This patchset enhances the usability of kprobe_multi program by introducing
support for ->fill_link_info. This allows users to easily determine the
probed functions associated with a kprobe_multi program. While
`bpftool perf show` already provides information about functions probed by
perf_event programs, supporting ->fill_link_info ensures consistent access
to this information across all bpf links.
In addition, this patch extends support to generic perf events, which are
currently not covered by `bpftool perf show`. While userspace is exposed to
only the perf type and config, other attributes such as sample_period and
sample_freq are disregarded.
To ensure accurate identification of probed functions, it is preferable to
expose the address directly rather than relying solely on the symbol name.
However, this implementation respects the kptr_restrict setting and avoids
exposing the address if it is not permitted.
v6->v7:
- From Daniel
- No need to explicitly cast in many places
- Use ptr_to_u64() instead of the cast
- return -ENOMEM when calloc fails
- Simplify the code in bpf_get_kprobe_info() further
- Squash #9 with #8
- And other coding style improvement
- From Andrii
- Comment improvement
- Use ENOSPC instead of E2BIG
- Use strlen only when buf in not NULL
- Clear probe_addr in bpf_get_uprobe_info()
v5->v6:
- From Andrii
- if ucount is too less, copy ucount items and return -E2BIG
- zero out kmulti_link->cnt elements if it is not permitted by kptr
- avoid leaking information when ucount is greater than kmulti_link->cnt
- drop the flags, and add BPF_PERF_EVENT_[UK]RETPROBE
- From Quentin
- use jsonw_null instead when we have no module name
- add explanation on perf_type_name in the commit log
- avoid the unnecessary out lable
v4->v5:
- Print "func [module]" in the kprobe_multi header (Andrii)
- Remove MAX_BPF_PERF_EVENT_TYPE (Alexei)
- Add padding field for future reuse (Yonghong)
v3->v4:
- From Quentin
- Rename MODULE_NAME_LEN to MODULE_MAX_NAME
- Convert retprobe to boolean for json output
- Trim the square brackets around module names for json output
- Move perf names into link.c
- Use a generic helper to get perf names
- Show address before func name, for consistency
- Use switch-case instead of if-else
- Increase the buff len to PATH_MAX
- Move macros to the top of the file
- From Andrii
- kprobe_multi flags should always be returned
- Keep it single line if it fits in under 100 characters
- Change the output format when showing kprobe_multi
- Imporve the format of perf_event names
- Rename struct perf_link to struct perf_event, and change the names of
the enum consequently
- From Yonghong
- Avoid disallowing extensions for all structs in the big union
- From Jiri
- Add flags to bpf_kprobe_multi_link
- Report kprobe_multi selftests errors
- Rename bpf_perf_link_fill_name and make it a separate patch
- Avoid breaking compilation when CONFIG_KPROBE_EVENTS or
CONFIG_UPROBE_EVENTS options are not defined
v2->v3:
- Expose flags instead of retporbe (Andrii)
- Simplify the check on kmulti_link->cnt (Andrii)
- Use kallsyms_show_value() instead (Andrii)
- Show also the module name for kprobe_multi (Andrii)
- Add new enum bpf_perf_link_type (Andrii)
- Move perf event names into bpftool (Andrii, Quentin, Jiri)
- Keep perf event names in sync with perf tools (Jiri)
v1->v2:
- Fix sparse warning (Stanislav, lkp@xxxxxxxxx)
- Fix BPF CI build error
- Reuse kernel_syms_load() (Alexei)
- Print 'name' instead of 'func' (Alexei)
- Show whether the probe is retprobe or not (Andrii)
- Add comment for the meaning of perf_event name (Andrii)
- Add support for generic perf event
- Adhere to the kptr_restrict setting
RFC->v1:
- Use a single copy_to_user() instead (Jiri)
- Show also the symbol name in bpftool (Quentin, Alexei)
- Use calloc() instead of malloc() in bpftool (Quentin)
- Avoid having conditional entries in the JSON output (Quentin)
- Drop ->show_fdinfo (Alexei)
- Use __u64 instead of __aligned_u64 for the field addr (Alexei)
- Avoid the contradiction in perf_event name length (Alexei)
- Address a build warning reported by kernel test robot <lkp@xxxxxxxxx>
Yafang Shao (10):
bpf: Support ->fill_link_info for kprobe_multi
bpftool: Dump the kernel symbol's module name
bpftool: Show kprobe_multi link info
bpf: Protect probed address based on kptr_restrict setting
bpf: Clear the probe_addr for uprobe
bpf: Expose symbol's respective address
bpf: Add a common helper bpf_copy_to_user()
bpf: Support ->fill_link_info for perf_event
bpftool: Add perf event names
bpftool: Show perf link info
include/linux/trace_events.h | 3 +-
include/uapi/linux/bpf.h | 40 +++
kernel/bpf/syscall.c | 180 ++++++++++++-
kernel/trace/bpf_trace.c | 49 +++-
kernel/trace/trace_kprobe.c | 13 +-
kernel/trace/trace_uprobe.c | 3 +-
tools/bpf/bpftool/link.c | 432 +++++++++++++++++++++++++++++-
tools/bpf/bpftool/xlated_dumper.c | 6 +-
tools/bpf/bpftool/xlated_dumper.h | 2 +
tools/include/uapi/linux/bpf.h | 40 +++
10 files changed, 734 insertions(+), 34 deletions(-)
--
2.30.1 (Apple Git-130)
