Automated testing of operating system (OS) kernel helper functions accessible through extended BPF (EBPF) filters
US12346453B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Sep 23, 2022 |
| Grant date | Jul 1, 2025 |
| Priority date | — |
| Expiry date | Jul 26, 2043 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/034
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
A method to test an OS kernel interface, such as an eBPF helper function. The interface has a grammar that defines the kernel interface. Testing is carried out using eBPF code that invokes and tests the interface using a fuzzing engine. To facilitate the process, additional user space code is configured to generate at least one kernel event that triggers the eBPF code to run, and to transform inputs from the fuzzing engine according to the grammar that defines the kernel interface. After loading the eBPF code into the OS kernel, the user space code issues the kernel event that causes the eBPF code to run. In response, and as the fuzzing engine executes, the eBPF code records arguments sent to the OS kernel through the kernel interface. The arguments are passed through a data structure shared by the eBPF code and the user space code. By recording the arguments and other diagnostic information, the security of the kernel interface is evaluated.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.