| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <aW86Pqgipfb_59S_@krava>
Date: Tue, 20 Jan 2026 09:18:06 +0100
From: Jiri Olsa <olsajiri@...il.com>
To: Menglong Dong <menglong.dong@...ux.dev>
Cc: Menglong Dong <menglong8.dong@...il.com>,
Jiri Olsa <olsajiri@...il.com>, andrii@...nel.org, ast@...nel.org,
daniel@...earbox.net, john.fastabend@...il.com,
martin.lau@...ux.dev, eddyz87@...il.com, song@...nel.org,
yonghong.song@...ux.dev, kpsingh@...nel.org, sdf@...ichev.me,
haoluo@...gle.com, mattbobrowski@...gle.com, rostedt@...dmis.org,
mhiramat@...nel.org, mathieu.desnoyers@...icios.com,
bpf@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-trace-kernel@...r.kernel.org
Subject: Re: [PATCH bpf-next v3 1/2] bpf: support bpf_get_func_arg() for
BPF_TRACE_RAW_TP
On Tue, Jan 20, 2026 at 09:24:46AM +0800, Menglong Dong wrote:
> On 2026/1/20 07:37, Jiri Olsa wrote:
> > On Mon, Jan 19, 2026 at 10:37:31AM +0800, Menglong Dong wrote:
> > > For now, bpf_get_func_arg() and bpf_get_func_arg_cnt() is not supported by
> > > the BPF_TRACE_RAW_TP, which is not convenient to get the argument of the
> > > tracepoint, especially for the case that the position of the arguments in
> > > a tracepoint can change.
> > >
> > > The target tracepoint BTF type id is specified during loading time,
> > > therefore we can get the function argument count from the function
> > > prototype instead of the stack.
> > >
> > > Signed-off-by: Menglong Dong <dongml2@...natelecom.cn>
> > > ---
> > > v3:
> > > - remove unnecessary NULL checking for prog->aux->attach_func_proto
> > >
> > > v2:
> > > - for nr_args, skip first 'void *__data' argument in btf_trace_##name
> > > typedef
> > > ---
> > > kernel/bpf/verifier.c | 32 ++++++++++++++++++++++++++++----
> > > kernel/trace/bpf_trace.c | 4 ++--
> > > 2 files changed, 30 insertions(+), 6 deletions(-)
> > >
> > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > index faa1ecc1fe9d..4f52342573f0 100644
> > > --- a/kernel/bpf/verifier.c
> > > +++ b/kernel/bpf/verifier.c
> > > @@ -23316,8 +23316,20 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
> > > /* Implement bpf_get_func_arg inline. */
> > > if (prog_type == BPF_PROG_TYPE_TRACING &&
> > > insn->imm == BPF_FUNC_get_func_arg) {
> > > - /* Load nr_args from ctx - 8 */
> > > - insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
> > > + if (eatype == BPF_TRACE_RAW_TP) {
> > > + int nr_args = btf_type_vlen(prog->aux->attach_func_proto);
> > > +
> > > + /*
> > > + * skip first 'void *__data' argument in btf_trace_##name
> > > + * typedef
> > > + */
> > > + nr_args--;
> > > + /* Save nr_args to reg0 */
> > > + insn_buf[0] = BPF_MOV64_IMM(BPF_REG_0, nr_args);
> > > + } else {
> > > + /* Load nr_args from ctx - 8 */
> > > + insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
> > > + }
> > > insn_buf[1] = BPF_JMP32_REG(BPF_JGE, BPF_REG_2, BPF_REG_0, 6);
> > > insn_buf[2] = BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 3);
> > > insn_buf[3] = BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1);
> > > @@ -23369,8 +23381,20 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
> > > /* Implement get_func_arg_cnt inline. */
> > > if (prog_type == BPF_PROG_TYPE_TRACING &&
> > > insn->imm == BPF_FUNC_get_func_arg_cnt) {
> > > - /* Load nr_args from ctx - 8 */
> > > - insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
> > > + if (eatype == BPF_TRACE_RAW_TP) {
> > > + int nr_args = btf_type_vlen(prog->aux->attach_func_proto);
> > > +
> > > + /*
> > > + * skip first 'void *__data' argument in btf_trace_##name
> > > + * typedef
> > > + */
> > > + nr_args--;
> > > + /* Save nr_args to reg0 */
> >
> > I think we can attach single bpf program to multiple rawtp tracepoints,
> > in which case this would not work properly for such program links on
> > tracepoints with different nr_args, right?
>
> Hi, Jiri. As for now, I think we can't do that when I look into
> bpf_raw_tp_link_attach(). For the BPF_TRACE_RAW_TP, we specify
> a target btf type id when loading the bpf prog. And during
> attaching, it seems that we can only attach to that target, which
> means that we can't attach to multiple rawtp tracepoint. And
> we can't change the target btf id when reattach, too. Right?
>
> Part of the implement of bpf_raw_tp_link_attach():
>
> static int bpf_raw_tp_link_attach(struct bpf_prog *prog,
> const char __user *user_tp_name, u64 cookie,
> enum bpf_attach_type attach_type)
> {
> struct bpf_link_primer link_primer;
> struct bpf_raw_tp_link *link;
> struct bpf_raw_event_map *btp;
> const char *tp_name;
> char buf[128];
> int err;
>
> switch (prog->type) {
> case BPF_PROG_TYPE_TRACING:
> case BPF_PROG_TYPE_EXT:
> case BPF_PROG_TYPE_LSM:
> if (user_tp_name)
> /* The attach point for this category of programs
> * should be specified via btf_id during program load.
> */
ah there's the name check, ok.. got confused by the max_ctx_offset
check in bpf_probe_register
thanks,
jirka
> return -EINVAL;
> if (prog->type == BPF_PROG_TYPE_TRACING &&
> prog->expected_attach_type == BPF_TRACE_RAW_TP) {
> tp_name = prog->aux->attach_func_name;
> break;
> }
> [......]
> }
> [......]
> }
>
> Thanks!
> Menglong Dong
>
> >
> > jirka
> >
> >
> > > + insn_buf[0] = BPF_MOV64_IMM(BPF_REG_0, nr_args);
> > > + } else {
> > > + /* Load nr_args from ctx - 8 */
> > > + insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
> > > + }
> > >
> > > new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, 1);
> > > if (!new_prog)
> > > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> > > index 6e076485bf70..9b1b56851d26 100644
> > > --- a/kernel/trace/bpf_trace.c
> > > +++ b/kernel/trace/bpf_trace.c
> > > @@ -1734,11 +1734,11 @@ tracing_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
> > > case BPF_FUNC_d_path:
> > > return &bpf_d_path_proto;
> > > case BPF_FUNC_get_func_arg:
> > > - return bpf_prog_has_trampoline(prog) ? &bpf_get_func_arg_proto : NULL;
> > > + return &bpf_get_func_arg_proto;
> > > case BPF_FUNC_get_func_ret:
> > > return bpf_prog_has_trampoline(prog) ? &bpf_get_func_ret_proto : NULL;
> > > case BPF_FUNC_get_func_arg_cnt:
> > > - return bpf_prog_has_trampoline(prog) ? &bpf_get_func_arg_cnt_proto : NULL;
> > > + return &bpf_get_func_arg_cnt_proto;
> > > case BPF_FUNC_get_attach_cookie:
> > > if (prog->type == BPF_PROG_TYPE_TRACING &&
> > > prog->expected_attach_type == BPF_TRACE_RAW_TP)
> >
> >
>
>
>
>
Powered by blists - more mailing lists