Speakers
Description
BPF_PROG_TEST_RUN has been a crucial tool for testing eBPF programs. Although it has been instrumental for XDP, as BPF spreads to other hookpoints (e.g., TC, sock_ops, struct_ops) that rely on complex data structures such as the SKB, we found that it provides an environment that diverges significantly from the kernel: it does not model these structures and instead defaults their state to zero. This leads to unfaithful test replication and test cases that may miss bugs that would occur in production. We verified three such scenarios in which a single zeroed field hides an entire branch of real kernel behavior.
A simple, concrete instance is skb->cloned, which the harness hard-wires to zero so that every clone-branching helper only ever takes its fast path. Testing against open-source eBPF programs, we confirmed this produces silent semantic divergence: bpf_skb_ecn_set_ce returns success but never sets the CE bit when an skb is cloned and its IP header is unwritable: a path the harness cannot reach. The test therefore reports a pass while the corresponding production behavior differs, illustrating how one unmodeled bit lets both unit tests and verification tools built on BPF_PROG_TEST_RUN overlook real bugs.