On Sun, Aug 15, 2021 at 12:05:58AM -0700, Andrii Nakryiko wrote: > Add ability for users to specify custom u64 value (bpf_cookie) when creating > BPF link for perf_event-backed BPF programs (kprobe/uprobe, perf_event, > tracepoints). > > This is useful for cases when the same BPF program is used for attaching and > processing invocation of different tracepoints/kprobes/uprobes in a generic > fashion, but such that each invocation is distinguished from each other (e.g., > BPF program can look up additional information associated with a specific > kernel function without having to rely on function IP lookups). This enables > new use cases to be implemented simply and efficiently that previously were > possible only through code generation (and thus multiple instances of almost > identical BPF program) or compilation at runtime (BCC-style) on target hosts > (even more expensive resource-wise). For uprobes it is not even possible in > some cases to know function IP before hand (e.g., when attaching to shared > library without PID filtering, in which case base load address is not known > for a library). > > This is done by storing u64 bpf_cookie in struct bpf_prog_array_item, > corresponding to each attached and run BPF program. Given cgroup BPF programs > already use two 8-byte pointers for their needs and cgroup BPF programs don't > have (yet?) support for bpf_cookie, reuse that space through union of > cgroup_storage and new bpf_cookie field. > > Make it available to kprobe/tracepoint BPF programs through bpf_trace_run_ctx. > This is set by BPF_PROG_RUN_ARRAY, used by kprobe/uprobe/tracepoint BPF > program execution code, which luckily is now also split from > BPF_PROG_RUN_ARRAY_CG. This run context will be utilized by a new BPF helper > giving access to this user-provided cookie value from inside a BPF program. > Generic perf_event BPF programs will access this value from perf_event itself > through passed in BPF program context. > > Acked-by: Yonghong Song <yhs@xxxxxx> > Signed-off-by: Andrii Nakryiko <andrii@xxxxxxxxxx> > --- > drivers/media/rc/bpf-lirc.c | 4 ++-- > include/linux/bpf.h | 16 +++++++++++++++- > include/linux/perf_event.h | 1 + > include/linux/trace_events.h | 6 +++--- > include/uapi/linux/bpf.h | 7 +++++++ > kernel/bpf/core.c | 29 ++++++++++++++++++----------- > kernel/bpf/syscall.c | 2 +- > kernel/events/core.c | 21 ++++++++++++++------- > kernel/trace/bpf_trace.c | 8 +++++--- > tools/include/uapi/linux/bpf.h | 7 +++++++ > 10 files changed, 73 insertions(+), 28 deletions(-) > Acked-by: Peter Zijlstra (Intel) <peterz@xxxxxxxxxxxxx>
