[RFC bpf-next 0/2] libbpf Userspace Runtime-Defined Tracing (URDT)

[Alan Maguire <alan.maguire@oracle.com>]

Adding userspace tracepoints in other languages like python and
go is a very useful for observability.  libstapsdt [1]
and language bindings like python-stapsdt [2] that rely on it
use a clever scheme of emulating static (USDT) userspace tracepoints
at runtime.  This involves (as I understand it):

- fabricating a shared library
- annotating it with ELF notes that describe its tracepoints
- dlopen()ing it and calling the appropriate probe fire function
  to trigger probe firing.

bcc already supports this mechanism (the examples in [2] use
bcc to list/trigger the tracepoints), so it seems like it
would be a good candidate for adding support to libbpf.

However, before doing that, it's worth considering if there
are simpler ways to support runtime probe firing.  This
small series demonstrates a simple method based on USDT
probes added to libbpf itself.

The suggested solution comprises 3 parts

1. functions to fire dynamic probes are added to libbpf itself
   bpf_urdt__probeN(), where N is the number of probe arguemnts.
   A sample usage would be
	bpf_urdt__probe3("myprovider", "myprobe", 1, 2, 3);

   Under the hood these correspond to USDT probes with an
   additional argument for uniquely identifying the probe
   (a hash of provider/probe name).

2. we attach to the appropriate USDT probe for the specified
   number of arguments urdt/probe0 for none, urdt/probe1 for
   1, etc.  We utilize the high-order 32 bits of the attach
   cookie to store the hash of the provider/probe name.

3. when urdt/probeN fires, the BPF_URDT() macro (which
   is similar to BPF_USDT()) checks if the hash passed
   in (identifying provider/probe) matches the attach
   cookie high-order 32 bits; if not it must be a firing
   for a different dynamic probe and we exit early.

Auto-attach support is also added, for example the following
would add a dynamic probe for provider:myprobe:

SEC("udrt/libbpf.so:2:myprovider:myprobe")
int BPF_URDT(myprobe, int arg1, char *arg2)
{
 ...
}

(Note the "2" above specifies the number of arguments to
the probe, otherwise it is identical to USDT).

The above program can then be triggered by a call to

 BPF_URDT_PROBE2("myprovider", "myprobe", 1, "hi");

The useful thing about this is that by attaching to
libbpf.so (and firing probes using that library) we
can get system-wide dynamic probe firing.  It is also
easy to fire a dynamic probe - no setup is required.

More examples of auto and manual attach can be found in
the selftests (patch 2).

If this approach appears to be worth pursing, we could
also look at adding support to libstapsdt for it.

Alan Maguire (2):
  libbpf: add support for Userspace Runtime Dynamic Tracing (URDT)
  selftests/bpf: add tests for Userspace Runtime Defined Tracepoints
    (URDT)

 tools/lib/bpf/Build                           |   2 +-
 tools/lib/bpf/Makefile                        |   2 +-
 tools/lib/bpf/libbpf.c                        |  94 ++++++++++
 tools/lib/bpf/libbpf.h                        |  94 ++++++++++
 tools/lib/bpf/libbpf.map                      |  13 ++
 tools/lib/bpf/libbpf_internal.h               |   2 +
 tools/lib/bpf/urdt.bpf.h                      | 103 +++++++++++
 tools/lib/bpf/urdt.c                          | 145 +++++++++++++++
 tools/testing/selftests/bpf/Makefile          |   2 +-
 tools/testing/selftests/bpf/prog_tests/urdt.c | 173 ++++++++++++++++++
 tools/testing/selftests/bpf/progs/test_urdt.c | 100 ++++++++++
 .../selftests/bpf/progs/test_urdt_shared.c    |  59 ++++++
 12 files changed, 786 insertions(+), 3 deletions(-)
 create mode 100644 tools/lib/bpf/urdt.bpf.h
 create mode 100644 tools/lib/bpf/urdt.c
 create mode 100644 tools/testing/selftests/bpf/prog_tests/urdt.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_urdt.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_urdt_shared.c

-- 
2.39.3