mbox series

[v3,bpf-next,00/10] bpf: Support ->fill_link_info for kprobe_multi and perf_event links

Message ID 20230612151608.99661-1-laoar.shao@gmail.com (mailing list archive)
Headers show
Series bpf: Support ->fill_link_info for kprobe_multi and perf_event links | expand

Message

Yafang Shao June 12, 2023, 3:15 p.m. UTC 
This patchset enhances the usability of kprobe_multi programs by introducing
support for ->fill_link_info. This allows users to easily determine the
probed functions associated with a kprobe_multi program. While
`bpftool perf show` already provides information about functions probed by
perf_event programs, supporting ->fill_link_info ensures consistent access to
this information across all bpf links.

In addition, this patch extends support to generic perf events, which are
currently not covered by `bpftool perf show`. While userspace is exposed to
only the perf type and config, other attributes such as sample_period and
sample_freq are disregarded.

To ensure accurate identification of probed functions, it is preferable to
expose the address directly rather than relying solely on the symbol name.
However, this implementation respects the kptr_restrict setting and avoids
exposing the address if it is not permitted.

v2->v3:
- Expose flags instead of retporbe (Andrii)
- Simplify the check on kmulti_link->cnt (Andrii)
- Use kallsyms_show_value() instead (Andrii)
- Show also the module name for kprobe_multi (Andrii)
- Add new enum bpf_perf_link_type (Andrii)
- Move perf event names into bpftool (Andrii, Quentin, Jiri)
- Keep perf event names in sync with perf tools (Jiri) 

v1->v2:
- Fix sparse warning (Stanislav, lkp@intel.com)
- Fix BPF CI build error
- Reuse kernel_syms_load() (Alexei)
- Print 'name' instead of 'func' (Alexei)
- Show whether the probe is retprobe or not (Andrii)
- Add comment for the meaning of perf_event name (Andrii)
- Add support for generic perf event
- Adhere to the kptr_restrict setting

RFC->v1:
- Use a single copy_to_user() instead (Jiri)
- Show also the symbol name in bpftool (Quentin, Alexei)
- Use calloc() instead of malloc() in bpftool (Quentin)
- Avoid having conditional entries in the JSON output (Quentin)
- Drop ->show_fdinfo (Alexei)
- Use __u64 instead of __aligned_u64 for the field addr (Alexei)
- Avoid the contradiction in perf_event name length (Alexei)
- Address a build warning reported by kernel test robot <lkp@intel.com>

Yafang Shao (10):
  bpf: Support ->fill_link_info for kprobe_multi
  bpftool: Dump the kernel symbol's module name
  bpftool: Show probed function in kprobe_multi link info
  bpf: Protect probed address based on kptr_restrict setting
  bpf: Clear the probe_addr for uprobe
  bpf: Expose symbol's respective address
  bpf: Add a common helper bpf_copy_to_user()
  bpf: Support ->fill_link_info for perf_event
  bpftool: Add perf event names
  bpftool: Show probed function in perf_event link info

 include/uapi/linux/bpf.h          |  37 +++++
 kernel/bpf/syscall.c              | 158 +++++++++++++++++--
 kernel/trace/bpf_trace.c          |  32 +++-
 kernel/trace/trace_kprobe.c       |   7 +-
 tools/bpf/bpftool/link.c          | 322 +++++++++++++++++++++++++++++++++++++-
 tools/bpf/bpftool/perf.c          | 107 +++++++++++++
 tools/bpf/bpftool/perf.h          |  11 ++
 tools/bpf/bpftool/xlated_dumper.c |   6 +-
 tools/bpf/bpftool/xlated_dumper.h |   2 +
 tools/include/uapi/linux/bpf.h    |  37 +++++
 10 files changed, 700 insertions(+), 19 deletions(-)
 create mode 100644 tools/bpf/bpftool/perf.h

Comments

Jiri Olsa June 15, 2023, 10:04 a.m. UTC | #1 
On Mon, Jun 12, 2023 at 03:15:58PM +0000, Yafang Shao wrote:
> This patchset enhances the usability of kprobe_multi programs by introducing
> support for ->fill_link_info. This allows users to easily determine the
> probed functions associated with a kprobe_multi program. While
> `bpftool perf show` already provides information about functions probed by
> perf_event programs, supporting ->fill_link_info ensures consistent access to
> this information across all bpf links.
> 
> In addition, this patch extends support to generic perf events, which are
> currently not covered by `bpftool perf show`. While userspace is exposed to
> only the perf type and config, other attributes such as sample_period and
> sample_freq are disregarded.
> 
> To ensure accurate identification of probed functions, it is preferable to
> expose the address directly rather than relying solely on the symbol name.
> However, this implementation respects the kptr_restrict setting and avoids
> exposing the address if it is not permitted.
> 
> v2->v3:
> - Expose flags instead of retporbe (Andrii)
> - Simplify the check on kmulti_link->cnt (Andrii)
> - Use kallsyms_show_value() instead (Andrii)
> - Show also the module name for kprobe_multi (Andrii)
> - Add new enum bpf_perf_link_type (Andrii)
> - Move perf event names into bpftool (Andrii, Quentin, Jiri)
> - Keep perf event names in sync with perf tools (Jiri) 

hi,
I'm getting some failing tests with this version:

#11/2    bpf_cookie/multi_kprobe_link_api:FAIL
#11/3    bpf_cookie/multi_kprobe_attach_api:FAIL
#11      bpf_cookie:FAIL

#104/1   kprobe_multi_test/skel_api:FAIL
#104/2   kprobe_multi_test/link_api_addrs:FAIL
#104/3   kprobe_multi_test/link_api_syms:FAIL
#104/4   kprobe_multi_test/attach_api_pattern:FAIL
#104/5   kprobe_multi_test/attach_api_addrs:FAIL
#104/6   kprobe_multi_test/attach_api_syms:FAIL
#104     kprobe_multi_test:FAIL
#105/1   kprobe_multi_testmod_test/testmod_attach_api_syms:FAIL
#105/2   kprobe_multi_testmod_test/testmod_attach_api_addrs:FAIL
#105     kprobe_multi_testmod_test:FAIL

jirka

> 
> v1->v2:
> - Fix sparse warning (Stanislav, lkp@intel.com)
> - Fix BPF CI build error
> - Reuse kernel_syms_load() (Alexei)
> - Print 'name' instead of 'func' (Alexei)
> - Show whether the probe is retprobe or not (Andrii)
> - Add comment for the meaning of perf_event name (Andrii)
> - Add support for generic perf event
> - Adhere to the kptr_restrict setting
> 
> RFC->v1:
> - Use a single copy_to_user() instead (Jiri)
> - Show also the symbol name in bpftool (Quentin, Alexei)
> - Use calloc() instead of malloc() in bpftool (Quentin)
> - Avoid having conditional entries in the JSON output (Quentin)
> - Drop ->show_fdinfo (Alexei)
> - Use __u64 instead of __aligned_u64 for the field addr (Alexei)
> - Avoid the contradiction in perf_event name length (Alexei)
> - Address a build warning reported by kernel test robot <lkp@intel.com>
> 
> Yafang Shao (10):
>   bpf: Support ->fill_link_info for kprobe_multi
>   bpftool: Dump the kernel symbol's module name
>   bpftool: Show probed function in kprobe_multi link info
>   bpf: Protect probed address based on kptr_restrict setting
>   bpf: Clear the probe_addr for uprobe
>   bpf: Expose symbol's respective address
>   bpf: Add a common helper bpf_copy_to_user()
>   bpf: Support ->fill_link_info for perf_event
>   bpftool: Add perf event names
>   bpftool: Show probed function in perf_event link info
> 
>  include/uapi/linux/bpf.h          |  37 +++++
>  kernel/bpf/syscall.c              | 158 +++++++++++++++++--
>  kernel/trace/bpf_trace.c          |  32 +++-
>  kernel/trace/trace_kprobe.c       |   7 +-
>  tools/bpf/bpftool/link.c          | 322 +++++++++++++++++++++++++++++++++++++-
>  tools/bpf/bpftool/perf.c          | 107 +++++++++++++
>  tools/bpf/bpftool/perf.h          |  11 ++
>  tools/bpf/bpftool/xlated_dumper.c |   6 +-
>  tools/bpf/bpftool/xlated_dumper.h |   2 +
>  tools/include/uapi/linux/bpf.h    |  37 +++++
>  10 files changed, 700 insertions(+), 19 deletions(-)
>  create mode 100644 tools/bpf/bpftool/perf.h
> 
> -- 
> 1.8.3.1
>
Yafang Shao June 15, 2023, 12:09 p.m. UTC | #2 
On Thu, Jun 15, 2023 at 6:04 PM Jiri Olsa <olsajiri@gmail.com> wrote:
>
> On Mon, Jun 12, 2023 at 03:15:58PM +0000, Yafang Shao wrote:
> > This patchset enhances the usability of kprobe_multi programs by introducing
> > support for ->fill_link_info. This allows users to easily determine the
> > probed functions associated with a kprobe_multi program. While
> > `bpftool perf show` already provides information about functions probed by
> > perf_event programs, supporting ->fill_link_info ensures consistent access to
> > this information across all bpf links.
> >
> > In addition, this patch extends support to generic perf events, which are
> > currently not covered by `bpftool perf show`. While userspace is exposed to
> > only the perf type and config, other attributes such as sample_period and
> > sample_freq are disregarded.
> >
> > To ensure accurate identification of probed functions, it is preferable to
> > expose the address directly rather than relying solely on the symbol name.
> > However, this implementation respects the kptr_restrict setting and avoids
> > exposing the address if it is not permitted.
> >
> > v2->v3:
> > - Expose flags instead of retporbe (Andrii)
> > - Simplify the check on kmulti_link->cnt (Andrii)
> > - Use kallsyms_show_value() instead (Andrii)
> > - Show also the module name for kprobe_multi (Andrii)
> > - Add new enum bpf_perf_link_type (Andrii)
> > - Move perf event names into bpftool (Andrii, Quentin, Jiri)
> > - Keep perf event names in sync with perf tools (Jiri)
>
> hi,
> I'm getting some failing tests with this version:
>
> #11/2    bpf_cookie/multi_kprobe_link_api:FAIL
> #11/3    bpf_cookie/multi_kprobe_attach_api:FAIL
> #11      bpf_cookie:FAIL
>
> #104/1   kprobe_multi_test/skel_api:FAIL
> #104/2   kprobe_multi_test/link_api_addrs:FAIL
> #104/3   kprobe_multi_test/link_api_syms:FAIL
> #104/4   kprobe_multi_test/attach_api_pattern:FAIL
> #104/5   kprobe_multi_test/attach_api_addrs:FAIL
> #104/6   kprobe_multi_test/attach_api_syms:FAIL
> #104     kprobe_multi_test:FAIL
> #105/1   kprobe_multi_testmod_test/testmod_attach_api_syms:FAIL
> #105/2   kprobe_multi_testmod_test/testmod_attach_api_addrs:FAIL
> #105     kprobe_multi_testmod_test:FAIL

Thanks for your report.
BPF CI catched these errors as well.
That is caused by setting link->fp.flags, which has been pointed out
by you in patch #1.
I will fix it in the next version.

--
Regards

Yafang