Re: [PATCH v4 09/16] perf tools: Enable indices setting syntax for BPF maps

[Arnaldo Carvalho de Melo <acme@kernel.org>]

Em Fri, Dec 11, 2015 at 08:39:35PM +0800, pi3orama escreveu:
> 
> 
> 发自我的 iPhone
> 
> > 在 2015年12月11日，下午8:15，Arnaldo Carvalho de Melo <acme@kernel.org> 写道：
> > 
> > Em Fri, Dec 11, 2015 at 09:11:45AM -0300, Arnaldo Carvalho de Melo escreveu:
> >> Em Tue, Dec 08, 2015 at 02:25:37AM +0000, Wang Nan escreveu:
> >>> This patch introduce a new syntax to perf event parser:
> >>> 
> >>> # perf record -e bpf_file.c/maps.mymap.value[0,3...5,7]=1234/ ...
> >> 
> >> Is the above example valid? Wouldn't this be "maps:mymap.value" ?
> >> 
> >>> 
> >>> By utilizing the basic facilities in bpf-loader.c which allow setting
> >>> different slots in a BPF map separately, the newly introduced syntax
> >>> allows perf to control specific elements in a BPF map.
> >>> 
> >>> Test result:
> >>> 
> >>> # cat ./test_bpf_map_3.c
> >>> /************************ BEGIN **************************/
> >>> #define SEC(NAME) __attribute__((section(NAME), used))
> >>> enum bpf_map_type {
> >>>     BPF_MAP_TYPE_ARRAY = 2,
> >>> };
> >>> struct bpf_map_def {
> >>>     unsigned int type;
> >>>     unsigned int key_size;
> >>>     unsigned int value_size;
> >>>     unsigned int max_entries;
> >>> };
> >>> static void *(*map_lookup_elem)(struct bpf_map_def *, void *) =
> >>>     (void *)1;
> >>> static int (*bpf_trace_printk)(const char *fmt, int fmt_size, ...) =
> >>>     (void *)6;
> >> 
> >> Can you explain the above a bit more? What are the magic 1 and 6 values?
> > 
> > So, from another patch:
> > 
> > static u64 (*bpf_ktime_get_ns)(void) =
> >     (void *)5;
> > static int (*bpf_trace_printk)(const char *fmt, int fmt_size, ...) =
> >     (void *)6;
> > static int (*bpf_get_smp_processor_id)(void) =
> >     (void *)8;
> > static int (*bpf_perf_event_output)(void *, struct bpf_map_def *, int,
> > void *, unsigned long) =
> >     (void *)23;
> > 
> > Where can I get this magical mistery table? Could this be hidden away in
> > some .h file automagically included in bpf scriptlets so that n00bies
> > like me don't have to be wtf'ing?
> > 
> 
> They are function numbers defined in bpf.h and bpf-common.h, but they are Linux
> headers. Directly include them causes many error for llvm. Also, the function
> prototypes are BPF specific and can't included in Linux source. We should have
> a place holds those indices and prototypes together.

Sure, just please don't assume whoever is reading your patches has this
background, provide comments above such places, so that reviewing gets
facilitated.

I eventually figured this is some sort of trampoline to access kernel
functions:

/* integer value in 'imm' field of BPF_CALL instruction selects which
 * helper function eBPF program intends to call
 */
enum bpf_func_id {
        BPF_FUNC_unspec,
        BPF_FUNC_map_lookup_elem, /* void *map_lookup_elem(&map, &key) */
        BPF_FUNC_map_update_elem, /* int map_update_elem(&map, &key, &value, flags) */
        BPF_FUNC_map_delete_elem, /* int map_delete_elem(&map, &key) */
        BPF_FUNC_probe_read,      /* int bpf_probe_read(void *dst, int size, void *src) */


But if you had just:

/*
 * See enum_bpf_func_id in ./include/uapi/linux/bpf.h
 */

That would've helped.

- Arnaldo