xtask: the sdbpf boot test runs the systemd unit tests for cgroup BPF programs

CHANGELOG.md

@@ -4,6 +4,10 @@ This file records each release. The format follows [Keep a Changelog](https://ke
 
 ## Unreleased
 
+### Added
+
+- The `sdbpf` boot test runs the unit tests test-bpf-devices, test-bpf-firewall and test-bpf-foreign-programs of systemd. They attach cgroup programs with `BPF_PROG_ATTACH`, `BPF_PROG_DETACH`, `BPF_PROG_QUERY` and `BPF_LINK_CREATE`, and all three pass. `RK_SYSTEMD_PACKAGES` of tools/systemd/build.sh adds packages to the systemd tree, and this test needs `systemd-tests` and `iputils-ping` (#537).
+
 ## [0.5.23] - 2026-11-12
 
 ### Added

tools/systemd/build.sh

@@ -11,13 +11,16 @@
 # `archlinux:latest` (amd64 only). Set RK_SYSTEMD to OUT_FILE, and
 # `cargo xtask boot-test systemd` boots the tree with systemd as PID 1. With
 # `RK_CMDLINE=rk.missing=1` and `RK_BOOT_LOG=1`, tools/missing/report.py makes the report of the
-# missing files of the image from the boot log.
+# missing files of the image from the boot log. RK_SYSTEMD_PACKAGES adds more packages of the
+# distribution to the tree. The `sdbpf` boot test needs a Debian tree with
+# `RK_SYSTEMD_PACKAGES="systemd-tests iputils-ping"`.
 set -eu
 
 usage='usage: tools/systemd/build.sh OUT_FILE [ARCH [IMAGE]]'
 out=${1:?$usage}
 arch=${2:-amd64}
 image=${3:-debian:trixie}
+RK_SYSTEMD_PACKAGES=${RK_SYSTEMD_PACKAGES:-}
 name=rk-systemd-build-$$
 trap 'docker rm -f "$name" >/dev/null 2>&1 || true' EXIT
 
@@ -26,21 +29,21 @@ debian:* | ubuntu:*)
 	install='
 apt-get update -qq >/dev/null
 DEBIAN_FRONTEND=noninteractive apt-get install -qq -y --no-install-recommends systemd kmod \
-	systemd-sysv dbus udev systemd-resolved >/dev/null
+	systemd-sysv dbus udev systemd-resolved $RK_SYSTEMD_PACKAGES >/dev/null
 apt-get clean
 rm -rf /var/lib/apt/lists/*
 '
 	;;
 fedora:*)
 	install='
 dnf -q -y install --setopt=install_weak_deps=False systemd systemd-udev systemd-resolved \
-	dbus-broker kmod gawk >/dev/null
+	dbus-broker kmod gawk $RK_SYSTEMD_PACKAGES >/dev/null
 dnf -q clean all
 '
 	;;
 archlinux:*)
 	install='
-pacman -Syu --noconfirm --needed systemd dbus kmod gawk >/dev/null
+pacman -Syu --noconfirm --needed systemd dbus kmod gawk $RK_SYSTEMD_PACKAGES >/dev/null
 pacman -Scc --noconfirm >/dev/null
 '
 	;;
@@ -50,6 +53,7 @@ pacman -Scc --noconfirm >/dev/null
 	;;
 esac
 
-docker run --platform "linux/$arch" --name "$name" "$image" sh -euc "$install"
+docker run -e "RK_SYSTEMD_PACKAGES=$RK_SYSTEMD_PACKAGES" --platform "linux/$arch" --name "$name" \
+	"$image" sh -euc "$install"
 docker export "$name" | gzip > "$out"
 echo "systemd: the tree of $image is in $out"

xtask/src/main.rs

@@ -404,8 +404,12 @@ const SYSTEMD_MEMORY: &str = "2G";
 /// the interface of the virtio-net-pci device must have its predictable name from `net_id`. In
 /// the `networkd` test, systemd-networkd gets an IPv4 address with DHCP from the user network of
 /// QEMU and sets a static IPv6 address, `networkctl` must give `routable` for the interface, and
-/// `resolvectl query` must give an address.
-const SYSTEMD_TESTS: &[&str] = &["udevd", "networkd"];
+/// `resolvectl query` must give an address. In the `sdbpf` test, the unit tests test-bpf-devices,
+/// test-bpf-firewall and test-bpf-foreign-programs of systemd must pass. They attach cgroup BPF
+/// programs and ping the addresses of the loopback interface. They come from the package
+/// systemd-tests, and ping comes from iputils-ping, so the tree needs both (see
+/// tools/systemd/build.sh).
+const SYSTEMD_TESTS: &[&str] = &["udevd", "networkd", "sdbpf"];
 
 /// The longest time that one boot test can take. TCG on a slow CI runner is the slowest case.
 const BOOT_TEST_TIMEOUT: Duration = Duration::from_secs(120);
@@ -462,6 +466,7 @@ const BOOT_TESTS: &[&str] = &[
     "systemd",
     "udevd",
     "networkd",
+    "sdbpf",
     "fstests",
 ];
 
@@ -1096,6 +1101,31 @@ esac
 systemctl poweroff
 END
 fi
+# The `sdbpf` test: the unit tests of systemd for the cgroup BPF programs. A test that it skips
+# exits with 77, and that is a failure here.
+if [ "${1:-}" = sdbpf ]; then
+cat > /usr/local/bin/rk-check << 'END'
+#!/bin/sh
+other=
+state=$(systemctl is-system-running --wait || true)
+echo "rk-sdbpf: state $state"
+dir=/usr/lib/systemd/tests/unit-tests
+[ -d $dir ] || echo 'rk-sdbpf: no systemd-tests in the tree, see tools/systemd/build.sh'
+command -v ping > /dev/null || echo 'rk-sdbpf: no ping in the tree, see tools/systemd/build.sh'
+for test in test-bpf-devices test-bpf-firewall test-bpf-foreign-programs; do
+    $dir/$test > /tmp/$test.log 2>&1
+    status=$?
+    tail -n 60 /tmp/$test.log | sed "s/^/rk-sdbpf: $test: /"
+    echo "rk-sdbpf: $test: exit $status"
+    [ $status = 0 ] || other="$other $test"
+done
+[ -z "$other" ] || echo "rk-sdbpf: bad:$other"
+case $state in
+running | degraded) [ -n "$other" ] || echo 'rk-sdbpf: pass' ;;
+esac
+systemctl poweroff
+END
+fi
 chmod 755 /usr/local/bin/rk-check
 echo "rk-systemd: $(/usr/lib/systemd/systemd --version | head -n 1)"
 exec /usr/lib/systemd/systemd