[PATCH bpf-next 0/3] bpf: Retrieve ref_ctr_offset from uprobe perf link

[PATCH bpf-next 0/3] bpf: Retrieve ref_ctr_offset from uprobe perf link

[Jiri Olsa]

hi,
adding ref_ctr_offset retrieval for uprobe perf link info.

thanks,
jirka


---
Jiri Olsa (3):
      bpf: Add support to retrieve ref_ctr_offset for uprobe perf link
      selftests/bpf: Add link info test for ref_ctr_offset retrieval
      bpftool: Display ref_ctr_offset for uprobe link info

 include/uapi/linux/bpf.h                                |  1 +
 kernel/bpf/syscall.c                                    |  5 +++--
 kernel/trace/trace_uprobe.c                             |  2 +-
 tools/bpf/bpftool/link.c                                |  3 +++
 tools/include/uapi/linux/bpf.h                          |  1 +
 tools/testing/selftests/bpf/prog_tests/fill_link_info.c | 18 ++++++++++++++++--
 6 files changed, 25 insertions(+), 5 deletions(-)

[PATCH bpf-next 1/3] bpf: Add support to retrieve ref_ctr_offset for uprobe perf link

[Jiri Olsa]

Adding support to retrieve ref_ctr_offset for uprobe perf link,
which got somehow omitted from the initial uprobe link info changes.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 include/uapi/linux/bpf.h       | 1 +
 kernel/bpf/syscall.c           | 5 +++--
 kernel/trace/trace_uprobe.c    | 2 +-
 tools/include/uapi/linux/bpf.h | 1 +
 4 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 71d5ac83cf5d..16e95398c91c 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -6724,6 +6724,7 @@ struct bpf_link_info {
 					__u32 name_len;
 					__u32 offset; /* offset from file_name */
 					__u64 cookie;
+					__u64 ref_ctr_offset;
 				} uprobe; /* BPF_PERF_EVENT_UPROBE, BPF_PERF_EVENT_URETPROBE */
 				struct {
 					__aligned_u64 func_name; /* in/out */
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index df33d19c5c3b..4b5f29168618 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3800,14 +3800,14 @@ static int bpf_perf_link_fill_kprobe(const struct perf_event *event,
 static int bpf_perf_link_fill_uprobe(const struct perf_event *event,
 				     struct bpf_link_info *info)
 {
+	u64 ref_ctr_offset, offset;
 	char __user *uname;
-	u64 addr, offset;
 	u32 ulen, type;
 	int err;
 
 	uname = u64_to_user_ptr(info->perf_event.uprobe.file_name);
 	ulen = info->perf_event.uprobe.name_len;
-	err = bpf_perf_link_fill_common(event, uname, &ulen, &offset, &addr,
+	err = bpf_perf_link_fill_common(event, uname, &ulen, &offset, &ref_ctr_offset,
 					&type, NULL);
 	if (err)
 		return err;
@@ -3819,6 +3819,7 @@ static int bpf_perf_link_fill_uprobe(const struct perf_event *event,
 	info->perf_event.uprobe.name_len = ulen;
 	info->perf_event.uprobe.offset = offset;
 	info->perf_event.uprobe.cookie = event->bpf_cookie;
+	info->perf_event.uprobe.ref_ctr_offset = ref_ctr_offset;
 	return 0;
 }
 #endif
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 3386439ec9f6..d9cf6ed2c106 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -1489,7 +1489,7 @@ int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type,
 				    : BPF_FD_TYPE_UPROBE;
 	*filename = tu->filename;
 	*probe_offset = tu->offset;
-	*probe_addr = 0;
+	*probe_addr = tu->ref_ctr_offset;
 	return 0;
 }
 #endif	/* CONFIG_PERF_EVENTS */
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 71d5ac83cf5d..16e95398c91c 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -6724,6 +6724,7 @@ struct bpf_link_info {
 					__u32 name_len;
 					__u32 offset; /* offset from file_name */
 					__u64 cookie;
+					__u64 ref_ctr_offset;
 				} uprobe; /* BPF_PERF_EVENT_UPROBE, BPF_PERF_EVENT_URETPROBE */
 				struct {
 					__aligned_u64 func_name; /* in/out */
-- 
2.49.0

[PATCH bpf-next 2/3] selftests/bpf: Add link info test for ref_ctr_offset retrieval

[Jiri Olsa]

Adding link info test for ref_ctr_offset retrieval for both
uprobe and uretprobe probes.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 .../selftests/bpf/prog_tests/fill_link_info.c  | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/fill_link_info.c b/tools/testing/selftests/bpf/prog_tests/fill_link_info.c
index e59af2aa6601..e40114620751 100644
--- a/tools/testing/selftests/bpf/prog_tests/fill_link_info.c
+++ b/tools/testing/selftests/bpf/prog_tests/fill_link_info.c
@@ -37,6 +37,7 @@ static noinline void uprobe_func(void)
 static int verify_perf_link_info(int fd, enum bpf_perf_event_type type, long addr,
 				 ssize_t offset, ssize_t entry_offset)
 {
+	ssize_t ref_ctr_offset = entry_offset /* ref_ctr_offset for uprobes */;
 	struct bpf_link_info info;
 	__u32 len = sizeof(info);
 	char buf[PATH_MAX];
@@ -97,6 +98,7 @@ static int verify_perf_link_info(int fd, enum bpf_perf_event_type type, long add
 	case BPF_PERF_EVENT_UPROBE:
 	case BPF_PERF_EVENT_URETPROBE:
 		ASSERT_EQ(info.perf_event.uprobe.offset, offset, "uprobe_offset");
+		ASSERT_EQ(info.perf_event.uprobe.ref_ctr_offset, ref_ctr_offset, "uprobe_ref_ctr_offset");
 
 		ASSERT_EQ(info.perf_event.uprobe.name_len, strlen(UPROBE_FILE) + 1,
 				  "name_len");
@@ -241,20 +243,32 @@ static void test_uprobe_fill_link_info(struct test_fill_link_info *skel,
 		.retprobe = type == BPF_PERF_EVENT_URETPROBE,
 		.bpf_cookie = PERF_EVENT_COOKIE,
 	);
+	const char *sema[1] = {
+		"uprobe_link_info_sema_1",
+	};
+	__u64 *ref_ctr_offset;
 	struct bpf_link *link;
 	int link_fd, err;
 
+	err = elf_resolve_syms_offsets("/proc/self/exe", 1, sema,
+				       (unsigned long **) &ref_ctr_offset, STT_OBJECT);
+	if (!ASSERT_OK(err, "elf_resolve_syms_offsets_object"))
+		return;
+
+	opts.ref_ctr_offset = *ref_ctr_offset;
 	link = bpf_program__attach_uprobe_opts(skel->progs.uprobe_run,
 					       0, /* self pid */
 					       UPROBE_FILE, uprobe_offset,
 					       &opts);
 	if (!ASSERT_OK_PTR(link, "attach_uprobe"))
-		return;
+		goto out;
 
 	link_fd = bpf_link__fd(link);
-	err = verify_perf_link_info(link_fd, type, 0, uprobe_offset, 0);
+	err = verify_perf_link_info(link_fd, type, 0, uprobe_offset, *ref_ctr_offset);
 	ASSERT_OK(err, "verify_perf_link_info");
 	bpf_link__destroy(link);
+out:
+	free(ref_ctr_offset);
 }
 
 static int verify_kmulti_link_info(int fd, bool retprobe, bool has_cookies)
-- 
2.49.0

[PATCH bpf-next 3/3] bpftool: Display ref_ctr_offset for uprobe link info

[Jiri Olsa]

Adding support to display ref_ctr_offset in link output, like:

  # bpftool link
  ...
  42: perf_event  prog 174
          uprobe /proc/self/exe+0x102f13  cookie 3735928559  ref_ctr_offset 50500538
          bpf_cookie 3735928559
          pids test_progs(1820)

  # bpftool link -j | jq
  [
    ...
    {
      "id": 42,
       ...
      "ref_ctr_offset": 50500538,
    }
  ]

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 tools/bpf/bpftool/link.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
index 52fd2c9fac56..b09aae3a191e 100644
--- a/tools/bpf/bpftool/link.c
+++ b/tools/bpf/bpftool/link.c
@@ -380,6 +380,7 @@ show_perf_event_uprobe_json(struct bpf_link_info *info, json_writer_t *wtr)
 			   u64_to_ptr(info->perf_event.uprobe.file_name));
 	jsonw_uint_field(wtr, "offset", info->perf_event.uprobe.offset);
 	jsonw_uint_field(wtr, "cookie", info->perf_event.uprobe.cookie);
+	jsonw_uint_field(wtr, "ref_ctr_offset", info->perf_event.uprobe.ref_ctr_offset);
 }
 
 static void
@@ -823,6 +824,8 @@ static void show_perf_event_uprobe_plain(struct bpf_link_info *info)
 	printf("%s+%#x  ", buf, info->perf_event.uprobe.offset);
 	if (info->perf_event.uprobe.cookie)
 		printf("cookie %llu  ", info->perf_event.uprobe.cookie);
+	if (info->perf_event.uprobe.ref_ctr_offset)
+		printf("ref_ctr_offset %llu  ", info->perf_event.uprobe.ref_ctr_offset);
 }
 
 static void show_perf_event_tracepoint_plain(struct bpf_link_info *info)
-- 
2.49.0

Re: [PATCH bpf-next 3/3] bpftool: Display ref_ctr_offset for uprobe link info

[Quentin Monnet]

On 06/05/2025 14:57, Jiri Olsa wrote:
> Adding support to display ref_ctr_offset in link output, like:
> 
>   # bpftool link
>   ...
>   42: perf_event  prog 174
>           uprobe /proc/self/exe+0x102f13  cookie 3735928559  ref_ctr_offset 50500538
>           bpf_cookie 3735928559
>           pids test_progs(1820)
> 
>   # bpftool link -j | jq
>   [
>     ...
>     {
>       "id": 42,
>        ...
>       "ref_ctr_offset": 50500538,
>     }
>   ]
> 
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>

Acked-by: Quentin Monnet <qmo@kernel.org>

Thanks Jiri!

Re: [PATCH bpf-next 3/3] bpftool: Display ref_ctr_offset for uprobe link info

[Andrii Nakryiko]

On Tue, May 6, 2025 at 6:58 AM Jiri Olsa <jolsa@kernel.org> wrote:
>
> Adding support to display ref_ctr_offset in link output, like:
>
>   # bpftool link
>   ...
>   42: perf_event  prog 174
>           uprobe /proc/self/exe+0x102f13  cookie 3735928559  ref_ctr_offset 50500538

let's use hex for ref_ctr_offset?

and also, why do we have bpf_cookie and cookie emitted? Are they different?

>           bpf_cookie 3735928559
>           pids test_progs(1820)
>
>   # bpftool link -j | jq
>   [
>     ...
>     {
>       "id": 42,
>        ...
>       "ref_ctr_offset": 50500538,
>     }
>   ]
>
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> ---
>  tools/bpf/bpftool/link.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
> index 52fd2c9fac56..b09aae3a191e 100644
> --- a/tools/bpf/bpftool/link.c
> +++ b/tools/bpf/bpftool/link.c
> @@ -380,6 +380,7 @@ show_perf_event_uprobe_json(struct bpf_link_info *info, json_writer_t *wtr)
>                            u64_to_ptr(info->perf_event.uprobe.file_name));
>         jsonw_uint_field(wtr, "offset", info->perf_event.uprobe.offset);
>         jsonw_uint_field(wtr, "cookie", info->perf_event.uprobe.cookie);
> +       jsonw_uint_field(wtr, "ref_ctr_offset", info->perf_event.uprobe.ref_ctr_offset);
>  }
>
>  static void
> @@ -823,6 +824,8 @@ static void show_perf_event_uprobe_plain(struct bpf_link_info *info)
>         printf("%s+%#x  ", buf, info->perf_event.uprobe.offset);
>         if (info->perf_event.uprobe.cookie)
>                 printf("cookie %llu  ", info->perf_event.uprobe.cookie);
> +       if (info->perf_event.uprobe.ref_ctr_offset)
> +               printf("ref_ctr_offset %llu  ", info->perf_event.uprobe.ref_ctr_offset);
>  }
>
>  static void show_perf_event_tracepoint_plain(struct bpf_link_info *info)
> --
> 2.49.0
>

Re: [PATCH bpf-next 1/3] bpf: Add support to retrieve ref_ctr_offset for uprobe perf link

[Yafang Shao]

On Tue, May 6, 2025 at 9:57 PM Jiri Olsa <jolsa@kernel.org> wrote:
>
> Adding support to retrieve ref_ctr_offset for uprobe perf link,
> which got somehow omitted from the initial uprobe link info changes.
>
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>

LGTM
Acked-by: Yafang Shao <laoar.shao@gmail.com>

> ---
>  include/uapi/linux/bpf.h       | 1 +
>  kernel/bpf/syscall.c           | 5 +++--
>  kernel/trace/trace_uprobe.c    | 2 +-
>  tools/include/uapi/linux/bpf.h | 1 +
>  4 files changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index 71d5ac83cf5d..16e95398c91c 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -6724,6 +6724,7 @@ struct bpf_link_info {
>                                         __u32 name_len;
>                                         __u32 offset; /* offset from file_name */
>                                         __u64 cookie;
> +                                       __u64 ref_ctr_offset;
>                                 } uprobe; /* BPF_PERF_EVENT_UPROBE, BPF_PERF_EVENT_URETPROBE */
>                                 struct {
>                                         __aligned_u64 func_name; /* in/out */
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index df33d19c5c3b..4b5f29168618 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3800,14 +3800,14 @@ static int bpf_perf_link_fill_kprobe(const struct perf_event *event,
>  static int bpf_perf_link_fill_uprobe(const struct perf_event *event,
>                                      struct bpf_link_info *info)
>  {
> +       u64 ref_ctr_offset, offset;
>         char __user *uname;
> -       u64 addr, offset;
>         u32 ulen, type;
>         int err;
>
>         uname = u64_to_user_ptr(info->perf_event.uprobe.file_name);
>         ulen = info->perf_event.uprobe.name_len;
> -       err = bpf_perf_link_fill_common(event, uname, &ulen, &offset, &addr,
> +       err = bpf_perf_link_fill_common(event, uname, &ulen, &offset, &ref_ctr_offset,
>                                         &type, NULL);
>         if (err)
>                 return err;
> @@ -3819,6 +3819,7 @@ static int bpf_perf_link_fill_uprobe(const struct perf_event *event,
>         info->perf_event.uprobe.name_len = ulen;
>         info->perf_event.uprobe.offset = offset;
>         info->perf_event.uprobe.cookie = event->bpf_cookie;
> +       info->perf_event.uprobe.ref_ctr_offset = ref_ctr_offset;
>         return 0;
>  }
>  #endif
> diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
> index 3386439ec9f6..d9cf6ed2c106 100644
> --- a/kernel/trace/trace_uprobe.c
> +++ b/kernel/trace/trace_uprobe.c
> @@ -1489,7 +1489,7 @@ int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type,
>                                     : BPF_FD_TYPE_UPROBE;
>         *filename = tu->filename;
>         *probe_offset = tu->offset;
> -       *probe_addr = 0;
> +       *probe_addr = tu->ref_ctr_offset;
>         return 0;
>  }
>  #endif /* CONFIG_PERF_EVENTS */
> diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
> index 71d5ac83cf5d..16e95398c91c 100644
> --- a/tools/include/uapi/linux/bpf.h
> +++ b/tools/include/uapi/linux/bpf.h
> @@ -6724,6 +6724,7 @@ struct bpf_link_info {
>                                         __u32 name_len;
>                                         __u32 offset; /* offset from file_name */
>                                         __u64 cookie;
> +                                       __u64 ref_ctr_offset;
>                                 } uprobe; /* BPF_PERF_EVENT_UPROBE, BPF_PERF_EVENT_URETPROBE */
>                                 struct {
>                                         __aligned_u64 func_name; /* in/out */
> --
> 2.49.0
>


-- 
Regards
Yafang

Re: [PATCH bpf-next 2/3] selftests/bpf: Add link info test for ref_ctr_offset retrieval

[Yafang Shao]

On Tue, May 6, 2025 at 9:57 PM Jiri Olsa <jolsa@kernel.org> wrote:
>
> Adding link info test for ref_ctr_offset retrieval for both
> uprobe and uretprobe probes.
>
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>

LGTM
Acked-by: Yafang Shao <laoar.shao@gmail.com>

> ---
>  .../selftests/bpf/prog_tests/fill_link_info.c  | 18 ++++++++++++++++--
>  1 file changed, 16 insertions(+), 2 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/fill_link_info.c b/tools/testing/selftests/bpf/prog_tests/fill_link_info.c
> index e59af2aa6601..e40114620751 100644
> --- a/tools/testing/selftests/bpf/prog_tests/fill_link_info.c
> +++ b/tools/testing/selftests/bpf/prog_tests/fill_link_info.c
> @@ -37,6 +37,7 @@ static noinline void uprobe_func(void)
>  static int verify_perf_link_info(int fd, enum bpf_perf_event_type type, long addr,
>                                  ssize_t offset, ssize_t entry_offset)
>  {
> +       ssize_t ref_ctr_offset = entry_offset /* ref_ctr_offset for uprobes */;
>         struct bpf_link_info info;
>         __u32 len = sizeof(info);
>         char buf[PATH_MAX];
> @@ -97,6 +98,7 @@ static int verify_perf_link_info(int fd, enum bpf_perf_event_type type, long add
>         case BPF_PERF_EVENT_UPROBE:
>         case BPF_PERF_EVENT_URETPROBE:
>                 ASSERT_EQ(info.perf_event.uprobe.offset, offset, "uprobe_offset");
> +               ASSERT_EQ(info.perf_event.uprobe.ref_ctr_offset, ref_ctr_offset, "uprobe_ref_ctr_offset");
>
>                 ASSERT_EQ(info.perf_event.uprobe.name_len, strlen(UPROBE_FILE) + 1,
>                                   "name_len");
> @@ -241,20 +243,32 @@ static void test_uprobe_fill_link_info(struct test_fill_link_info *skel,
>                 .retprobe = type == BPF_PERF_EVENT_URETPROBE,
>                 .bpf_cookie = PERF_EVENT_COOKIE,
>         );
> +       const char *sema[1] = {
> +               "uprobe_link_info_sema_1",
> +       };
> +       __u64 *ref_ctr_offset;
>         struct bpf_link *link;
>         int link_fd, err;
>
> +       err = elf_resolve_syms_offsets("/proc/self/exe", 1, sema,
> +                                      (unsigned long **) &ref_ctr_offset, STT_OBJECT);
> +       if (!ASSERT_OK(err, "elf_resolve_syms_offsets_object"))
> +               return;
> +
> +       opts.ref_ctr_offset = *ref_ctr_offset;
>         link = bpf_program__attach_uprobe_opts(skel->progs.uprobe_run,
>                                                0, /* self pid */
>                                                UPROBE_FILE, uprobe_offset,
>                                                &opts);
>         if (!ASSERT_OK_PTR(link, "attach_uprobe"))
> -               return;
> +               goto out;
>
>         link_fd = bpf_link__fd(link);
> -       err = verify_perf_link_info(link_fd, type, 0, uprobe_offset, 0);
> +       err = verify_perf_link_info(link_fd, type, 0, uprobe_offset, *ref_ctr_offset);
>         ASSERT_OK(err, "verify_perf_link_info");
>         bpf_link__destroy(link);
> +out:
> +       free(ref_ctr_offset);
>  }
>
>  static int verify_kmulti_link_info(int fd, bool retprobe, bool has_cookies)
> --
> 2.49.0
>


-- 
Regards
Yafang

Re: [PATCH bpf-next 3/3] bpftool: Display ref_ctr_offset for uprobe link info

[Jiri Olsa]

On Tue, May 06, 2025 at 03:33:33PM -0700, Andrii Nakryiko wrote:
> On Tue, May 6, 2025 at 6:58 AM Jiri Olsa <jolsa@kernel.org> wrote:
> >
> > Adding support to display ref_ctr_offset in link output, like:
> >
> >   # bpftool link
> >   ...
> >   42: perf_event  prog 174
> >           uprobe /proc/self/exe+0x102f13  cookie 3735928559  ref_ctr_offset 50500538
> 
> let's use hex for ref_ctr_offset?

I had that, then I saw cookie was dec ;-) either way is fine for me

> 
> and also, why do we have bpf_cookie and cookie emitted? Are they different?

hum, right.. so there's bpf_cookie retrieval from perf_link through the
task_file iterator:

  cbdaf71f7e65 bpftool: Add bpf_cookie to link output

I guess it was added before we decided to have bpf_link_info.perf_event
interface, which seems easier to me

jirka

> 
> >           bpf_cookie 3735928559
> >           pids test_progs(1820)
> >
> >   # bpftool link -j | jq
> >   [
> >     ...
> >     {
> >       "id": 42,
> >        ...
> >       "ref_ctr_offset": 50500538,
> >     }
> >   ]
> >
> > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > ---
> >  tools/bpf/bpftool/link.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
> > index 52fd2c9fac56..b09aae3a191e 100644
> > --- a/tools/bpf/bpftool/link.c
> > +++ b/tools/bpf/bpftool/link.c
> > @@ -380,6 +380,7 @@ show_perf_event_uprobe_json(struct bpf_link_info *info, json_writer_t *wtr)
> >                            u64_to_ptr(info->perf_event.uprobe.file_name));
> >         jsonw_uint_field(wtr, "offset", info->perf_event.uprobe.offset);
> >         jsonw_uint_field(wtr, "cookie", info->perf_event.uprobe.cookie);
> > +       jsonw_uint_field(wtr, "ref_ctr_offset", info->perf_event.uprobe.ref_ctr_offset);
> >  }
> >
> >  static void
> > @@ -823,6 +824,8 @@ static void show_perf_event_uprobe_plain(struct bpf_link_info *info)
> >         printf("%s+%#x  ", buf, info->perf_event.uprobe.offset);
> >         if (info->perf_event.uprobe.cookie)
> >                 printf("cookie %llu  ", info->perf_event.uprobe.cookie);
> > +       if (info->perf_event.uprobe.ref_ctr_offset)
> > +               printf("ref_ctr_offset %llu  ", info->perf_event.uprobe.ref_ctr_offset);
> >  }
> >
> >  static void show_perf_event_tracepoint_plain(struct bpf_link_info *info)
> > --
> > 2.49.0
> >

Re: [PATCH bpf-next 3/3] bpftool: Display ref_ctr_offset for uprobe link info

[Quentin Monnet]

2025-05-07 10:56 UTC+0200 ~ Jiri Olsa <olsajiri@gmail.com>
> On Tue, May 06, 2025 at 03:33:33PM -0700, Andrii Nakryiko wrote:
>> On Tue, May 6, 2025 at 6:58 AM Jiri Olsa <jolsa@kernel.org> wrote:
>>>
>>> Adding support to display ref_ctr_offset in link output, like:
>>>
>>>   # bpftool link
>>>   ...
>>>   42: perf_event  prog 174
>>>           uprobe /proc/self/exe+0x102f13  cookie 3735928559  ref_ctr_offset 50500538
>>
>> let's use hex for ref_ctr_offset?
> 
> I had that, then I saw cookie was dec ;-) either way is fine for me

I'm fine either way, but let's use the same base for the two values
please. If you want to change the cookie to hexa (in the plain output)
for better readability, that's OK as well (JSON output needs to remain a
decimal in both cases, of course).

Quentin

Re: [PATCH bpf-next 3/3] bpftool: Display ref_ctr_offset for uprobe link info

[Andrii Nakryiko]

On Wed, May 7, 2025 at 2:40 AM Quentin Monnet <qmo@kernel.org> wrote:
>
> 2025-05-07 10:56 UTC+0200 ~ Jiri Olsa <olsajiri@gmail.com>
> > On Tue, May 06, 2025 at 03:33:33PM -0700, Andrii Nakryiko wrote:
> >> On Tue, May 6, 2025 at 6:58 AM Jiri Olsa <jolsa@kernel.org> wrote:
> >>>
> >>> Adding support to display ref_ctr_offset in link output, like:
> >>>
> >>>   # bpftool link
> >>>   ...
> >>>   42: perf_event  prog 174
> >>>           uprobe /proc/self/exe+0x102f13  cookie 3735928559  ref_ctr_offset 50500538
> >>
> >> let's use hex for ref_ctr_offset?
> >
> > I had that, then I saw cookie was dec ;-) either way is fine for me
>
> I'm fine either way, but let's use the same base for the two values
> please. If you want to change the cookie to hexa (in the plain output)
> for better readability, that's OK as well (JSON output needs to remain a
> decimal in both cases, of course).

Why should cookie and offset use the same base? Offset is always
address-like, so hex makes most sense there, 100%. But a cookie is
most probably going to be some small value (index into array, or small
number representing attachment point number, etc), so decimal is most
natural. Importantly, BPF cookie can't really be a pointer (what will
you do with it on BPF side?), so it's something a bit more
human-driven, and thus decimal seems like a better default.

>
> Quentin

Re: [PATCH bpf-next 3/3] bpftool: Display ref_ctr_offset for uprobe link info

[Quentin Monnet]

2025-05-07 11:18 UTC-0700 ~ Andrii Nakryiko <andrii.nakryiko@gmail.com>
> On Wed, May 7, 2025 at 2:40 AM Quentin Monnet <qmo@kernel.org> wrote:
>>
>> 2025-05-07 10:56 UTC+0200 ~ Jiri Olsa <olsajiri@gmail.com>
>>> On Tue, May 06, 2025 at 03:33:33PM -0700, Andrii Nakryiko wrote:
>>>> On Tue, May 6, 2025 at 6:58 AM Jiri Olsa <jolsa@kernel.org> wrote:
>>>>>
>>>>> Adding support to display ref_ctr_offset in link output, like:
>>>>>
>>>>>   # bpftool link
>>>>>   ...
>>>>>   42: perf_event  prog 174
>>>>>           uprobe /proc/self/exe+0x102f13  cookie 3735928559  ref_ctr_offset 50500538
>>>>
>>>> let's use hex for ref_ctr_offset?
>>>
>>> I had that, then I saw cookie was dec ;-) either way is fine for me
>>
>> I'm fine either way, but let's use the same base for the two values
>> please. If you want to change the cookie to hexa (in the plain output)
>> for better readability, that's OK as well (JSON output needs to remain a
>> decimal in both cases, of course).
> 
> Why should cookie and offset use the same base? Offset is always
> address-like, so hex makes most sense there, 100%. But a cookie is
> most probably going to be some small value (index into array, or small
> number representing attachment point number, etc), so decimal is most
> natural. Importantly, BPF cookie can't really be a pointer (what will
> you do with it on BPF side?), so it's something a bit more
> human-driven, and thus decimal seems like a better default.

OK my bad, I take it back, then :)

Quentin

Re: [PATCH bpf-next 3/3] bpftool: Display ref_ctr_offset for uprobe link info

[Jiri Olsa]

On Wed, May 07, 2025 at 10:56:35AM +0200, Jiri Olsa wrote:
> On Tue, May 06, 2025 at 03:33:33PM -0700, Andrii Nakryiko wrote:
> > On Tue, May 6, 2025 at 6:58 AM Jiri Olsa <jolsa@kernel.org> wrote:
> > >
> > > Adding support to display ref_ctr_offset in link output, like:
> > >
> > >   # bpftool link
> > >   ...
> > >   42: perf_event  prog 174
> > >           uprobe /proc/self/exe+0x102f13  cookie 3735928559  ref_ctr_offset 50500538
> > 
> > let's use hex for ref_ctr_offset?
> 
> I had that, then I saw cookie was dec ;-) either way is fine for me
> 
> > 
> > and also, why do we have bpf_cookie and cookie emitted? Are they different?
> 
> hum, right.. so there's bpf_cookie retrieval from perf_link through the
> task_file iterator:
> 
>   cbdaf71f7e65 bpftool: Add bpf_cookie to link output
> 
> I guess it was added before we decided to have bpf_link_info.perf_event
> interface, which seems easier to me

we could drop the bpf_cookie with attached patch, but should we worry
about loosing 'bpf_cookie' tag from json output (there will be just
'cookie' tag now with the same value)

jirka


---
diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
index 9eb764fe4cc8..ca8923425637 100644
--- a/tools/bpf/bpftool/main.h
+++ b/tools/bpf/bpftool/main.h
@@ -104,9 +104,7 @@ struct obj_ref {
 
 struct obj_refs {
 	int ref_cnt;
-	bool has_bpf_cookie;
 	struct obj_ref *refs;
-	__u64 bpf_cookie;
 };
 
 struct btf;
diff --git a/tools/bpf/bpftool/pids.c b/tools/bpf/bpftool/pids.c
index 23f488cf1740..e81518dfc835 100644
--- a/tools/bpf/bpftool/pids.c
+++ b/tools/bpf/bpftool/pids.c
@@ -80,8 +80,6 @@ static void add_ref(struct hashmap *map, struct pid_iter_entry *e)
 	memcpy(ref->comm, e->comm, sizeof(ref->comm));
 	ref->comm[sizeof(ref->comm) - 1] = '\0';
 	refs->ref_cnt = 1;
-	refs->has_bpf_cookie = e->has_bpf_cookie;
-	refs->bpf_cookie = e->bpf_cookie;
 
 	err = hashmap__append(map, e->id, refs);
 	if (err)
@@ -214,9 +212,6 @@ void emit_obj_refs_json(struct hashmap *map, __u32 id,
 		if (refs->ref_cnt == 0)
 			break;
 
-		if (refs->has_bpf_cookie)
-			jsonw_lluint_field(json_writer, "bpf_cookie", refs->bpf_cookie);
-
 		jsonw_name(json_writer, "pids");
 		jsonw_start_array(json_writer);
 		for (i = 0; i < refs->ref_cnt; i++) {
@@ -246,9 +241,6 @@ void emit_obj_refs_plain(struct hashmap *map, __u32 id, const char *prefix)
 		if (refs->ref_cnt == 0)
 			break;
 
-		if (refs->has_bpf_cookie)
-			printf("\n\tbpf_cookie %llu", (unsigned long long) refs->bpf_cookie);
-
 		printf("%s", prefix);
 		for (i = 0; i < refs->ref_cnt; i++) {
 			struct obj_ref *ref = &refs->refs[i];
diff --git a/tools/bpf/bpftool/skeleton/pid_iter.bpf.c b/tools/bpf/bpftool/skeleton/pid_iter.bpf.c
index 948dde25034e..ea6d54f43425 100644
--- a/tools/bpf/bpftool/skeleton/pid_iter.bpf.c
+++ b/tools/bpf/bpftool/skeleton/pid_iter.bpf.c
@@ -15,19 +15,6 @@ enum bpf_obj_type {
 	BPF_OBJ_BTF,
 };
 
-struct bpf_perf_link___local {
-	struct bpf_link link;
-	struct file *perf_file;
-} __attribute__((preserve_access_index));
-
-struct perf_event___local {
-	u64 bpf_cookie;
-} __attribute__((preserve_access_index));
-
-enum bpf_link_type___local {
-	BPF_LINK_TYPE_PERF_EVENT___local = 7,
-};
-
 extern const void bpf_link_fops __ksym;
 extern const void bpf_link_fops_poll __ksym __weak;
 extern const void bpf_map_fops __ksym;
@@ -52,17 +39,6 @@ static __always_inline __u32 get_obj_id(void *ent, enum bpf_obj_type type)
 	}
 }
 
-/* could be used only with BPF_LINK_TYPE_PERF_EVENT links */
-static __u64 get_bpf_cookie(struct bpf_link *link)
-{
-	struct bpf_perf_link___local *perf_link;
-	struct perf_event___local *event;
-
-	perf_link = container_of(link, struct bpf_perf_link___local, link);
-	event = BPF_CORE_READ(perf_link, perf_file, private_data);
-	return BPF_CORE_READ(event, bpf_cookie);
-}
-
 SEC("iter/task_file")
 int iter(struct bpf_iter__task_file *ctx)
 {
@@ -102,18 +78,6 @@ int iter(struct bpf_iter__task_file *ctx)
 	e.pid = task->tgid;
 	e.id = get_obj_id(file->private_data, obj_type);
 
-	if (obj_type == BPF_OBJ_LINK &&
-	    bpf_core_enum_value_exists(enum bpf_link_type___local,
-				       BPF_LINK_TYPE_PERF_EVENT___local)) {
-		struct bpf_link *link = (struct bpf_link *) file->private_data;
-
-		if (BPF_CORE_READ(link, type) == bpf_core_enum_value(enum bpf_link_type___local,
-								     BPF_LINK_TYPE_PERF_EVENT___local)) {
-			e.has_bpf_cookie = true;
-			e.bpf_cookie = get_bpf_cookie(link);
-		}
-	}
-
 	bpf_probe_read_kernel_str(&e.comm, sizeof(e.comm),
 				  task->group_leader->comm);
 	bpf_seq_write(ctx->meta->seq, &e, sizeof(e));
diff --git a/tools/bpf/bpftool/skeleton/pid_iter.h b/tools/bpf/bpftool/skeleton/pid_iter.h
index bbb570d4cca6..5692cf257adb 100644
--- a/tools/bpf/bpftool/skeleton/pid_iter.h
+++ b/tools/bpf/bpftool/skeleton/pid_iter.h
@@ -6,8 +6,6 @@
 struct pid_iter_entry {
 	__u32 id;
 	int pid;
-	__u64 bpf_cookie;
-	bool has_bpf_cookie;
 	char comm[16];
 };
 

Re: [PATCH bpf-next 3/3] bpftool: Display ref_ctr_offset for uprobe link info

[Andrii Nakryiko]

On Fri, May 9, 2025 at 8:30 AM Jiri Olsa <olsajiri@gmail.com> wrote:
>
> On Wed, May 07, 2025 at 10:56:35AM +0200, Jiri Olsa wrote:
> > On Tue, May 06, 2025 at 03:33:33PM -0700, Andrii Nakryiko wrote:
> > > On Tue, May 6, 2025 at 6:58 AM Jiri Olsa <jolsa@kernel.org> wrote:
> > > >
> > > > Adding support to display ref_ctr_offset in link output, like:
> > > >
> > > >   # bpftool link
> > > >   ...
> > > >   42: perf_event  prog 174
> > > >           uprobe /proc/self/exe+0x102f13  cookie 3735928559  ref_ctr_offset 50500538
> > >
> > > let's use hex for ref_ctr_offset?
> >
> > I had that, then I saw cookie was dec ;-) either way is fine for me
> >
> > >
> > > and also, why do we have bpf_cookie and cookie emitted? Are they different?
> >
> > hum, right.. so there's bpf_cookie retrieval from perf_link through the
> > task_file iterator:
> >
> >   cbdaf71f7e65 bpftool: Add bpf_cookie to link output
> >
> > I guess it was added before we decided to have bpf_link_info.perf_event
> > interface, which seems easier to me
>
> we could drop the bpf_cookie with attached patch, but should we worry
> about loosing 'bpf_cookie' tag from json output (there will be just
> 'cookie' tag now with the same value)
>

I don't have strong feelings about this, but note that bpf_cookie is
available on more kernel versions than the more recently added
uprobe-specific cookie. If it's not too cumbersome, maybe we can just
not display bpf_cookie *if* kernel provides uprobe-specific cookie
information? Not sure, don't really care all that much, just noticed
duplication earlier and thought to point this out.

> jirka
>
>
> ---
> diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
> index 9eb764fe4cc8..ca8923425637 100644
> --- a/tools/bpf/bpftool/main.h
> +++ b/tools/bpf/bpftool/main.h
> @@ -104,9 +104,7 @@ struct obj_ref {
>
>  struct obj_refs {
>         int ref_cnt;
> -       bool has_bpf_cookie;
>         struct obj_ref *refs;
> -       __u64 bpf_cookie;
>  };
>
>  struct btf;
> diff --git a/tools/bpf/bpftool/pids.c b/tools/bpf/bpftool/pids.c
> index 23f488cf1740..e81518dfc835 100644
> --- a/tools/bpf/bpftool/pids.c
> +++ b/tools/bpf/bpftool/pids.c
> @@ -80,8 +80,6 @@ static void add_ref(struct hashmap *map, struct pid_iter_entry *e)
>         memcpy(ref->comm, e->comm, sizeof(ref->comm));
>         ref->comm[sizeof(ref->comm) - 1] = '\0';
>         refs->ref_cnt = 1;
> -       refs->has_bpf_cookie = e->has_bpf_cookie;
> -       refs->bpf_cookie = e->bpf_cookie;
>
>         err = hashmap__append(map, e->id, refs);
>         if (err)
> @@ -214,9 +212,6 @@ void emit_obj_refs_json(struct hashmap *map, __u32 id,
>                 if (refs->ref_cnt == 0)
>                         break;
>
> -               if (refs->has_bpf_cookie)
> -                       jsonw_lluint_field(json_writer, "bpf_cookie", refs->bpf_cookie);
> -
>                 jsonw_name(json_writer, "pids");
>                 jsonw_start_array(json_writer);
>                 for (i = 0; i < refs->ref_cnt; i++) {
> @@ -246,9 +241,6 @@ void emit_obj_refs_plain(struct hashmap *map, __u32 id, const char *prefix)
>                 if (refs->ref_cnt == 0)
>                         break;
>
> -               if (refs->has_bpf_cookie)
> -                       printf("\n\tbpf_cookie %llu", (unsigned long long) refs->bpf_cookie);
> -
>                 printf("%s", prefix);
>                 for (i = 0; i < refs->ref_cnt; i++) {
>                         struct obj_ref *ref = &refs->refs[i];
> diff --git a/tools/bpf/bpftool/skeleton/pid_iter.bpf.c b/tools/bpf/bpftool/skeleton/pid_iter.bpf.c
> index 948dde25034e..ea6d54f43425 100644
> --- a/tools/bpf/bpftool/skeleton/pid_iter.bpf.c
> +++ b/tools/bpf/bpftool/skeleton/pid_iter.bpf.c
> @@ -15,19 +15,6 @@ enum bpf_obj_type {
>         BPF_OBJ_BTF,
>  };
>
> -struct bpf_perf_link___local {
> -       struct bpf_link link;
> -       struct file *perf_file;
> -} __attribute__((preserve_access_index));
> -
> -struct perf_event___local {
> -       u64 bpf_cookie;
> -} __attribute__((preserve_access_index));
> -
> -enum bpf_link_type___local {
> -       BPF_LINK_TYPE_PERF_EVENT___local = 7,
> -};
> -
>  extern const void bpf_link_fops __ksym;
>  extern const void bpf_link_fops_poll __ksym __weak;
>  extern const void bpf_map_fops __ksym;
> @@ -52,17 +39,6 @@ static __always_inline __u32 get_obj_id(void *ent, enum bpf_obj_type type)
>         }
>  }
>
> -/* could be used only with BPF_LINK_TYPE_PERF_EVENT links */
> -static __u64 get_bpf_cookie(struct bpf_link *link)
> -{
> -       struct bpf_perf_link___local *perf_link;
> -       struct perf_event___local *event;
> -
> -       perf_link = container_of(link, struct bpf_perf_link___local, link);
> -       event = BPF_CORE_READ(perf_link, perf_file, private_data);
> -       return BPF_CORE_READ(event, bpf_cookie);
> -}
> -
>  SEC("iter/task_file")
>  int iter(struct bpf_iter__task_file *ctx)
>  {
> @@ -102,18 +78,6 @@ int iter(struct bpf_iter__task_file *ctx)
>         e.pid = task->tgid;
>         e.id = get_obj_id(file->private_data, obj_type);
>
> -       if (obj_type == BPF_OBJ_LINK &&
> -           bpf_core_enum_value_exists(enum bpf_link_type___local,
> -                                      BPF_LINK_TYPE_PERF_EVENT___local)) {
> -               struct bpf_link *link = (struct bpf_link *) file->private_data;
> -
> -               if (BPF_CORE_READ(link, type) == bpf_core_enum_value(enum bpf_link_type___local,
> -                                                                    BPF_LINK_TYPE_PERF_EVENT___local)) {
> -                       e.has_bpf_cookie = true;
> -                       e.bpf_cookie = get_bpf_cookie(link);
> -               }
> -       }
> -
>         bpf_probe_read_kernel_str(&e.comm, sizeof(e.comm),
>                                   task->group_leader->comm);
>         bpf_seq_write(ctx->meta->seq, &e, sizeof(e));
> diff --git a/tools/bpf/bpftool/skeleton/pid_iter.h b/tools/bpf/bpftool/skeleton/pid_iter.h
> index bbb570d4cca6..5692cf257adb 100644
> --- a/tools/bpf/bpftool/skeleton/pid_iter.h
> +++ b/tools/bpf/bpftool/skeleton/pid_iter.h
> @@ -6,8 +6,6 @@
>  struct pid_iter_entry {
>         __u32 id;
>         int pid;
> -       __u64 bpf_cookie;
> -       bool has_bpf_cookie;
>         char comm[16];
>  };
>