On 17/06/2019 21:40, Jiong Wang wrote: > Now if we don't split patch when patch an insn inside patch, instead, if we > replace the patched insn using what you suggested, then the logic looks to > me becomes even more complex, something like > > for (idx = 0; idx < insn_cnt; idx++) { > if (insns[idx] is not BPF_LIST_INSN) { > do_insn(...) > } > else if (insns[idx] is BPF_LIST_INSN) { > list = pool_base + insn.imm; > while (list) { > insn = list_head->insn; > if (insn is BF_LIST_INSN) { > sub_list = ... > while () > do_insn() > continue; > } > do_insn(...) > list = pool_base + list->next; > } > } > } Why can't do_insn() just go like: if (insn is BPF_LIST_INSN) for (idx = 0; idx < LIST_COUNT(insn); idx++) do_insn(pool_base + LIST_START(insn) + idx); else rest of processing ? Alternatively, iterate with something more sophisticated than 'idx++' (standard recursion-to-loop transformation). You shouldn't ever need a for() tower statically in the code... > So, I am thinking what Alexei and Andrii suggested make sense, just use > single data structure (singly linked list) to represent everything, so the > insn traversal etc could be simple But then you have to also store orig_insn_idx with each insn, so you can calculate the new jump offsets when you linearise. Having an array of patched_orig_insns gives you that for free.