feat: support for uprobe multi info

Signed-off-by: Max Altgelt <max.altgelt@nextron-systems.com>

Author: secDre4mer

link/link_other.go

@@ -226,6 +226,63 @@ func (kpm *KprobeMultiInfo) Cookies() ([]uint64, bool) {
 	return kpm.cookies, kpm.cookies != nil
 }
 
+type UprobeMultiInfo struct {
+	count         uint32
+	flags         uint32
+	missed        uint64
+	offsets       []uint64
+	cookies       []uint64
+	refCtrOffsets []uint64
+	path          string
+	pid           uint32
+}
+
+// AddressCount is the number of addresses hooked by the kprobe.
+func (umi *UprobeMultiInfo) AddressCount() (uint32, bool) {
+	return umi.count, umi.count > 0
+}
+
+func (umi *UprobeMultiInfo) Flags() (uint32, bool) {
+	return umi.flags, umi.flags > 0
+}
+
+func (umi *UprobeMultiInfo) Missed() (uint64, bool) {
+	return umi.missed, umi.missed > 0
+}
+
+type UprobeMultiOffset struct {
+	Offset uint64
+	Cookie uint64
+	RefCtr uint64
+}
+
+// Offsets returns the offsets that the uprobe was attached to along with the related cookies and ref counters.
+func (umi *UprobeMultiInfo) Offsets() ([]UprobeMultiOffset, bool) {
+	if umi.offsets == nil || len(umi.cookies) != len(umi.offsets) || len(umi.refCtrOffsets) != len(umi.offsets) {
+		return nil, false
+	}
+	var adresses = make([]UprobeMultiOffset, len(umi.offsets))
+	for i := range umi.offsets {
+		adresses[i] = UprobeMultiOffset{
+			Offset: umi.offsets[i],
+			Cookie: umi.cookies[i],
+			RefCtr: umi.refCtrOffsets[i],
+		}
+	}
+	return adresses, true
+}
+
+func (umi *UprobeMultiInfo) Path() string {
+	return umi.path
+}
+
+// Pid returns the process ID that this uprobe is attached to.
+//
+// If it does not exist, the uprobe will trigger for all processes.
+func (umi *UprobeMultiInfo) Pid() (uint32, bool) {
+	return umi.pid, umi.pid > 0
+}
+
 const (
 	PerfEventUnspecified = sys.BPF_PERF_EVENT_UNSPEC
 	PerfEventUprobe      = sys.BPF_PERF_EVENT_UPROBE
@@ -358,6 +415,14 @@ func (r Info) KprobeMulti() *KprobeMultiInfo {
 	return e
 }
 
+// UprobeMulti returns uprobe-multi type-specific link info.
+//
+// Returns nil if the type-specific link info isn't available.
+func (r Info) UprobeMulti() *UprobeMultiInfo {
+	e, _ := r.extra.(*UprobeMultiInfo)
+	return e
+}
+
 // PerfEvent returns perf-event type-specific link info.
 //
 // Returns nil if the type-specific link info isn't available.

link/uprobe_multi.go

@@ -176,6 +176,58 @@ func (kml *uprobeMultiLink) Update(_ *ebpf.Program) error {
 	return fmt.Errorf("update uprobe_multi: %w", ErrNotSupported)
 }
 
+func (kml *uprobeMultiLink) Info() (*Info, error) {
+	var info sys.UprobeMultiLinkInfo
+	if err := sys.ObjInfo(kml.fd, &info); err != nil {
+		return nil, fmt.Errorf("uprobe multi link info: %s", err)
+	}
+	var (
+		path          = make([]byte, info.PathSize)
+		refCtrOffsets = make([]uint64, info.Count)
+		addrs         = make([]uint64, info.Count)
+		cookies       = make([]uint64, info.Count)
+	)
+	info = sys.UprobeMultiLinkInfo{
+		Path:          sys.SlicePointer(path),
+		PathSize:      uint32(len(path)),
+		Offsets:       sys.SlicePointer(addrs),
+		RefCtrOffsets: sys.SlicePointer(refCtrOffsets),
+		Cookies:       sys.SlicePointer(cookies),
+		Count:         uint32(len(addrs)),
+	}
+	if err := sys.ObjInfo(kml.fd, &info); err != nil {
+		return nil, fmt.Errorf("uprobe multi link info: %s", err)
+	}
+	if info.Path.IsNil() {
+		path = nil
+	}
+	if info.Cookies.IsNil() {
+		cookies = nil
+	}
+	if info.Offsets.IsNil() {
+		addrs = nil
+	}
+	if info.RefCtrOffsets.IsNil() {
+		refCtrOffsets = nil
+	}
+	extra := &UprobeMultiInfo{
+		count:         info.Count,
+		flags:         info.Flags,
+		pid:           info.Pid,
+		offsets:       addrs,
+		cookies:       cookies,
+		refCtrOffsets: refCtrOffsets,
+		path:          unix.ByteSliceToString(path),
+	}
+
+	return &Info{
+		info.Type,
+		info.Id,
+		ebpf.ProgramID(info.ProgId),
+		extra,
+	}, nil
+}
+
 var haveBPFLinkUprobeMulti = internal.NewFeatureTest("bpf_link_uprobe_multi", func() error {
 	prog, err := ebpf.NewProgram(&ebpf.ProgramSpec{
 		Name: "probe_upm_link",

link/uprobe_multi_test.go

@@ -39,6 +39,31 @@ func TestUprobeMulti(t *testing.T) {
 	_ = um.Close()
 }
 
+func TestUprobeMultiInfo(t *testing.T) {
+	testutils.SkipIfNotSupported(t, haveBPFLinkUprobeMulti())
+	testutils.SkipOnOldKernel(t, "6.8", "bpf_link_info_uprobe_multi")
+
+	prog := mustLoadProgram(t, ebpf.Kprobe, ebpf.AttachTraceUprobeMulti, "")
+
+	// uprobe
+	um, err := bashEx.UprobeMulti(bashSyms, prog, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer um.Close()
+
+	linkInfo, err := um.Info()
+	if err != nil {
+		t.Fatal(err)
+	}
+	qt.Assert(t, qt.Equals(linkInfo.Type, UprobeMultiType))
+	uprobeDetails := linkInfo.UprobeMulti()
+	qt.Assert(t, qt.StringContains(uprobeDetails.Path(), bashEx.path)) // On some platforms, /bin/bash may point to /usr/bin/bash, thus only a contains and no equals check
+	uprobeOffsets, ok := uprobeDetails.Offsets()
+	qt.Assert(t, qt.IsTrue(ok))
+	qt.Assert(t, qt.HasLen(uprobeOffsets, len(bashSyms)))
+}
+
 func TestUprobeMultiInput(t *testing.T) {
 	testutils.SkipIfNotSupported(t, haveBPFLinkUprobeMulti())