[RFC PATCH bpf-next v2 0/2] ftrace: deprecate the ftrace_enabled disable switch

[RFC PATCH bpf-next v2 0/2] ftrace: deprecate the ftrace_enabled disable switch

[Andrey Grodzovsky]

This adresses a long-standing issue: kernel.ftrace_enabled=0 silently
disables BPF trampolines (fentry/fexit) and ftrace-based
kprobes/kretprobes. The write succeeds, the hook stops firing with no
error, and re-enabling silently restores it.

The solution chosen is to deny setting this knob to 0 from userspace,
thus preventing this case in the first place. Steven mentioned that the
switch became effectively useless and doesn't serve any meaningful
purpose anymore, and only creates problems for systems that rely on
ftrace, such as Livepatching and eBPF. Any attempt to set it to 0 will
fail with -EOPNOTSUPP. Reading and writing 1 remain unchanged.

Patch 1: the sysctl change plus a doc note.
Patch 2: updates the one selftest that relied on the old disable
behavior.


Changes since v1 :
  - test-ftrace.sh: keep the full original disable/reload scenario on
    kernels where kernel.ftrace_enabled=0 still works, and only fall
    back to the simple "write is refused" check on kernels that
    deprecate the knob.(Steven)

[1] https://lore.kernel.org/bpf/20260730163544.2042327-1-andrey.grodzovsky@crowdstrike.com/

Andrey Grodzovsky (2):
  ftrace: deprecate disabling via ftrace_enabled sysctl
  selftests/livepatch: update test-ftrace.sh for deprecated
    ftrace_enabled

 Documentation/trace/ftrace.rst                |  5 +++
 kernel/trace/ftrace.c                         | 19 ++++----
 .../testing/selftests/livepatch/functions.sh  | 13 ++++++
 .../selftests/livepatch/test-ftrace.sh        | 45 ++++++++++++-------
 4 files changed, 54 insertions(+), 28 deletions(-)

-- 
2.34.1

[RFC PATCH bpf-next v2 1/2] ftrace: deprecate disabling via ftrace_enabled sysctl

[Andrey Grodzovsky]

Writing 0 to kernel.ftrace_enabled has not reliably disabled ftrace
for years (FTRACE_OPS_FL_PERMANENT users already block it, and more
callers rely on ftrace always being on). Refuse the write instead of
leaving it in an inconsistent "disables some, not all" state: return
-EOPNOTSUPP and log a message. Reads and enabling (writing 1) are
unaffected.

Update the docs to note the deprecation up front.

Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
---
 Documentation/trace/ftrace.rst |  5 +++++
 kernel/trace/ftrace.c          | 19 ++++++++-----------
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/Documentation/trace/ftrace.rst b/Documentation/trace/ftrace.rst
index 84f06bf0da9b..7261f25f8b4b 100644
--- a/Documentation/trace/ftrace.rst
+++ b/Documentation/trace/ftrace.rst
@@ -3313,6 +3313,11 @@ this special filter via::
 ftrace_enabled
 --------------
 
+.. note::
+   Disabling ftrace via this switch is deprecated. Writing 0 is refused
+   with -EOPNOTSUPP and logs a warning; writing 1 and reading the value
+   are unaffected.
+
 Note, the proc sysctl ftrace_enable is a big on/off switch for the
 function tracer. By default it is enabled (when function tracing is
 enabled in the kernel). If it is disabled, all function tracing is
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index f93e34dd2328..82bb7356ccce 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -9357,7 +9357,7 @@ static void ftrace_startup_sysctl(void)
 	}
 }
 
-static void ftrace_shutdown_sysctl(void)
+static void __maybe_unused ftrace_shutdown_sysctl(void)
 {
 	int command;
 
@@ -9377,7 +9377,7 @@ static void ftrace_shutdown_sysctl(void)
 # define ftrace_shutdown_sysctl()      do { } while (0)
 #endif /* CONFIG_DYNAMIC_FTRACE */
 
-static bool is_permanent_ops_registered(void)
+static bool __maybe_unused is_permanent_ops_registered(void)
 {
 	struct ftrace_ops *op;
 
@@ -9415,15 +9415,12 @@ ftrace_enable_sysctl(const struct ctl_table *table, int write,
 		ftrace_startup_sysctl();
 
 	} else {
-		if (is_permanent_ops_registered()) {
-			ftrace_enabled = true;
-			return -EBUSY;
-		}
-
-		/* stopping ftrace calls (just send to ftrace_stub) */
-		ftrace_trace_function = ftrace_stub;
-
-		ftrace_shutdown_sysctl();
+		/*
+		 * Disabling ftrace at runtime via this knob is deprecated.
+		 */
+		ftrace_enabled = true;
+		pr_warn_once("The ftrace_enabled file is deprecated and no longer disables ftrace\n");
+		return -EOPNOTSUPP;
 	}
 
 	last_ftrace_enabled = !!ftrace_enabled;
-- 
2.34.1

Re: [RFC PATCH bpf-next v2 1/2] ftrace: deprecate disabling via ftrace_enabled sysctl

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] The patch breaks livepatch kselftests by deprecating and rejecting writes to kernel.ftrace_enabled without updating the corresponding tests.
- [Low] Unused static functions `ftrace_shutdown_sysctl` and `is_permanent_ops_registered` were retained and marked with `__maybe_unused` instead of being properly removed.
--

--- Patch [1]: [RFC PATCH bpf-next v2 1/2] ftrace: deprecate disabling via ftrace_enabled sysctl ---
commit 6675b51e1176bc76210101b0a6a9da0c7a32dc59
Author: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>

ftrace: deprecate disabling via ftrace_enabled sysctl

This commit deprecates disabling ftrace via the kernel.ftrace_enabled
sysctl. It refuses writes of 0 by returning -EOPNOTSUPP and logging a
warning, rather than leaving the system in an inconsistent state.

> diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
> index f93e34dd23288..82bb7356ccce5 100644
> --- a/kernel/trace/ftrace.c
> +++ b/kernel/trace/ftrace.c
> @@ -9357,7 +9357,7 @@ static void ftrace_startup_sysctl(void)
>  	}
>  }
>  
> -static void ftrace_shutdown_sysctl(void)
> +static void __maybe_unused ftrace_shutdown_sysctl(void)

[Severity: Low]
Since the only caller of ftrace_shutdown_sysctl() has been removed by this
patch, should this function be deleted entirely rather than kept around with
a __maybe_unused annotation?

>  {
>  	int command;

[ ... ]

> @@ -9377,7 +9377,7 @@ static void ftrace_shutdown_sysctl(void)
>  # define ftrace_shutdown_sysctl()      do { } while (0)
>  #endif /* CONFIG_DYNAMIC_FTRACE */
>  
> -static bool is_permanent_ops_registered(void)
> +static bool __maybe_unused is_permanent_ops_registered(void)

[Severity: Low]
Similarly, is_permanent_ops_registered() appears to be completely dead code
now. Can this be safely removed instead of marking it __maybe_unused?

>  {
>  	struct ftrace_ops *op;

[ ... ]

> @@ -9415,15 +9415,12 @@ ftrace_enable_sysctl(const struct ctl_table *table, int write,
>  		ftrace_startup_sysctl();
>  
>  	} else {
> -		if (is_permanent_ops_registered()) {
> -			ftrace_enabled = true;
> -			return -EBUSY;
> -		}
> -
> -		/* stopping ftrace calls (just send to ftrace_stub) */
> -		ftrace_trace_function = ftrace_stub;
> -
> -		ftrace_shutdown_sysctl();
> +		/*
> +		 * Disabling ftrace at runtime via this knob is deprecated.
> +		 */
> +		ftrace_enabled = true;
> +		pr_warn_once("The ftrace_enabled file is deprecated and no longer disables ftrace\n");
> +		return -EOPNOTSUPP;

[Severity: Medium]
Will rejecting writes of 0 here break the livepatch kselftests?

Looking at tools/testing/selftests/livepatch/test-ftrace.sh, the scripts
explicitly toggle this sysctl and expect either success or an -EBUSY error
when a livepatch is active:

tools/testing/selftests/livepatch/test-ftrace.sh:
    set_ftrace_enabled 0
    load_failing_mod $MOD_LIVEPATCH
    ...
    # Check that ftrace could not get disabled when a livepatch is enabled
    set_ftrace_enabled --fail 0

Now that this returns -EOPNOTSUPP unconditionally, it looks like these
tests will fail or be skipped. Do the livepatch kselftests need to be
updated alongside this change?

>  	}
>  
>  	last_ftrace_enabled = !!ftrace_enabled;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260731175358.3542156-1-andrey.grodzovsky@crowdstrike.com?part=1

[RFC PATCH bpf-next v2 2/2] selftests/livepatch: update test-ftrace.sh for deprecated ftrace_enabled

[Andrey Grodzovsky]

kernel.ftrace_enabled=0 is now refused on kernels that deprecate the
knob, so the old disable/reload flow no longer applies there. Probe
for this with ftrace_disable_supported() and keep the full original
scenario (disable, fail to load a livepatch, re-enable, load, confirm
disable is refused while loaded) on kernels where it still works;
otherwise just confirm the write is refused.

Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Suggested-by: Miroslav Benes <mbenes@suse.cz>
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
---
 .../testing/selftests/livepatch/functions.sh  | 13 ++++++
 .../selftests/livepatch/test-ftrace.sh        | 45 ++++++++++++-------
 2 files changed, 41 insertions(+), 17 deletions(-)

diff --git a/tools/testing/selftests/livepatch/functions.sh b/tools/testing/selftests/livepatch/functions.sh
index 30dc677b2f45..7fa4bda70221 100644
--- a/tools/testing/selftests/livepatch/functions.sh
+++ b/tools/testing/selftests/livepatch/functions.sh
@@ -126,6 +126,19 @@ function set_ftrace_enabled() {
 	echo "livepatch: kernel.ftrace_enabled = $result" > /dev/kmsg
 }
 
+# ftrace_disable_supported() - probe whether kernel.ftrace_enabled=0
+#	can still disable ftrace on this kernel. Newer kernels deprecate
+#	the knob and always refuse the write with -EOPNOTSUPP.
+function ftrace_disable_supported() {
+	local result
+
+	sysctl -q kernel.ftrace_enabled=0 &> /dev/null
+	result=$(sysctl --values kernel.ftrace_enabled)
+	sysctl -q kernel.ftrace_enabled=1 &> /dev/null
+
+	[[ "$result" == "0" ]]
+}
+
 function cleanup() {
 	pop_config
 }
diff --git a/tools/testing/selftests/livepatch/test-ftrace.sh b/tools/testing/selftests/livepatch/test-ftrace.sh
index d2c3dea63104..cd27148510f8 100755
--- a/tools/testing/selftests/livepatch/test-ftrace.sh
+++ b/tools/testing/selftests/livepatch/test-ftrace.sh
@@ -12,29 +12,32 @@ setup_config
 # - turn ftrace_enabled OFF and verify livepatches can't load
 # - turn ftrace_enabled ON and verify livepatch can load
 # - verify that ftrace_enabled can't be turned OFF while a livepatch is loaded
+# (skipped on kernels where the sysctl is deprecated and always refuses 0)
 
 start_test "livepatch interaction with ftrace_enabled sysctl"
 
-set_ftrace_enabled 0
-load_failing_mod $MOD_LIVEPATCH
+if ftrace_disable_supported; then
 
-set_ftrace_enabled 1
-load_lp $MOD_LIVEPATCH
-if [[ "$(cat /proc/cmdline)" != "$MOD_LIVEPATCH: this has been live patched" ]] ; then
-	echo -e "FAIL\n\n"
-	die "livepatch kselftest(s) failed"
-fi
+	set_ftrace_enabled 0
+	load_failing_mod $MOD_LIVEPATCH
 
-# Check that ftrace could not get disabled when a livepatch is enabled
-set_ftrace_enabled --fail 0
-if [[ "$(cat /proc/cmdline)" != "$MOD_LIVEPATCH: this has been live patched" ]] ; then
-	echo -e "FAIL\n\n"
-	die "livepatch kselftest(s) failed"
-fi
-disable_lp $MOD_LIVEPATCH
-unload_lp $MOD_LIVEPATCH
+	set_ftrace_enabled 1
+	load_lp $MOD_LIVEPATCH
+	if [[ "$(cat /proc/cmdline)" != "$MOD_LIVEPATCH: this has been live patched" ]] ; then
+		echo -e "FAIL\n\n"
+		die "livepatch kselftest(s) failed"
+	fi
 
-check_result "livepatch: kernel.ftrace_enabled = 0
+	# Check that ftrace could not get disabled when a livepatch is enabled
+	set_ftrace_enabled --fail 0
+	if [[ "$(cat /proc/cmdline)" != "$MOD_LIVEPATCH: this has been live patched" ]] ; then
+		echo -e "FAIL\n\n"
+		die "livepatch kselftest(s) failed"
+	fi
+	disable_lp $MOD_LIVEPATCH
+	unload_lp $MOD_LIVEPATCH
+
+	check_result "livepatch: kernel.ftrace_enabled = 0
 % insmod test_modules/$MOD_LIVEPATCH.ko
 livepatch: enabling patch '$MOD_LIVEPATCH'
 livepatch: '$MOD_LIVEPATCH': initializing patching transition
@@ -60,6 +63,14 @@ livepatch: '$MOD_LIVEPATCH': completing unpatching transition
 livepatch: '$MOD_LIVEPATCH': unpatching complete
 % rmmod $MOD_LIVEPATCH"
 
+else
+
+	set_ftrace_enabled --fail 0
+	check_result "livepatch: sysctl: setting key \"kernel.ftrace_enabled\": \
+Operation not supported"
+
+fi
+
 
 # - verify livepatch can load
 # - check if traces have a patched function
-- 
2.34.1