Skip to content

Expose target_obj_id and target_btf_id fields in TracingLinkInfo#1193

Merged
d-e-s-o merged 3 commits intolibbpf:masterfrom
frobware:expose-target_obj_id-and-target_btf_id-fields-in-tracinglinkinfo
Jul 7, 2025
Merged

Expose target_obj_id and target_btf_id fields in TracingLinkInfo#1193
d-e-s-o merged 3 commits intolibbpf:masterfrom
frobware:expose-target_obj_id-and-target_btf_id-fields-in-tracinglinkinfo

Conversation

@frobware
Copy link
Contributor

@frobware frobware commented Jul 5, 2025

Expose target_obj_id and target_btf_id fields in TracingLinkInfo to provide access to BPF tracing link information without requiring additional syscalls.

These fields are already available in the kernel's bpf_link_info struct and are exposed by bpftool, but were being ignored by libbpf-rs. This forces applications to make additional syscalls via bpf_obj_get_info_by_fd() to retrieve information that was already available from the initial query.

Changes

  • libbpf-rs/src/query.rs: Add target_obj_id and target_btf_id fields to TracingLinkInfo struct
  • examples/bpf_query/src/main.rs: Enhanced to demonstrate the new fields for tracing links
  • libbpf-rs/CHANGELOG.md: Document the enhancement

Fields Added

  • target_obj_id: prog_id for PROG_EXT links, otherwise BTF object ID
  • target_btf_id: BTF type ID inside the target object

Example Output

After this change, the bpf_query example shows:

$ sudo ./target/debug/bpf_query link
id=   6 prog_id=1437 type=tracing
    attach_type=LsmMac target_obj_id=1 target_btf_id=59022

This correlates with bpftool output:

$ sudo bpftool link show id 6
6: tracing  prog 1437
        prog_type lsm  attach_type lsm_mac
        target_obj_id 1  target_btf_id 59022

Benefits

  • Performance: Eliminates additional syscalls for BPF introspection tools
  • Consistency: Follows existing pattern of exposing all available kernel fields
  • Compatibility: only adds new fields

@frobware frobware force-pushed the expose-target_obj_id-and-target_btf_id-fields-in-tracinglinkinfo branch from 16e3b62 to 4033e5b Compare July 5, 2025 08:38
Copy link
Collaborator

@d-e-s-o d-e-s-o left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks mostly good to me, thanks. Left two comments. Also, can you please combine the CHANGELOG commit into the one adding the fields? No need to separate.

Comment on lines 22 to 23
- Added `target_obj_id` and `target_btf_id` fields to `TracingLinkInfo`
to expose BTF information directly from kernel queries
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

frobware and others added 3 commits July 7, 2025 19:08
Add missing target_obj_id and target_btf_id fields to the
TracingLinkInfo struct to provide complete access to BPF tracing link
information.

These fields are already available in the kernel's bpf_link_info
struct and are exposed by bpftool, but were being ignored by
libbpf-rs. This forces applications to make additional syscalls via
bpf_obj_get_info_by_fd to retrieve information that was already
available from the initial query.

Fields added:
- target_obj_id: prog_id for PROG_EXT links, otherwise BTF object ID
- target_btf_id: BTF type ID inside the target object

The target BTF information is essential for BPF introspection tools
that need to understand what kernel objects or functions tracing
programs are attached to, particularly for LSM hooks, fentry/fexit
probes, and other advanced tracing mechanisms.

Follows the existing pattern of exposing all available kernel fields
rather than requiring applications to perform additional queries.

Signed-off-by: Andrew McDermott <aim@frobware.com>
The enhanced TracingLinkInfo struct now includes target_obj_id and
target_btf_id fields that are directly available from the kernel's
bpf_link_info structure. This eliminates the need for additional
syscalls to retrieve BTF information for tracing links.

Example output:

    $ sudo ./target/debug/bpf_query link
    id=   6 prog_id=1437 type=tracing
        attach_type=LsmMac target_obj_id=1 target_btf_id=59022

This output correlates with bpftool:

    $ sudo bpftool link show id 6
    6: tracing  prog 1437
            prog_type lsm  attach_type lsm_mac
            target_obj_id 1  target_btf_id 59022

Signed-off-by: Andrew McDermott <aim@frobware.com>
Co-authored-by: Daniel Müller <d-e-s-o@users.noreply.github.com>
@frobware frobware force-pushed the expose-target_obj_id-and-target_btf_id-fields-in-tracinglinkinfo branch from bae77fc to c4b8e11 Compare July 7, 2025 18:13
@d-e-s-o d-e-s-o merged commit 1387b91 into libbpf:master Jul 7, 2025
14 checks passed
@frobware frobware deleted the expose-target_obj_id-and-target_btf_id-fields-in-tracinglinkinfo branch September 2, 2025 07:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

Comments