netdev - [RFC PATCH v2 0/2] libbpf: Add support for dynamic tracepoints

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250112064513.883-1-laoar.shao@gmail.com>
Date: Sun, 12 Jan 2025 14:45:11 +0800
From: Yafang Shao <laoar.shao@...il.com>
To: andrii@...nel.org,
	eddyz87@...il.com,
	ast@...nel.org,
	daniel@...earbox.net,
	martin.lau@...ux.dev,
	song@...nel.org,
	yonghong.song@...ux.dev,
	john.fastabend@...il.com,
	kpsingh@...nel.org,
	sdf@...ichev.me,
	haoluo@...gle.com,
	jolsa@...nel.org,
	edumazet@...gle.com,
	dxu@...uu.xyz
Cc: bpf@...r.kernel.org,
	netdev@...r.kernel.org,
	Yafang Shao <laoar.shao@...il.com>
Subject: [RFC PATCH v2 0/2] libbpf: Add support for dynamic tracepoints 

The primary goal of this change is to enable tracing of inlined kernel
functions with BPF programs.

Dynamic tracepoints can be created using tools like perf-probe, debugfs, or
similar utilities. For example:

  $ perf probe -a 'tcp_listendrop sk'
  $ ls /sys/kernel/debug/tracing/events/probe/tcp_listendrop/
  enable  filter  format  hist  id  trigger

Here, tcp_listendrop() is an example of an inlined kernel function.

While these dynamic tracepoints are functional, they cannot be easily
attached to BPF programs. For instance, attempting to use them with
bpftrace results in the following error:

  $ bpftrace -l 'tracepoint:probe:*'
  tracepoint:probe:tcp_listendrop

  $ bpftrace -e 'tracepoint:probe:tcp_listendrop {print(comm)}'
  Attaching 1 probe...
  ioctl(PERF_EVENT_IOC_SET_BPF): Invalid argument
  ERROR: Error attaching probe: tracepoint:probe:tcp_listendrop

The issue lies in how these dynamic tracepoints are implemented: despite
being exposed as tracepoints, they remain kprobe events internally. As a
result, loading them as a tracepoint program fails. Instead, they must be
loaded as kprobe programs.

This change introduces support for such use cases in libbpf by adding a
new section: SEC("kprobe/SUBSYSTEM/PROBE")

- Future work
  Extend support for dynamic tracepoints in bpftrace.

Changes:
v1->v2:
- Use a new SEC("kprobe/SUBSYSTEM/PROBE") instead (Jiri)

v1: https://lore.kernel.org/bpf/20250105124403.991-1-laoar.shao@gmail.com/

Yafang Shao (2):
  libbpf: Add support for dynamic tracepoint
  selftests/bpf: Add selftest for dynamic tracepoint

 tools/lib/bpf/libbpf.c                        | 29 ++++++++-
 .../bpf/prog_tests/test_dynamic_tp.c          | 64 +++++++++++++++++++
 .../testing/selftests/bpf/progs/dynamic_tp.c  | 27 ++++++++
 3 files changed, 119 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/test_dynamic_tp.c
 create mode 100644 tools/testing/selftests/bpf/progs/dynamic_tp.c

-- 
2.43.5