linux-kernel - Re: [PATCH v2] tracepoint: Have tracepoints created with DECLARE_TRACE() have

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAEf4BzZxDPpsTnger+UXL9wbrpK5gf_9YD2fD0VNA1nC7bcwUg@mail.gmail.com>
Date: Fri, 9 May 2025 11:27:22 -0700
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: LKML <linux-kernel@...r.kernel.org>, 
	Linux Trace Kernel <linux-trace-kernel@...r.kernel.org>, bpf@...r.kernel.org, 
	netdev <netdev@...r.kernel.org>, Jiri Olsa <olsajiri@...il.com>, 
	Peter Zijlstra <peterz@...radead.org>, David Ahern <dsahern@...nel.org>, 
	Juri Lelli <juri.lelli@...il.com>, Breno Leitao <leitao@...ian.org>, 
	Alexei Starovoitov <alexei.starovoitov@...il.com>, Gabriele Monaco <gmonaco@...hat.com>, 
	Masami Hiramatsu <mhiramat@...nel.org>, Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
Subject: Re: [PATCH v2] tracepoint: Have tracepoints created with
 DECLARE_TRACE() have _tp suffix

On Wed, May 7, 2025 at 1:20 PM Steven Rostedt <rostedt@...dmis.org> wrote:
>
> From: Steven Rostedt <rostedt@...dmis.org>
>
> Most tracepoints in the kernel are created with TRACE_EVENT(). The
> TRACE_EVENT() macro (and DECLARE_EVENT_CLASS() and DEFINE_EVENT() where in
> reality, TRACE_EVENT() is just a helper macro that calls those other two
> macros), will create not only a tracepoint (the function trace_<event>()
> used in the kernel), it also exposes the tracepoint to user space along
> with defining what fields will be saved by that tracepoint.
>
> There are a few places that tracepoints are created in the kernel that are
> not exposed to userspace via tracefs. They can only be accessed from code
> within the kernel. These tracepoints are created with DEFINE_TRACE()
>
> Most of these tracepoints end with "_tp". This is useful as when the
> developer sees that, they know that the tracepoint is for in-kernel only
> (meaning it can only be accessed inside the kernel, either directly by the
> kernel or indirectly via modules and BPF programs) and is not exposed to
> user space.
>
> Instead of making this only a process to add "_tp", enforce it by making
> the DECLARE_TRACE() append the "_tp" suffix to the tracepoint. This
> requires adding DECLARE_TRACE_EVENT() macros for the TRACE_EVENT() macro
> to use that keeps the original name.
>
> Link: https://lore.kernel.org/all/20250418083351.20a60e64@gandalf.local.home/
>
> Cc: Masami Hiramatsu <mhiramat@...nel.org>
> Cc: Peter Zijlstra <peterz@...radead.org>
> Cc: David Ahern <dsahern@...nel.org>
> Cc: Juri Lelli <juri.lelli@...il.com>
> Cc: Breno Leitao <leitao@...ian.org>
> Cc: Alexei Starovoitov <alexei.starovoitov@...il.com>
> Cc: Andrii Nakryiko <andrii.nakryiko@...il.com>
> Cc: Gabriele Monaco <gmonaco@...hat.com>
> Acked-by: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
> Acked-by: Andrii Nakryiko <andrii@...nel.org>
> Signed-off-by: Steven Rostedt (Google) <rostedt@...dmis.org>
> ---
> Changes since RFC/v1: https://lore.kernel.org/20250418110104.12af6883@gandalf.local.home
>
> - Folded in Jiri Olsa's update to DECLARE_TRACE_WRITABLE()
>   https://lore.kernel.org/linux-trace-kernel/aAY9pcvYHkYKFwZ5@krava/
>
> - Updated change log to be more specific about "kernel only"
>   (Andrii Nakryiko)
>
> - Updated Documentation to ref
>
>  Documentation/trace/tracepoints.rst           | 17 ++++++---
>  include/linux/tracepoint.h                    | 38 +++++++++++++------
>  include/trace/bpf_probe.h                     |  8 ++--
>  include/trace/define_trace.h                  | 17 ++++++++-
>  include/trace/events/sched.h                  | 30 +++++++--------
>  include/trace/events/tcp.h                    |  2 +-
>  .../bpf/test_kmods/bpf_testmod-events.h       |  2 +-
>  .../selftests/bpf/test_kmods/bpf_testmod.c    |  8 ++--
>  8 files changed, 78 insertions(+), 44 deletions(-)
>

[...]

> diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod-events.h b/tools/testing/selftests/bpf/test_kmods/bpf_testmod-events.h
> index aeef86b3da74..2bac14ef507f 100644
> --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod-events.h
> +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod-events.h
> @@ -42,7 +42,7 @@ DECLARE_TRACE(bpf_testmod_test_nullable_bare,
>
>  struct sk_buff;
>
> -DECLARE_TRACE(bpf_testmod_test_raw_tp_null,
> +DECLARE_TRACE(bpf_testmod_test_raw_null,

here "raw_tp" is actually part of the name (we are testing raw
tracepoints with NULL argument), so I'd suggest to not change it here,
we'll just have trace_bpf_testmod_test_raw_tp_null_tp() below, however
odd it might be looking :)

>         TP_PROTO(struct sk_buff *skb),
>         TP_ARGS(skb)
>  );
> diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> index 3220f1d28697..fd40c1180b09 100644
> --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> @@ -413,7 +413,7 @@ bpf_testmod_test_read(struct file *file, struct kobject *kobj,
>
>         (void)bpf_testmod_test_arg_ptr_to_struct(&struct_arg1_2);
>
> -       (void)trace_bpf_testmod_test_raw_tp_null(NULL);
> +       (void)trace_bpf_testmod_test_raw_null_tp(NULL);
>
>         bpf_testmod_test_struct_ops3();
>
> @@ -431,14 +431,14 @@ bpf_testmod_test_read(struct file *file, struct kobject *kobj,
>         if (bpf_testmod_loop_test(101) > 100)
>                 trace_bpf_testmod_test_read(current, &ctx);
>
> -       trace_bpf_testmod_test_nullable_bare(NULL);
> +       trace_bpf_testmod_test_nullable_bare_tp(NULL);
>
>         /* Magic number to enable writable tp */
>         if (len == 64) {
>                 struct bpf_testmod_test_writable_ctx writable = {
>                         .val = 1024,
>                 };
> -               trace_bpf_testmod_test_writable_bare(&writable);
> +               trace_bpf_testmod_test_writable_bare_tp(&writable);
>                 if (writable.early_ret)
>                         return snprintf(buf, len, "%d\n", writable.val);
>         }
> @@ -470,7 +470,7 @@ bpf_testmod_test_write(struct file *file, struct kobject *kobj,
>                 .len = len,
>         };
>
> -       trace_bpf_testmod_test_write_bare(current, &ctx);
> +       trace_bpf_testmod_test_write_bare_tp(current, &ctx);
>

please update the following three lines in selftests to match new names:

progs/test_module_attach.c
22:SEC("raw_tp/bpf_testmod_test_write_bare")

progs/test_tp_btf_nullable.c
9:SEC("tp_btf/bpf_testmod_test_nullable_bare")
16:SEC("tp_btf/bpf_testmod_test_nullable_bare")


just add that "_tp" suffix everywhere and CI should be happy

>         return -EIO; /* always fail */
>  }
> --
> 2.47.2
>