Merge tag 'bpf-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf...

Pull bpf updates from Alexei Starovoitov:

 - Support pulling non-linear xdp data with bpf_xdp_pull_data() kfunc
   (Amery Hung)

   Applied as a stable branch in bpf-next and net-next trees.

 - Support reading skb metadata via bpf_dynptr (Jakub Sitnicki)

   Also a stable branch in bpf-next and net-next trees.

 - Enforce expected_attach_type for tailcall compatibility (Daniel
   Borkmann)

 - Replace path-sensitive with path-insensitive live stack analysis in
   the verifier (Eduard Zingerman)

   This is a significant change in the verification logic. More details,
   motivation, long term plans are in the cover letter/merge commit.

 - Support signed BPF programs (KP Singh)

   This is another major feature that took years to materialize.

   Algorithm details are in the cover letter/marge commit

 - Add support for may_goto instruction to s390 JIT (Ilya Leoshkevich)

 - Add support for may_goto instruction to arm64 JIT (Puranjay Mohan)

 - Fix USDT SIB argument handling in libbpf (Jiawei Zhao)

 - Allow uprobe-bpf program to change context registers (Jiri Olsa)

 - Support signed loads from BPF arena (Kumar Kartikeya Dwivedi and
   Puranjay Mohan)

 - Allow access to union arguments in tracing programs (Leon Hwang)

 - Optimize rcu_read_lock() + migrate_disable() combination where it's
   used in BPF subsystem (Menglong Dong)

 - Introduce bpf_task_work_schedule*() kfuncs to schedule deferred
   execution of BPF callback in the context of a specific task using the
   kernel’s task_work infrastructure (Mykyta Yatsenko)

 - Enforce RCU protection for KF_RCU_PROTECTED kfuncs (Kumar Kartikeya
   Dwivedi)

 - Add stress test for rqspinlock in NMI (Kumar Kartikeya Dwivedi)

 - Improve the precision of tnum multiplier verifier operation
   (Nandakumar Edamana)

 - Use tnums to improve is_branch_taken() logic (Paul Chaignon)

 - Add support for atomic operations in arena in riscv JIT (Pu Lehui)

 - Report arena faults to BPF error stream (Puranjay Mohan)

 - Search for tracefs at /sys/kernel/tracing first in bpftool (Quentin
   Monnet)

 - Add bpf_strcasecmp() kfunc (Rong Tao)

 - Support lookup_and_delete_elem command in BPF_MAP_STACK_TRACE (Tao
   Chen)

* tag 'bpf-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (197 commits)
  libbpf: Replace AF_ALG with open coded SHA-256
  selftests/bpf: Add stress test for rqspinlock in NMI
  selftests/bpf: Add test case for different expected_attach_type
  bpf: Enforce expected_attach_type for tailcall compatibility
  bpftool: Remove duplicate string.h header
  bpf: Remove duplicate crypto/sha2.h header
  libbpf: Fix error when st-prefix_ops and ops from differ btf
  selftests/bpf: Test changing packet data from kfunc
  selftests/bpf: Add stacktrace map lookup_and_delete_elem test case
  selftests/bpf: Refactor stacktrace_map case with skeleton
  bpf: Add lookup_and_delete_elem for BPF_MAP_STACK_TRACE
  selftests/bpf: Fix flaky bpf_cookie selftest
  selftests/bpf: Test changing packet data from global functions with a kfunc
  bpf: Emit struct bpf_xdp_sock type in vmlinux BTF
  selftests/bpf: Task_work selftest cleanup fixes
  MAINTAINERS: Delete inactive maintainers from AF_XDP
  bpf: Mark kfuncs as __noclone
  selftests/bpf: Add kprobe multi write ctx attach test
  selftests/bpf: Add kprobe write ctx attach test
  selftests/bpf: Add uprobe context ip register change test
  ...

diff --cc MAINTAINERS
Simple merge

diff --cc arch/arm64/net/bpf_jit_comp.c
Simple merge

diff --cc arch/riscv/Kconfig
Simple merge

diff --cc arch/riscv/include/asm/cmpxchg.h
Simple merge

diff --cc arch/riscv/net/bpf_jit_comp64.c
Simple merge

diff --cc include/linux/cgroup.h
Simple merge

diff --cc include/linux/rcupdate.h
Simple merge

diff --cc kernel/bpf/stackmap.c
Simple merge

diff --cc kernel/bpf/verifier.c
Simple merge

diff --cc kernel/cgroup/cgroup.c
Simple merge

diff --cc kernel/events/core.c
Simple merge

diff --cc kernel/events/uprobes.c
index c8bfff023c6e885376d9b65df5677c1254342c68,2b32c32bcb776fb4c7241f6fdde7b2d09898d232..5dcf927310fd532cd1e4808fab8c461a9523bf1d
--- 1/kernel/events/uprobes.c
--- 2/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@@ -2765,9 -2741,13 +2765,16 @@@ static void handle_swbp(struct pt_regs 
  
        handler_chain(uprobe, regs);
  
+       /*
+        * If user decided to take execution elsewhere, it makes little sense
+        * to execute the original instruction, so let's skip it.
+        */
+       if (instruction_pointer(regs) != bp_vaddr)
+               goto out;
+ 
 +      /* Try to optimize after first hit. */
 +      arch_uprobe_optimize(&uprobe->arch, bp_vaddr);
 +
        if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
                goto out;
  

diff --cc tools/testing/selftests/bpf/prog_tests/usdt.c
index 833eb87483a1cdb39cd4978810dbdee1e822cd28,615e9c3e93bf0a27ffd516046def5c96e061d767..4f7f45e693153da8dda9bca688e3adbf00c9809b
--- 1/tools/testing/selftests/bpf/prog_tests/usdt.c
--- 2/tools/testing/selftests/bpf/prog_tests/usdt.c
+++ b/tools/testing/selftests/bpf/prog_tests/usdt.c
@@@ -40,20 -40,73 +40,80 @@@ static void __always_inline trigger_fun
        }
  }
  
 -static void subtest_basic_usdt(void)
+ #if defined(__x86_64__) || defined(__i386__)
+ /*
+  * SIB (Scale-Index-Base) addressing format: "size@(base_reg, index_reg, scale)"
+  * - 'size' is the size in bytes of the array element, and its sign indicates
+  *   whether the type is signed (negative) or unsigned (positive).
+  * - 'base_reg' is the register holding the base address, normally rdx or edx
+  * - 'index_reg' is the register holding the index, normally rax or eax
+  * - 'scale' is the scaling factor (typically 1, 2, 4, or 8), which matches the
+  *    size of the element type.
+  *
+  * For example, for an array of 'short' (signed 2-byte elements), the SIB spec would be:
+  * - size: -2 (negative because 'short' is signed)
+  * - scale: 2 (since sizeof(short) == 2)
+  *
+  * The resulting SIB format: "-2@(%%rdx,%%rax,2)" for x86_64, "-2@(%%edx,%%eax,2)" for i386
+  */
+ static volatile short array[] = {-1, -2, -3, -4};
+ 
+ #if defined(__x86_64__)
+ #define USDT_SIB_ARG_SPEC -2@(%%rdx,%%rax,2)
+ #else
+ #define USDT_SIB_ARG_SPEC -2@(%%edx,%%eax,2)
+ #endif
+ 
+ unsigned short test_usdt_sib_semaphore SEC(".probes");
+ 
+ static void trigger_sib_spec(void)
+ {
+       /*
+        * Force SIB addressing with inline assembly.
+        *
+        * You must compile with -std=gnu99 or -std=c99 to use the
+        * STAP_PROBE_ASM macro.
+        *
+        * The STAP_PROBE_ASM macro generates a quoted string that gets
+        * inserted between the surrounding assembly instructions. In this
+        * case, USDT_SIB_ARG_SPEC is embedded directly into the instruction
+        * stream, creating a probe point between the asm statement boundaries.
+        * It works fine with gcc/clang.
+        *
+        * Register constraints:
+        * - "d"(array): Binds the 'array' variable to %rdx or %edx register
+        * - "a"(0): Binds the constant 0 to %rax or %eax register
+        * These ensure that when USDT_SIB_ARG_SPEC references %%rdx(%edx) and
+        * %%rax(%eax), they contain the expected values for SIB addressing.
+        *
+        * The "memory" clobber prevents the compiler from reordering memory
+        * accesses around the probe point, ensuring that the probe behavior
+        * is predictable and consistent.
+        */
+       asm volatile(
+               STAP_PROBE_ASM(test, usdt_sib, USDT_SIB_ARG_SPEC)
+               :
+               : "d"(array), "a"(0)
+               : "memory"
+       );
+ }
+ #endif
+ 
 +static void subtest_basic_usdt(bool optimized)
  {
        LIBBPF_OPTS(bpf_usdt_opts, opts);
        struct test_usdt *skel;
        struct test_usdt__bss *bss;
 -      int err, i;
 +      int err, i, called;
+       const __u64 expected_cookie = 0xcafedeadbeeffeed;
  
 +#define TRIGGER(x) ({                 \
 +      trigger_func(x);                \
 +      if (optimized)                  \
 +              trigger_func(x);        \
 +      optimized ? 2 : 1;              \
 +      })
 +
        skel = test_usdt__open_and_load();
        if (!ASSERT_OK_PTR(skel, "skel_open"))
                return;
@@@ -73,13 -126,22 +133,22 @@@
        if (!ASSERT_OK_PTR(skel->links.usdt0, "usdt0_link"))
                goto cleanup;
  
-       called = TRIGGER(1);
+ #if defined(__x86_64__) || defined(__i386__)
+       opts.usdt_cookie = expected_cookie;
+       skel->links.usdt_sib = bpf_program__attach_usdt(skel->progs.usdt_sib,
+                                                        0 /*self*/, "/proc/self/exe",
+                                                        "test", "usdt_sib", &opts);
+       if (!ASSERT_OK_PTR(skel->links.usdt_sib, "usdt_sib_link"))
+               goto cleanup;
+ #endif
+ 
 -      trigger_func(1);
++      alled = TRIGGER(1);
  
 -      ASSERT_EQ(bss->usdt0_called, 1, "usdt0_called");
 -      ASSERT_EQ(bss->usdt3_called, 1, "usdt3_called");
 -      ASSERT_EQ(bss->usdt12_called, 1, "usdt12_called");
 +      ASSERT_EQ(bss->usdt0_called, called, "usdt0_called");
 +      ASSERT_EQ(bss->usdt3_called, called, "usdt3_called");
 +      ASSERT_EQ(bss->usdt12_called, called, "usdt12_called");
  
-       ASSERT_EQ(bss->usdt0_cookie, 0xcafedeadbeeffeed, "usdt0_cookie");
+       ASSERT_EQ(bss->usdt0_cookie, expected_cookie, "usdt0_cookie");
        ASSERT_EQ(bss->usdt0_arg_cnt, 0, "usdt0_arg_cnt");
        ASSERT_EQ(bss->usdt0_arg_ret, -ENOENT, "usdt0_arg_ret");
        ASSERT_EQ(bss->usdt0_arg_size, -ENOENT, "usdt0_arg_size");
@@@ -163,9 -225,18 +232,19 @@@
        ASSERT_EQ(bss->usdt3_args[1], 42, "usdt3_arg2");
        ASSERT_EQ(bss->usdt3_args[2], (uintptr_t)&bla, "usdt3_arg3");
  
+ #if defined(__x86_64__) || defined(__i386__)
+       trigger_sib_spec();
+       ASSERT_EQ(bss->usdt_sib_called, 1, "usdt_sib_called");
+       ASSERT_EQ(bss->usdt_sib_cookie, expected_cookie, "usdt_sib_cookie");
+       ASSERT_EQ(bss->usdt_sib_arg_cnt, 1, "usdt_sib_arg_cnt");
+       ASSERT_EQ(bss->usdt_sib_arg, nums[0], "usdt_sib_arg");
+       ASSERT_EQ(bss->usdt_sib_arg_ret, 0, "usdt_sib_arg_ret");
+       ASSERT_EQ(bss->usdt_sib_arg_size, sizeof(nums[0]), "usdt_sib_arg_size");
+ #endif
+ 
  cleanup:
        test_usdt__destroy(skel);
 +#undef TRIGGER
  }
  
  unsigned short test_usdt_100_semaphore SEC(".probes");

diff --cc tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
Simple merge