From: Eduard Zingerman <eddyz87@gmail.com>
To: Yonghong Song <yonghong.song@linux.dev>, bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
kernel-team@fb.com
Subject: Re: [PATCH bpf-next v5 20/21] selftests/bpf: Cover the exception cleanup shapes the chain does not reach
Date: Wed, 23 Sep 2026 00:50:36 -0700 [thread overview]
Message-ID: <962c001bc6497234e5ee66353e206e6c2f38834f.camel@gmail.com> (raw)
In-Reply-To: <20260923050029.2427329-1-yonghong.song@linux.dev>
On Tue, 2026-09-22 at 22:00 -0700, Yonghong Song wrote:
...
> +static void test_shapes(void)
> +{
Maybe consider adding an annotation __retbss(var, value)?
Similar to __retval(), but checking the value of a variable in .bss
after the test execution?
Similar to how veristat does it, it can:
- look for a map with a name ".bss" and enumerate
- look for a btf_is_datasec() with a name ".bss"
- iterate over variables in the section and look
for one with a name specified in the annotation
- read the value if it is e.g. u32
(we can limit support by u32 or u64 at the moment).
This would remove the necessity for test_shapes(),
as generic RUN_TESTS() would suffice.
But also, Yonghong, this series adds 2.5K lines of tests,
are you sure all these tests are necessary?
Is there a more compact way to encode these?
> + struct exceptions_cleanup_shapes *skel;
> +
> + skel = exceptions_cleanup_shapes__open_and_load();
> + if (!ASSERT_OK_PTR(skel, "shapes open_and_load"))
> + return;
> +
> + /* The frame loads at all only if everything unreachable in it went. */
> + if (test__start_subtest("sweep_no_throw"))
> + run_shape(skel, skel->progs.entry_sweep, 1, 0, 0);
> + if (test__start_subtest("sweep_throw"))
> + run_shape(skel, skel->progs.entry_sweep, 101, THROW_COOKIE, RAN_SWEEP);
> +
> + /* The covered call unwinds to the pad; the uncovered one walks past. */
> + if (test__start_subtest("shared_callee_no_throw")) {
> + skel->bss->outer_input = 0;
> + run_shape(skel, skel->progs.entry_shared, 1, 2, 0);
> + }
> + if (test__start_subtest("shared_callee_throw")) {
> + skel->bss->outer_input = 0;
> + run_shape(skel, skel->progs.entry_shared, 101, THROW_COOKIE, RAN_SHARED);
> + }
> + if (test__start_subtest("shared_callee_uncovered_throw")) {
> + skel->bss->outer_input = 101;
> + run_shape(skel, skel->progs.entry_shared, 1, THROW_COOKIE, 0);
> + skel->bss->outer_input = 0;
> + }
> +
> + /* The pad only sets its bit if it got the frame's own r6-r9 back. */
> + if (test__start_subtest("pad_sees_callee_saved"))
> + run_shape(skel, skel->progs.entry_regs, 101, THROW_COOKIE, RAN_REGS);
> +
> + /* Same check, with a tail-call-reachable callee: its spill moves. */
> + if (test__start_subtest("tail_call_no_throw"))
> + run_shape(skel, skel->progs.entry_tail_call, 1, 0, 0);
> + if (test__start_subtest("tail_call_throw"))
> + run_shape(skel, skel->progs.entry_tail_call, 101, THROW_COOKIE,
> + RAN_TAIL_CALL);
> +
> + /* A region around a nounwind call: no pad dispatched, still loads. */
> + if (test__start_subtest("nounwind_region"))
> + run_shape(skel, skel->progs.entry_nounwind_rec, 1, 0, 0);
> +
> + /* A pad in the main program's own frame, not in a subprogram. */
> + if (test__start_subtest("main_program_pad"))
> + run_shape(skel, skel->progs.entry_main_pad, 101, THROW_COOKIE,
> + RAN_MAIN_PAD);
> +
> + /*
> + * The same call site either way: the subprogram's throw unwinds into
> + * this frame and runs its pad, an extension's stops at its own boundary.
> + */
> + if (test__start_subtest("freplace_subprog_throws"))
> + run_shape(skel, skel->progs.entry_freplace, 7, THROW_COOKIE,
> + RAN_FREPLACE);
> + if (test__start_subtest("freplace_extension_throws"))
> + test_freplace(skel);
> +
> + /*
> + * A tail call that is taken: the walk ends at the target, so the cookie
> + * comes back from there and this frame's pad does not run -- though it
> + * is reachable, so a walk past the boundary would find it.
> + */
> + if (test__start_subtest("tail_call_taken")) {
> + int key = 0, prog_fd = bpf_program__fd(skel->progs.tc_target);
> +
> + if (ASSERT_OK(bpf_map_update_elem(bpf_map__fd(skel->maps.taken_table),
> + &key, &prog_fd, BPF_ANY),
> + "populate taken_table"))
> + run_shape(skel, skel->progs.entry_tail_taken, 101,
> + THROW_COOKIE, 0);
> + }
> +
> + /*
> + * A throwing subprog named by a BPF_PSEUDO_FUNC and handed to a
> + * bpf_loop() the verifier never reaches: the callback check has to fire
> + * on the helper call, not on the ld_imm64.
> + */
> + if (test__start_subtest("addr_taken_no_throw"))
> + run_shape(skel, skel->progs.entry_addr_taken, 1, 2, 0);
> + if (test__start_subtest("addr_taken_throw"))
> + run_shape(skel, skel->progs.entry_addr_taken, 101, THROW_COOKIE,
> + RAN_ADDR_TAKEN);
> +
> + /*
> + * A record covering bpf_throw() itself rather than a call to a frame
> + * that throws: raised, caught up with and delivered in one frame.
> + */
> + if (test__start_subtest("no_subprog_no_throw"))
> + run_shape(skel, skel->progs.entry_no_subprog, 1, 0, 0);
> + if (test__start_subtest("no_subprog_throw"))
> + run_shape(skel, skel->progs.entry_no_subprog, 101, THROW_COOKIE,
> + RAN_NO_SUBPROG);
> +
> + /*
> + * A pad that calls a subprogram; with a throwing extension in its place,
> + * the nested exception has to stop there, not restart this pad.
> + */
> + if (test__start_subtest("pad_calls_subprog")) {
> + skel->bss->pad_runs = 0;
> + run_shape(skel, skel->progs.entry_pad_calls, 101, THROW_COOKIE,
> + RAN_PAD_CALLS);
> + ASSERT_EQ(skel->bss->pad_runs, 1, "pad_runs");
> + }
> + if (test__start_subtest("pad_calls_throwing_extension"))
> + test_pad_calls_freplace(skel);
> +
> + /*
> + * A covered throw the sweep leaves last, where the default exception
> + * callback is patched in; the pad's bit needs r6-r9 still spilled.
> + */
> + if (test__start_subtest("pad_before_throw"))
> + run_shape(skel, skel->progs.entry_pad_first, 101, THROW_COOKIE,
> + RAN_PAD_FIRST);
> +
> + /*
> + * A region whose last instruction is a 16-byte one, so that end - 1
> + * names the half of it that is not an instruction.
> + */
> + if (test__start_subtest("region_ends_on_ldimm64"))
> + run_shape(skel, skel->progs.entry_wide_rec, 101, THROW_COOKIE,
> + RAN_WIDE_REC);
> +
> + /*
> + * A pad that reloads from and writes to its own frame's stack, which a
> + * JIT addressing the frame through the stack pointer gets wrong.
> + */
> + if (test__start_subtest("pad_uses_own_frame"))
> + run_shape(skel, skel->progs.entry_pad_stack, 101, THROW_COOKIE,
> + RAN_PAD_STACK);
> +
> + /* The same, with an uncovered frame between the throw and the pad. */
> + if (test__start_subtest("pad_two_frames_up"))
> + run_shape(skel, skel->progs.entry_deep_pad, 101, THROW_COOKIE,
> + RAN_DEEP_PAD);
> +
> + /* An extension program with a cleanup table of its own. */
> + if (test__start_subtest("extension_carries_table"))
> + test_ext_table(skel);
> +
> + /*
> + * A pad terminated by _Unwind_Resume, which libbpf maps onto the kfunc;
> + * every other program here calls bpf_unwind_resume directly.
> + */
> + if (test__start_subtest("resume_alias"))
> + run_shape(skel, skel->progs.entry_resume_alias, 101,
> + THROW_COOKIE, RAN_RESUME_ALIAS);
> +
> + /*
> + * A pad that calls a subprogram which tail calls, array empty and then
> + * populated: the tail call releases only the callee's own prologue.
> + */
> + if (test__start_subtest("pad_callee_tail_call")) {
> + int key = 0, prog_fd = bpf_program__fd(skel->progs.pad_tc_target);
> +
> + skel->bss->pad_tc_target_ran = 0;
> + skel->bss->pad_runs = 0;
> + run_shape(skel, skel->progs.entry_pad_tail_call, 101,
> + THROW_COOKIE, RAN_PAD_TAIL_CALL);
> + ASSERT_EQ(skel->bss->pad_tc_target_ran, 0, "target not run");
> + ASSERT_EQ(skel->bss->pad_runs, 1, "pad_runs");
> +
> + if (ASSERT_OK(bpf_map_update_elem(bpf_map__fd(skel->maps.pad_tc_table),
> + &key, &prog_fd, BPF_ANY),
> + "populate pad_tc_table")) {
> + skel->bss->pad_runs = 0;
> + run_shape(skel, skel->progs.entry_pad_tail_call, 101,
> + THROW_COOKIE, RAN_PAD_TAIL_CALL);
> + ASSERT_EQ(skel->bss->pad_tc_target_ran, 1, "target ran");
> + ASSERT_EQ(skel->bss->pad_runs, 1, "pad_runs");
> + }
> + }
> +
> + /*
> + * The same, into a target that carries a table and throws: that target
> + * is a boundary, so the outer pad runs once, not twice.
> + */
> + if (test__start_subtest("pad_callee_tail_call_throws")) {
> + int key = 0, prog_fd = bpf_program__fd(skel->progs.pad_tc_throw_target);
> +
> + if (ASSERT_OK(bpf_map_update_elem(bpf_map__fd(skel->maps.pad_tc_table),
> + &key, &prog_fd, BPF_ANY),
> + "populate pad_tc_table")) {
> + skel->bss->pad_runs = 0;
> + skel->bss->tc_target_pad_runs = 0;
> + run_shape(skel, skel->progs.entry_pad_tail_call, 101,
> + THROW_COOKIE, RAN_PAD_TAIL_CALL);
> + /* The target cleaned up after itself, once. */
> + ASSERT_EQ(skel->bss->tc_target_pad_runs, 1,
> + "tc_target_pad_runs");
> + /* And the outer pad was not started over. */
> + ASSERT_EQ(skel->bss->pad_runs, 1, "pad_runs");
> + }
> + }
> +
> + /*
> + * A pad whose first instruction opt_remove_nops() deletes: the record
> + * has to follow the pad rather than be dropped with the nop.
> + */
> + if (test__start_subtest("nop_at_pad_head"))
> + run_shape(skel, skel->progs.entry_nop_pad, 101, THROW_COOKIE,
> + RAN_NOP_PAD);
> +
> + /*
> + * A pad that indexes its frame's stack by a register the frame set
> + * before the throwing call, marked precise back across the unwind edge.
> + */
> + if (test__start_subtest("pad_var_stack_offset"))
> + run_shape(skel, skel->progs.entry_var_stack, 101, THROW_COOKIE,
> + RAN_VAR_STACK);
> +
> + /*
> + * The same, where the throw is in a global subprogram, which the
> + * verifier walks without a frame of its own.
> + */
> + if (test__start_subtest("pad_over_global_subprog"))
> + run_shape(skel, skel->progs.entry_global_pad, 101, THROW_COOKIE,
> + RAN_GLOBAL_PAD);
> +
> + /*
> + * A pad that indexes its frame by r0, which no insn in the frame
> + * wrote: the precision request for it must not cross the unwind edge.
> + */
> + if (test__start_subtest("pad_r0_precision"))
> + run_shape(skel, skel->progs.entry_pad_r0, 101, THROW_COOKIE,
> + RAN_PAD_R0);
> +
> + exceptions_cleanup_shapes__destroy(skel);
> +}
> +
...
next prev parent reply other threads:[~2026-09-23 7:50 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-23 4:58 [PATCH bpf-next v5 00/21] bpf: Run exception cleanup landing pads when bpf_throw() unwinds Yonghong Song
2026-09-23 4:58 ` [PATCH bpf-next v5 01/21] bpf: Pack bpf_insn_aux_data flags into bit fields Yonghong Song
2026-09-23 5:40 ` bot+bpf-ci
2026-09-23 19:16 ` Eduard Zingerman
2026-09-23 4:58 ` [PATCH bpf-next v5 02/21] bpf: Accept the compiler's exception cleanup table at program load Yonghong Song
2026-09-23 4:59 ` [PATCH bpf-next v5 03/21] bpf: Add the bpf_unwind_resume() kfunc Yonghong Song
2026-09-23 6:13 ` Kumar Kartikeya Dwivedi
2026-09-23 4:59 ` [PATCH bpf-next v5 04/21] bpf: Add lookups for exception cleanup resumes and landing pads Yonghong Song
2026-09-23 4:59 ` [PATCH bpf-next v5 05/21] bpf: Prepare for an exception cleanup table before the CFG walk Yonghong Song
2026-09-23 5:40 ` bot+bpf-ci
2026-09-23 4:59 ` [PATCH bpf-next v5 06/21] bpf: Make exception landing pads reachable in the CFG Yonghong Song
2026-09-23 5:51 ` bot+bpf-ci
2026-09-23 19:25 ` Eduard Zingerman
2026-09-23 4:59 ` [PATCH bpf-next v5 07/21] bpf: Explore the landing pads no call site reaches Yonghong Song
2026-09-23 16:26 ` Eduard Zingerman
2026-09-23 17:27 ` Yonghong Song
2026-09-23 18:06 ` Eduard Zingerman
2026-09-23 18:09 ` Yonghong Song
2026-09-23 21:28 ` Alexei Starovoitov
2026-09-23 22:19 ` Eduard Zingerman
2026-09-23 23:20 ` Alexei Starovoitov
2026-09-24 0:13 ` Kumar Kartikeya Dwivedi
2026-09-24 1:53 ` Alexei Starovoitov
2026-09-24 6:12 ` Kumar Kartikeya Dwivedi
2026-09-23 23:09 ` Yonghong Song
2026-09-23 4:59 ` [PATCH bpf-next v5 08/21] bpf: Walk the exception unwind in the verifier Yonghong Song
2026-09-23 16:34 ` Eduard Zingerman
2026-09-23 18:01 ` Yonghong Song
2026-09-23 4:59 ` [PATCH bpf-next v5 09/21] bpf: Refuse exception cleanup shapes bpf_throw() cannot dispatch Yonghong Song
2026-09-23 4:59 ` [PATCH bpf-next v5 10/21] bpf: Refuse a private stack for a program with an exception cleanup table Yonghong Song
2026-09-23 4:59 ` [PATCH bpf-next v5 11/21] bpf: Dispatch exception cleanup pads from bpf_throw() Yonghong Song
2026-09-23 4:59 ` [PATCH bpf-next v5 12/21] bpf, x86: Dispatch exception cleanup pads at run time Yonghong Song
2026-09-23 6:45 ` Eduard Zingerman
2026-09-23 20:45 ` Yonghong Song
2026-09-23 4:59 ` [PATCH bpf-next v5 13/21] bpf, arm64: " Yonghong Song
2026-09-23 4:59 ` [PATCH bpf-next v5 14/21] libbpf: Resolve the compiler's _Unwind_Resume to the kernel's kfunc Yonghong Song
2026-09-23 8:36 ` Kumar Kartikeya Dwivedi
2026-09-23 5:00 ` [PATCH bpf-next v5 15/21] libbpf: Add cleanup_info to bpf_prog_load_opts Yonghong Song
2026-09-23 5:00 ` [PATCH bpf-next v5 16/21] libbpf: Collect .bpf_cleanup records and pass them to the kernel Yonghong Song
2026-09-23 5:52 ` Kumar Kartikeya Dwivedi
2026-09-23 5:00 ` [PATCH bpf-next v5 17/21] libbpf: Carry the exception cleanup table through the light skeleton Yonghong Song
2026-09-23 5:00 ` [PATCH bpf-next v5 18/21] libbpf: Let the static linker carry .bpf_cleanup relocations Yonghong Song
2026-09-23 5:40 ` bot+bpf-ci
2026-09-23 5:00 ` [PATCH bpf-next v5 19/21] selftests/bpf: Add an end-to-end .bpf_cleanup exception test Yonghong Song
2026-09-23 5:51 ` bot+bpf-ci
2026-09-23 5:00 ` [PATCH bpf-next v5 20/21] selftests/bpf: Cover the exception cleanup shapes the chain does not reach Yonghong Song
2026-09-23 5:51 ` bot+bpf-ci
2026-09-23 7:50 ` Eduard Zingerman [this message]
2026-09-23 5:00 ` [PATCH bpf-next v5 21/21] selftests/bpf: Load an exception cleanup program from a light skeleton Yonghong Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=962c001bc6497234e5ee66353e206e6c2f38834f.camel@gmail.com \
--to=eddyz87@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=kernel-team@fb.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox