summaryrefslogtreecommitdiff
path: root/tools/testing/selftests/bpf
AgeCommit message (Collapse)Author
2026-08-22Merge tag 'perf-tools-for-v7.3-2026-08-21' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools updates from Namhyung Kim: "perf c2c: - Add 'function view' in perf c2c report TUI (switched by pressing 'TAB' in the cacheline view) to organize samples around functions rather than cachelines in 3-level hierarchy: Level 1: Read-side function (sorted by estimated Cycles %) Level 2: Contending writer functions (sorted by Store count) Level 3: Shared cacheline addresses Users can navigate the entries and fold/unfold using 'e' key. An example output would look like below: Shared Data Functions Table (19 entries, sorted on Cycles %) Cycles Store % count Function / Contending function / Cacheline ---------------------------------------------------------------------- + 35.67% 876 + [k] cpupri_set + 24.31% 424 + [k] pull_rt_task - 16.53% 555 - [k] dequeue_pushable_task 145 - [k] pull_rt_task 145 0xff2d0082809da080 139 - [k] enqueue_pushable_task 70 0xff2d00a2071f9640 69 0xff2d0082809da000 python module support: - Extend "perf" python module so that it can be fully functional. The goal is to run scripts directly, not by 'perf script' command. This would give better performance as well as more control to build standalone programs with UI. - Add LiveSession helper (perf_live.py) to enable live event collection directly from Python using perf.evlist and perf.parse_events. perf stat: - Add --hide-zero-events option to suppress zero-count events - Reject conflicting --field-separator and --json-output options - Fix duplicate event output with --for-each-cgroup perf sched latency: - Add -H/--histogram and --hist-mode (log|linear) options to show scheduler wait latency histograms - Add --time option to filter analysis by time span in 'perf sched latency' ARM CoreSight: - Synthesize callchains for instruction samples from CoreSight trace using thread stack ('--itrace=g...') - Support call indentation ('perf script -F +callindent') to display call depth hierarchy on branch samples - Decode ETE (Embedded Trace Extension) exception packets Build system: - Add 'make install-build-deps' target to install required packages - Parallelize JSON and metric pre-computation in jevents.py for faster builds Vendor event/metric updates: - Add Intel Nova Lake events and update tables for existing models - Update AMD Zen 5 and Zen 6 core events - Update Arm64 Tegra410 metrics and PowerPC hcalls Internal changes and fixes: - Harden trace-event and synthetic event parsing against corrupted data - Fix unwinding of multi-threaded processes in libdw unwinder - Fix memory leaks in various commands and python bindings - Speed up 'perf test' shell tests" * tag 'perf-tools-for-v7.3-2026-08-21' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (232 commits) perf vendor events arm64: Fix Tegra410 Olympus event 0x0197 perf vendor events arm64: fix swapped MetricGroup for Tegra410 L1 prefetcher metrics perf evlist: Warn when 'sleep' workload is used without system-wide (-a) option perf c2c: document function view in perf-c2c man page perf c2c: add function view browser UI and cacheline detail perf c2c: build and finalize the function view hierarchy perf c2c: add function view hierarchy entry creation perf c2c: add function view stats merge and memory management perf c2c: add HPP list parsing for function view columns perf c2c: add column rendering for function view perf c2c: add function view model skeleton perf c2c: extract shared data structures into util/c2c.h perf test sample-parsing: Validate PERF_FORMAT_GROUP values without LOST perf dso: Replace assert with runtime check in dso__read_symbol() perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() perf dso: Use stored fd error instead of stale errno in file_read() and file_size() perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() perf dso: Guard against errno==0 when dso__get_filename() returns NULL perf build: install-build-deps: add RHEL family devel package mapping perf build: Remove leftover feature tests for removed cxx and clang support ...
2026-08-20Merge tag 'loongarch-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Add DIRECT_MAP_PHYSMEM_END definition - Expand module virtual address space to 2GB - Use current_stack_pointer in current_pt_regs() - BPF JIT enhancements such as kptr_xchg and timed may_goto - Some bug fixes and other small changes * tag 'loongarch-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: selftests/bpf: Enable kptr_xchg_inline test on LoongArch LoongArch: BPF: Add arch_bpf_stack_walk() implementation LoongArch: BPF: Add timed may_goto implementation LoongArch: BPF: Resolve per-CPU addrs for internal-only MOV LoongArch: BPF: Advertise JIT support for kptr xchg inline LoongArch: BPF: Align value-returning atomics with LKMM LoongArch: BPF: Split unconditional branch JA paths statically LoongArch: BPF: Remove dead move_imm() call in BPF_NEG path LoongArch: BPF: Remove redundant zext jumping in move_imm() LoongArch: BPF: Implement branchless conditional move for TCC LoongArch: BPF: Refactor jump offset calculation in tail call LoongArch: BPF: Move arena register slot below TCC context LoongArch: BPF: Optimize redundant TCC loads in epilogue LoongArch: Use current_stack_pointer in current_pt_regs() LoongArch: Use generic cmp_int() instead of custom cmp_3way() LoongArch: Expand module virtual address space to 2GB LoongArch: Add DIRECT_MAP_PHYSMEM_END definition LoongArch: Fix acpi_package_ids[] array overflow
2026-08-20Merge tag 'net-next-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Jakub Kicinski: "One of the 'small improvements all over the place' releases for us. It's hard to draw any direct comparisons because summer vacations disrupted our patch processing (and presumably - generation) quite a bit. Quick and dirty count suggests we (Paolo and I) merged a very similar number of net (632) and net-next (648) patches. This is not telling the full story either because 1/3 to 1/2 of the net-next patches also *seem* like AI-driven low priority fixes, cleanups and clarifications. We are completely overwhelmed, of course. The glimmer of hope is that we secured sufficient LLM budget and access (thank you Meta!) to run reviews with multiple frontier models on each patch. This eliminates some hallucinations. That said, in terms of review, the LLMs can only do so much. The sad truth is that our APIs (especially for rare events like PCIe errors, timeouts etc) have always been racy, and now LLMs don't let us ignore that. I expect our direction for the next release will be to tweak the reviews a little bit more, but start shifting focus to letting the LLMs take care of the busy work - managing patchwork, automating common process complaints, editing commit messages, and maybe applying patches which already got "reviewed-by" tags from people we trust... Core & protocols: - A few steps lowering rtnl_lock dependence: - per-netns netdev unregistration for select SW drivers (e.g. veth, ipvlan, tunnels) - rtnl_lock-less FIB rule changes (RTM_NEWRULE and RTM_DELRULE) - prepare software drivers and TC qdiscs for rtnl_lock-less GET - Support BIG TCP (>64kB TSO) in UDP tunnels (vxlan, geneve) - Support buffers larger than PAGE_SIZE in devmem zero-copy API - Improve MPTCP handling of extreme memory pressure handling, when out-of-order queue had to be pruned - Report the per-group user count via RTM_GETMULTICAST - Expose the route deletion reason in RTM_DELROUTE - Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more useful handling of LSM denials when receiving SCM_RIGHTS messages: instead of truncating the message at the first blocked fd, keep every fd slot and store the LSM errno in the blocked slot - IPv6 Segment Routing - support looking up the post-encap SID (address) in a different/specified routing table - Support PRP RedBox (interlink) creation - Support per-nexthop UDP dst port in VXLAN - Continue converting getsockopt callbacks in a number of protocols to iov_iter Ethernet: - Merge initial CXL support for AMD/Solarflare NICs (shared branch with the CXL tree) - New drivers: - ADIN1140 10BASE-T1S MACPHY - Initial skeleton of Intel iXD and ZTE Dinghai drivers - High-speed NICs: - AMD/Pensando: - support firmware flashing - Cisco (enic): - SR-IOV V2 admin channel and MBOX protocol - Huawei (hns3): - support for ethtool pfc_prevention_tout - nVidia/Mellanox: - support sharing bandwidth control across interfaces of the same device - Marvell (octeontx2-pf): - link RQ page pools to netdev for Netlink stats - Google vNIC: - XDP metadata support for DQ RDA - Microsoft vNIC: - support forcing full-page RX buffers - Other NICs: - Synopsys IP: - eic7700: support for eth1 - Microchip (lan743x): - support for RMII interface - Wangxun: - support for ethtool -G and -C for VFs - add Tx timeout and PCIe error handling - Intel (igb/igc): - RSS key get/set support - support for forcing link speed without auto-negotiation - Switches: - NXP (dpaa2): - support bonding/LAG offload - Mediatek: - mt7530: EN7528 support - initial support for MT7628 - Micrel (ksz8/9): - refactoring work to move towards library model - PTP support for KSZ8463 - nVidia/Mellanox: - support rtnl-lock-less ethtool callbacks - Realtek: - rtl8366rb: use generic RTL83xx code - support SGMII and HSGMII for RTL8367S - PHYs: - Airoha: - EcoNet EN7528 PHY support - DAPU Telecom - DAPU Telecom DAP8211R(I) Gigabit PHY support - Realtek: - support RTL8261C_CG - support RTL8261D Wireless: - nl80211: per-link statistics support for multi-link operation - mac80211: AQL/airtime-fairness support for multicast - Merge Peripheral Authentication Service (PAS) / TEE support for ath12k (shared branch with the firmware/qcom tree) - New drivers: - mm81x for Morse Micro Long-Range S1G devices - nxpwifi for NXP devices (mostly forked off from mwifiex) - Driver changes: - Broadcom (brcmfmac): - DPP support, some Cypress part update - MediaTek (mt76): - mt7928 support - mt7925 NAN support - mt7996 AP powersave improvements - Qualcomm (ath12k): - much kernel infrastructure integration work - AHB platform MultiPD support - Realtek (rt89): - LED support - RTL8922DE support - dual-BT coex for RTL8922D - Intel: - new FW version support Bluetooth: - HCI: add support for Shorter Connection Interval (SCI) feature - af_bluetooth: add minimal context analysis annotations - Driver changes: - Intel: - add Bluetooth SAR revision 2 support - add vendor_reset PCI sysfs for PLDR - Mediatek: - add USB IDs for MT7902 and MT7922 devices - Realtek: - add USB IDs for 8761CU and 8852BE devices - NXP: - add M.2 Bluetooth device support using pwrseq Misc: - DPLL support for manual/numerical oscillator control (NCO) (implement in zl3073x) - MCTP support for MCTP over USB v1.1 (DMTF DSP0283) - Power-over-Ethernet: support Realtek PSE controllers - Remove the IBM EHEA driver - Remove tulip/xircom_cb driver" * tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1433 commits) net/mlx5e: do not HW-GRO coalesce small frames net: openvswitch: fix nf_connlabels leak in ovs_ct_init net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() net: openvswitch: fix flow mask use-after-free on flow deletion sctp: stop processing a packet once its association is deleted dpll: zl3073x: add PTP clock support dpll: zl3073x: add channel ToD, phase step and TIE operations dpll: zl3073x: scale poll interval proportionally to timeout ptp: vmclock: prevent read-only mappings from becoming writable ipv4: reject undersized MTUs in ip_do_fragment() bonding: initialize err for empty target lists net: dsa: initial support for MT7628 embedded switch net: dsa: initial MT7628 tagging driver net: phy: mediatek: add phy driver for MT7628 built-in Fast Ethernet PHYs dt-bindings: net: dsa: add MT7628 ESW net: pse-pd: realtek-pse-mcu: add UART transport net: pse-pd: realtek-pse-mcu: add I2C transport net: pse-pd: add Realtek PSE MCU core dt-bindings: net: pse-pd: add bindings for Realtek PSE MCU vsock: use sock_error() to consume sk_err after a failed connect ...
2026-08-20Merge tag 'bpf-next-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Pull bpf updates from Daniel Borkmann: "Major changes: - Redesign the verifier error reporting: failures now carry source and instruction annotations along with the causal event history that led to them, making program rejections far easier to debug and repair (Kumar Kartikeya Dwivedi) - Add arena argument support to kfuncs and struct_ops through the new __arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan, Kumar Kartikeya Dwivedi, Ihor Solodrai) - Signed BPF program loader rework to accommodate both BPF and security community needs where the kernel runs the signature verification at BPF_PROG_LOAD time before the LSM admission hook (Daniel Borkmann) - Add a set of ksock kfuncs which let BPF LSM and syscall programs create, connect and send on UDP sockets in order to emit telemetry data (Mahe Tardy) - Unify helper and kfunc call argument verification and classify kfunc arguments purely from BTF into a generated bpf_func_proto which is computed once at add-call time (Amery Hung) Other features and fixes: - Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport) - Add bidirectional VLAN support to bpf_fib_lookup() through the new BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags (Avinash Duduskar) - Infer zext_dst from static register liveness analysis to fix 32-bit zero-extension semantics, and remove the artificial limitations on pointer types eligible for spilling (Eduard Zingerman) - Inline the numeric open-coded iterator kfuncs so that bpf_for() loops no longer pay a kfunc call on every iteration (Puranjay Mohan) - Add an arena-based bitmap data structure to libarena along with serial and parallel selftests (Emil Tsalapatis) - Teach resolve_btfids to discover kfuncs from the kernel's BTF ID sets and to emit kfunc BTF decl tags, reducing the kernel build's dependency on pahole features (Ihor Solodrai) - Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that tunnel decapsulation can update the GSO and encapsulation state of the skb (Nick Hudson) - Fix the ring buffer pending_pos walk and the available-data accounting on 32-bit position wrap (Israel Téllez García) - Add memory usage accounting for arena maps and fix an mmap_lock deadlock on arena lock failure (Jiayuan Chen) - Add tracing_multi link info support to the kernel UAPI and bpftool, and refactor the stack map code to run with preemption disabled (Jiri Olsa) - Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the egress direction of the target's peer device (Jordan Rife) - Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular modules, can declare kfuncs safe to call under bpf_spin_lock instead of relying on the verifier's hard-coded allowlist (Kaitao Cheng) - Introduce global percpu data for BPF programs with libbpf probing and bpftool skeleton support, and stop exposing uninitialized kernel heap memory when copying per-CPU map values (Leon Hwang) - Add s390 JIT support for load-acquire and store-release instructions (Maxim Khmelevskii) - Fix a CFI mismatch in the task work callback and an arm64 KASAN false positive after bpf_throw() (Mykyta Yatsenko) - Reject writes through untrusted BTF pointers and bound the rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar) - Invalidate RCU pointers only after the final spin unlock and account for preempt and IRQ disabled regions as overlapping RCU protection (Ning Ding) - Support mixing bpf2bpf calls and tail calls on RV64, add signed operations and 32-bit atomics to the RV32 JIT, and add timed may_goto support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang) - Fix a use-after-free on mm_struct in bpf_find_vma() for foreign tasks and an mmap_lock leak in the irq_work path (Sanghyun Park) - Populate mmap-able BPF array map memory lazily which makes mmap() O(1) instead of proportional to the map size (Song Liu) - Introduce a jit_required flag and reject programs with inlined helpers when no JIT is available, where the interpreter would otherwise jump into an invalid address (Tiezhu Yang) - Fix the x86 JIT per-CPU address resolution into an extended register where the REX prefix dropped the high destination register bit (Vineet Gupta) - Reject MEM_ALLOC BTF accesses past object bounds, arena frees below the arena base, and mixed arena and ordinary atomic paths (Yiyang Chen) - Fix the trampoline handling of 128-bit arguments and of return values larger than 8 bytes (Yonghong Song) - Ensure that any fault prone load is rewritten with exception table handling, and fix the arena load-acquire and atomic fetch handling in the x86, arm64, riscv and s390 JITs (Daniel Borkmann) - Many more fixes and cleanups across the verifier, arena, trampolines, sockmap, cgroup, ring buffer, x86/arm64/riscv/s390 JITs, libbpf, bpftool, resolve_btfids and selftests" * tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (373 commits) selftests/bpf: Add tests for a store on a fault prone qdisc pointer selftests/bpf: Add tests for fault prone loads out of RCU pointers selftests/bpf: Add tests for pointer type merge at a shared load selftests/bpf: Remove duplicate copies of the arena spinlock qnodes selftests/bpf: Retry stat generation in cgroup_iter_memcg selftests/bpf: Test pseudo-function policy diagnostics bpf: Distinguish function references in policy diagnostics bpf: Preserve source attribution without source text selftests/bpf: Test kfunc argument diagnostics bpf: Correct kfunc argument diagnostics bpf: Use canonical stack argument names in diagnostics bpf: Preserve R0 lineage across helper calls selftests/bpf: Exercise negative optlen in cgroup getsockopt hook bpf: Reject negative optlen in cgroup getsockopt hook selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state bpf: Clear decap state on skb_adjust_room shrink path bpf: Allow new DECAP flags and add guard rails bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation bpf: Refactor masks for ADJ_ROOM flags and encap validation bpf: Name the enum for BPF_FUNC_skb_adjust_room flags ...
2026-08-19Merge tag 'trace-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Expose btf_ids to trace events In order to allow BPF programs to attach to system call trace events (which are actually pseudo trace events built on top of raw_syscall events), expose the BTF ID of the events. This will allow BPF programs better precision in attaching to events. - Use "u64" to assign to hist_field->type Instead of using kstrdup("u64", GFP_KERNEL) to assign the hist_field->type, just point it to "u64" instead. The hist_field->type is freed via kfree_const(). - Replace kmalloc()/strcpy() with kstrdup() for trace_printk Instead of having two calls to copy the module format string, just use kstrdup(). - Use __free() in trace event histograms and triggres where possible - Use seq_buf in trace event code instead of strcat() Instead of calculating the size of the buffer to use and filling it with strcat(), use the seq_buf infrastructure that takes care of making sure not to overflow the string size. - Reject invalid preemptirq_delay_test CPU affinity The preempt_delay_test module can take an invalid CPU affinity mask and create confusing output. Simply have the module reject invalid affinity masks. - Prevent division by zero in ftrace_ops sample module code If the ftrace_ops sample module code receives the module parameter nr_function_calls set to zero, it can cause a division by zero error. - Warn when an event dereferences a parameter in TP_printk() On boot up and module load, the trace event TP_printk() is scanned for possible bugs. As the TP_printk() code is executed when the user reads the "trace" file and processes the data written when the trace_event executed, the data it reads can be literally days old. The scan currently checks for dereferencing printk formats like "%pI6". But it does not check if the parameters themselves have a dereference like: TP_printk("offset %08x: value %08x", (u32)(__entry->addr - __entry->edma->membase), __entry->value) __entry represents the pointer to the event on the ring buffer. The __entry->edma->membase is dereferencing a pointer on the ring buffer to find membase, but the __entry->edma may no longer be a valid pointer. Warn on this case too. - Replace some strcpy() with strscpy() - Clean up mmiotrace events to use assign_type() macro The assign_type() macro makes sure the event type is indeed the type that is being parsed. The mmiotrace trace was written before that macro was created so it just simply typecasted the pointer. Replace the typecasting with the macro. - Have the ENUM processing to numbers only process what is added The code that converts ENUMs to their numbers in the trace events scanned all events to do the processing. This was true when a module was loaded too. That is, instead of processing just the events for the module, it processed *all* events. Even the builtin ones that were processed at boot up. Add a check for the event->module matching mod if it is a module before processing it. * tag 'trace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (21 commits) tracing: Have trace_event_update_all() only handle module that is loading tracing: Cleanup event_enable_trigger_parse() by using __free() tracing: Report every TP_printk double dereference tracing/mmiotrace: Use trace_assign_type() in mmio_print_mark() tracing: Make per-template BTF id lists file-local tracing: Use seq_buf for string concatenation tracing: Use strscpy() instead of strcpy() in trace_sched_switch tracing: Warn when an event dereferences a pointer in TP_printk() samples/ftrace: Prevent division by zero when nr_function_calls is zero tracing: Reject invalid preemptirq_delay_test CPU affinity fgraph: Use trace_seq_putc() in print_graph_return() tracing/user_events: Replace a seq_printf() call by seq_puts() in user_seq_show() tracing/user_events: Use seq_putc() in two functions tracing: Bound histogram expression strings with seq_buf tracing: Return ERR_PTR() from expr_str() tracing: Use __free() for expr_str() buffer kernel/trace/trace_printk: Use kstrdup() instead of kmalloc() and strcpy() tracing: Point constant hist field type to string literal selftests/bpf: Add test for tracepoint btf_ids tracefs file tracing: Expose tracepoint BTF ids via tracefs ...
2026-08-18Merge tag 'locking-core-2026-08-17' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "Futexes: - Use runtime constants for futex_hash computation (K Prateek Nayak, Peter Zijlstra) - Optimise the size check get_futex_key() (Sebastian Andrzej Siewior) - Avoid private hash use-after-free on final put (Felix Hoffmann) - Tell kmemleak we're not leaking __futex_queues (Peter Zijlstra) Rust integration updates: - Implement refcounted interrupt disable and SpinLockIrq for Rust (Boqun Feng, Heiko Carstens, Joel Fernandes, Lyude Paul) - Rust sync: add helpers for mb, dma_mb and friends; add generic memory barriers and use LKMM atomics instead of Rust atomics in the revocable code (Gary Guo) - Add abstraction and integrate synchronize_rcu() (Philipp Stanner) Lock debugging: - Add qspinlock contended_release tracepoint (Dmitry Ilvokhin, Peter Zijlstra) - Enable the printing of held locks of remote running tasks and print task CPU (Ingo Molnar) - percpu-rwsem: Annotate intentional data race in readers_active_check() (Sun Shaojie) Misc fixes and updates by Boqun Feng, Peter Zijlstra, Fangrui Song, Naveen Kumar Chaudhary and Thomas Huth" * tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (44 commits) rust: sync: Introduce SpinLockIrq::lock_with() and friends rust: sync: Add SpinLockIrq rust: sync: Use super::* in spinlock.rs rust: helper: Add spin_{un,}lock_irq_{enable,disable}() helpers rust: Introduce interrupt module s390/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS arm64: sched/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS preempt: Introduce HAS_SEPARATE_PREEMPT_RESCHED_BITS sched: Avoid signed comparison of preempt_count() in __cant_migrate() sched: Remove the unused preempt_offset parameter of __cant_sleep() locking: Switch to _irq_{disable,enable}() variants in cleanup guards irq: Add KUnit test for refcounted interrupt enable/disable irq,spin_lock: Add counted interrupt disabling/enabling openrisc: Include <linux/cpumask.h> in smp.h preempt: Introduce __preempt_count_{sub,add}_return() preempt: Introduce HARDIRQ_DISABLE_BITS preempt: Track NMI nesting to separate per-CPU counter futex: Tell kmemleak we're not leaking __futex_queues x86/paravirt: Trace contended_release on unlock tracing/lock: Use TRACE_EVENT_FN() for contended_release ...
2026-08-18Merge tag 'perf-core-2026-08-17' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull performance events updates from Ingo Molnar: "uprobes updates: - Fix a category of bugs with optimized uprobes that can clobber the redzone area with call instruction storing return address on stack where user code may keep temporary data without adjusting RSP. Fix this by moving the optimized uprobes on top of 10-bytes NOP instruction, so we can squeeze another instruction to escape the redzone area before doing the call (Jiri Olsa, Andrii Nakryiko) - Switch uretprobes_srcu to SRCU-fast-updown, to improve performance (Puranjay Mohan) Intel CPU PMU driver updates: - Optimize ACR handling in match_prev_assignment() (Dapeng Mi) - Fix various PMU driver bugs and data leaks (Dapeng Mi) - Fix Intel PT stop/start with no update (Adrian Hunter) Intel uncore PMU driver updates: - Fix various uncore PMU setup robustness bugs (Zide Chen) AMD uncore PMU driver updates: - Add group validation (Sandipan Das) .. and misc fixes and updates by Dapeng Mi, Randy Dunlap and Zide Chen" * tag 'perf-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (42 commits) perf/x86: Optimize ACR handling in match_prev_assignment() perf/x86/intel: Fix intel_cap handling on hybrid PMUs perf/x86: Remove stale fixed counter helper and fix hybrid PMU access perf/x86/intel: Unwind cpuc state if PEBS buffer setup fails perf/x86: Guard intel_pmu_cpu_dead() against invalid hybrid PMU casts perf/x86: Free hybrid state on PMU init failure perf/x86: Unregister PMI handler on PMU init failure perf/x86/intel/pt: Fix stop/start with no update perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED perf/x86/intel/pt: Factor out pt_config_enable() uprobes: Switch uretprobes_srcu to SRCU-fast-updown srcu: Add lock guard for srcu_fast_updown flavor perf/x86/intel/pt: Drop kernel-doc for deleted struct members perf/x86/amd/uncore: Add group validation selftests/bpf: Add tests for forked/cloned optimized uprobes selftests/bpf: Add tests for uprobe nop10 red zone clobbering selftests/bpf: Add reattach tests for uprobe syscall selftests/bpf: Change uprobe/usdt trigger bench code to use nop10 selftests/bpf: Change uprobe syscall tests to use nop10 selftests/bpf: Emit nop,nop10 instructions combo for x86_64 arch ...
2026-08-17Merge tag 'vfs-7.3-rc1.kfunc' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs bpf access updates from Christian Brauner: "This adds a bpf_sock_read_xattr() kfunc so a BPF LSM program can read a user.* extended attribute from a socket's sockfs inode locklessly. userspace already uses user.* xattrs on sockets to implement socket rate limiting and to tag sockets for other purposes such as a varlink registry. There has been no efficient way for a BPF program to read those labels back. With this a listening socket marked from userspace with fsetxattr() can be read back during bind or connect and acted upon on the connecting socket. That lets userspace mark sockets and later rediscover them or implement policy on them" * tag 'vfs-7.3-rc1.kfunc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/bpf: Add test for bpf_sock_read_xattr() kfunc fs: Add bpf_sock_read_xattr() kfunc to read socket xattrs
2026-08-17selftests/bpf: Add tests for a store on a fault prone qdisc pointerDaniel Borkmann
Cover the store which used to be left as a plain BPF_STX without an exception table entry: 1: R1=trusted_ptr_Qdisc() ; struct Qdisc *next = sch->next_sched; 1: (79) r1 = *(u64 *)(r1 +216) ; R1=ptr_Qdisc() ; next->limit = 1000; 3: (63) *(u32 *)(r1 +20) = r2 ; R1=ptr_Qdisc() R2=1000 Assert that it is rejected now. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t ns_bpf_qdisc [...] #257/1 ns_bpf_qdisc/fifo:OK #257/2 ns_bpf_qdisc/fq:OK #257/3 ns_bpf_qdisc/attach to mq:OK #257/4 ns_bpf_qdisc/attach to non root:OK #257/5 ns_bpf_qdisc/incompl_ops:OK #257/6 ns_bpf_qdisc/invalid_dynptr:OK #257/7 ns_bpf_qdisc/invalid_dynptr_cross_frame:OK #257/8 ns_bpf_qdisc/invalid_dynptr_slice:OK #257/9 ns_bpf_qdisc/untrusted_write:OK #257/10 ns_bpf_qdisc/dynptr_use_after_invalidate_clone:OK #257 ns_bpf_qdisc:OK Summary: 1/10 PASSED, 0 SKIPPED, 0/0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260817141015.878071-3-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-17selftests/bpf: Add tests for fault prone loads out of RCU pointersDaniel Borkmann
Cover the two loads which used to lose the BPF_PROBE_MEM rewrite, both reached from an RCU read-side critical section. The purpose of this patch is to assert load success in order to make sure to not trigger verifier_bug_if() on bpf_may_fault_on_deref() due to forgotten rewrite of a probed pointer. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t rcu_read_lock [...] #332/1 rcu_read_lock/success:OK #332/2 rcu_read_lock/rcuptr_acquire:OK #332/3 rcu_read_lock/negative_tests_inproper_region:OK #332/4 rcu_read_lock/negative_tests_rcuptr_misuse:OK #332 rcu_read_lock:OK Summary: 1/4 PASSED, 0 SKIPPED, 0/0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260817141015.878071-2-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-17selftests/bpf: Add tests for pointer type merge at a shared loadDaniel Borkmann
Cover the ways in which the type recorded for a shared load used to lose the BPF_PROBE_MEM rewrite which would then trigger a NULL deref if not handled properly. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t mem_rdonly_untrusted [...] #242/1 mem_rdonly_untrusted/btf_id_to_ptr_mem:OK #242/2 mem_rdonly_untrusted/ldx_is_ok_bad_addr:OK #242/3 mem_rdonly_untrusted/ldx_is_ok_good_addr:OK #242/4 mem_rdonly_untrusted/offset_not_tracked:OK #242/5 mem_rdonly_untrusted/stx_not_ok:OK #242/6 mem_rdonly_untrusted/atomic_not_ok:OK #242/7 mem_rdonly_untrusted/atomic_rmw_not_ok:OK #242/8 mem_rdonly_untrusted/kfunc_param_not_ok:OK #242/9 mem_rdonly_untrusted/mixed_mem_type:OK #242/10 mem_rdonly_untrusted/mixed_mem_untrusted_btf_id_type:OK #242/11 mem_rdonly_untrusted/mixed_mem_btf_id_type:OK #242/12 mem_rdonly_untrusted/mixed_rdonly_mem_btf_id_type:OK #242/13 mem_rdonly_untrusted/mixed_mem_mem_type:OK #242/14 mem_rdonly_untrusted/mixed_map_value_mem_type:OK #242/15 mem_rdonly_untrusted/mixed_stack_mem_type:OK #242/16 mem_rdonly_untrusted/diff_size_access:OK #242/17 mem_rdonly_untrusted/misaligned_access:OK #242/18 mem_rdonly_untrusted/null_check:OK #242/19 mem_rdonly_untrusted/ldx_is_ok_commuted_addr:OK #242/20 mem_rdonly_untrusted/helper_param_not_ok:OK #242 mem_rdonly_untrusted:OK Summary: 1/20 PASSED, 0 SKIPPED, 0/0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260817141015.878071-1-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-17selftests/bpf: Remove duplicate copies of the arena spinlock qnodesChangwoo Min
bpf_arena_spin_lock.h defines its 64KB qnodes array in the header, so every translation unit including it emits a copy. __weak makes them all resolve to one instance, but bpftool gen object merges only the symbols and concatenates each input's .addr_space.1 bytes, leaving the surplus copies unreferenced in the linked object. libarena links ten such units, so nine copies were dead weight (bytes): object before after ----------------------------------------------------- .addr_space.1 in libarena.bpf.o 676200 86376 libarena.skel.h 2100123 892371 libarena_asan.skel.h 2641124 1466477 Declare qnodes in the header and let each program define it once: libarena in src/common.bpf.c, and the arena_spin_lock test beside the lock it guards. Tested with test_progs -t arena_spin_lock and -t libarena. Signed-off-by: Changwoo Min <changwoo@igalia.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260817160249.655916-1-changwoo@igalia.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-17selftests/bpf: Retry stat generation in cgroup_iter_memcgAndrii Nakryiko
Each cgroup_iter_memcg subtest touches 1024 pages and expects the matching memcg counter to be non-zero. On a host with many CPUs it reads zero instead: test_anon:FAIL:final anon mapped val: actual 0 <= expected 0 memcg stats are cached per-cpu and only become visible once the periodic flusher runs (FLUSH_TIME, 2s), or once pending updates cross MEMCG_CHARGE_BATCH * num_online_cpus(). That threshold is 512 pages at 8 CPUs but 8192 at 128, so a single pass no longer reaches it and bpf_mem_cgroup_flush_stats() returns without flushing anything. Retry the stat generation, sleeping in between, so that a flusher cycle is always covered. Sleep before dropping the mapping, so that a flusher cycle landing in the sleep observes the mapped state. nr_anon_mapped and nr_file_mapped are rmap gauges, and unmapping first would post a matching negative delta for the flusher to aggregate to a net zero. test_file asserts on both nr_file_pages and nr_file_mapped, which have different lifetimes, as page cache pages outlive the mapping. Retry while either one is still zero. Fixes: 6bce6ddbe634 ("bpf: selftests: selftests for memcg stat kfuncs") Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260814232017.2839959-1-andrii@kernel.org
2026-08-17selftests/bpf: Enable kptr_xchg_inline test on LoongArchChenguang Zhao
Enable the kptr_xchg_inline functional test on LoongArch64 now that the BPF JIT can inline bpf_kptr_xchg() with correct memory ordering. Acked-by: Hengqi Chen <hengqi.chen@gmail.com> Acked-by: Tiezhu Yang <yangtiezhu@loongson.cn> Tested-by: Tiezhu Yang <yangtiezhu@loongson.cn> Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-08-17selftests/bpf: Test pseudo-function policy diagnosticsKumar Kartikeya Dwivedi
Load a socket-filter program that passes a callback to bpf_loop() without making a BPF-to-BPF call. Verify that the privileged load succeeds and the unprivileged Policy report identifies the BPF function reference at its ldimm64 instruction. Also reject the inaccurate BPF-to-BPF call wording in the portion of the log covered by the structured report. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/bpf/d02e6a6d3b2dc43a207b8ba836ce62497b250dede9252e7409c5212201c794b7@mail.kernel.org Link: https://lore.kernel.org/bpf/20260816015746.2632990-15-memxor@gmail.com
2026-08-17selftests/bpf: Test kfunc argument diagnosticsKumar Kartikeya Dwivedi
Extend existing negative kfunc programs to assert that BTF void is rendered as void and that variable __szk arguments receive a structured constant-size diagnostic. Also pass a context pointer to bpf_refcount_acquire() and verify that the report describes the generic refcounted-object contract and the actual argument type. Retain the legacy verbose-message assertions. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/3eda33675965763aa9b2e6a5784f32b34a6a83988a55fbea98b0dbd0cf3b088d@mail.kernel.org Link: https://lore.kernel.org/bpf/20260816015746.2632990-8-memxor@gmail.com
2026-08-17selftests/bpf: Exercise negative optlen in cgroup getsockopt hookJunseo Lim
Add a cgroup getsockopt selftest that sets ctx->optlen to -1. Use TCP_ZEROCOPY_RECEIVE to exercise the kernel-buffer getsockopt hook. The userspace-visible result is -EFAULT on both patched and unpatched kernels, so the return value alone cannot distinguish the bug. The test still exercises the kernel-buffer getsockopt path with a negative ctx->optlen, which reproduces the hardened usercopy warning on unpatched kernels. Signed-off-by: Junseo Lim <zirajs7@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/4dbdcda23b2f2be06c5659f8102cd6bd036825b3.1786448307.git.zirajs7@gmail.com
2026-08-17selftests/bpf: tc_tunnel - validate decap GSO and encapsulation stateNick Hudson
tc_tunnel only partially validated decap state and missed some tunnel cases. In particular, IPXIP decap checks were not exercised for IPIP/SIT paths, and non-GSO decap encapsulation state was not verified. Tighten the test by: - setting DECAP_IPXIP4/6 flags for IPIP/SIT/IP6 decap paths based on the outer tunnel header family; - requiring needed DECAP enum values via CO-RE enum existence checks so missing kernel support fails fast; - validating post-decap tunnel state for both GSO and non-GSO packets: expected gso_type bits must be cleared and skb->encapsulation must match remaining tunnel flags; - removing forced TSO disable in the test harness so GSO validation is exercised. This improves coverage for decap tunnel-state regressions and ensures sit_none/ipip-style paths are checked correctly. Signed-off-by: Nick Hudson <nhudson@akamai.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260812083115.73100-7-nhudson@akamai.com
2026-08-17selftests/bpf: Enable timed may_goto tests for LoongArchTiezhu Yang
Enable stream_cond_break, may_goto_interaction, and verifier_may_goto_1 tests for LoongArch, aligning with recent architectural infrastructure support (timed may_goto and arch_bpf_stack_walk JIT). With this patch, the following tests passed on LoongArch: sudo ./test_progs -a stream_success/stream_cond_break sudo ./test_progs -a verifier_bpf_fastcall/may_goto_interaction sudo ./test_progs -a verifier_may_goto_1 Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260813070906.5164-1-yangtiezhu@loongson.cn
2026-08-17selftests/bpf: Fix comment style in network_helpers.cAlexis Lothoré (eBPF Foundation)
BPF subsystem requires multi-line comments to have the opening /* start on its own line. Update multi-line comments in network_helpers.c to follow this requirement. Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260814-tc_tunnel_flaky-v5-1-5b93d030c42c@bootlin.com
2026-08-16selftests/bpf: Cover mixed arena and stack atomicsYiyang Chen
Add a verifier test with one atomic RMW instruction reached through PTR_TO_ARENA and PTR_TO_STACK paths. The verifier must reject the shared instruction with the existing incompatible-pointer diagnostic. Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn> Link: https://patch.msgid.link/20260816-bpf-next-038-mixed-atomic-v1-v2-2-4644c1886dbc@mails.tsinghua.edu.cn Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-15selftests/bpf: Add ksock test for async callback guardMahe Tardy
Because the kfuncs are going through LSM hooks, allowing their use via workqueue callbacks would expose the wrong credentials. This test ensures the kfunc are preventing any use from these contexts. Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Acked-by: Song Liu <song@kernel.org> Link: https://lore.kernel.org/bpf/20260813110540.103550-6-mahe.tardy@gmail.com
2026-08-15selftests/bpf: Test forbidden bpf_ksock_send() LSM attachMahe Tardy
The bpf_ksock_send() kfunc eventually calls security_socket_sendmsg(), thus creating a possible recursion if a program calling the kfunc is attached on that specific hook. A filter is added on the kfunc registration to prevent that at load time from the verifier. This test exercises that the verifier will reject such program on that attach point. Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Acked-by: Song Liu <song@kernel.org> Link: https://lore.kernel.org/bpf/20260813110540.103550-5-mahe.tardy@gmail.com
2026-08-15selftests/bpf: Add ksock kfunc testMahe Tardy
Add a selftest that exercises the ksock kfuncs end-to-end. One syscall BPF setup program creates a ksock context and connects the socket. Another LSM sleepable BPF program looks up the context and send test data. The userspace harness creates a network namespace and a new socket on loopback, run the setup syscall prog and send LSM BPF prog then check that the userspace socket received the data from BPF. Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://lore.kernel.org/bpf/20260813110540.103550-4-mahe.tardy@gmail.com
2026-08-15bpf: Report Call Type Safety argument errorsKumar Kartikeya Dwivedi
Augment selected helper and kfunc argument-contract failures with Call Type Safety reports. Keep the existing terse verifier messages and add reason, source context, causal register or stack-argument history, and targeted suggestions. Cover helper register-type mismatch, helper and kfunc non-NULL pointer requirements, release-helper ownership requirements, scalar and constant kfunc arguments, trusted and RCU pointer contracts, kfunc memory arguments, memory/length pairs, refcounted kptrs, constant strings, and IRQ flag stack arguments. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260815064612.378577-12-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-15bpf: Report Register Type Safety errorsKumar Kartikeya Dwivedi
Augment selected register-state verifier failures with Register Type Safety reports. The existing verbose verifier messages remain in place; the new reports add reason, source context, causal path, and suggestions. Cover invalid pointer dereferences, unreadable registers, missing outgoing stack arguments for bpf2bpf and kfunc calls, and rejected pointer arithmetic. Use scoped diagnostic history so reports start from the latest relevant value change and then show later branch outcomes. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260815064612.378577-9-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-14selftests/bpf: Check per-CPU address resolution per registerVineet Gupta
An ld_imm64 of a per-CPU map value is followed by a mov_percpu_addr that reuses the same register, so which register the address lands in decides how the JIT encodes the add. Getting the REX prefix wrong there is invisible to a functional test unless the address happens to land in an extended register, which is why this went unnoticed. Load a .percpu variable into every register in one program and match the JITed add against the register each one must resolve into. Signed-off-by: Vineet Gupta <vineet.gupta@linux.dev> Link: https://patch.msgid.link/20260814220254.3797467-3-vineet.gupta@linux.dev Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-14selftests/bpf: Fix selftest build after filter.h updateIhor Solodrai
Upstream commit 7a1f400ff5e5 ("tools: Ensure tools copy of linux/filter.h exports the UAPI") caused selftests/bpf build to fail [1] with: In file included from progs/arena_atomics.c:9: /codebuild/output/src2365462129/src/actions-runner/_work/bpf/bpf/tools/testing/selftests/bpf/../../../include/linux/filter.h:9:10: fatal error: 'uapi/linux/filter.h' file not found 9 | #include <uapi/linux/filter.h> | ^~~~~~~~~~~~~~~~~~~~~ 1 error generated. CLNG-BPF [test_progs] bind_perm.bpf.o make: *** [Makefile:888: /codebuild/output/src2365462129/src/actions-runner/_work/bpf/bpf/tools/testing/selftests/bpf/arena_atomics.bpf.o] Error 1 make: *** Waiting for unfinished jobs.... GEN-OBJ [libarena] libarena.bpf.o GEN-SKEL [libarena] libarena.skel.h make: Leaving directory '/codebuild/output/src2365462129/src/actions-runner/_work/bpf/bpf/tools/testing/selftests/bpf' Process completed with exit code 2. BPF selftest programs include the tools header directly, but BPF_CFLAGS only exposes tools/include/uapi. Compiler therefore cannot resolve the nested UAPI include. Add tools/include after tools/include/uapi in BPF_CFLAGS. This preserves the existing UAPI header precedence while allowing tools headers to include uapi headers. [1] https://github.com/kernel-patches/bpf/actions/runs/31806678733/job/94787271162 Fixes: 7a1f400ff5e5 ("tools: Ensure tools copy of linux/filter.h exports the UAPI") Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260814173522.2783625-1-ihor.solodrai@linux.dev
2026-08-14selftests/bpf: Improve readability in iter test for percpu dataLeon Hwang
The original 'offsetof()' + offset is equal to the new 'offsetof()'. Use the new 'offsetof()' instead. Rename two variables btw: * offsetof_num -> num_off * percpu_data_sum -> sum Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260814173206.93082-6-leon.hwang@linux.dev
2026-08-14selftests/bpf: Make pyperf600 a success againAndrii Nakryiko
pyperf600 has been running into 8K BPF_COMPLEXITY_LIMIT_JMP_SEQ limitations for a long while now, after some internal compiler changes. Until BPF verifier is bestowed with scalar evolution logic, make that test actually work by doing what would anyone should do in such situations: by moving repeatable per-iteration work into independently verified global functions. `void *` argument is a problem for global funcs, but a static function wrapper doing necessary casts and a bit of __arg_nonnull magic dust is all it takes. Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Yonghong Song <yonghong.song@linux.dev> Tested-by: Pu Lehui <pulehui@huawei.com> # riscv Reviewed-by: Pu Lehui <pulehui@huawei.com> Link: https://lore.kernel.org/bpf/20260813232943.581283-1-andrii@kernel.org
2026-08-14selftests/bpf: Use ping_command() for IPv6 pings in lwt_ip_encapAndrii Nakryiko
lwt_ip_encap hardcodes the ping6 binary for its IPv6 pings. iputils merged ping6 into ping long ago and distros have started dropping the compat symlink -- Arch's iputils 20250605 ships only arping, clockdiff, ping and tracepath. There, every lwt_ip_encap subtest fails: check_ping_ok:FAIL:ip netns exec ns-lwt-ip-encap-1-0101330 ping6 -c 1 \ -W1 -I veth1 fb04::1 > /dev/null unexpected error: 256 (errno 2) #217/1 lwt_ip_encap_ipv4/egress:FAIL The IPv4 subtests fail too, because check_ping_ok() pings both families. SYS() runs the command through system(), so a missing binary is indistinguishable from an unreachable peer. network_helpers.c has had ping_command() for exactly this since commit 372642ea83ff ("selftests/bpf: Move netcnt test under test_progs"): it falls back to "ping -6" when ping6 is not present. lwt_ip_encap.c is the last hardcoded ping6 user. Fix that. Fixes: f5e288943e2c ("selftests/bpf: Move test_lwt_ip_encap to test_progs") Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Song Liu <song@kernel.org> Link: https://lore.kernel.org/bpf/20260813213558.3103179-1-andrii@kernel.org
2026-08-14selftests/bpf: Test a multi-slot argument before a struct_ops arena argumentPuranjay Mohan
The trampoline reads the __arena flag from the btf_func_model per argument but stores the ctx one register slot at a time, so the two only line up if every preceding argument occupies exactly one slot. Every arena-bearing member of bpf_testmod_ops3 takes single-slot arguments, so nothing exercises the mapping and a mis-indexed arg_flags lookup would go unnoticed on any architecture. Add test_arena_multislot(), whose first argument is a 16-byte struct passed by value. It fills ctx[0] and ctx[1], putting the arena pointer at argument index one but slot two. The callback checks both halves of the struct before dereferencing ctx[2], so a JIT that walks registers instead of arguments converts the wrong slot and fails the test. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Acked-by: Xu Kuohai <xukuohai@huawei.com> Link: https://lore.kernel.org/bpf/20260813190356.335181-8-puranjay@kernel.org Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-14selftests/bpf: Enable __arena argument tests on arm64Puranjay Mohan
The arena kfunc and struct_ops argument tests were restricted to x86-64 because it was the only JIT that implemented the conversions. arm64 does now, so let them run there too: tag every program in arena_kfunc.c with __arch_arm64 in addition to __arch_x86_64, and widen the __x86_64__ guards in the struct_ops arena test. Without this the tests report SKIP on arm64 rather than exercising the newly added JIT support. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Acked-by: Xu Kuohai <xukuohai@huawei.com> Link: https://lore.kernel.org/bpf/20260813190356.335181-7-puranjay@kernel.org Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-14selftests/bpf: Add arm64 JIT-sequence tests for __arena kfunc argumentsPuranjay Mohan
Pin the arm64 counterparts of the x86-64 rebase sequences: the single extended-register add for an unconditional argument, the nullable truncate-test-and-skip variant, and all five argument registers in one call. The nullable cases use a local label so the branch is pinned to the instruction right after the add, and the label line does not spell out the call because arm64 emits either a direct bl or a materialize- and-blr pair depending on the distance to the kfunc. Note that on arm64 an unconditional argument is one instruction with nothing to anchor it against, so arena_arg_jit_rebase alone cannot tell the two forms apart; it only requires that nothing is emitted between the rebase and the call. The args5 test is what pins the distinction, since its four consecutive adds leave no room for a nullable truncate-and-branch pair between them. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Acked-by: Xu Kuohai <xukuohai@huawei.com> Link: https://lore.kernel.org/bpf/20260813190356.335181-6-puranjay@kernel.org Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-13selftests/bpf: Guarantee zero termination for veristat test buffersEduard Zingerman
In veristat tests replace direct read() calls with calls to read_output() utility function, which: - guarantees that the input buffer is zero terminated; - asserts that read operation succeeded. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260811-veristat-filter-fix-v2-3-6c234c4cd6ef@gmail.com
2026-08-13selftests/bpf: Exercise veristat filtering logic in a selftestEduard Zingerman
Test cases for veristat file/prog name filtering logic. Check various formulations for any (*foo*), file (*foo*/), prog (/bar) and file/prog (*foo*/bar) filters, alongside erroneous filters and mixed allow/deny filter expressions. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260811-veristat-filter-fix-v2-2-6c234c4cd6ef@gmail.com
2026-08-13selftests/bpf: Fix for veristat file/prog filters processingEduard Zingerman
At the moment veristat filtering behaves unexpectedly for the following filter expression: -f !file/prog The expression rejects all programs with name 'prog', and all programs in a file with name 'file'. This commit fixes the expression to exclude only a program 'prog' from a file 'file'. Additionally, the commit makes empty filters like '-f ""' or '-f "/"' and error. Here is the filtering behaviour compared old versus new: | filter | file | prog | old verdict | new verdict | |----------+------+------+-------------+-------------| | !foo | foo | bar | skipped | skipped | | !foo | bar | foo | skipped | skipped | | !foo | bar | bar | processed | processed | | !foo/bar | foo | bar | skipped | skipped | | !foo/bar | foo | buz | skipped | processed | (!) | !foo/bar | bar | bar | skipped | processed | (!) | !foo/ | foo | bar | skipped | skipped | | !foo/ | bar | bar | processed | processed | | !/bar | foo | bar | skipped | skipped | | !/bar | foo | foo | processed | processed | | !/ | foo | bar | processed | error | (!) | ! | foo | bar | processed | error | (!) |----------+------+------+-------------+-------------| | foo | foo | bar | processed | processed | | foo | bar | foo | processed | processed | | foo | bar | bar | skipped | skipped | | foo/bar | foo | bar | processed | processed | | foo/bar | foo | buz | skipped | skipped | | foo/bar | bar | bar | skipped | skipped | | foo/ | foo | bar | processed | processed | | foo/ | bar | bar | skipped | skipped | | /bar | foo | bar | processed | processed | | /bar | foo | foo | skipped | skipped | | / | foo | bar | processed | error | (!) | | foo | bar | skipped | error | (!) Fixes: 10b1b3f3e56a ("selftests/bpf: consolidate and improve file/prog filtering in veristat") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260811-veristat-filter-fix-v2-1-6c234c4cd6ef@gmail.com
2026-08-13Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc8). No conflicts. Adjacent changes: drivers/net/ethernet/wangxun/ngbe/ngbe_main.c 5f3a13e0bb5e ("net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling") d661abdc30c2 ("net: ngbe: correct misleading interrupt comment") drivers/net/ipvlan/ipvlan_main.c e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev") 00a40d809207 ("ipvlan: Support per-netns netdev unregistration.") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-13selftests/bpf: Verify bpf_iter for global percpu dataLeon Hwang
Add a test to verify that it is OK to iter the percpu_array map used for global percpu data. Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260813152324.97937-11-leon.hwang@linux.dev
2026-08-13selftests/bpf: Test verifier log for global percpu dataLeon Hwang
Add two tests to verify the verifier log "R%d points to percpu_array map which cannot be used as const string\n". Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260813152324.97937-10-leon.hwang@linux.dev
2026-08-13selftests/bpf: Test direct reading/writing read-only percpu_array mapLeon Hwang
Verify these two cases: 1. Direct reading the data of read-only percpu data's percpu_array map is allowed. 2. Direct writing the data of read-only percpu data's percpu_array map is disallowed. Assisted-by: Codex:gpt-5.5-xhigh Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260813152324.97937-9-leon.hwang@linux.dev
2026-08-13selftests/bpf: Add tests to verify global percpu dataLeon Hwang
If the arch, like s390x, does not support percpu insn, these cases won't test global percpu data by checking FEAT_PERCPU_DATA support. The following APIs have been tested for global percpu data: 1. bpf_map__set_initial_value() 2. bpf_map__initial_value() 3. bpf_map__set_value_size() 4. generated percpu struct pointer pointing to internal map's mmaped data 5. bpf_map__lookup_elem() for global percpu data map 6. bpf_map_lookup_elem_flags() for global percpu data map At the same time, the case is also tested with 'bpftool gen skeleton -L'. Assisted-by: Codex:gpt-5.5-xhigh Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260813152324.97937-8-leon.hwang@linux.dev
2026-08-13selftests/bpf: Fix chained_global_func_calls_success() for cpu v4Yonghong Song
The chained_global_func_calls_success() test hardcodes the instruction counts reported by the verifier's per-subprog stats: subprog {{[0-9]+}} (global_good) global insns_self 5 insns_total 5 stack processed 14 insns global_good() does 'return arr[0]', where arr[] is an int array and the return type is long. Without cpu v4 this is a zero-extending load followed by a <<32/s>>32 sign-extension pair. With -mcpu=v4 llvm emits a single sign-extending load instead: 18: (18) r1 = 0xffa00000008eb000 20: (81) r0 = *(s32 *)(r1 +0) 21: (95) exit so the subprog is 3 insns rather than 5, and the whole program is 12 processed insns rather than 14. test_progs-cpuv4 fails with: EXPECTED REGEX: 'subprog {{[0-9]+}} (global_good) global insns_self 5 insns_total 5 stack' #606/1 verifier_global_subprogs/chained_global_func_calls_success:FAIL Select the expected counts based on __BPF_CPU_VERSION__. Fixes: c2e6c7de8830 ("bpf: Show more useful info in stack depth stats") Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260813150641.3347662-1-yonghong.song@linux.dev
2026-08-12selftests/bpf: Test resolve_btfids arena argument suffixesKumar Kartikeya Dwivedi
Add a suffix-only kfunc declaration with arena annotations on all five arguments. Verify that resolve_btfids emits address_space(1) type tags for every position without KF_ARENA_ARG flags in the BTF ID sets. Represent expected arena arguments as a per-parameter bitmap so the test covers suffixes beyond the two positions expressible by flags. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://patch.msgid.link/20260812193842.2879226-3-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12selftests/bpf: Test subprogram instruction statisticsKumar Kartikeya Dwivedi
Add small verifier programs with deterministic instruction streams to exercise per-subprogram self and inclusive instruction accounting. Use assembly for normal call chains and straight-line callback bodies containing only moves, calls, and returns or exits, so control-flow pruning does not make the expected counts unstable. Pass callback arguments as explicit assembly operands so the compiler keeps their registers live across the asm block. Cover asynchronous callback attribution separately: main verification-root totals include all callback exploration, while static and callback totals remain local to their synchronous paths. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260812221925.3358041-7-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12selftests/bpf: Test stack depth stats without BTF subprog namesKumar Kartikeya Dwivedi
Test the per-program insns_self, insns_total, and stack depth statistics emitted when BTF function info does not provide subprogram names. Check that the subprog 0 main record and static-subprogram records use <unknown>. Make VERBOSE_ACCEPT request verifier statistics so the raw-insn test can validate the output without a test-specific log level. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260812221925.3358041-6-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12selftests/bpf: Adjust veristat stack depth parsingKumar Kartikeya Dwivedi
The verifier now reports instruction and stack depth statistics using uniform "subprog <id> (<name>) <kind>" records. Subprogram 0 is classified as main, while other records are global or static. Each record carries insns_self, insns_total, and stack depth. Teach veristat to parse the new records while retaining support for the legacy one-line stack depth format used by older kernels. Skip both instruction counts and match only through the stack value so fields can still be appended without breaking parsing. Increase the bounded backward scan so it can include all 256 per-subprogram records. Zero-initialize the legacy stack buffer because logs using the new format do not populate it before the trailing tokenizer loop. This makes the loop see an empty string instead of reading uninitialized data. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260812221925.3358041-5-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12bpf: Show more useful info in stack depth statsKumar Kartikeya Dwivedi
Stack depth statistics list captured depths in subprogram-number order, while per-verification instruction counts are reported separately. Since libbpf determines subprogram numbers, it is hard to associate either statistic with its subprogram name or see where verifier work is spent. Now that self and inclusive instruction counts are available for every subprogram, keep the combined maximum stack depth on its own line and print one uniform record for each subprogram. Represent the main program as subprog 0, then classify each record as main, global, or static before reporting insns_self, insns_total, and stack depth. The aggregate processed count is the sum of all self counts, while each total shows verifier work rooted at that subprogram. When no subprogram name is available, print <unknown>. Keep the existing aggregate "processed ... insns" record unchanged for compatibility. Suggested-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260812221925.3358041-4-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12selftests/bpf: vmtest.sh: Preserve command quoting when running in the VMVineet Gupta
vmtest.sh captures the trailing command with command="$@", which flattens the arguments into a single space-separated string, and then pastes it into the generated guest init script: cd /root/bpf echo ${command} stdbuf -oL -eL ${command} That here-doc is unquoted, so the host expands ${command} and the flattened text lands in the script verbatim. The guest bash then parses those lines as shell source, re-splitting the text on whitespace and glob-expanding it against /root/bpf. As a result any command with a glob or an argument containing spaces is corrupted before it reaches the test binary. For example: vmtest.sh -- ./test_progs -a 'verifier_*' has 'verifier_*' expanded in the guest into the matching object/skeleton files (verifier_align.bpf.o verifier_align.skel.h ...), so test_progs is handed a list of filenames instead of the intended name filter and runs no matching tests. Quote each argument with printf '%q ' so the command is reproduced verbatim inside the VM: the escaped text goes through exactly one round of quote removal when the guest parses the init script, yielding the original argv with globs and special characters intact. The common case (e.g. -t <name>) is unaffected. Only do this when there is a command to quote. printf '%q ' with no arguments still applies the format once and emits '', which the -s (debug shell) path would take for a real command and try to run. Note this makes the trailing command strictly an argv rather than a shell snippet: passing it pre-quoted as one word, e.g. vmtest.sh -- "./test_progs -t foo" no longer works, and neither does embedding guest-side shell syntax such as ';' or a redirection. 'sh -c ...' still works. The RV64 recipe in README.rst does depend on the old double parse: it wraps the denylist in \" so the literal quotes reach the guest, whose second parse of the init script removes them. Under %q those quotes now survive into argv, and parse_test_list() strtok_r()s on ',' turns them into junk filters: -d ",exceptions," -> ["] [exceptions] ["] That is harmless for DENYLIST.riscv64 only because its first line is a comment, so the leading field is empty. A denylist starting with a real entry would silently lose it - ["*arena*] never matches - so drop the backslashes and let the host consume the quotes instead. Fixes: c9709f52386d ("bpf: Helper script for running BPF presubmit tests") Signed-off-by: Vineet Gupta <vineet.gupta@linux.dev> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260807204434.1036279-5-vineet.gupta@linux.dev
2026-08-12selftests/bpf: Report failed subtest count in test_progs summaryVineet Gupta
The final summary line is asymmetric: the PASSED field reports both the number of top-level tests and the number of subtests within them, while the FAILED field reports only top-level tests: Summary: 640/5750 PASSED, 7760 SKIPPED, 100 FAILED There is no way to tell whether those 100 failing tests amount to 100 broken subtests or 1000. So count subtests with a non-zero error_cnt into a new sub_fail_cnt and print it alongside fail_cnt: Summary: 640/5750 PASSED, 7760 SKIPPED, 100/342 FAILED ^^^^^ This is correct for -j runs, as subtest_states[] is populated both in sequential and parallel modes. A test that fails without declaring any subtests contributes 0 to sub_fail_cnt. That mirrors the existing behaviour of sub_succ_cnt for tests that pass without subtests, keeping the two numerators comparable. Also emit the new count as a "failed_subtest" field in the JSON output, for parity with the existing "success_subtest". Note that this changes the trailing field of the summary line from a bare integer to "A/B", so anything scraping "N FAILED" out of it needs updating. While here, fix the fail_cnt comment in struct test_env, which claims it counts "total failed tests + sub-tests". Signed-off-by: Vineet Gupta <vineet.gupta@linux.dev> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260807204434.1036279-4-vineet.gupta@linux.dev
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-07 01:19:11 +0000