On 2025/12/19 08:55 Andrii Nakryiko [off-list ref] write:

On Wed, Dec 17, 2025 at 1:55 AM Menglong Dong [off-list ref] wrote:

quoted

Add BPF_TRACE_SESSION to libbpf and bpftool.

Signed-off-by: Menglong Dong <redacted>
---
 tools/bpf/bpftool/common.c | 1 +
 tools/lib/bpf/bpf.c        | 2 ++
 tools/lib/bpf/libbpf.c     | 3 +++
 3 files changed, 6 insertions(+)

diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index e8daf963ecef..534be6cfa2be 100644
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c

@@ -1191,6 +1191,7 @@ const char *bpf_attach_type_input_str(enum bpf_attach_type t)
        case BPF_TRACE_FENTRY:                  return "fentry";
        case BPF_TRACE_FEXIT:                   return "fexit";
        case BPF_MODIFY_RETURN:                 return "mod_ret";
+       case BPF_TRACE_SESSION:                 return "fsession";
        case BPF_SK_REUSEPORT_SELECT:           return "sk_skb_reuseport_select";
        case BPF_SK_REUSEPORT_SELECT_OR_MIGRATE:        return "sk_skb_reuseport_select_or_migrate";
        default:        return libbpf_bpf_attach_type_str(t);

diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index 21b57a629916..5042df4a5df7 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c

@@ -794,6 +794,7 @@ int bpf_link_create(int prog_fd, int target_fd,
        case BPF_TRACE_FENTRY:
        case BPF_TRACE_FEXIT:
        case BPF_MODIFY_RETURN:
+       case BPF_TRACE_SESSION:
        case BPF_LSM_MAC:
                attr.link_create.tracing.cookie = OPTS_GET(opts, tracing.cookie, 0);
                if (!OPTS_ZEROED(opts, tracing))

@@ -917,6 +918,7 @@ int bpf_link_create(int prog_fd, int target_fd,
        case BPF_TRACE_FENTRY:
        case BPF_TRACE_FEXIT:
        case BPF_MODIFY_RETURN:
+       case BPF_TRACE_SESSION:

no need, this is a legacy fallback path for programs that were (at
some point for older kernels) attachable only through
BPF_RAW_TRACEPOINT_OPEN. BPF_LINK_CREATE is sufficient, drop this
line.

OK, I see.

quoted

                return bpf_raw_tracepoint_open(NULL, prog_fd);
        default:
                return libbpf_err(err);

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index c7c79014d46c..0c095195df31 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c

@@ -115,6 +115,7 @@ static const char * const attach_type_name[] = {
        [BPF_TRACE_FENTRY]              = "trace_fentry",
        [BPF_TRACE_FEXIT]               = "trace_fexit",
        [BPF_MODIFY_RETURN]             = "modify_return",
+       [BPF_TRACE_SESSION]             = "trace_session",

let's use fsession terminology consistently

OK, so we will use "trace_fsession" here.

Thanks!
Menglong Dong

quoted

        [BPF_LSM_MAC]                   = "lsm_mac",
        [BPF_LSM_CGROUP]                = "lsm_cgroup",
        [BPF_SK_LOOKUP]                 = "sk_lookup",

@@ -9853,6 +9854,8 @@ static const struct bpf_sec_def section_defs[] = {
        SEC_DEF("fentry.s+",            TRACING, BPF_TRACE_FENTRY, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
        SEC_DEF("fmod_ret.s+",          TRACING, BPF_MODIFY_RETURN, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
        SEC_DEF("fexit.s+",             TRACING, BPF_TRACE_FEXIT, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
+       SEC_DEF("fsession+",            TRACING, BPF_TRACE_SESSION, SEC_ATTACH_BTF, attach_trace),
+       SEC_DEF("fsession.s+",          TRACING, BPF_TRACE_SESSION, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
        SEC_DEF("freplace+",            EXT, 0, SEC_ATTACH_BTF, attach_trace),
        SEC_DEF("lsm+",                 LSM, BPF_LSM_MAC, SEC_ATTACH_BTF, attach_lsm),
        SEC_DEF("lsm.s+",               LSM, BPF_LSM_MAC, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_lsm),
--

2.52.0