On Wed, Jun 14, 2023 at 6:36 AM Kui-Feng Lee <sinquersw@xxxxxxxxx> wrote:
>
>
>
> On 6/12/23 08:16, Yafang Shao wrote:
> > Show the already expose kprobe_multi link info in bpftool. The result as
> > follows,
> >
> > 52: kprobe_multi prog 381
> > retprobe 0 func_cnt 7
> > addrs ffffffff9ec44f20 funcs schedule_timeout_interruptible
> > ffffffff9ec44f60 schedule_timeout_killable
> > ffffffff9ec44fa0 schedule_timeout_uninterruptible
> > ffffffff9ec44fe0 schedule_timeout_idle
> > ffffffffc09468d0 xfs_trans_get_efd [xfs]
> > ffffffffc0953a10 xfs_trans_get_buf_map [xfs]
> > ffffffffc0957320 xfs_trans_get_dqtrx [xfs]
> > pids kprobe_multi(559862)
> > 53: kprobe_multi prog 381
> > retprobe 1 func_cnt 7
> > addrs ffffffff9ec44f20 funcs schedule_timeout_interruptible
> > ffffffff9ec44f60 schedule_timeout_killable
> > ffffffff9ec44fa0 schedule_timeout_uninterruptible
> > ffffffff9ec44fe0 schedule_timeout_idle
> > ffffffffc09468d0 xfs_trans_get_efd [xfs]
> > ffffffffc0953a10 xfs_trans_get_buf_map [xfs]
> > ffffffffc0957320 xfs_trans_get_dqtrx [xfs]
> > pids kprobe_multi(559862)
> >
> > $ tools/bpf/bpftool/bpftool link show -j
> > [{"id":52,"type":"kprobe_multi","prog_id":381,"retprobe":0,"func_cnt":7,"funcs":[{"addr":18446744072078249760,"func":"schedule_timeout_interruptible","module":""},{"addr":18446744072078249824,"func":"schedule_timeout_killable","module":""},{"addr":18446744072078249888,"func":"schedule_timeout_uninterruptible","module":""},{"addr":18446744072078249952,"func":"schedule_timeout_idle","module":""},{"addr":18446744072645535952,"func":"xfs_trans_get_efd","module":"[xfs]"},{"addr":18446744072645589520,"func":"xfs_trans_get_buf_map","module":"[xfs]"},{"addr":18446744072645604128,"func":"xfs_trans_get_dqtrx","module":"[xfs]"}],"pids":[{"pid":559862,"comm":"kprobe_multi"}]},{"id":53,"type":"kprobe_multi","prog_id":381,"retprobe":1,"func_cnt":7,"funcs":[{"addr":18446744072078249760,"func":"schedule_timeout_interruptible","module":""},{"addr":18446744072078249824,"func":"schedule_timeout_killable","module":""},{"addr":18446744072078249888,"func":"schedule_timeout_uninterruptible","module":""},{"addr":18446744072078249952,"func":"schedule_timeout_idle","module":""},{"addr":18446744072645535952,"func":"xfs_trans_get_efd","module":"[xfs]"},{"addr":18446744072645589520,"func":"xfs_trans_get_buf_map","module":"[xfs]"},{"addr":18446744072645604128,"func":"xfs_trans_get_dqtrx","module":"[xfs]"}],"pids":[{"pid":559862,"comm":"kprobe_multi"}]}]
> >
> > Signed-off-by: Yafang Shao <laoar.shao@xxxxxxxxx>
> > ---
> > tools/bpf/bpftool/link.c | 109 ++++++++++++++++++++++++++++++++++++++++++++++-
> > 1 file changed, 108 insertions(+), 1 deletion(-)
> >
> > diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
> > index 2d78607..0015582 100644
> > --- a/tools/bpf/bpftool/link.c
> > +++ b/tools/bpf/bpftool/link.c
> > @@ -14,8 +14,10 @@
> >
> > #include "json_writer.h"
> > #include "main.h"
> > +#include "xlated_dumper.h"
> >
> > static struct hashmap *link_table;
> > +static struct dump_data dd = {};
> >
> > static int link_parse_fd(int *argc, char ***argv)
> > {
> > @@ -166,6 +168,45 @@ static int get_prog_info(int prog_id, struct bpf_prog_info *info)
> > return err;
> > }
> >
> > +static int cmp_u64(const void *A, const void *B)
> > +{
> > + const __u64 *a = A, *b = B;
> > +
> > + return *a - *b;
> > +}
> > +
> > +static void
> > +show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr)
> > +{
> > + __u32 i, j = 0;
> > + __u64 *addrs;
> > +
> > + jsonw_uint_field(json_wtr, "retprobe",
> > + info->kprobe_multi.flags & BPF_F_KPROBE_MULTI_RETURN);
> > + jsonw_uint_field(json_wtr, "func_cnt", info->kprobe_multi.count);
> > + jsonw_name(json_wtr, "funcs");
> > + jsonw_start_array(json_wtr);
> > + addrs = (__u64 *)u64_to_ptr(info->kprobe_multi.addrs);
> > + qsort((void *)addrs, info->kprobe_multi.count, sizeof(__u64), cmp_u64);
> > +
> > + /* Load it once for all. */
> > + if (!dd.sym_count)
> > + kernel_syms_load(&dd);
> > + for (i = 0; i < dd.sym_count; i++) {
> > + if (dd.sym_mapping[i].address != addrs[j])
> > + continue;
> > + jsonw_start_object(json_wtr);
> > + jsonw_uint_field(json_wtr, "addr", dd.sym_mapping[i].address);
> > + jsonw_string_field(json_wtr, "func", dd.sym_mapping[i].name);
> > + /* Print none if it is vmlinux */
> > + jsonw_string_field(json_wtr, "module", dd.sym_mapping[i].module);
> > + jsonw_end_object(json_wtr);
> > + if (j++ == info->kprobe_multi.count)
> > + break;
> > + }
> > + jsonw_end_array(json_wtr);
> > +}
> > +
> > static int show_link_close_json(int fd, struct bpf_link_info *info)
> > {
> > struct bpf_prog_info prog_info;
> > @@ -218,6 +259,9 @@ static int show_link_close_json(int fd, struct bpf_link_info *info)
> > jsonw_uint_field(json_wtr, "map_id",
> > info->struct_ops.map_id);
> > break;
> > + case BPF_LINK_TYPE_KPROBE_MULTI:
> > + show_kprobe_multi_json(info, json_wtr);
> > + break;
> > default:
> > break;
> > }
> > @@ -351,6 +395,44 @@ void netfilter_dump_plain(const struct bpf_link_info *info)
> > printf(" flags 0x%x", info->netfilter.flags);
> > }
> >
> > +static void show_kprobe_multi_plain(struct bpf_link_info *info)
> > +{
> > + __u32 i, j = 0;
> > + __u64 *addrs;
> > +
> > + if (!info->kprobe_multi.count)
> > + return;
> > +
> > + printf("\n\tretprobe %d func_cnt %u ",
> > + info->kprobe_multi.flags & BPF_F_KPROBE_MULTI_RETURN,
> > + info->kprobe_multi.count);
> > + addrs = (__u64 *)u64_to_ptr(info->kprobe_multi.addrs);
> > + qsort((void *)addrs, info->kprobe_multi.count, sizeof(__u64), cmp_u64);
> > +
> > + /* Load it once for all. */
> > + if (!dd.sym_count)
> > + kernel_syms_load(&dd);
> > + for (i = 0; i < dd.sym_count; i++) {
> > + if (dd.sym_mapping[i].address != addrs[j])
> > + continue;
> > + if (!j)
> > + printf("\n\taddrs %016lx funcs %s",
> > + dd.sym_mapping[i].address,
> > + dd.sym_mapping[i].name);
> > + else
> > + printf("\n\t %016lx %s",
> > + dd.sym_mapping[i].address,
> > + dd.sym_mapping[i].name);
> > + if (dd.sym_mapping[i].module[0] != '\0')
> > + printf(" %s ", dd.sym_mapping[i].module);
> > + else
> > + printf(" ");
>
> Could you explain what these extra spaces after module names are for?
There are two spaces. We use two spaces to seperate different items
printed in bpftool. For example,
"4: kprobe_multi prog 16"
There are two spaces between the "type" and the "prog".
We always print these two spaces after one item is printed:
printf("type %u ", info->type);
printf("prog %u ", info->prog_id);
That way, we can add new item easily and consistently.
--
Regards
Yafang
