Tests: Port five more selftests found by re-running the corpus audit

veristat_foo (three socket programs) is clean. test_perf_link,
test_enable_stats and test_cgroup_link count with __sync_fetch_and_add, which
becomes a plain `x += 1` tagged WORKAROUND(atomics) for a mechanical sweep
once atomics exist. connect4_dropper compares against bpf_htons(port), written
out as shifts on the low 16 bits. All five pass at IR, llc and verifier level,
and bring perf_event, raw_tracepoint/sys_enter, cgroup_skb/egress and
cgroup/connect4 under test.

The porting notes gain the third batch, the atomics tag, the current blocker
histogram from the checked-in audit tool, and how to re-run it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DLMW3X7opqAPH6bjmTVkr7

Author: claude

tests/README.md

@@ -123,6 +123,12 @@ program writes a global and the driver reads it back. Ports keep that shape with
 values the kernel's driver does. Anything a global cannot yet hold (arrays,
 structs, strings) is a roadmap test, not a workaround.
 
+The one substitution still in use is `WORKAROUND(atomics)`: upstream counters
+incremented with `__sync_fetch_and_add` are plain `x += 1` here, tagged on the
+line so the sweep is mechanical once atomics land. `PORTING-NOTES.md` in that
+directory records every port, its rewrite if any, and why the rest of the
+corpus is out of reach; `tools/selftest-audit.py` regenerates that scoring.
+
 Anything importing from `vmlinux` belongs in `vmlinux/`, which is registered in
 `VMLINUX_TEST_DIRS_PASSING` so it is skipped rather than failed where no
 `vmlinux.py` has been generated.

tests/kernel_selftest_equivalent/PORTING-NOTES.md

@@ -139,6 +139,62 @@ type, never narrowing. It now goes through `convert()` like every other integer
 | `bpf_nop_bench.c` | `bpf_loop`-based benchmark macro |
 | `test_tcp_estats.c` | large; inlinable helpers and struct-heavy, not attempted yet |
 
+## Third batch: what the re-run audit found
+
+`tools/selftest-audit.py` is the corpus classifier, rebuilt and checked in. Run against
+the current upstream `progs/` it reports 847 real programs, 25 with no hard blocker. All
+but two of those 25 were already ported or are unportable for a reason a regex cannot see
+(`bpf_nop_bench.c` hides a loop in a macro, `test_pkt_md_access.c` type-puns narrow loads,
+`tracing_struct_int128.c` indexes the raw ctx array and needs bpf_testmod to load). The
+programs with exactly one blocker were read by hand for anything a documented rewrite
+could absorb. Five more ports, all passing at every level:
+
+| Port | Upstream | Section | Rewrite |
+|---|---|---|---|
+| `socket/veristat_foo.py` | `veristat_foo.c` | `socket` x3 | none |
+| `tracing/perf_link.py` | `test_perf_link.c` | `perf_event` | `WORKAROUND(atomics)` |
+| `tracing/enable_stats.py` | `test_enable_stats.c` | `raw_tracepoint/sys_enter` | `WORKAROUND(atomics)` |
+| `cgroup/cgroup_link.py` | `test_cgroup_link.c` | `cgroup_skb/egress` x2 | `WORKAROUND(atomics)` |
+| `vmlinux/connect4_dropper.py` | `connect4_dropper.c` | `cgroup/connect4` | `bpf_htons` written as shifts |
+
+### `WORKAROUND(atomics)`
+
+Three upstream programs count with `__sync_fetch_and_add(&x, 1)`. PythonBPF has no atomic
+operations, so the ports do `x += 1`, a plain read-modify-write, and tag the line. As with
+the earlier globals tag this is scaffolding for a mechanical sweep once atomics land:
+
+```bash
+grep -rn "WORKAROUND(atomics)" tests/kernel_selftest_equivalent/
+```
+
+It is not a cosmetic substitution: the upstream drivers run these programs from many
+CPUs at once and the exact count matters there, which is precisely what a non-atomic
+increment loses.
+
+### The blocker histogram now
+
+Over 847 real programs, hard blockers only; a program usually hits several:
+
+| Blocker | Programs | Share |
+|---|---|---|
+| unsupported helper | 496 | 59% |
+| kfuncs | 284 | 34% |
+| unsupported map type | 273 | 32% |
+| verifier-test annotations | 238 | 28% |
+| typed program macros (`BPF_PROG`, `BPF_KPROBE`) | 234 | 28% |
+| BPF-to-BPF calls | 176 | 21% |
+| `goto` | 143 | 17% |
+| inline asm | 142 | 17% |
+| struct globals | 126 | 15% |
+| CO-RE reads | 116 | 14% |
+| loops | 109 | 13% |
+| array globals | 105 | 12% |
+| atomics | 86 | 10% |
+
+Globals no longer appear as a blocker at all. The next unlocks by count are helpers (a
+long tail, but `bpf_get_current_task`, `bpf_ktime_get_boot_ns` and the `bpf_probe_read_user*`
+family recur), array maps, and typed program arguments.
+
 ## 3. Incidental findings
 
 - **Nested struct field access fails with a misleading error.** `ctx.regs.ip` reports
@@ -155,7 +211,11 @@ type, never narrowing. It now goes through `convert()` like every other integer
 
 ## Re-running the corpus scoring
 
-The audit behind this spike scored all 976 programs against the compiler's envelope. It is
-worth re-running after each feature lands, to see what the change unlocked. The blocker
-histogram at the time of writing, over 820 real programs: globals 52%, verifier-test
-annotations 27%, typed program macros 26%, kfuncs 20%, inline asm 16%, loops 12%.
+```bash
+git clone --depth 1 --filter=blob:none --sparse https://github.com/torvalds/linux
+git -C linux sparse-checkout set --no-cone tools/testing/selftests/bpf/progs
+python3 tools/selftest-audit.py linux/tools/testing/selftests/bpf/progs --histogram --max-hard 1
+```
+
+Re-run it after each feature lands. The envelope it encodes (helper, map and construct
+lists at the top of the script) is maintained by hand and must move with the compiler.

tests/kernel_selftest_equivalent/cgroup/cgroup_link.py

@@ -0,0 +1,58 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/test_cgroup_link.c
+#
+# Two cgroup_skb/egress programs, each counting its own runs. Upstream
+# attaches one through a cgroup bpf_link, then swaps in the other with
+# bpf_link_update() and checks the right counter moves:
+#
+#     int calls = 0;
+#     int alt_calls = 0;
+#
+#     SEC("cgroup_skb/egress")
+#     int egress(struct __sk_buff *skb)
+#     {
+#             __sync_fetch_and_add(&calls, 1);
+#             return 1;
+#     }
+#
+# WORKAROUND(atomics): the upstream increments are atomic. PythonBPF has no
+# atomic operations, so these are plain read-modify-writes of the globals.
+
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64, c_int32
+
+
+@bpf
+@bpfglobal
+def calls() -> c_int32:
+    return c_int32(0)
+
+
+@bpf
+@bpfglobal
+def alt_calls() -> c_int32:
+    return c_int32(0)
+
+
+@bpf
+@section("cgroup_skb/egress")
+def egress(skb: c_void_p) -> c_int64:
+    global calls
+    calls += 1  # WORKAROUND(atomics): __sync_fetch_and_add(&calls, 1)
+    return c_int64(1)
+
+
+@bpf
+@section("cgroup_skb/egress")
+def egress_alt(skb: c_void_p) -> c_int64:
+    global alt_calls
+    alt_calls += 1  # WORKAROUND(atomics): __sync_fetch_and_add(&alt_calls, 1)
+    return c_int64(1)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/kernel_selftest_equivalent/socket/veristat_foo.py

@@ -0,0 +1,35 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/veristat_foo.c
+#
+# Three empty socket filters. Upstream exists only to exercise veristat's
+# program-name filters, so the bodies are irrelevant and the names are the
+# test. Ported for the same reason: three programs, one section, one object.
+
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64
+
+
+@bpf
+@section("socket")
+def foo(ctx: c_void_p) -> c_int64:
+    return c_int64(0)
+
+
+@bpf
+@section("socket")
+def bar(ctx: c_void_p) -> c_int64:
+    return c_int64(0)
+
+
+@bpf
+@section("socket")
+def buz(ctx: c_void_p) -> c_int64:
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/kernel_selftest_equivalent/tracing/enable_stats.py

@@ -0,0 +1,43 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/test_enable_stats.c
+#
+# A raw tracepoint program that counts its runs. Upstream enables
+# BPF_STATS_RUN_TIME, triggers the program, and checks run_time_ns and
+# run_cnt in bpf_prog_info alongside `count`:
+#
+#     __u64 count = 0;
+#
+#     SEC("raw_tracepoint/sys_enter")
+#     int test_enable_stats(void *ctx)
+#     {
+#             __sync_fetch_and_add(&count, 1);
+#             return 0;
+#     }
+#
+# WORKAROUND(atomics): the upstream increment is atomic. PythonBPF has no
+# atomic operations, so this is a plain read-modify-write of the global.
+
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64, c_uint64
+
+
+@bpf
+@bpfglobal
+def count() -> c_uint64:
+    return c_uint64(0)
+
+
+@bpf
+@section("raw_tracepoint/sys_enter")
+def test_enable_stats(ctx: c_void_p) -> c_int64:
+    global count
+    count += 1  # WORKAROUND(atomics): __sync_fetch_and_add(&count, 1)
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/kernel_selftest_equivalent/tracing/perf_link.py

@@ -0,0 +1,43 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/test_perf_link.c
+#
+# A perf_event program that counts how often it runs. Upstream attaches it
+# through a perf_event bpf_link and checks `run_cnt` moved:
+#
+#     int run_cnt = 0;
+#
+#     SEC("perf_event")
+#     int handler(struct pt_regs *ctx)
+#     {
+#             __sync_fetch_and_add(&run_cnt, 1);
+#             return 0;
+#     }
+#
+# WORKAROUND(atomics): the upstream increment is atomic. PythonBPF has no
+# atomic operations, so this is a plain read-modify-write of the global.
+# Replace with the atomic form once atomics land; grep for WORKAROUND(atomics).
+
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64, c_int32
+
+
+@bpf
+@bpfglobal
+def run_cnt() -> c_int32:
+    return c_int32(0)
+
+
+@bpf
+@section("perf_event")
+def handler(ctx: c_void_p) -> c_int64:
+    global run_cnt
+    run_cnt += 1  # WORKAROUND(atomics): __sync_fetch_and_add(&run_cnt, 1)
+    return c_int64(0)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()

tests/kernel_selftest_equivalent/vmlinux/connect4_dropper.py

@@ -0,0 +1,53 @@
+# Ported from Linux tools/testing/selftests/bpf/progs/connect4_dropper.c
+#
+# A cgroup/connect4 hook that rejects TCP connects to one port, which
+# userspace writes into `port` before attaching:
+#
+#     int port;
+#
+#     SEC("cgroup/connect4")
+#     int connect_v4_dropper(struct bpf_sock_addr *ctx)
+#     {
+#             if (ctx->type != SOCK_STREAM)
+#                     return VERDICT_PROCEED;
+#             if (ctx->user_port == bpf_htons(port))
+#                     return VERDICT_REJECT;
+#             return VERDICT_PROCEED;
+#     }
+#
+# bpf_htons() is a byte swap, written out here as shifts on the low 16 bits;
+# SOCK_STREAM is 1.
+
+from pythonbpf import bpf, section, bpfglobal, compile
+from vmlinux import struct_bpf_sock_addr
+from ctypes import c_int64, c_int32
+
+VERDICT_REJECT = 0
+VERDICT_PROCEED = 1
+SOCK_STREAM = 1
+
+
+@bpf
+@bpfglobal
+def port() -> c_int32:
+    return c_int32(0)
+
+
+@bpf
+@section("cgroup/connect4")
+def connect_v4_dropper(ctx: struct_bpf_sock_addr) -> c_int64:
+    if ctx.type != 1:
+        return c_int64(1)
+    port_be = ((port & 0xFF) << 8) | ((port >> 8) & 0xFF)
+    if ctx.user_port == port_be:
+        return c_int64(0)
+    return c_int64(1)
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()