bpf: Add multi kprobe link
authorJiri Olsa <jolsa@kernel.org>
Wed, 16 Mar 2022 12:24:09 +0000 (13:24 +0100)
committerAlexei Starovoitov <ast@kernel.org>
Fri, 18 Mar 2022 03:17:18 +0000 (20:17 -0700)
commit0dcac272540613d41c05e89679e4ddb978b612f1
tree39a7dc5e536eb4ed41daa4a272cbf346b04cd09b
parentaecf489f2ce51436402818c96639ed6303b540f8
bpf: Add multi kprobe link

Adding new link type BPF_LINK_TYPE_KPROBE_MULTI that attaches kprobe
program through fprobe API.

The fprobe API allows to attach probe on multiple functions at once
very fast, because it works on top of ftrace. On the other hand this
limits the probe point to the function entry or return.

The kprobe program gets the same pt_regs input ctx as when it's attached
through the perf API.

Adding new attach type BPF_TRACE_KPROBE_MULTI that allows attachment
kprobe to multiple function with new link.

User provides array of addresses or symbols with count to attach the
kprobe program to. The new link_create uapi interface looks like:

  struct {
          __u32           flags;
          __u32           cnt;
          __aligned_u64   syms;
          __aligned_u64   addrs;
  } kprobe_multi;

The flags field allows single BPF_TRACE_KPROBE_MULTI bit to create
return multi kprobe.

Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20220316122419.933957-4-jolsa@kernel.org
include/linux/bpf_types.h
include/linux/trace_events.h
include/uapi/linux/bpf.h
kernel/bpf/syscall.c
kernel/trace/bpf_trace.c
tools/include/uapi/linux/bpf.h