run-veristat: add a portable runner and VM entrypoint

.github/workflows/scripts_tests.yml

@@ -5,7 +5,7 @@ on:
   pull_request:
   push:
     branches:
-      - master
+      - main
 
 jobs:
   test_run_vmtest:

ci/vmtest/configs/SPLAT_ALLOWLIST

@@ -19,3 +19,15 @@ WARNING: Unprivileged eBPF is enabled
 # https://lore.kernel.org/all/20260812-hello_world-v1-1-c3c2ddcb362d@meta.com/
 # Delete this entry once that fix reaches the CI kernel.
 BUG: KASAN: stack-out-of-bounds in (stack_trace_consume_entry|filter_irq_stacks)\+
+
+# Ignore the KASAN splats generated by KASAN-for-JIT selftests: those are
+# expected to trigger many splats to validate that the KASAN
+# instrumentation is properly inserted in JITed programs.
+BUG: KASAN: slab-(out-of-bounds|use-after-free) in bpf_prog_([a-f0-9]){16}_(st|ld)(x)?(_not)?_on_stack\+
+BUG: KASAN: slab-(out-of-bounds|use-after-free) in bpf_prog_([a-f0-9]){16}_simple_atomic(_fetch)?(_not)?_on_stack\+
+BUG: KASAN: slab-(out-of-bounds|use-after-free) in bpf_prog_([a-f0-9]){16}_ldx_patched(_not)?_on_stack\+
+BUG: KASAN: slab-(out-of-bounds|use-after-free) in bpf_prog_([a-f0-9]){16}_(load_acquire|store_release)(_not)?_on_stack\+
+BUG: KASAN: slab-(out-of-bounds|use-after-free) in bpf_prog_([a-f0-9]){16}_verifier_paths_stack_and_non_stack\+
+BUG: KASAN: slab-(out-of-bounds|use-after-free) in bpf_prog_([a-f0-9]){16}_ldx_oob\+
+BUG: KASAN: slab-(out-of-bounds|use-after-free) in bpf_prog_([a-f0-9]){16}_st_blinded\+
+BUG: KASAN: slab-(out-of-bounds|use-after-free) in bpf_prog_([a-f0-9]){16}_ldx_self_alias_on_stack\+

prepare-incremental-build/README.md

@@ -1,5 +1,3 @@
-[![Action test](https://github.com/libbpf/ci/actions/workflows/test-prepare-incremental-build-action.yml/badge.svg)](https://github.com/libbpf/ci/actions/workflows/test-prepare-incremental-build-action.yml)
-
 # Prepare incremental build
 
 This action uses [actions/cache](https://github.com/actions/cache) in combination with custom scripts to save kernel build output from previous workflow runs to faciliate incremental builds.

run-veristat/README.md

@@ -0,0 +1,79 @@
+# Run veristat
+
+`run_veristat.py` measures prepared BPF corpora against the running kernel.
+It requires Python 3 and a veristat executable. The caller prepares the objects,
+boots the kernel, and handles baselines and publication.
+
+```sh
+python3 run_veristat.py --veristat /tools/veristat \
+    --manifest /inputs/manifest.json --output /results/current
+```
+
+The manifest selects exact objects and optional veristat filter files. Paths
+are relative to the manifest directory; corpus names must be unique directory
+names and object basenames must be unique within each corpus.
+
+```json
+{
+  "version": 1,
+  "corpora": [
+    {
+      "name": "kernel",
+      "objects": {"kernel/example.bpf.o": "<sha256>"},
+      "filter": "kernel/veristat.cfg"
+    }
+  ]
+}
+```
+
+The output directory must be new. The runner checks object SHA256s and runs
+one veristat process per corpus with `-o csv -q -e file,prog,verdict,states`.
+Each corpus gets `results.csv`, `stderr.log`, and an atomic `status.json`.
+Status is `running`, `measured`, or `error`; a missing status means the corpus
+was not started. Interrupted and partial results must not be cached as measured.
+
+`measured` requires a zero tool exit status and nonempty, valid program records.
+Rejected programs remain CSV data for the caller's comparison policy.
+The runner continues after a corpus error and returns nonzero if any corpus
+could not be measured. The VM launcher handles VM failure and timeouts.
+
+Status includes the corpus digest: SHA256 of the sorted SHA256SUMS-style
+`<sha256>  <basename>\n` listing. Source/build details and directory locations
+do not participate in object identity.
+
+Diagnostics go to stderr: run inputs, corpus progress, and completion or failure
+details. Messages are flushed so an interrupted run retains its last operation.
+Tool output stays in files. The caller controls visibility of the result files
+and VM console. Meta objects and raw verifier logs must remain private; OSS
+callers can publish their results.
+
+## Prepare a corpus
+
+`create_manifest.py` selects local files by glob and records their checksums:
+
+```sh
+python3 create_manifest.py --name kernel --directory /inputs/kernel \
+    --pattern '*.bpf.o' --filter /inputs/kernel/veristat.cfg \
+    --output /inputs/manifest.json
+```
+
+Omit `--filter` when none is needed. A batch caller can use `make_corpus()`
+to build the manifest's `corpora` list. Downloads and builds belong to the caller.
+
+## Run with run-vmtest
+
+Select `run-vmtest/run-veristat.sh` through `VMTEST_SCRIPT` and supply guest paths:
+
+```sh
+VERISTAT_BINARY=/mnt/vmtest/selftests/bpf/veristat
+VERISTAT_MANIFEST=/mnt/vmtest/manifest.json
+VERISTAT_RESULTS=/mnt/vmtest/veristat-results
+```
+
+The entrypoint records `veristat:<exitcode>` in `STATUS_FILE` (default
+`/mnt/vmtest/exitstatus`) and runs the kernel-splat check. The host `run.sh`
+collects those statuses after the guest exits and fails the action on errors.
+Per-corpus outcomes remain in the result JSON files.
+
+When upgrading from v4, migrate `kernel-test: run_veristat` callers to this
+entrypoint and prepare their manifests before booting the VM.

run-veristat/create_manifest.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+"""Describe selected local objects for a veristat measurement."""
+
+import argparse
+import json
+import os
+from pathlib import Path
+
+from run_veristat import file_sha256
+
+
+def make_corpus(name, directory, pattern, config, manifest_path):
+    parent = Path(manifest_path).absolute().parent
+    corpus = {
+        "name": name,
+        "objects": {
+            os.path.relpath(path, parent): file_sha256(path)
+            for path in sorted(Path(directory).absolute().glob(pattern))
+            if path.is_file()
+        },
+    }
+    if config:
+        corpus["filter"] = os.path.relpath(Path(config).absolute(), parent)
+    return corpus
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--name", required=True)
+    parser.add_argument("--directory", required=True)
+    parser.add_argument("--pattern", required=True)
+    parser.add_argument("--filter")
+    parser.add_argument("--output", required=True, type=Path)
+    args = parser.parse_args()
+    corpus = make_corpus(
+        args.name, args.directory, args.pattern, args.filter, args.output
+    )
+    args.output.write_text(
+        json.dumps({"version": 1, "corpora": [corpus]}, indent=2) + "\n"
+    )
+
+
+if __name__ == "__main__":
+    main()