linux-kernel - Re: [PATCH RFC bpf-next 3/5] bpf,x86: add tracing session supporting for x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6206161.lOV4Wx5bFT@7950hx>
Date: Mon, 20 Oct 2025 16:31:44 +0800
From: Menglong Dong <menglong.dong@...ux.dev>
To: Menglong Dong <menglong8.dong@...il.com>, Jiri Olsa <olsajiri@...il.com>
Cc: ast@...nel.org, daniel@...earbox.net, john.fastabend@...il.com,
 andrii@...nel.org, martin.lau@...ux.dev, eddyz87@...il.com, song@...nel.org,
 yonghong.song@...ux.dev, kpsingh@...nel.org, sdf@...ichev.me,
 haoluo@...gle.com, mattbobrowski@...gle.com, rostedt@...dmis.org,
 mhiramat@...nel.org, mathieu.desnoyers@...icios.com, leon.hwang@...ux.dev,
 bpf@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-trace-kernel@...r.kernel.org
Subject:
 Re: [PATCH RFC bpf-next 3/5] bpf,x86: add tracing session supporting for
 x86_64

On 2025/10/20 16:19, Jiri Olsa wrote:
> On Sat, Oct 18, 2025 at 10:21:22PM +0800, Menglong Dong wrote:
> 
> SNIP
> 
> >  /* mov rax, qword ptr [rbp - rounded_stack_depth - 8] */
> >  #define LOAD_TRAMP_TAIL_CALL_CNT_PTR(stack)	\
> >  	__LOAD_TCC_PTR(-round_up(stack, 8) - 8)
> > @@ -3179,8 +3270,10 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
> >  					 void *func_addr)
> >  {
> >  	int i, ret, nr_regs = m->nr_args, stack_size = 0;
> > -	int regs_off, nregs_off, ip_off, run_ctx_off, arg_stack_off, rbx_off;
> > +	int regs_off, nregs_off, session_off, ip_off, run_ctx_off,
> > +	    arg_stack_off, rbx_off;
> >  	struct bpf_tramp_links *fentry = &tlinks[BPF_TRAMP_FENTRY];
> > +	struct bpf_tramp_links *session = &tlinks[BPF_TRAMP_SESSION];
> >  	struct bpf_tramp_links *fexit = &tlinks[BPF_TRAMP_FEXIT];
> >  	struct bpf_tramp_links *fmod_ret = &tlinks[BPF_TRAMP_MODIFY_RETURN];
> >  	void *orig_call = func_addr;
> > @@ -3222,6 +3315,8 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
> >  	 *
> >  	 * RBP - nregs_off [ regs count	     ]  always
> >  	 *
> > +	 * RBP - session_off [ session flags ] tracing session
> > +	 *
> >  	 * RBP - ip_off    [ traced function ]  BPF_TRAMP_F_IP_ARG flag
> >  	 *
> >  	 * RBP - rbx_off   [ rbx value       ]  always
> > @@ -3246,6 +3341,8 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
> >  	/* regs count  */
> >  	stack_size += 8;
> >  	nregs_off = stack_size;
> > +	stack_size += 8;
> > +	session_off = stack_size;
> 
> should this depend on session->nr_links ?

Hmm...my mistake, it should. And this also break the bpf_get_func_ip(),
which I'll fix in the next version.

> 
> jirka
> 
> >  
> >  	if (flags & BPF_TRAMP_F_IP_ARG)
> >  		stack_size += 8; /* room for IP address argument */
> > @@ -3345,6 +3442,13 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
> >  			return -EINVAL;
> >  	}
> >  
> > +	if (session->nr_links) {
> > +		if (invoke_bpf_session_entry(m, &prog, session, regs_off,
> > +					     run_ctx_off, session_off,
> > +					     image, rw_image))
> > +			return -EINVAL;
> > +	}
> > +
> >  	if (fmod_ret->nr_links) {
> >  		branches = kcalloc(fmod_ret->nr_links, sizeof(u8 *),
> >  				   GFP_KERNEL);
> > @@ -3409,6 +3513,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
> >  		}
> >  	}
> >  
> > +	if (session->nr_links) {
> > +		if (invoke_bpf_session_exit(m, &prog, session, regs_off,
> > +					    run_ctx_off, session_off,
> > +					    image, rw_image)) {
> > +			ret = -EINVAL;
> > +			goto cleanup;
> > +		}
> > +	}
> > +
> >  	if (flags & BPF_TRAMP_F_RESTORE_REGS)
> >  		restore_regs(m, &prog, regs_off);
> >  
> 
>