feat: add support for uprobe_multi link #486

maxgio92 · 2025-04-12T13:34:58Z

This patch introduces support for multi uprobe attach via uprobe_multi link [1], to support attach of multiple uprobes and usdt probes without involving perf events. Normal uprobe is attached through the perf event and attaching many uprobes generates one perf event each.

New BPFProg.AttachUprobeMulti and BPFProg.AttachURetprobeMulti methods are available from this patch, which are
astractions over the libbpf bpf_program__attach_uprobe_multi helper, to attach uprobes and uretprobes respectively.

Moreover, the API is simplified over the bpf_program__attach_uprobe_multi, by abstracting the bpf_uprobe_multi_opts API. Following the libbpf API, only the second set of inputs of the libbpf API is supported now, that is, mentioning libbpf:
bpf_program__attach_uprobe_multi() attaches a BPF program to multiple
uprobes with uprobe_multi link.

User can specify 2 mutually exclusive set of inputs:

use only path/func_pattern/pid arguments
use path/pid with allowed combinations of
syms/offsets/ref_ctr_offsets/cookies/cnt

The Go binding API indeed supports the path and offsets set of inputs, in a similar fashion the BPFProg.AttachUprobe and
BPFProg.AttachUretprobe provide.

[1]
https://lore.kernel.org/bpf/[email protected]/

CLAassistant · 2025-04-12T13:38:04Z

All committers have signed the CLA.

libbpfgo.c

selftest/uprobe-multi/main.go

geyslan · 2025-04-17T20:34:22Z

@maxgio92 Tks for this great contribution. We'll get into it soon.

maxgio92 · 2025-04-19T16:54:25Z

Thank you @geyslan!
I've looked in the meantime at the CI failed checks, but none of them seem related to the new tests for uprobe multi link 🤔

geyslan · 2025-04-29T18:53:34Z

Thank you @geyslan! I've looked in the meantime at the CI failed checks, but none of them seem related to the new tests for uprobe multi link 🤔

Perhaps due to the double definition in vmlinux.h? LMK.

maxgio92 · 2025-04-30T11:26:35Z

My bad @geyslan, I fixed the declarations, thanks.
The difference there is the new unions for the stack and data segments registers, for the support to Intel FRED available since 6.9.

May I ask you a check and possibly a review?
Thank you so much!

geyslan · 2025-05-17T20:50:31Z

May I ask you a check and possibly a review? Thank you so much!

Of course! I'll do it as soon as I have a free slot. And thanks again for your contribution!

@yanivagman FYI.

geyslan · 2025-05-23T21:48:01Z

I'll get here soon.

Copilot

Pull Request Overview

This PR adds support for multi uprobe and uretprobe attach via a new uprobe_multi link, simplifying the API compared to using individual perf events. Key changes include new methods in the BPFProg API, updated BPF C helper and binding functions, and associated selftests in Go, C, shell script, and Makefile.

Reviewed Changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
selftest/uprobe-multi/test.go	Added Go selftest exercising multiple probe attachments
selftest/uprobe-multi/test.c	Added C selftest for uprobe multi functionality
selftest/uprobe-multi/run.sh	Shell script to automate selftests
selftest/uprobe-multi/main.go	Main selftest implementation using multi uprobes
selftest/uprobe-multi/main.bpf.c	BPF C code for ring buffer event notifications
prog.go	New API additions for multi uprobe attach
libbpfgo.h & libbpfgo.c	Bindings for the new uprobe_multi attach helper
Makefile and go.mod	Build and dependency updates for the new functionality
selftest/common/vmlinux.h	Minor adjustments to support the new BPF changes

prog.go

selftest/uprobe-multi/main.go

geyslan

All good. I've requested small changes and we'll be good to go.

--- EDIT

Just forgot to mention before. Please make the commits atomic, I mean, this has changes that are later removed partially in the next.

I ask that since I don't want squash them later 👍🏻.

libbpfgo.c

prog.go

selftest/common/vmlinux.h

selftest/uprobe-multi/.gitignore

selftest/uprobe-multi/go.mod

selftest/uprobe-multi/main.go

maxgio92 · 2025-05-30T16:39:31Z

Hi @geyslan, thank you so much. I've addressed all the points.
LMK if anything else needs to be addressed.

libbpfgo.c

geyslan · 2025-05-30T17:57:53Z

prog.go

+// func_pattern argument to libbpf bpf_program__attach_uprobe_multi() which accepts a regular expression
+// to specify functions to attach BPF program to, is currently not supported.


In this it's not available yet, right?

Exactly. We do only in the cgo API as decided to simplify its introduction next - considering the fix

prog.go

This patch introduces support for multi uprobe attach via uprobe_multi link [1], to support attach of multiple uprobes and usdt probes without involving perf events. Normal uprobe is attached through the perf event and attaching many uprobes generates one perf event each. New BPFProg.AttachUprobeMulti and BPFProg.AttachURetprobeMulti methods are available from this patch, which are astractions over the libbpf bpf_program__attach_uprobe_multi helper, to attach uprobes and uretprobes respectively. Moreover, the API is simplified over the bpf_program__attach_uprobe_multi, by abstracting the bpf_uprobe_multi_opts API. Following the libbpf API, only the second set of inputs of the libbpf API is supported now, that is, mentioning libbpf: bpf_program__attach_uprobe_multi() attaches a BPF program to multiple uprobes with uprobe_multi link. User can specify 2 mutually exclusive set of inputs: 1) use only path/func_pattern/pid arguments 2) use path/pid with allowed combinations of syms/offsets/ref_ctr_offsets/cookies/cnt The Go binding API indeed supports the path and offsets set of inputs, in a similar fashion the BPFProg.AttachUprobe and BPFProg.AttachUretprobe provide. [1] https://lore.kernel.org/bpf/[email protected]/ Signed-off-by: Massimiliano Giovagnoli <[email protected]>

This commit updates the vmlinux.h header to support intel fred into the stack and data segment registers. Signed-off-by: Massimiliano Giovagnoli <[email protected]>

maxgio92 · 2025-05-30T19:51:22Z

Everything has been addressed @geyslan. Thanks for your patience :-)
Let me know if you prefer to address the support for the func_pattern argument within this PR. As decided, for now it's only supported in the CGO API to ease future contribution.

geyslan · 2025-05-30T20:15:40Z

No worries. The missing API can be handled next. Thanks again for this new feature. 🚀

maxgio92 · 2025-05-30T20:29:03Z

Right. min has been introduced in Go 1.21, so tests for Go 1.20 is failing now :) Let me address it soon

geyslan · 2025-05-30T21:11:28Z

Right. min has been introduced in Go 1.21, so tests for Go 1.20 is failing now :) Let me address it soon

Indeed. Shame on me.

geyslan · 2025-05-30T21:15:55Z

libbpfgo.c

+    struct bpf_uprobe_multi_opts opts = {};
+    opts.sz = sizeof(opts);
+    opts.offsets = offsets;
+    opts.cookies = cookies;
+    opts.cnt = cnt;
+    opts.retprobe = retprobe;


Note for the future: Currently, bpf_uprobe_multi_opts is only used by bpf_program__attach_uprobe_multi. If this changes, it may be better to manage it with dedicated _new() and _free() handlers.

maxgio92 · 2025-05-31T01:26:29Z

No problem @geyslan at all. I've just added a facade to min so that the test behaves correctly for Go < 1.21 as well - tested with 1.18, 1.19 and 1.20.

geyslan · 2025-05-31T11:18:31Z

Maybe just placing the Min in the test file or even its logic replacing min would be simpler. WDYT?

P.S.: I used min to not pollute logs.

maxgio92 · 2025-05-31T13:59:58Z

@geyslan What about just removing it? The value this debug brings is not worth it IMO. I mean:

diff --git a/selftest/uprobe-multi/main.go b/selftest/uprobe-multi/main.go
index 61fa1a7..eafcbdc 100644
--- a/selftest/uprobe-multi/main.go
+++ b/selftest/uprobe-multi/main.go
@@ -192,10 +192,6 @@ func getFunSyms(name string) ([]elf.Symbol, error) {
 		return nil, err
 	}
 	log.Printf("found %d symbols in %s\n", len(syms), name)
-	log.Printf("showing first %d symbols\n", utils.Min(10, len(syms)))
-	for i := 0; i < utils.Min(10, len(syms)); i++ {
-		log.Printf("symbol %d: %v\n", i, syms[i])
-	}
 	for _, sym := range syms {
 		// Exclude non-function symbols.
 		if elf.ST_TYPE(sym.Info) != elf.STT_FUNC {

In the meantime, I've simplified the backward compatible min, in case we want to keep it.

Signed-off-by: Massimiliano Giovagnoli <[email protected]>

geyslan · 2025-06-02T14:33:02Z

@maxgio92 🚀

maxgio92 · 2025-06-02T16:15:09Z

Thank you so much @geyslan !

maxgio92 changed the title ~~feat: add support for uprobe_multi~~ feat: add support for uprobe_multi link Apr 12, 2025

maxgio92 force-pushed the uprobe-multi-support branch 3 times, most recently from 9effc2a to 052ab74 Compare April 13, 2025 18:19

maxgio92 commented Apr 15, 2025

View reviewed changes

libbpfgo.c Outdated Show resolved Hide resolved

maxgio92 force-pushed the uprobe-multi-support branch 2 times, most recently from 212413a to bf641e7 Compare April 17, 2025 18:29

maxgio92 commented Apr 17, 2025

View reviewed changes

selftest/uprobe-multi/main.go Show resolved Hide resolved

maxgio92 force-pushed the uprobe-multi-support branch 2 times, most recently from 5ed33df to 276caf5 Compare April 17, 2025 18:47

maxgio92 marked this pull request as ready for review April 18, 2025 13:30

maxgio92 force-pushed the uprobe-multi-support branch from fe675c2 to 26f12b4 Compare April 30, 2025 11:22

maxgio92 force-pushed the uprobe-multi-support branch from 2ccb0bf to 4d79b3f Compare May 1, 2025 07:50

geyslan requested a review from Copilot May 23, 2025 21:54

Copilot AI reviewed May 23, 2025

View reviewed changes

prog.go Outdated Show resolved Hide resolved

selftest/uprobe-multi/main.go Show resolved Hide resolved

geyslan added the feature New feature or request label May 24, 2025

geyslan requested changes May 30, 2025

View reviewed changes

geyslan assigned maxgio92 May 30, 2025

maxgio92 force-pushed the uprobe-multi-support branch 5 times, most recently from 83943a9 to f4b1692 Compare May 30, 2025 16:35

maxgio92 force-pushed the uprobe-multi-support branch from f4b1692 to a111cd1 Compare May 30, 2025 16:38

maxgio92 requested a review from geyslan May 30, 2025 16:40

geyslan reviewed May 30, 2025

View reviewed changes

libbpfgo.c Outdated Show resolved Hide resolved

geyslan reviewed May 30, 2025

View reviewed changes

prog.go Show resolved Hide resolved

Massimiliano Giovagnoli and others added 2 commits May 30, 2025 21:47

test(selftest/common): update vmlinux.h

7f58ebb

This commit updates the vmlinux.h header to support intel fred into the stack and data segment registers. Signed-off-by: Massimiliano Giovagnoli <[email protected]>

maxgio92 force-pushed the uprobe-multi-support branch from 7611df3 to 7f58ebb Compare May 30, 2025 19:49

geyslan reviewed May 30, 2025

View reviewed changes

test(selftest/uprobe-multi): add support for go < 1.21

925afa4

Signed-off-by: Massimiliano Giovagnoli <[email protected]>

maxgio92 force-pushed the uprobe-multi-support branch from deb7220 to 925afa4 Compare May 31, 2025 14:09

maxgio92 requested a review from geyslan May 31, 2025 14:16

geyslan approved these changes Jun 2, 2025

View reviewed changes

geyslan merged commit 0884266 into aquasecurity:main Jun 2, 2025
26 checks passed

maxgio92 mentioned this pull request Jun 3, 2025

Move to upstream libbpfgo maxgio92/xcover#20

Open

		// func_pattern argument to libbpf bpf_program__attach_uprobe_multi() which accepts a regular expression
		// to specify functions to attach BPF program to, is currently not supported.

feat: add support for uprobe_multi link #486

feat: add support for uprobe_multi link #486

Uh oh!

Conversation

maxgio92 commented Apr 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CLAassistant commented Apr 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

geyslan commented Apr 17, 2025

Uh oh!

maxgio92 commented Apr 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

geyslan commented Apr 29, 2025

Uh oh!

maxgio92 commented Apr 30, 2025

Uh oh!

geyslan commented May 17, 2025

Uh oh!

geyslan commented May 23, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

geyslan left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

maxgio92 commented May 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

geyslan May 30, 2025

Choose a reason for hiding this comment

Uh oh!

maxgio92 May 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

maxgio92 commented May 30, 2025

Uh oh!

geyslan commented May 30, 2025

Uh oh!

maxgio92 commented May 30, 2025

Uh oh!

geyslan commented May 30, 2025

Uh oh!

geyslan May 30, 2025

Choose a reason for hiding this comment

Uh oh!

maxgio92 commented May 31, 2025

Uh oh!

geyslan commented May 31, 2025

Uh oh!

maxgio92 commented May 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

geyslan commented Jun 2, 2025

Uh oh!

maxgio92 commented Jun 2, 2025

maxgio92 commented Apr 12, 2025 •

edited

Loading

CLAassistant commented Apr 12, 2025 •

edited

Loading

maxgio92 commented Apr 19, 2025 •

edited

Loading

geyslan left a comment •

edited

Loading

maxgio92 commented May 30, 2025 •

edited

Loading

maxgio92 May 30, 2025 •

edited

Loading

maxgio92 commented May 31, 2025 •

edited

Loading