From 84540157953e8332d01dc60bb45107a18a724efd Mon Sep 17 00:00:00 2001 From: Quentin Monnet Date: Mon, 20 Jul 2026 16:16:45 +0100 Subject: [PATCH 1/7] sync: Update libbpf submodule Pull latest libbpf from mirror. Libbpf version: 1.8.0 Libbpf commit: 2bbc4834e960804351c9b6301ec28cd082484a85 Signed-off-by: Quentin Monnet --- libbpf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libbpf b/libbpf index 34e3ebf..2bbc483 160000 --- a/libbpf +++ b/libbpf @@ -1 +1 @@ -Subproject commit 34e3ebf0f062cf81882c51ac95dce720101ca5cc +Subproject commit 2bbc4834e960804351c9b6301ec28cd082484a85 From e2fa587484b02d0a5bb5f79efb5b33138edcbd81 Mon Sep 17 00:00:00 2001 From: luoliang Date: Thu, 2 Jul 2026 09:23:11 +0800 Subject: [PATCH 2/7] bpftool: Use btf_vlen()/btf_kind()/btf_kflag() helpers consistently The btf_vlen(), btf_kind() and btf_kflag() inline helpers defined in tools/lib/bpf/btf.h are thin wrappers around the BTF_INFO_VLEN(), BTF_INFO_KIND() and BTF_INFO_KFLAG() UAPI macros - each one simply returns the corresponding macro applied to t->info. bpftool already uses these helpers in most places, but 13 call sites in btf.c and btf_dumper.c still open-code the raw macros. Use the helpers consistently, matching the rest of bpftool as well as libbpf. No functional change. Signed-off-by: Liang Luo Signed-off-by: Andrii Nakryiko Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20260702012311.2265001-1-luoliang@kylinos.cn --- src/btf.c | 13 ++++++------- src/btf_dumper.c | 14 +++++++------- 2 files changed, 13 insertions(+), 14 deletions(-) diff --git a/src/btf.c b/src/btf.c index 6ef908a..c958902 100644 --- a/src/btf.c +++ b/src/btf.c @@ -179,7 +179,7 @@ static int dump_btf_type(const struct btf *btf, __u32 id, case BTF_KIND_STRUCT: case BTF_KIND_UNION: { const struct btf_member *m = (const void *)(t + 1); - __u32 i, vlen = BTF_INFO_VLEN(t->info); + __u32 i, vlen = btf_vlen(t); if (json_output) { jsonw_uint_field(w, "size", t->size); @@ -193,7 +193,7 @@ static int dump_btf_type(const struct btf *btf, __u32 id, const char *name = btf_str(btf, m->name_off); __u32 bit_off, bit_sz; - if (BTF_INFO_KFLAG(t->info)) { + if (btf_kflag(t)) { bit_off = BTF_MEMBER_BIT_OFFSET(m->offset); bit_sz = BTF_MEMBER_BITFIELD_SIZE(m->offset); } else { @@ -224,7 +224,7 @@ static int dump_btf_type(const struct btf *btf, __u32 id, } case BTF_KIND_ENUM: { const struct btf_enum *v = (const void *)(t + 1); - __u32 i, vlen = BTF_INFO_VLEN(t->info); + __u32 i, vlen = btf_vlen(t); const char *encoding; encoding = btf_kflag(t) ? "SIGNED" : "UNSIGNED"; @@ -300,8 +300,7 @@ static int dump_btf_type(const struct btf *btf, __u32 id, break; } case BTF_KIND_FWD: { - const char *fwd_kind = BTF_INFO_KFLAG(t->info) ? "union" - : "struct"; + const char *fwd_kind = btf_kflag(t) ? "union" : "struct"; if (json_output) jsonw_string_field(w, "fwd_kind", fwd_kind); @@ -322,7 +321,7 @@ static int dump_btf_type(const struct btf *btf, __u32 id, } case BTF_KIND_FUNC_PROTO: { const struct btf_param *p = (const void *)(t + 1); - __u32 i, vlen = BTF_INFO_VLEN(t->info); + __u32 i, vlen = btf_vlen(t); if (json_output) { jsonw_uint_field(w, "ret_type_id", t->type); @@ -365,7 +364,7 @@ static int dump_btf_type(const struct btf *btf, __u32 id, case BTF_KIND_DATASEC: { const struct btf_var_secinfo *v = (const void *)(t + 1); const struct btf_type *vt; - __u32 i, vlen = BTF_INFO_VLEN(t->info); + __u32 i, vlen = btf_vlen(t); if (json_output) { jsonw_uint_field(w, "size", t->size); diff --git a/src/btf_dumper.c b/src/btf_dumper.c index 9dc8425..e407582 100644 --- a/src/btf_dumper.c +++ b/src/btf_dumper.c @@ -476,8 +476,8 @@ static int btf_dumper_struct(const struct btf_dumper *d, __u32 type_id, if (!t) return -EINVAL; - kind_flag = BTF_INFO_KFLAG(t->info); - vlen = BTF_INFO_VLEN(t->info); + kind_flag = btf_kflag(t); + vlen = btf_vlen(t); jsonw_start_object(d->jw); m = (struct btf_member *)(t + 1); @@ -535,7 +535,7 @@ static int btf_dumper_datasec(const struct btf_dumper *d, __u32 type_id, if (!t) return -EINVAL; - vlen = BTF_INFO_VLEN(t->info); + vlen = btf_vlen(t); vsi = (struct btf_var_secinfo *)(t + 1); jsonw_start_object(d->jw); @@ -557,7 +557,7 @@ static int btf_dumper_do_type(const struct btf_dumper *d, __u32 type_id, { const struct btf_type *t = btf__type_by_id(d->btf, type_id); - switch (BTF_INFO_KIND(t->info)) { + switch (btf_kind(t)) { case BTF_KIND_INT: return btf_dumper_int(t, bit_offset, data, d->jw, d->is_plain_text); @@ -631,7 +631,7 @@ static int __btf_dumper_type_only(const struct btf *btf, __u32 type_id, t = btf__type_by_id(btf, type_id); - switch (BTF_INFO_KIND(t->info)) { + switch (btf_kind(t)) { case BTF_KIND_INT: case BTF_KIND_TYPEDEF: case BTF_KIND_FLOAT: @@ -661,7 +661,7 @@ static int __btf_dumper_type_only(const struct btf *btf, __u32 type_id, break; case BTF_KIND_FWD: BTF_PRINT_ARG("%s %s ", - BTF_INFO_KFLAG(t->info) ? "union" : "struct", + btf_kflag(t) ? "union" : "struct", btf__name_by_offset(btf, t->name_off)); break; case BTF_KIND_VOLATILE: @@ -718,7 +718,7 @@ static int btf_dump_func(const struct btf *btf, char *func_sig, BTF_PRINT_ARG("%s(", btf__name_by_offset(btf, func->name_off)); else BTF_PRINT_ARG("("); - vlen = BTF_INFO_VLEN(func_proto->info); + vlen = btf_vlen(func_proto); for (i = 0; i < vlen; i++) { struct btf_param *arg = &((struct btf_param *)(func_proto + 1))[i]; From 9c0e06012d6fb2ef369cae7ab52bc994f9263880 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Wed, 8 Jul 2026 09:53:39 +0200 Subject: [PATCH 3/7] bpftool: Check EVP_Digest when computing excl_prog_hash bpftool_prog_sign() ignores the return value of EVP_Digest(). If the digest computation fails (context allocation failure, or a digest fetch failure under OpenSSL), EVP_Digest() returns 0 and leaves the output buffer untouched, but the function still reports success. Fixes: 40863f4d6ef2 ("bpftool: Add support for signing BPF programs") Signed-off-by: Daniel Borkmann Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20260708075343.358712-5-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi --- src/sign.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/sign.c b/src/sign.c index f9b742f..1257dba 100644 --- a/src/sign.c +++ b/src/sign.c @@ -175,8 +175,11 @@ int bpftool_prog_sign(struct bpf_load_and_run_opts *opts) goto cleanup; } - EVP_Digest(opts->insns, opts->insns_sz, opts->excl_prog_hash, - &opts->excl_prog_hash_sz, EVP_sha256(), NULL); + if (EVP_Digest(opts->insns, opts->insns_sz, opts->excl_prog_hash, + &opts->excl_prog_hash_sz, EVP_sha256(), NULL) != 1) { + err = -EIO; + goto cleanup; + } bd_out = BIO_new(BIO_s_mem()); if (!bd_out) { From d368c762d74a73003e6338e4d8f39e47fcc87af2 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Wed, 8 Jul 2026 09:53:40 +0200 Subject: [PATCH 4/7] bpftool: Cover loader metadata with the program signature bpftool_prog_sign() signed only the loader instructions. The metadata blob the loader installs was left to an in-loader hash check, which the kernel now performs at load time over insns || metadata. Sign that same concatenation: pass the metadata blob (gen_loader_opts data) through to bpftool_prog_sign() and feed insns || metadata to CMS_final(). The excl_prog_hash stays a digest of the instructions alone; it binds the metadata map to the loader and is matched against prog->digest by the verifier, independent of what the signature covers. The signed artifact is now plain data: both bytes the signature covers are embedded verbatim in the generated skeleton, so signing and verifying an lskel is an ordinary CMS operation that a signer or auditor can perform (or reproduce) offline, without analyzing loader bytecode to establish what the signature actually attests to. Signed-off-by: Daniel Borkmann Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20260708075343.358712-6-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi --- src/gen.c | 2 ++ src/sign.c | 17 +++++++++++++++-- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/src/gen.c b/src/gen.c index 6ae7262..a01d06d 100644 --- a/src/gen.c +++ b/src/gen.c @@ -793,6 +793,8 @@ static int gen_trace(struct bpf_object *obj, const char *obj_name, const char *h if (sign_progs) { sopts.insns = opts.insns; sopts.insns_sz = opts.insns_sz; + sopts.data = opts.data; + sopts.data_sz = opts.data_sz; sopts.excl_prog_hash = prog_sha; sopts.excl_prog_hash_sz = sizeof(prog_sha); sopts.signature = sig_buf; diff --git a/src/sign.c b/src/sign.c index 1257dba..88726a6 100644 --- a/src/sign.c +++ b/src/sign.c @@ -135,9 +135,21 @@ int bpftool_prog_sign(struct bpf_load_and_run_opts *opts) CMS_ContentInfo *cms = NULL; long actual_sig_len = 0; X509 *x509 = NULL; + void *data = NULL; + size_t data_sz; int err = 0; - bd_in = BIO_new_mem_buf(opts->insns, opts->insns_sz); + data_sz = (size_t)opts->insns_sz + opts->data_sz; + data = malloc(data_sz); + if (!data) { + err = -ENOMEM; + goto cleanup; + } + memcpy(data, opts->insns, opts->insns_sz); + if (opts->data_sz) + memcpy((char *)data + opts->insns_sz, opts->data, opts->data_sz); + + bd_in = BIO_new_mem_buf(data, data_sz); if (!bd_in) { err = -ENOMEM; goto cleanup; @@ -181,7 +193,7 @@ int bpftool_prog_sign(struct bpf_load_and_run_opts *opts) goto cleanup; } - bd_out = BIO_new(BIO_s_mem()); + bd_out = BIO_new(BIO_s_mem()); if (!bd_out) { err = -ENOMEM; goto cleanup; @@ -215,6 +227,7 @@ int bpftool_prog_sign(struct bpf_load_and_run_opts *opts) X509_free(x509); EVP_PKEY_free(private_key); BIO_free(bd_in); + free(data); DISPLAY_OSSL_ERR(err < 0); return err; } From 21c5a29f21101a1cd7635211ace6a215a010ecc0 Mon Sep 17 00:00:00 2001 From: Quentin Monnet Date: Mon, 20 Jul 2026 16:17:24 +0100 Subject: [PATCH 5/7] sync: update .mailmap Update .mailmap based on bpftool's list of contributors and on the latest .mailmap version in the upstream repository. Signed-off-by: Quentin Monnet --- .mailmap | 1 + 1 file changed, 1 insertion(+) diff --git a/.mailmap b/.mailmap index d5c353c..dc872fd 100644 --- a/.mailmap +++ b/.mailmap @@ -2,6 +2,7 @@ Changbin Du Fangrui Song Geliang Tang Herbert Xu +Jason Wang Jesper Dangaard Brouer Kees Cook Maxim Mikityanskiy From 00a40bc5764870172832534bf5587259bcc66365 Mon Sep 17 00:00:00 2001 From: Quentin Monnet Date: Mon, 20 Jul 2026 16:17:24 +0100 Subject: [PATCH 6/7] sync: Pull latest bpftool changes from kernel Syncing latest bpftool commits from kernel repository. Baseline bpf-next commit: 0b58988cacfc91604c4b5be2c3295f8aac0ee3d0 Checkpoint bpf-next commit: 9a3a07d06e7d74f4aecc51396c771149336ac55d Baseline bpf commit: 9b51a6155d14389876916726430da30eabb1d4ed Checkpoint bpf commit: 7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f Daniel Borkmann (2): bpftool: Check EVP_Digest when computing excl_prog_hash bpftool: Cover loader metadata with the program signature luoliang (1): bpftool: Use btf_vlen()/btf_kind()/btf_kflag() helpers consistently src/btf.c | 13 ++++++------- src/btf_dumper.c | 14 +++++++------- src/gen.c | 2 ++ src/sign.c | 24 ++++++++++++++++++++---- 4 files changed, 35 insertions(+), 18 deletions(-) Signed-off-by: Quentin Monnet --- BPF-CHECKPOINT-COMMIT | 2 +- CHECKPOINT-COMMIT | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/BPF-CHECKPOINT-COMMIT b/BPF-CHECKPOINT-COMMIT index 7ecf7fc..ad5028e 100644 --- a/BPF-CHECKPOINT-COMMIT +++ b/BPF-CHECKPOINT-COMMIT @@ -1 +1 @@ -9b51a6155d14389876916726430da30eabb1d4ed +7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f diff --git a/CHECKPOINT-COMMIT b/CHECKPOINT-COMMIT index b45923f..2f75802 100644 --- a/CHECKPOINT-COMMIT +++ b/CHECKPOINT-COMMIT @@ -1 +1 @@ -0b58988cacfc91604c4b5be2c3295f8aac0ee3d0 +9a3a07d06e7d74f4aecc51396c771149336ac55d From 5b2736f4e547d06c9e43a0be23a1138d3daf88f0 Mon Sep 17 00:00:00 2001 From: Quentin Monnet Date: Mon, 20 Jul 2026 16:35:37 +0100 Subject: [PATCH 7/7] mirror: Update expected diff with kernel sources A recent patch has touched some portions of bpftool's Makefile that differ between kernel's and mirror's sources. Let's update the diff with the expected differences accordingly, to smoothen future sync ups. Signed-off-by: Quentin Monnet --- scripts/sync-kernel-expected-diff.patch | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/scripts/sync-kernel-expected-diff.patch b/scripts/sync-kernel-expected-diff.patch index 9633a61..c2c9569 100644 --- a/scripts/sync-kernel-expected-diff.patch +++ b/scripts/sync-kernel-expected-diff.patch @@ -55,10 +55,10 @@ - DESTDIR=$(LIBBPF_BOOTSTRAP_DESTDIR:/=) prefix= \ + $(Q)$(MAKE) -C $(BPF_DIR) OBJDIR=$(patsubst %/,%,$(LIBBPF_BOOTSTRAP_OUTPUT)) \ + DESTDIR="" PREFIX=$(LIBBPF_BOOTSTRAP_DESTDIR:/=) \ - ARCH= CROSS_COMPILE= CC="$(HOSTCC)" LD="$(HOSTLD)" AR="$(HOSTAR)" $@ install_headers + ARCH= CROSS_COMPILE= CC="$(HOSTCC)" LD="$(HOSTLD)" AR="$(HOSTAR)" \ + CFLAGS="$(LIBBPF_BOOTSTRAP_CFLAGS)" EXTRA_CFLAGS= $@ install_headers - $(LIBBPF_BOOTSTRAP_INTERNAL_HDRS): $(LIBBPF_BOOTSTRAP_HDRS_DIR)/%.h: $(BPF_DIR)/%.h | $(LIBBPF_BOOTSTRAP_HDRS_DIR) -@@ -75,9 +73,9 @@ +@@ -76,9 +74,9 @@ CFLAGS += -DPACKAGE='"bpftool"' -D__EXPORTED_HEADERS__ \ -I$(or $(OUTPUT),.) \ -I$(LIBBPF_INCLUDE) \ @@ -71,7 +71,7 @@ ifneq ($(BPFTOOL_VERSION),) CFLAGS += -DBPFTOOL_VERSION='"$(BPFTOOL_VERSION)"' endif -@@ -123,11 +121,7 @@ +@@ -146,11 +144,7 @@ endif ifeq ($(check_feat),1) @@ -83,17 +83,17 @@ +include Makefile.feature endif - LIBS = $(LIBBPF) -lelf -lz -@@ -225,7 +219,7 @@ - $(OUTPUT)%.bpf.o: skeleton/%.bpf.c $(OUTPUT)vmlinux.h $(LIBBPF_BOOTSTRAP) - $(QUIET_CLANG)$(CLANG) \ + LIBS = $(LIBBPF) -lelf $(CRYPTO_LIBS) -lz +@@ -263,7 +257,7 @@ + -Wno-microsoft-anon-tag \ + -fms-extensions \ -I$(or $(OUTPUT),.) \ - -I$(srctree)/tools/include/uapi/ \ + -I$(srctree)/include/uapi/ \ -I$(LIBBPF_BOOTSTRAP_INCLUDE) \ -g -O2 -Wall -fno-stack-protector \ --target=bpf -c $< -o $@ -@@ -243,7 +237,7 @@ +@@ -281,7 +275,7 @@ CFLAGS += $(if $(BUILD_BPF_SKELS),,-DBPFTOOL_WITHOUT_SKELETONS) @@ -102,7 +102,7 @@ $(QUIET_CC)$(CC) $(CFLAGS) -c -MMD $< -o $@ $(BPFTOOL_BOOTSTRAP): $(BOOTSTRAP_OBJS) $(LIBBPF_BOOTSTRAP) -@@ -262,7 +256,7 @@ +@@ -300,7 +294,7 @@ $(call QUIET_CLEAN, feature-detect) $(Q)$(MAKE) -C $(srctree)/tools/build/feature/ clean >/dev/null @@ -111,7 +111,7 @@ $(call QUIET_CLEAN, bpftool) $(Q)$(RM) -- $(OUTPUT)bpftool $(OUTPUT)*.o $(OUTPUT)*.d $(Q)$(RM) -- $(OUTPUT)*.skel.h $(OUTPUT)vmlinux.h -@@ -278,7 +272,7 @@ +@@ -316,7 +310,7 @@ install: install-bin $(Q)$(INSTALL) -m 0755 -d $(DESTDIR)$(bash_compdir) @@ -120,7 +120,7 @@ uninstall: $(call QUIET_UNINST, bpftool) -@@ -286,16 +280,16 @@ +@@ -324,16 +318,16 @@ $(Q)$(RM) -- $(DESTDIR)$(bash_compdir)/bpftool doc: