linux-kernel - [PATCH bpf-next v3 0/3] bpf: Add overwrite mode for BPF ring buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251018035738.4039621-1-xukuohai@huaweicloud.com>
Date: Sat, 18 Oct 2025 11:57:35 +0800
From: Xu Kuohai <xukuohai@...weicloud.com>
To: bpf@...r.kernel.org,
	linux-kselftest@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: Alexei Starovoitov <ast@...nel.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	Andrii Nakryiko <andrii@...nel.org>,
	Martin KaFai Lau <martin.lau@...ux.dev>,
	Eduard Zingerman <eddyz87@...il.com>,
	Yonghong Song <yhs@...com>,
	Song Liu <song@...nel.org>
Subject: [PATCH bpf-next v3 0/3] bpf: Add overwrite mode for BPF ring buffer 

When the BPF ring buffer is full, a new event cannot be recorded until one
or more old events are consumed to make enough space for it. In cases such
as fault diagnostics, where recent events are more useful than older ones,
this mechanism may lead to critical events being lost.

So add overwrite mode for BPF ring buffer to address it. In this mode, the
new event overwrites the oldest event when the buffer is full.

v3:
- remove half-round wakeup, drop unnecessary min in ringbuf_avail_data_sz(),
  switch to smp_load_acquire, update tests and fix typos, etc (Andrii)
- rebase and re-collect performance data

v2:
https://lore.kernel.org/bpf/20250905150641.2078838-1-xukuohai@huaweicloud.com/
- remove libbpf changes (Andrii)
- update overwrite benchmark

v1:
https://lore.kernel.org/bpf/20250804022101.2171981-1-xukuohai@huaweicloud.com/

Xu Kuohai (3):
  bpf: Add overwrite mode for BPF ring buffer
  selftests/bpf: Add overwrite mode test for BPF ring buffer
  selftests/bpf/benchs: Add overwrite mode benchmark for BPF ring buffer

 include/uapi/linux/bpf.h                      |   4 +
 kernel/bpf/ringbuf.c                          | 109 +++++++++++++++---
 tools/include/uapi/linux/bpf.h                |   4 +
 tools/testing/selftests/bpf/Makefile          |   3 +-
 .../selftests/bpf/benchs/bench_ringbufs.c     |  66 ++++++++++-
 .../bpf/benchs/run_bench_ringbufs.sh          |   4 +
 .../selftests/bpf/prog_tests/ringbuf.c        |  64 ++++++++++
 .../selftests/bpf/progs/ringbuf_bench.c       |  11 ++
 .../bpf/progs/test_ringbuf_overwrite.c        |  98 ++++++++++++++++
 9 files changed, 337 insertions(+), 26 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/test_ringbuf_overwrite.c

-- 
2.43.0