Re: [PATCH 11/19] bpf: Add support to load multi func tracing program

[Yonghong Song <yhs@fb.com>]

On 6/7/21 11:18 AM, Jiri Olsa wrote:
> On Sun, Jun 06, 2021 at 08:56:47PM -0700, Yonghong Song wrote:
>>
>>
>> On 6/5/21 4:10 AM, Jiri Olsa wrote:
>>> Adding support to load tracing program with new BPF_F_MULTI_FUNC flag,
>>> that allows the program to be loaded without specific function to be
>>> attached to.
>>>
>>> The verifier assumes the program is using all (6) available arguments
>>
>> Is this a verifier failure or it is due to the check in the
>> beginning of function arch_prepare_bpf_trampoline()?
>>
>>          /* x86-64 supports up to 6 arguments. 7+ can be added in the future
>> */
>>          if (nr_args > 6)
>>                  return -ENOTSUPP;
> 
> yes, that's the limit.. it allows the traced program to
> touch 6 arguments, because it's the maximum for JIT
> 
>>
>> If it is indeed due to arch_prepare_bpf_trampoline() maybe we
>> can improve it instead of specially processing the first argument
>> "ip" in quite some places?
> 
> do you mean to teach JIT to process more than 6 arguments?

Yes. Not sure how hard it is. If it is doable with reasonable 
complexity, I think it will be worth it as it will benefit this
case to avoid special tweaks of the first argument, but also
benefit other cases e.g., attaching to a kernel function with
7 or more arguments.

> 
>>
>>> as unsigned long values. We can't add extra ip argument at this time,
>>> because JIT on x86 would fail to process this function. Instead we
>>> allow to access extra first 'ip' argument in btf_ctx_access.
>>>
>>> Such program will be allowed to be attached to multiple functions
>>> in following patches.
>>>
>>> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
>>> ---
>>>    include/linux/bpf.h            |  1 +
>>>    include/uapi/linux/bpf.h       |  7 +++++++
>>>    kernel/bpf/btf.c               |  5 +++++
>>>    kernel/bpf/syscall.c           | 35 +++++++++++++++++++++++++++++-----
>>>    kernel/bpf/verifier.c          |  3 ++-
>>>    tools/include/uapi/linux/bpf.h |  7 +++++++
>>>    6 files changed, 52 insertions(+), 6 deletions(-)
>>>
[...]