Post Syndicated from daroc original https://lwn.net/Articles/1017705/

From
servers in a data center to desktop computers, many devices
communicating on a network will eventually have to filter network
traffic, whether it’s for security or performance reasons. As a result,
this is a domain where a lot of work is put into improving performance:
a tiny performance improvement can have considerable gains.

Bpfilter is a
project that allows for packet filtering to easily be done with BPF, which can
be faster than other mechanisms.

Post Syndicated from daroc original https://lwn.net/Articles/1019885/

BPF arenas are areas of memory where the verifier can safely relax its checking of
pointers, allowing programmers to write arbitrary data structures in BPF. Emil
Tsalapatis reported on how his team has used arenas in writing

sched_ext schedulers at the 2025 Linux Storage, Filesystem,
Memory-Management, and BPF Summit. His biggest complaint was about the fact that
kernel pointers can’t be stored in BPF arenas — something that the BPF
developers hope to address, although there are some implementation problems that
must be sorted out first.

Post Syndicated from daroc original https://lwn.net/Articles/1020657/

Greg Kroah-Hartman has announced the release of the
6.14.6,
6.12.28,
6.6.90,
6.1.138, and
5.15.182 stable kernel versions.

Post Syndicated from daroc original https://lwn.net/Articles/1020653/

Security updates have been issued by Debian (fossil, libapache2-mod-auth-openidc, and request-tracker4), Fedora (thunderbird), Mageia (firefox and thunderbird), SUSE (389-ds, apparmor, cargo-c, chromium, go1.24, govulncheck-vulndb, java-1_8_0-openjdk, kanidm, libsoup, mozjs102, openssl-1_1, openssl-3, python-Django, sccache, tealdeer, tomcat, transfig, wasm-bindgen, and wireshark), and Ubuntu (libreoffice and python-h11).

Post Syndicated from daroc original https://lwn.net/Articles/1019667/

Anton Protopopov led a short discussion at the 2025 Linux Storage, Filesystem,
Memory-Management, and BPF Summit about amount of memory used
by hash tables in BPF programs. He thinks that the current memory layout is
inefficient, and wants to split the structure that holds table entries into two
variants for different kinds of maps. When that proposal proved
uncontroversial, he also took the chance to talk about a bug in BPF’s call
instruction.

Post Syndicated from daroc original https://lwn.net/Articles/1018493/

Linux systems can have large filesystems; trying to keep up with the
stream of

fanotify filesystem-monitoring notifications for them can be a struggle.
Fanotify is one of a few ways to monitor accesses to filesystems provided by the kernel.
Song Liu led a discussion
on how to improve in-kernel filtering of fanotify events to a joint
session of the filesystem and BPF tracks at the 2025 Linux Storage, Filesystem,
Memory-Management, and BPF Summit. He wants to combine the best parts of a few
different approaches to efficiently filter filesystem events.

Post Syndicated from daroc original https://lwn.net/Articles/1019869/

Security updates have been issued by Debian (chromium, nodejs, openjdk-17, and thunderbird), Fedora (firefox, golang-github-nvidia-container-toolkit, and thunderbird), Mageia (kernel), Oracle (ghostscript, glibc, kernel, libxslt, php:8.1, and thunderbird), SUSE (cmctl, firefox-esr, govulncheck-vulndb, java-21-openjdk, libxml2, poppler, python-h11, and redis), and Ubuntu (docker.io, ghostscript, linux-xilinx-zynqmp, and micropython).

Post Syndicated from daroc original https://lwn.net/Articles/1018475/

Modern compilers perform a lot of optimizations, which can complicate debugging.
Song Liu and Thierry Treyer spoke about a potential improvement to

BPF Type Format (BTF) debugging information that could partially combat that
problem at the 2025 Linux Storage, Filesystem,
Memory-Management, and BPF Summit.
They want to add information on selectively inlined functions to BTF in order to
better support tracing tools.
Treyer participated remotely.

Post Syndicated from daroc original https://lwn.net/Articles/1018320/

Martin Lau gave a talk in the BPF track of the 2025 Linux Storage, Filesystem,
Memory-Management, and BPF Summit about a performance problem
plaguing the networking subsystem, and some potential ways to fix it. He works on
BPF programs that need to store socket-local data; amid other improvements to
the networking and BPF subsystems, retrieving that data has become a noticeable
bottleneck for his use case. His proposed fix prompted a good deal of discussion
about how the data should be laid out.

Post Syndicated from daroc original https://lwn.net/Articles/1017549/

The Linux kernel can be configured so that
kernel modules must be signed or

otherwise authenticated to be loaded
into the kernel. Some BPF developers want that to be an option for BPF programs
as well — after all, if those are going to run as part of the kernel,
they should be subject to the same code-signing requirements. Blaise Boscaccy
and Cong Wang presented two different visions for how BPF code signing could
work at the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit.

Post Syndicated from daroc original https://lwn.net/Articles/1017439/

Anton Protopopov kicked off the BPF track on
the second day of the 2025 Linux Storage, Filesystem,
Memory-Management, and BPF Summit with a discussion about permitting
indirect calls in BPF. He also spoke about his continuing work on

static keys, a topic which is related because the implementation of indirect
jumps and static keys in the verifier use some of the same mechanisms for
tracking indirect control-flow.
Although some design work remains to be done, it may soon be
possible to make indirect calls in BPF without any extra work compared to normal
C.

Post Syndicated from daroc original https://lwn.net/Articles/1018297/

The Python Steering Council

accepted PEP 750
(“Template Strings“) on April 10. LWN
covered the discussion around the proposal, including the
substantial revisions to the idea that were needed for it
to be accepted. Template strings (t-strings) are a new kind of string that produces
structured data instead of a raw string, allowing library authors to build their own custom
template-handling logic.
Since the approval happened before the cutoff for new features (May 6),
support for template strings will be included in Python 3.14, scheduled for October 2025.

Post Syndicated from daroc original https://lwn.net/Articles/1018020/

Security updates have been issued by Debian (graphicsmagick and libapache2-mod-auth-openidc), Fedora (giflib, mod_auth_openidc, mysql8.0, perl, perl-Devel-Cover, perl-PAR-Packer, perl-String-Compare-ConstantTime, rust-openssl, rust-openssl-sys, trunk, and workrave), Mageia (chromium-browser-stable and rust), Oracle (java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, kernel, libreoffice, and webkit2gtk3), Red Hat (gvisor-tap-vsock), SUSE (containerd, docker, docker-stable, forgejo, GraphicsMagick, libmozjs-115-0, perl-32bit, poppler, subfinder, and thunderbird), and Ubuntu (erlang and ruby2.3, ruby2.5).

Post Syndicated from daroc original https://lwn.net/Articles/1017116/

The BPF verifier is not magic; it cannot solve the

halting problem. Therefore,
it has to err on the side of assuming that a program will run too long if it
cannot prove that the program will not.
The ultimate check on the size of a BPF program is the
one-million-instruction limit — the verifier will refuse to process more than
one-million instructions, no matter what a BPF program does. Alexei Starovoitov gave
a talk at the 2025 Linux Storage, Filesystem,
Memory-Management, and BPF Summit about that limit,
why correctly written BPF programs shouldn’t hit it, and how to make the user
experience of large BPF programs better in the future.

Post Syndicated from daroc original https://lwn.net/Articles/1016853/

BPF is, famously, not part of the kernel’s promises of user-space stability. New
kernels can and do break existing BPF programs; the BPF developers try to
fix unintentional regressions as they happen, but the whole thing can be something of a bumpy
ride for users trying to deploy BPF programs across multiple kernel versions.
Shung-Hsi Yu and Daniel Xu had two different approaches to fixing the problem
that they presented at the 2025 Linux Storage, Filesystem,
Memory-Management, and BPF Summit.

Post Syndicated from daroc original https://lwn.net/Articles/1016712/

Eduard Zingerman presented a daring proposal that “makes sense if you think
about it a bit” at the 2025 Linux Storage, Filesystem,
Memory-Management, and BPF Summit. He wants to inline
performance-sensitive kernel functions
into the BPF programs that call them. His
prototype does not yet address all of the design problems inherent in that idea,
but it did spark a lengthy discussion about the feasibility of his proposal.

Post Syndicated from daroc original https://lwn.net/Articles/1017197/

Security updates have been issued by AlmaLinux (delve and golang and go-toolset:rhel8), Debian (webkit2gtk), Fedora (openvpn, thunderbird, uboot-tools, and zabbix), SUSE (expat, fontforge, govulncheck-vulndb, and kernel), and Ubuntu (haproxy and libsoup2.4, libsoup3).

Post Syndicated from daroc original https://lwn.net/Articles/1016674/

The 6.15 merge window saw the inclusion of a new type of lock for BPF programs:
a resilient queued spinlock that Kumar Kartikeya Dwivedi has been working on
for some time. Eventually, he hopes to convert all of the spinlocks currently
used in the BPF subsystem to his new lock.
He gave a remote presentation about the design of the lock at the
2025 Linux Storage, Filesystem,
Memory-Management, and BPF summit.

Post Syndicated from daroc original https://lwn.net/Articles/1016243/

Pahole (originally “Poke-a-hole”) is a Swiss Army knife for exploring and
editing debug information. Pahole is also currently involved
in the kernel’s build process to rearrange the information
produced by various compilers into a form useful to the BPF verifier, although
there are plans to render it unnecessary.
Pahole maintainer Arnaldo Carvalho de Melo shared some status
updates about the project at the 2025 Linux Storage, Filesystem,
Memory-Management, and BPF summit. Interested readers can find his slides
here.

Post Syndicated from daroc original https://lwn.net/Articles/1016105/

Yonghong Song brought a story about tracking down the cause of a strange verifier error
message to the 2025 Linux Storage, Filesystem, Memory-Management, and BPF
Summit. He then presented some possible ways to improve Clang’s user experience for
anyone running into the same class of error in the future. Toward the end of his
allotted time, he also discussed the problems with optimizations that change the
signature of functions — a problem that José Marchesi had also brought up in
the previous session.