en Copyright 2015 Java http://kernelsources.org:8080/source/history/linux/kernel/bpf/cnum_defs.h#79b8ebcbe483fee401e1b91dd32470348d9aa5b8 bpf: Export cnum_umin/umax() helpers for netronome driverERROR: modpost: "cnum64_umin" [drivers/net/ethernet/netronome/nfp/nfp.ko] undefined!ERROR: modpost: "cnum64_umax" [drivers/net/ethernet/netronome/nfp/nfp.ko] undefined!Export symbols for these references.Reported-by: Kaitao Cheng <pilgrimtao@gmail.com>Fixes: bbc631085503 ("bpf: replace min/max fields with struct cnum{32,64}")Signed-off-by: Alan Maguire <alan.maguire@oracle.com>Acked-by: Eduard Zingerman <eddyz87@gmail.com>Link: https://lore.kernel.org/r/20260427112205.1346733-1-alan.maguire@oracle.comSigned-off-by: Alexei Starovoitov <ast@kernel.org> List of files: /linux/kernel/bpf/cnum_defs.h Mon, 27 Apr 2026 13:22:05 +0200 Alan Maguire <alan.maguire@oracle.com> http://kernelsources.org:8080/source/history/linux/kernel/bpf/cnum_defs.h#cd5b460ed1eca9e48f3eb07db1ee0a522c0eaa23 bpf: range_within() must check cnum ranges instead of min/max pairsstates.c:range_within() must be updated to properly check ifcnum-based range in an old state is a superset of a range in the curstate. Currently it makes the decision using min/max accessors: reg_umin(old) <= reg_umin(cur) <= reg_umax(old)This is wrong for cnums that cross both UT_MAX/0 and ST_MAX/ST_MINboundaries. Consider cnum32{base=0x7FFFFFF0, size=0x80000020},which represents values [0x7FFFFFF0, ..., U32_MAX, 0, ..., 0x10].Its projections are u32_min/max=0/U32_MAX, s32_min/max=S32_MIN/MAX.A register with range [0x100, 0x200] (which lies entirely in the gapof the wrapping range) would pass the min/max check despite having nooverlap with the actual cnum arc.This commit replaces min/max comparison with cnum{32,64}_is_subset()operation. The operation implementation is verified using cbmc modelchecker in [1].[1] https://github.com/eddyz87/cnum-verif/Fixes: bbc631085503 ("bpf: replace min/max fields with struct cnum{32,64}")Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>Link: https://lore.kernel.org/r/20260425-cnum-range-within-v1-1-2fdca70cb09d@gmail.comSigned-off-by: Alexei Starovoitov <ast@kernel.org> List of files: /linux/kernel/bpf/cnum_defs.h Sun, 26 Apr 2026 00:48:23 +0200 Eduard Zingerman <eddyz87@gmail.com> http://kernelsources.org:8080/source/history/linux/kernel/bpf/cnum_defs.h#256f0071f9b61ae5028f749449fd3fdad015889d bpf: representation and basic operations on circular numbersThis commit adds basic definitions for cnum32/cnum64.This is a unified numeric range representation for signed and unsigneddomains. Inspired by an old post from Shung-Hsi Yu [1] and paper [2].Operations correctness is verified using cbmc model checker,tests source code can be found in a separate repo [3].The cnum64_cnum32_intersect() function is notable, because it handledseveral cases verifier.c:deduce_bounds_64_from_32() does not.Given:- a is a 64-bit range- b is a 32-bit range- t is a refined 64-bit range, such that ∀ v ∈ a, (u32)v ∈ b: v ∈ t.cnum64_cnum32_intersect() makes the following deductions:(A): 'b' is a sub-range of the first or the last 32-bit sub-range of 'a': 64-bit number axis ---> N*2^32 (N+1)*2^32 (N+2)*2^32 (N+3)*2^32 ||------|---|=====|-------||----------|=====|-------||----------|=====|----|--|| | |< b >| |< b >| |< b >| | | | | | |<--+--------------------------- a ---------------------------+--->| | | |<-------------------------- t -------------------------->|(B) 'b' does not intersect with the first of the last 32-bit sub-range of 'a':N*2^32 (N+1)*2^32 (N+2)*2^32 (N+3)*2^32||--|=====|----|----------||--|=====|---------------||--|=====|------------|--|| |< b >| | |< b >| |< b >| | | | | | |<-------------+--------- a -------------------|----------->| | | |<-------- t ------------------>|(C) 'b' crosses 0/U32_MAX boundary:N*2^32 (N+1)*2^32 (N+2)*2^32 (N+3)*2^32||===|---------|------|===||===|----------------|===||===|---------|------|===|| |b >| | |< b||b >| |< b||b >| | |< b| | | | | |<-----+----------------- a --------------+-------->| | | |<---------------- t ------------->|Current implementation of deduce_bounds_64_from_32() only handlescase (A).[1] https://lore.kernel.org/all/ZTZxoDJJbX9mrQ9w@u94a/[2] https://jorgenavas.github.io/papers/ACM-TOPLAS-wrapped.pdf[3] https://github.com/eddyz87/cnum-verif/tree/masterSigned-off-by: Eduard Zingerman <eddyz87@gmail.com>Link: https://lore.kernel.org/r/20260424-cnums-everywhere-rfc-v1-v3-1-ca434b39a486@gmail.comSigned-off-by: Alexei Starovoitov <ast@kernel.org> List of files: /linux/kernel/bpf/cnum_defs.h Sat, 25 Apr 2026 00:52:42 +0200 Eduard Zingerman <eddyz87@gmail.com>