Tests: Port eight kernel BPF selftests

Ports of programs from tools/testing/selftests/bpf/progs/ in the Linux tree.
Each names its upstream original in a header comment.

The value is breadth of program type. Between them these cover tracepoint,
raw_tp, tp_btf, xdp, cgroup/getsockopt, netfilter and kprobe.multi -- most of
which nothing else in the suite exercised, and all of which the section
pass-through in @section was previously untested against.

    get_cgroup_id            tracepoint/syscalls/sys_enter_nanosleep
    autoattach               raw_tp/sys_enter + raw_tp/sys_exit
    link_pinning             raw_tp/sys_enter + tp_btf/sys_enter
    tracepoint_sched_switch  tracepoint/sched/sched_switch
    cgroup_preorder          cgroup/getsockopt x4
    netfilter_link_attach    netfilter
    kprobe_multi_empty       kprobe.multi/
    vmlinux/xdp_devmap_helpers   xdp, struct_xdp_md field access

Only the BPF half of each selftest is ported. Upstream pairs every program with
a userspace driver in prog_tests/ that loads it through a skeleton and asserts
on the result; the framework here compiles and verifies but never runs, so
these are compiler assertions rather than semantic ones. tests/passing_tests/
selftests/README.md says so explicitly.

Where upstream reports results through global variables -- which most of the
corpus does -- the global becomes a one-entry HashMap, tagged WORKAROUND(globals)
so the substitutions can be swept up mechanically once real global variable
support lands.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: r41k0u

tests/passing_tests/selftests/README.md

@@ -0,0 +1,51 @@
+# Ported kernel BPF selftests
+
+Programs here are ports of tests from the Linux kernel tree, under
+`tools/testing/selftests/bpf/progs/`. Each file names its upstream original in a
+header comment.
+
+They are ordinary cases as far as the framework is concerned: discovered
+automatically, and checked at all three levels (IR, `llc`, kernel verifier). The
+point of this directory is breadth of **program type** — between them these
+cover `tracepoint`, `raw_tp`, `tp_btf`, `xdp`, `cgroup/getsockopt`, `netfilter`
+and `kprobe.multi`, most of which nothing else in the suite exercises.
+
+## What a port does and does not prove
+
+A kernel selftest is two halves: the BPF program in `progs/`, and a userspace
+driver in `prog_tests/` that loads it through a skeleton, triggers it, and
+asserts on the result. **Only the BPF half is ported here**, because the
+framework compiles and verifies programs but never runs them.
+
+So these check that PythonBPF emits a loadable, verifiable object for a given
+program type and feature mix. They do not check that the program *behaves* the
+way the kernel's version does. Treat a passing test here as a compiler
+assertion, not a semantic one.
+
+## `WORKAROUND(globals)`
+
+The selftest corpus overwhelmingly reports results through global variables: the
+program writes a global, and the driver reads it back. PythonBPF has no global
+variable support yet, so those become one-entry `HashMap`s keyed by index.
+
+Every such substitution is tagged `WORKAROUND(globals)` in a comment:
+
+```bash
+grep -rn "WORKAROUND(globals)" tests/passing_tests/selftests/
+```
+
+This is deliberate scaffolding, not the intended shape. When real globals land,
+these should be rewritten to use them — the tag is there to make that sweep
+mechanical. Note that a map substitution also changes what a future userspace
+driver would read, so it is not purely cosmetic.
+
+## Adding another
+
+Check it against what the compiler actually supports before starting — no loops,
+no BPF-to-BPF calls, no kfuncs, no atomics, no `__builtin_*`, one opaque context
+argument, and only `HashMap` / `PerfEventArray` / `RingBuffer`. A program that
+needs more than one level of struct field access (`ctx->regs.ip`) is also out of
+reach today.
+
+Anything importing from `vmlinux` goes in `vmlinux/` so it is skipped rather
+than failed on machines without a generated `vmlinux.py`.

tests/passing_tests/selftests/autoattach.py

@@ -0,0 +1,42 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/test_autoattach.c
+#
+# Two programs on different raw tracepoints, each recording that it ran. The
+# upstream test asserts both fired after bpf_object__attach_skeleton().
+#
+# WORKAROUND(globals): upstream uses `bool prog1_called` / `bool prog2_called`.
+# PythonBPF has no global variable support yet, so both live in one HashMap
+# keyed by program number. Replace with real globals once they land.
+
+from pythonbpf import bpf, map, section, bpfglobal, compile
+from pythonbpf.maps import HashMap
+from ctypes import c_void_p, c_int64, c_int32, c_uint64
+
+
+# WORKAROUND(globals): key 1 -> prog1_called, key 2 -> prog2_called
+@bpf
+@map
+def called() -> HashMap:
+    return HashMap(key=c_int32, value=c_uint64, max_entries=2)
+
+
+@bpf
+@section("raw_tp/sys_enter")
+def prog1(ctx: c_void_p) -> c_int64:
+    called.update(1, 1)
+    return c_int64(0)
+
+
+@bpf
+@section("raw_tp/sys_exit")
+def prog2(ctx: c_void_p) -> c_int64:
+    called.update(2, 1)
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/selftests/cgroup_preorder.py

@@ -0,0 +1,77 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/cgroup_preorder.c
+#
+# Four cgroup/getsockopt programs attached at different points in a cgroup
+# hierarchy, each appending its own marker to a shared buffer. The upstream test
+# reads the buffer back to assert the order the hierarchy ran them in.
+#
+# WORKAROUND(globals): upstream uses `unsigned int idx` and `__u8 result[4]`.
+# PythonBPF has neither global variables nor global arrays yet, so the cursor
+# lives in a one-entry HashMap and the buffer in a four-entry one keyed by
+# position. Replace with real globals once they land.
+
+from pythonbpf import bpf, map, section, bpfglobal, compile
+from pythonbpf.maps import HashMap
+from ctypes import c_void_p, c_int64, c_int32, c_uint64
+
+
+# WORKAROUND(globals): stands in for `unsigned int idx;`
+@bpf
+@map
+def idx() -> HashMap:
+    return HashMap(key=c_int32, value=c_uint64, max_entries=1)
+
+
+# WORKAROUND(globals): stands in for `__u8 result[4];`, keyed by position
+@bpf
+@map
+def result() -> HashMap:
+    return HashMap(key=c_int32, value=c_uint64, max_entries=4)
+
+
+@bpf
+@section("cgroup/getsockopt")
+def child(ctx: c_void_p) -> c_int64:
+    i = idx.lookup(0)
+    if i < 4:
+        result.update(i, 1)
+        idx.update(0, i + 1)
+    return c_int64(1)
+
+
+@bpf
+@section("cgroup/getsockopt")
+def child_2(ctx: c_void_p) -> c_int64:
+    i = idx.lookup(0)
+    if i < 4:
+        result.update(i, 2)
+        idx.update(0, i + 1)
+    return c_int64(1)
+
+
+@bpf
+@section("cgroup/getsockopt")
+def parent(ctx: c_void_p) -> c_int64:
+    i = idx.lookup(0)
+    if i < 4:
+        result.update(i, 3)
+        idx.update(0, i + 1)
+    return c_int64(1)
+
+
+@bpf
+@section("cgroup/getsockopt")
+def parent_2(ctx: c_void_p) -> c_int64:
+    i = idx.lookup(0)
+    if i < 4:
+        result.update(i, 4)
+        idx.update(0, i + 1)
+    return c_int64(1)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/selftests/get_cgroup_id.py

@@ -0,0 +1,47 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/get_cgroup_id_kern.c
+#
+# Upstream records the cgroup id of a process whose pid matches one the
+# userspace half of the test set beforehand.
+#
+# WORKAROUND(globals): upstream uses the file-scope variables `cg_id` and
+# `expected_pid` to pass values in and out. PythonBPF has no global variable
+# support yet, so each becomes a one-entry HashMap keyed by 0. Replace these
+# with real globals once they land; grep for WORKAROUND(globals).
+
+from pythonbpf import bpf, map, section, bpfglobal, compile
+from pythonbpf.maps import HashMap
+from pythonbpf.helper import pid, get_current_cgroup_id
+from ctypes import c_void_p, c_int64, c_int32, c_uint64
+
+
+# WORKAROUND(globals): stands in for `__u64 expected_pid;`
+@bpf
+@map
+def expected_pid() -> HashMap:
+    return HashMap(key=c_int32, value=c_uint64, max_entries=1)
+
+
+# WORKAROUND(globals): stands in for `__u64 cg_id;`
+@bpf
+@map
+def cg_id() -> HashMap:
+    return HashMap(key=c_int32, value=c_uint64, max_entries=1)
+
+
+@bpf
+@section("tracepoint/syscalls/sys_enter_nanosleep")
+def trace(ctx: c_void_p) -> c_int64:
+    process_id = pid()
+    want = expected_pid.lookup(0)
+    if want == process_id:
+        cg_id.update(0, get_current_cgroup_id())
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/selftests/kprobe_multi_empty.py

@@ -0,0 +1,26 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/kprobe_multi_empty.c
+#
+# An empty kprobe.multi program. Upstream attaches it to an empty symbol set to
+# check that path; here it checks that PythonBPF emits a loadable object for
+# the kprobe.multi program type, which resolves differently from plain kprobe.
+#
+# The trailing slash in the section name is upstream's and is significant: it
+# marks an empty symbol pattern.
+
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64
+
+
+@bpf
+@section("kprobe.multi/")
+def test_kprobe_empty(ctx: c_void_p) -> c_int64:
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/selftests/link_pinning.py

@@ -0,0 +1,46 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/test_link_pinning.c
+#
+# The same trivial body attached through two different program types, so the
+# upstream test can pin a link, close the skeleton, and check the program still
+# runs. Both copy an input value to an output value.
+#
+# WORKAROUND(globals): upstream uses `int in` / `int out`. PythonBPF has no
+# global variable support yet, so both live in one HashMap: key 0 is the input
+# the userspace side writes, key 1 is the output. Replace with real globals
+# once they land.
+
+from pythonbpf import bpf, map, section, bpfglobal, compile
+from pythonbpf.maps import HashMap
+from ctypes import c_void_p, c_int64, c_int32, c_uint64
+
+
+# WORKAROUND(globals): key 0 -> in, key 1 -> out
+@bpf
+@map
+def io() -> HashMap:
+    return HashMap(key=c_int32, value=c_uint64, max_entries=2)
+
+
+@bpf
+@section("raw_tp/sys_enter")
+def raw_tp_prog(ctx: c_void_p) -> c_int64:
+    val = io.lookup(0)
+    io.update(1, val)
+    return c_int64(0)
+
+
+@bpf
+@section("tp_btf/sys_enter")
+def tp_btf_prog(ctx: c_void_p) -> c_int64:
+    val = io.lookup(0)
+    io.update(1, val)
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/selftests/netfilter_link_attach.py

@@ -0,0 +1,25 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/test_netfilter_link_attach.c
+#
+# A netfilter program that accepts everything. Upstream uses it to exercise
+# link attachment against a netfilter hook; here it checks that PythonBPF emits
+# a loadable object for the netfilter program type.
+#
+# NF_ACCEPT is 1.
+
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64
+
+
+@bpf
+@section("netfilter")
+def nf_link_attach_test(ctx: c_void_p) -> c_int64:
+    return c_int64(1)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/selftests/tracepoint_sched_switch.py

@@ -0,0 +1,27 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/test_tracepoint.c
+#
+# Upstream is a bare handler on sched/sched_switch, used to prove the program
+# attaches to a non-syscall tracepoint. Kept faithful: the point is the
+# attachment surface, not the body.
+#
+# Upstream declares the tracepoint argument layout as a struct taken from
+# /sys/kernel/tracing/events/sched/sched_switch/format. PythonBPF does not read
+# tracepoint formats, so the context stays opaque.
+
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64
+
+
+@bpf
+@section("tracepoint/sched/sched_switch")
+def oncpu(ctx: c_void_p) -> c_int64:
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/passing_tests/selftests/vmlinux/xdp_devmap_helpers.py

@@ -0,0 +1,32 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/test_xdp_devmap_helpers.c
+#
+# Reads the ingress and egress interface indices out of the XDP context and
+# prints them with the frame length. Upstream exists to show that
+# ctx->egress_ifindex is only reachable with expected_attach_type
+# BPF_XDP_DEVMAP; here it doubles as a struct_xdp_md field-access test.
+
+from pythonbpf import bpf, section, bpfglobal, compile
+from vmlinux import struct_xdp_md
+from vmlinux import XDP_PASS
+from ctypes import c_int64
+
+
+@bpf
+@section("xdp")
+def xdpdm_devlog(ctx: struct_xdp_md) -> c_int64:
+    data = ctx.data
+    data_end = ctx.data_end
+    ingress = ctx.ingress_ifindex
+    egress = ctx.egress_ifindex
+    length = data_end - data
+    print(f"devmap redirect: dev {ingress} -> dev {egress} len {length}")
+    return c_int64(XDP_PASS)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()