Expose target_obj_id and target_btf_id fields in TracingLinkInfo#1193
Merged
d-e-s-o merged 3 commits intolibbpf:masterfrom Jul 7, 2025
Conversation
16e3b62 to
4033e5b
Compare
d-e-s-o
reviewed
Jul 7, 2025
libbpf-rs/CHANGELOG.md
Outdated
Comment on lines
22
to
23
| - Added `target_obj_id` and `target_btf_id` fields to `TracingLinkInfo` | ||
| to expose BTF information directly from kernel queries |
Collaborator
There was a problem hiding this comment.
Please move into a new Unreleased section. See af0910e#diff-4c0b9d3ba9467bbce23979f2823a77684818168c500364d9652b70eac9dfe1f9
Contributor
Author
There was a problem hiding this comment.
Add missing target_obj_id and target_btf_id fields to the TracingLinkInfo struct to provide complete access to BPF tracing link information. These fields are already available in the kernel's bpf_link_info struct and are exposed by bpftool, but were being ignored by libbpf-rs. This forces applications to make additional syscalls via bpf_obj_get_info_by_fd to retrieve information that was already available from the initial query. Fields added: - target_obj_id: prog_id for PROG_EXT links, otherwise BTF object ID - target_btf_id: BTF type ID inside the target object The target BTF information is essential for BPF introspection tools that need to understand what kernel objects or functions tracing programs are attached to, particularly for LSM hooks, fentry/fexit probes, and other advanced tracing mechanisms. Follows the existing pattern of exposing all available kernel fields rather than requiring applications to perform additional queries. Signed-off-by: Andrew McDermott <aim@frobware.com>
The enhanced TracingLinkInfo struct now includes target_obj_id and
target_btf_id fields that are directly available from the kernel's
bpf_link_info structure. This eliminates the need for additional
syscalls to retrieve BTF information for tracing links.
Example output:
$ sudo ./target/debug/bpf_query link
id= 6 prog_id=1437 type=tracing
attach_type=LsmMac target_obj_id=1 target_btf_id=59022
This output correlates with bpftool:
$ sudo bpftool link show id 6
6: tracing prog 1437
prog_type lsm attach_type lsm_mac
target_obj_id 1 target_btf_id 59022
Signed-off-by: Andrew McDermott <aim@frobware.com>
Co-authored-by: Daniel Müller <d-e-s-o@users.noreply.github.com>
bae77fc to
c4b8e11
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Expose
target_obj_idandtarget_btf_idfields inTracingLinkInfoto provide access to BPF tracing link information without requiring additional syscalls.These fields are already available in the kernel's
bpf_link_infostruct and are exposed bybpftool, but were being ignored by libbpf-rs. This forces applications to make additional syscalls viabpf_obj_get_info_by_fd()to retrieve information that was already available from the initial query.Changes
target_obj_idandtarget_btf_idfields toTracingLinkInfostructFields Added
target_obj_id: prog_id for PROG_EXT links, otherwise BTF object IDtarget_btf_id: BTF type ID inside the target objectExample Output
After this change, the bpf_query example shows:
$ sudo ./target/debug/bpf_query link id= 6 prog_id=1437 type=tracing attach_type=LsmMac target_obj_id=1 target_btf_id=59022This correlates with bpftool output:
$ sudo bpftool link show id 6 6: tracing prog 1437 prog_type lsm attach_type lsm_mac target_obj_id 1 target_btf_id 59022Benefits