On Tue, Apr 23, 2024 at 05:26:39PM -0700, Andrii Nakryiko wrote:
> On Mon, Apr 22, 2024 at 5:12 AM Jiri Olsa <jolsa@xxxxxxxxxx> wrote:
> >
> > Adding support to attach bpf program for entry and return probe
> > of the same function. This is common use case which at the moment
> > requires to create two kprobe multi links.
> >
> > Adding new BPF_TRACE_KPROBE_MULTI_SESSION attach type that instructs
> > kernel to attach single link program to both entry and exit probe.
> >
> > It's possible to control execution of the bpf program on return
> > probe simply by returning zero or non zero from the entry bpf
> > program execution to execute or not the bpf program on return
> > probe respectively.
> >
> > Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx>
> > ---
> > include/uapi/linux/bpf.h | 1 +
> > kernel/bpf/syscall.c | 7 ++++++-
> > kernel/trace/bpf_trace.c | 28 ++++++++++++++++++++--------
> > tools/include/uapi/linux/bpf.h | 1 +
> > 4 files changed, 28 insertions(+), 9 deletions(-)
> >
> > diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> > index cee0a7915c08..fb8ecb199273 100644
> > --- a/include/uapi/linux/bpf.h
> > +++ b/include/uapi/linux/bpf.h
> > @@ -1115,6 +1115,7 @@ enum bpf_attach_type {
> > BPF_CGROUP_UNIX_GETSOCKNAME,
> > BPF_NETKIT_PRIMARY,
> > BPF_NETKIT_PEER,
> > + BPF_TRACE_KPROBE_MULTI_SESSION,
>
> let's use a shorter BPF_TRACE_KPROBE_SESSION? we'll just know that
> it's multi-variant (there is no point in adding non-multi kprobes
> going forward anyways, it's a new default)
>
> > __MAX_BPF_ATTACH_TYPE
> > };
> >
>
> [...]
>
> > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> > index afb232b1d7c2..3b15a40f425f 100644
> > --- a/kernel/trace/bpf_trace.c
> > +++ b/kernel/trace/bpf_trace.c
> > @@ -1631,6 +1631,17 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
> > }
> > }
> >
> > +static bool is_kprobe_multi(const struct bpf_prog *prog)
> > +{
> > + return prog->expected_attach_type == BPF_TRACE_KPROBE_MULTI ||
> > + prog->expected_attach_type == BPF_TRACE_KPROBE_MULTI_SESSION;
> > +}
> > +
> > +static inline bool is_kprobe_multi_session(const struct bpf_prog *prog)
>
> ditto, this multi is just a distraction at this point, IMO
ok, sounds good, will drop multi for session stuff
jirka
>
> > +{
> > + return prog->expected_attach_type == BPF_TRACE_KPROBE_MULTI_SESSION;
> > +}
> > +
> > static const struct bpf_func_proto *
> > kprobe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
> > {
>
> [...]
