For now, the BPF program of type BPF_PROG_TYPE_TRACING is not allowed to be attached to multiple hooks, and we have to create a BPF program for each kernel function, for which we want to trace, even through all the program have the same (or similar) logic. This can consume extra memory, and make the program loading slow if we have plenty of kernel function to trace.
In this series, we add the support to allow attaching a tracing BPF program to multi hooks, which is similar to BPF_TRACE_KPROBE_MULTI.
In the 1st patch, we add the support to record index of the accessed function args of the target for tracing program. Meanwhile, we add the function btf_check_func_part_match() to compare the accessed function args of two function prototype. This function will be used in the next commit.
In the 2nd patch, we refactor the struct modules_array to ptr_array, as we need similar function to hold the target btf, target program and kernel modules that we reference to in the following commit.
In the 3rd patch, we introduce the struct bpf_tramp_link_conn to be the bridge between bpf_link and trampoline, as the releation between bpf_link and trampoline is not one-to-one anymore.
In the 4th patch, we add the struct bpf_tramp_multi_link and bpf_trampoline_multi_{link,unlink}_prog for multi-link of trampoline.
In the 5th patch, we add target btf to the function args of bpf_check_attach_target(), then the caller can specify the btf to check.
The 6th patch is the main part to add multi-link supporting for tracing. For now, only the following attach type is supported:
BPF_TRACE_FENTRY_MULTI BPF_TRACE_FEXIT_MULTI BPF_MODIFY_RETURN_MULTI
The attach type of BPF_TRACE_RAW_TP has different link type, so we skip this part in this series for now.
In the 7th and 8th patches, we add multi-link supporting of tracing to libbpf. Note that we don't free btfs that we load after the bpf programs are loaded into the kernel now if any programs of type tracing multi-link existing, as we need to lookup the btf types during attaching.
In the 9th patch, we add the testcases for this series.
Changes since v1: - According to the advice of Alexei, introduce multi-link for tracing instead of attaching a tracing program to multiple trampolines with creating multi instance of bpf_link.
Menglong Dong (9): bpf: tracing: add support to record and check the accessed args bpf: refactor the modules_array to ptr_array bpf: trampoline: introduce struct bpf_tramp_link_conn bpf: trampoline: introduce bpf_tramp_multi_link bpf: verifier: add btf to the function args of bpf_check_attach_target bpf: tracing: add multi-link support libbpf: don't free btf if program of multi-link tracing existing libbpf: add support for the multi-link of tracing selftests/bpf: add testcases for multi-link of tracing
arch/arm64/net/bpf_jit_comp.c | 4 +- arch/riscv/net/bpf_jit_comp64.c | 4 +- arch/s390/net/bpf_jit_comp.c | 4 +- arch/x86/net/bpf_jit_comp.c | 4 +- include/linux/bpf.h | 51 ++- include/linux/bpf_verifier.h | 1 + include/uapi/linux/bpf.h | 10 + kernel/bpf/bpf_struct_ops.c | 2 +- kernel/bpf/btf.c | 113 ++++- kernel/bpf/syscall.c | 425 +++++++++++++++++- kernel/bpf/trampoline.c | 97 +++- kernel/bpf/verifier.c | 24 +- kernel/trace/bpf_trace.c | 48 +- net/bpf/test_run.c | 3 + net/core/bpf_sk_storage.c | 2 + tools/bpf/bpftool/common.c | 3 + tools/include/uapi/linux/bpf.h | 10 + tools/lib/bpf/bpf.c | 10 + tools/lib/bpf/bpf.h | 6 + tools/lib/bpf/libbpf.c | 215 ++++++++- tools/lib/bpf/libbpf.h | 16 + tools/lib/bpf/libbpf.map | 2 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 49 ++ .../bpf/prog_tests/tracing_multi_link.c | 153 +++++++ .../selftests/bpf/progs/tracing_multi_test.c | 209 +++++++++ 25 files changed, 1366 insertions(+), 99 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/tracing_multi_link.c create mode 100644 tools/testing/selftests/bpf/progs/tracing_multi_test.c