| Message ID | 20230628115329.248450-1-laoar.shao@gmail.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | bpf: Support ->fill_link_info for kprobe_multi and perf_event links | expand |
On Wed, Jun 28, 2023 at 11:53:18AM +0000, Yafang Shao wrote: > This patchset enhances the usability of kprobe_multi program by introducing > support for ->fill_link_info. This allows users to easily determine the > probed functions associated with a kprobe_multi program. While > `bpftool perf show` already provides information about functions probed by > perf_event programs, supporting ->fill_link_info ensures consistent access > to this information across all bpf links. > > In addition, this patch extends support to generic perf events, which are > currently not covered by `bpftool perf show`. While userspace is exposed to > only the perf type and config, other attributes such as sample_period and > sample_freq are disregarded. > > To ensure accurate identification of probed functions, it is preferable to > expose the address directly rather than relying solely on the symbol name. > However, this implementation respects the kptr_restrict setting and avoids > exposing the address if it is not permitted. > > v5->v6: > - From Andrii > - if ucount is too less, copy ucount items and return -E2BIG > - zero out kmulti_link->cnt elements if it is not permitted by kptr > - avoid leaking information when ucount is greater than kmulti_link->cnt > - drop the flags, and add BPF_PERF_EVENT_[UK]RETPROBE > - From Quentin > - use jsonw_null instead when we have no module name > - add explanation on perf_type_name in the commit log > - avoid the unnecessary out lable Acked-by: Jiri Olsa <jolsa@kernel.org> jirka
This patchset enhances the usability of kprobe_multi program by introducing support for ->fill_link_info. This allows users to easily determine the probed functions associated with a kprobe_multi program. While `bpftool perf show` already provides information about functions probed by perf_event programs, supporting ->fill_link_info ensures consistent access to this information across all bpf links. In addition, this patch extends support to generic perf events, which are currently not covered by `bpftool perf show`. While userspace is exposed to only the perf type and config, other attributes such as sample_period and sample_freq are disregarded. To ensure accurate identification of probed functions, it is preferable to expose the address directly rather than relying solely on the symbol name. However, this implementation respects the kptr_restrict setting and avoids exposing the address if it is not permitted. v5->v6: - From Andrii - if ucount is too less, copy ucount items and return -E2BIG - zero out kmulti_link->cnt elements if it is not permitted by kptr - avoid leaking information when ucount is greater than kmulti_link->cnt - drop the flags, and add BPF_PERF_EVENT_[UK]RETPROBE - From Quentin - use jsonw_null instead when we have no module name - add explanation on perf_type_name in the commit log - avoid the unnecessary out lable v4->v5: - Print "func [module]" in the kprobe_multi header (Andrii) - Remove MAX_BPF_PERF_EVENT_TYPE (Alexei) - Add padding field for future reuse (Yonghong) v3->v4: - From Quentin - Rename MODULE_NAME_LEN to MODULE_MAX_NAME - Convert retprobe to boolean for json output - Trim the square brackets around module names for json output - Move perf names into link.c - Use a generic helper to get perf names - Show address before func name, for consistency - Use switch-case instead of if-else - Increase the buff len to PATH_MAX - Move macros to the top of the file - From Andrii - kprobe_multi flags should always be returned - Keep it single line if it fits in under 100 characters - Change the output format when showing kprobe_multi - Imporve the format of perf_event names - Rename struct perf_link to struct perf_event, and change the names of the enum consequently - From Yonghong - Avoid disallowing extensions for all structs in the big union - From Jiri - Add flags to bpf_kprobe_multi_link - Report kprobe_multi selftests errors - Rename bpf_perf_link_fill_name and make it a separate patch - Avoid breaking compilation when CONFIG_KPROBE_EVENTS or CONFIG_UPROBE_EVENTS options are not defined v2->v3: - Expose flags instead of retporbe (Andrii) - Simplify the check on kmulti_link->cnt (Andrii) - Use kallsyms_show_value() instead (Andrii) - Show also the module name for kprobe_multi (Andrii) - Add new enum bpf_perf_link_type (Andrii) - Move perf event names into bpftool (Andrii, Quentin, Jiri) - Keep perf event names in sync with perf tools (Jiri) v1->v2: - Fix sparse warning (Stanislav, lkp@intel.com) - Fix BPF CI build error - Reuse kernel_syms_load() (Alexei) - Print 'name' instead of 'func' (Alexei) - Show whether the probe is retprobe or not (Andrii) - Add comment for the meaning of perf_event name (Andrii) - Add support for generic perf event - Adhere to the kptr_restrict setting RFC->v1: - Use a single copy_to_user() instead (Jiri) - Show also the symbol name in bpftool (Quentin, Alexei) - Use calloc() instead of malloc() in bpftool (Quentin) - Avoid having conditional entries in the JSON output (Quentin) - Drop ->show_fdinfo (Alexei) - Use __u64 instead of __aligned_u64 for the field addr (Alexei) - Avoid the contradiction in perf_event name length (Alexei) - Address a build warning reported by kernel test robot <lkp@intel.com> Yafang Shao (11): bpf: Support ->fill_link_info for kprobe_multi bpftool: Dump the kernel symbol's module name bpftool: Show kprobe_multi link info bpf: Protect probed address based on kptr_restrict setting bpf: Clear the probe_addr for uprobe bpf: Expose symbol's respective address bpf: Add a common helper bpf_copy_to_user() bpf: Add bpf_perf_link_fill_common() bpf: Support ->fill_link_info for perf_event bpftool: Add perf event names bpftool: Show perf link info include/uapi/linux/bpf.h | 40 +++ kernel/bpf/syscall.c | 185 ++++++++++++- kernel/trace/bpf_trace.c | 41 ++- kernel/trace/trace_kprobe.c | 7 +- tools/bpf/bpftool/link.c | 428 +++++++++++++++++++++++++++++- tools/bpf/bpftool/xlated_dumper.c | 6 +- tools/bpf/bpftool/xlated_dumper.h | 2 + tools/include/uapi/linux/bpf.h | 40 +++ 8 files changed, 729 insertions(+), 20 deletions(-)