test+build(ff_dpdk_kni): Stage-7+ FU-S7-KNI-ENABLE — per-target -DFF_KNI + 7 TCs

Adds per-target Makefile override:
  $(LIB_OBJS_DIR)/ff_dpdk_kni.o: KNI_EXTRA_CFLAGS := -DFF_KNI
so the FF_KNI-gated OSPF case + (!enable_kni) protocol_filter guards become
reachable from the unit suite.

Stub int enable_kni=0 in test_ff_dpdk_kni.c (not linking ff_dpdk_if.o).
Adds 7 TCs targeting:
  TC-12 ipv4_ospf_returns_ospf            (FF_KNI: case IPPROTO_OSPFIGP)
  TC-13 tcp_kni_enabled_short             (L209 protocol_filter_tcp len<hdr)
  TC-14 udp_kni_enabled_short             (L221 protocol_filter_udp len<hdr)
  TC-15 tcp_kni_enabled_match_returns_kni (L199 protocol_filter_l4 hit + L342 enable_kni=1)
  TC-16 tcp_kni_enabled_miss_returns_unknown (L199 false leg)
  TC-17 udp_kni_enabled_match_returns_kni (L350 enable_kni=1)
  TC-18 init_null_port_lists              (L114 kni_set_bitmap !p early-return)

ff_dpdk_kni.c  line   27.5% -> 59.9%  (+32.4pp)
ff_dpdk_kni.c  branch 40.9% -> 51.6%  (+10.7pp)
Project merged branch  59.9% -> 60.5%  (+0.6pp)
Tests 11 -> 18 / 0 fail / valgrind 11/11 / 0 definite leaks
G8 ratchet: ff_dpdk_kni line 40->55, branch 35->47

Author: branch-coverage-leader

docs/unit_test_spec/zh_cn/79-stage7-review.md

@@ -126,3 +126,46 @@ Phase 9 review+mirror  : 0
 ```
 
 EOF
+
+---
+
+## §9 Stage-7+ Follow-up: FU-S7-KNI-ENABLE
+
+**触发**：Stage-7 验收时 ff_dpdk_kni 52 missing branches 多在 `#ifdef FF_KNI` 内或被 dead-code 剥离，未达预期。
+
+**实施**：
+1. **Makefile per-target 覆盖**：`$(LIB_OBJS_DIR)/ff_dpdk_kni.o: KNI_EXTRA_CFLAGS := -DFF_KNI`，仅对 kni.o 启用 FF_KNI（避免污染其他 lib obj）。
+2. **stub 补 enable_kni**：`int enable_kni = 0;`（lib/ff_dpdk_if.c 提供，未链接 → 在 test 文件本地 stub）。
+3. **新 7 TCs**（test_ff_dpdk_kni.c）：
+   - TC-S7-KNI-12 ipv4_ospf_returns_ospf：`case IPPROTO_OSPFIGP: return FILTER_OSPF`（FF_KNI-only case）
+   - TC-S7-KNI-13/14 tcp/udp_kni_enabled_short：覆盖 protocol_filter_tcp/udp 的 `len < hdr` 真分支（L209/221）
+   - TC-S7-KNI-15 tcp_kni_enabled_match_returns_kni：覆盖 protocol_filter_l4 的 `if(get_bitmap()) return FILTER_KNI`（L199）+ `if (!enable_kni)` 假分支（L342）
+   - TC-S7-KNI-16 tcp_kni_enabled_miss_returns_unknown：覆盖 L199 假分支
+   - TC-S7-KNI-17 udp_kni_enabled_match_returns_kni：覆盖 L350 假分支
+   - TC-S7-KNI-18 init_null_port_lists：覆盖 kni_set_bitmap `if(!p) return;` 早返（L114）
+
+**结果**：
+
+| 指标 | Stage-7 末 | Stage-7+ 末 | Δ |
+|---|---|---|---|
+| ff_dpdk_kni.c **line** | 27.5% | **59.9%** | **+32.4pp** |
+| ff_dpdk_kni.c **branch** | 40.9% | **51.6%** | **+10.7pp** |
+| ff_dpdk_kni.c branch denom | 88 | 93 | +5（FF_KNI 新启 case+if）|
+| ff_dpdk_kni.c branch hit  | 36 | 48 | +12 |
+| **Project merged branch** | 59.92% | **60.51%** | **+0.59pp** |
+| Project merged line | 60.4% | **62.9%** | +2.5pp |
+| ff_dpdk_kni TC count | 11 | **18** | +7 |
+| valgrind | 11/11 PASS | **11/11 PASS** | 同 |
+
+**G8 ratchet**：`ff_dpdk_kni.c` line 40→55、branch 35→47（actual −5pp 安全边界）。
+
+**剩余 missing**（仍未覆盖，需更复杂手段）：
+- L142/148/149/161/163：kni_process_tx 的 ratelimit + tx_dropped 分支 — 需要构造完整 rte_eth_devices[port_id] PMD ops（极复杂，建议 Stage-8 用 LD_PRELOAD wrap 或起 KNI 真整合套件）
+- L181/183/185：kni_process_rx 同上
+- L426/435/466/476/480/486：ff_kni_alloc 的 process_type / virtio_user / ring_create 内部分支 — 需 rte_eal_hotplug_add 真 vdev 注册
+
+**FU-S8-KNI-PROCESS**（继任 follow-up，留 Stage-8）：
+- 选项 A：在 unit 里加 `--wrap=rte_eth_tx_burst` / `--wrap=rte_eth_rx_burst` 的 mock，仿造一个最小的 burst 计数器，覆盖 L161/163/181/183/185（约 +6 branches 可达）
+- 选项 B：起 `tests/integration/test_ff_kni_integration.c`，在真 DPDK + virtio_user 环境下跑 ff_kni_alloc 全路径（Stage-8 D2 集成扩容）
+
+EOF

tests/unit/Makefile

@@ -150,8 +150,14 @@ check: all
 $(LIB_OBJS_DIR):
 	@mkdir -p $@
 
+# Per-target extra CFLAGS for selected lib objects.
+# FU-S7-KNI-ENABLE (Stage-7 follow-up): build ff_dpdk_kni.o with -DFF_KNI so
+# that the test suite can exercise the OSPF case and the (!enable_kni)
+# protocol_filter guard branches (otherwise dead code in the unit build).
+$(LIB_OBJS_DIR)/ff_dpdk_kni.o: KNI_EXTRA_CFLAGS := -DFF_KNI
+
 $(LIB_OBJS_DIR)/%.o: $(LIB_DIR)/%.c | $(LIB_OBJS_DIR)
-	$(CC) $(CFLAGS) $(DPDK_CFLAGS) -c $< -o $@
+	$(CC) $(CFLAGS) $(DPDK_CFLAGS) $(KNI_EXTRA_CFLAGS) -c $< -o $@
 
 # ----- common stubs -----
 $(COMMON_DIR)/%.o: $(COMMON_DIR)/%.c

tests/unit/coverage_threshold.sh

@@ -78,7 +78,7 @@ BEGIN {
     # line via real EAL --vdev=net_null0; the unit number below is the
     # sub-set reachable in pure-mock unit scope.
     tline["ff_dpdk_if.c"]       =  4;  tbr["ff_dpdk_if.c"]       =  2   # actual (unit-only): line=5.7%   branch=3.6%   (merged: line=30.5% branch=22.1%)
-    tline["ff_dpdk_kni.c"]      = 40;  tbr["ff_dpdk_kni.c"]      = 35   # actual: line=47.2%  branch=40.9%
+    tline["ff_dpdk_kni.c"]      = 55;  tbr["ff_dpdk_kni.c"]      = 47   # actual: line=59.9%  branch=51.6%  (Stage-7+ FU-S7-KNI-ENABLE)
 
     pass = 0; fail = 0; total_files = 0
 }

tests/unit/test_ff_dpdk_kni.c

@@ -63,6 +63,12 @@ __thread unsigned int per_lcore__lcore_id = 0;
 /* nb_dev_ports defined in ff_dpdk_if.c (which we don't link here) */
 int nb_dev_ports = 0;
 
+/* FU-S7-KNI-ENABLE: with -DFF_KNI compiled into ff_dpdk_kni.o, the lib
+ * references `extern int enable_kni;` (defined in ff_dpdk_if.c which we
+ * do NOT link). Provide the stub here; tests that need the
+ * (!enable_kni) false-leg flip it to 1 around the call. */
+int enable_kni = 0;
+
 /* ------------------------------------------------------------------------ */
 /* Module-level EAL/mempool/ring (one-time init via rte_eal_init)            */
 /* ------------------------------------------------------------------------ */
@@ -399,6 +405,186 @@ test_ff_kni_init_tcp_udp_port_bitmaps(void **state)
     kni_stat = saved_kni_stat;
 }
 
+/* ======================================================================== */
+/* Stage-7 follow-up FU-S7-KNI-ENABLE: branches gated by -DFF_KNI            */
+/* ======================================================================== */
+
+#ifndef IPPROTO_OSPFIGP
+#define IPPROTO_OSPFIGP 89
+#endif
+
+/* Helper: build a minimal IPv4 packet starting with version+IHL byte; the
+ * caller patches proto and (optionally) appends an L4 header. The
+ * packet's IPv4 header length is exactly 20 bytes (IHL=5). */
+static void
+ff_test_build_ipv4(uint8_t *buf, size_t buf_len, uint8_t proto)
+{
+    memset(buf, 0, buf_len);
+    buf[0] = 0x45;       /* version=4 IHL=5 */
+    buf[9] = proto;      /* next-proto */
+}
+
+/* TC-S7-KNI-12: IPv4+OSPF (proto=89) -> FILTER_OSPF. Covers the FF_KNI-
+ * gated `case IPPROTO_OSPFIGP: return FILTER_OSPF;` branch (L335-338). */
+static void
+test_ff_kni_proto_filter_ipv4_ospf_returns_ospf(void **state)
+{
+    (void)state;
+    uint8_t pkt[64];
+    ff_test_build_ipv4(pkt, sizeof(pkt), IPPROTO_OSPFIGP);
+    enum FilterReturn rv = ff_kni_proto_filter(pkt, sizeof(pkt),
+                                               RTE_ETHER_TYPE_IPV4);
+    assert_int_equal(rv, FILTER_OSPF);
+}
+
+/* TC-S7-KNI-13: IPv4+TCP with enable_kni=1 and a too-short L4 fragment
+ * after the IP header -> FILTER_UNKNOWN via protocol_filter_tcp's
+ * `len < sizeof(rte_tcp_hdr)` true leg (L209 br=0).                  */
+static void
+test_ff_kni_proto_filter_ipv4_tcp_kni_enabled_short(void **state)
+{
+    (void)state;
+    /* IP hdr 20 + 5 bytes TCP fragment (< sizeof(rte_tcp_hdr)=20). */
+    uint8_t pkt[25];
+    ff_test_build_ipv4(pkt, sizeof(pkt), IPPROTO_TCP);
+
+    int saved = enable_kni; enable_kni = 1;
+    enum FilterReturn rv = ff_kni_proto_filter(pkt, sizeof(pkt),
+                                               RTE_ETHER_TYPE_IPV4);
+    enable_kni = saved;
+    assert_int_equal(rv, FILTER_UNKNOWN);
+}
+
+/* TC-S7-KNI-14: IPv4+UDP with enable_kni=1 and a too-short L4 fragment
+ * -> FILTER_UNKNOWN via protocol_filter_udp's len<hdr true leg (L221). */
+static void
+test_ff_kni_proto_filter_ipv4_udp_kni_enabled_short(void **state)
+{
+    (void)state;
+    /* IP hdr 20 + 5 bytes UDP fragment (< sizeof(rte_udp_hdr)=8). */
+    uint8_t pkt[25];
+    ff_test_build_ipv4(pkt, sizeof(pkt), IPPROTO_UDP);
+
+    int saved = enable_kni; enable_kni = 1;
+    enum FilterReturn rv = ff_kni_proto_filter(pkt, sizeof(pkt),
+                                               RTE_ETHER_TYPE_IPV4);
+    enable_kni = saved;
+    assert_int_equal(rv, FILTER_UNKNOWN);
+}
+
+/* TC-S7-KNI-15: enable_kni=1, ff_kni_init had registered TCP port 80 in
+ * the bitmap, packet has dst_port=80 (network order) -> FILTER_KNI.
+ * Covers protocol_filter_l4's true leg (L199) AND the `if (!enable_kni)`
+ * false leg in the IPPROTO_TCP case (L342).                            */
+static void
+test_ff_kni_proto_filter_ipv4_tcp_kni_enabled_match_returns_kni(void **state)
+{
+    (void)state;
+    SKIP_IF_NO_EAL();
+
+    /* (Re)build the port bitmaps under our control. Save+restore the
+     * caller-managed kni_rp/kni_stat as the existing TC-U-P3-KNI-11 does. */
+    struct rte_ring **saved_kni_rp   = kni_rp;
+    struct kni_interface_stats **saved_kni_stat = kni_stat;
+    ff_kni_init(/*nb_ports*/1, /*tcp*/"80", /*udp*/"53");
+    rte_free(kni_rp);
+    rte_free(kni_stat);
+    kni_rp   = saved_kni_rp;
+    kni_stat = saved_kni_stat;
+
+    /* IPv4(20) + TCP(20). dst_port lives at IP hdr offset 20 + TCP byte 2..3. */
+    uint8_t pkt[40];
+    ff_test_build_ipv4(pkt, sizeof(pkt), IPPROTO_TCP);
+    /* dst_port=80 in network byte order. set_bitmap stores the htons-ed
+     * port; get_bitmap is called with hdr->dst_port (already big-endian),
+     * so writing 0x00,0x50 directly produces the same bit index. */
+    pkt[20 + 2] = 0x00;
+    pkt[20 + 3] = 0x50;
+
+    int saved = enable_kni; enable_kni = 1;
+    enum FilterReturn rv = ff_kni_proto_filter(pkt, sizeof(pkt),
+                                               RTE_ETHER_TYPE_IPV4);
+    enable_kni = saved;
+    assert_int_equal(rv, FILTER_KNI);
+}
+
+/* TC-S7-KNI-16: enable_kni=1, packet has dst_port=8080 NOT in the bitmap
+ * -> FILTER_UNKNOWN (protocol_filter_l4 false leg, L199 br=0).         */
+static void
+test_ff_kni_proto_filter_ipv4_tcp_kni_enabled_miss_returns_unknown(void **state)
+{
+    (void)state;
+    SKIP_IF_NO_EAL();
+
+    struct rte_ring **saved_kni_rp   = kni_rp;
+    struct kni_interface_stats **saved_kni_stat = kni_stat;
+    ff_kni_init(1, "80", "53");
+    rte_free(kni_rp);
+    rte_free(kni_stat);
+    kni_rp   = saved_kni_rp;
+    kni_stat = saved_kni_stat;
+
+    uint8_t pkt[40];
+    ff_test_build_ipv4(pkt, sizeof(pkt), IPPROTO_TCP);
+    /* dst_port=8080=0x1F90 in network order. */
+    pkt[20 + 2] = 0x1F;
+    pkt[20 + 3] = 0x90;
+
+    int saved = enable_kni; enable_kni = 1;
+    enum FilterReturn rv = ff_kni_proto_filter(pkt, sizeof(pkt),
+                                               RTE_ETHER_TYPE_IPV4);
+    enable_kni = saved;
+    assert_int_equal(rv, FILTER_UNKNOWN);
+}
+
+/* TC-S7-KNI-17: enable_kni=1 + UDP dst_port=53 matches bitmap -> FILTER_KNI.
+ * Covers `if (!enable_kni)` false leg in IPPROTO_UDP case (L350).         */
+static void
+test_ff_kni_proto_filter_ipv4_udp_kni_enabled_match_returns_kni(void **state)
+{
+    (void)state;
+    SKIP_IF_NO_EAL();
+
+    struct rte_ring **saved_kni_rp   = kni_rp;
+    struct kni_interface_stats **saved_kni_stat = kni_stat;
+    ff_kni_init(1, "80", "53");
+    rte_free(kni_rp);
+    rte_free(kni_stat);
+    kni_rp   = saved_kni_rp;
+    kni_stat = saved_kni_stat;
+
+    /* IPv4(20) + UDP(8). dst_port=53 (0x0035) at IP+2..3. */
+    uint8_t pkt[28];
+    ff_test_build_ipv4(pkt, sizeof(pkt), IPPROTO_UDP);
+    pkt[20 + 2] = 0x00;
+    pkt[20 + 3] = 0x35;
+
+    int saved = enable_kni; enable_kni = 1;
+    enum FilterReturn rv = ff_kni_proto_filter(pkt, sizeof(pkt),
+                                               RTE_ETHER_TYPE_IPV4);
+    enable_kni = saved;
+    assert_int_equal(rv, FILTER_KNI);
+}
+
+/* TC-S7-KNI-18: ff_kni_init with NULL tcp_ports / udp_ports exercises
+ * kni_set_bitmap's L114 `if(!p) return;` early-return branch.          */
+static void
+test_ff_kni_init_null_port_lists(void **state)
+{
+    (void)state;
+    SKIP_IF_NO_EAL();
+
+    struct rte_ring **saved_kni_rp   = kni_rp;
+    struct kni_interface_stats **saved_kni_stat = kni_stat;
+    /* Both args NULL — kni_set_bitmap is invoked twice and returns
+     * immediately on the !p check. Init must still succeed. */
+    ff_kni_init(/*nb_ports*/1, /*tcp*/NULL, /*udp*/NULL);
+    rte_free(kni_rp);
+    rte_free(kni_stat);
+    kni_rp   = saved_kni_rp;
+    kni_stat = saved_kni_stat;
+}
+
 /* ------------------------------------------------------------------------ */
 /* Main runner                                                              */
 /* ------------------------------------------------------------------------ */
@@ -418,6 +604,14 @@ main(void)
         cmocka_unit_test_setup_teardown(test_ff_kni_proto_filter_ipv4_oversized_ihl, test_setup, NULL),
         cmocka_unit_test_setup_teardown(test_ff_kni_proto_filter_ipv4_ipip_recurse,  test_setup, NULL),
         cmocka_unit_test_setup_teardown(test_ff_kni_init_tcp_udp_port_bitmaps,       test_setup, NULL),
+        /* Stage-7 follow-up FU-S7-KNI-ENABLE: branches gated by -DFF_KNI */
+        cmocka_unit_test_setup_teardown(test_ff_kni_proto_filter_ipv4_ospf_returns_ospf,                    test_setup, NULL),
+        cmocka_unit_test_setup_teardown(test_ff_kni_proto_filter_ipv4_tcp_kni_enabled_short,                test_setup, NULL),
+        cmocka_unit_test_setup_teardown(test_ff_kni_proto_filter_ipv4_udp_kni_enabled_short,                test_setup, NULL),
+        cmocka_unit_test_setup_teardown(test_ff_kni_proto_filter_ipv4_tcp_kni_enabled_match_returns_kni,    test_setup, NULL),
+        cmocka_unit_test_setup_teardown(test_ff_kni_proto_filter_ipv4_tcp_kni_enabled_miss_returns_unknown, test_setup, NULL),
+        cmocka_unit_test_setup_teardown(test_ff_kni_proto_filter_ipv4_udp_kni_enabled_match_returns_kni,    test_setup, NULL),
+        cmocka_unit_test_setup_teardown(test_ff_kni_init_null_port_lists,                                   test_setup, NULL),
     };
     return cmocka_run_group_tests(tests, group_setup, group_teardown);
 }