Upload eBPF July update

alpha/engagements/2026/eBPF/update-2026-07.md

@@ -0,0 +1,62 @@
+## **eBPF Foundation Alpha-Omega Engagement**
+
+### **Project Update — July 2026**
+
+This project update details the engineering progress made during June 2026 for the eBPF Foundation's Alpha-Omega engagement. Activities during this reporting period focused heavily on advancing Kernel Address Sanitizer (KASAN)—a dynamic memory error detector designed to intercept out-of-bounds and use-after-free bugs—support for Just-In-Time (JIT) compiled eBPF programs. Key achievements include the distribution and maintenance of the version 2 (v2) RFC patch series, the expansion of instruction tracking to encompass atomic operations, the resolution of verifier instruction patching synchronization edge cases, and continuous validation against automated testing infrastructures.
+
+---
+
+### **RFC Review and Community Engagement**
+
+Upstream collaboration and document maintenance progressed across several areas:
+
+* **LSFMMBPF Publication:** A technical blog post summarizing the outcomes of the LSFMMBPF (Linux Storage, Filesystem, Memory Management, and BPF) summit and detailing the architectural goals of the eBPF KASAN work was completed, reviewed, and prepared for publication at [https://alpha-omega.dev/blog/driving-ebpf-performance-and-stability-updates-from-the-lsfmmbpf-2026-ebpf-track/](https://alpha-omega.dev/blog/driving-ebpf-performance-and-stability-updates-from-the-lsfmmbpf-2026-ebpf-track/).  
+* **RFC v2 Submission:** The second iteration of the core eBPF KASAN patch series was formally submitted upstream to the Linux kernel mailing list under `https://lore.kernel.org/bpf/20260604-kasan-v2-0-c066e627fda8@bootlin.com/`.  
+* **Architectural Refactoring:** Based on initial upstream feedback, a previously proposed stack-marking helper was completely deprecated. The validation checks were relocated directly into the JIT compiler layer to provide a cleaner integration.  
+* **Register Tracking Analysis:** Automated feedback regarding potential `r10` and `r11` register clobbering during sanitization calls was evaluated against the SystemV ABI and Address Sanitizer assembly patterns. The analysis determined that excluding these registers from the preservation path remains safe, as they do not conflict with the active execution contexts of the underlying eBPF programs. 
+
+---
+
+### **Expanded Instruction Coverage**
+
+Instrumentation capabilities were extended across a wider range of the BPF instruction set:
+
+* **Atomic Operations:** Basic atomic instructions, including `BPF_ATOMIC | BPF_ADD`, were integrated. Discrepancies identified in how the x86 JIT compiler handled instrumentation for corner-case atomic branches prompted targeted adjustments within the `do_jit` compilation logic to avoid treating specific atomics as standalone corner cases.  
+* **Ordered Memory Operations:** Instrumentation was successfully achieved for `load_acquire` and `store_release` operations, completing the planned nominal implementation for core memory-access types.  
+* **Double-Word Store Refactoring:** Review feedback highlighted regressions affecting double-word (DW) variants of `BPF_ST` instructions when utilizing the arguments-on-stack feature. The underlying instruction management was refactored to maintain alignment parity.
+
+---
+
+### **Testing and Validation**
+
+Automated validation and test suite resilience were enhanced during the period:
+
+* **CI Integration:** The full patch series was verified using the upstream BPF CI infrastructure. With `kasan_multi_shot` and related kernel configuration parameters enabled, the test framework successfully validated that expected KASAN reports are generated accurately.  
+* **Negative Test Suite Strengthening:** Initial stack-poisoning test constraints caused by alignment differences between arbitrary variables on the program stack and standard slab allocations were resolved. By encapsulating test variables within structured data layouts on the stack, negative verification tests—which ensure instrumentation is omitted where inappropriate—were safely re-introduced.   
+* **Multi-State Memory Validation:** A specialized test case was added to verify that memory operations routing through multiple verifier execution states are correctly instrumented, even when one path resolves a register specifically to stack memory.  
+* **Kernel Log Isolation:** Test framework interactions with the kernel ring buffer were corrected. An issue where individual tests fully consumed log output—thereby disrupting downstream test reporting that relies on log parsing—was rectified.
+
+---
+
+### **Architecture and Verifier Fixes**
+
+Significant effort was dedicated to addressing instances where the kernel verifier alters the eBPF instruction stream prior to JIT compilation:
+
+* **Global Subprograms:** A bug triggering false-positive KASAN errors when caller stack memory was passed into global subprograms was mitigated. Because global subprogram boundaries complicate tracking inside the verifier, a conservative architectural stance was implemented with maintainer agreement, ensuring memory accesses within global subprograms are not prematurely skipped.  
+* **Upstream Rebase:** The development branch was successfully rebased onto the latest CI kernel, resolving a minor conflict with the recently introduced `MAX_CALL_FRAMES` expansion.  
+* **In-Flight Instruction Patching Redesign:** Deeper analysis revealed that several verifier fixups (such as zero/random high-32-bit extensions via `BPF_F_TEST_RND_HI32`, context conversions like `bpf_convert_ctx_accesses`, and constant blinding via `bpf_jit_blind_constant`) alter or inject new `LDX`, `ST`, or `STX` instructions. These structural changes frequently shifted or stripped the non-stack-access metadata flags.  
+* **Auxiliary Data Relocation:** To resolve this desynchronization, `bpf_patch_insn_data` was updated across all kernel call sites to accept a new parameter indicating the relative offset of the original instruction within the newly generated patch sequence. In complex scenarios where a virtual instruction is expanded into an entirely new sequence (e.g., inlined helpers), a fallback value (`-1`) is supplied. Concurrently, `adjust_insn_aux_data` was updated to accurately relocate stack-tracking flags and automatically enforce a conservative non-stack-access designation on any newly generated memory operations.
+
+---
+
+### **Current Focus**
+
+* Validating the updated instruction patching logic and auxiliary metadata relocation framework using interactive debugging tools (`gdb`).  
+* Developing reliable, minimal reproducer test cases in the eBPF self-test directory to exercise and stress-test complex verifier fixup code paths.  
+* Integrating the fixup tracking improvements into the development branch to prepare for subsequent upstream reviews.
+
+---
+
+### **Acknowledgements**
+
+The eBPF Foundation thanks Alpha-Omega for its continued support of this work. The engagement is helping advance practical security improvements for the Linux kernel and the broader eBPF ecosystem through both upstream engineering and community collaboration.