| Message ID | 20230623141546.3751-12-laoar.shao@gmail.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | BPF |
| Headers | show |
| Series | bpf: Support ->fill_link_info for kprobe_multi and perf_event links | expand |
2023-06-23 14:15 UTC+0000 ~ Yafang Shao <laoar.shao@gmail.com> > Enhance bpftool to display comprehensive information about exposed > perf_event links, covering uprobe, kprobe, tracepoint, and generic perf > event. The resulting output will include the following details: > > $ tools/bpf/bpftool/bpftool link show > 4: perf_event prog 23 > uprobe /home/dev/waken/bpf/uprobe/a.out+0x1338 > bpf_cookie 0 > pids uprobe(27503) > 5: perf_event prog 24 > uretprobe /home/dev/waken/bpf/uprobe/a.out+0x1338 > bpf_cookie 0 > pids uprobe(27503) > 6: perf_event prog 31 > kprobe ffffffffa90a9660 kernel_clone > bpf_cookie 0 > pids kprobe(27777) > 7: perf_event prog 30 > kretprobe ffffffffa90a9660 kernel_clone > bpf_cookie 0 > pids kprobe(27777) > 8: perf_event prog 37 > tracepoint sched_switch > bpf_cookie 0 > pids tracepoint(28036) > 9: perf_event prog 43 > event software:cpu-clock > bpf_cookie 0 > pids perf_event(28261) > 10: perf_event prog 43 > event hw-cache:LLC-load-misses > bpf_cookie 0 > pids perf_event(28261) > 11: perf_event prog 43 > event hardware:cpu-cycles > bpf_cookie 0 > pids perf_event(28261) > > $ tools/bpf/bpftool/bpftool link show -j > [{"id":4,"type":"perf_event","prog_id":23,"retprobe":false,"file":"/home/dev/waken/bpf/uprobe/a.out","offset":4920,"bpf_cookie":0,"pids":[{"pid":27503,"comm":"uprobe"}]},{"id":5,"type":"perf_event","prog_id":24,"retprobe":true,"file":"/home/dev/waken/bpf/uprobe/a.out","offset":4920,"bpf_cookie":0,"pids":[{"pid":27503,"comm":"uprobe"}]},{"id":6,"type":"perf_event","prog_id":31,"retprobe":false,"addr":18446744072250627680,"func":"kernel_clone","offset":0,"bpf_cookie":0,"pids":[{"pid":27777,"comm":"kprobe"}]},{"id":7,"type":"perf_event","prog_id":30,"retprobe":true,"addr":18446744072250627680,"func":"kernel_clone","offset":0,"bpf_cookie":0,"pids":[{"pid":27777,"comm":"kprobe"}]},{"id":8,"type":"perf_event","prog_id":37,"tracepoint":"sched_switch","bpf_cookie":0,"pids":[{"pid":28036,"comm":"tracepoint"}]},{"id":9,"type":"perf_event","prog_id":43,"event_type":"software","event_config":"cpu-clock","bpf_cookie":0,"pids":[{"pid":28261,"comm":"perf_event"}]},{"id":10,"type":"perf_event","prog_id":43,"event_type":"hw-cache","event_config":"LLC-load-misses","bpf_cookie":0,"pids":[{"pid":28261,"comm":"perf_event"}]},{"id":11,"type":"perf_event","prog_id":43,"event_type":"hardware","event_config":"cpu-cycles","bpf_cookie":0,"pids":[{"pid":28261,"comm":"perf_event"}]}] > > For generic perf events, the displayed information in bpftool is limited to > the type and configuration, while other attributes such as sample_period, > sample_freq, etc., are not included. > > The kernel function address won't be exposed if it is not permitted by > kptr_restrict. The result as follows when kptr_restrict is 2. > > $ tools/bpf/bpftool/bpftool link show > 4: perf_event prog 23 > uprobe /home/dev/waken/bpf/uprobe/a.out+0x1338 > 5: perf_event prog 24 > uretprobe /home/dev/waken/bpf/uprobe/a.out+0x1338 > 6: perf_event prog 31 > kprobe kernel_clone > 7: perf_event prog 30 > kretprobe kernel_clone > 8: perf_event prog 37 > tracepoint sched_switch > 9: perf_event prog 43 > event software:cpu-clock > 10: perf_event prog 43 > event hw-cache:LLC-load-misses > 11: perf_event prog 43 > event hardware:cpu-cycles > > Signed-off-by: Yafang Shao <laoar.shao@gmail.com> > --- > tools/bpf/bpftool/link.c | 237 ++++++++++++++++++++++++++++++++++++++++++++++- > 1 file changed, 236 insertions(+), 1 deletion(-) > > diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c > index e5aeee3..31bee95 100644 > --- a/tools/bpf/bpftool/link.c > +++ b/tools/bpf/bpftool/link.c > @@ -17,6 +17,8 @@ > #include "main.h" > #include "xlated_dumper.h" > > +#define PERF_HW_CACHE_LEN 128 > + > static struct hashmap *link_table; > static struct dump_data dd = {}; > > @@ -274,6 +276,110 @@ static int cmp_u64(const void *A, const void *B) > jsonw_end_array(json_wtr); > } > > +static void > +show_perf_event_kprobe_json(struct bpf_link_info *info, json_writer_t *wtr) > +{ > + jsonw_bool_field(wtr, "retprobe", info->perf_event.kprobe.flags & 0x1); > + jsonw_uint_field(wtr, "addr", info->perf_event.kprobe.addr); > + jsonw_string_field(wtr, "func", > + u64_to_ptr(info->perf_event.kprobe.func_name)); > + jsonw_uint_field(wtr, "offset", info->perf_event.kprobe.offset); > +} > + > +static void > +show_perf_event_uprobe_json(struct bpf_link_info *info, json_writer_t *wtr) > +{ > + jsonw_bool_field(wtr, "retprobe", info->perf_event.uprobe.flags & 0x1); > + jsonw_string_field(wtr, "file", > + u64_to_ptr(info->perf_event.uprobe.file_name)); > + jsonw_uint_field(wtr, "offset", info->perf_event.uprobe.offset); > +} > + > +static void > +show_perf_event_tracepoint_json(struct bpf_link_info *info, json_writer_t *wtr) > +{ > + jsonw_string_field(wtr, "tracepoint", > + u64_to_ptr(info->perf_event.tracepoint.tp_name)); > +} > + > +static char *perf_config_hw_cache_str(__u64 config) > +{ > + const char *hw_cache, *result, *op; > + char *str = malloc(PERF_HW_CACHE_LEN); > + > + if (!str) { > + p_err("mem alloc failed"); > + return NULL; > + } > + > + hw_cache = perf_event_name(evsel__hw_cache, config & 0xff); > + if (hw_cache) > + snprintf(str, PERF_HW_CACHE_LEN, "%s-", hw_cache); > + else > + snprintf(str, PERF_HW_CACHE_LEN, "%lld-", config & 0xff); > + > + op = perf_event_name(evsel__hw_cache_op, (config >> 8) & 0xff); > + if (op) > + snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str), > + "%s-", op); > + else > + snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str), > + "%lld-", (config >> 8) & 0xff); > + > + result = perf_event_name(evsel__hw_cache_result, config >> 16); > + if (result) > + snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str), > + "%s", result); > + else > + snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str), > + "%lld", config >> 16); > + return str; > +} > + > +static const char *perf_config_str(__u32 type, __u64 config) > +{ > + const char *perf_config; > + > + switch (type) { > + case PERF_TYPE_HARDWARE: > + perf_config = perf_event_name(event_symbols_hw, config); > + break; > + case PERF_TYPE_SOFTWARE: > + perf_config = perf_event_name(event_symbols_sw, config); > + break; > + case PERF_TYPE_HW_CACHE: > + perf_config = perf_config_hw_cache_str(config); > + break; > + default: > + perf_config = NULL; > + break; > + } > + return perf_config; > +} > + > +static void > +show_perf_event_event_json(struct bpf_link_info *info, json_writer_t *wtr) > +{ > + __u64 config = info->perf_event.event.config; > + __u32 type = info->perf_event.event.type; > + const char *perf_type, *perf_config; > + > + perf_type = perf_event_name(perf_type_name, type); > + if (perf_type) > + jsonw_string_field(wtr, "event_type", perf_type); > + else > + jsonw_uint_field(wtr, "event_type", type); > + > + perf_config = perf_config_str(type, config); > + if (perf_config) > + jsonw_string_field(wtr, "event_config", perf_config); > + else > + jsonw_uint_field(wtr, "event_config", config); > + > + if (type == PERF_TYPE_HW_CACHE && perf_config) > + free((void *)perf_config); > +} > + > static int show_link_close_json(int fd, struct bpf_link_info *info) > { > struct bpf_prog_info prog_info; > @@ -329,6 +435,24 @@ static int show_link_close_json(int fd, struct bpf_link_info *info) > case BPF_LINK_TYPE_KPROBE_MULTI: > show_kprobe_multi_json(info, json_wtr); > break; > + case BPF_LINK_TYPE_PERF_EVENT: > + switch (info->perf_event.type) { > + case BPF_PERF_EVENT_EVENT: > + show_perf_event_event_json(info, json_wtr); > + break; > + case BPF_PERF_EVENT_TRACEPOINT: > + show_perf_event_tracepoint_json(info, json_wtr); > + break; > + case BPF_PERF_EVENT_KPROBE: > + show_perf_event_kprobe_json(info, json_wtr); > + break; > + case BPF_PERF_EVENT_UPROBE: > + show_perf_event_uprobe_json(info, json_wtr); > + break; > + default: > + break; > + } > + break; > default: > break; > } > @@ -500,6 +624,75 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info) > } > } > > +static void show_perf_event_kprobe_plain(struct bpf_link_info *info) > +{ > + const char *buf; > + > + buf = (const char *)u64_to_ptr(info->perf_event.kprobe.func_name); > + if (buf[0] == '\0' && !info->perf_event.kprobe.addr) > + return; > + > + if (info->perf_event.kprobe.flags & 0x1) > + printf("\n\tkretprobe "); > + else > + printf("\n\tkprobe "); > + if (info->perf_event.kprobe.addr) > + printf("%llx ", info->perf_event.kprobe.addr); > + printf("%s", buf); > + if (info->perf_event.kprobe.offset) > + printf("+%#x", info->perf_event.kprobe.offset); > + printf(" "); > +} > + > +static void show_perf_event_uprobe_plain(struct bpf_link_info *info) > +{ > + const char *buf; > + > + buf = (const char *)u64_to_ptr(info->perf_event.uprobe.file_name); > + if (buf[0] == '\0') > + return; > + > + if (info->perf_event.uprobe.flags & 0x1) > + printf("\n\turetprobe "); > + else > + printf("\n\tuprobe "); > + printf("%s+%#x ", buf, info->perf_event.uprobe.offset); > +} > + > +static void show_perf_event_tracepoint_plain(struct bpf_link_info *info) > +{ > + const char *buf; > + > + buf = (const char *)u64_to_ptr(info->perf_event.tracepoint.tp_name); > + if (buf[0] == '\0') > + return; > + > + printf("\n\ttracepoint %s ", buf); > +} > + > +static void show_perf_event_event_plain(struct bpf_link_info *info) > +{ > + __u64 config = info->perf_event.event.config; > + __u32 type = info->perf_event.event.type; > + const char *perf_type, *perf_config; > + > + printf("\n\tevent "); > + perf_type = perf_event_name(perf_type_name, type); > + if (perf_type) > + printf("%s:", perf_type); > + else > + printf("%u :", type); > + > + perf_config = perf_config_str(type, config); > + if (perf_config) > + printf("%s ", perf_config); > + else > + printf("%llu ", config); > + > + if (type == PERF_TYPE_HW_CACHE && perf_config) > + free((void *)perf_config); > +} > + > static int show_link_close_plain(int fd, struct bpf_link_info *info) > { > struct bpf_prog_info prog_info; > @@ -548,6 +741,24 @@ static int show_link_close_plain(int fd, struct bpf_link_info *info) > case BPF_LINK_TYPE_KPROBE_MULTI: > show_kprobe_multi_plain(info); > break; > + case BPF_LINK_TYPE_PERF_EVENT: > + switch (info->perf_event.type) { > + case BPF_PERF_EVENT_EVENT: > + show_perf_event_event_plain(info); > + break; > + case BPF_PERF_EVENT_TRACEPOINT: > + show_perf_event_tracepoint_plain(info); > + break; > + case BPF_PERF_EVENT_KPROBE: > + show_perf_event_kprobe_plain(info); > + break; > + case BPF_PERF_EVENT_UPROBE: > + show_perf_event_uprobe_plain(info); > + break; > + default: > + break; > + } > + break; > default: > break; > } > @@ -570,11 +781,12 @@ static int do_show_link(int fd) > struct bpf_link_info info; > __u32 len = sizeof(info); > __u64 *addrs = NULL; > - char buf[256]; > + char buf[PATH_MAX]; > int count; > int err; > > memset(&info, 0, sizeof(info)); > + buf[0] = '\0'; > again: > err = bpf_link_get_info_by_fd(fd, &info, &len); > if (err) { > @@ -609,7 +821,30 @@ static int do_show_link(int fd) > goto again; > } > } > + if (info.type == BPF_LINK_TYPE_PERF_EVENT) { > + if (info.perf_event.type == BPF_PERF_EVENT_EVENT) > + goto out; This "if (...) goto out;" seems unnecessary? If info.perf_event.type is BPF_PERF_EVENT_EVENT we won't match any of the conditions below and should reach the "out:" label anyway (and that label seems also unnecessary)? > + if (info.perf_event.type == BPF_PERF_EVENT_TRACEPOINT && > + !info.perf_event.tracepoint.tp_name) { > + info.perf_event.tracepoint.tp_name = (unsigned long)&buf; > + info.perf_event.tracepoint.name_len = sizeof(buf); > + goto again; > + } > + if (info.perf_event.type == BPF_PERF_EVENT_KPROBE && > + !info.perf_event.kprobe.func_name) { > + info.perf_event.kprobe.func_name = (unsigned long)&buf; > + info.perf_event.kprobe.name_len = sizeof(buf); > + goto again; > + } > + if (info.perf_event.type == BPF_PERF_EVENT_UPROBE && > + !info.perf_event.uprobe.file_name) { > + info.perf_event.uprobe.file_name = (unsigned long)&buf; > + info.perf_event.uprobe.name_len = sizeof(buf); > + goto again; > + } > + } > > +out: > if (json_output) > show_link_close_json(fd, &info); > else
On Fri, Jun 23, 2023 at 7:16 AM Yafang Shao <laoar.shao@gmail.com> wrote: > pids uprobe(27503) > 6: perf_event prog 31 ... > pids kprobe(27777) > 7: perf_event prog 30 ... > pids kprobe(27777) > 8: perf_event prog 37 > tracepoint sched_switch > bpf_cookie 0 > pids tracepoint(28036) uprobe/kprobe/tracepoint are really the names of your user space applications? or something broke in bpftool that it doesn't show comm correctly?
On Sat, Jun 24, 2023 at 12:49 AM Quentin Monnet <quentin@isovalent.com> wrote: > > 2023-06-23 14:15 UTC+0000 ~ Yafang Shao <laoar.shao@gmail.com> > > Enhance bpftool to display comprehensive information about exposed > > perf_event links, covering uprobe, kprobe, tracepoint, and generic perf > > event. The resulting output will include the following details: > > > > $ tools/bpf/bpftool/bpftool link show > > 4: perf_event prog 23 > > uprobe /home/dev/waken/bpf/uprobe/a.out+0x1338 > > bpf_cookie 0 > > pids uprobe(27503) > > 5: perf_event prog 24 > > uretprobe /home/dev/waken/bpf/uprobe/a.out+0x1338 > > bpf_cookie 0 > > pids uprobe(27503) > > 6: perf_event prog 31 > > kprobe ffffffffa90a9660 kernel_clone > > bpf_cookie 0 > > pids kprobe(27777) > > 7: perf_event prog 30 > > kretprobe ffffffffa90a9660 kernel_clone > > bpf_cookie 0 > > pids kprobe(27777) > > 8: perf_event prog 37 > > tracepoint sched_switch > > bpf_cookie 0 > > pids tracepoint(28036) > > 9: perf_event prog 43 > > event software:cpu-clock > > bpf_cookie 0 > > pids perf_event(28261) > > 10: perf_event prog 43 > > event hw-cache:LLC-load-misses > > bpf_cookie 0 > > pids perf_event(28261) > > 11: perf_event prog 43 > > event hardware:cpu-cycles > > bpf_cookie 0 > > pids perf_event(28261) > > > > $ tools/bpf/bpftool/bpftool link show -j > > [{"id":4,"type":"perf_event","prog_id":23,"retprobe":false,"file":"/home/dev/waken/bpf/uprobe/a.out","offset":4920,"bpf_cookie":0,"pids":[{"pid":27503,"comm":"uprobe"}]},{"id":5,"type":"perf_event","prog_id":24,"retprobe":true,"file":"/home/dev/waken/bpf/uprobe/a.out","offset":4920,"bpf_cookie":0,"pids":[{"pid":27503,"comm":"uprobe"}]},{"id":6,"type":"perf_event","prog_id":31,"retprobe":false,"addr":18446744072250627680,"func":"kernel_clone","offset":0,"bpf_cookie":0,"pids":[{"pid":27777,"comm":"kprobe"}]},{"id":7,"type":"perf_event","prog_id":30,"retprobe":true,"addr":18446744072250627680,"func":"kernel_clone","offset":0,"bpf_cookie":0,"pids":[{"pid":27777,"comm":"kprobe"}]},{"id":8,"type":"perf_event","prog_id":37,"tracepoint":"sched_switch","bpf_cookie":0,"pids":[{"pid":28036,"comm":"tracepoint"}]},{"id":9,"type":"perf_event","prog_id":43,"event_type":"software","event_config":"cpu-clock","bpf_cookie":0,"pids":[{"pid":28261,"comm":"perf_event"}]},{"id":10,"type":"perf_event","prog_id":43,"event_type":"hw-cache","event_config":"LLC-load-misses","bpf_cookie":0,"pids":[{"pid":28261,"comm":"perf_event"}]},{"id":11,"type":"perf_event","prog_id":43,"event_type":"hardware","event_config":"cpu-cycles","bpf_cookie":0,"pids":[{"pid":28261,"comm":"perf_event"}]}] > > > > For generic perf events, the displayed information in bpftool is limited to > > the type and configuration, while other attributes such as sample_period, > > sample_freq, etc., are not included. > > > > The kernel function address won't be exposed if it is not permitted by > > kptr_restrict. The result as follows when kptr_restrict is 2. > > > > $ tools/bpf/bpftool/bpftool link show > > 4: perf_event prog 23 > > uprobe /home/dev/waken/bpf/uprobe/a.out+0x1338 > > 5: perf_event prog 24 > > uretprobe /home/dev/waken/bpf/uprobe/a.out+0x1338 > > 6: perf_event prog 31 > > kprobe kernel_clone > > 7: perf_event prog 30 > > kretprobe kernel_clone > > 8: perf_event prog 37 > > tracepoint sched_switch > > 9: perf_event prog 43 > > event software:cpu-clock > > 10: perf_event prog 43 > > event hw-cache:LLC-load-misses > > 11: perf_event prog 43 > > event hardware:cpu-cycles > > > > Signed-off-by: Yafang Shao <laoar.shao@gmail.com> > > --- > > tools/bpf/bpftool/link.c | 237 ++++++++++++++++++++++++++++++++++++++++++++++- > > 1 file changed, 236 insertions(+), 1 deletion(-) > > > > diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c > > index e5aeee3..31bee95 100644 > > --- a/tools/bpf/bpftool/link.c > > +++ b/tools/bpf/bpftool/link.c > > @@ -17,6 +17,8 @@ > > #include "main.h" > > #include "xlated_dumper.h" > > > > +#define PERF_HW_CACHE_LEN 128 > > + > > static struct hashmap *link_table; > > static struct dump_data dd = {}; > > > > @@ -274,6 +276,110 @@ static int cmp_u64(const void *A, const void *B) > > jsonw_end_array(json_wtr); > > } > > > > +static void > > +show_perf_event_kprobe_json(struct bpf_link_info *info, json_writer_t *wtr) > > +{ > > + jsonw_bool_field(wtr, "retprobe", info->perf_event.kprobe.flags & 0x1); > > + jsonw_uint_field(wtr, "addr", info->perf_event.kprobe.addr); > > + jsonw_string_field(wtr, "func", > > + u64_to_ptr(info->perf_event.kprobe.func_name)); > > + jsonw_uint_field(wtr, "offset", info->perf_event.kprobe.offset); > > +} > > + > > +static void > > +show_perf_event_uprobe_json(struct bpf_link_info *info, json_writer_t *wtr) > > +{ > > + jsonw_bool_field(wtr, "retprobe", info->perf_event.uprobe.flags & 0x1); > > + jsonw_string_field(wtr, "file", > > + u64_to_ptr(info->perf_event.uprobe.file_name)); > > + jsonw_uint_field(wtr, "offset", info->perf_event.uprobe.offset); > > +} > > + > > +static void > > +show_perf_event_tracepoint_json(struct bpf_link_info *info, json_writer_t *wtr) > > +{ > > + jsonw_string_field(wtr, "tracepoint", > > + u64_to_ptr(info->perf_event.tracepoint.tp_name)); > > +} > > + > > +static char *perf_config_hw_cache_str(__u64 config) > > +{ > > + const char *hw_cache, *result, *op; > > + char *str = malloc(PERF_HW_CACHE_LEN); > > + > > + if (!str) { > > + p_err("mem alloc failed"); > > + return NULL; > > + } > > + > > + hw_cache = perf_event_name(evsel__hw_cache, config & 0xff); > > + if (hw_cache) > > + snprintf(str, PERF_HW_CACHE_LEN, "%s-", hw_cache); > > + else > > + snprintf(str, PERF_HW_CACHE_LEN, "%lld-", config & 0xff); > > + > > + op = perf_event_name(evsel__hw_cache_op, (config >> 8) & 0xff); > > + if (op) > > + snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str), > > + "%s-", op); > > + else > > + snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str), > > + "%lld-", (config >> 8) & 0xff); > > + > > + result = perf_event_name(evsel__hw_cache_result, config >> 16); > > + if (result) > > + snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str), > > + "%s", result); > > + else > > + snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str), > > + "%lld", config >> 16); > > + return str; > > +} > > + > > +static const char *perf_config_str(__u32 type, __u64 config) > > +{ > > + const char *perf_config; > > + > > + switch (type) { > > + case PERF_TYPE_HARDWARE: > > + perf_config = perf_event_name(event_symbols_hw, config); > > + break; > > + case PERF_TYPE_SOFTWARE: > > + perf_config = perf_event_name(event_symbols_sw, config); > > + break; > > + case PERF_TYPE_HW_CACHE: > > + perf_config = perf_config_hw_cache_str(config); > > + break; > > + default: > > + perf_config = NULL; > > + break; > > + } > > + return perf_config; > > +} > > + > > +static void > > +show_perf_event_event_json(struct bpf_link_info *info, json_writer_t *wtr) > > +{ > > + __u64 config = info->perf_event.event.config; > > + __u32 type = info->perf_event.event.type; > > + const char *perf_type, *perf_config; > > + > > + perf_type = perf_event_name(perf_type_name, type); > > + if (perf_type) > > + jsonw_string_field(wtr, "event_type", perf_type); > > + else > > + jsonw_uint_field(wtr, "event_type", type); > > + > > + perf_config = perf_config_str(type, config); > > + if (perf_config) > > + jsonw_string_field(wtr, "event_config", perf_config); > > + else > > + jsonw_uint_field(wtr, "event_config", config); > > + > > + if (type == PERF_TYPE_HW_CACHE && perf_config) > > + free((void *)perf_config); > > +} > > + > > static int show_link_close_json(int fd, struct bpf_link_info *info) > > { > > struct bpf_prog_info prog_info; > > @@ -329,6 +435,24 @@ static int show_link_close_json(int fd, struct bpf_link_info *info) > > case BPF_LINK_TYPE_KPROBE_MULTI: > > show_kprobe_multi_json(info, json_wtr); > > break; > > + case BPF_LINK_TYPE_PERF_EVENT: > > + switch (info->perf_event.type) { > > + case BPF_PERF_EVENT_EVENT: > > + show_perf_event_event_json(info, json_wtr); > > + break; > > + case BPF_PERF_EVENT_TRACEPOINT: > > + show_perf_event_tracepoint_json(info, json_wtr); > > + break; > > + case BPF_PERF_EVENT_KPROBE: > > + show_perf_event_kprobe_json(info, json_wtr); > > + break; > > + case BPF_PERF_EVENT_UPROBE: > > + show_perf_event_uprobe_json(info, json_wtr); > > + break; > > + default: > > + break; > > + } > > + break; > > default: > > break; > > } > > @@ -500,6 +624,75 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info) > > } > > } > > > > +static void show_perf_event_kprobe_plain(struct bpf_link_info *info) > > +{ > > + const char *buf; > > + > > + buf = (const char *)u64_to_ptr(info->perf_event.kprobe.func_name); > > + if (buf[0] == '\0' && !info->perf_event.kprobe.addr) > > + return; > > + > > + if (info->perf_event.kprobe.flags & 0x1) > > + printf("\n\tkretprobe "); > > + else > > + printf("\n\tkprobe "); > > + if (info->perf_event.kprobe.addr) > > + printf("%llx ", info->perf_event.kprobe.addr); > > + printf("%s", buf); > > + if (info->perf_event.kprobe.offset) > > + printf("+%#x", info->perf_event.kprobe.offset); > > + printf(" "); > > +} > > + > > +static void show_perf_event_uprobe_plain(struct bpf_link_info *info) > > +{ > > + const char *buf; > > + > > + buf = (const char *)u64_to_ptr(info->perf_event.uprobe.file_name); > > + if (buf[0] == '\0') > > + return; > > + > > + if (info->perf_event.uprobe.flags & 0x1) > > + printf("\n\turetprobe "); > > + else > > + printf("\n\tuprobe "); > > + printf("%s+%#x ", buf, info->perf_event.uprobe.offset); > > +} > > + > > +static void show_perf_event_tracepoint_plain(struct bpf_link_info *info) > > +{ > > + const char *buf; > > + > > + buf = (const char *)u64_to_ptr(info->perf_event.tracepoint.tp_name); > > + if (buf[0] == '\0') > > + return; > > + > > + printf("\n\ttracepoint %s ", buf); > > +} > > + > > +static void show_perf_event_event_plain(struct bpf_link_info *info) > > +{ > > + __u64 config = info->perf_event.event.config; > > + __u32 type = info->perf_event.event.type; > > + const char *perf_type, *perf_config; > > + > > + printf("\n\tevent "); > > + perf_type = perf_event_name(perf_type_name, type); > > + if (perf_type) > > + printf("%s:", perf_type); > > + else > > + printf("%u :", type); > > + > > + perf_config = perf_config_str(type, config); > > + if (perf_config) > > + printf("%s ", perf_config); > > + else > > + printf("%llu ", config); > > + > > + if (type == PERF_TYPE_HW_CACHE && perf_config) > > + free((void *)perf_config); > > +} > > + > > static int show_link_close_plain(int fd, struct bpf_link_info *info) > > { > > struct bpf_prog_info prog_info; > > @@ -548,6 +741,24 @@ static int show_link_close_plain(int fd, struct bpf_link_info *info) > > case BPF_LINK_TYPE_KPROBE_MULTI: > > show_kprobe_multi_plain(info); > > break; > > + case BPF_LINK_TYPE_PERF_EVENT: > > + switch (info->perf_event.type) { > > + case BPF_PERF_EVENT_EVENT: > > + show_perf_event_event_plain(info); > > + break; > > + case BPF_PERF_EVENT_TRACEPOINT: > > + show_perf_event_tracepoint_plain(info); > > + break; > > + case BPF_PERF_EVENT_KPROBE: > > + show_perf_event_kprobe_plain(info); > > + break; > > + case BPF_PERF_EVENT_UPROBE: > > + show_perf_event_uprobe_plain(info); > > + break; > > + default: > > + break; > > + } > > + break; > > default: > > break; > > } > > @@ -570,11 +781,12 @@ static int do_show_link(int fd) > > struct bpf_link_info info; > > __u32 len = sizeof(info); > > __u64 *addrs = NULL; > > - char buf[256]; > > + char buf[PATH_MAX]; > > int count; > > int err; > > > > memset(&info, 0, sizeof(info)); > > + buf[0] = '\0'; > > again: > > err = bpf_link_get_info_by_fd(fd, &info, &len); > > if (err) { > > @@ -609,7 +821,30 @@ static int do_show_link(int fd) > > goto again; > > } > > } > > + if (info.type == BPF_LINK_TYPE_PERF_EVENT) { > > + if (info.perf_event.type == BPF_PERF_EVENT_EVENT) > > + goto out; > > This "if (...) goto out;" seems unnecessary? If info.perf_event.type is > BPF_PERF_EVENT_EVENT we won't match any of the conditions below and > should reach the "out:" label anyway (and that label seems also > unnecessary)? Makes sense. Will change it.
On Sat, Jun 24, 2023 at 1:14 AM Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote: > > On Fri, Jun 23, 2023 at 7:16 AM Yafang Shao <laoar.shao@gmail.com> wrote: > > pids uprobe(27503) > > 6: perf_event prog 31 > ... > > pids kprobe(27777) > > 7: perf_event prog 30 > ... > > pids kprobe(27777) > > 8: perf_event prog 37 > > tracepoint sched_switch > > bpf_cookie 0 > > pids tracepoint(28036) > > uprobe/kprobe/tracepoint are really the names of your user space applications? Yes, they are my test applications. I just named them that way for an easy test :) > > or something broke in bpftool that it doesn't show comm correctly?
diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c index e5aeee3..31bee95 100644 --- a/tools/bpf/bpftool/link.c +++ b/tools/bpf/bpftool/link.c @@ -17,6 +17,8 @@ #include "main.h" #include "xlated_dumper.h" +#define PERF_HW_CACHE_LEN 128 + static struct hashmap *link_table; static struct dump_data dd = {}; @@ -274,6 +276,110 @@ static int cmp_u64(const void *A, const void *B) jsonw_end_array(json_wtr); } +static void +show_perf_event_kprobe_json(struct bpf_link_info *info, json_writer_t *wtr) +{ + jsonw_bool_field(wtr, "retprobe", info->perf_event.kprobe.flags & 0x1); + jsonw_uint_field(wtr, "addr", info->perf_event.kprobe.addr); + jsonw_string_field(wtr, "func", + u64_to_ptr(info->perf_event.kprobe.func_name)); + jsonw_uint_field(wtr, "offset", info->perf_event.kprobe.offset); +} + +static void +show_perf_event_uprobe_json(struct bpf_link_info *info, json_writer_t *wtr) +{ + jsonw_bool_field(wtr, "retprobe", info->perf_event.uprobe.flags & 0x1); + jsonw_string_field(wtr, "file", + u64_to_ptr(info->perf_event.uprobe.file_name)); + jsonw_uint_field(wtr, "offset", info->perf_event.uprobe.offset); +} + +static void +show_perf_event_tracepoint_json(struct bpf_link_info *info, json_writer_t *wtr) +{ + jsonw_string_field(wtr, "tracepoint", + u64_to_ptr(info->perf_event.tracepoint.tp_name)); +} + +static char *perf_config_hw_cache_str(__u64 config) +{ + const char *hw_cache, *result, *op; + char *str = malloc(PERF_HW_CACHE_LEN); + + if (!str) { + p_err("mem alloc failed"); + return NULL; + } + + hw_cache = perf_event_name(evsel__hw_cache, config & 0xff); + if (hw_cache) + snprintf(str, PERF_HW_CACHE_LEN, "%s-", hw_cache); + else + snprintf(str, PERF_HW_CACHE_LEN, "%lld-", config & 0xff); + + op = perf_event_name(evsel__hw_cache_op, (config >> 8) & 0xff); + if (op) + snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str), + "%s-", op); + else + snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str), + "%lld-", (config >> 8) & 0xff); + + result = perf_event_name(evsel__hw_cache_result, config >> 16); + if (result) + snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str), + "%s", result); + else + snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str), + "%lld", config >> 16); + return str; +} + +static const char *perf_config_str(__u32 type, __u64 config) +{ + const char *perf_config; + + switch (type) { + case PERF_TYPE_HARDWARE: + perf_config = perf_event_name(event_symbols_hw, config); + break; + case PERF_TYPE_SOFTWARE: + perf_config = perf_event_name(event_symbols_sw, config); + break; + case PERF_TYPE_HW_CACHE: + perf_config = perf_config_hw_cache_str(config); + break; + default: + perf_config = NULL; + break; + } + return perf_config; +} + +static void +show_perf_event_event_json(struct bpf_link_info *info, json_writer_t *wtr) +{ + __u64 config = info->perf_event.event.config; + __u32 type = info->perf_event.event.type; + const char *perf_type, *perf_config; + + perf_type = perf_event_name(perf_type_name, type); + if (perf_type) + jsonw_string_field(wtr, "event_type", perf_type); + else + jsonw_uint_field(wtr, "event_type", type); + + perf_config = perf_config_str(type, config); + if (perf_config) + jsonw_string_field(wtr, "event_config", perf_config); + else + jsonw_uint_field(wtr, "event_config", config); + + if (type == PERF_TYPE_HW_CACHE && perf_config) + free((void *)perf_config); +} + static int show_link_close_json(int fd, struct bpf_link_info *info) { struct bpf_prog_info prog_info; @@ -329,6 +435,24 @@ static int show_link_close_json(int fd, struct bpf_link_info *info) case BPF_LINK_TYPE_KPROBE_MULTI: show_kprobe_multi_json(info, json_wtr); break; + case BPF_LINK_TYPE_PERF_EVENT: + switch (info->perf_event.type) { + case BPF_PERF_EVENT_EVENT: + show_perf_event_event_json(info, json_wtr); + break; + case BPF_PERF_EVENT_TRACEPOINT: + show_perf_event_tracepoint_json(info, json_wtr); + break; + case BPF_PERF_EVENT_KPROBE: + show_perf_event_kprobe_json(info, json_wtr); + break; + case BPF_PERF_EVENT_UPROBE: + show_perf_event_uprobe_json(info, json_wtr); + break; + default: + break; + } + break; default: break; } @@ -500,6 +624,75 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info) } } +static void show_perf_event_kprobe_plain(struct bpf_link_info *info) +{ + const char *buf; + + buf = (const char *)u64_to_ptr(info->perf_event.kprobe.func_name); + if (buf[0] == '\0' && !info->perf_event.kprobe.addr) + return; + + if (info->perf_event.kprobe.flags & 0x1) + printf("\n\tkretprobe "); + else + printf("\n\tkprobe "); + if (info->perf_event.kprobe.addr) + printf("%llx ", info->perf_event.kprobe.addr); + printf("%s", buf); + if (info->perf_event.kprobe.offset) + printf("+%#x", info->perf_event.kprobe.offset); + printf(" "); +} + +static void show_perf_event_uprobe_plain(struct bpf_link_info *info) +{ + const char *buf; + + buf = (const char *)u64_to_ptr(info->perf_event.uprobe.file_name); + if (buf[0] == '\0') + return; + + if (info->perf_event.uprobe.flags & 0x1) + printf("\n\turetprobe "); + else + printf("\n\tuprobe "); + printf("%s+%#x ", buf, info->perf_event.uprobe.offset); +} + +static void show_perf_event_tracepoint_plain(struct bpf_link_info *info) +{ + const char *buf; + + buf = (const char *)u64_to_ptr(info->perf_event.tracepoint.tp_name); + if (buf[0] == '\0') + return; + + printf("\n\ttracepoint %s ", buf); +} + +static void show_perf_event_event_plain(struct bpf_link_info *info) +{ + __u64 config = info->perf_event.event.config; + __u32 type = info->perf_event.event.type; + const char *perf_type, *perf_config; + + printf("\n\tevent "); + perf_type = perf_event_name(perf_type_name, type); + if (perf_type) + printf("%s:", perf_type); + else + printf("%u :", type); + + perf_config = perf_config_str(type, config); + if (perf_config) + printf("%s ", perf_config); + else + printf("%llu ", config); + + if (type == PERF_TYPE_HW_CACHE && perf_config) + free((void *)perf_config); +} + static int show_link_close_plain(int fd, struct bpf_link_info *info) { struct bpf_prog_info prog_info; @@ -548,6 +741,24 @@ static int show_link_close_plain(int fd, struct bpf_link_info *info) case BPF_LINK_TYPE_KPROBE_MULTI: show_kprobe_multi_plain(info); break; + case BPF_LINK_TYPE_PERF_EVENT: + switch (info->perf_event.type) { + case BPF_PERF_EVENT_EVENT: + show_perf_event_event_plain(info); + break; + case BPF_PERF_EVENT_TRACEPOINT: + show_perf_event_tracepoint_plain(info); + break; + case BPF_PERF_EVENT_KPROBE: + show_perf_event_kprobe_plain(info); + break; + case BPF_PERF_EVENT_UPROBE: + show_perf_event_uprobe_plain(info); + break; + default: + break; + } + break; default: break; } @@ -570,11 +781,12 @@ static int do_show_link(int fd) struct bpf_link_info info; __u32 len = sizeof(info); __u64 *addrs = NULL; - char buf[256]; + char buf[PATH_MAX]; int count; int err; memset(&info, 0, sizeof(info)); + buf[0] = '\0'; again: err = bpf_link_get_info_by_fd(fd, &info, &len); if (err) { @@ -609,7 +821,30 @@ static int do_show_link(int fd) goto again; } } + if (info.type == BPF_LINK_TYPE_PERF_EVENT) { + if (info.perf_event.type == BPF_PERF_EVENT_EVENT) + goto out; + if (info.perf_event.type == BPF_PERF_EVENT_TRACEPOINT && + !info.perf_event.tracepoint.tp_name) { + info.perf_event.tracepoint.tp_name = (unsigned long)&buf; + info.perf_event.tracepoint.name_len = sizeof(buf); + goto again; + } + if (info.perf_event.type == BPF_PERF_EVENT_KPROBE && + !info.perf_event.kprobe.func_name) { + info.perf_event.kprobe.func_name = (unsigned long)&buf; + info.perf_event.kprobe.name_len = sizeof(buf); + goto again; + } + if (info.perf_event.type == BPF_PERF_EVENT_UPROBE && + !info.perf_event.uprobe.file_name) { + info.perf_event.uprobe.file_name = (unsigned long)&buf; + info.perf_event.uprobe.name_len = sizeof(buf); + goto again; + } + } +out: if (json_output) show_link_close_json(fd, &info); else
Enhance bpftool to display comprehensive information about exposed perf_event links, covering uprobe, kprobe, tracepoint, and generic perf event. The resulting output will include the following details: $ tools/bpf/bpftool/bpftool link show 4: perf_event prog 23 uprobe /home/dev/waken/bpf/uprobe/a.out+0x1338 bpf_cookie 0 pids uprobe(27503) 5: perf_event prog 24 uretprobe /home/dev/waken/bpf/uprobe/a.out+0x1338 bpf_cookie 0 pids uprobe(27503) 6: perf_event prog 31 kprobe ffffffffa90a9660 kernel_clone bpf_cookie 0 pids kprobe(27777) 7: perf_event prog 30 kretprobe ffffffffa90a9660 kernel_clone bpf_cookie 0 pids kprobe(27777) 8: perf_event prog 37 tracepoint sched_switch bpf_cookie 0 pids tracepoint(28036) 9: perf_event prog 43 event software:cpu-clock bpf_cookie 0 pids perf_event(28261) 10: perf_event prog 43 event hw-cache:LLC-load-misses bpf_cookie 0 pids perf_event(28261) 11: perf_event prog 43 event hardware:cpu-cycles bpf_cookie 0 pids perf_event(28261) $ tools/bpf/bpftool/bpftool link show -j [{"id":4,"type":"perf_event","prog_id":23,"retprobe":false,"file":"/home/dev/waken/bpf/uprobe/a.out","offset":4920,"bpf_cookie":0,"pids":[{"pid":27503,"comm":"uprobe"}]},{"id":5,"type":"perf_event","prog_id":24,"retprobe":true,"file":"/home/dev/waken/bpf/uprobe/a.out","offset":4920,"bpf_cookie":0,"pids":[{"pid":27503,"comm":"uprobe"}]},{"id":6,"type":"perf_event","prog_id":31,"retprobe":false,"addr":18446744072250627680,"func":"kernel_clone","offset":0,"bpf_cookie":0,"pids":[{"pid":27777,"comm":"kprobe"}]},{"id":7,"type":"perf_event","prog_id":30,"retprobe":true,"addr":18446744072250627680,"func":"kernel_clone","offset":0,"bpf_cookie":0,"pids":[{"pid":27777,"comm":"kprobe"}]},{"id":8,"type":"perf_event","prog_id":37,"tracepoint":"sched_switch","bpf_cookie":0,"pids":[{"pid":28036,"comm":"tracepoint"}]},{"id":9,"type":"perf_event","prog_id":43,"event_type":"software","event_config":"cpu-clock","bpf_cookie":0,"pids":[{"pid":28261,"comm":"perf_event"}]},{"id":10,"type":"perf_event","prog_id":43,"event_type":"hw-cache","event_config":"LLC-load-misses","bpf_cookie":0,"pids":[{"pid":28261,"comm":"perf_event"}]},{"id":11,"type":"perf_event","prog_id":43,"event_type":"hardware","event_config":"cpu-cycles","bpf_cookie":0,"pids":[{"pid":28261,"comm":"perf_event"}]}] For generic perf events, the displayed information in bpftool is limited to the type and configuration, while other attributes such as sample_period, sample_freq, etc., are not included. The kernel function address won't be exposed if it is not permitted by kptr_restrict. The result as follows when kptr_restrict is 2. $ tools/bpf/bpftool/bpftool link show 4: perf_event prog 23 uprobe /home/dev/waken/bpf/uprobe/a.out+0x1338 5: perf_event prog 24 uretprobe /home/dev/waken/bpf/uprobe/a.out+0x1338 6: perf_event prog 31 kprobe kernel_clone 7: perf_event prog 30 kretprobe kernel_clone 8: perf_event prog 37 tracepoint sched_switch 9: perf_event prog 43 event software:cpu-clock 10: perf_event prog 43 event hw-cache:LLC-load-misses 11: perf_event prog 43 event hardware:cpu-cycles Signed-off-by: Yafang Shao <laoar.shao@gmail.com> --- tools/bpf/bpftool/link.c | 237 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 236 insertions(+), 1 deletion(-)