adding ci files

.github/actions/veristat_baseline_compare/action.yml

@@ -0,0 +1,49 @@
+name: 'run-veristat'
+description: 'Run veristat benchmark'
+inputs:
+  veristat_output:
+    description: 'Veristat output filepath'
+    required: true
+  baseline_name:
+    description: 'Veristat baseline cache name'
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - uses: actions/upload-artifact@v3
+      with:
+        name: ${{ inputs.baseline_name }}
+        if-no-files-found: error
+        path: ${{ github.workspace }}/${{ inputs.veristat_output }}
+
+    # For pull request:
+    # - get baseline log from cache
+    # - compare it to current run
+    - if: ${{ github.event_name == 'pull_request' }}
+      uses: actions/cache/restore@v3
+      with:
+        key: ${{ inputs.baseline_name }}
+        restore-keys: |
+          ${{ inputs.baseline_name }}-
+        path: '${{ github.workspace }}/${{ inputs.baseline_name }}'
+
+    - if: ${{ github.event_name == 'pull_request' }}
+      name: Show veristat comparison
+      shell: bash
+      run: ./.github/scripts/compare-veristat-results.sh
+      env:
+        BASELINE_PATH: ${{ github.workspace }}/${{ inputs.baseline_name }}
+        VERISTAT_OUTPUT: ${{ inputs.veristat_output }}
+
+    # For push: just put baseline log to cache
+    - if: ${{ github.event_name == 'push' }}
+      shell: bash
+      run: |
+        mv "${{ github.workspace }}/${{ inputs.veristat_output }}" \
+           "${{ github.workspace }}/${{ inputs.baseline_name }}"
+
+    - if: ${{ github.event_name == 'push' }}
+      uses: actions/cache/save@v3
+      with:
+        key: ${{ inputs.baseline_name }}-${{ github.run_id }}
+        path: '${{ github.workspace }}/${{ inputs.baseline_name }}'

.github/scripts/bpf-objects-rootfs.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+eval "$(guestfish --listen)"
+
+guestfish --verbose --remote \
+    add /tmp/root.img label:img : \
+    launch : \
+    mount /dev/disk/guestfs/img / : \
+    copy-in /tmp/bpf_objects / : \
+    chmod 0755 /bpf_objects
+
+guestfish --remote exit

.github/scripts/compare-veristat-results.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+if [[ ! -f "${BASELINE_PATH}" ]]; then
+    echo "# No ${BASELINE_PATH} available" >> "${GITHUB_STEP_SUMMARY}"
+
+    echo "No ${BASELINE_PATH} available"
+    echo "Printing veristat results"
+    cat "${VERISTAT_OUTPUT}"
+
+    exit
+fi
+
+selftests/bpf/veristat \
+    --output-format csv \
+    --emit file,prog,verdict,states \
+    --compare "${BASELINE_PATH}" "${VERISTAT_OUTPUT}" > compare.csv
+
+python3 ./.github/scripts/veristat-compare.py compare.csv

.github/scripts/get-commit-metadata.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+branch="${GITHUB_BASE_REF}"
+
+if [ "${GITHUB_EVENT_NAME}" = 'push' ]; then
+  branch="${GITHUB_REF_NAME}"
+fi
+
+echo "branch=${branch}" >> "${GITHUB_OUTPUT}"
+
+upstream="${branch//_base/}"
+commit="$(
+  git rev-parse "origin/${upstream}" &> /dev/null \
+    || (
+      git fetch --quiet --prune --no-tags --depth=1 --no-recurse-submodules origin "+refs/heads/${upstream}:refs/remotes/origin/${upstream}" && \
+      git rev-parse "origin/${upstream}"
+    )
+)"
+timestamp_utc="$(TZ=utc git show --format='%cd' --no-patch --date=iso-strict-local "${commit}")"
+
+echo "timestamp=${timestamp_utc}" >> "${GITHUB_OUTPUT}"
+echo "commit=${commit}" >> "${GITHUB_OUTPUT}"
+echo "Most recent upstream commit is ${commit}"

.github/scripts/matrix.py

@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+
+from json import dumps
+from enum import Enum
+import os
+
+
+class Arch(Enum):
+    """
+    CPU architecture supported by CI.
+    """
+
+    AARCH64 = "aarch64"
+    S390X = "s390x"
+    X86_64 = "x86_64"
+
+
+def set_output(name, value):
+    """Write an output variable to the GitHub output file."""
+    with open(os.getenv("GITHUB_OUTPUT"), "a", encoding="utf-8") as file:
+        file.write(f"{name}={value}\n")
+
+
+def generate_test_config(test):
+    """Create the configuration for the provided test."""
+    experimental = test.endswith("_parallel")
+    config = {
+        "test": test,
+        "continue_on_error": experimental,
+        # While in experimental mode, parallel jobs may get stuck
+        # anywhere, including in user space where the kernel won't detect
+        # a problem and panic. We add a second layer of (smaller) timeouts
+        # here such that if we get stuck in a parallel run, we hit this
+        # timeout and fail without affecting the overall job success (as
+        # would be the case if we hit the job-wide timeout). For
+        # non-experimental jobs, 360 is the default which will be
+        # superseded by the overall workflow timeout (but we need to
+        # specify something).
+        "timeout_minutes": 30 if experimental else 360,
+    }
+    return config
+
+
+def get_tests(config):
+    tests = [
+        "test_progs",
+        "test_progs_parallel",
+        "test_progs_no_alu32",
+        "test_progs_no_alu32_parallel",
+        "test_maps",
+        "test_verifier",
+    ]
+    if config.get("parallel_tests", True):
+        return tests
+    return [test for test in tests if not test.endswith("parallel")]
+
+
+matrix = [
+    {
+        "kernel": "LATEST",
+        "runs_on": [],
+        "arch": Arch.X86_64.value,
+        "toolchain": "gcc",
+        "llvm-version": "16",
+    },
+    {
+        "kernel": "LATEST",
+        "runs_on": [],
+        "arch": Arch.X86_64.value,
+        "toolchain": "llvm",
+        "llvm-version": "16",
+    },
+    {
+        "kernel": "LATEST",
+        "runs_on": [],
+        "arch": Arch.AARCH64.value,
+        "toolchain": "gcc",
+        "llvm-version": "16",
+    },
+    # {
+    #     "kernel": "LATEST",
+    #     "runs_on": [],
+    #     "arch": Arch.AARCH64.value,
+    #     "toolchain": "llvm",
+    #     "llvm-version": "16",
+    # },
+    {
+        "kernel": "LATEST",
+        "runs_on": [],
+        "arch": Arch.S390X.value,
+        "toolchain": "gcc",
+        "llvm-version": "16",
+        "parallel_tests": False,
+    },
+]
+self_hosted_repos = [
+    "kernel-patches/bpf",
+    "kernel-patches/vmtest",
+]
+
+for idx in range(len(matrix) - 1, -1, -1):
+    if matrix[idx]["toolchain"] == "gcc":
+        matrix[idx]["toolchain_full"] = "gcc"
+    else:
+        matrix[idx]["toolchain_full"] = "llvm-" + matrix[idx]["llvm-version"]
+
+# Only a few repository within "kernel-patches" use self-hosted runners.
+if (
+    os.environ["GITHUB_REPOSITORY_OWNER"] != "kernel-patches"
+    or os.environ["GITHUB_REPOSITORY"] not in self_hosted_repos
+):
+    # Outside of those repositories, we only run on x86_64 GH hosted runners (ubuntu-latest)
+    for idx in range(len(matrix) - 1, -1, -1):
+        if matrix[idx]["arch"] != Arch.X86_64.value:
+            del matrix[idx]
+        else:
+            matrix[idx]["runs_on"] = ["ubuntu-latest"]
+else:
+    # Otherwise, run on (self-hosted, arch) runners
+    for idx in range(len(matrix) - 1, -1, -1):
+        matrix[idx]["runs_on"].extend(["self-hosted", matrix[idx]["arch"]])
+
+build_matrix = {"include": matrix}
+set_output("build_matrix", dumps(build_matrix))
+
+test_matrix = {
+    "include": [
+        {**config, **generate_test_config(test)}
+        for config in matrix
+        for test in get_tests(config)
+    ]
+}
+set_output("test_matrix", dumps(test_matrix))
+
+veristat_runs_on = next(
+    x["runs_on"]
+    for x in matrix
+    if x["arch"] == os.environ["veristat_arch"]
+    and x["toolchain"] == os.environ["veristat_toolchain"]
+)
+set_output("veristat_runs_on", veristat_runs_on)

.github/scripts/prepare-incremental-builds.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+
+set -eu
+
+commit_id="${1}"
+
+# $1 - the SHA-1 to fetch and check out
+fetch_and_checkout() {
+  local build_base_sha
+
+  build_base_sha="${1}"
+  # If cached artifacts became stale for one reason or another, we
+  # may not have the build base SHA available. Fetch it and retry.
+  git fetch origin "${build_base_sha}" && git checkout --quiet "${build_base_sha}"
+}
+
+# $1 - value of KBUILD_OUTPUT
+clear_cache_artifacts() {
+  local output_dir
+
+  output_dir="${1}"
+  echo "Unable to find earlier upstream ref. Discarding KBUILD_OUTPUT contents..."
+  rm --recursive --force "${output_dir}"
+  mkdir "${output_dir}"
+  false
+}
+
+# $1 - value of KBUILD_OUTPUT
+# $2 - current time in ISO 8601 format
+restore_source_code_times() {
+  local build_output
+  local current_time
+  local src_time
+  local obj_time
+
+  build_output="${1}"
+  current_time="${2}"
+  src_time="$(date --iso-8601=ns --date="${current_time} - 2 minutes")"
+  obj_time="$(date --iso-8601=ns --date="${current_time} - 1 minute")"
+
+  git ls-files | xargs --max-args=10000 touch -m --no-create --date="${src_time}"
+  find "${build_output}" -type f | xargs --max-args=10000 touch -m --no-create --date="${obj_time}"
+  git checkout --quiet -
+  echo "Adjusted src and obj time stamps relative to system time"
+}
+
+mkdir --parents "${KBUILD_OUTPUT}"
+current_time="$(date --iso-8601=ns)"
+
+if [ -f "${KBUILD_OUTPUT}/.build-base-sha" ]; then
+  build_base_sha="$(cat "${KBUILD_OUTPUT}/.build-base-sha")"
+  echo "Setting up base build state for ${build_base_sha}"
+
+  (
+    git checkout --quiet "${build_base_sha}" \
+      || fetch_and_checkout "${build_base_sha}" \
+      || clear_cache_artifacts "${KBUILD_OUTPUT}"
+  ) && restore_source_code_times "${KBUILD_OUTPUT}" "${current_time}"
+else
+  echo "No previous build data found"
+fi
+
+echo -n "${commit_id}" > "${KBUILD_OUTPUT}/.build-base-sha"

.github/scripts/tar-artifact.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+set -eux
+
+arch="${1}"
+toolchain="${2}"
+
+# Remove intermediate object files that we have no use for. Ideally
+# we'd just exclude them from tar below, but it does not provide
+# options to express the precise constraints.
+find selftests/ -name "*.o" -a ! -name "*.bpf.o" -print0 | \
+  xargs --null --max-args=10000 rm
+
+# Strip debug information, which is excessively large (consuming
+# bandwidth) while not actually being used (the kernel does not use
+# DWARF to symbolize stacktraces).
+strip --strip-debug "${KBUILD_OUTPUT}"/vmlinux
+
+additional_file_list=()
+if [ "${GITHUB_REPOSITORY}" == "kernel-patches/vmtest" ]; then
+  # Package up a bunch of additional infrastructure to support running
+  # 'make kernelrelease' and bpf tool checks later on.
+  mapfile -t additional_file_list < <(find . -iname Makefile)
+  additional_file_list+=(
+    "scripts/" 
+    "tools/testing/selftests/bpf/" 
+    "tools/include/" 
+    "tools/bpf/bpftool/"
+  )
+fi
+
+image_name=$(make -s image_name)
+
+# zstd is installed by default in the runner images.
+tar -cf - \
+  "${KBUILD_OUTPUT}/.config" \
+  "${KBUILD_OUTPUT}/${image_name}" \
+  "${KBUILD_OUTPUT}/include/config/auto.conf" \
+  "${KBUILD_OUTPUT}/include/generated/autoconf.h" \
+  "${KBUILD_OUTPUT}/vmlinux" \
+  "${additional_file_list[@]}" \
+  --exclude '*.cmd' \
+  --exclude '*.d' \
+  --exclude '*.h' \
+  --exclude '*.output' \
+  selftests/bpf/ | zstd -T0 -19 -o "vmlinux-${arch}-${toolchain}.tar.zst"