Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

+95 -20

MAINTAINERS

··· 3617 3617 F: Documentation/devicetree/bindings/iio/accel/bosch,bma400.yaml 3618 3618 F: drivers/iio/accel/bma400* 3619 3619 3620 - BPF (Safe dynamic programs and tools) 3620 + BPF [GENERAL] (Safe Dynamic Programs and Tools) 3621 3621 M: Alexei Starovoitov <ast@kernel.org> 3622 3622 M: Daniel Borkmann <daniel@iogearbox.net> 3623 3623 M: Andrii Nakryiko <andrii@kernel.org> 3624 - R: Martin KaFai Lau <kafai@fb.com> 3625 - R: Song Liu <songliubraving@fb.com> 3624 + R: Martin KaFai Lau <martin.lau@linux.dev> 3625 + R: Song Liu <song@kernel.org> 3626 3626 R: Yonghong Song <yhs@fb.com> 3627 3627 R: John Fastabend <john.fastabend@gmail.com> 3628 3628 R: KP Singh <kpsingh@kernel.org> 3629 - L: netdev@vger.kernel.org 3629 + R: Stanislav Fomichev <sdf@google.com> 3630 + R: Hao Luo <haoluo@google.com> 3631 + R: Jiri Olsa <jolsa@kernel.org> 3630 3632 L: bpf@vger.kernel.org 3631 3633 S: Supported 3632 3634 W: https://bpf.io/ ··· 3660 3658 F: tools/bpf/ 3661 3659 F: tools/lib/bpf/ 3662 3660 F: tools/testing/selftests/bpf/ 3663 - N: bpf 3664 - K: bpf 3665 3661 3666 3662 BPF JIT for ARM 3667 3663 M: Shubham Bansal <illusionist.neo@gmail.com> 3668 - L: netdev@vger.kernel.org 3669 3664 L: bpf@vger.kernel.org 3670 3665 S: Odd Fixes 3671 3666 F: arch/arm/net/ ··· 3671 3672 M: Daniel Borkmann <daniel@iogearbox.net> 3672 3673 M: Alexei Starovoitov <ast@kernel.org> 3673 3674 M: Zi Shen Lim <zlim.lnx@gmail.com> 3674 - L: netdev@vger.kernel.org 3675 3675 L: bpf@vger.kernel.org 3676 3676 S: Supported 3677 3677 F: arch/arm64/net/ ··· 3678 3680 BPF JIT for MIPS (32-BIT AND 64-BIT) 3679 3681 M: Johan Almbladh <johan.almbladh@anyfinetworks.com> 3680 3682 M: Paul Burton <paulburton@kernel.org> 3681 - L: netdev@vger.kernel.org 3682 3683 L: bpf@vger.kernel.org 3683 3684 S: Maintained 3684 3685 F: arch/mips/net/ 3685 3686 3686 3687 BPF JIT for NFP NICs 3687 3688 M: Jakub Kicinski <kuba@kernel.org> 3688 - L: netdev@vger.kernel.org 3689 3689 L: bpf@vger.kernel.org 3690 3690 S: Odd Fixes 3691 3691 F: drivers/net/ethernet/netronome/nfp/bpf/ ··· 3691 3695 BPF JIT for POWERPC (32-BIT AND 64-BIT) 3692 3696 M: Naveen N. Rao <naveen.n.rao@linux.ibm.com> 3693 3697 M: Michael Ellerman <mpe@ellerman.id.au> 3694 - L: netdev@vger.kernel.org 3695 3698 L: bpf@vger.kernel.org 3696 3699 S: Supported 3697 3700 F: arch/powerpc/net/ ··· 3698 3703 BPF JIT for RISC-V (32-bit) 3699 3704 M: Luke Nelson <luke.r.nels@gmail.com> 3700 3705 M: Xi Wang <xi.wang@gmail.com> 3701 - L: netdev@vger.kernel.org 3702 3706 L: bpf@vger.kernel.org 3703 3707 S: Maintained 3704 3708 F: arch/riscv/net/ ··· 3705 3711 3706 3712 BPF JIT for RISC-V (64-bit) 3707 3713 M: Björn Töpel <bjorn@kernel.org> 3708 - L: netdev@vger.kernel.org 3709 3714 L: bpf@vger.kernel.org 3710 3715 S: Maintained 3711 3716 F: arch/riscv/net/ ··· 3714 3721 M: Ilya Leoshkevich <iii@linux.ibm.com> 3715 3722 M: Heiko Carstens <hca@linux.ibm.com> 3716 3723 M: Vasily Gorbik <gor@linux.ibm.com> 3717 - L: netdev@vger.kernel.org 3718 3724 L: bpf@vger.kernel.org 3719 3725 S: Supported 3720 3726 F: arch/s390/net/ ··· 3721 3729 3722 3730 BPF JIT for SPARC (32-BIT AND 64-BIT) 3723 3731 M: David S. Miller <davem@davemloft.net> 3724 - L: netdev@vger.kernel.org 3725 3732 L: bpf@vger.kernel.org 3726 3733 S: Odd Fixes 3727 3734 F: arch/sparc/net/ 3728 3735 3729 3736 BPF JIT for X86 32-BIT 3730 3737 M: Wang YanQing <udknight@gmail.com> 3731 - L: netdev@vger.kernel.org 3732 3738 L: bpf@vger.kernel.org 3733 3739 S: Odd Fixes 3734 3740 F: arch/x86/net/bpf_jit_comp32.c ··· 3734 3744 BPF JIT for X86 64-BIT 3735 3745 M: Alexei Starovoitov <ast@kernel.org> 3736 3746 M: Daniel Borkmann <daniel@iogearbox.net> 3737 - L: netdev@vger.kernel.org 3738 3747 L: bpf@vger.kernel.org 3739 3748 S: Supported 3740 3749 F: arch/x86/net/ 3741 3750 X: arch/x86/net/bpf_jit_comp32.c 3742 3751 3743 - BPF LSM (Security Audit and Enforcement using BPF) 3752 + BPF [CORE] 3753 + M: Alexei Starovoitov <ast@kernel.org> 3754 + M: Daniel Borkmann <daniel@iogearbox.net> 3755 + R: John Fastabend <john.fastabend@gmail.com> 3756 + L: bpf@vger.kernel.org 3757 + S: Maintained 3758 + F: kernel/bpf/verifier.c 3759 + F: kernel/bpf/tnum.c 3760 + F: kernel/bpf/core.c 3761 + F: kernel/bpf/syscall.c 3762 + F: kernel/bpf/dispatcher.c 3763 + F: kernel/bpf/trampoline.c 3764 + F: include/linux/bpf* 3765 + F: include/linux/filter.h 3766 + 3767 + BPF [BTF] 3768 + M: Martin KaFai Lau <martin.lau@linux.dev> 3769 + L: bpf@vger.kernel.org 3770 + S: Maintained 3771 + F: kernel/bpf/btf.c 3772 + F: include/linux/btf* 3773 + 3774 + BPF [TRACING] 3775 + M: Song Liu <song@kernel.org> 3776 + R: Jiri Olsa <jolsa@kernel.org> 3777 + L: bpf@vger.kernel.org 3778 + S: Maintained 3779 + F: kernel/trace/bpf_trace.c 3780 + F: kernel/bpf/stackmap.c 3781 + 3782 + BPF [NETWORKING] (tc BPF, sock_addr) 3783 + M: Martin KaFai Lau <martin.lau@linux.dev> 3784 + M: Daniel Borkmann <daniel@iogearbox.net> 3785 + R: John Fastabend <john.fastabend@gmail.com> 3786 + L: bpf@vger.kernel.org 3787 + L: netdev@vger.kernel.org 3788 + S: Maintained 3789 + F: net/core/filter.c 3790 + F: net/sched/act_bpf.c 3791 + F: net/sched/cls_bpf.c 3792 + 3793 + BPF [NETWORKING] (struct_ops, reuseport) 3794 + M: Martin KaFai Lau <martin.lau@linux.dev> 3795 + L: bpf@vger.kernel.org 3796 + L: netdev@vger.kernel.org 3797 + S: Maintained 3798 + F: kernel/bpf/bpf_struct* 3799 + 3800 + BPF [SECURITY & LSM] (Security Audit and Enforcement using BPF) 3744 3801 M: KP Singh <kpsingh@kernel.org> 3745 3802 R: Florent Revest <revest@chromium.org> 3746 3803 R: Brendan Jackman <jackmanb@chromium.org> ··· 3798 3761 F: kernel/bpf/bpf_lsm.c 3799 3762 F: security/bpf/ 3800 3763 3801 - BPF L7 FRAMEWORK 3764 + BPF [STORAGE & CGROUPS] 3765 + M: Martin KaFai Lau <martin.lau@linux.dev> 3766 + L: bpf@vger.kernel.org 3767 + S: Maintained 3768 + F: kernel/bpf/cgroup.c 3769 + F: kernel/bpf/*storage.c 3770 + F: kernel/bpf/bpf_lru* 3771 + 3772 + BPF [RINGBUF] 3773 + M: Andrii Nakryiko <andrii@kernel.org> 3774 + L: bpf@vger.kernel.org 3775 + S: Maintained 3776 + F: kernel/bpf/ringbuf.c 3777 + 3778 + BPF [ITERATOR] 3779 + M: Yonghong Song <yhs@fb.com> 3780 + L: bpf@vger.kernel.org 3781 + S: Maintained 3782 + F: kernel/bpf/*iter.c 3783 + 3784 + BPF [L7 FRAMEWORK] (sockmap) 3802 3785 M: John Fastabend <john.fastabend@gmail.com> 3803 3786 M: Jakub Sitnicki <jakub@cloudflare.com> 3804 3787 L: netdev@vger.kernel.org ··· 3831 3774 F: net/ipv4/udp_bpf.c 3832 3775 F: net/unix/unix_bpf.c 3833 3776 3834 - BPFTOOL 3777 + BPF [LIBRARY] (libbpf) 3778 + M: Andrii Nakryiko <andrii@kernel.org> 3779 + L: bpf@vger.kernel.org 3780 + S: Maintained 3781 + F: tools/lib/bpf/ 3782 + 3783 + BPF [TOOLING] (bpftool) 3835 3784 M: Quentin Monnet <quentin@isovalent.com> 3836 3785 L: bpf@vger.kernel.org 3837 3786 S: Maintained 3838 3787 F: kernel/bpf/disasm.* 3839 3788 F: tools/bpf/bpftool/ 3789 + 3790 + BPF [SELFTESTS] (Test Runners & Infrastructure) 3791 + M: Andrii Nakryiko <andrii@kernel.org> 3792 + R: Mykola Lysenko <mykolal@fb.com> 3793 + L: bpf@vger.kernel.org 3794 + S: Maintained 3795 + F: tools/testing/selftests/bpf/ 3796 + 3797 + BPF [MISC] 3798 + L: bpf@vger.kernel.org 3799 + S: Odd Fixes 3800 + K: (?:\b|_)bpf(?:\b|_) 3840 3801 3841 3802 BROADCOM B44 10/100 ETHERNET DRIVER 3842 3803 M: Michael Chan <michael.chan@broadcom.com>

+48 -67

kernel/bpf/verifier.c

··· 1562 1562 reg->var_off = tnum_or(tnum_clear_subreg(var64_off), var32_off); 1563 1563 } 1564 1564 1565 + static void reg_bounds_sync(struct bpf_reg_state *reg) 1566 + { 1567 + /* We might have learned new bounds from the var_off. */ 1568 + __update_reg_bounds(reg); 1569 + /* We might have learned something about the sign bit. */ 1570 + __reg_deduce_bounds(reg); 1571 + /* We might have learned some bits from the bounds. */ 1572 + __reg_bound_offset(reg); 1573 + /* Intersecting with the old var_off might have improved our bounds 1574 + * slightly, e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), 1575 + * then new var_off is (0; 0x7f...fc) which improves our umax. 1576 + */ 1577 + __update_reg_bounds(reg); 1578 + } 1579 + 1565 1580 static bool __reg32_bound_s64(s32 a) 1566 1581 { 1567 1582 return a >= 0 && a <= S32_MAX; ··· 1618 1603 * so they do not impact tnum bounds calculation. 1619 1604 */ 1620 1605 __mark_reg64_unbounded(reg); 1621 - __update_reg_bounds(reg); 1622 1606 } 1623 - 1624 - /* Intersecting with the old var_off might have improved our bounds 1625 - * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), 1626 - * then new var_off is (0; 0x7f...fc) which improves our umax. 1627 - */ 1628 - __reg_deduce_bounds(reg); 1629 - __reg_bound_offset(reg); 1630 - __update_reg_bounds(reg); 1607 + reg_bounds_sync(reg); 1631 1608 } 1632 1609 1633 1610 static bool __reg64_bound_s32(s64 a) ··· 1635 1628 static void __reg_combine_64_into_32(struct bpf_reg_state *reg) 1636 1629 { 1637 1630 __mark_reg32_unbounded(reg); 1638 - 1639 1631 if (__reg64_bound_s32(reg->smin_value) && __reg64_bound_s32(reg->smax_value)) { 1640 1632 reg->s32_min_value = (s32)reg->smin_value; 1641 1633 reg->s32_max_value = (s32)reg->smax_value; ··· 1643 1637 reg->u32_min_value = (u32)reg->umin_value; 1644 1638 reg->u32_max_value = (u32)reg->umax_value; 1645 1639 } 1646 - 1647 - /* Intersecting with the old var_off might have improved our bounds 1648 - * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), 1649 - * then new var_off is (0; 0x7f...fc) which improves our umax. 1650 - */ 1651 - __reg_deduce_bounds(reg); 1652 - __reg_bound_offset(reg); 1653 - __update_reg_bounds(reg); 1640 + reg_bounds_sync(reg); 1654 1641 } 1655 1642 1656 1643 /* Mark a register as having a completely unknown (scalar) value. */ ··· 6942 6943 ret_reg->s32_max_value = meta->msize_max_value; 6943 6944 ret_reg->smin_value = -MAX_ERRNO; 6944 6945 ret_reg->s32_min_value = -MAX_ERRNO; 6945 - __reg_deduce_bounds(ret_reg); 6946 - __reg_bound_offset(ret_reg); 6947 - __update_reg_bounds(ret_reg); 6946 + reg_bounds_sync(ret_reg); 6948 6947 } 6949 6948 6950 6949 static int ··· 8199 8202 8200 8203 if (!check_reg_sane_offset(env, dst_reg, ptr_reg->type)) 8201 8204 return -EINVAL; 8202 - 8203 - __update_reg_bounds(dst_reg); 8204 - __reg_deduce_bounds(dst_reg); 8205 - __reg_bound_offset(dst_reg); 8206 - 8205 + reg_bounds_sync(dst_reg); 8207 8206 if (sanitize_check_bounds(env, insn, dst_reg) < 0) 8208 8207 return -EACCES; 8209 8208 if (sanitize_needed(opcode)) { ··· 8937 8944 /* ALU32 ops are zero extended into 64bit register */ 8938 8945 if (alu32) 8939 8946 zext_32_to_64(dst_reg); 8940 - 8941 - __update_reg_bounds(dst_reg); 8942 - __reg_deduce_bounds(dst_reg); 8943 - __reg_bound_offset(dst_reg); 8947 + reg_bounds_sync(dst_reg); 8944 8948 return 0; 8945 8949 } 8946 8950 ··· 9126 9136 insn->dst_reg); 9127 9137 } 9128 9138 zext_32_to_64(dst_reg); 9129 - 9130 - __update_reg_bounds(dst_reg); 9131 - __reg_deduce_bounds(dst_reg); 9132 - __reg_bound_offset(dst_reg); 9139 + reg_bounds_sync(dst_reg); 9133 9140 } 9134 9141 } else { 9135 9142 /* case: R = imm ··· 9564 9577 return; 9565 9578 9566 9579 switch (opcode) { 9580 + /* JEQ/JNE comparison doesn't change the register equivalence. 9581 + * 9582 + * r1 = r2; 9583 + * if (r1 == 42) goto label; 9584 + * ... 9585 + * label: // here both r1 and r2 are known to be 42. 9586 + * 9587 + * Hence when marking register as known preserve it's ID. 9588 + */ 9567 9589 case BPF_JEQ: 9568 - case BPF_JNE: 9569 - { 9570 - struct bpf_reg_state *reg = 9571 - opcode == BPF_JEQ ? true_reg : false_reg; 9572 - 9573 - /* JEQ/JNE comparison doesn't change the register equivalence. 9574 - * r1 = r2; 9575 - * if (r1 == 42) goto label; 9576 - * ... 9577 - * label: // here both r1 and r2 are known to be 42. 9578 - * 9579 - * Hence when marking register as known preserve it's ID. 9580 - */ 9581 - if (is_jmp32) 9582 - __mark_reg32_known(reg, val32); 9583 - else 9584 - ___mark_reg_known(reg, val); 9590 + if (is_jmp32) { 9591 + __mark_reg32_known(true_reg, val32); 9592 + true_32off = tnum_subreg(true_reg->var_off); 9593 + } else { 9594 + ___mark_reg_known(true_reg, val); 9595 + true_64off = true_reg->var_off; 9596 + } 9585 9597 break; 9586 - } 9598 + case BPF_JNE: 9599 + if (is_jmp32) { 9600 + __mark_reg32_known(false_reg, val32); 9601 + false_32off = tnum_subreg(false_reg->var_off); 9602 + } else { 9603 + ___mark_reg_known(false_reg, val); 9604 + false_64off = false_reg->var_off; 9605 + } 9606 + break; 9587 9607 case BPF_JSET: 9588 9608 if (is_jmp32) { 9589 9609 false_32off = tnum_and(false_32off, tnum_const(~val32)); ··· 9729 9735 dst_reg->smax_value); 9730 9736 src_reg->var_off = dst_reg->var_off = tnum_intersect(src_reg->var_off, 9731 9737 dst_reg->var_off); 9732 - /* We might have learned new bounds from the var_off. */ 9733 - __update_reg_bounds(src_reg); 9734 - __update_reg_bounds(dst_reg); 9735 - /* We might have learned something about the sign bit. */ 9736 - __reg_deduce_bounds(src_reg); 9737 - __reg_deduce_bounds(dst_reg); 9738 - /* We might have learned some bits from the bounds. */ 9739 - __reg_bound_offset(src_reg); 9740 - __reg_bound_offset(dst_reg); 9741 - /* Intersecting with the old var_off might have improved our bounds 9742 - * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), 9743 - * then new var_off is (0; 0x7f...fc) which improves our umax. 9744 - */ 9745 - __update_reg_bounds(src_reg); 9746 - __update_reg_bounds(dst_reg); 9738 + reg_bounds_sync(src_reg); 9739 + reg_bounds_sync(dst_reg); 9747 9740 } 9748 9741 9749 9742 static void reg_combine_min_max(struct bpf_reg_state *true_src,

+1

net/xdp/xsk_buff_pool.c

··· 332 332 for (i = 0; i < dma_map->dma_pages_cnt; i++) { 333 333 dma = &dma_map->dma_pages[i]; 334 334 if (*dma) { 335 + *dma &= ~XSK_NEXT_PG_CONTIG_MASK; 335 336 dma_unmap_page_attrs(dma_map->dev, *dma, PAGE_SIZE, 336 337 DMA_BIDIRECTIONAL, attrs); 337 338 *dma = 0;

+7

samples/fprobe/fprobe_example.c

··· 25 25 26 26 static char symbol[MAX_SYMBOL_LEN] = "kernel_clone"; 27 27 module_param_string(symbol, symbol, sizeof(symbol), 0644); 28 + MODULE_PARM_DESC(symbol, "Probed symbol(s), given by comma separated symbols or a wildcard pattern."); 29 + 28 30 static char nosymbol[MAX_SYMBOL_LEN] = ""; 29 31 module_param_string(nosymbol, nosymbol, sizeof(nosymbol), 0644); 32 + MODULE_PARM_DESC(nosymbol, "Not-probed symbols, given by a wildcard pattern."); 33 + 30 34 static bool stackdump = true; 31 35 module_param(stackdump, bool, 0644); 36 + MODULE_PARM_DESC(stackdump, "Enable stackdump."); 37 + 32 38 static bool use_trace = false; 33 39 module_param(use_trace, bool, 0644); 40 + MODULE_PARM_DESC(use_trace, "Use trace_printk instead of printk. This is only for debugging."); 34 41 35 42 static void show_backtrace(void) 36 43 {

+21

tools/testing/selftests/bpf/verifier/jmp32.c

··· 864 864 .result = ACCEPT, 865 865 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 866 866 }, 867 + { 868 + "jeq32/jne32: bounds checking", 869 + .insns = { 870 + BPF_MOV64_IMM(BPF_REG_6, 563), 871 + BPF_MOV64_IMM(BPF_REG_2, 0), 872 + BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0), 873 + BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0), 874 + BPF_ALU32_REG(BPF_OR, BPF_REG_2, BPF_REG_6), 875 + BPF_JMP32_IMM(BPF_JNE, BPF_REG_2, 8, 5), 876 + BPF_JMP_IMM(BPF_JSGE, BPF_REG_2, 500, 2), 877 + BPF_MOV64_IMM(BPF_REG_0, 2), 878 + BPF_EXIT_INSN(), 879 + BPF_MOV64_REG(BPF_REG_0, BPF_REG_4), 880 + BPF_EXIT_INSN(), 881 + BPF_MOV64_IMM(BPF_REG_0, 1), 882 + BPF_EXIT_INSN(), 883 + }, 884 + .prog_type = BPF_PROG_TYPE_SCHED_CLS, 885 + .result = ACCEPT, 886 + .retval = 1, 887 + },

+22

tools/testing/selftests/bpf/verifier/jump.c

··· 373 373 .result = ACCEPT, 374 374 .retval = 3, 375 375 }, 376 + { 377 + "jump & dead code elimination", 378 + .insns = { 379 + BPF_MOV64_IMM(BPF_REG_0, 1), 380 + BPF_MOV64_IMM(BPF_REG_3, 0), 381 + BPF_ALU64_IMM(BPF_NEG, BPF_REG_3, 0), 382 + BPF_ALU64_IMM(BPF_NEG, BPF_REG_3, 0), 383 + BPF_ALU64_IMM(BPF_OR, BPF_REG_3, 32767), 384 + BPF_JMP_IMM(BPF_JSGE, BPF_REG_3, 0, 1), 385 + BPF_EXIT_INSN(), 386 + BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 0x8000, 1), 387 + BPF_EXIT_INSN(), 388 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -32767), 389 + BPF_MOV64_IMM(BPF_REG_0, 2), 390 + BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 0, 1), 391 + BPF_MOV64_REG(BPF_REG_0, BPF_REG_4), 392 + BPF_EXIT_INSN(), 393 + }, 394 + .prog_type = BPF_PROG_TYPE_SCHED_CLS, 395 + .result = ACCEPT, 396 + .retval = 2, 397 + },

Configure Feed

Configure Feed