Thread (30 messages) 30 messages, 4 authors, 2025-12-20

Re: [PATCH bpf-next v4 1/9] bpf: add tracing session support

From: Andrii Nakryiko <hidden>
Date: 2025-12-19 00:55:45
Also in: bpf, lkml

On Wed, Dec 17, 2025 at 1:55 AM Menglong Dong [off-list ref] wrote:
The tracing session is something that similar to kprobe session. It allow
to attach a single BPF program to both the entry and the exit of the
target functions.

Introduce the struct bpf_fsession_link, which allows to add the link to
both the fentry and fexit progs_hlist of the trampoline.

Signed-off-by: Menglong Dong <redacted>
Co-developed-by: Leon Hwang <redacted>
Signed-off-by: Leon Hwang <redacted>
---
v4:
- instead of adding a new hlist to progs_hlist in trampoline, add the bpf
  program to both the fentry hlist and the fexit hlist.
---
 include/linux/bpf.h                           | 20 +++++++++++
 include/uapi/linux/bpf.h                      |  1 +
 kernel/bpf/btf.c                              |  2 ++
 kernel/bpf/syscall.c                          | 18 +++++++++-
 kernel/bpf/trampoline.c                       | 36 +++++++++++++++----
 kernel/bpf/verifier.c                         | 12 +++++--
 net/bpf/test_run.c                            |  1 +
 net/core/bpf_sk_storage.c                     |  1 +
 tools/include/uapi/linux/bpf.h                |  1 +
 .../bpf/prog_tests/tracing_failure.c          |  2 +-
 10 files changed, 83 insertions(+), 11 deletions(-)
[...]
quoted hunk ↗ jump to hunk
 int bpf_prog_ctx_arg_info_init(struct bpf_prog *prog,
                               const struct bpf_ctx_arg_aux *info, u32 cnt);
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 84ced3ed2d21..696a7d37db0e 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1145,6 +1145,7 @@ enum bpf_attach_type {
        BPF_NETKIT_PEER,
        BPF_TRACE_KPROBE_SESSION,
        BPF_TRACE_UPROBE_SESSION,
+       BPF_TRACE_SESSION,
FSESSION for consistency with FENTRY and FEXIT
        __MAX_BPF_ATTACH_TYPE
 };
[...]
quoted hunk ↗ jump to hunk
 {
-       enum bpf_tramp_prog_type kind;
-       struct bpf_tramp_link *link_exiting;
+       enum bpf_tramp_prog_type kind, okind;
+       struct bpf_tramp_link *link_existing;
+       struct bpf_fsession_link *fslink;
        int err = 0;
        int cnt = 0, i;

-       kind = bpf_attach_type_to_tramp(link->link.prog);
+       okind = kind = bpf_attach_type_to_tramp(link->link.prog);
        if (tr->extension_prog)
                /* cannot attach fentry/fexit if extension prog is attached.
                 * cannot overwrite extension prog either.
@@ -621,13 +624,18 @@ static int __bpf_trampoline_link_prog(struct bpf_tramp_link *link,
                                          BPF_MOD_JUMP, NULL,
                                          link->link.prog->bpf_func);
        }
+       if (kind == BPF_TRAMP_SESSION) {
+               /* deal with fsession as fentry by default */
+               kind = BPF_TRAMP_FENTRY;
+               cnt++;
+       }
this "pretend we are BPF_TRAMP_FENTRY" looks a bit hacky and is very
hard to follow. I think it would be cleaner to have explicit small
special cases for BPF_TRAMP_SESSION, and then generalize
hlist_for_each_entry case by using a local variable for storing
&tr->progs_hlist[kind] (which for TRAMP_SESSION you'll set to
&tr->progs_hlist[BPF_TRAMP_FENTRY]). You'll then just do extra
hlist_add_head/hlist_del_init and count manipulation. IMO, it's better
than keeping in head what kind and okind is...

        if (cnt >= BPF_MAX_TRAMP_LINKS)
                return -E2BIG;
        if (!hlist_unhashed(&link->tramp_hlist))
                /* prog already linked */
                return -EBUSY;
-       hlist_for_each_entry(link_exiting, &tr->progs_hlist[kind], tramp_hlist) {
-               if (link_exiting->link.prog != link->link.prog)
+       hlist_for_each_entry(link_existing, &tr->progs_hlist[kind], tramp_hlist) {
+               if (link_existing->link.prog != link->link.prog)
                        continue;
                /* prog already linked */
                return -EBUSY;
[...]
quoted hunk ↗ jump to hunk
@@ -23298,6 +23299,7 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
                if (prog_type == BPF_PROG_TYPE_TRACING &&
                    insn->imm == BPF_FUNC_get_func_ret) {
                        if (eatype == BPF_TRACE_FEXIT ||
+                           eatype == BPF_TRACE_SESSION ||
                            eatype == BPF_MODIFY_RETURN) {
                                /* Load nr_args from ctx - 8 */
                                insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
@@ -24242,7 +24244,8 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,
                if (tgt_prog->type == BPF_PROG_TYPE_TRACING &&
                    prog_extension &&
                    (tgt_prog->expected_attach_type == BPF_TRACE_FENTRY ||
-                    tgt_prog->expected_attach_type == BPF_TRACE_FEXIT)) {
+                    tgt_prog->expected_attach_type == BPF_TRACE_FEXIT ||
+                    tgt_prog->expected_attach_type == BPF_TRACE_SESSION)) {
                        /* Program extensions can extend all program types
                         * except fentry/fexit. The reason is the following.
                         * The fentry/fexit programs are used for performance
@@ -24257,7 +24260,7 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,
                         * beyond reasonable stack size. Hence extending fentry
                         * is not allowed.
                         */
-                       bpf_log(log, "Cannot extend fentry/fexit\n");
+                       bpf_log(log, "Cannot extend fentry/fexit/session\n");
fsession?
quoted hunk ↗ jump to hunk
                        return -EINVAL;
                }
        } else {
@@ -24341,6 +24344,7 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,
        case BPF_LSM_CGROUP:
        case BPF_TRACE_FENTRY:
        case BPF_TRACE_FEXIT:
+       case BPF_TRACE_SESSION:
                if (!btf_type_is_func(t)) {
                        bpf_log(log, "attach_btf_id %u is not a function\n",
                                btf_id);
[...]
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help