[PATCH bpf-next v4 1/2] bpf: Add show_fdinfo for uprobe_multi

[PATCH bpf-next v4 1/2] bpf: Add show_fdinfo for uprobe_multi

[Tao Chen]

Show uprobe_multi link info with fdinfo, the info as follows:

link_type:	uprobe_multi
link_id:	9
prog_tag:	e729f789e34a8eca
prog_id:	39
type:	uprobe_multi
uprobe_cnt:	3
pid:	0
path:	/home/dylane/bpf/tools/testing/selftests/bpf/test_progs
offset           ref_ctr_offset   cookie
0xa69f13         0x0              3
0xa69f1e         0x0              1
0xa69f29         0x0              2

Signed-off-by: Tao Chen <chen.dylane@linux.dev>
---
 kernel/trace/bpf_trace.c | 47 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

Change list:
  v3 -> v4:
    - use %pS to print func info.(Alexei)
  v3:
  https://lore.kernel.org/bpf/20250616130233.451439-1-chen.dylane@linux.dev

  v2 -> v3:
    - show info in one line for multi events.(Jiri)
  v2:
  https://lore.kernel.org/bpf/20250615150514.418581-1-chen.dylane@linux.dev 

  v1 -> v2:
    - replace 'func_cnt' with 'uprobe_cnt'.(Andrii)
    - print func name is more readable and security for kprobe_multi.(Alexei)
  v1:
  https://lore.kernel.org/bpf/20250612115556.295103-1-chen.dylane@linux.dev

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 24b94870b50..2d422f897ac 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -3157,10 +3157,57 @@ static int bpf_uprobe_multi_link_fill_link_info(const struct bpf_link *link,
 	return err;
 }
 
+#ifdef CONFIG_PROC_FS
+static void bpf_uprobe_multi_show_fdinfo(const struct bpf_link *link,
+					 struct seq_file *seq)
+{
+	struct bpf_uprobe_multi_link *umulti_link;
+	char *p, *buf;
+
+	umulti_link = container_of(link, struct bpf_uprobe_multi_link, link);
+
+	buf = kmalloc(PATH_MAX, GFP_KERNEL);
+	if (!buf)
+		return;
+
+	p = d_path(&umulti_link->path, buf, PATH_MAX);
+	if (IS_ERR(p)) {
+		kfree(buf);
+		return;
+	}
+
+	seq_printf(seq,
+		   "type:\t%s\n"
+		   "uprobe_cnt:\t%u\n"
+		   "pid:\t%u\n"
+		   "path:\t%s\n",
+		   umulti_link->flags == BPF_F_UPROBE_MULTI_RETURN ?
+					 "uretprobe_multi" : "uprobe_multi",
+		   umulti_link->cnt,
+		   umulti_link->task ? task_pid_nr_ns(umulti_link->task,
+			   task_active_pid_ns(current)) : 0,
+		   p);
+
+	seq_printf(seq, "%-16s %-16s %-16s\n", "offset", "ref_ctr_offset", "cookie");
+	for (int i = 0; i < umulti_link->cnt; i++) {
+		seq_printf(seq,
+			   "%#-16llx %#-16lx %-16llu\n",
+			   umulti_link->uprobes[i].offset,
+			   umulti_link->uprobes[i].ref_ctr_offset,
+			   umulti_link->uprobes[i].cookie);
+	}
+
+	kfree(buf);
+}
+#endif
+
 static const struct bpf_link_ops bpf_uprobe_multi_link_lops = {
 	.release = bpf_uprobe_multi_link_release,
 	.dealloc_deferred = bpf_uprobe_multi_link_dealloc,
 	.fill_link_info = bpf_uprobe_multi_link_fill_link_info,
+#ifdef CONFIG_PROC_FS
+	.show_fdinfo = bpf_uprobe_multi_show_fdinfo,
+#endif
 };
 
 static int uprobe_prog_run(struct bpf_uprobe *uprobe,
-- 
2.48.1

[PATCH bpf-next v4 2/2] bpf: Add show_fdinfo for kprobe_multi

[Tao Chen]

Show kprobe_multi link info with fdinfo, the info as follows:

link_type:	kprobe_multi
link_id:	1
prog_tag:	a15b7646cb7f3322
prog_id:	21
type:	kprobe_multi
kprobe_cnt:	8
missed:	0
cookie           func
8                bpf_fentry_test1+0x0/0x20
2                bpf_fentry_test2+0x0/0x20
7                bpf_fentry_test3+0x0/0x20
6                bpf_fentry_test4+0x0/0x20
5                bpf_fentry_test5+0x0/0x20
4                bpf_fentry_test6+0x0/0x20
3                bpf_fentry_test7+0x0/0x20
1                bpf_fentry_test8+0x0/0x10

Signed-off-by: Tao Chen <chen.dylane@linux.dev>
---
 kernel/trace/bpf_trace.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 2d422f897ac..99a1044b294 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2623,10 +2623,40 @@ static int bpf_kprobe_multi_link_fill_link_info(const struct bpf_link *link,
 	return err;
 }
 
+#ifdef CONFIG_PROC_FS
+static void bpf_kprobe_multi_show_fdinfo(const struct bpf_link *link,
+					 struct seq_file *seq)
+{
+	struct bpf_kprobe_multi_link *kmulti_link;
+
+	kmulti_link = container_of(link, struct bpf_kprobe_multi_link, link);
+
+	seq_printf(seq,
+		   "type:\t%s\n"
+		   "kprobe_cnt:\t%u\n"
+		   "missed:\t%lu\n",
+		   kmulti_link->flags == BPF_F_KPROBE_MULTI_RETURN ? "kretprobe_multi" :
+					 "kprobe_multi",
+		   kmulti_link->cnt,
+		   kmulti_link->fp.nmissed);
+
+	seq_printf(seq, "%-16s %-16s\n", "cookie", "func");
+	for (int i = 0; i < kmulti_link->cnt; i++) {
+		seq_printf(seq,
+			   "%-16llu %-16pS\n",
+			   kmulti_link->cookies[i],
+			   (void *)kmulti_link->addrs[i]);
+	}
+}
+#endif
+
 static const struct bpf_link_ops bpf_kprobe_multi_link_lops = {
 	.release = bpf_kprobe_multi_link_release,
 	.dealloc_deferred = bpf_kprobe_multi_link_dealloc,
 	.fill_link_info = bpf_kprobe_multi_link_fill_link_info,
+#ifdef CONFIG_PROC_FS
+	.show_fdinfo = bpf_kprobe_multi_show_fdinfo,
+#endif
 };
 
 static void bpf_kprobe_multi_cookie_swap(void *a, void *b, int size, const void *priv)
-- 
2.48.1

Re: [PATCH bpf-next v4 2/2] bpf: Add show_fdinfo for kprobe_multi

[Alexei Starovoitov]

On Wed, Jun 18, 2025 at 8:44 PM Tao Chen <chen.dylane@linux.dev> wrote:
>
> Show kprobe_multi link info with fdinfo, the info as follows:
>
> link_type:      kprobe_multi
> link_id:        1
> prog_tag:       a15b7646cb7f3322
> prog_id:        21
> type:   kprobe_multi

..

> +       seq_printf(seq,
> +                  "type:\t%s\n"
> +                  "kprobe_cnt:\t%u\n"
> +                  "missed:\t%lu\n",
> +                  kmulti_link->flags == BPF_F_KPROBE_MULTI_RETURN ? "kretprobe_multi" :
> +                                        "kprobe_multi",

why print the same info twice ?
seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]);
in bpf_link_show_fdinfo() already did it in a cleaner way.

Same issue in the other patch.

pw-bot: cr

Re: [PATCH bpf-next v4 2/2] bpf: Add show_fdinfo for kprobe_multi

[Tao Chen]

在 2025/6/20 01:17, Alexei Starovoitov 写道:
> On Wed, Jun 18, 2025 at 8:44 PM Tao Chen <chen.dylane@linux.dev> wrote:
>>
>> Show kprobe_multi link info with fdinfo, the info as follows:
>>
>> link_type:      kprobe_multi
>> link_id:        1
>> prog_tag:       a15b7646cb7f3322
>> prog_id:        21
>> type:   kprobe_multi
> 
> ..
> 
>> +       seq_printf(seq,
>> +                  "type:\t%s\n"
>> +                  "kprobe_cnt:\t%u\n"
>> +                  "missed:\t%lu\n",
>> +                  kmulti_link->flags == BPF_F_KPROBE_MULTI_RETURN ? "kretprobe_multi" :
>> +                                        "kprobe_multi",
> 
> why print the same info twice ?
> seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]);
> in bpf_link_show_fdinfo() already did it in a cleaner way.
> 

link_type only shows 'kprobe_multi', maybe we can show the format like:
// for kretprobe_multi
retprobe: true

// for kprobe_multi
retprobe: false

> Same issue in the other patch.
> 
> pw-bot: cr


-- 
Best Regards
Tao Chen

Re: [PATCH bpf-next v4 2/2] bpf: Add show_fdinfo for kprobe_multi

[Alexei Starovoitov]

On Thu, Jun 19, 2025 at 7:46 PM Tao Chen <chen.dylane@linux.dev> wrote:
>
> 在 2025/6/20 01:17, Alexei Starovoitov 写道:
> > On Wed, Jun 18, 2025 at 8:44 PM Tao Chen <chen.dylane@linux.dev> wrote:
> >>
> >> Show kprobe_multi link info with fdinfo, the info as follows:
> >>
> >> link_type:      kprobe_multi
> >> link_id:        1
> >> prog_tag:       a15b7646cb7f3322
> >> prog_id:        21
> >> type:   kprobe_multi
> >
> > ..
> >
> >> +       seq_printf(seq,
> >> +                  "type:\t%s\n"
> >> +                  "kprobe_cnt:\t%u\n"
> >> +                  "missed:\t%lu\n",
> >> +                  kmulti_link->flags == BPF_F_KPROBE_MULTI_RETURN ? "kretprobe_multi" :
> >> +                                        "kprobe_multi",
> >
> > why print the same info twice ?
> > seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]);
> > in bpf_link_show_fdinfo() already did it in a cleaner way.
> >
>
> link_type only shows 'kprobe_multi', maybe we can show the format like:

Ohh. Especially so. It would be wrong and confusing to display:
link_type:      kprobe_multi
type: kretprobe_multi

Let's fix 'link_type' to display it properly.

Re: [PATCH bpf-next v4 2/2] bpf: Add show_fdinfo for kprobe_multi

[Tao Chen]

在 2025/6/20 10:59, Alexei Starovoitov 写道:
> On Thu, Jun 19, 2025 at 7:46 PM Tao Chen <chen.dylane@linux.dev> wrote:
>>
>> 在 2025/6/20 01:17, Alexei Starovoitov 写道:
>>> On Wed, Jun 18, 2025 at 8:44 PM Tao Chen <chen.dylane@linux.dev> wrote:
>>>>
>>>> Show kprobe_multi link info with fdinfo, the info as follows:
>>>>
>>>> link_type:      kprobe_multi
>>>> link_id:        1
>>>> prog_tag:       a15b7646cb7f3322
>>>> prog_id:        21
>>>> type:   kprobe_multi
>>>
>>> ..
>>>
>>>> +       seq_printf(seq,
>>>> +                  "type:\t%s\n"
>>>> +                  "kprobe_cnt:\t%u\n"
>>>> +                  "missed:\t%lu\n",
>>>> +                  kmulti_link->flags == BPF_F_KPROBE_MULTI_RETURN ? "kretprobe_multi" :
>>>> +                                        "kprobe_multi",
>>>
>>> why print the same info twice ?
>>> seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]);
>>> in bpf_link_show_fdinfo() already did it in a cleaner way.
>>>
>>
>> link_type only shows 'kprobe_multi', maybe we can show the format like:
> 
> Ohh. Especially so. It would be wrong and confusing to display:
> link_type:      kprobe_multi
> type: kretprobe_multi
> 
> Let's fix 'link_type' to display it properly.

Yeah, but it seems that 'link_type' is a common field for other link 
types, you mean use 'link_type' to show 'kprobe_multi' or 'kretprobe_multi'?

-- 
Best Regards
Tao Chen

Re: [PATCH bpf-next v4 2/2] bpf: Add show_fdinfo for kprobe_multi

[Tao Chen]

在 2025/6/20 10:59, Alexei Starovoitov 写道:
> On Thu, Jun 19, 2025 at 7:46 PM Tao Chen <chen.dylane@linux.dev> wrote:
>>
>> 在 2025/6/20 01:17, Alexei Starovoitov 写道:
>>> On Wed, Jun 18, 2025 at 8:44 PM Tao Chen <chen.dylane@linux.dev> wrote:
>>>>
>>>> Show kprobe_multi link info with fdinfo, the info as follows:
>>>>
>>>> link_type:      kprobe_multi
>>>> link_id:        1
>>>> prog_tag:       a15b7646cb7f3322
>>>> prog_id:        21
>>>> type:   kprobe_multi
>>>
>>> ..
>>>
>>>> +       seq_printf(seq,
>>>> +                  "type:\t%s\n"
>>>> +                  "kprobe_cnt:\t%u\n"
>>>> +                  "missed:\t%lu\n",
>>>> +                  kmulti_link->flags == BPF_F_KPROBE_MULTI_RETURN ? "kretprobe_multi" :
>>>> +                                        "kprobe_multi",
>>>
>>> why print the same info twice ?
>>> seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]);
>>> in bpf_link_show_fdinfo() already did it in a cleaner way.
>>>
>>
>> link_type only shows 'kprobe_multi', maybe we can show the format like:
> 
> Ohh. Especially so. It would be wrong and confusing to display:
> link_type:      kprobe_multi
> type: kretprobe_multi
> 
> Let's fix 'link_type' to display it properly.

What do you think show like this:

     link_type:      kprobe_multi
     link_id:        1
     prog_tag:       33be53a4fd673e1d
     prog_id:        21
     retprobe:       false
     kprobe_cnt:     8
     missed: 0
     cookie           func
     1                bpf_fentry_test1+0x0/0x20
     7                bpf_fentry_test2+0x0/0x20
     2                bpf_fentry_test3+0x0/0x20
     3                bpf_fentry_test4+0x0/0x20
     4                bpf_fentry_test5+0x0/0x20
     5                bpf_fentry_test6+0x0/0x20
     6                bpf_fentry_test7+0x0/0x20
     8                bpf_fentry_test8+0x0/0x10

-- 
Best Regards
Tao Chen

Re: [PATCH bpf-next v4 2/2] bpf: Add show_fdinfo for kprobe_multi

[Alexei Starovoitov]

On Thu, Jun 19, 2025 at 8:31 PM Tao Chen <chen.dylane@linux.dev> wrote:
>
> 在 2025/6/20 10:59, Alexei Starovoitov 写道:
> > On Thu, Jun 19, 2025 at 7:46 PM Tao Chen <chen.dylane@linux.dev> wrote:
> >>
> >> 在 2025/6/20 01:17, Alexei Starovoitov 写道:
> >>> On Wed, Jun 18, 2025 at 8:44 PM Tao Chen <chen.dylane@linux.dev> wrote:
> >>>>
> >>>> Show kprobe_multi link info with fdinfo, the info as follows:
> >>>>
> >>>> link_type:      kprobe_multi
> >>>> link_id:        1
> >>>> prog_tag:       a15b7646cb7f3322
> >>>> prog_id:        21
> >>>> type:   kprobe_multi
> >>>
> >>> ..
> >>>
> >>>> +       seq_printf(seq,
> >>>> +                  "type:\t%s\n"
> >>>> +                  "kprobe_cnt:\t%u\n"
> >>>> +                  "missed:\t%lu\n",
> >>>> +                  kmulti_link->flags == BPF_F_KPROBE_MULTI_RETURN ? "kretprobe_multi" :
> >>>> +                                        "kprobe_multi",
> >>>
> >>> why print the same info twice ?
> >>> seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]);
> >>> in bpf_link_show_fdinfo() already did it in a cleaner way.
> >>>
> >>
> >> link_type only shows 'kprobe_multi', maybe we can show the format like:
> >
> > Ohh. Especially so. It would be wrong and confusing to display:
> > link_type:      kprobe_multi
> > type: kretprobe_multi
> >
> > Let's fix 'link_type' to display it properly.
>
> What do you think show like this:
>
>      link_type:      kprobe_multi
>      link_id:        1
>      prog_tag:       33be53a4fd673e1d
>      prog_id:        21
>      retprobe:       false

It leaks implementation details.
For the kernel the link type is BPF_LINK_TYPE_KPROBE_MULTI for retprobe too,
but show_fdinfo is for humans.
'link_type:' field can be more precise and differentiate
what's effectively a subtype of the link.

Re: [PATCH bpf-next v4 2/2] bpf: Add show_fdinfo for kprobe_multi

[Tao Chen]

在 2025/6/21 02:25, Alexei Starovoitov 写道:
> On Thu, Jun 19, 2025 at 8:31 PM Tao Chen <chen.dylane@linux.dev> wrote:
>>
>> 在 2025/6/20 10:59, Alexei Starovoitov 写道:
>>> On Thu, Jun 19, 2025 at 7:46 PM Tao Chen <chen.dylane@linux.dev> wrote:
>>>>
>>>> 在 2025/6/20 01:17, Alexei Starovoitov 写道:
>>>>> On Wed, Jun 18, 2025 at 8:44 PM Tao Chen <chen.dylane@linux.dev> wrote:
>>>>>>
>>>>>> Show kprobe_multi link info with fdinfo, the info as follows:
>>>>>>
>>>>>> link_type:      kprobe_multi
>>>>>> link_id:        1
>>>>>> prog_tag:       a15b7646cb7f3322
>>>>>> prog_id:        21
>>>>>> type:   kprobe_multi
>>>>>
>>>>> ..
>>>>>
>>>>>> +       seq_printf(seq,
>>>>>> +                  "type:\t%s\n"
>>>>>> +                  "kprobe_cnt:\t%u\n"
>>>>>> +                  "missed:\t%lu\n",
>>>>>> +                  kmulti_link->flags == BPF_F_KPROBE_MULTI_RETURN ? "kretprobe_multi" :
>>>>>> +                                        "kprobe_multi",
>>>>>
>>>>> why print the same info twice ?
>>>>> seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]);
>>>>> in bpf_link_show_fdinfo() already did it in a cleaner way.
>>>>>
>>>>
>>>> link_type only shows 'kprobe_multi', maybe we can show the format like:
>>>
>>> Ohh. Especially so. It would be wrong and confusing to display:
>>> link_type:      kprobe_multi
>>> type: kretprobe_multi
>>>
>>> Let's fix 'link_type' to display it properly.
>>
>> What do you think show like this:
>>
>>       link_type:      kprobe_multi
>>       link_id:        1
>>       prog_tag:       33be53a4fd673e1d
>>       prog_id:        21
>>       retprobe:       false
> 
> It leaks implementation details.
> For the kernel the link type is BPF_LINK_TYPE_KPROBE_MULTI for retprobe too,
> but show_fdinfo is for humans.
> 'link_type:' field can be more precise and differentiate
> what's effectively a subtype of the link.

Well, i will fix it in v5. Thanks.

-- 
Best Regards
Tao Chen