Re: [PATCH bpf-next v4 7/9] libbpf: add support for tracing session

[Menglong Dong <menglong.dong@linux.dev>]

On 2025/12/19 08:55 Andrii Nakryiko <andrii.nakryiko@gmail.com> write:
> On Wed, Dec 17, 2025 at 1:55 AM Menglong Dong <menglong8.dong@gmail.com> wrote:
> >
> > Add BPF_TRACE_SESSION to libbpf and bpftool.
> >
> > Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
> > ---
> >  tools/bpf/bpftool/common.c | 1 +
> >  tools/lib/bpf/bpf.c        | 2 ++
> >  tools/lib/bpf/libbpf.c     | 3 +++
> >  3 files changed, 6 insertions(+)
> >
> > diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
> > index e8daf963ecef..534be6cfa2be 100644
> > --- a/tools/bpf/bpftool/common.c
> > +++ b/tools/bpf/bpftool/common.c
> > @@ -1191,6 +1191,7 @@ const char *bpf_attach_type_input_str(enum bpf_attach_type t)
> >         case BPF_TRACE_FENTRY:                  return "fentry";
> >         case BPF_TRACE_FEXIT:                   return "fexit";
> >         case BPF_MODIFY_RETURN:                 return "mod_ret";
> > +       case BPF_TRACE_SESSION:                 return "fsession";
> >         case BPF_SK_REUSEPORT_SELECT:           return "sk_skb_reuseport_select";
> >         case BPF_SK_REUSEPORT_SELECT_OR_MIGRATE:        return "sk_skb_reuseport_select_or_migrate";
> >         default:        return libbpf_bpf_attach_type_str(t);
> > diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
> > index 21b57a629916..5042df4a5df7 100644
> > --- a/tools/lib/bpf/bpf.c
> > +++ b/tools/lib/bpf/bpf.c
> > @@ -794,6 +794,7 @@ int bpf_link_create(int prog_fd, int target_fd,
> >         case BPF_TRACE_FENTRY:
> >         case BPF_TRACE_FEXIT:
> >         case BPF_MODIFY_RETURN:
> > +       case BPF_TRACE_SESSION:
> >         case BPF_LSM_MAC:
> >                 attr.link_create.tracing.cookie = OPTS_GET(opts, tracing.cookie, 0);
> >                 if (!OPTS_ZEROED(opts, tracing))
> > @@ -917,6 +918,7 @@ int bpf_link_create(int prog_fd, int target_fd,
> >         case BPF_TRACE_FENTRY:
> >         case BPF_TRACE_FEXIT:
> >         case BPF_MODIFY_RETURN:
> > +       case BPF_TRACE_SESSION:
> 
> no need, this is a legacy fallback path for programs that were (at
> some point for older kernels) attachable only through
> BPF_RAW_TRACEPOINT_OPEN. BPF_LINK_CREATE is sufficient, drop this
> line.

OK, I see.

> 
> >                 return bpf_raw_tracepoint_open(NULL, prog_fd);
> >         default:
> >                 return libbpf_err(err);
> > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> > index c7c79014d46c..0c095195df31 100644
> > --- a/tools/lib/bpf/libbpf.c
> > +++ b/tools/lib/bpf/libbpf.c
> > @@ -115,6 +115,7 @@ static const char * const attach_type_name[] = {
> >         [BPF_TRACE_FENTRY]              = "trace_fentry",
> >         [BPF_TRACE_FEXIT]               = "trace_fexit",
> >         [BPF_MODIFY_RETURN]             = "modify_return",
> > +       [BPF_TRACE_SESSION]             = "trace_session",
> 
> let's use fsession terminology consistently

OK, so we will use "trace_fsession" here.

Thanks!
Menglong Dong

> 
> 
> >         [BPF_LSM_MAC]                   = "lsm_mac",
> >         [BPF_LSM_CGROUP]                = "lsm_cgroup",
> >         [BPF_SK_LOOKUP]                 = "sk_lookup",
> > @@ -9853,6 +9854,8 @@ static const struct bpf_sec_def section_defs[] = {
> >         SEC_DEF("fentry.s+",            TRACING, BPF_TRACE_FENTRY, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
> >         SEC_DEF("fmod_ret.s+",          TRACING, BPF_MODIFY_RETURN, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
> >         SEC_DEF("fexit.s+",             TRACING, BPF_TRACE_FEXIT, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
> > +       SEC_DEF("fsession+",            TRACING, BPF_TRACE_SESSION, SEC_ATTACH_BTF, attach_trace),
> > +       SEC_DEF("fsession.s+",          TRACING, BPF_TRACE_SESSION, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
> >         SEC_DEF("freplace+",            EXT, 0, SEC_ATTACH_BTF, attach_trace),
> >         SEC_DEF("lsm+",                 LSM, BPF_LSM_MAC, SEC_ATTACH_BTF, attach_lsm),
> >         SEC_DEF("lsm.s+",               LSM, BPF_LSM_MAC, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_lsm),
> > --
> > 2.52.0
> >
>