Tests: Port three kernel BPF selftests

Ports of programs from tools/testing/selftests/bpf/progs/ in the Linux tree,
each naming its upstream original in a header comment.

    tracing/tracepoint_sched_switch.py   test_tracepoint.c
    tracing/get_cgroup_id.py             get_cgroup_id_kern.c
    tracing/autoattach.py                test_autoattach.c

Deliberately a small spike rather than bulk coverage. The three sample different
global-variable shapes, since substituting for globals is what porting the rest
of the corpus will mostly consist of: none at all (the control case), a scalar
read plus a scalar write, and two flags written from two programs on two
different attach points.

They also widen the range of program types under test.
tracepoint/sched/sched_switch and raw_tp/sys_enter were previously unexercised;
@section writes its string straight into the ELF with no allowlist, so that
pass-through had only ever been tested against a handful of types.

Only the BPF half of each selftest is ported -- upstream pairs every program
with a userspace driver in prog_tests/ that loads and asserts, whereas this
framework compiles and verifies but never runs. tests/README.md now says so
explicitly, along with the WORKAROUND(globals) convention marking each map
substituted for a global.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: r41k0u

tests/README.md

@@ -91,10 +91,48 @@ All xfails use `strict = True`: if a test starts **passing** it shows up as **XP
 ## Kernel selftest equivalents
 
 `tests/kernel_selftest_equivalent/` contains PythonBPF versions of important
-kernel BPF selftests from `bpf-next/tools/testing/selftests/bpf`. These tests
-describe features PythonBPF should grow next. They are collected by default and
-must be listed as strict expected failures in `tests/test_config.toml` until the
-corresponding feature lands.
+kernel BPF selftests from `bpf-next/tools/testing/selftests/bpf`. Each file names
+its upstream original in a header comment.
+
+The directory holds two kinds of test, and both are useful:
+
+- **Ports that pass.** A program PythonBPF can already express. These widen the
+  range of program types under test — `raw_tp`, `perf_event`,
+  `tracepoint/sched/*` and others that nothing else exercises.
+- **Roadmap tests that fail.** A program describing a feature PythonBPF should
+  grow next. These must be listed as **strict** expected failures in
+  `tests/test_config.toml` until the feature lands, at which point they turn up
+  as XPASS and should be promoted.
+
+### What a passing port proves — and does not
+
+A kernel selftest is two halves: the BPF program under `progs/`, and a userspace
+driver under `prog_tests/` that loads it through a skeleton, triggers it and
+asserts on the result. **Only the BPF half is ported**, because this framework
+compiles and verifies programs but never runs them.
+
+So a passing test here says PythonBPF emits a loadable, verifiable object for
+that program type and feature mix. It does not say the program behaves the way
+the kernel's version does. Treat it as a compiler assertion, not a semantic one.
+
+### `WORKAROUND(globals)`
+
+The selftest corpus overwhelmingly reports results through global variables: the
+program writes a global and the driver reads it back. PythonBPF has no global
+variable support, so each becomes a one-entry `HashMap` keyed by index, tagged in
+a comment naming the variable it replaces:
+
+```bash
+grep -rn "WORKAROUND(globals)" tests/kernel_selftest_equivalent/
+```
+
+This is deliberate scaffolding, not the intended shape — the tag exists so the
+sweep is mechanical once real globals land. It is not a cosmetic substitution
+either: it changes what a future userspace driver would read.
+
+Anything importing from `vmlinux` belongs in `vmlinux/`, which is registered in
+`VMLINUX_TEST_DIRS_PASSING` so it is skipped rather than failed where no
+`vmlinux.py` has been generated.
 
 ## Directory structure
 
@@ -113,5 +151,5 @@ tests/
 │   └── verifier.py            ← bpftool subprocess wrapper
 ├── passing_tests/             ← programs that should compile and verify cleanly
 ├── failing_tests/             ← programs with known issues (declared in test_config.toml)
-└── kernel_selftest_equivalent/ ← kernel-selftest-inspired feature roadmap tests
+└── kernel_selftest_equivalent/ ← ports of kernel selftests + feature roadmap tests
 ```

tests/kernel_selftest_equivalent/tracing/autoattach.py

@@ -0,0 +1,42 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/test_autoattach.c
+#
+# Two programs on different raw tracepoints, each recording that it ran. The
+# upstream test asserts both fired after bpf_object__attach_skeleton().
+#
+# WORKAROUND(globals): upstream uses `bool prog1_called` / `bool prog2_called`.
+# PythonBPF has no global variable support yet, so both live in one HashMap
+# keyed by program number. Replace with real globals once they land.
+
+from pythonbpf import bpf, map, section, bpfglobal, compile
+from pythonbpf.maps import HashMap
+from ctypes import c_void_p, c_int64, c_int32, c_uint64
+
+
+# WORKAROUND(globals): key 1 -> prog1_called, key 2 -> prog2_called
+@bpf
+@map
+def called() -> HashMap:
+    return HashMap(key=c_int32, value=c_uint64, max_entries=2)
+
+
+@bpf
+@section("raw_tp/sys_enter")
+def prog1(ctx: c_void_p) -> c_int64:
+    called.update(1, 1)
+    return c_int64(0)
+
+
+@bpf
+@section("raw_tp/sys_exit")
+def prog2(ctx: c_void_p) -> c_int64:
+    called.update(2, 1)
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/kernel_selftest_equivalent/tracing/get_cgroup_id.py

@@ -0,0 +1,47 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/get_cgroup_id_kern.c
+#
+# Upstream records the cgroup id of a process whose pid matches one the
+# userspace half of the test set beforehand.
+#
+# WORKAROUND(globals): upstream uses the file-scope variables `cg_id` and
+# `expected_pid` to pass values in and out. PythonBPF has no global variable
+# support yet, so each becomes a one-entry HashMap keyed by 0. Replace these
+# with real globals once they land; grep for WORKAROUND(globals).
+
+from pythonbpf import bpf, map, section, bpfglobal, compile
+from pythonbpf.maps import HashMap
+from pythonbpf.helper import pid, get_current_cgroup_id
+from ctypes import c_void_p, c_int64, c_int32, c_uint64
+
+
+# WORKAROUND(globals): stands in for `__u64 expected_pid;`
+@bpf
+@map
+def expected_pid() -> HashMap:
+    return HashMap(key=c_int32, value=c_uint64, max_entries=1)
+
+
+# WORKAROUND(globals): stands in for `__u64 cg_id;`
+@bpf
+@map
+def cg_id() -> HashMap:
+    return HashMap(key=c_int32, value=c_uint64, max_entries=1)
+
+
+@bpf
+@section("tracepoint/syscalls/sys_enter_nanosleep")
+def trace(ctx: c_void_p) -> c_int64:
+    process_id = pid()
+    want = expected_pid.lookup(0)
+    if want == process_id:
+        cg_id.update(0, get_current_cgroup_id())
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/kernel_selftest_equivalent/tracing/tracepoint_sched_switch.py

@@ -0,0 +1,27 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/test_tracepoint.c
+#
+# Upstream is a bare handler on sched/sched_switch, used to prove the program
+# attaches to a non-syscall tracepoint. Kept faithful: the point is the
+# attachment surface, not the body.
+#
+# Upstream declares the tracepoint argument layout as a struct taken from
+# /sys/kernel/tracing/events/sched/sched_switch/format. PythonBPF does not read
+# tracepoint formats, so the context stays opaque.
+
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64
+
+
+@bpf
+@section("tracepoint/sched/sched_switch")
+def oncpu(ctx: c_void_p) -> c_int64:
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()