hi,
adding support to attach both entry and return bpf program on single
kprobe multi link. The first RFC patchset is in [0].
Having entry together with return probe for given function is common
use case for tetragon, bpftrace and most likely for others.
At the moment if we want both entry and return probe to execute bpf
program we need to create two (entry and return probe) links. The link
for return probe creates extra entry probe to setup the return probe.
The extra entry probe execution could be omitted if we had a way to
use just single link for both entry and exit probe.
In addition it's possible to control the execution of the return probe
with the return value of the entry bpf program. If the entry program
returns 0 the return probe is installed and executed, otherwise it's
skip.
v2 changes:
- adding 'kprobe.wrapper' program that is called both for entry and
exit probe [Andrii]
- I kept the interface that adds new flag in attr.link_create.kprobe_multi.flags,
because I don't see it breaking backward compatibility and it's much simpler
than new attach type, I tried to discuss this in [1], but I'm ok to change
that if it turns out to be a problem
thanks,
jirka
[0] https://lore.kernel.org/bpf/20240207153550.856536-1-jolsa@xxxxxxxxxx/
[1] https://lore.kernel.org/bpf/ZdhmKQ1_vpCJTS_U@krava/
---
Jiri Olsa (4):
bpf: Add support for kprobe multi wrapper attach
bpf: Add bpf_kprobe_multi_is_return kfunc
libbpf: Add support for kprobe multi wrapper attach
selftests/bpf: Add kprobe multi wrapper test
include/uapi/linux/bpf.h | 3 ++-
kernel/bpf/btf.c | 3 +++
kernel/trace/bpf_trace.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++++-------
tools/include/uapi/linux/bpf.h | 3 ++-
tools/lib/bpf/libbpf.c | 38 ++++++++++++++++++++++++++++---
tools/lib/bpf/libbpf.h | 4 +++-
tools/testing/selftests/bpf/bpf_kfuncs.h | 2 ++
tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c | 49 ++++++++++++++++++++++++++++++++++++++++
tools/testing/selftests/bpf/progs/kprobe_multi_wrapper.c | 100 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
9 files changed, 259 insertions(+), 14 deletions(-)
create mode 100644 tools/testing/selftests/bpf/progs/kprobe_multi_wrapper.c
