linux-kernel - Re: [RFC][PATCH] tracepoint: Have tracepoints created with DECLARE_TRACE() have

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4BzZfoCV=irWiy1MCY0fkhsJWxq8UGTYCW9Y3pQQP35eBLQ@mail.gmail.com>
Date: Wed, 23 Apr 2025 11:21:25 -0700
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: LKML <linux-kernel@...r.kernel.org>, 
	Linux Trace Kernel <linux-trace-kernel@...r.kernel.org>, 
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>, Masami Hiramatsu <mhiramat@...nel.org>, 
	Peter Zijlstra <peterz@...radead.org>, David Ahern <dsahern@...nel.org>, 
	Juri Lelli <juri.lelli@...il.com>, Breno Leitao <leitao@...ian.org>, netdev@...r.kernel.org, 
	Alexei Starovoitov <alexei.starovoitov@...il.com>, bpf@...r.kernel.org, 
	Gabriele Monaco <gmonaco@...hat.com>
Subject: Re: [RFC][PATCH] tracepoint: Have tracepoints created with
 DECLARE_TRACE() have _tp suffix

On Fri, Apr 18, 2025 at 7:59 AM Steven Rostedt <rostedt@...dmis.org> wrote:
>
> From: Steven Rostedt <rostedt@...dmis.org>
>
> Most tracepoints in the kernel are created with TRACE_EVENT(). The
> TRACE_EVENT() macro (and DECLARE_EVENT_CLASS() and DEFINE_EVENT() where in
> reality, TRACE_EVENT() is just a helper macro that calls those other two
> macros), will create not only a tracepoint (the function trace_<event>()
> used in the kernel), it also exposes the tracepoint to user space along
> with defining what fields will be saved by that tracepoint.
>
> There are a few places that tracepoints are created in the kernel that are
> not exposed to userspace via tracefs. They can only be accessed from code
> within the kernel. These tracepoints are created with DEFINE_TRACE()

The part about accessing only from code within the kernel isn't true.
Can we please drop that? BPF program can be attached to these bare
tracepoints just fine without tracefs (so-called BPF raw tracepoint
program types).

But I don't have an objection to the change itself, given all of them
currently do have _tp suffix except a few that we have in BPF
selftests's module, just as Jiri mentioned.

Acked-by: Andrii Nakryiko <andrii@...nel.org>

>
> Most of these tracepoints end with "_tp". This is useful as when the
> developer sees that, they know that the tracepoint is for in-kernel only
> and is not exposed to user space.
>
> Instead of making this only a process to add "_tp", enforce it by making
> the DECLARE_TRACE() append the "_tp" suffix to the tracepoint. This
> requires adding DECLARE_TRACE_EVENT() macros for the TRACE_EVENT() macro
> to use that keeps the original name.
>
> Link: https://lore.kernel.org/all/20250418083351.20a60e64@gandalf.local.home/
>
> Signed-off-by: Steven Rostedt (Google) <rostedt@...dmis.org>
> ---
>  include/linux/tracepoint.h   | 38 ++++++++++++++++++++++++------------
>  include/trace/bpf_probe.h    |  4 ++--
>  include/trace/define_trace.h | 17 +++++++++++++++-
>  include/trace/events/sched.h | 30 ++++++++++++++--------------
>  include/trace/events/tcp.h   |  2 +-
>  5 files changed, 60 insertions(+), 31 deletions(-)
>

[...]