[PATCH bpf-next v3 0/4] bpf: Add support for sleepable raw tracepoint programs

[PATCH bpf-next v3 0/4] bpf: Add support for sleepable raw tracepoint programs

[Mykyta Yatsenko]

This series adds support for sleepable BPF programs attached to raw
tracepoints (tp_btf). The motivation is to allow BPF programs on
syscall tracepoints to use sleepable helpers such as
bpf_copy_from_user(), enabling reliable user memory reads that can
page-fault.

Currently, raw tracepoint BPF programs always run with RCU read lock
held inside __bpf_trace_run(), which prevents calling any helper that
might sleep. Faultable tracepoints (__DECLARE_TRACE_SYSCALL) already
run under rcu_tasks_trace protection in process context where sleeping
is safe.

This series removes that restriction for faultable tracepoints:

Patch 1 modifies __bpf_trace_run() to support sleepable programs:
use migrate_disable() for per-CPU data protection on both paths,
adding rcu_read_lock() only for non-sleepable programs. For sleepable
programs, call might_fault() to annotate faultable context and rely
on the outer rcu_tasks_trace lock from the faultable tracepoint
callback for program lifetime protection. Also removes
preempt_disable from the faultable tracepoint BPF callback wrapper,
since per-CPU protection and RCU locking are now managed per-program
inside __bpf_trace_run().

Patch 2 allows BPF_TRACE_RAW_TP programs to be loaded as sleepable,
and adds a load-time check in bpf_check_attach_target() to reject
sleepable programs targeting non-faultable tracepoints with a
verifier error message.

Patch 3 adds the tp_btf.s section handler in libbpf, following the
existing pattern of fentry.s/fexit.s/lsm.s.

Patch 4 adds selftests covering both the positive case (sleepable
program on sys_enter using bpf_copy_from_user() to read user memory)
and the negative case (sleepable program rejected on sched_switch
at load time via RUN_TESTS).

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
---
Changes in v3:
  - Moved faultable tracepoint check from attach time to load time in
    bpf_check_attach_target(), providing a clear verifier error message
  - Removed cant_sleep() call from non-sleepable path in
    __bpf_trace_run()
  - Folded preempt_disable removal into the sleepable execution path
    patch
  - Used RUN_TESTS() with __failure/__msg for negative test case instead
    of explicit userspace program
  - Reduced series from 6 patches to 4
  - Link to v2: https://lore.kernel.org/r/20260225-sleepable_tracepoints-v2-0-0330dafd650f@meta.com

Changes in v2:
  - Address AI review points - modified the order of the patches
  - Link to v1: https://lore.kernel.org/bpf/20260218-sleepable_tracepoints-v1-0-ec2705497208@meta.com/

---
Mykyta Yatsenko (4):
      bpf: Add sleepable execution path for raw tracepoint programs
      bpf: Verifier support for sleepable raw tracepoint programs
      libbpf: Add tp_btf.s section handler for sleepable raw tracepoints
      selftests/bpf: Add tests for sleepable raw tracepoint programs

 include/trace/bpf_probe.h                          |  2 -
 kernel/bpf/verifier.c                              |  9 ++++-
 kernel/trace/bpf_trace.c                           | 13 +++++--
 tools/lib/bpf/libbpf.c                             |  1 +
 .../selftests/bpf/prog_tests/sleepable_raw_tp.c    | 40 ++++++++++++++++++++
 .../selftests/bpf/progs/test_sleepable_raw_tp.c    | 43 ++++++++++++++++++++++
 .../bpf/progs/test_sleepable_raw_tp_fail.c         | 18 +++++++++
 tools/testing/selftests/bpf/verifier/sleepable.c   | 17 ++++++++-
 8 files changed, 135 insertions(+), 8 deletions(-)
---
base-commit: bd2e02e3c9215305dfa344c050d5822f19929cf7
change-id: 20260216-sleepable_tracepoints-381ae1410550

Best regards,
-- 
Mykyta Yatsenko <yatsenko@meta.com>

[PATCH bpf-next v3 1/4] bpf: Add sleepable execution path for raw tracepoint programs

[Mykyta Yatsenko]

From: Mykyta Yatsenko <yatsenko@meta.com>

Modify __bpf_trace_run() to support both sleepable and non-sleepable
BPF programs. When the program is sleepable:

- Call might_fault() to annotate the faultable context
- Use migrate_disable()/migrate_enable() instead of
  rcu_read_lock()/rcu_read_unlock() to allow sleeping while
  still protecting percpu data access
- The outer rcu_tasks_trace lock is already held by the faultable
  tracepoint callback (__DECLARE_TRACE_SYSCALL), providing lifetime
  protection for the BPF program

For non-sleepable programs, rcu_read_lock_dont_migrate() is replaced
with explicit migrate_disable()/rcu_read_lock() pairing.

Remove preempt_disable_notrace()/preempt_enable_notrace() from
__BPF_DECLARE_TRACE_SYSCALL. Per-CPU protection and RCU locking are
now managed per-program inside __bpf_trace_run().

Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
---
 include/trace/bpf_probe.h |  2 --
 kernel/trace/bpf_trace.c  | 13 ++++++++++---
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/include/trace/bpf_probe.h b/include/trace/bpf_probe.h
index 9391d54d3f12..d1de8f9aa07f 100644
--- a/include/trace/bpf_probe.h
+++ b/include/trace/bpf_probe.h
@@ -58,9 +58,7 @@ static notrace void							\
 __bpf_trace_##call(void *__data, proto)					\
 {									\
 	might_fault();							\
-	preempt_disable_notrace();					\
 	CONCATENATE(bpf_trace_run, COUNT_ARGS(args))(__data, CAST_TO_U64(args));	\
-	preempt_enable_notrace();					\
 }
 
 #undef DECLARE_EVENT_SYSCALL_CLASS
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 0b040a417442..3688a7e115d1 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2076,7 +2076,7 @@ void __bpf_trace_run(struct bpf_raw_tp_link *link, u64 *args)
 	struct bpf_run_ctx *old_run_ctx;
 	struct bpf_trace_run_ctx run_ctx;
 
-	rcu_read_lock_dont_migrate();
+	migrate_disable();
 	if (unlikely(!bpf_prog_get_recursion_context(prog))) {
 		bpf_prog_inc_misses_counter(prog);
 		goto out;
@@ -2085,12 +2085,19 @@ void __bpf_trace_run(struct bpf_raw_tp_link *link, u64 *args)
 	run_ctx.bpf_cookie = link->cookie;
 	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
 
-	(void) bpf_prog_run(prog, args);
+	if (prog->sleepable) {
+		might_fault();
+		(void)bpf_prog_run(prog, args);
+	} else {
+		rcu_read_lock();
+		(void)bpf_prog_run(prog, args);
+		rcu_read_unlock();
+	}
 
 	bpf_reset_run_ctx(old_run_ctx);
 out:
 	bpf_prog_put_recursion_context(prog);
-	rcu_read_unlock_migrate();
+	migrate_enable();
 }
 
 #define UNPACK(...)			__VA_ARGS__

-- 
2.52.0

[PATCH bpf-next v3 2/4] bpf: Verifier support for sleepable raw tracepoint programs

[Mykyta Yatsenko]

From: Mykyta Yatsenko <yatsenko@meta.com>

Add BPF_TRACE_RAW_TP to the set of tracing program attach types
that can be loaded as sleepable in can_be_sleepable().

Reject sleepable programs that target non-faultable tracepoints
at load time in bpf_check_attach_target(), providing a clear
verifier error message.

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
---
 kernel/bpf/verifier.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8e4f69918693..95b33b85698f 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -25216,6 +25216,12 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,
 		btp = bpf_get_raw_tracepoint(tname);
 		if (!btp)
 			return -EINVAL;
+		if (prog->sleepable && !tracepoint_is_faultable(btp->tp)) {
+			bpf_log(log, "Sleepable program cannot attach to non-faultable tracepoint %s\n",
+				tname);
+			bpf_put_raw_tracepoint(btp);
+			return -EINVAL;
+		}
 		fname = kallsyms_lookup((unsigned long)btp->bpf_func, NULL, NULL, NULL,
 					trace_symbol);
 		bpf_put_raw_tracepoint(btp);
@@ -25432,6 +25438,7 @@ static bool can_be_sleepable(struct bpf_prog *prog)
 		case BPF_MODIFY_RETURN:
 		case BPF_TRACE_ITER:
 		case BPF_TRACE_FSESSION:
+		case BPF_TRACE_RAW_TP:
 			return true;
 		default:
 			return false;
@@ -25461,7 +25468,7 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)
 	}
 
 	if (prog->sleepable && !can_be_sleepable(prog)) {
-		verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable\n");
+		verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, struct_ops, and raw_tp programs can be sleepable\n");
 		return -EINVAL;
 	}
 

-- 
2.52.0

[PATCH bpf-next v3 3/4] libbpf: Add tp_btf.s section handler for sleepable raw tracepoints

[Mykyta Yatsenko]

From: Mykyta Yatsenko <yatsenko@meta.com>

Add SEC_DEF for "tp_btf.s+" section prefix, enabling userspace BPF
programs to use SEC("tp_btf.s/<tracepoint>") to load sleepable raw
tracepoint programs. This follows the existing pattern used for
fentry.s, fexit.s, fmod_ret.s, and lsm.s section definitions.

Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
---
 tools/lib/bpf/libbpf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 0662d72bad20..7b65869f5c8e 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -9863,6 +9863,7 @@ static const struct bpf_sec_def section_defs[] = {
 	SEC_DEF("raw_tracepoint.w+",	RAW_TRACEPOINT_WRITABLE, 0, SEC_NONE, attach_raw_tp),
 	SEC_DEF("raw_tp.w+",		RAW_TRACEPOINT_WRITABLE, 0, SEC_NONE, attach_raw_tp),
 	SEC_DEF("tp_btf+",		TRACING, BPF_TRACE_RAW_TP, SEC_ATTACH_BTF, attach_trace),
+	SEC_DEF("tp_btf.s+",		TRACING, BPF_TRACE_RAW_TP, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
 	SEC_DEF("fentry+",		TRACING, BPF_TRACE_FENTRY, SEC_ATTACH_BTF, attach_trace),
 	SEC_DEF("fmod_ret+",		TRACING, BPF_MODIFY_RETURN, SEC_ATTACH_BTF, attach_trace),
 	SEC_DEF("fexit+",		TRACING, BPF_TRACE_FEXIT, SEC_ATTACH_BTF, attach_trace),

-- 
2.52.0

[PATCH bpf-next v3 4/4] selftests/bpf: Add tests for sleepable raw tracepoint programs

[Mykyta Yatsenko]

From: Mykyta Yatsenko <yatsenko@meta.com>

Add tests for sleepable raw tracepoint programs:
- success: Attach a sleepable BPF program to the faultable sys_enter
  tracepoint (tp_btf.s/sys_enter). Verify the program is triggered by
  a syscall.
- reject_non_faultable: Verify that loading a sleepable BPF program
  targeting a non-faultable tracepoint (tp_btf.s/sched_switch) is
  rejected by the verifier.

Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
---
 .../selftests/bpf/prog_tests/sleepable_raw_tp.c    | 40 ++++++++++++++++++++
 .../selftests/bpf/progs/test_sleepable_raw_tp.c    | 43 ++++++++++++++++++++++
 .../bpf/progs/test_sleepable_raw_tp_fail.c         | 18 +++++++++
 tools/testing/selftests/bpf/verifier/sleepable.c   | 17 ++++++++-
 4 files changed, 116 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/sleepable_raw_tp.c b/tools/testing/selftests/bpf/prog_tests/sleepable_raw_tp.c
new file mode 100644
index 000000000000..e902b41591e7
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/sleepable_raw_tp.c
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
+
+#include <test_progs.h>
+#include <time.h>
+#include "test_sleepable_raw_tp.skel.h"
+#include "test_sleepable_raw_tp_fail.skel.h"
+
+static void test_sleepable_raw_tp_success(void)
+{
+	struct test_sleepable_raw_tp *skel;
+	int err;
+
+	skel = test_sleepable_raw_tp__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "skel_open_load"))
+		return;
+
+	skel->bss->target_pid = getpid();
+
+	err = test_sleepable_raw_tp__attach(skel);
+	if (!ASSERT_OK(err, "skel_attach"))
+		goto cleanup;
+
+	syscall(__NR_nanosleep, &(struct timespec){ .tv_nsec = 555 }, NULL);
+
+	ASSERT_EQ(skel->bss->triggered, 1, "triggered");
+	ASSERT_EQ(skel->bss->err, 0, "err");
+	ASSERT_EQ(skel->bss->copied_tv_nsec, 555, "copied_tv_nsec");
+
+cleanup:
+	test_sleepable_raw_tp__destroy(skel);
+}
+
+void test_sleepable_raw_tp(void)
+{
+	if (test__start_subtest("success"))
+		test_sleepable_raw_tp_success();
+
+	RUN_TESTS(test_sleepable_raw_tp_fail);
+}
diff --git a/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp.c b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp.c
new file mode 100644
index 000000000000..ebacc766df57
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp.c
@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
+
+#include <vmlinux.h>
+#include <asm/unistd.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_core_read.h>
+#include <bpf/bpf_helpers.h>
+
+char _license[] SEC("license") = "GPL";
+
+int target_pid;
+int triggered;
+long err;
+long copied_tv_nsec;
+
+SEC("tp_btf.s/sys_enter")
+int BPF_PROG(test_sleepable_sys_enter, struct pt_regs *regs, long id)
+{
+	struct task_struct *task = bpf_get_current_task_btf();
+	struct __kernel_timespec *ts;
+	long tv_nsec;
+
+	if (task->pid != target_pid)
+		return 0;
+
+	if (id != __NR_nanosleep)
+		return 0;
+
+	ts = (void *)PT_REGS_PARM1_CORE_SYSCALL(regs);
+
+	/*
+	 * Use bpf_copy_from_user() - a sleepable helper - to read user memory.
+	 * This exercises the sleepable execution path of raw tracepoints.
+	 */
+	err = bpf_copy_from_user(&tv_nsec, sizeof(tv_nsec), &ts->tv_nsec);
+	if (err)
+		return err;
+
+	copied_tv_nsec = tv_nsec;
+	triggered = 1;
+	return 0;
+}
diff --git a/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp_fail.c b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp_fail.c
new file mode 100644
index 000000000000..54100899f728
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp_fail.c
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
+
+#include <vmlinux.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_helpers.h>
+#include "bpf_misc.h"
+
+char _license[] SEC("license") = "GPL";
+
+/* Sleepable program on a non-faultable tracepoint should fail to load */
+SEC("tp_btf.s/sched_switch")
+__failure __msg("Sleepable program cannot attach to non-faultable tracepoint")
+int BPF_PROG(test_sleepable_sched_switch, bool preempt,
+	     struct task_struct *prev, struct task_struct *next)
+{
+	return 0;
+}
diff --git a/tools/testing/selftests/bpf/verifier/sleepable.c b/tools/testing/selftests/bpf/verifier/sleepable.c
index 1f0d2bdc673f..6dabc5522945 100644
--- a/tools/testing/selftests/bpf/verifier/sleepable.c
+++ b/tools/testing/selftests/bpf/verifier/sleepable.c
@@ -76,7 +76,20 @@
 	.runs = -1,
 },
 {
-	"sleepable raw tracepoint reject",
+	"sleepable raw tracepoint accept",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_TRACING,
+	.expected_attach_type = BPF_TRACE_RAW_TP,
+	.kfunc = "sys_enter",
+	.result = ACCEPT,
+	.flags = BPF_F_SLEEPABLE,
+	.runs = -1,
+},
+{
+	"sleepable raw tracepoint reject non-faultable",
 	.insns = {
 	BPF_MOV64_IMM(BPF_REG_0, 0),
 	BPF_EXIT_INSN(),
@@ -85,7 +98,7 @@
 	.expected_attach_type = BPF_TRACE_RAW_TP,
 	.kfunc = "sched_switch",
 	.result = REJECT,
-	.errstr = "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable",
+	.errstr = "Sleepable program cannot attach to non-faultable tracepoint",
 	.flags = BPF_F_SLEEPABLE,
 	.runs = -1,
 },

-- 
2.52.0

Re: [PATCH bpf-next v3 2/4] bpf: Verifier support for sleepable raw tracepoint programs

[Emil Tsalapatis]

On Wed Mar 11, 2026 at 2:22 PM EDT, Mykyta Yatsenko wrote:
> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Add BPF_TRACE_RAW_TP to the set of tracing program attach types
> that can be loaded as sleepable in can_be_sleepable().
>
> Reject sleepable programs that target non-faultable tracepoints
> at load time in bpf_check_attach_target(), providing a clear
> verifier error message.
>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

> ---
>  kernel/bpf/verifier.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 8e4f69918693..95b33b85698f 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -25216,6 +25216,12 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,
>  		btp = bpf_get_raw_tracepoint(tname);
>  		if (!btp)
>  			return -EINVAL;
> +		if (prog->sleepable && !tracepoint_is_faultable(btp->tp)) {
> +			bpf_log(log, "Sleepable program cannot attach to non-faultable tracepoint %s\n",
> +				tname);
> +			bpf_put_raw_tracepoint(btp);
> +			return -EINVAL;
> +		}
>  		fname = kallsyms_lookup((unsigned long)btp->bpf_func, NULL, NULL, NULL,
>  					trace_symbol);
>  		bpf_put_raw_tracepoint(btp);
> @@ -25432,6 +25438,7 @@ static bool can_be_sleepable(struct bpf_prog *prog)
>  		case BPF_MODIFY_RETURN:
>  		case BPF_TRACE_ITER:
>  		case BPF_TRACE_FSESSION:
> +		case BPF_TRACE_RAW_TP:
>  			return true;
>  		default:
>  			return false;
> @@ -25461,7 +25468,7 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)
>  	}
>  
>  	if (prog->sleepable && !can_be_sleepable(prog)) {
> -		verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable\n");
> +		verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, struct_ops, and raw_tp programs can be sleepable\n");
>  		return -EINVAL;
>  	}
>  

Re: [PATCH bpf-next v3 2/4] bpf: Verifier support for sleepable raw tracepoint programs

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1218 bytes --]

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -25435,6 +25441,7 @@ static bool can_be_sleepable(struct bpf_prog *prog)
>  		case BPF_MODIFY_RETURN:
>  		case BPF_TRACE_ITER:
>  		case BPF_TRACE_FSESSION:
> +		case BPF_TRACE_RAW_TP:
>  			return true;
>  		default:
>  			return false;
> @@ -25464,7 +25471,7 @@ struct bpf_attach_target_info tgt_info = {};
>  	}
>
>  	if (prog->sleepable && !can_be_sleepable(prog)) {
> -		verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable\n");
> +		verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, struct_ops, and raw_tp programs can be sleepable\n");

The updated error message adds raw_tp but still omits fsession,
which is listed in can_be_sleepable() just above. Should this
read "fentry/fexit/fmod_ret/fsession, lsm, iter, uprobe,
struct_ops, and raw_tp"?

>  		return -EINVAL;
>  	}


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/22968403755

Re: [PATCH bpf-next v3 3/4] libbpf: Add tp_btf.s section handler for sleepable raw tracepoints

[Emil Tsalapatis]

On Wed Mar 11, 2026 at 2:22 PM EDT, Mykyta Yatsenko wrote:
> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Add SEC_DEF for "tp_btf.s+" section prefix, enabling userspace BPF
> programs to use SEC("tp_btf.s/<tracepoint>") to load sleepable raw
> tracepoint programs. This follows the existing pattern used for
> fentry.s, fexit.s, fmod_ret.s, and lsm.s section definitions.
>
> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

> ---
>  tools/lib/bpf/libbpf.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 0662d72bad20..7b65869f5c8e 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -9863,6 +9863,7 @@ static const struct bpf_sec_def section_defs[] = {
>  	SEC_DEF("raw_tracepoint.w+",	RAW_TRACEPOINT_WRITABLE, 0, SEC_NONE, attach_raw_tp),
>  	SEC_DEF("raw_tp.w+",		RAW_TRACEPOINT_WRITABLE, 0, SEC_NONE, attach_raw_tp),
>  	SEC_DEF("tp_btf+",		TRACING, BPF_TRACE_RAW_TP, SEC_ATTACH_BTF, attach_trace),
> +	SEC_DEF("tp_btf.s+",		TRACING, BPF_TRACE_RAW_TP, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
>  	SEC_DEF("fentry+",		TRACING, BPF_TRACE_FENTRY, SEC_ATTACH_BTF, attach_trace),
>  	SEC_DEF("fmod_ret+",		TRACING, BPF_MODIFY_RETURN, SEC_ATTACH_BTF, attach_trace),
>  	SEC_DEF("fexit+",		TRACING, BPF_TRACE_FEXIT, SEC_ATTACH_BTF, attach_trace),

Re: [PATCH bpf-next v3 4/4] selftests/bpf: Add tests for sleepable raw tracepoint programs

[Emil Tsalapatis]

On Wed Mar 11, 2026 at 2:22 PM EDT, Mykyta Yatsenko wrote:
> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Add tests for sleepable raw tracepoint programs:
> - success: Attach a sleepable BPF program to the faultable sys_enter
>   tracepoint (tp_btf.s/sys_enter). Verify the program is triggered by
>   a syscall.
> - reject_non_faultable: Verify that loading a sleepable BPF program
>   targeting a non-faultable tracepoint (tp_btf.s/sched_switch) is
>   rejected by the verifier.
>
> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

> ---
>  .../selftests/bpf/prog_tests/sleepable_raw_tp.c    | 40 ++++++++++++++++++++
>  .../selftests/bpf/progs/test_sleepable_raw_tp.c    | 43 ++++++++++++++++++++++
>  .../bpf/progs/test_sleepable_raw_tp_fail.c         | 18 +++++++++
>  tools/testing/selftests/bpf/verifier/sleepable.c   | 17 ++++++++-
>  4 files changed, 116 insertions(+), 2 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/sleepable_raw_tp.c b/tools/testing/selftests/bpf/prog_tests/sleepable_raw_tp.c
> new file mode 100644
> index 000000000000..e902b41591e7
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/sleepable_raw_tp.c
> @@ -0,0 +1,40 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
> +
> +#include <test_progs.h>
> +#include <time.h>
> +#include "test_sleepable_raw_tp.skel.h"
> +#include "test_sleepable_raw_tp_fail.skel.h"
> +
> +static void test_sleepable_raw_tp_success(void)
> +{
> +	struct test_sleepable_raw_tp *skel;
> +	int err;
> +
> +	skel = test_sleepable_raw_tp__open_and_load();
> +	if (!ASSERT_OK_PTR(skel, "skel_open_load"))
> +		return;
> +
> +	skel->bss->target_pid = getpid();
> +
> +	err = test_sleepable_raw_tp__attach(skel);
> +	if (!ASSERT_OK(err, "skel_attach"))
> +		goto cleanup;
> +
> +	syscall(__NR_nanosleep, &(struct timespec){ .tv_nsec = 555 }, NULL);
> +
> +	ASSERT_EQ(skel->bss->triggered, 1, "triggered");
> +	ASSERT_EQ(skel->bss->err, 0, "err");
> +	ASSERT_EQ(skel->bss->copied_tv_nsec, 555, "copied_tv_nsec");
> +
> +cleanup:
> +	test_sleepable_raw_tp__destroy(skel);
> +}
> +
> +void test_sleepable_raw_tp(void)
> +{
> +	if (test__start_subtest("success"))
> +		test_sleepable_raw_tp_success();
> +
> +	RUN_TESTS(test_sleepable_raw_tp_fail);
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp.c b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp.c
> new file mode 100644
> index 000000000000..ebacc766df57
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp.c
> @@ -0,0 +1,43 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
> +
> +#include <vmlinux.h>
> +#include <asm/unistd.h>
> +#include <bpf/bpf_tracing.h>
> +#include <bpf/bpf_core_read.h>
> +#include <bpf/bpf_helpers.h>
> +
> +char _license[] SEC("license") = "GPL";
> +
> +int target_pid;
> +int triggered;
> +long err;
> +long copied_tv_nsec;
> +
> +SEC("tp_btf.s/sys_enter")
> +int BPF_PROG(test_sleepable_sys_enter, struct pt_regs *regs, long id)
> +{
> +	struct task_struct *task = bpf_get_current_task_btf();
> +	struct __kernel_timespec *ts;
> +	long tv_nsec;
> +
> +	if (task->pid != target_pid)
> +		return 0;
> +
> +	if (id != __NR_nanosleep)
> +		return 0;
> +
> +	ts = (void *)PT_REGS_PARM1_CORE_SYSCALL(regs);
> +
> +	/*
> +	 * Use bpf_copy_from_user() - a sleepable helper - to read user memory.
> +	 * This exercises the sleepable execution path of raw tracepoints.
> +	 */
> +	err = bpf_copy_from_user(&tv_nsec, sizeof(tv_nsec), &ts->tv_nsec);
> +	if (err)
> +		return err;
> +
> +	copied_tv_nsec = tv_nsec;
> +	triggered = 1;
> +	return 0;
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp_fail.c b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp_fail.c
> new file mode 100644
> index 000000000000..54100899f728
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp_fail.c
> @@ -0,0 +1,18 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
> +
> +#include <vmlinux.h>
> +#include <bpf/bpf_tracing.h>
> +#include <bpf/bpf_helpers.h>
> +#include "bpf_misc.h"
> +
> +char _license[] SEC("license") = "GPL";
> +
> +/* Sleepable program on a non-faultable tracepoint should fail to load */
> +SEC("tp_btf.s/sched_switch")
> +__failure __msg("Sleepable program cannot attach to non-faultable tracepoint")
> +int BPF_PROG(test_sleepable_sched_switch, bool preempt,
> +	     struct task_struct *prev, struct task_struct *next)
> +{
> +	return 0;
> +}
> diff --git a/tools/testing/selftests/bpf/verifier/sleepable.c b/tools/testing/selftests/bpf/verifier/sleepable.c
> index 1f0d2bdc673f..6dabc5522945 100644
> --- a/tools/testing/selftests/bpf/verifier/sleepable.c
> +++ b/tools/testing/selftests/bpf/verifier/sleepable.c
> @@ -76,7 +76,20 @@
>  	.runs = -1,
>  },
>  {
> -	"sleepable raw tracepoint reject",
> +	"sleepable raw tracepoint accept",
> +	.insns = {
> +	BPF_MOV64_IMM(BPF_REG_0, 0),
> +	BPF_EXIT_INSN(),
> +	},
> +	.prog_type = BPF_PROG_TYPE_TRACING,
> +	.expected_attach_type = BPF_TRACE_RAW_TP,
> +	.kfunc = "sys_enter",
> +	.result = ACCEPT,
> +	.flags = BPF_F_SLEEPABLE,
> +	.runs = -1,
> +},
> +{
> +	"sleepable raw tracepoint reject non-faultable",
>  	.insns = {
>  	BPF_MOV64_IMM(BPF_REG_0, 0),
>  	BPF_EXIT_INSN(),
> @@ -85,7 +98,7 @@
>  	.expected_attach_type = BPF_TRACE_RAW_TP,
>  	.kfunc = "sched_switch",
>  	.result = REJECT,
> -	.errstr = "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable",
> +	.errstr = "Sleepable program cannot attach to non-faultable tracepoint",
>  	.flags = BPF_F_SLEEPABLE,
>  	.runs = -1,
>  },

Re: [PATCH bpf-next v3 1/4] bpf: Add sleepable execution path for raw tracepoint programs

[Emil Tsalapatis]

On Wed Mar 11, 2026 at 2:22 PM EDT, Mykyta Yatsenko wrote:
> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Modify __bpf_trace_run() to support both sleepable and non-sleepable
> BPF programs. When the program is sleepable:
>
> - Call might_fault() to annotate the faultable context
> - Use migrate_disable()/migrate_enable() instead of
>   rcu_read_lock()/rcu_read_unlock() to allow sleeping while
>   still protecting percpu data access
> - The outer rcu_tasks_trace lock is already held by the faultable
>   tracepoint callback (__DECLARE_TRACE_SYSCALL), providing lifetime
>   protection for the BPF program
>
> For non-sleepable programs, rcu_read_lock_dont_migrate() is replaced
> with explicit migrate_disable()/rcu_read_lock() pairing.
>
> Remove preempt_disable_notrace()/preempt_enable_notrace() from
> __BPF_DECLARE_TRACE_SYSCALL. Per-CPU protection and RCU locking are
> now managed per-program inside __bpf_trace_run().
>
> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

> ---
>  include/trace/bpf_probe.h |  2 --
>  kernel/trace/bpf_trace.c  | 13 ++++++++++---
>  2 files changed, 10 insertions(+), 5 deletions(-)
>
> diff --git a/include/trace/bpf_probe.h b/include/trace/bpf_probe.h
> index 9391d54d3f12..d1de8f9aa07f 100644
> --- a/include/trace/bpf_probe.h
> +++ b/include/trace/bpf_probe.h
> @@ -58,9 +58,7 @@ static notrace void							\
>  __bpf_trace_##call(void *__data, proto)					\
>  {									\
>  	might_fault();							\
> -	preempt_disable_notrace();					\
>  	CONCATENATE(bpf_trace_run, COUNT_ARGS(args))(__data, CAST_TO_U64(args));	\
> -	preempt_enable_notrace();					\
>  }
>  
>  #undef DECLARE_EVENT_SYSCALL_CLASS
> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 0b040a417442..3688a7e115d1 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -2076,7 +2076,7 @@ void __bpf_trace_run(struct bpf_raw_tp_link *link, u64 *args)
>  	struct bpf_run_ctx *old_run_ctx;
>  	struct bpf_trace_run_ctx run_ctx;
>  
> -	rcu_read_lock_dont_migrate();
> +	migrate_disable();
>  	if (unlikely(!bpf_prog_get_recursion_context(prog))) {
>  		bpf_prog_inc_misses_counter(prog);
>  		goto out;
> @@ -2085,12 +2085,19 @@ void __bpf_trace_run(struct bpf_raw_tp_link *link, u64 *args)
>  	run_ctx.bpf_cookie = link->cookie;
>  	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
>  
> -	(void) bpf_prog_run(prog, args);
> +	if (prog->sleepable) {
> +		might_fault();
> +		(void)bpf_prog_run(prog, args);
> +	} else {
> +		rcu_read_lock();
> +		(void)bpf_prog_run(prog, args);
> +		rcu_read_unlock();
> +	}
>  
>  	bpf_reset_run_ctx(old_run_ctx);
>  out:
>  	bpf_prog_put_recursion_context(prog);
> -	rcu_read_unlock_migrate();
> +	migrate_enable();
>  }
>  
>  #define UNPACK(...)			__VA_ARGS__

Re: [PATCH bpf-next v3 2/4] bpf: Verifier support for sleepable raw tracepoint programs

[Kumar Kartikeya Dwivedi]

On Wed, 11 Mar 2026 at 19:53, <bot+bpf-ci@kernel.org> wrote:
>
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
>
> [ ... ]
>
> > @@ -25435,6 +25441,7 @@ static bool can_be_sleepable(struct bpf_prog *prog)
> >               case BPF_MODIFY_RETURN:
> >               case BPF_TRACE_ITER:
> >               case BPF_TRACE_FSESSION:
> > +             case BPF_TRACE_RAW_TP:
> >                       return true;
> >               default:
> >                       return false;
> > @@ -25464,7 +25471,7 @@ struct bpf_attach_target_info tgt_info = {};
> >       }
> >
> >       if (prog->sleepable && !can_be_sleepable(prog)) {
> > -             verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable\n");
> > +             verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, struct_ops, and raw_tp programs can be sleepable\n");
>
> The updated error message adds raw_tp but still omits fsession,
> which is listed in can_be_sleepable() just above. Should this
> read "fentry/fexit/fmod_ret/fsession, lsm, iter, uprobe,
> struct_ops, and raw_tp"?
>

We can ignore AI for now, Leon has a change for this.

> >               return -EINVAL;
> >       }
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/22968403755

Re: [PATCH bpf-next v3 2/4] bpf: Verifier support for sleepable raw tracepoint programs

[Kumar Kartikeya Dwivedi]

On Wed, 11 Mar 2026 at 19:24, Mykyta Yatsenko
<mykyta.yatsenko5@gmail.com> wrote:
>
> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Add BPF_TRACE_RAW_TP to the set of tracing program attach types
> that can be loaded as sleepable in can_be_sleepable().
>
> Reject sleepable programs that target non-faultable tracepoints
> at load time in bpf_check_attach_target(), providing a clear
> verifier error message.
>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
> ---

Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

>  [...]

Re: [PATCH bpf-next v3 1/4] bpf: Add sleepable execution path for raw tracepoint programs

[Puranjay Mohan]

Mykyta Yatsenko <mykyta.yatsenko5@gmail.com> writes:

> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Modify __bpf_trace_run() to support both sleepable and non-sleepable
> BPF programs. When the program is sleepable:
>
> - Call might_fault() to annotate the faultable context
> - Use migrate_disable()/migrate_enable() instead of
>   rcu_read_lock()/rcu_read_unlock() to allow sleeping while
>   still protecting percpu data access
> - The outer rcu_tasks_trace lock is already held by the faultable
>   tracepoint callback (__DECLARE_TRACE_SYSCALL), providing lifetime
>   protection for the BPF program
>
> For non-sleepable programs, rcu_read_lock_dont_migrate() is replaced
> with explicit migrate_disable()/rcu_read_lock() pairing.
>
> Remove preempt_disable_notrace()/preempt_enable_notrace() from
> __BPF_DECLARE_TRACE_SYSCALL. Per-CPU protection and RCU locking are
> now managed per-program inside __bpf_trace_run().
>
> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

Acked-by: Puranjay Mohan <puranjay@kernel.org>

> ---
>  include/trace/bpf_probe.h |  2 --
>  kernel/trace/bpf_trace.c  | 13 ++++++++++---
>  2 files changed, 10 insertions(+), 5 deletions(-)
>
> diff --git a/include/trace/bpf_probe.h b/include/trace/bpf_probe.h
> index 9391d54d3f12..d1de8f9aa07f 100644
> --- a/include/trace/bpf_probe.h
> +++ b/include/trace/bpf_probe.h
> @@ -58,9 +58,7 @@ static notrace void							\
>  __bpf_trace_##call(void *__data, proto)					\
>  {									\
>  	might_fault();							\
> -	preempt_disable_notrace();					\
>  	CONCATENATE(bpf_trace_run, COUNT_ARGS(args))(__data, CAST_TO_U64(args));	\
> -	preempt_enable_notrace();					\
>  }
>  
>  #undef DECLARE_EVENT_SYSCALL_CLASS
> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 0b040a417442..3688a7e115d1 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -2076,7 +2076,7 @@ void __bpf_trace_run(struct bpf_raw_tp_link *link, u64 *args)
>  	struct bpf_run_ctx *old_run_ctx;
>  	struct bpf_trace_run_ctx run_ctx;
>  
> -	rcu_read_lock_dont_migrate();
> +	migrate_disable();
>  	if (unlikely(!bpf_prog_get_recursion_context(prog))) {
>  		bpf_prog_inc_misses_counter(prog);
>  		goto out;
> @@ -2085,12 +2085,19 @@ void __bpf_trace_run(struct bpf_raw_tp_link *link, u64 *args)
>  	run_ctx.bpf_cookie = link->cookie;
>  	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
>  
> -	(void) bpf_prog_run(prog, args);
> +	if (prog->sleepable) {
> +		might_fault();
> +		(void)bpf_prog_run(prog, args);
> +	} else {
> +		rcu_read_lock();
> +		(void)bpf_prog_run(prog, args);
> +		rcu_read_unlock();
> +	}
>  
>  	bpf_reset_run_ctx(old_run_ctx);
>  out:
>  	bpf_prog_put_recursion_context(prog);
> -	rcu_read_unlock_migrate();
> +	migrate_enable();
>  }
>  
>  #define UNPACK(...)			__VA_ARGS__
>
> -- 
> 2.52.0

Re: [PATCH bpf-next v3 2/4] bpf: Verifier support for sleepable raw tracepoint programs

[Puranjay Mohan]

Mykyta Yatsenko <mykyta.yatsenko5@gmail.com> writes:

> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Add BPF_TRACE_RAW_TP to the set of tracing program attach types
> that can be loaded as sleepable in can_be_sleepable().
>
> Reject sleepable programs that target non-faultable tracepoints
> at load time in bpf_check_attach_target(), providing a clear
> verifier error message.
>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

Acked-by: Puranjay Mohan <puranjay@kernel.org>

> ---
>  kernel/bpf/verifier.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 8e4f69918693..95b33b85698f 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -25216,6 +25216,12 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,
>  		btp = bpf_get_raw_tracepoint(tname);
>  		if (!btp)
>  			return -EINVAL;
> +		if (prog->sleepable && !tracepoint_is_faultable(btp->tp)) {
> +			bpf_log(log, "Sleepable program cannot attach to non-faultable tracepoint %s\n",
> +				tname);
> +			bpf_put_raw_tracepoint(btp);
> +			return -EINVAL;
> +		}
>  		fname = kallsyms_lookup((unsigned long)btp->bpf_func, NULL, NULL, NULL,
>  					trace_symbol);
>  		bpf_put_raw_tracepoint(btp);
> @@ -25432,6 +25438,7 @@ static bool can_be_sleepable(struct bpf_prog *prog)
>  		case BPF_MODIFY_RETURN:
>  		case BPF_TRACE_ITER:
>  		case BPF_TRACE_FSESSION:
> +		case BPF_TRACE_RAW_TP:
>  			return true;
>  		default:
>  			return false;
> @@ -25461,7 +25468,7 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)
>  	}
>  
>  	if (prog->sleepable && !can_be_sleepable(prog)) {
> -		verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable\n");
> +		verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, struct_ops, and raw_tp programs can be sleepable\n");
>  		return -EINVAL;
>  	}
>  
>
> -- 
> 2.52.0

Re: [PATCH bpf-next v3 3/4] libbpf: Add tp_btf.s section handler for sleepable raw tracepoints

[Puranjay Mohan]

Mykyta Yatsenko <mykyta.yatsenko5@gmail.com> writes:

> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Add SEC_DEF for "tp_btf.s+" section prefix, enabling userspace BPF
> programs to use SEC("tp_btf.s/<tracepoint>") to load sleepable raw
> tracepoint programs. This follows the existing pattern used for
> fentry.s, fexit.s, fmod_ret.s, and lsm.s section definitions.
>
> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

Acked-by: Puranjay Mohan <puranjay@kernel.org>

> ---
>  tools/lib/bpf/libbpf.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 0662d72bad20..7b65869f5c8e 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -9863,6 +9863,7 @@ static const struct bpf_sec_def section_defs[] = {
>  	SEC_DEF("raw_tracepoint.w+",	RAW_TRACEPOINT_WRITABLE, 0, SEC_NONE, attach_raw_tp),
>  	SEC_DEF("raw_tp.w+",		RAW_TRACEPOINT_WRITABLE, 0, SEC_NONE, attach_raw_tp),
>  	SEC_DEF("tp_btf+",		TRACING, BPF_TRACE_RAW_TP, SEC_ATTACH_BTF, attach_trace),
> +	SEC_DEF("tp_btf.s+",		TRACING, BPF_TRACE_RAW_TP, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
>  	SEC_DEF("fentry+",		TRACING, BPF_TRACE_FENTRY, SEC_ATTACH_BTF, attach_trace),
>  	SEC_DEF("fmod_ret+",		TRACING, BPF_MODIFY_RETURN, SEC_ATTACH_BTF, attach_trace),
>  	SEC_DEF("fexit+",		TRACING, BPF_TRACE_FEXIT, SEC_ATTACH_BTF, attach_trace),
>
> -- 
> 2.52.0

Re: [PATCH bpf-next v3 4/4] selftests/bpf: Add tests for sleepable raw tracepoint programs

[Puranjay Mohan]

Mykyta Yatsenko <mykyta.yatsenko5@gmail.com> writes:

> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Add tests for sleepable raw tracepoint programs:
> - success: Attach a sleepable BPF program to the faultable sys_enter
>   tracepoint (tp_btf.s/sys_enter). Verify the program is triggered by
>   a syscall.
> - reject_non_faultable: Verify that loading a sleepable BPF program
>   targeting a non-faultable tracepoint (tp_btf.s/sched_switch) is
>   rejected by the verifier.
>
> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

Acked-by: Puranjay Mohan <puranjay@kernel.org>

> ---
>  .../selftests/bpf/prog_tests/sleepable_raw_tp.c    | 40 ++++++++++++++++++++
>  .../selftests/bpf/progs/test_sleepable_raw_tp.c    | 43 ++++++++++++++++++++++
>  .../bpf/progs/test_sleepable_raw_tp_fail.c         | 18 +++++++++
>  tools/testing/selftests/bpf/verifier/sleepable.c   | 17 ++++++++-
>  4 files changed, 116 insertions(+), 2 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/sleepable_raw_tp.c b/tools/testing/selftests/bpf/prog_tests/sleepable_raw_tp.c
> new file mode 100644
> index 000000000000..e902b41591e7
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/sleepable_raw_tp.c
> @@ -0,0 +1,40 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
> +
> +#include <test_progs.h>
> +#include <time.h>
> +#include "test_sleepable_raw_tp.skel.h"
> +#include "test_sleepable_raw_tp_fail.skel.h"
> +
> +static void test_sleepable_raw_tp_success(void)
> +{
> +	struct test_sleepable_raw_tp *skel;
> +	int err;
> +
> +	skel = test_sleepable_raw_tp__open_and_load();
> +	if (!ASSERT_OK_PTR(skel, "skel_open_load"))
> +		return;
> +
> +	skel->bss->target_pid = getpid();
> +
> +	err = test_sleepable_raw_tp__attach(skel);
> +	if (!ASSERT_OK(err, "skel_attach"))
> +		goto cleanup;
> +
> +	syscall(__NR_nanosleep, &(struct timespec){ .tv_nsec = 555 }, NULL);
> +
> +	ASSERT_EQ(skel->bss->triggered, 1, "triggered");
> +	ASSERT_EQ(skel->bss->err, 0, "err");
> +	ASSERT_EQ(skel->bss->copied_tv_nsec, 555, "copied_tv_nsec");
> +
> +cleanup:
> +	test_sleepable_raw_tp__destroy(skel);
> +}
> +
> +void test_sleepable_raw_tp(void)
> +{
> +	if (test__start_subtest("success"))
> +		test_sleepable_raw_tp_success();
> +
> +	RUN_TESTS(test_sleepable_raw_tp_fail);
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp.c b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp.c
> new file mode 100644
> index 000000000000..ebacc766df57
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp.c
> @@ -0,0 +1,43 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
> +
> +#include <vmlinux.h>
> +#include <asm/unistd.h>
> +#include <bpf/bpf_tracing.h>
> +#include <bpf/bpf_core_read.h>
> +#include <bpf/bpf_helpers.h>
> +
> +char _license[] SEC("license") = "GPL";
> +
> +int target_pid;
> +int triggered;
> +long err;
> +long copied_tv_nsec;
> +
> +SEC("tp_btf.s/sys_enter")
> +int BPF_PROG(test_sleepable_sys_enter, struct pt_regs *regs, long id)
> +{
> +	struct task_struct *task = bpf_get_current_task_btf();
> +	struct __kernel_timespec *ts;
> +	long tv_nsec;
> +
> +	if (task->pid != target_pid)
> +		return 0;
> +
> +	if (id != __NR_nanosleep)
> +		return 0;
> +
> +	ts = (void *)PT_REGS_PARM1_CORE_SYSCALL(regs);
> +
> +	/*
> +	 * Use bpf_copy_from_user() - a sleepable helper - to read user memory.
> +	 * This exercises the sleepable execution path of raw tracepoints.
> +	 */
> +	err = bpf_copy_from_user(&tv_nsec, sizeof(tv_nsec), &ts->tv_nsec);
> +	if (err)
> +		return err;
> +
> +	copied_tv_nsec = tv_nsec;
> +	triggered = 1;
> +	return 0;
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp_fail.c b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp_fail.c
> new file mode 100644
> index 000000000000..54100899f728
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp_fail.c
> @@ -0,0 +1,18 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
> +
> +#include <vmlinux.h>
> +#include <bpf/bpf_tracing.h>
> +#include <bpf/bpf_helpers.h>
> +#include "bpf_misc.h"
> +
> +char _license[] SEC("license") = "GPL";
> +
> +/* Sleepable program on a non-faultable tracepoint should fail to load */
> +SEC("tp_btf.s/sched_switch")
> +__failure __msg("Sleepable program cannot attach to non-faultable tracepoint")
> +int BPF_PROG(test_sleepable_sched_switch, bool preempt,
> +	     struct task_struct *prev, struct task_struct *next)
> +{
> +	return 0;
> +}
> diff --git a/tools/testing/selftests/bpf/verifier/sleepable.c b/tools/testing/selftests/bpf/verifier/sleepable.c
> index 1f0d2bdc673f..6dabc5522945 100644
> --- a/tools/testing/selftests/bpf/verifier/sleepable.c
> +++ b/tools/testing/selftests/bpf/verifier/sleepable.c
> @@ -76,7 +76,20 @@
>  	.runs = -1,
>  },
>  {
> -	"sleepable raw tracepoint reject",
> +	"sleepable raw tracepoint accept",
> +	.insns = {
> +	BPF_MOV64_IMM(BPF_REG_0, 0),
> +	BPF_EXIT_INSN(),
> +	},
> +	.prog_type = BPF_PROG_TYPE_TRACING,
> +	.expected_attach_type = BPF_TRACE_RAW_TP,
> +	.kfunc = "sys_enter",
> +	.result = ACCEPT,
> +	.flags = BPF_F_SLEEPABLE,
> +	.runs = -1,
> +},
> +{
> +	"sleepable raw tracepoint reject non-faultable",
>  	.insns = {
>  	BPF_MOV64_IMM(BPF_REG_0, 0),
>  	BPF_EXIT_INSN(),
> @@ -85,7 +98,7 @@
>  	.expected_attach_type = BPF_TRACE_RAW_TP,
>  	.kfunc = "sched_switch",
>  	.result = REJECT,
> -	.errstr = "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable",
> +	.errstr = "Sleepable program cannot attach to non-faultable tracepoint",
>  	.flags = BPF_F_SLEEPABLE,
>  	.runs = -1,
>  },
>
> -- 
> 2.52.0

Re: [PATCH bpf-next v3 2/4] bpf: Verifier support for sleepable raw tracepoint programs

[Leon Hwang]

On 12/3/26 07:07, Kumar Kartikeya Dwivedi wrote:
> On Wed, 11 Mar 2026 at 19:53, <bot+bpf-ci@kernel.org> wrote:
>>
>>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>>> --- a/kernel/bpf/verifier.c
>>> +++ b/kernel/bpf/verifier.c
>>
>> [ ... ]
>>
>>> @@ -25435,6 +25441,7 @@ static bool can_be_sleepable(struct bpf_prog *prog)
>>>               case BPF_MODIFY_RETURN:
>>>               case BPF_TRACE_ITER:
>>>               case BPF_TRACE_FSESSION:
>>> +             case BPF_TRACE_RAW_TP:
>>>                       return true;
>>>               default:
>>>                       return false;
>>> @@ -25464,7 +25471,7 @@ struct bpf_attach_target_info tgt_info = {};
>>>       }
>>>
>>>       if (prog->sleepable && !can_be_sleepable(prog)) {
>>> -             verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable\n");
>>> +             verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, struct_ops, and raw_tp programs can be sleepable\n");
>>
>> The updated error message adds raw_tp but still omits fsession,
>> which is listed in can_be_sleepable() just above. Should this
>> read "fentry/fexit/fmod_ret/fsession, lsm, iter, uprobe,
>> struct_ops, and raw_tp"?
>>
> 
> We can ignore AI for now, Leon has a change for this.
> 
Just to confirm the change: is it
https://lore.kernel.org/bpf/20260303150639.85007-2-leon.hwang@linux.dev/?

If yes, it is to add "fsession" to the verbose log message in
check_get_func_ip(). Then, the AI review is correct: "fsession" was
missing here.

After searching for "fexit" in verifier.c, "FENTRY/FEXIT" can be updated
to "FENTRY/FEXIT/FSESSION" in bpf_check_attach_target(), and "fsession"
is missing in some comments. I'm not sure whether it is worth a patch to
do such cleanup work.

cc Menglong

Thanks,
Leon

Re: [PATCH bpf-next v3 2/4] bpf: Verifier support for sleepable raw tracepoint programs

[Menglong Dong]

On 2026/3/12 13:50 Leon Hwang <leon.hwang@linux.dev> write:
> On 12/3/26 07:07, Kumar Kartikeya Dwivedi wrote:
> > On Wed, 11 Mar 2026 at 19:53, <bot+bpf-ci@kernel.org> wrote:
> >>
> >>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> >>> --- a/kernel/bpf/verifier.c
> >>> +++ b/kernel/bpf/verifier.c
> >>
> >> [ ... ]
> >>
> >>> @@ -25435,6 +25441,7 @@ static bool can_be_sleepable(struct bpf_prog *prog)
> >>>               case BPF_MODIFY_RETURN:
> >>>               case BPF_TRACE_ITER:
> >>>               case BPF_TRACE_FSESSION:
> >>> +             case BPF_TRACE_RAW_TP:
> >>>                       return true;
> >>>               default:
> >>>                       return false;
> >>> @@ -25464,7 +25471,7 @@ struct bpf_attach_target_info tgt_info = {};
> >>>       }
> >>>
> >>>       if (prog->sleepable && !can_be_sleepable(prog)) {
> >>> -             verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable\n");
> >>> +             verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, struct_ops, and raw_tp programs can be sleepable\n");
> >>
> >> The updated error message adds raw_tp but still omits fsession,
> >> which is listed in can_be_sleepable() just above. Should this
> >> read "fentry/fexit/fmod_ret/fsession, lsm, iter, uprobe,
> >> struct_ops, and raw_tp"?
> >>
> > 
> > We can ignore AI for now, Leon has a change for this.
> > 
> Just to confirm the change: is it
> https://lore.kernel.org/bpf/20260303150639.85007-2-leon.hwang@linux.dev/?
> 
> If yes, it is to add "fsession" to the verbose log message in
> check_get_func_ip(). Then, the AI review is correct: "fsession" was
> missing here.
> 
> After searching for "fexit" in verifier.c, "FENTRY/FEXIT" can be updated
> to "FENTRY/FEXIT/FSESSION" in bpf_check_attach_target(), and "fsession"
> is missing in some comments. I'm not sure whether it is worth a patch to
> do such cleanup work.

Ah, when I search the "fentry.*fexit", I found that there do have
some missed things in:
- the comments
- the log message in check_get_func_ip() and check_attach_btf_id()
- the document in bpftool-prog.rst
- the help info in bpftool
- bash-completion of bpftool

I can send a series to fix these things, except the log message in
check_get_func_ip(), which is already in Leon's patch.

Thanks!
Menglong Dong

> 
> cc Menglong
> 
> Thanks,
> Leon
> 
> 
> 

Re: [PATCH bpf-next v3 2/4] bpf: Verifier support for sleepable raw tracepoint programs

[Leon Hwang]

On 12/3/26 14:21, Menglong Dong wrote:
> On 2026/3/12 13:50 Leon Hwang <leon.hwang@linux.dev> write:
>> On 12/3/26 07:07, Kumar Kartikeya Dwivedi wrote:
>>> On Wed, 11 Mar 2026 at 19:53, <bot+bpf-ci@kernel.org> wrote:

[...]

>>>
>>> We can ignore AI for now, Leon has a change for this.
>>>
>> Just to confirm the change: is it
>> https://lore.kernel.org/bpf/20260303150639.85007-2-leon.hwang@linux.dev/?
>>
>> If yes, it is to add "fsession" to the verbose log message in
>> check_get_func_ip(). Then, the AI review is correct: "fsession" was
>> missing here.
>>
>> After searching for "fexit" in verifier.c, "FENTRY/FEXIT" can be updated
>> to "FENTRY/FEXIT/FSESSION" in bpf_check_attach_target(), and "fsession"
>> is missing in some comments. I'm not sure whether it is worth a patch to
>> do such cleanup work.
> 
> Ah, when I search the "fentry.*fexit", I found that there do have
> some missed things in:
> - the comments
> - the log message in check_get_func_ip() and check_attach_btf_id()
> - the document in bpftool-prog.rst
> - the help info in bpftool
> - bash-completion of bpftool
> 
> I can send a series to fix these things, except the log message in
> check_get_func_ip(), which is already in Leon's patch.
> 

More appropriate to include it in your series, I think.

Thanks,
Leon

Re: [PATCH bpf-next v3 1/4] bpf: Add sleepable execution path for raw tracepoint programs

[Andrii Nakryiko]

On Wed, Mar 11, 2026 at 11:23 AM Mykyta Yatsenko
<mykyta.yatsenko5@gmail.com> wrote:
>
> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Modify __bpf_trace_run() to support both sleepable and non-sleepable
> BPF programs. When the program is sleepable:
>
> - Call might_fault() to annotate the faultable context
> - Use migrate_disable()/migrate_enable() instead of
>   rcu_read_lock()/rcu_read_unlock() to allow sleeping while
>   still protecting percpu data access
> - The outer rcu_tasks_trace lock is already held by the faultable
>   tracepoint callback (__DECLARE_TRACE_SYSCALL), providing lifetime
>   protection for the BPF program

we should not rely on this, see uprobe_prog_run(), we should do
something like that here, explicitly calling correct RCU flavor
depending on sleepable/non-sleepable program

>
> For non-sleepable programs, rcu_read_lock_dont_migrate() is replaced
> with explicit migrate_disable()/rcu_read_lock() pairing.
>
> Remove preempt_disable_notrace()/preempt_enable_notrace() from
> __BPF_DECLARE_TRACE_SYSCALL. Per-CPU protection and RCU locking are
> now managed per-program inside __bpf_trace_run().
>
> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
> ---
>  include/trace/bpf_probe.h |  2 --
>  kernel/trace/bpf_trace.c  | 13 ++++++++++---
>  2 files changed, 10 insertions(+), 5 deletions(-)
>
> diff --git a/include/trace/bpf_probe.h b/include/trace/bpf_probe.h
> index 9391d54d3f12..d1de8f9aa07f 100644
> --- a/include/trace/bpf_probe.h
> +++ b/include/trace/bpf_probe.h
> @@ -58,9 +58,7 @@ static notrace void                                                   \
>  __bpf_trace_##call(void *__data, proto)                                        \
>  {                                                                      \
>         might_fault();                                                  \
> -       preempt_disable_notrace();                                      \
>         CONCATENATE(bpf_trace_run, COUNT_ARGS(args))(__data, CAST_TO_U64(args));        \
> -       preempt_enable_notrace();                                       \
>  }
>
>  #undef DECLARE_EVENT_SYSCALL_CLASS
> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 0b040a417442..3688a7e115d1 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -2076,7 +2076,7 @@ void __bpf_trace_run(struct bpf_raw_tp_link *link, u64 *args)
>         struct bpf_run_ctx *old_run_ctx;
>         struct bpf_trace_run_ctx run_ctx;
>
> -       rcu_read_lock_dont_migrate();
> +       migrate_disable();
>         if (unlikely(!bpf_prog_get_recursion_context(prog))) {
>                 bpf_prog_inc_misses_counter(prog);
>                 goto out;
> @@ -2085,12 +2085,19 @@ void __bpf_trace_run(struct bpf_raw_tp_link *link, u64 *args)
>         run_ctx.bpf_cookie = link->cookie;
>         old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
>
> -       (void) bpf_prog_run(prog, args);
> +       if (prog->sleepable) {
> +               might_fault();
> +               (void)bpf_prog_run(prog, args);
> +       } else {
> +               rcu_read_lock();
> +               (void)bpf_prog_run(prog, args);
> +               rcu_read_unlock();
> +       }
>
>         bpf_reset_run_ctx(old_run_ctx);
>  out:
>         bpf_prog_put_recursion_context(prog);
> -       rcu_read_unlock_migrate();
> +       migrate_enable();
>  }
>
>  #define UNPACK(...)                    __VA_ARGS__
>
> --
> 2.52.0
>

Re: [PATCH bpf-next v3 3/4] libbpf: Add tp_btf.s section handler for sleepable raw tracepoints

[Andrii Nakryiko]

On Wed, Mar 11, 2026 at 11:23 AM Mykyta Yatsenko
<mykyta.yatsenko5@gmail.com> wrote:
>
> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Add SEC_DEF for "tp_btf.s+" section prefix, enabling userspace BPF
> programs to use SEC("tp_btf.s/<tracepoint>") to load sleepable raw
> tracepoint programs. This follows the existing pattern used for
> fentry.s, fexit.s, fmod_ret.s, and lsm.s section definitions.
>
> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
> ---
>  tools/lib/bpf/libbpf.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 0662d72bad20..7b65869f5c8e 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -9863,6 +9863,7 @@ static const struct bpf_sec_def section_defs[] = {
>         SEC_DEF("raw_tracepoint.w+",    RAW_TRACEPOINT_WRITABLE, 0, SEC_NONE, attach_raw_tp),
>         SEC_DEF("raw_tp.w+",            RAW_TRACEPOINT_WRITABLE, 0, SEC_NONE, attach_raw_tp),
>         SEC_DEF("tp_btf+",              TRACING, BPF_TRACE_RAW_TP, SEC_ATTACH_BTF, attach_trace),
> +       SEC_DEF("tp_btf.s+",            TRACING, BPF_TRACE_RAW_TP, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),

what about raw_tp.s+ ?

pw-bot: cr


>         SEC_DEF("fentry+",              TRACING, BPF_TRACE_FENTRY, SEC_ATTACH_BTF, attach_trace),
>         SEC_DEF("fmod_ret+",            TRACING, BPF_MODIFY_RETURN, SEC_ATTACH_BTF, attach_trace),
>         SEC_DEF("fexit+",               TRACING, BPF_TRACE_FEXIT, SEC_ATTACH_BTF, attach_trace),
>
> --
> 2.52.0
>

Re: [PATCH bpf-next v3 2/4] bpf: Verifier support for sleepable raw tracepoint programs

[Andrii Nakryiko]

On Wed, Mar 11, 2026 at 11:23 AM Mykyta Yatsenko
<mykyta.yatsenko5@gmail.com> wrote:
>
> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Add BPF_TRACE_RAW_TP to the set of tracing program attach types

for completeness, we should probably make classic tracepoints
sleepable as well, no?

> that can be loaded as sleepable in can_be_sleepable().
>
> Reject sleepable programs that target non-faultable tracepoints
> at load time in bpf_check_attach_target(), providing a clear
> verifier error message.
>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
> ---
>  kernel/bpf/verifier.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 8e4f69918693..95b33b85698f 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -25216,6 +25216,12 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,
>                 btp = bpf_get_raw_tracepoint(tname);
>                 if (!btp)
>                         return -EINVAL;
> +               if (prog->sleepable && !tracepoint_is_faultable(btp->tp)) {
> +                       bpf_log(log, "Sleepable program cannot attach to non-faultable tracepoint %s\n",
> +                               tname);
> +                       bpf_put_raw_tracepoint(btp);
> +                       return -EINVAL;
> +               }
>                 fname = kallsyms_lookup((unsigned long)btp->bpf_func, NULL, NULL, NULL,
>                                         trace_symbol);
>                 bpf_put_raw_tracepoint(btp);
> @@ -25432,6 +25438,7 @@ static bool can_be_sleepable(struct bpf_prog *prog)
>                 case BPF_MODIFY_RETURN:
>                 case BPF_TRACE_ITER:
>                 case BPF_TRACE_FSESSION:
> +               case BPF_TRACE_RAW_TP:
>                         return true;
>                 default:
>                         return false;
> @@ -25461,7 +25468,7 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)
>         }
>
>         if (prog->sleepable && !can_be_sleepable(prog)) {
> -               verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable\n");
> +               verbose(env, "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, struct_ops, and raw_tp programs can be sleepable\n");

this is becoming ridiculous, can't we just say "Program type XXX
cannot be sleepable"?

>                 return -EINVAL;
>         }
>

>
> --
> 2.52.0
>

Re: [PATCH bpf-next v3 4/4] selftests/bpf: Add tests for sleepable raw tracepoint programs

[Andrii Nakryiko]

On Wed, Mar 11, 2026 at 11:23 AM Mykyta Yatsenko
<mykyta.yatsenko5@gmail.com> wrote:
>
> From: Mykyta Yatsenko <yatsenko@meta.com>
>
> Add tests for sleepable raw tracepoint programs:
> - success: Attach a sleepable BPF program to the faultable sys_enter
>   tracepoint (tp_btf.s/sys_enter). Verify the program is triggered by
>   a syscall.
> - reject_non_faultable: Verify that loading a sleepable BPF program
>   targeting a non-faultable tracepoint (tp_btf.s/sched_switch) is
>   rejected by the verifier.
>
> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
> ---
>  .../selftests/bpf/prog_tests/sleepable_raw_tp.c    | 40 ++++++++++++++++++++
>  .../selftests/bpf/progs/test_sleepable_raw_tp.c    | 43 ++++++++++++++++++++++
>  .../bpf/progs/test_sleepable_raw_tp_fail.c         | 18 +++++++++
>  tools/testing/selftests/bpf/verifier/sleepable.c   | 17 ++++++++-
>  4 files changed, 116 insertions(+), 2 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/sleepable_raw_tp.c b/tools/testing/selftests/bpf/prog_tests/sleepable_raw_tp.c
> new file mode 100644
> index 000000000000..e902b41591e7
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/sleepable_raw_tp.c
> @@ -0,0 +1,40 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
> +
> +#include <test_progs.h>
> +#include <time.h>
> +#include "test_sleepable_raw_tp.skel.h"
> +#include "test_sleepable_raw_tp_fail.skel.h"
> +
> +static void test_sleepable_raw_tp_success(void)
> +{
> +       struct test_sleepable_raw_tp *skel;
> +       int err;
> +
> +       skel = test_sleepable_raw_tp__open_and_load();
> +       if (!ASSERT_OK_PTR(skel, "skel_open_load"))
> +               return;
> +
> +       skel->bss->target_pid = getpid();
> +
> +       err = test_sleepable_raw_tp__attach(skel);
> +       if (!ASSERT_OK(err, "skel_attach"))
> +               goto cleanup;
> +
> +       syscall(__NR_nanosleep, &(struct timespec){ .tv_nsec = 555 }, NULL);
> +
> +       ASSERT_EQ(skel->bss->triggered, 1, "triggered");
> +       ASSERT_EQ(skel->bss->err, 0, "err");
> +       ASSERT_EQ(skel->bss->copied_tv_nsec, 555, "copied_tv_nsec");
> +
> +cleanup:
> +       test_sleepable_raw_tp__destroy(skel);
> +}
> +
> +void test_sleepable_raw_tp(void)
> +{
> +       if (test__start_subtest("success"))
> +               test_sleepable_raw_tp_success();
> +
> +       RUN_TESTS(test_sleepable_raw_tp_fail);
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp.c b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp.c
> new file mode 100644
> index 000000000000..ebacc766df57
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp.c
> @@ -0,0 +1,43 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
> +
> +#include <vmlinux.h>
> +#include <asm/unistd.h>
> +#include <bpf/bpf_tracing.h>
> +#include <bpf/bpf_core_read.h>
> +#include <bpf/bpf_helpers.h>
> +
> +char _license[] SEC("license") = "GPL";
> +
> +int target_pid;
> +int triggered;
> +long err;
> +long copied_tv_nsec;
> +
> +SEC("tp_btf.s/sys_enter")
> +int BPF_PROG(test_sleepable_sys_enter, struct pt_regs *regs, long id)
> +{
> +       struct task_struct *task = bpf_get_current_task_btf();
> +       struct __kernel_timespec *ts;
> +       long tv_nsec;
> +
> +       if (task->pid != target_pid)
> +               return 0;
> +
> +       if (id != __NR_nanosleep)
> +               return 0;
> +
> +       ts = (void *)PT_REGS_PARM1_CORE_SYSCALL(regs);

this is BTF-aware raw tracepoint, so let's use non-CO-RE variant of
this macro (PT_REGS_PARM1_SYSCALL), which will perform direct regs->di
access

but then let's also have non-BTF-aware (SEC("raw_tp")) test, where
you'll have to use PT_REGS_PARM1_CORE_SYSCALL().

And let's also make sure that SEC("tp.s/syscalls/sys_enter_nanosleep")
also works?

> +
> +       /*
> +        * Use bpf_copy_from_user() - a sleepable helper - to read user memory.
> +        * This exercises the sleepable execution path of raw tracepoints.
> +        */
> +       err = bpf_copy_from_user(&tv_nsec, sizeof(tv_nsec), &ts->tv_nsec);
> +       if (err)
> +               return err;
> +
> +       copied_tv_nsec = tv_nsec;
> +       triggered = 1;
> +       return 0;
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp_fail.c b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp_fail.c
> new file mode 100644
> index 000000000000..54100899f728
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_sleepable_raw_tp_fail.c
> @@ -0,0 +1,18 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
> +
> +#include <vmlinux.h>
> +#include <bpf/bpf_tracing.h>
> +#include <bpf/bpf_helpers.h>
> +#include "bpf_misc.h"
> +
> +char _license[] SEC("license") = "GPL";
> +
> +/* Sleepable program on a non-faultable tracepoint should fail to load */
> +SEC("tp_btf.s/sched_switch")
> +__failure __msg("Sleepable program cannot attach to non-faultable tracepoint")
> +int BPF_PROG(test_sleepable_sched_switch, bool preempt,
> +            struct task_struct *prev, struct task_struct *next)
> +{
> +       return 0;
> +}
> diff --git a/tools/testing/selftests/bpf/verifier/sleepable.c b/tools/testing/selftests/bpf/verifier/sleepable.c
> index 1f0d2bdc673f..6dabc5522945 100644
> --- a/tools/testing/selftests/bpf/verifier/sleepable.c
> +++ b/tools/testing/selftests/bpf/verifier/sleepable.c
> @@ -76,7 +76,20 @@
>         .runs = -1,
>  },
>  {
> -       "sleepable raw tracepoint reject",
> +       "sleepable raw tracepoint accept",
> +       .insns = {
> +       BPF_MOV64_IMM(BPF_REG_0, 0),
> +       BPF_EXIT_INSN(),
> +       },
> +       .prog_type = BPF_PROG_TYPE_TRACING,
> +       .expected_attach_type = BPF_TRACE_RAW_TP,
> +       .kfunc = "sys_enter",
> +       .result = ACCEPT,
> +       .flags = BPF_F_SLEEPABLE,
> +       .runs = -1,
> +},
> +{
> +       "sleepable raw tracepoint reject non-faultable",
>         .insns = {
>         BPF_MOV64_IMM(BPF_REG_0, 0),
>         BPF_EXIT_INSN(),
> @@ -85,7 +98,7 @@
>         .expected_attach_type = BPF_TRACE_RAW_TP,
>         .kfunc = "sched_switch",
>         .result = REJECT,
> -       .errstr = "Only fentry/fexit/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable",
> +       .errstr = "Sleepable program cannot attach to non-faultable tracepoint",
>         .flags = BPF_F_SLEEPABLE,
>         .runs = -1,
>  },
>
> --
> 2.52.0
>