/kernel-testing

name: kernel-testing
description: Linux kernel testing skill for KUnit, kselftest, syzkaller, and LTP. Use when writing KUnit tests, running kselftest harness, configuring syzkaller fuzzing, or integrating KernelCI. Activates on queries about kunit_test_suite, kunit.py, kselftest, syzkaller, kcov, or Linux Test Project.

Kernel Testing

Purpose

Guide agents through testing the Linux kernel: KUnit in-kernel unit tests, the kselftest harness, syzkaller fuzzing with kcov coverage, Linux Test Project (LTP) syscall regression, and KernelCI integration for continuous testing.

When to Use

• Writing unit tests for kernel library code or driver helpers
• Adding regression tests to `tools/testing/selftests/`
• Fuzzing syscalls and ioctl interfaces with syzkaller
• Measuring kernel code coverage with kcov
• Running LTP for syscall compatibility validation
• Setting up CI for kernel patches

Workflow

1. KUnit — in-kernel unit tests

// test_example.c
#include <kunit/test.h>

static void example_test(struct kunit *test)
{
    KUNIT_EXPECT_EQ(test, 1 + 1, 2);
    KUNIT_ASSERT_NOT_ERR_OR_NULL(test, kmalloc(16, GFP_KERNEL));
}

static struct kunit_case example_test_cases[] = {
    KUNIT_CASE(example_test),
    {}
};

static struct kunit_suite example_suite = {
    .name = "example",
    .test_cases = example_test_cases,
};
kunit_test_suite(example_suite);

MODULE_LICENSE("GPL");

# Makefile
obj-$(CONFIG_KUNIT) += test_example.o

# Run KUnit (in-tree)
./tools/testing/kunit/kunit.py run

# Run specific test
./tools/testing/kunit/kunit.py run --filter example

# With cross-compilation
./tools/testing/kunit/kunit.py run --cross_compile aarch64-linux-gnu- \
    --arch arm64

KUnit runs in kernel context (UMH or dedicated kunit kernel). Use `kunit_kmalloc` for test allocations.

2. kselftest harness

# Build all selftests
cd tools/testing/selftests
make -j$(nproc)

# Run all
make run_tests

# Run specific test
./memfd/memfd_test
./mount/run_unprivileged_remount.sh

Adding a new selftest:

tools/testing/selftests/mytest/
├── Makefile
├── mytest.c
└── config        # optional kconfig requirements

# tools/testing/selftests/mytest/Makefile
CFLAGS += -Wall
TEST_GEN_FILES := mytest
TEST_PROGS := mytest

include ../lib.mk

# Run from top-level
make -C tools/testing/selftests/mytest run_tests

3. syzkaller fuzzing

# Install syzkaller
git clone https://github.com/google/syzkaller
cd syzkaller && make

# Manager config (manager.cfg)
{
    "target": "linux/amd64",
    "http": "127.0.0.1:56741",
    "workdir": "/tmp/syzkaller",
    "kernel_obj": "/path/to/kernel/build",
    "syzkaller": "/path/to/syzkaller",
    "procs": 8,
    "type": "qemu",
    "vm": {
        "count": 4,
        "kernel": "/path/to/bzImage",
        "cpu": 2,
        "mem": 2048
    }
}

# Start manager
./bin/syz-manager -config manager.cfg

# Reproduce a crash
./bin/syz-repro -config manager.cfg crash-report.txt

Kernel requirements: `CONFIG_KCOV`, `CONFIG_DEBUG_FS`, `CONFIG_KASAN` (recommended).

4. kcov — kernel coverage

# Enable kcov on instrumented kernel
# CONFIG_KCOV=y in kernel config

# syzkaller uses kcov automatically
# Manual coverage via debugfs
ls /sys/kernel/debug/kcov/

Coverage guides syzkaller toward unexplored kernel paths.

5. Linux Test Project (LTP)

# Build LTP
git clone https://github.com/linux-test-project/ltp
cd ltp
make autotools
./configure
make -j$(nproc)
make install

# Run syscall tests
cd /opt/ltp
./runltp -f syscalls

# Run specific test
./runltp -f syscalls -s pipe01

LTP categories: syscalls, FS, network, IPC, controllers, security.

6. KernelCI

# Local kernel build test (simplified workflow)
# KernelCI tests patches against multiple defconfigs

# Submit build to KernelCI (project-specific tokens)
# See https://kernelci.org/docs/

# Check boot and kselftest results in KernelCI dashboard

Typical CI pipeline:

Patch → build (allmodconfig) → boot test (QEMU) → kselftest → LTP subset

7. Testing decision tree

What to test?
├── Pure kernel function logic → KUnit
├── Userspace-visible behavior (syscall, ioctl) → kselftest
├── Security/crash finding → syzkaller + KASAN
├── Regression across distros → LTP
└── Upstream patch CI → KernelCI

8. Debug-friendly test kernel config

CONFIG_KUNIT=y
CONFIG_KCOV=y
CONFIG_KASAN=y
CONFIG_DEBUG_INFO_DWARF5=y
CONFIG_FRAME_POINTER=y
CONFIG_FTRACE=y

make kvm_guest.config   # reasonable test config base
scripts/config --enable KUNIT KCOV KASAN
make olddefconfig

Common Problems

| Symptom | Cause | Fix | |---------|-------|-----| | KUnit tests not found | CONFIG_KUNIT disabled | Enable in .config; rebuild | | kselftest SKIP | Missing kernel feature | Check `config` file requirements | | syzkaller no crashes | Wrong VM config | Verify QEMU boots; check kernel cmdline | | kcov zero coverage | CONFIG_KCOV off | Rebuild kernel with kcov | | LTP massive failures | Wrong environment | Run as root; check prerequisites in README | | kunit.py hangs | UML vs hardware mismatch | Specify `--arch` and cross-compile |

Related Skills

• `skills/low-level-programming/linux-kernel-modules` — modules under test
• `skills/kernel/device-drivers` — driver logic to unit test
• `skills/kernel/kernel-debugging` — debug failures found by tests
• `skills/runtimes/fuzzing` — userspace fuzzing concepts (libFuzzer)
• `skills/runtimes/sanitizers` — KASAN/KMSAN for kernel
• `skills/virtualization/qemu-kvm` — QEMU for kernel boot testing