test(unit): add 'make check' valgrind memcheck integration (FU-S2-1)

Runs every test binary under valgrind --tool=memcheck with
--errors-for-leak-kinds=definite + --error-exitcode=99. All 11 binaries
pass with 0 errors.

valgrind.supp suppresses long-lived F-Stack config-cache leaks anchored
on ff_load_config / ff_parse_args / ff_check_config (lib design: cfg
loaded once per process, no ff_unload_config). Tracked as
FU-S2-2-CFG-UNLOAD.

Author: unit-test-impl-leader

tests/unit/Makefile

@@ -56,7 +56,7 @@ ALL_TESTS     := $(SANITY_TESTS) $(P0_TESTS) $(P1_TESTS) $(P2_TESTS) $(P3_TESTS)
 COMMON_OBJS   := $(COMMON_DIR)/ff_log_stub.o $(COMMON_DIR)/rte_stub.o
 
 # Default goal
-.PHONY: all test test_p0 test_p1 test_sanity check clean coverage coverage_clean help
+.PHONY: all test test_p0 test_p1 test_p2 test_p3 test_sanity check clean coverage coverage_clean help
 all: $(ALL_TESTS)
 
 help:
@@ -66,6 +66,9 @@ help:
 	@echo "  make test_sanity  - run hello-world sanity test"
 	@echo "  make test_p0      - run P0 tests only"
 	@echo "  make test_p1      - run P1 tests only"
+	@echo "  make test_p2      - run P2 tests only"
+	@echo "  make test_p3      - run P3 tests only"
+	@echo "  make check        - run all tests under valgrind memcheck (FU-S2-1)"
 	@echo "  make clean        - clean build artifacts (uses rm_tmp_file.sh wrapper)"
 	@echo "  make coverage     - build with gcov + run tests + emit lcov HTML report"
 	@echo "  make coverage_clean - remove gcov/.gcda/.gcno + coverage_report/"
@@ -105,8 +108,43 @@ test: all
 	done
 	@echo "ALL TESTS PASS ($(words $(ALL_TESTS)) binaries)"
 
-check: test
-	@echo "TODO: integrate valgrind --tool=memcheck per test (FU-S2-1)"
+# ----- check (FU-S2-1: valgrind memcheck per binary) ---------------------
+# Runs every test binary under valgrind --tool=memcheck. Definite leaks
+# fail the build (--errors-for-leak-kinds=definite + --error-exitcode=99).
+# Long-lived F-Stack config-cache leaks (lib/ff_config.c) are filtered
+# via valgrind.supp; see that file for the FU-S2-2-CFG-UNLOAD follow-up.
+VALGRIND      ?= valgrind
+VALGRIND_SUPP := valgrind.supp
+VALGRIND_OPTS := --tool=memcheck \
+                 --leak-check=full \
+                 --errors-for-leak-kinds=definite \
+                 --error-exitcode=99 \
+                 --suppressions=$(VALGRIND_SUPP) \
+                 --quiet
+
+check: all
+	@if ! command -v $(VALGRIND) >/dev/null 2>&1; then \
+	  echo "ERROR: $(VALGRIND) not installed; please 'dnf install -y valgrind'"; \
+	  exit 1; \
+	fi
+	@pass=0; fail=0; failed=""; \
+	for t in $(ALL_TESTS); do \
+	  printf "==> valgrind %-30s ... " "$$t"; \
+	  if $(RUN_ENV) $(VALGRIND) $(VALGRIND_OPTS) ./$$t >/dev/null 2>/tmp/vg_$$t.$$$$.log; then \
+	    echo "OK"; pass=$$((pass+1)); \
+	    /data/workspace/rm_tmp_file.sh /tmp/vg_$$t.$$$$.log >/dev/null 2>&1; \
+	  else \
+	    echo "FAIL (see /tmp/vg_$$t.$$$$.log)"; \
+	    fail=$$((fail+1)); failed="$$failed $$t"; \
+	  fi; \
+	done; \
+	echo ""; \
+	echo "=== valgrind summary: $$pass pass / $$fail fail ($(words $(ALL_TESTS)) total) ==="; \
+	if [ $$fail -gt 0 ]; then \
+	  echo "Failed binaries:$$failed"; \
+	  exit 1; \
+	fi
+	@echo "ALL VALGRIND CHECKS PASS"
 
 # ----- lib/*.c → lib_objs/*.o (independent of lib/Makefile, NFR-U-6) -----
 $(LIB_OBJS_DIR):

tests/unit/valgrind.supp

@@ -0,0 +1,47 @@
+#
+# valgrind suppressions for F-Stack unit tests (FU-S2-1).
+#
+# All entries here document KNOWN long-lived allocations in lib/ff_config.c
+# and lib/ff_ini_parser.c. F-Stack's design is to load configuration once
+# at process startup and keep it resident for the entire process lifetime
+# (no ff_unload_config()), so on a normal run there is nothing to free.
+# However, unit tests call ff_load_config repeatedly across TC; each call
+# leaks the previous run's port_cfgs / vlan / vip / freebsd cfg blocks.
+#
+# Tracked as FU-S2-2-CFG-UNLOAD: add ff_unload_config() that walks the
+# parsed structures and frees them. Until that lands, valgrind treats
+# these as leaks; suppressions below let `make check` pass without
+# masking new (truly accidental) regressions elsewhere.
+#
+# Suppression syntax: see https://valgrind.org/docs/manual/manual-core.html#manual-core.suppress
+#
+# We use catch-all stacks anchored on the public API entry points
+# (ff_load_config / ff_parse_args / ff_check_config) — any leak whose
+# stack contains those frames is by-design long-lived configuration data
+# and is suppressed. Real bugs (leaks not crossing those entry points)
+# are still reported.
+#
+
+{
+   ff-config-leak-via-ff_load_config
+   Memcheck:Leak
+   match-leak-kinds: definite,indirect
+   ...
+   fun:ff_load_config
+}
+
+{
+   ff-config-leak-via-ff_parse_args
+   Memcheck:Leak
+   match-leak-kinds: definite,indirect
+   ...
+   fun:ff_parse_args
+}
+
+{
+   ff-config-leak-via-ff_check_config
+   Memcheck:Leak
+   match-leak-kinds: definite,indirect
+   ...
+   fun:ff_check_config
+}