On Mon, Jun 23, 2025 at 6:44 AM Tao Chen <[email protected]> wrote: > > Alexei suggested, 'link_type' can be more precise and differentiate > for human in fdinfo. In fact BPF_LINK_TYPE_KPROBE_MULTI includes > kretprobe_multi type, the same as BPF_LINK_TYPE_UPROBE_MULTI, so we > can show it more concretely. > > link_type: kprobe_multi > link_id: 1 > prog_tag: d2b307e915f0dd37 > ... > link_type: kretprobe_multi > link_id: 2 > prog_tag: ab9ea0545870781d > ... > link_type: uprobe_multi > link_id: 9 > prog_tag: e729f789e34a8eca > ... > link_type: uretprobe_multi > link_id: 10 > prog_tag: 7db356c03e61a4d4 > > Signed-off-by: Tao Chen <[email protected]> > --- > include/linux/trace_events.h | 10 ++++++++++ > kernel/bpf/syscall.c | 9 ++++++++- > kernel/trace/bpf_trace.c | 28 ++++++++++++++++++++++++++++ > 3 files changed, 46 insertions(+), 1 deletion(-) > > Change list: > v4 -> v5: > - Add patch1 to show precise link_type for > {uprobe,kprobe}_multi.(Alexei) > - patch2,3 just remove type field, which will be showed in > link_type > v4: > https://lore.kernel.org/bpf/[email protected] > > v3 -> v4: > - use %pS to print func info.(Alexei) > v3: > https://lore.kernel.org/bpf/[email protected] > > v2 -> v3: > - show info in one line for multi events.(Jiri) > v2: > https://lore.kernel.org/bpf/[email protected] > > v1 -> v2: > - replace 'func_cnt' with 'uprobe_cnt'.(Andrii) > - print func name is more readable and security for kprobe_multi.(Alexei) > v1: > https://lore.kernel.org/bpf/[email protected] > > diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h > index fa9cf4292df..951c91babbc 100644 > --- a/include/linux/trace_events.h > +++ b/include/linux/trace_events.h > @@ -780,6 +780,8 @@ int bpf_get_perf_event_info(const struct perf_event > *event, u32 *prog_id, > unsigned long *missed); > int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog > *prog); > int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog > *prog); > +void bpf_kprobe_multi_link_type_show(const struct bpf_link *link, char > *link_type, int len); > +void bpf_uprobe_multi_link_type_show(const struct bpf_link *link, char > *link_type, int len); > #else > static inline unsigned int trace_call_bpf(struct trace_event_call *call, > void *ctx) > { > @@ -832,6 +834,14 @@ bpf_uprobe_multi_link_attach(const union bpf_attr *attr, > struct bpf_prog *prog) > { > return -EOPNOTSUPP; > } > +static inline void > +bpf_kprobe_multi_link_type_show(const struct bpf_link *link, char > *link_type, int len) > +{ > +} > +static inline void > +bpf_uprobe_multi_link_type_show(const struct bpf_link *link, char > *link_type, int len) > +{ > +} > #endif > > enum { > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c > index 51ba1a7aa43..43b821b37bc 100644 > --- a/kernel/bpf/syscall.c > +++ b/kernel/bpf/syscall.c > @@ -3226,9 +3226,16 @@ static void bpf_link_show_fdinfo(struct seq_file *m, > struct file *filp) > const struct bpf_prog *prog = link->prog; > enum bpf_link_type type = link->type; > char prog_tag[sizeof(prog->tag) * 2 + 1] = { }; > + char link_type[64] = {}; > > if (type < ARRAY_SIZE(bpf_link_type_strs) && > bpf_link_type_strs[type]) { > - seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]); > + if (link->type == BPF_LINK_TYPE_KPROBE_MULTI) > + bpf_kprobe_multi_link_type_show(link, link_type, > sizeof(link_type)); > + else if (link->type == BPF_LINK_TYPE_UPROBE_MULTI) > + bpf_uprobe_multi_link_type_show(link, link_type, > sizeof(link_type)); > + else > + strscpy(link_type, bpf_link_type_strs[type], > sizeof(link_type)); > + seq_printf(m, "link_type:\t%s\n", link_type);
New callbacks just to print a string? Let's find a different way. How about moving 'flags' from bpf_[ku]probe_multi_link into bpf_link ? (There is a 7 byte hole there anyway) and checking flags inline. Jiri, Andrii, better ideas?
