[PATCH bpf v2] selftests/bpf: Remove hexdump dependency

[PATCH bpf v2] selftests/bpf: Remove hexdump dependency

[Matthieu Baerts (NGI0)]

The verification signature header generation requires converting a
binary certificate to a C array. Previously this only worked with xxd,
and a switch to hexdump has been done in commit b640d556a2b3
("selftests/bpf: Remove xxd util dependency").

hexdump is a more common utility program, yet it might not be installed
by default. When it is not installed, BPF selftests build without
errors, but tests_progs is unusable: it exits with the 255 code and
without any error messages. When manually reproducing the issue, it is
not too hard to find out that the generated verification_cert.h file is
incorrect, but that's time consuming. When digging the BPF selftests
build logs, this line can be seen amongst thousands others, but ignored:

  /bin/sh: 2: hexdump: not found

Here, od is used instead of hexdump. od is coming from the coreutils
package, and this new od command produces the same output when using od
from GNU coreutils, uutils, and even busybox. This is more portable, and
it produces a similar results to what was done before with hexdump:
there is an extra comma at the end instead of trailing whitespaces,
but the C code is not impacted.

Fixes: b640d556a2b3 ("selftests/bpf: Remove xxd util dependency")
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
Originally, I was going to add a check to stop the build if hexdump was
not available, but switching to 'od' seems to be a better solution while
not adding a new dependency.

Because test_progs was not reporting why it became unusable, I added a
Fixes tag to have this backported, to help others. Feel free to remove
it, or even drop the patch if you prefer to stick with hexdump.

Changes in v2:
- use a shorter 'sed' command instead of 'awk' (David Laight)
- I didn't add Mykyta's Tested-by because the code has changed.
- Link to v1: https://patch.msgid.link/20260216-bpf-sft-hexdump-od-v1-1-f8cebd8eb9d0@kernel.org
---
 tools/testing/selftests/bpf/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index c6bf4dfb1495..6776158f1f3e 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -723,7 +723,7 @@ $(VERIFICATION_CERT) $(PRIVATE_KEY): $(VERIFY_SIG_SETUP)
 # Generates a header with C array declaration, containing test_progs_verification_cert bytes
 $(VERIFY_SIG_HDR): $(VERIFICATION_CERT)
 	$(Q)(echo "unsigned char test_progs_verification_cert[] = {"; \
-	 hexdump -v -e '12/1 "  0x%02x," "\n"' $< | sed 's/0x  ,//g; $$s/,$$//'; \
+	 od -v -t 'xC' -w12 $< | sed 's/ \(\S\+\)/ 0x\1,/g;s/^\S\+/ /;$$d'; \
 	 echo "};"; \
 	 echo "unsigned int test_progs_verification_cert_len = $$(wc -c < $<);") > $@
 

---
base-commit: 886bf921ecfc30f8f31341bc26560d8bf08b937b
change-id: 20260216-bpf-sft-hexdump-od-abd07a3bf026

Best regards,
-- 
Matthieu Baerts (NGI0) <matttbe@kernel.org>

Re: [PATCH bpf v2] selftests/bpf: Remove hexdump dependency

[Alan Maguire]

On 18/02/2026 12:01, Matthieu Baerts (NGI0) wrote:
> The verification signature header generation requires converting a
> binary certificate to a C array. Previously this only worked with xxd,
> and a switch to hexdump has been done in commit b640d556a2b3
> ("selftests/bpf: Remove xxd util dependency").
> 
> hexdump is a more common utility program, yet it might not be installed
> by default. When it is not installed, BPF selftests build without
> errors, but tests_progs is unusable: it exits with the 255 code and
> without any error messages. When manually reproducing the issue, it is
> not too hard to find out that the generated verification_cert.h file is
> incorrect, but that's time consuming. When digging the BPF selftests
> build logs, this line can be seen amongst thousands others, but ignored:
> 
>   /bin/sh: 2: hexdump: not found
> 
> Here, od is used instead of hexdump. od is coming from the coreutils
> package, and this new od command produces the same output when using od
> from GNU coreutils, uutils, and even busybox. This is more portable, and
> it produces a similar results to what was done before with hexdump:
> there is an extra comma at the end instead of trailing whitespaces,
> but the C code is not impacted.
> 
> Fixes: b640d556a2b3 ("selftests/bpf: Remove xxd util dependency")
> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

looks good to me, and works well.

Tested-by: Alan Maguire <alan.maguire@oracle.com>

Re: [PATCH bpf v2] selftests/bpf: Remove hexdump dependency

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Wed, 18 Feb 2026 13:01:44 +0100 you wrote:
> The verification signature header generation requires converting a
> binary certificate to a C array. Previously this only worked with xxd,
> and a switch to hexdump has been done in commit b640d556a2b3
> ("selftests/bpf: Remove xxd util dependency").
> 
> hexdump is a more common utility program, yet it might not be installed
> by default. When it is not installed, BPF selftests build without
> errors, but tests_progs is unusable: it exits with the 255 code and
> without any error messages. When manually reproducing the issue, it is
> not too hard to find out that the generated verification_cert.h file is
> incorrect, but that's time consuming. When digging the BPF selftests
> build logs, this line can be seen amongst thousands others, but ignored:
> 
> [...]

Here is the summary with links:
  - [bpf,v2] selftests/bpf: Remove hexdump dependency
    https://git.kernel.org/bpf/bpf/c/1e5c00912695

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html