linux-kernel - [PATCH bpf-next v1 1/2] bpf: Add kfuncs for detecting execution context

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251022113412.352307-2-jiayuan.chen@linux.dev>
Date: Wed, 22 Oct 2025 19:33:32 +0800
From: Jiayuan Chen <jiayuan.chen@...ux.dev>
To: bpf@...r.kernel.org
Cc: Jiayuan Chen <jiayuan.chen@...ux.dev>,
	Alexei Starovoitov <ast@...nel.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	Andrii Nakryiko <andrii@...nel.org>,
	Martin KaFai Lau <martin.lau@...ux.dev>,
	Eduard Zingerman <eddyz87@...il.com>,
	Song Liu <song@...nel.org>,
	Yonghong Song <yonghong.song@...ux.dev>,
	John Fastabend <john.fastabend@...il.com>,
	KP Singh <kpsingh@...nel.org>,
	Stanislav Fomichev <sdf@...ichev.me>,
	Hao Luo <haoluo@...gle.com>,
	Jiri Olsa <jolsa@...nel.org>,
	Shuah Khan <shuah@...nel.org>,
	linux-kernel@...r.kernel.org,
	linux-kselftest@...r.kernel.org
Subject: [PATCH bpf-next v1 1/2] bpf: Add kfuncs for detecting execution context

This path introduces several kfuncs to help BPF programs determine their
current execution context. When hooking functions for statistics, we often
need to use current->comm to get the process name.

However, these hooked functions can be called from either process context
or interrupt context. When called from interrupt context, the current we
obtain may refer to the process that was interrupted, which may not be
what we need.

These new kfuncs expose APIs that allow users to determine the actual
execution context.

Signed-off-by: Jiayuan Chen <jiayuan.chen@...ux.dev>
---
 kernel/bpf/helpers.c | 45 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index b9ec6ee21c94..e09c70b4eaea 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -4252,6 +4252,47 @@ __bpf_kfunc int bpf_task_work_schedule_resume(struct task_struct *task, struct b
 	return bpf_task_work_schedule(task, tw, map__map, callback, aux__prog, TWA_RESUME);
 }
 
+/**
+ * bpf_in_nmi_context - Check whether we are serving NMI
+ *
+ * Return: true if we are serving NMI
+ */
+__bpf_kfunc bool bpf_in_nmi_context(void)
+{
+	return in_nmi();
+}
+
+/**
+ * bpf_in_hardirq_context - Check whether we are serving hard irq
+ *
+ * Return: true if we are serving hard irq
+ */
+__bpf_kfunc bool bpf_in_hardirq_context(void)
+{
+	return in_hardirq();
+}
+
+/**
+ * bpf_in_softirq_context - Check whether we are serving soft irq
+ *
+ * Return: true if we are serving soft irq
+ */
+__bpf_kfunc bool bpf_in_softirq_context(void)
+{
+	/* in_softirq() has been deprecated */
+	return in_serving_softirq();
+}
+
+/**
+ * bpf_in_task_context - Check whether we are in task context
+ *
+ * Return: true if we are in task context
+ */
+__bpf_kfunc bool bpf_in_task_context(void)
+{
+	return in_task();
+}
+
 __bpf_kfunc_end_defs();
 
 static void bpf_task_work_cancel_scheduled(struct irq_work *irq_work)
@@ -4429,6 +4470,10 @@ BTF_ID_FLAGS(func, bpf_cgroup_read_xattr, KF_RCU)
 BTF_ID_FLAGS(func, bpf_stream_vprintk, KF_TRUSTED_ARGS)
 BTF_ID_FLAGS(func, bpf_task_work_schedule_signal, KF_TRUSTED_ARGS)
 BTF_ID_FLAGS(func, bpf_task_work_schedule_resume, KF_TRUSTED_ARGS)
+BTF_ID_FLAGS(func, bpf_in_softirq_context)
+BTF_ID_FLAGS(func, bpf_in_hardirq_context)
+BTF_ID_FLAGS(func, bpf_in_task_context)
+BTF_ID_FLAGS(func, bpf_in_nmi_context)
 BTF_KFUNCS_END(common_btf_ids)
 
 static const struct btf_kfunc_id_set common_kfunc_set = {
-- 
2.43.0