netdev - Re: [PATCH bpf-next v4 7/9] libbpf: add support for tracing session

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6115584.MhkbZ0Pkbq@7940hx>
Date: Fri, 19 Dec 2025 09:42:12 +0800
From: Menglong Dong <menglong.dong@...ux.dev>
To: Menglong Dong <menglong8.dong@...il.com>,
 Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc: ast@...nel.org, andrii@...nel.org, davem@...emloft.net,
 dsahern@...nel.org, daniel@...earbox.net, martin.lau@...ux.dev,
 eddyz87@...il.com, song@...nel.org, yonghong.song@...ux.dev,
 john.fastabend@...il.com, kpsingh@...nel.org, sdf@...ichev.me,
 haoluo@...gle.com, jolsa@...nel.org, tglx@...utronix.de, mingo@...hat.com,
 bp@...en8.de, dave.hansen@...ux.intel.com, x86@...nel.org, hpa@...or.com,
 netdev@...r.kernel.org, bpf@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH bpf-next v4 7/9] libbpf: add support for tracing session

On 2025/12/19 08:55 Andrii Nakryiko <andrii.nakryiko@...il.com> write:
> On Wed, Dec 17, 2025 at 1:55 AM Menglong Dong <menglong8.dong@...il.com> wrote:
> >
> > Add BPF_TRACE_SESSION to libbpf and bpftool.
> >
> > Signed-off-by: Menglong Dong <dongml2@...natelecom.cn>
> > ---
> >  tools/bpf/bpftool/common.c | 1 +
> >  tools/lib/bpf/bpf.c        | 2 ++
> >  tools/lib/bpf/libbpf.c     | 3 +++
> >  3 files changed, 6 insertions(+)
> >
> > diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
> > index e8daf963ecef..534be6cfa2be 100644
> > --- a/tools/bpf/bpftool/common.c
> > +++ b/tools/bpf/bpftool/common.c
> > @@ -1191,6 +1191,7 @@ const char *bpf_attach_type_input_str(enum bpf_attach_type t)
> >         case BPF_TRACE_FENTRY:                  return "fentry";
> >         case BPF_TRACE_FEXIT:                   return "fexit";
> >         case BPF_MODIFY_RETURN:                 return "mod_ret";
> > +       case BPF_TRACE_SESSION:                 return "fsession";
> >         case BPF_SK_REUSEPORT_SELECT:           return "sk_skb_reuseport_select";
> >         case BPF_SK_REUSEPORT_SELECT_OR_MIGRATE:        return "sk_skb_reuseport_select_or_migrate";
> >         default:        return libbpf_bpf_attach_type_str(t);
> > diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
> > index 21b57a629916..5042df4a5df7 100644
> > --- a/tools/lib/bpf/bpf.c
> > +++ b/tools/lib/bpf/bpf.c
> > @@ -794,6 +794,7 @@ int bpf_link_create(int prog_fd, int target_fd,
> >         case BPF_TRACE_FENTRY:
> >         case BPF_TRACE_FEXIT:
> >         case BPF_MODIFY_RETURN:
> > +       case BPF_TRACE_SESSION:
> >         case BPF_LSM_MAC:
> >                 attr.link_create.tracing.cookie = OPTS_GET(opts, tracing.cookie, 0);
> >                 if (!OPTS_ZEROED(opts, tracing))
> > @@ -917,6 +918,7 @@ int bpf_link_create(int prog_fd, int target_fd,
> >         case BPF_TRACE_FENTRY:
> >         case BPF_TRACE_FEXIT:
> >         case BPF_MODIFY_RETURN:
> > +       case BPF_TRACE_SESSION:
> 
> no need, this is a legacy fallback path for programs that were (at
> some point for older kernels) attachable only through
> BPF_RAW_TRACEPOINT_OPEN. BPF_LINK_CREATE is sufficient, drop this
> line.

OK, I see.

> 
> >                 return bpf_raw_tracepoint_open(NULL, prog_fd);
> >         default:
> >                 return libbpf_err(err);
> > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> > index c7c79014d46c..0c095195df31 100644
> > --- a/tools/lib/bpf/libbpf.c
> > +++ b/tools/lib/bpf/libbpf.c
> > @@ -115,6 +115,7 @@ static const char * const attach_type_name[] = {
> >         [BPF_TRACE_FENTRY]              = "trace_fentry",
> >         [BPF_TRACE_FEXIT]               = "trace_fexit",
> >         [BPF_MODIFY_RETURN]             = "modify_return",
> > +       [BPF_TRACE_SESSION]             = "trace_session",
> 
> let's use fsession terminology consistently

OK, so we will use "trace_fsession" here.

Thanks!
Menglong Dong

> 
> 
> >         [BPF_LSM_MAC]                   = "lsm_mac",
> >         [BPF_LSM_CGROUP]                = "lsm_cgroup",
> >         [BPF_SK_LOOKUP]                 = "sk_lookup",
> > @@ -9853,6 +9854,8 @@ static const struct bpf_sec_def section_defs[] = {
> >         SEC_DEF("fentry.s+",            TRACING, BPF_TRACE_FENTRY, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
> >         SEC_DEF("fmod_ret.s+",          TRACING, BPF_MODIFY_RETURN, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
> >         SEC_DEF("fexit.s+",             TRACING, BPF_TRACE_FEXIT, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
> > +       SEC_DEF("fsession+",            TRACING, BPF_TRACE_SESSION, SEC_ATTACH_BTF, attach_trace),
> > +       SEC_DEF("fsession.s+",          TRACING, BPF_TRACE_SESSION, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
> >         SEC_DEF("freplace+",            EXT, 0, SEC_ATTACH_BTF, attach_trace),
> >         SEC_DEF("lsm+",                 LSM, BPF_LSM_MAC, SEC_ATTACH_BTF, attach_lsm),
> >         SEC_DEF("lsm.s+",               LSM, BPF_LSM_MAC, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_lsm),
> > --
> > 2.52.0
> >
>