[PATCH bpf-next 0/7] bpf: implement BPF_PERF_EVENT_QUERY for perf event query

Yonghong Song
2018-05-15T23:45:33Z

Currently, suppose a userspace application has loaded a bpf program
and attached it to a tracepoint/kprobe/uprobe, and a bpf
introspection tool, e.g., bpftool, wants to show which bpf program
is attached to which tracepoint/kprobe/uprobe. Such attachment
information will be really useful to understand the overall bpf
deployment in the system.

There is a name field (16 bytes) for each program, which could
be used to encode the attachment point. There are some drawbacks
for this approaches. First, bpftool user (e.g., an admin) may not
really understand the association between the name and the
attachment point. Second, if one program is attached to multiple
places, encoding a proper name which can imply all these
attachments becomes difficult.

This patch introduces a new bpf subcommand BPF_PERF_EVENT_QUERY.
Given a pid and fd, if the <pid, fd> is associated with a
tracepoint/kprobe/uprobea perf event, BPF_PERF_EVENT_QUERY will return
. prog_id
. tracepoint name, or
. k[ret]probe funcname + offset or kernel addr, or
. u[ret]probe filename + offset
to the userspace.
The user can use "bpftool prog" to find more information about
bpf program itself with prog_id.

Patch #1 adds function perf_get_event() in kernel/events/core.c.
Patch #2 implements the bpf subcommand BPF_PERF_EVENT_QUERY.
Patch #3 syncs tools bpf.h header and also add bpf_trace_event_query()
in the libbpf library for samples/selftests/bpftool to use.
Patch #4 adds ksym_get_addr() utility function.
Patch #5 add a test in samples/bpf for querying k[ret]probes and
u[ret]probes.
Patch #6 add a test in tools/testing/selftests/bpf for querying
raw_tracepoint and tracepoint.
Patch #7 add a new subcommand "perf" to bpftool.

Yonghong Song (7):
perf/core: add perf_get_event() to return perf_event given a struct
file
bpf: introduce bpf subcommand BPF_PERF_EVENT_QUERY
tools/bpf: sync kernel header bpf.h and add bpf_trace_event_query in
libbpf
tools/bpf: add ksym_get_addr() in trace_helpers
samples/bpf: add a samples/bpf test for BPF_PERF_EVENT_QUERY
tools/bpf: add two BPF_PERF_EVENT_QUERY tests in test_progs
tools/bpftool: add perf subcommand

include/linux/perf_event.h | 5 +
include/linux/trace_events.h | 15 ++
include/uapi/linux/bpf.h | 25 ++
kernel/bpf/syscall.c | 113 +++++++++
kernel/events/core.c | 8 +
kernel/trace/bpf_trace.c | 53 ++++
kernel/trace/trace_kprobe.c | 29 +++
kernel/trace/trace_uprobe.c | 22 ++
samples/bpf/Makefile | 4 +
samples/bpf/perf_event_query_kern.c | 19 ++
samples/bpf/perf_event_query_user.c | 376 ++++++++++++++++++++++++++++
tools/bpf/bpftool/main.c | 3 +-
tools/bpf/bpftool/main.h | 1 +
tools/bpf/bpftool/perf.c | 188 ++++++++++++++
tools/include/uapi/linux/bpf.h | 25 ++
tools/lib/bpf/bpf.c | 23 ++
tools/lib/bpf/bpf.h | 3 +
tools/testing/selftests/bpf/test_progs.c | 133 ++++++++++
tools/testing/selftests/bpf/trace_helpers.c | 12 +
tools/testing/selftests/bpf/trace_helpers.h | 1 +
20 files changed, 1057 insertions(+), 1 deletion(-)
create mode 100644 samples/bpf/perf_event_query_kern.c
create mode 100644 samples/bpf/perf_event_query_user.c
create mode 100644 tools/bpf/bpftool/perf.c

--
2.9.5