Re: [PATCH] libbpf: kprobe.multi: feedback function counts by kernel traced

[Jiri Olsa <olsajiri@gmail.com>]

On Sun, Jun 25, 2023 at 10:18:16AM +0800, Jackie Liu wrote:
> From: Jackie Liu <liuyun01@kylinos.cn>
> 
> When tracking functions through kprobe.multi, the number of tracked
> functions cannot be directly obtained. Sometimes in order to calculate
> this value, it is necessary to recalculate according to the pattern in
> the program. This is unnecessary. It is calculated by libbpf feedback
> through opts.cnt value, which can save resources. Example at [1].
> 
> [1] https://github.com/JackieLiu1/ketones/blob/master/src/funccount/funccount.c#L317
> 
> Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
> ---
>  tools/lib/bpf/libbpf.c | 3 ++-
>  tools/lib/bpf/libbpf.h | 2 +-
>  2 files changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index fca5d2e412c5..ed3f1202c570 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -10506,7 +10506,7 @@ static void kprobe_multi_resolve_reinit(struct kprobe_multi_resolve *res)
>  struct bpf_link *
>  bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
>  				      const char *pattern,
> -				      const struct bpf_kprobe_multi_opts *opts)
> +				      struct bpf_kprobe_multi_opts *opts)
>  {
>  	LIBBPF_OPTS(bpf_link_create_opts, lopts);
>  	struct kprobe_multi_resolve res = {
> @@ -10582,6 +10582,7 @@ bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
>  	}
>  	link->fd = link_fd;
>  	free(res.addrs);
> +	OPTS_SET(opts, cnt, res.cnt);

hum I'm not sure it's good idea to use opts for output values

there's ongoing patchset adding possibility to get this
info/value via BPF_OBJ_GET_INFO_BY_FD syscall [1]

jirka

[1] https://lore.kernel.org/bpf/20230623141546.3751-1-laoar.shao@gmail.com/

>  	return link;
>  
>  error:
> diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
> index 0b7362397ea3..f860dacc6add 100644
> --- a/tools/lib/bpf/libbpf.h
> +++ b/tools/lib/bpf/libbpf.h
> @@ -527,7 +527,7 @@ struct bpf_kprobe_multi_opts {
>  LIBBPF_API struct bpf_link *
>  bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
>  				      const char *pattern,
> -				      const struct bpf_kprobe_multi_opts *opts);
> +				      struct bpf_kprobe_multi_opts *opts);
>  
>  struct bpf_ksyscall_opts {
>  	/* size of this struct, for forward/backward compatibility */
> -- 
> 2.25.1
>