linux-kernel - Re: [PATCH bpf-next v2 00/10] bpf: tracing session supporting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5931958.DvuYhMxLoT@7950hx>
Date: Wed, 22 Oct 2025 16:19:27 +0800
From: Menglong Dong <menglong.dong@...ux.dev>
To: ast@...nel.org, jolsa@...nel.org, Menglong Dong <menglong8.dong@...il.com>
Cc: daniel@...earbox.net, john.fastabend@...il.com, andrii@...nel.org,
 martin.lau@...ux.dev, eddyz87@...il.com, song@...nel.org,
 yonghong.song@...ux.dev, kpsingh@...nel.org, sdf@...ichev.me,
 haoluo@...gle.com, mattbobrowski@...gle.com, rostedt@...dmis.org,
 mhiramat@...nel.org, mathieu.desnoyers@...icios.com, leon.hwang@...ux.dev,
 jiang.biao@...ux.dev, bpf@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-trace-kernel@...r.kernel.org
Subject: Re: [PATCH bpf-next v2 00/10] bpf: tracing session supporting

On 2025/10/22 16:01, Menglong Dong wrote:
> Sometimes, we need to hook both the entry and exit of a function with
> TRACING. Therefore, we need define a FENTRY and a FEXIT for the target
> function, which is not convenient.
> 
> Therefore, we add a tracing session support for TRACING. Generally
> speaking, it's similar to kprobe session, which can hook both the entry
> and exit of a function with a single BPF program. Meanwhile, it can also
> control the execution of the fexit with the return value of the fentry.
> Session cookie is also supported with the kfunc bpf_fsession_cookie().
> 
> The kfunc bpf_tracing_is_exit() and bpf_fsession_cookie() are both inlined
> in the verifier.

Hmm......the gmail broken after it sent the 7th patch. So I sent
the remained 3 patches again. However, they are not recognized
together as a series. So awkward :/

Should I resend it?

Thanks!
Menglong Dong

> 
> We allow the usage of bpf_get_func_ret() to get the return value in the
> fentry of the tracing session, as it will always get "0", which is safe
> enough and is OK.
> 
> The while fsession stuff is arch related, so the -EOPNOTSUPP will be
> returned if it is not supported yet by the arch. In this series, we only
> support x86_64. And later, other arch will be implemented.
> 
> Changes since v1:
> * session cookie support.
>   In this version, session cookie is implemented, and the kfunc
>   bpf_fsession_cookie() is added.
> 
> * restructure the layout of the stack.
>   In this version, the session stuff that stored in the stack is changed,
>   and we locate them after the return value to not break
>   bpf_get_func_ip().
> 
> * testcase enhancement.
>   Some nits in the testcase that suggested by Jiri is fixed. Meanwhile,
>   the testcase for get_func_ip and session cookie is added too.
> 
> Menglong Dong (10):
>   bpf: add tracing session support
>   bpf: add kfunc bpf_tracing_is_exit for TRACE_SESSION
>   bpf: add kfunc bpf_fsession_cookie for TRACING SESSION
>   bpf,x86: add ret_off to invoke_bpf()
>   bpf,x86: add tracing session supporting for x86_64
>   libbpf: add support for tracing session
>   selftests/bpf: test get_func_ip for fsession
>   selftests/bpf: add testcases for tracing session
>   selftests/bpf: add session cookie testcase for fsession
>   selftests/bpf: add testcase for mixing fsession, fentry and fexit
> 
>  arch/arm64/net/bpf_jit_comp.c                 |   3 +
>  arch/loongarch/net/bpf_jit.c                  |   3 +
>  arch/powerpc/net/bpf_jit_comp.c               |   3 +
>  arch/riscv/net/bpf_jit_comp64.c               |   3 +
>  arch/s390/net/bpf_jit_comp.c                  |   3 +
>  arch/x86/net/bpf_jit_comp.c                   | 214 ++++++++++++++++--
>  include/linux/bpf.h                           |   2 +
>  include/uapi/linux/bpf.h                      |   1 +
>  kernel/bpf/btf.c                              |   2 +
>  kernel/bpf/syscall.c                          |   2 +
>  kernel/bpf/trampoline.c                       |   5 +-
>  kernel/bpf/verifier.c                         |  45 +++-
>  kernel/trace/bpf_trace.c                      |  59 ++++-
>  net/bpf/test_run.c                            |   1 +
>  net/core/bpf_sk_storage.c                     |   1 +
>  tools/bpf/bpftool/common.c                    |   1 +
>  tools/include/uapi/linux/bpf.h                |   1 +
>  tools/lib/bpf/bpf.c                           |   2 +
>  tools/lib/bpf/libbpf.c                        |   3 +
>  .../selftests/bpf/prog_tests/fsession_test.c  | 161 +++++++++++++
>  .../bpf/prog_tests/get_func_ip_test.c         |   2 +
>  .../bpf/prog_tests/tracing_failure.c          |   2 +-
>  .../selftests/bpf/progs/fsession_cookie.c     |  49 ++++
>  .../selftests/bpf/progs/fsession_mixed.c      |  45 ++++
>  .../selftests/bpf/progs/fsession_test.c       | 175 ++++++++++++++
>  .../selftests/bpf/progs/get_func_ip_test.c    |  14 ++
>  26 files changed, 776 insertions(+), 26 deletions(-)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/fsession_test.c
>  create mode 100644 tools/testing/selftests/bpf/progs/fsession_cookie.c
>  create mode 100644 tools/testing/selftests/bpf/progs/fsession_mixed.c
>  create mode 100644 tools/testing/selftests/bpf/progs/fsession_test.c
> 
>