Re: [PATCH v3 bpf-next 00/10] bpf: Support ->fill_link_info for kprobe_multi and perf_event links

[Jiri Olsa <olsajiri@gmail.com>]

On Mon, Jun 12, 2023 at 03:15:58PM +0000, Yafang Shao wrote:
> This patchset enhances the usability of kprobe_multi programs by introducing
> support for ->fill_link_info. This allows users to easily determine the
> probed functions associated with a kprobe_multi program. While
> `bpftool perf show` already provides information about functions probed by
> perf_event programs, supporting ->fill_link_info ensures consistent access to
> this information across all bpf links.
> 
> In addition, this patch extends support to generic perf events, which are
> currently not covered by `bpftool perf show`. While userspace is exposed to
> only the perf type and config, other attributes such as sample_period and
> sample_freq are disregarded.
> 
> To ensure accurate identification of probed functions, it is preferable to
> expose the address directly rather than relying solely on the symbol name.
> However, this implementation respects the kptr_restrict setting and avoids
> exposing the address if it is not permitted.
> 
> v2->v3:
> - Expose flags instead of retporbe (Andrii)
> - Simplify the check on kmulti_link->cnt (Andrii)
> - Use kallsyms_show_value() instead (Andrii)
> - Show also the module name for kprobe_multi (Andrii)
> - Add new enum bpf_perf_link_type (Andrii)
> - Move perf event names into bpftool (Andrii, Quentin, Jiri)
> - Keep perf event names in sync with perf tools (Jiri) 

hi,
I'm getting some failing tests with this version:

#11/2    bpf_cookie/multi_kprobe_link_api:FAIL
#11/3    bpf_cookie/multi_kprobe_attach_api:FAIL
#11      bpf_cookie:FAIL

#104/1   kprobe_multi_test/skel_api:FAIL
#104/2   kprobe_multi_test/link_api_addrs:FAIL
#104/3   kprobe_multi_test/link_api_syms:FAIL
#104/4   kprobe_multi_test/attach_api_pattern:FAIL
#104/5   kprobe_multi_test/attach_api_addrs:FAIL
#104/6   kprobe_multi_test/attach_api_syms:FAIL
#104     kprobe_multi_test:FAIL
#105/1   kprobe_multi_testmod_test/testmod_attach_api_syms:FAIL
#105/2   kprobe_multi_testmod_test/testmod_attach_api_addrs:FAIL
#105     kprobe_multi_testmod_test:FAIL

jirka

> 
> v1->v2:
> - Fix sparse warning (Stanislav, lkp@intel.com)
> - Fix BPF CI build error
> - Reuse kernel_syms_load() (Alexei)
> - Print 'name' instead of 'func' (Alexei)
> - Show whether the probe is retprobe or not (Andrii)
> - Add comment for the meaning of perf_event name (Andrii)
> - Add support for generic perf event
> - Adhere to the kptr_restrict setting
> 
> RFC->v1:
> - Use a single copy_to_user() instead (Jiri)
> - Show also the symbol name in bpftool (Quentin, Alexei)
> - Use calloc() instead of malloc() in bpftool (Quentin)
> - Avoid having conditional entries in the JSON output (Quentin)
> - Drop ->show_fdinfo (Alexei)
> - Use __u64 instead of __aligned_u64 for the field addr (Alexei)
> - Avoid the contradiction in perf_event name length (Alexei)
> - Address a build warning reported by kernel test robot <lkp@intel.com>
> 
> Yafang Shao (10):
>   bpf: Support ->fill_link_info for kprobe_multi
>   bpftool: Dump the kernel symbol's module name
>   bpftool: Show probed function in kprobe_multi link info
>   bpf: Protect probed address based on kptr_restrict setting
>   bpf: Clear the probe_addr for uprobe
>   bpf: Expose symbol's respective address
>   bpf: Add a common helper bpf_copy_to_user()
>   bpf: Support ->fill_link_info for perf_event
>   bpftool: Add perf event names
>   bpftool: Show probed function in perf_event link info
> 
>  include/uapi/linux/bpf.h          |  37 +++++
>  kernel/bpf/syscall.c              | 158 +++++++++++++++++--
>  kernel/trace/bpf_trace.c          |  32 +++-
>  kernel/trace/trace_kprobe.c       |   7 +-
>  tools/bpf/bpftool/link.c          | 322 +++++++++++++++++++++++++++++++++++++-
>  tools/bpf/bpftool/perf.c          | 107 +++++++++++++
>  tools/bpf/bpftool/perf.h          |  11 ++
>  tools/bpf/bpftool/xlated_dumper.c |   6 +-
>  tools/bpf/bpftool/xlated_dumper.h |   2 +
>  tools/include/uapi/linux/bpf.h    |  37 +++++
>  10 files changed, 700 insertions(+), 19 deletions(-)
>  create mode 100644 tools/bpf/bpftool/perf.h
> 
> -- 
> 1.8.3.1
>