2023-06-14 10:42 UTC+0800 ~ Yafang Shao <laoar.shao@xxxxxxxxx>
> On Wed, Jun 14, 2023 at 6:36 AM Kui-Feng Lee <sinquersw@xxxxxxxxx> wrote:
>>
>>
>>
>> On 6/12/23 08:16, Yafang Shao wrote:
>>> Show the already expose kprobe_multi link info in bpftool. The result as
>>> follows,
>>>
>>> 52: kprobe_multi prog 381
>>> retprobe 0 func_cnt 7
>>> addrs ffffffff9ec44f20 funcs schedule_timeout_interruptible
>>> ffffffff9ec44f60 schedule_timeout_killable
>>> ffffffff9ec44fa0 schedule_timeout_uninterruptible
>>> ffffffff9ec44fe0 schedule_timeout_idle
>>> ffffffffc09468d0 xfs_trans_get_efd [xfs]
>>> ffffffffc0953a10 xfs_trans_get_buf_map [xfs]
>>> ffffffffc0957320 xfs_trans_get_dqtrx [xfs]
>>> pids kprobe_multi(559862)
>>> 53: kprobe_multi prog 381
>>> retprobe 1 func_cnt 7
>>> addrs ffffffff9ec44f20 funcs schedule_timeout_interruptible
>>> ffffffff9ec44f60 schedule_timeout_killable
>>> ffffffff9ec44fa0 schedule_timeout_uninterruptible
>>> ffffffff9ec44fe0 schedule_timeout_idle
>>> ffffffffc09468d0 xfs_trans_get_efd [xfs]
>>> ffffffffc0953a10 xfs_trans_get_buf_map [xfs]
>>> ffffffffc0957320 xfs_trans_get_dqtrx [xfs]
>>> pids kprobe_multi(559862)
>>>
>>> $ tools/bpf/bpftool/bpftool link show -j
>>> [{"id":52,"type":"kprobe_multi","prog_id":381,"retprobe":0,"func_cnt":7,"funcs":[{"addr":18446744072078249760,"func":"schedule_timeout_interruptible","module":""},{"addr":18446744072078249824,"func":"schedule_timeout_killable","module":""},{"addr":18446744072078249888,"func":"schedule_timeout_uninterruptible","module":""},{"addr":18446744072078249952,"func":"schedule_timeout_idle","module":""},{"addr":18446744072645535952,"func":"xfs_trans_get_efd","module":"[xfs]"},{"addr":18446744072645589520,"func":"xfs_trans_get_buf_map","module":"[xfs]"},{"addr":18446744072645604128,"func":"xfs_trans_get_dqtrx","module":"[xfs]"}],"pids":[{"pid":559862,"comm":"kprobe_multi"}]},{"id":53,"type":"kprobe_multi","prog_id":381,"retprobe":1,"func_cnt":7,"funcs":[{"addr":18446744072078249760,"func":"schedule_timeout_interruptible","module":""},{"addr":18446744072078249824,"func":"schedule_timeout_killable","module":""},{"addr":18446744072078249888,"func":"schedule_timeout_uninterruptible","module":""},{"addr":18446744072078249952,"func":"schedule_timeout_idle","module":""},{"addr":18446744072645535952,"func":"xfs_trans_get_efd","module":"[xfs]"},{"addr":18446744072645589520,"func":"xfs_trans_get_buf_map","module":"[xfs]"},{"addr":18446744072645604128,"func":"xfs_trans_get_dqtrx","module":"[xfs]"}],"pids":[{"pid":559862,"comm":"kprobe_multi"}]}]
>>>
>>> Signed-off-by: Yafang Shao <laoar.shao@xxxxxxxxx>
>>> ---
>>> tools/bpf/bpftool/link.c | 109 ++++++++++++++++++++++++++++++++++++++++++++++-
>>> 1 file changed, 108 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
>>> index 2d78607..0015582 100644
>>> --- a/tools/bpf/bpftool/link.c
>>> +++ b/tools/bpf/bpftool/link.c
>>> @@ -14,8 +14,10 @@
>>>
>>> #include "json_writer.h"
>>> #include "main.h"
>>> +#include "xlated_dumper.h"
>>>
>>> static struct hashmap *link_table;
>>> +static struct dump_data dd = {};
>>>
>>> static int link_parse_fd(int *argc, char ***argv)
>>> {
>>> @@ -166,6 +168,45 @@ static int get_prog_info(int prog_id, struct bpf_prog_info *info)
>>> return err;
>>> }
>>>
>>> +static int cmp_u64(const void *A, const void *B)
>>> +{
>>> + const __u64 *a = A, *b = B;
>>> +
>>> + return *a - *b;
>>> +}
>>> +
>>> +static void
>>> +show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr)
>>> +{
>>> + __u32 i, j = 0;
>>> + __u64 *addrs;
>>> +
>>> + jsonw_uint_field(json_wtr, "retprobe",
>>> + info->kprobe_multi.flags & BPF_F_KPROBE_MULTI_RETURN);
>>> + jsonw_uint_field(json_wtr, "func_cnt", info->kprobe_multi.count);
>>> + jsonw_name(json_wtr, "funcs");
>>> + jsonw_start_array(json_wtr);
>>> + addrs = (__u64 *)u64_to_ptr(info->kprobe_multi.addrs);
>>> + qsort((void *)addrs, info->kprobe_multi.count, sizeof(__u64), cmp_u64);
>>> +
>>> + /* Load it once for all. */
>>> + if (!dd.sym_count)
>>> + kernel_syms_load(&dd);
>>> + for (i = 0; i < dd.sym_count; i++) {
>>> + if (dd.sym_mapping[i].address != addrs[j])
>>> + continue;
>>> + jsonw_start_object(json_wtr);
>>> + jsonw_uint_field(json_wtr, "addr", dd.sym_mapping[i].address);
>>> + jsonw_string_field(json_wtr, "func", dd.sym_mapping[i].name);
>>> + /* Print none if it is vmlinux */
>>> + jsonw_string_field(json_wtr, "module", dd.sym_mapping[i].module);
>>> + jsonw_end_object(json_wtr);
>>> + if (j++ == info->kprobe_multi.count)
>>> + break;
>>> + }
>>> + jsonw_end_array(json_wtr);
>>> +}
>>> +
>>> static int show_link_close_json(int fd, struct bpf_link_info *info)
>>> {
>>> struct bpf_prog_info prog_info;
>>> @@ -218,6 +259,9 @@ static int show_link_close_json(int fd, struct bpf_link_info *info)
>>> jsonw_uint_field(json_wtr, "map_id",
>>> info->struct_ops.map_id);
>>> break;
>>> + case BPF_LINK_TYPE_KPROBE_MULTI:
>>> + show_kprobe_multi_json(info, json_wtr);
>>> + break;
>>> default:
>>> break;
>>> }
>>> @@ -351,6 +395,44 @@ void netfilter_dump_plain(const struct bpf_link_info *info)
>>> printf(" flags 0x%x", info->netfilter.flags);
>>> }
>>>
>>> +static void show_kprobe_multi_plain(struct bpf_link_info *info)
>>> +{
>>> + __u32 i, j = 0;
>>> + __u64 *addrs;
>>> +
>>> + if (!info->kprobe_multi.count)
>>> + return;
>>> +
>>> + printf("\n\tretprobe %d func_cnt %u ",
>>> + info->kprobe_multi.flags & BPF_F_KPROBE_MULTI_RETURN,
>>> + info->kprobe_multi.count);
>>> + addrs = (__u64 *)u64_to_ptr(info->kprobe_multi.addrs);
>>> + qsort((void *)addrs, info->kprobe_multi.count, sizeof(__u64), cmp_u64);
>>> +
>>> + /* Load it once for all. */
>>> + if (!dd.sym_count)
>>> + kernel_syms_load(&dd);
>>> + for (i = 0; i < dd.sym_count; i++) {
>>> + if (dd.sym_mapping[i].address != addrs[j])
>>> + continue;
>>> + if (!j)
>>> + printf("\n\taddrs %016lx funcs %s",
>>> + dd.sym_mapping[i].address,
>>> + dd.sym_mapping[i].name);
>>> + else
>>> + printf("\n\t %016lx %s",
>>> + dd.sym_mapping[i].address,
>>> + dd.sym_mapping[i].name);
>>> + if (dd.sym_mapping[i].module[0] != '\0')
>>> + printf(" %s ", dd.sym_mapping[i].module);
>>> + else
>>> + printf(" ");
>>
>> Could you explain what these extra spaces after module names are for?
>
> There are two spaces. We use two spaces to seperate different items
> printed in bpftool. For example,
> "4: kprobe_multi prog 16"
> There are two spaces between the "type" and the "prog".
>
> We always print these two spaces after one item is printed:
> printf("type %u ", info->type);
> printf("prog %u ", info->prog_id);
> That way, we can add new item easily and consistently.
>
I'm not sure we _always_ do it at the end of lines, but it seems to be
rather consistent in link.c at least. For my part I don't know if this
printf(" ") is really necessary - I'd rather avoid spaces at the end of
lines, but then there would be several other locations to update. So I
don't have any objection, either.
Quentin
