Re: [PATCH bpf-next 2/7] bpf: Add support for kprobe multi session context

[Jiri Olsa <olsajiri@gmail.com>]

On Tue, Apr 23, 2024 at 05:26:45PM -0700, Andrii Nakryiko wrote:
> On Mon, Apr 22, 2024 at 5:13 AM Jiri Olsa <jolsa@kernel.org> wrote:
> >
> > Adding struct bpf_session_run_ctx object to hold session related
> > data, which is atm is_return bool and data pointer coming in
> > following changes.
> >
> > Placing bpf_session_run_ctx layer in between bpf_run_ctx and
> > bpf_kprobe_multi_run_ctx so the session data can be retrieved
> > regardless of if it's kprobe_multi or uprobe_multi link, which
> > support is coming in future. This way both kprobe_multi and
> > uprobe_multi can use same kfuncs to access the session data.
> >
> > Adding bpf_session_is_return kfunc that returns true if the
> > bpf program is executed from the exit probe of the kprobe multi
> > link attached in wrapper mode. It returns false otherwise.
> >
> > Adding new kprobe hook for kprobe program type.
> >
> > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > ---
> >  kernel/bpf/btf.c         |  3 ++
> >  kernel/trace/bpf_trace.c | 67 +++++++++++++++++++++++++++++++++++-----
> >  2 files changed, 63 insertions(+), 7 deletions(-)
> >
> 
> LGTM, but see the question below
> 
> Acked-by: Andrii Nakryiko <andrii@kernel.org>
> 
> [...]
> 
> > @@ -2848,7 +2859,7 @@ kprobe_multi_link_handler(struct fprobe *fp, unsigned long fentry_ip,
> >         int err;
> >
> >         link = container_of(fp, struct bpf_kprobe_multi_link, fp);
> > -       err = kprobe_multi_link_prog_run(link, get_entry_ip(fentry_ip), regs);
> > +       err = kprobe_multi_link_prog_run(link, get_entry_ip(fentry_ip), regs, false);
> >         return is_kprobe_multi_session(link->link.prog) ? err : 0;
> >  }
> >
> > @@ -2860,7 +2871,7 @@ kprobe_multi_link_exit_handler(struct fprobe *fp, unsigned long fentry_ip,
> >         struct bpf_kprobe_multi_link *link;
> >
> >         link = container_of(fp, struct bpf_kprobe_multi_link, fp);
> > -       kprobe_multi_link_prog_run(link, get_entry_ip(fentry_ip), regs);
> > +       kprobe_multi_link_prog_run(link, get_entry_ip(fentry_ip), regs, true);
> 
> Is there some way to figure out whether we are an entry or return
> probe from struct fprobe itself? I was hoping to have a single
> callback for both entry and exit handler in fprobe to keep callback
> call chain a bit simpler

AFAICS not at the moment.. also both callbacks have same arguments,
just the entry handler returns int and exit handler void

jirka