| 1dad22de | 19-Oct-2026 |
Kumar Kartikeya Dwivedi <memxor@gmail.com> |
selftests/bpf: Test __arena pointer members
Add a struct_ops member to bpf_testmod whose argument struct publishes
arena pointers: a plain one, a __nullable one that is left NULL, one
behind a neste
selftests/bpf: Test __arena pointer members
Add a struct_ops member to bpf_testmod whose argument struct publishes
arena pointers: a plain one, a __nullable one that is left NULL, one
behind a nested struct, one inside a union, next to a scalar, together
with a kfunc that fills the struct with the kernel address of an __arena
argument and calls the member.
Two callbacks read the pointers back. One shares the header with the
module, so the members are arena pointers on the program side as well
and need no cast; it also records the register a load produces, which
must be the arena offset with the upper 32 bits clear, reads the member
with a load-acquire as well, which has to yield the same pointer, and
hands the pointer to an __arena kfunc. The other mirrors the vmlinux.h
rendering of the struct, a kernel pointer with the type tag as an
attribute, and casts the members to the arena address space the way a
program built against vmlinux.h has to. Both increment the value through
each pointer and the trigger checks the count. The first callback also
reads a member through a plain pointer to a bad address, a probed load
that is skipped or faults, and checks that it reads as NULL rather than
as an arena pointer.
The failure cases cover a store to the member, which a struct_ops
program cannot do to any argument member, a load from the union, an
exchange, one insn loading the arena pointer on one path and a scalar or
a memory pointer on another, and a program without an arena. On a
kernel whose module BTF carries no type tags the member tests are
reported as skipped.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019132203.3034698-10-memxor@gmail.com
show more ...
|
| 9278bedb | 19-Oct-2026 |
Kumar Kartikeya Dwivedi <memxor@gmail.com> |
selftests/bpf: Test __nullable pointer members
Add a struct_ops member to bpf_testmod whose argument struct carries two
task pointers, one plain and one __nullable, both made trusted through a
__saf
selftests/bpf: Test __nullable pointer members
Add a struct_ops member to bpf_testmod whose argument struct carries two
task pointers, one plain and one __nullable, both made trusted through a
__safe_trusted alias of the struct in the module BTF, and a kfunc that
calls the member once with the nullable pointer unset and once set.
The callback acquires the plain pointer as is and the nullable one only
after a check, driven through the kfunc from a syscall program. The
failure case passes the nullable pointer to bpf_task_acquire() unchecked
and is rejected as possibly NULL.
More members cover the other kinds of pointer: a per-CPU one, which
only the per-CPU helpers consume and which keeps the flag, the struct
itself through a plain pointer and through an untrusted one out of a
__kptr_untrusted map value that is never set, and a pointer to a scalar,
which are probed and lose it. The callback uses each after a check; a
failure test passes the per-CPU pointer unchecked, and three programs
read the probed ones unchecked and load. bpf_testmod_ops3 gets the base
helpers for the per-CPU helpers.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019132203.3034698-9-memxor@gmail.com
show more ...
|
| b6878211 | 16-Oct-2026 |
Yonghong Song <yonghong.song@linux.dev> |
selftests/bpf: Test trampoline args around a 16-byte aligned stack arg
Add two bpf_testmod functions whose 16-byte aligned argument, a struct
holding an __int128, is passed on the stack after a hole
selftests/bpf: Test trampoline args around a 16-byte aligned stack arg
Add two bpf_testmod functions whose 16-byte aligned argument, a struct
holding an __int128, is passed on the stack after a hole:
- bpf_testmod_test_int128_stack(): seven u64s before the struct, so it
leaves a register empty on arm64 and a stack slot empty on x86-64.
- bpf_testmod_test_int128_backfill(): a 16-byte struct of two longs
moves to the x86-64 stack and gives R9 back to the next argument; the
struct then leaves a stack slot empty on both x86-64 and arm64.
The __int128 is wrapped in a struct because btf_ctx_access() refuses a
program reading an integer argument wider than eight bytes, while it
lets the program read each slot of a struct argument.
The fentry programs read each argument slot from ctx[] and check that
the trampoline packs them in the BPF convention, and the fexit programs
check the return value, weighted by argument slot, which is only right
if the original function got its arguments back where its convention
wants them.
Without the preceding x86 fix the test fails with:
test_int128_args:FAIL:s:h.lo unexpected s:h.lo: actual 2 != expected 8
...
test_int128_args:FAIL:s ret unexpected s ret: actual 285 != expected 385
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261016183110.1135597-1-yonghong.song@linux.dev
show more ...
|
| 98e46955 | 16-Oct-2026 |
Yonghong Song <yonghong.song@linux.dev> |
selftests/bpf: Test by-value __int128 kfunc arguments at an odd slot
This follows up the series "bpf: Support by-value struct and __int128
arguments" [1]. The __int128 kfunc tests it added pass the
selftests/bpf: Test by-value __int128 kfunc arguments at an odd slot
This follows up the series "bpf: Support by-value struct and __int128
arguments" [1]. The __int128 kfunc tests it added pass the __int128 at
an even argument slot, after two u64s, or past the argument registers,
where it lands on an even arm64 stack slot. So neither the AAPCS64 rule
that rounds the register number up to an even one for an argument
aligned to 16 bytes, nor the same rule for a stack slot, is exercised.
Each leaves a hole the arm64 JIT has to open by moving the __int128 and
every argument after it up a slot.
Add three kfuncs. Like the earlier ones, each weighs its arguments by
argument slot, so that two eightbytes landing in each other's slots are
caught as well as one landing in a hole:
- bpf_kfunc_call_test_i128_arg_odd(): the __int128 at an odd register
slot.
- bpf_kfunc_call_test_i128_arg_odd_many(): the same, with arguments
after it that arm64 shifts onto its stack, and a second __int128 at
an odd arm64 stack slot.
- bpf_kfunc_call_test_i128_arg_stack_hole(): a struct holding an
__int128 at an odd stack slot on both x86-64 and arm64, after x86-64
gives R9 back to an argument following a 16-byte struct.
x86-64 has no register alignment rule and places the first two like the
BPF convention, so they check that its JIT leaves them where they are.
The last two need more than the five BPF argument registers and are only
built with a compiler that supports stack arguments.
On arm64 the first two kfuncs get BTF only with the pahole patch
"dwarf_loader: Skip the argument register the arm64 ABI leaves as a hole"
[2], in pahole master after v1.32. An older pahole finds the argument
after the __int128 in an unexpected register, x4 rather than x3, and
leaves the function out of BTF, so the tests fail to load there.
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20260912195156.980886-1-yonghong.song@linux.dev/ [1]
Link: https://lore.kernel.org/dwarves/20260917164043.1577508-1-yonghong.song@linux.dev/ [2]
Link: https://patch.msgid.link/20261016183054.1134162-1-yonghong.song@linux.dev
show more ...
|
| a25a6138 | 21-Sep-2026 |
Kumar Kartikeya Dwivedi <memxor@gmail.com> |
selftests/bpf: Cover generic output stack initialization
Exercise generic output buffers with and without CAP_PERFMON, using both
helpers and __uninit kfuncs. Check that initialized bytes stay reada
selftests/bpf: Cover generic output stack initialization
Exercise generic output buffers with and without CAP_PERFMON, using both
helpers and __uninit kfuncs. Check that initialized bytes stay readable
and lose stale value information, while invalid bytes remain unreadable
without permission to read uninitialized stack memory. Cover constant and
variable sizes, scalar spills, pointer spills, special stack objects, and
privileged variable offsets.
Add a kfunc that writes only the first byte of its output. Its runtime tests
read preinitialized bytes, checking both the written byte and an untouched
tail byte across a liveness checkpoint. Verify that the sysctl name helper
and uninitialized fixed and variable-sized kfunc outputs are accepted when
their contents are not read back.
Update existing __uninit readback expectations and exercise skb_load_bytes
with reduced capabilities. Even fully-writing generic outputs now preserve
invalid bytes in the verifier, so reading those bytes requires prior
initialization by the BPF program.
Use map_update_elem inputs for helper_arg_fallback_keeps_scanning. Its
original snprintf argument no longer reads the buffer, and a privileged
output with an unknown size does not trigger the whole-stack read fallback.
A variable-offset key and parent-frame value retain the intended assertion.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260921023843.411943-10-memxor@gmail.com
show more ...
|
| 89835699 | 21-Sep-2026 |
Kumar Kartikeya Dwivedi <memxor@gmail.com> |
selftests/bpf: Cover __uninit kfunc output argument slots
Keep coverage for per-slot output tracking separate from the immediate
single-output regression tests. Check that both constant-size outputs
selftests/bpf: Cover __uninit kfunc output argument slots
Keep coverage for per-slot output tracking separate from the immediate
single-output regression tests. Check that both constant-size outputs are
initialized, and that a variable-size output does not disable initialization
of an independent constant-size output.
Also exercise an output following a by-value parameter that occupies two
argument slots, and an output pointer passed on the stack. Run each case
with normal capabilities and with CAP_BPF and CAP_NET_ADMIN only. Leave the
stack-passed output uninitialized so its reduced-capability case fails if
the verifier treats it as an ordinary input buffer.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260921023843.411943-8-memxor@gmail.com
show more ...
|
| 698181b2 | 08-Sep-2026 |
Tiezhu Yang <yangtiezhu@loongson.cn> |
selftests/bpf: Add test for indirect struct_ops trampoline
Add a test case to verify that arguments passed on the stack are
correctly read by an indirect struct_ops trampoline.
This test ensures th
selftests/bpf: Add test for indirect struct_ops trampoline
Add a test case to verify that arguments passed on the stack are
correctly read by an indirect struct_ops trampoline.
This test ensures the correctness of stack offsets across various
architectures. It is particularly critical for architectures like
LoongArch, RISC-V, ARM64, and PowerPC where arguments beyond the
first 8 registers are passed on the stack, as well as x86_64 and
s390x which have lower register argument limits.
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Link: https://lore.kernel.org/r/20260908073506.29734-1-yangtiezhu@loongson.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
show more ...
|
| 2cbbb035 | 03-Sep-2026 |
Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com> |
selftests/bpf: add tests to validate KASAN on JIT programs
Add a basic KASAN test runner that loads and test-run programs that can
trigger memory management bugs. The test captures kernel logs and e
selftests/bpf: add tests to validate KASAN on JIT programs
Add a basic KASAN test runner that loads and test-run programs that can
trigger memory management bugs. The test captures kernel logs and ensure
that the expected KASAN splat is emitted by searching for the
corresponding first lines in the report, hence validated that the needed
instrumentation has been inserted by the JIT compiler before the
relevant memory accesses. To allow each test to trigger the expected
report, the kernel must run with the kasan_multi_shot configuration.
The runner covers different cases and settings: in the nominal case, it
validates kasan reports on basic instructions (on all supported accesses
sizes) but also when report _should not_ be emitted (eg: for accesses on
program stack). The runner also comes with a few specialized tests that
are then not executed for all sizes/locations:
- specific atomic ops
- test for instructions involving different verifier states, with some
states flagging memory as stack, and other states as non-stack memory
- tests that validate the stack marking shifting when a patch is emitted
by the verifier (zext/rnd_hi32, constant blindind).
Most of those tests are able to trigger kasan reports by altering the
shadow memory (triggering faulty accesses is otherwise complex, because
of the verifier). A few tests trigger actual faulty accesses (eg
out-of-bound accesses)
A few of those tests depends on cpuv4 (load_acquire/store_release, st,
st_blinded), and so are executed only with test_progs-cpuv4
# ./test_progs -a kasan
#175/1 kasan/st_1_not_on_stack:SKIP
#175/2 kasan/st_1_on_stack:SKIP
#175/3 kasan/st_2_not_on_stack:SKIP
#175/4 kasan/st_2_on_stack:SKIP
#175/5 kasan/st_4_not_on_stack:SKIP
#175/6 kasan/st_4_on_stack:SKIP
#175/7 kasan/st_8_not_on_stack:SKIP
#175/8 kasan/st_8_on_stack:SKIP
#175/9 kasan/stx_1_not_on_stack:OK
#175/10 kasan/stx_1_on_stack:OK
#175/11 kasan/stx_2_not_on_stack:OK
#175/12 kasan/stx_2_on_stack:OK
#175/13 kasan/stx_4_not_on_stack:OK
#175/14 kasan/stx_4_on_stack:OK
#175/15 kasan/stx_8_not_on_stack:OK
#175/16 kasan/stx_8_on_stack:OK
#175/17 kasan/ldx_1_not_on_stack:OK
#175/18 kasan/ldx_1_on_stack:OK
#175/19 kasan/ldx_2_not_on_stack:OK
#175/20 kasan/ldx_2_on_stack:OK
#175/21 kasan/ldx_4_not_on_stack:OK
#175/22 kasan/ldx_4_on_stack:OK
#175/23 kasan/ldx_8_not_on_stack:OK
#175/24 kasan/ldx_8_on_stack:OK
#175/25 kasan/simple_atomic_4_not_on_stack:OK
#175/26 kasan/simple_atomic_4_on_stack:OK
#175/27 kasan/simple_atomic_8_not_on_stack:OK
#175/28 kasan/simple_atomic_8_on_stack:OK
#175/29 kasan/simple_atomic_fetch_not_on_stack:OK
#175/30 kasan/simple_atomic_fetch_on_stack:OK
#175/31 kasan/load_acquire_1_not_on_stack:SKIP
#175/32 kasan/load_acquire_1_on_stack:SKIP
#175/33 kasan/load_acquire_2_not_on_stack:SKIP
#175/34 kasan/load_acquire_2_on_stack:SKIP
#175/35 kasan/load_acquire_4_not_on_stack:SKIP
#175/36 kasan/load_acquire_4_on_stack:SKIP
#175/37 kasan/load_acquire_8_not_on_stack:SKIP
#175/38 kasan/load_acquire_8_on_stack:SKIP
#175/39 kasan/store_release_1_not_on_stack:SKIP
#175/40 kasan/store_release_1_on_stack:SKIP
#175/41 kasan/store_release_2_not_on_stack:SKIP
#175/42 kasan/store_release_2_on_stack:SKIP
#175/43 kasan/store_release_4_not_on_stack:SKIP
#175/44 kasan/store_release_4_on_stack:SKIP
#175/45 kasan/store_release_8_not_on_stack:SKIP
#175/46 kasan/store_release_8_on_stack:SKIP
#175/47 kasan/ldx_patched_not_on_stack:OK
#175/48 kasan/ldx_patched_on_stack:OK
#175/49 kasan/verifier_paths_stack_and_non_stack:OK
#175/50 kasan/ldx_oob_1_not_on_stack:OK
#175/51 kasan/ldx_oob_2_not_on_stack:OK
#175/52 kasan/ldx_oob_4_not_on_stack:OK
#175/53 kasan/ldx_oob_8_not_on_stack:OK
#175/54 kasan/ldx_self_alias_on_stack:OK
#175/55 kasan/st_blinded:SKIP
#175 kasan:OK (SKIP: 25/55)
Summary: 1/30 PASSED, 25 SKIPPED, 0/0 FAILED
Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Link: https://lore.kernel.org/r/20260903-kasan-v9-8-2407fe99255a@bootlin.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
show more ...
|
| f7213961 | 29-Aug-2026 |
Yonghong Song <yonghong.song@linux.dev> |
selftests/bpf: Test kfuncs returning arena pointers by value
Cover the by-value struct returns a kfunc may now make: two arena
pointers filling R0:R2, and an arena pointer beside a scalar. Two furth
selftests/bpf: Test kfuncs returning arena pointers by value
Cover the by-value struct returns a kfunc may now make: two arena
pointers filling R0:R2, and an arena pointer beside a scalar. Two further
cases drop the tag from one member of a struct and one arm of a union,
and stay rejected naming that member, so what decides is the tag rather
than the member being a pointer. The existing cases for a struct and a
nested struct carrying a plain pointer stay rejected as well.
These cases call the kfuncs from C, so the compiler lowers the by-value
return itself, and a struct or union only lands in R0:R2 with the LLVM 23
BPF ABI. An older clang, and gcc, return it through a hidden pointer in
R1 instead, which shifts the arguments along and fails verification. The
file is therefore guarded on LLVM 23, falling back to a dummy test.
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20260829061610.1699950-1-yonghong.song@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
show more ...
|
| 0b9fc795 | 19-Aug-2026 |
Yonghong Song <yonghong.song@linux.dev> |
selftests/bpf: Add inline-asm and subprog tests for R0: R2 returns
Add inline-asm tests covering what the C tests cannot reach, since they
need a callee that violates the convention on purpose.
The
selftests/bpf: Add inline-asm and subprog tests for R0: R2 returns
Add inline-asm tests covering what the C tests cannot reach, since they
need a callee that violates the convention on purpose.
The coverage includes BPF-to-BPF returns, kfunc calls, backtracking and
liveness. In addition, a negative freplace test checks that an extension
cannot replace a function returning R0:R2.
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260819055325.3300712-1-yonghong.song@linux.dev
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
show more ...
|
| 2d4de9a4 | 08-Aug-2026 |
Tejun Heo <tj@kernel.org> |
selftests/bpf: Test stack-passed struct_ops arena arguments
Add a test_arena_stack member with eight leading scalar arguments so the
arena pointer is passed on the stack.
The callback validates the
selftests/bpf: Test stack-passed struct_ops arena arguments
Add a test_arena_stack member with eight leading scalar arguments so the
arena pointer is passed on the stack.
The callback validates the first and last scalar ctx slots before
dereferencing the pointer in ctx[8]. This exercises the indirect
trampoline stack layout and arena conversion together, and prevents a
regression where stack arguments are read one slot late.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Tested-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260808003938.3486067-13-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
show more ...
|
| ba048419 | 08-Aug-2026 |
Tejun Heo <tj@kernel.org> |
selftests/bpf: Add struct_ops __arena and __arena__nullable argument tests
Add test_arena and test_arena_nullable members to bpf_testmod_ops3 with
arena-tagged stub arguments and kfuncs that forward
selftests/bpf: Add struct_ops __arena and __arena__nullable argument tests
Add test_arena and test_arena_nullable members to bpf_testmod_ops3 with
arena-tagged stub arguments and kfuncs that forward a caller-provided
pointer to them. The kfuncs take arena-tagged arguments, so each round
trip exercises both conversion directions end to end: the kfunc receives
a kernel arena address and the trampoline converts it back to an arena
pointer for the callback.
The non-nullable callback dereferences its argument with no NULL branch
and captures the raw ctx value, which the trigger program compares
against the arena offset of the passed object, pinning the exact
(u32)(kaddr - kern_vm_start) conversion. The nullable callback verifies
that only a true kernel NULL arrives as NULL. Failure coverage: a
program with no arena is rejected when it loads. The tests run on x86-64
and skip elsewhere, as the programs fail verification where the JIT
lacks arena argument support.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260808003938.3486067-11-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
show more ...
|
| 9779193e | 02-Jun-2026 |
Ricardo B. Marlière <rbm@suse.com> |
selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels
test_kmods/Makefile always pointed KDIR at the kernel source tree root,
ignoring O= and KBUILD_OUTPUT. On distro kernels where the s
selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels
test_kmods/Makefile always pointed KDIR at the kernel source tree root,
ignoring O= and KBUILD_OUTPUT. On distro kernels where the source tree has
not been built, the Makefile had no fallback and would fail
unconditionally.
When O= or KBUILD_OUTPUT is set and points at a prepared kernel build
directory (one containing Module.symvers), pass it through so kbuild can
locate the correct build infrastructure (scripts, Kconfig, etc.). Note
that the module artifacts themselves still land in the M= directory,
which is test_kmods/; O= only controls where kbuild finds its build
infrastructure. Fall back to /lib/modules/$(uname -r)/build when neither
an explicit valid build directory nor an in-tree Module.symvers is
present.
A selftests-only O= value (one that does not contain Module.symvers, e.g.
a private output directory) is intentionally not treated as a kernel
build directory. Without this guard, a user invoking
"make -C tools/testing/selftests/bpf O=/tmp/out" would have test_kmods
try to use /tmp/out as the kernel build dir and fail.
The parent bpf/Makefile resolves O= and KBUILD_OUTPUT to absolute paths
before invoking the test_kmods sub-make. Without this, $(abspath ...)
inside test_kmods/Makefile would resolve relative paths against the
sub-make's CWD (test_kmods/) rather than the user's invocation directory.
When O= is passed to kbuild, also pass KBUILD_OUTPUT=$(KMOD_O_VALID)
explicitly. The parent invocation lifts KBUILD_OUTPUT into MAKEFLAGS as
a command-line variable, which would otherwise suppress kbuild's own
"KBUILD_OUTPUT := $(O)" assignment and cause it to use the inherited
KBUILD_OUTPUT instead of the validated O=.
Guard both all and clean against a missing KDIR so the step is silently
skipped rather than fatal. Make the parent Makefile's cp conditional so it
does not abort when modules were not built.
Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
Link: https://lore.kernel.org/r/20260602-selftests-bpf_misconfig-v12-2-27f898b3ba26@suse.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
show more ...
|