux BTF, the element count of
  struct skb_shared_info.frags (btf__load_vmlinux_btf(),
  btf__find_by_name_kind(), btf_array()->nelems). It works in any
  namespace, so test_xsk.sh needs no -f option in mainline, and it is
  the limit AF_XDP really checks (see the last item below).

Suggested order: the BTF patch first, then the test_xsk.sh namespace
patch on top of it.

Not part of this series
-----------------------

I will take this series once the comments above are addressed; the
issues below are not caused by it and should not hold it. They are in
the same test though, so please file two more tasks, one for vz and
one for mainline, and fix them in both places:

- test_exit() in xsk_prereqs.sh always exits 1, so every "skip all
  tests" (no veth, no ip, no netns) is a failure for the kselftest
  runner.
  Fix: "exit $1". The callers pass $ksft_fail or $ksft_skip.
  vz and mainline.

- test_xsk.sh exits 0 when tests failed: it ends with
  "if [ $failures -eq 0 ]" without an else.
  Fix: backport 2a912258c90e8 ("selftests/bpf: Upon failures, exit
  with code 1 in test_xsk.sh", v6.18-rc1).
  vz only, mainline already has it.

- The test takes the frag limit from the max_skb_frags sysctl, but
  AF_XDP copy mode checks the compile-time MAX_SKB_FRAGS
  (xsk_build_skb() in net/xdp/xsk.c). The sysctl caps TCP and MPTCP
  only. Once an admin lowers it, too_many_frags checks the wrong
  limit.
  Fix in vz: take the limit from vmlinux BTF as described above and
  drop the -f option this series adds.
  In mainline the BTF patch above already covers it.

Please link all new bugs to VSTOR-150731.

Thanks,
Konstantin

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel