Skip to content

runtime: add uprobe_multi support - #328

Open
Officeyutong wants to merge 14 commits into
eunomia-bpf:masterfrom
Officeyutong:uprobe-multi-backup
Open

runtime: add uprobe_multi support#328
Officeyutong wants to merge 14 commits into
eunomia-bpf:masterfrom
Officeyutong:uprobe-multi-backup

Conversation

@Officeyutong

Copy link
Copy Markdown
Contributor

uprobe_multi is a special type of uprobe, which allows hooking multiple userspace functions in a single attach. This PR adds uprobe_multi support for uprobe_attach_impl, the corresponding example, and update CI

Closes #214

See https://lore.kernel.org/bpf/20230424160447.2005755-1-jolsa@kernel.org/ for details

Our design

In the kernel bpf, the attaching of uprobe_multi were implemented through creating a bpf link, and filling all information (such as pid, function offset, attach cookies) in the link opts. You may find it in bpf_program__attach_uprobe_multi

But in bpftime, all attaches are required to have an attach target (a.k.a perf event), so for uprobe_multi that doesn't give us a perf event, we have a slightly different implementation to the kernel: When creating a bpf link, we doesn't only record configurations from bpf_link_create_opts into the handler, but also do we create some perf events for the uprobe_multi links, and record them in the handler. In this way, we tear down a uprobe_multi into several simple uprobe attach targets, and with a total bpf link. This will not affect the hooking performance.

Main changes

  • Update bpf_link_handler to make it support multiple attach targets
  • Adapt for multiple attach targets in a single bpf_link

@yunwei37
yunwei37 force-pushed the master branch 3 times, most recently from 1354316 to a6a132b Compare September 11, 2024 18:08
@yunwei37
yunwei37 marked this pull request as ready for review April 10, 2025 17:57
@yunwei37
yunwei37 force-pushed the master branch 2 times, most recently from cbcb1e9 to 20acd88 Compare October 1, 2025 23:45

} else {
SPDLOG_ERROR(
"Trying to instantiate uprobe multi (entry hook), but uretprobe is not registered");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"Trying to instantiate uprobe multi (entry hook), but uretprobe is not registered");
"Trying to instantiate uprobe multi (entry hook), but uprobe is not registered");

Shouldn't the message be that way?

Comment on lines +38 to +39
return std::string("<Frida attach private data addr=") +
std::to_string(addr);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return std::string("<Frida attach private data addr=") +
std::to_string(addr);
return std::string("<Frida attach private data addr=") +
std::to_string(reinterpret_cast<uintptr_t>(addr)) + ">";

// For perf event link, there should be an instantiated target
auto &[priv_data, attach_type] =
instantiated_perf_events[handler.target_id];
SPDLOG_DEBUG("Attach private data is {}, attach type is ",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
SPDLOG_DEBUG("Attach private data is {}, attach type is ",
SPDLOG_DEBUG("Attach private data is {}, attach type is {}",

[=](void *mem, size_t mem_size, uint64_t *ret) -> int {
current_thread_bpf_cookie = cookie;
int err = prog->bpftime_prog_exec(
(void *)mem, mem_size, ret);
return err;
},
*priv_data, attach_type);
native_ids.emplace_back(attach_id, attach_impl);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't we need to check if the attach failed, on attach_id?

@yunwei37

yunwei37 commented Jul 19, 2026

Copy link
Copy Markdown
Member

This branch conflicts with master and still has four non-outdated review threads, including an unchecked attach_id failure path plus message/formatting fixes. The next concrete step is for the author to rebase, address those threads on the rebased code, and request a fresh review; the current head should not be merged.

AI-generated response; a maintainer will review and follow up later

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[idea]: Support uprobe_multi for bpftime

3 participants