[LSF/MM/BPF TOPIC] multi kprobe updates

[LSF/MM/BPF TOPIC] multi kprobe updates

[Jiri Olsa]

There's few ongoing kprobe multi features that I'd like to give an update
about and discuss.

- Support to execute bpf program for both entry and return probes. This
  way we don't need to create 2 links when we need to run bpf program on
  entry/return probes of the same function, first rfc posted [0].

- In addition to above feature introduce shared 'session' data between
  entry and exit probe accessible from bpf program, originally discussed
  in [1].

- Allow to use per program re-entry checks instead of current hard coded
  per cpu re-entry check, or just change to per program check directly.

- There's ongoing development of patchset moving fprobe implementation
  from function tracer on top of fgraph tracer by Masami Hiramatsu [2].
  As kprobe multi link is implemented via fprobe I'd like to give an
  update what this change means for kprobe multi link.


[0] https://lore.kernel.org/bpf/20240207153550.856536-1-jolsa@kernel.org/
[1] https://lore.kernel.org/bpf/CAEf4Bzb6sPXAtDVke=CtCXev0mxhfgEG_O-xUA-e9-8NnbBtJQ@mail.gmail.com/
[2] https://lore.kernel.org/bpf/170723204881.502590.11906735097521170661.stgit@devnote2/

Re: [LSF/MM/BPF TOPIC] multi kprobe updates

[Masami Hiramatsu]

On Thu, 22 Feb 2024 11:18:33 +0100
Jiri Olsa <olsajiri@gmail.com> wrote:

> There's few ongoing kprobe multi features that I'd like to give an update
> about and discuss.
> 
> - Support to execute bpf program for both entry and return probes. This
>   way we don't need to create 2 links when we need to run bpf program on
>   entry/return probes of the same function, first rfc posted [0].
> 
> - In addition to above feature introduce shared 'session' data between
>   entry and exit probe accessible from bpf program, originally discussed
>   in [1].
> 
> - Allow to use per program re-entry checks instead of current hard coded
>   per cpu re-entry check, or just change to per program check directly.
> 
> - There's ongoing development of patchset moving fprobe implementation
>   from function tracer on top of fgraph tracer by Masami Hiramatsu [2].
>   As kprobe multi link is implemented via fprobe I'd like to give an
>   update what this change means for kprobe multi link.

And now I updated the series.[3] This changes the ftrace_regs accessible
registers according to the context. In entry probe, no change, but exit
probe can only access return value, return address (as instruction pointer)
and frame pointer if available.

[3] https://lore.kernel.org/all/170887410337.564249.6360118840946697039.stgit@devnote2/

Thanks,

> 
> 
> [0] https://lore.kernel.org/bpf/20240207153550.856536-1-jolsa@kernel.org/
> [1] https://lore.kernel.org/bpf/CAEf4Bzb6sPXAtDVke=CtCXev0mxhfgEG_O-xUA-e9-8NnbBtJQ@mail.gmail.com/
> [2] https://lore.kernel.org/bpf/170723204881.502590.11906735097521170661.stgit@devnote2/


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>