Re: [PATCH bpf-next 2/2] perf: stop using deprecated bpf__object_next() API

[Jiri Olsa <jolsa@redhat.com>]

On Wed, Dec 29, 2021 at 11:01:35AM -0800, Christy Lee wrote:

SNIP

> > >
> > > I don't use it, I just know it's there.. that's why I asked ;-)
> > >
> > > it's possible to specify bpf program on the perf command line
> > > to be attached to event, like:
> > >
> > >       # cat tools/perf/examples/bpf/hello.c
> > >       #include <stdio.h>
> > >
> > >       int syscall_enter(openat)(void *args)
> > >       {
> > >               puts("Hello, world\n");
> > >               return 0;
> > >       }
> > >
> > >       license(GPL);
> > >       #
> > >       # perf trace -e openat,tools/perf/examples/bpf/hello.c cat /etc/passwd > /dev/null
> > >          0.016 (         ): __bpf_stdout__:Hello, world
> > >          0.018 ( 0.010 ms): cat/9079 openat(dfd: CWD, filename: /etc/ld.so.cache, flags: CLOEXEC) = 3
> > >          0.057 (         ): __bpf_stdout__:Hello, world
> > >          0.059 ( 0.011 ms): cat/9079 openat(dfd: CWD, filename: /lib64/libc.so.6, flags: CLOEXEC) = 3
> > >          0.417 (         ): __bpf_stdout__:Hello, world
> > >          0.419 ( 0.009 ms): cat/9079 openat(dfd: CWD, filename: /etc/passwd) = 3
> > >       #
> > >
> > > I took that example from commit message
> [...]
> 
> I found the original commit aa3abf30bb28addcf593578d37447d42e3f65fc3
> that included a test case, but I'm having trouble reproducing it due to syntax
> error. I am running this on bpf-next master without my patches.
> 
> I ran 'perf test -v LLVM' and used it's output to generate a script for
> compiling the perf test object:
> 
> --------------------------------------------------
> $ cat ~/bin/hello-ebpf
> INPUT_FILE=/tmp/test.c
> OUTPUT_FILE=/tmp/test.o
> 
> export KBUILD_DIR=/lib/modules/5.12.0-0_fbk2_3390_g7ecb4ac46d7f/build
> export NR_CPUS=56
> export LINUX_VERSION_CODE=0x50c00
> export CLANG_EXEC=/data/users/christylee/devtools/llvm/latest/bin/clang
> export CLANG_OPTIONS=-xc
> export KERNEL_INC_OPTIONS="-nostdinc -isystem
> /data/users/christylee/devtools/gcc/10.3.0/lib/gcc/x86_64-pc-linux-gnu/10.3.0/include
> -I./arch/\
> x86/include -I./arch/x86/include/generated  -I./include
> -I./arch/x86/include/uapi -I./arch/x86/include/generated/uapi
> -I./include/uapi -I./in\
> clude/generated/uapi -include ./include/linux/compiler-version.h
> -include ./include/linux/kconfig.h"
> export PERF_BPF_INC_OPTIONS=-I/home/christylee/lib/perf/include/bpf
> export WORKING_DIR=/lib/modules/5.12.0-0_fbk2_3390_g7ecb4ac46d7f/build
> export CLANG_SOURCE=-
> 
> rm -f $OUTPUT_FILE
> cat $INPUT_FILE |
> /data/users/christylee/devtools/llvm/latest/bin/clang -D__KERNEL__
> -D__NR_CPUS__=56 -DLINUX_VERSION_CODE=0x50c00 -xc  -I/ho\
> me/christylee/lib/perf/include/bpf  -nostdinc -isystem
> /data/users/christylee/devtools/gcc/10.3.0/lib/gcc/x86_64-pc-linux-gnu/10.3.0/include
> \
> -I./arch/x86/include -I./arch/x86/include/generated  -I./include
> -I./arch/x86/include/uapi -I./arch/x86/include/generated/uapi
> -I./include/ua\
> pi -I./include/generated/uapi -include
> ./include/linux/compiler-version.h -include ./include/linux/kconfig.h
> -Wno-unused-value -Wno-pointer-\
> sign -working-directory
> /lib/modules/5.12.0-0_fbk2_3390_g7ecb4ac46d7f/build -c - -target bpf
> -O2 -o $OUTPUT_FILE
> --------------------------------------------------
> 
> I then wrote and compiled a script that ask to get asks to put a probe
> at a function that
> does not exists in the kernel, it errors out as expected:
> 
> $ cat /tmp/test.c
> __attribute__((section("fork=does_not_exist"), used)) int fork(void *ctx) {
>     return 0;
> }
> 
> char _license[] __attribute__((section("license"), used)) = "GPL";
> int _version __attribute__((section("version"), used)) = 0x40100;
> $ cd ~/bin && ./hello-ebpf
> $ perf record --event /tmp/test.o sleep 1
> Using perf wrapper that supports hot-text. Try perf.real if you
> encounter any issues.
> Probe point 'does_not_exist' not found.
> event syntax error: '/tmp/test.o'
>                      \___ You need to check probing points in BPF file
> 
> (add -v to see detail)
> Run 'perf list' for a list of valid events
> 
>  Usage: perf record [<options>] [<command>]
>     or: perf record [<options>] -- <command> [<options>]
> 
>     -e, --event <event>   event selector. use 'perf list' to list
> available events
> 
> ---------------------------------------------------
> 
> Next I changed the attribute to something that exists in the kernel.
> As expected, it errors out
> with permission problem:
> $ cat /tmp/test.c
> __attribute__((section("fork=fork_init"), used)) int fork(void *ctx) {
>     return 0;
> }
> char _license[] __attribute__((section("license"), used)) = "GPL";
> int _version __attribute__((section("version"), used)) = 0x40100;
> $ grep fork_init /proc/kallsyms
> ffffffff8146e250 T xfs_ifork_init_cow
> ffffffff83980481 T fork_init
> $ cd ~/bin && ./hello-ebpf
> $ perf record --event /tmp/test.o sleep 1
> Using perf wrapper that supports hot-text. Try perf.real if you
> encounter any issues.
> Failed to open kprobe_events: Permission denied
> event syntax error: '/tmp/test.o'
>                      \___ You need to be root
> 
> (add -v to see detail)
> Run 'perf list' for a list of valid events
> 
>  Usage: perf record [<options>] [<command>]
>     or: perf record [<options>] -- <command> [<options>]
> 
>     -e, --event <event>   event selector. use 'perf list' to list
> available events
> 
> ---------------------------------------------------
> 
> So I reran as root, but this time I get an invalid syntax error:
> 
> # perf record --event /tmp/test.o -v sleep 1
> Using perf wrapper that supports hot-text. Try perf.real if you
> encounter any issues.
> Failed to write event: Invalid argument
> event syntax error: '/tmp/test.o'
>                      \___ Invalid argument
> 
> (add -v to see detail)
> Run 'perf list' for a list of valid events
> 
>  Usage: perf record [<options>] [<command>]
>     or: perf record [<options>] -- <command> [<options>]
> 
>     -e, --event <event>   event selector. use 'perf list' to list
> available events
> ---------------------------------------------------
> 
> Is there a different way to attach a custom event probe point?
> 

nice, good question ;-)

looks like there are no volunteers from original authors,
I'll check on that

thanks,
jirka