Re: [PATCH bpf-next 1/7] bpf: Add support for kprobe multi session attach

[Andrii Nakryiko <andrii.nakryiko@gmail.com>]

On Mon, Apr 22, 2024 at 5:12 AM Jiri Olsa <jolsa@kernel.org> wrote:
>
> Adding support to attach bpf program for entry and return probe
> of the same function. This is common use case which at the moment
> requires to create two kprobe multi links.
>
> Adding new BPF_TRACE_KPROBE_MULTI_SESSION attach type that instructs
> kernel to attach single link program to both entry and exit probe.
>
> It's possible to control execution of the bpf program on return
> probe simply by returning zero or non zero from the entry bpf
> program execution to execute or not the bpf program on return
> probe respectively.
>
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> ---
>  include/uapi/linux/bpf.h       |  1 +
>  kernel/bpf/syscall.c           |  7 ++++++-
>  kernel/trace/bpf_trace.c       | 28 ++++++++++++++++++++--------
>  tools/include/uapi/linux/bpf.h |  1 +
>  4 files changed, 28 insertions(+), 9 deletions(-)
>
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index cee0a7915c08..fb8ecb199273 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -1115,6 +1115,7 @@ enum bpf_attach_type {
>         BPF_CGROUP_UNIX_GETSOCKNAME,
>         BPF_NETKIT_PRIMARY,
>         BPF_NETKIT_PEER,
> +       BPF_TRACE_KPROBE_MULTI_SESSION,

let's use a shorter BPF_TRACE_KPROBE_SESSION? we'll just know that
it's multi-variant (there is no point in adding non-multi kprobes
going forward anyways, it's a new default)

>         __MAX_BPF_ATTACH_TYPE
>  };
>

[...]

> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index afb232b1d7c2..3b15a40f425f 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -1631,6 +1631,17 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
>         }
>  }
>
> +static bool is_kprobe_multi(const struct bpf_prog *prog)
> +{
> +       return prog->expected_attach_type == BPF_TRACE_KPROBE_MULTI ||
> +              prog->expected_attach_type == BPF_TRACE_KPROBE_MULTI_SESSION;
> +}
> +
> +static inline bool is_kprobe_multi_session(const struct bpf_prog *prog)

ditto, this multi is just a distraction at this point, IMO

> +{
> +       return prog->expected_attach_type == BPF_TRACE_KPROBE_MULTI_SESSION;
> +}
> +
>  static const struct bpf_func_proto *
>  kprobe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
>  {

[...]