Changes in const_fold.c

f5ad4101009e7f5f5984ffea6923d4fcd470932a - Merge tag 'bpf-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

Wed, 15 Apr 2026 03:04:04 +0200

Merge tag 'bpf-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-nextPull bpf updates from Alexei Starovoitov: - Welcome new BPF maintainers: Kumar Kartikeya Dwivedi, Eduard Zingerman while Martin KaFai Lau reduced his load to Reviwer. - Lots of fixes everywhere from many first time contributors. Thank you All. - Diff stat is dominated by mechanical split of verifier.c into multiple components: - backtrack.c: backtracking logic and jump history - states.c: state equivalence - cfg.c: control flow graph, postorder, strongly connected components - liveness.c: register and stack liveness - fixups.c: post-verification passes: instruction patching, dead code removal, bpf_loop inlining, finalize fastcall 8k line were moved. verifier.c still stands at 20k lines. Further refactoring is planned for the next release. - Replace dynamic stack liveness with static stack liveness based on data flow analysis. This improved the verification time by 2x for some programs and equally reduced memory consumption. New logic is in liveness.c and supported by constant folding in const_fold.c (Eduard Zingerman, Alexei Starovoitov) - Introduce BTF layout to ease addition of new BTF kinds (Alan Maguire) - Use kmalloc_nolock() universally in BPF local storage (Amery Hung) - Fix several bugs in linked registers delta tracking (Daniel Borkmann) - Improve verifier support of arena pointers (Emil Tsalapatis) - Improve verifier tracking of register bounds in min/max and tnum domains (Harishankar Vishwanathan, Paul Chaignon, Hao Sun) - Further extend support for implicit arguments in the verifier (Ihor Solodrai) - Add support for nop,nop5 instruction combo for USDT probes in libbpf (Jiri Olsa) - Support merging multiple module BTFs (Josef Bacik) - Extend applicability of bpf_kptr_xchg (Kaitao Cheng) - Retire rcu_trace_implies_rcu_gp() (Kumar Kartikeya Dwivedi) - Support variable offset context access for 'syscall' programs (Kumar Kartikeya Dwivedi) - Migrate bpf_task_work and dynptr to kmalloc_nolock() (Mykyta Yatsenko) - Fix UAF in in open-coded task_vma iterator (Puranjay Mohan)* tag 'bpf-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (241 commits) selftests/bpf: cover short IPv4/IPv6 inputs with adjust_room bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb selftests/bpf: Use memfd_create instead of shm_open in cgroup_iter_memcg selftests/bpf: Add test for cgroup storage OOB read bpf: Fix OOB in pcpu_init_value selftests/bpf: Fix reg_bounds to match new tnum-based refinement selftests/bpf: Add tests for non-arena/arena operations bpf: Allow instructions with arena source and non-arena dest registers bpftool: add missing fsession to the usage and docs of bpftool docs/bpf: add missing fsession attach type to docs bpf: add missing fsession to the verifier log bpf: Move BTF checking logic into check_btf.c bpf: Move backtracking logic to backtrack.c bpf: Move state equivalence logic to states.c bpf: Move check_cfg() into cfg.c bpf: Move compute_insn_live_regs() into liveness.c bpf: Move fixup/post-processing logic from verifier.c into fixups.c bpf: Simplify do_check_insn() bpf: Move checks for reserved fields out of the main pass bpf: Delete unused variable ... List of files: /linux/kernel/bpf/const_fold.c

6a14beefab457f267b8cedc6ac697a9562ec1244 - Merge branch 'bpf-prep-patches-for-static-stack-liveness'

Fri, 03 Apr 2026 17:33:48 +0200

Merge branch 'bpf-prep-patches-for-static-stack-liveness'Alexei Starovoitov says:====================bpf: Prep patches for static stack liveness.v4->v5:- minor test fixupv3->v4:- fixed invalid recursion detection when calback is called multiple timesv3: https://lore.kernel.org/bpf/20260402212856.86606-1-alexei.starovoitov@gmail.com/v2->v3:- added recursive call detection- fixed ubsan warning- removed double declaration in the header- added Acksv2: https://lore.kernel.org/bpf/20260402061744.10885-1-alexei.starovoitov@gmail.com/v1->v2:. fixed bugs spotted by Eduard, Mykyta, claude and gemini. fixed selftests that were failing in unpriv. gemini(sashiko) found several precision improvements in patch 6, but they made no difference in real programs.v1: https://lore.kernel.org/bpf/20260401021635.34636-1-alexei.starovoitov@gmail.com/First 6 prep patches for static stack liveness.. do src/dst_reg validation early and remove defensive checks. sort subprog in topo order. We wanted to do this long ago to process global subprogs this way and in other cases.. Add constant folding pass that computes map_ptr, subprog_idx, loads from readonly maps, and other constants that fit into 32-bit. Use these constants to eliminate dead code. Replace predicted conditional branches with "jmp always". That reduces JIT prog size.. Add two helpers that return access size from their arguments.====================Link: https://patch.msgid.link/20260403024422.87231-1-alexei.starovoitov@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/const_fold.c

f1606dd0ac49230f5a5fa1a279210fdf0249c20f - bpf: Add bpf_compute_const_regs() and bpf_prune_dead_branches() passes

Fri, 03 Apr 2026 04:44:19 +0200

bpf: Add bpf_compute_const_regs() and bpf_prune_dead_branches() passesAdd two passes before the main verifier pass:bpf_compute_const_regs() is a forward dataflow analysis that tracksregister values in R0-R9 across the program using fixed-pointiteration in reverse postorder. Each register is tracked witha six-state lattice: UNVISITED -> CONST(val) / MAP_PTR(map_index) / MAP_VALUE(map_index, offset) / SUBPROG(num) -> UNKNOWNAt merge points, if two paths produce the same state and value fora register, it stays; otherwise it becomes UNKNOWN.The analysis handles: - MOV, ADD, SUB, AND with immediate or register operands - LD_IMM64 for plain constants, map FDs, map values, and subprogs - LDX from read-only maps: constant-folds the load by reading the map value directly via bpf_map_direct_read()Results that fit in 32 bits are stored per-instruction ininsn_aux_data and bitmasks.bpf_prune_dead_branches() uses the computed constants to evaluateconditional branches. When both operands of a conditional jump areknown constants, the branch outcome is determined statically and theinstruction is rewritten to an unconditional jump.The CFG postorder is then recomputed to reflect new control flow.This eliminates dead edges so that subsequent liveness analysisdoesn't propagate through dead code.Also add runtime sanity check to validate that precomputedconstants match the verifier's tracked state.Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260403024422.87231-5-alexei.starovoitov@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/const_fold.c