ci: replace virtme with vimto

vimto is a lightweight wrapper around qemu with the sole purpose of
executing Go unit tests. Use it instead of virtme, which has not
had a reliable upstream for a while.

Signed-off-by: Lorenz Bauer <lmb@isovalent.com>

.github/workflows/ci.yml

@@ -11,6 +11,7 @@ env:
   CI_MIN_CLANG_VERSION: '11'
   go_version: '~1.22'
   prev_go_version: '~1.21'
+  CGO_ENABLED: '0'
   # This needs to match whatever Netlify supports.
   # Also defined in Pipfile.
   python_version: '~3.8'
@@ -108,6 +109,8 @@ jobs:
     runs-on: ubuntu-latest-4cores-16gb
     needs: build-and-lint
     timeout-minutes: 15
+    env:
+      CI_KERNEL_SELFTESTS: '/usr/src/linux/tools/testing/selftests/bpf'
     steps:
       - uses: actions/checkout@v4
 
@@ -116,15 +119,16 @@ jobs:
         with:
           go-version: '${{ env.prev_go_version }}'
 
+      - run: go install lmb.io/vimto@latest
       - run: go install gotest.tools/gotestsum@v1.8.1
-      - run: sudo pip3 install https://github.com/amluto/virtme/archive/beb85146cd91de37ae455eccb6ab67c393e6e290.zip
       - run: sudo apt-get update && sudo apt-get install -y --no-install-recommends qemu-system-x86
+      - run: sudo chmod 0666 /dev/kvm
 
       - name: Test
-        run: gotestsum --raw-command --ignore-non-json-output-lines --junitfile junit.xml -- ./run-tests.sh $CI_MAX_KERNEL_VERSION -short -count 1 -json ./...
+        run: gotestsum --raw-command --ignore-non-json-output-lines --junitfile junit.xml -- vimto -kernel :${CI_MAX_KERNEL_VERSION}-selftests -- go test -short -count 1 -json ./...
 
       - name: Benchmark
-        run: go test -exec sudo -short -run '^$' -bench . -benchtime=1x ./...
+        run: vimto -kernel :${CI_MAX_KERNEL_VERSION}-selftests -- go test -short -run '^$' -bench . -benchtime=1x ./...
 
       - name: Upload Test Results
         if: always()
@@ -167,15 +171,21 @@ jobs:
           sudo dmesg
 
   vm-test:
-    name: Run tests on pre-built kernel
+    name: Run tests
     runs-on: ubuntu-latest-4cores-16gb
     needs: build-and-lint
     timeout-minutes: 15
     strategy:
       matrix:
-        version: ["6.7", "6.1", "5.15", "5.10", "5.4", "4.19", "4.14", "4.9"]
-    env:
-      KERNEL_VERSION: "${{ matrix.version }}"
+        tag:
+          - "6.7"
+          - "6.1"
+          - "5.15"
+          - "5.10"
+          - "5.4"
+          - "4.19"
+          - "4.14"
+          - "4.9"
     steps:
       - uses: actions/checkout@v4
 
@@ -185,15 +195,16 @@ jobs:
           go-version: '${{ env.go_version }}'
 
       - run: go install gotest.tools/gotestsum@v1.8.1
-      - run: sudo pip3 install https://github.com/amluto/virtme/archive/beb85146cd91de37ae455eccb6ab67c393e6e290.zip
+      - run: go install lmb.io/vimto@latest
       - run: sudo apt-get update && sudo apt-get install -y --no-install-recommends qemu-system-x86
+      - run: sudo chmod 0666 /dev/kvm
 
       - name: Test
-        run: gotestsum --raw-command --ignore-non-json-output-lines --junitfile junit.xml -- ./run-tests.sh $KERNEL_VERSION -short -count 1 -json ./...
+        run: gotestsum --raw-command --ignore-non-json-output-lines --junitfile junit.xml -- vimto -kernel :${{ matrix.tag }} -- go test -short -count 1 -json ./...
 
       - name: Upload Test Results
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: Test Results (${{ matrix.version }})
+          name: Test Results (${{ matrix.tag }})
           path: junit.xml

.vimto.toml

@@ -0,0 +1,12 @@
+kernel="ghcr.io/cilium/ci-kernels:stable"
+smp="cpus=2"
+memory="1G"
+user="root"
+setup=[
+  "mount -t cgroup2 -o nosuid,noexec,nodev cgroup2 /sys/fs/cgroup",
+  "/bin/sh -c 'modprobe bpf_testmod || true'",
+  "dmesg --clear",
+]
+teardown=[
+  "dmesg --read-clear",
+]

docs/ebpf/contributing/index.md

@@ -22,30 +22,24 @@ the contents of the DCO.
 Many of the tests require privileges to set resource limits and load eBPF code.
 The easiest way to obtain these is to run the tests with `sudo`.
 
-To test the current package with your local kernel you can simply run:
-```
-go test -exec sudo ./...
-```
-
-To test the current package with a different kernel version you can use the [run-tests.sh] script.
-It requires [virtme], qemu and docker to be installed.
-Unfortunately virtme is not well maintained at the moment, so we recommend installing
-a known working version:
+Run all tests with the following command:
 
 ```shell-session
-pip3 install https://github.com/amluto/virtme/archive/beb85146cd91de37ae455eccb6ab67c393e6e290.zip
+go test -exec sudo ./...
 ```
 
-Once you have the dependencies you can run all tests on a different kernel:
+To test the current package with a different kernel version you can use [vimto].
+Once you have installed `vimto` and its dependencies you can run all tests on a
+different kernel:
 
 ```shell-session
-./run-tests.sh 5.4
+vimto -- go test ./...
 ```
 
-Or run a subset of tests:
+Use one of the [precompiled kernels](https://github.com/cilium/ci-kernels/pkgs/container/ci-kernels/versions) like so:
 
 ```shell-session
-./run-tests.sh 5.4 -run TCX ./link
+vimto -kernel :mainline -- go test ./...
 ```
 
 ## Regenerating testdata and source code
@@ -105,8 +99,7 @@ you as a code owner. Please create an issue in the repository.
     * Maintain roadmap and encourage contributions towards it
     * Merge approved PRs
 
-[virtme]: https://github.com/amluto/virtme
-[run-tests.sh]: https://github.com/cilium/ebpf/blob/main/run-tests.sh
+[vimto]: https://github.com/lmb/vimto
 [permissions]: https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/repository-roles-for-an-organization#permissions-for-each-role
 [ebpf-go-contributors]: https://github.com/orgs/cilium/teams/ebpf-go-contributors/members
 [ebpf-go-reviewers]: https://github.com/orgs/cilium/teams/ebpf-go-reviewers/members

elf_reader_test.go

@@ -907,7 +907,7 @@ func TestIPRoute2Compat(t *testing.T) {
 }
 
 var (
-	elfPath    = flag.String("elfs", os.Getenv("KERNEL_SELFTESTS"), "`Path` containing libbpf-compatible ELFs (defaults to $KERNEL_SELFTESTS)")
+	elfPath    = flag.String("elfs", os.Getenv("CI_KERNEL_SELFTESTS"), "`Path` containing libbpf-compatible ELFs (defaults to $CI_KERNEL_SELFTESTS)")
 	elfPattern = flag.String("elf-pattern", "*.o", "Glob `pattern` for object files that should be tested")
 )
 

internal/version_test.go

@@ -1,8 +1,9 @@
 package internal
 
 import (
-	"os"
 	"testing"
+
+	"github.com/go-quicktest/qt"
 )
 
 func TestVersion(t *testing.T) {
@@ -48,19 +49,8 @@ func TestKernelVersion(t *testing.T) {
 }
 
 func TestCurrentKernelVersion(t *testing.T) {
-	v, err := KernelVersion()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if evStr := os.Getenv("KERNEL_VERSION"); evStr != "" {
-		ev, err := NewVersion(evStr)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if ev[0] != v[0] || ev[1] != v[1] {
-			t.Errorf("expected kernel version %d.%d, got %d.%d", ev[0], ev[1], v[0], v[1])
-		}
-	}
+	_, err := KernelVersion()
+	qt.Assert(t, qt.IsNil(err))
 }
 
 func TestVersionFromCode(t *testing.T) {

testdata/sh/update-kernel-deps.sh

@@ -2,7 +2,25 @@
 
 set -euo pipefail
 
-source "$(dirname "$(realpath "$0")")/lib.sh"
+readonly docker="${CONTAINER_ENGINE:-docker}"
+
+extract_oci_image() {
+	local image_name=$1
+	local target_directory=$2
+
+	echo -n "Fetching $image_name... "
+
+	# We abuse the --output flag of docker buildx to obtain a copy of the image.
+	# This is simpler than creating a temporary container and using docker cp.
+	# It also automatically fetches the image for us if necessary.
+	if ! echo "FROM $image_name" | "$docker" buildx build --quiet --pull --output="$target_directory" - &> /dev/null; then
+		echo "failed"
+		return 1
+	fi
+
+	echo "ok"
+	return 0
+}
 
 tmp=$(mktemp -d)