Skip to content

bpf: tracing session supporting #10066

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 10 commits into from
Closed

bpf: tracing session supporting #10066

wants to merge 10 commits into from

Conversation

@kernel-patches-daemon-bpf
Copy link

Pull request for series with
subject: bpf: tracing session supporting
version: 2
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1014394

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: e758657
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1014394
version: 2

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: e758657
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1014394
version: 2

@kernel-patches-review-bot
Copy link 

commit a19e4b3fc15aac4cf9a1f186458064353a8a9525
Author: Menglong Dong <[email protected]>

bpf: add tracing session support

This commit adds BPF tracing session support, allowing a single BPF
program to attach to both entry and exit of target functions. When
fentry returns non-zero, fexit is skipped, similar to kprobe session.

The kernel implementation looks complete, but the userspace tooling
support appears incomplete. Can BPF_TRACE_SESSION programs be loaded
successfully with the current libbpf?

> diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
> index ef0827eb0..fda18988d 100644
> --- a/tools/bpf/bpftool/common.c
> +++ b/tools/bpf/bpftool/common.c
> @@ -1189,6 +1189,7 @@ const char *attach_type_str(enum bpf_attach_type t)
>  	case BPF_TRACE_RAW_TP:			return "raw_tp";
>  	case BPF_TRACE_FENTRY:			return "fentry";
>  	case BPF_TRACE_FEXIT:			return "fexit";
> +	case BPF_TRACE_SESSION:			return "session";

Should this case be added to the switch statement in
attach_type_str()? Without it, bpftool will return a generic string
for BPF_TRACE_SESSION instead of "session".

> diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
> index 6829936d3..79ba3023e 100644
> --- a/tools/include/uapi/linux/bpf.h
> +++ b/tools/include/uapi/linux/bpf.h
> @@ -1133,6 +1133,7 @@ enum bpf_attach_type {
>  	BPF_NETKIT_PEER,
>  	BPF_TRACE_KPROBE_SESSION,
>  	BPF_TRACE_UPROBE_SESSION,
> +	BPF_TRACE_SESSION,
>  	__MAX_BPF_ATTACH_TYPE
>  };
>
> diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
> index abc3724e3..9875bb6d9 100644
> --- a/tools/lib/bpf/bpf.c
> +++ b/tools/lib/bpf/bpf.c
> @@ -793,6 +793,7 @@ int bpf_link_create(int prog_fd, int target_fd,
>  		break;
>  	case BPF_TRACE_RAW_TP:
>  	case BPF_TRACE_FENTRY:
>  	case BPF_TRACE_FEXIT:
> +	case BPF_TRACE_SESSION:
>  	case BPF_MODIFY_RETURN:
>  	case BPF_LSM_MAC:

Should BPF_TRACE_SESSION be added here? Without this case, the tracing
cookie won't be properly set for session programs in bpf_link_create().

> @@ -915,6 +916,7 @@ int bpf_prog_attach(int prog_fd, int target_fd, enum bpf_attach_type attach_typ
>  	case BPF_LSM_MAC:
>  	case BPF_TRACE_FENTRY:
>  	case BPF_TRACE_FEXIT:
> +	case BPF_TRACE_SESSION:
>  	case BPF_MODIFY_RETURN:

Is BPF_TRACE_SESSION missing from this switch in bpf_prog_attach()?
Without it, the function will hit the default case and return an error
instead of calling bpf_raw_tracepoint_open().

> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 9d0178043..16d4b94eb 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -113,6 +113,7 @@ static const char * const attach_type_name[] = {
>  	[BPF_FLOW_DISSECTOR]		= "flow_dissector",
>  	[BPF_TRACE_RAW_TP]		= "trace_raw_tp",
>  	[BPF_TRACE_FENTRY]		= "trace_fentry",
>  	[BPF_TRACE_FEXIT]		= "trace_fexit",
> +	[BPF_TRACE_SESSION]		= "trace_session",
>  	[BPF_MODIFY_RETURN]		= "modify_return",

Should this entry be added to attach_type_name[]? Without it,
libbpf_bpf_attach_type_str() will return NULL for BPF_TRACE_SESSION.

> @@ -9606,6 +9607,8 @@ static const struct bpf_sec_def section_defs[] = {
>  	SEC_DEF("fmod_ret+",		TRACING, BPF_MODIFY_RETURN, SEC_ATTACH_BTF, attach_trace),
>  	SEC_DEF("fexit+",		TRACING, BPF_TRACE_FEXIT, SEC_ATTACH_BTF, attach_trace),
>  	SEC_DEF("fentry.s+",		TRACING, BPF_TRACE_FENTRY, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
> +	SEC_DEF("session+",		TRACING, BPF_TRACE_SESSION, SEC_ATTACH_BTF, attach_trace),
> +	SEC_DEF("session.s+",		TRACING, BPF_TRACE_SESSION, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
>  	SEC_DEF("fmod_ret.s+",		TRACING, BPF_MODIFY_RETURN, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),

Should SEC_DEF entries for "session+" and "session.s+" be added here?
Following the pattern of fentry/fexit, users would expect to use
SEC("session/func_name") in their BPF programs. Without these
definitions, programs using this annotation won't be recognized.

AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

In-Reply-To-Subject: bpf: add tracing session support
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/18709732882

@kernel-patches-daemon-bpf
Copy link
Author

Forwarding comment 3431079584 via email
In-Reply-To: [email protected]
Patch: https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: e758657
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1014394
version: 2

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: e758657
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1014394
version: 2

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: e758657
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1014394
version: 2

@image-dragon
bpf: add tracing session support
08d08ba 
The tracing session is something that similar to kprobe session. It allow
to attach a single BPF program to both the entry and the exit of the
target functions.

While a non-zero value is returned by the fentry, the fexit will be
skipped, which is similar to kprobe session.

Signed-off-by: Menglong Dong <[email protected]>
Co-developed-by: Leon Hwang <[email protected]>
Signed-off-by: Leon Hwang <[email protected]>
@image-dragon
bpf: add kfunc bpf_tracing_is_exit for TRACE_SESSION
f36eebe 
If TRACE_SESSION exists, we will use extra 8-bytes in the stack of the
trampoline to store the flags that we needed, and the 8-bytes lie after
the return value, which means ctx[nr_args + 1]. And we will store the
flag "is_exit" to the first bit of it.

Introduce the kfunc bpf_tracing_is_exit(), which is used to tell if it
is fexit currently. Meanwhile, inline it in the verifier.

Signed-off-by: Menglong Dong <[email protected]>
Co-developed-by: Leon Hwang <[email protected]>
Signed-off-by: Leon Hwang <[email protected]>
@image-dragon
bpf: add kfunc bpf_fsession_cookie for TRACING SESSION
25fbf13 
Add the kfunc bpf_fsession_cookie(), which is similar to
bpf_session_cookie() and return the address of the session cookie. The
address of the session cookie is stored after session flags, which means
ctx[nr_args + 2].

Inline this kfunc in the verifier too.

Signed-off-by: Menglong Dong <[email protected]>
@image-dragon
bpf,x86: add ret_off to invoke_bpf()
91ea3c2 
For now, the offset of the return value in trampoline is fixed 8-bytes.
In this commit, we introduce the variable "ret_off" to represent the
offset of the return value. For now, the "ret_off" is just 8. And in the
following patch, we will make it something else to use the room after it.

Signed-off-by: Menglong Dong <[email protected]>
@image-dragon
bpf,x86: add tracing session supporting for x86_64
0417cf3 
Add BPF_TRACE_SESSION supporting to x86_64. invoke_bpf_session_entry and
invoke_bpf_session_exit is introduced for this purpose.

In invoke_bpf_session_entry(), we will check if the return value of the
fentry is 0, and set the corresponding session flag if not. And in
invoke_bpf_session_exit(), we will check if the corresponding flag is
set. If set, the fexit will be skipped.

As designed, the session flags and session cookie address is stored after
the return value, and the stack look like this:

  cookie ptr	-> 8 bytes
  session flags	-> 8 bytes
  return value	-> 8 bytes
  argN		-> 8 bytes
  ...
  arg1		-> 8 bytes
  nr_args	-> 8 bytes
  ...
  cookieN	-> 8 bytes
  cookie1	-> 8 bytes

In the entry of the session, we will clear the return value, so the fentry
will always get 0 with ctx[nr_args] or bpf_get_func_ret().

Before the execution of the BPF prog, the "cookie ptr" will be filled with
the corresponding cookie address, which is done in
invoke_bpf_session_entry() and invoke_bpf_session_exit().

Signed-off-by: Menglong Dong <[email protected]>
Co-developed-by: Leon Hwang <[email protected]>
Signed-off-by: Leon Hwang <[email protected]>
@image-dragon
libbpf: add support for tracing session
78d54a4 
Add BPF_TRACE_SESSION to libbpf and bpftool.

Signed-off-by: Menglong Dong <[email protected]>
@image-dragon
selftests/bpf: test get_func_ip for fsession
4559798 
As the layout of the stack changed for fsession, we'd better test
bpf_get_func_ip() for it.

Signed-off-by: Menglong Dong <[email protected]>
@image-dragon
selftests/bpf: add testcases for tracing session
274c22b 
Add testcases for BPF_TRACE_SESSION.

Signed-off-by: Menglong Dong <[email protected]>
@image-dragon
selftests/bpf: add session cookie testcase for fsession
df28484 
Test the session cookie for fsession. Multiple fsession BPF progs is
attached to bpf_fentry_test1() and session cookie is read and write in
this testcase.

Signed-off-by: Menglong Dong <[email protected]>
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: e758657
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1014394
version: 2

@image-dragon
selftests/bpf: add testcase for mixing fsession, fentry and fexit
706b875 
Test the fsession when it is used together with fentry, fexit.

Signed-off-by: Menglong Dong <[email protected]>
@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot deleted the series/1014394=>bpf-next branch October 28, 2025 10:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bpf-next new V2-ci-fail V2

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@image-dragon