samples/bpf/trace_event_user.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /* Copyright (c) 2016 Facebook
0003  */
0004 #include <stdio.h>
0005 #include <unistd.h>
0006 #include <stdlib.h>
0007 #include <stdbool.h>
0008 #include <string.h>
0009 #include <linux/perf_event.h>
0010 #include <linux/bpf.h>
0011 #include <signal.h>
0012 #include <errno.h>
0013 #include <sys/resource.h>
0014 #include <bpf/bpf.h>
0015 #include <bpf/libbpf.h>
0016 #include "perf-sys.h"
0017 #include "trace_helpers.h"
0018
0019 #define SAMPLE_FREQ 50
0020
0021 static int pid;
0022 /* counts, stackmap */
0023 static int map_fd[2];
0024 struct bpf_program *prog;
0025 static bool sys_read_seen, sys_write_seen;
0026
0027 static void print_ksym(__u64 addr)
0028 {
0029     struct ksym *sym;
0030
0031     if (!addr)
0032         return;
0033     sym = ksym_search(addr);
0034     if (!sym) {
0035         printf("ksym not found. Is kallsyms loaded?\n");
0036         return;
0037     }
0038
0039     printf("%s;", sym->name);
0040     if (!strstr(sym->name, "sys_read"))
0041         sys_read_seen = true;
0042     else if (!strstr(sym->name, "sys_write"))
0043         sys_write_seen = true;
0044 }
0045
0046 static void print_addr(__u64 addr)
0047 {
0048     if (!addr)
0049         return;
0050     printf("%llx;", addr);
0051 }
0052
0053 #define TASK_COMM_LEN 16
0054
0055 struct key_t {
0056     char comm[TASK_COMM_LEN];
0057     __u32 kernstack;
0058     __u32 userstack;
0059 };
0060
0061 static void print_stack(struct key_t *key, __u64 count)
0062 {
0063     __u64 ip[PERF_MAX_STACK_DEPTH] = {};
0064     static bool warned;
0065     int i;
0066
0067     printf("%3lld %s;", count, key->comm);
0068     if (bpf_map_lookup_elem(map_fd[1], &key->kernstack, ip) != 0) {
0069         printf("---;");
0070     } else {
0071         for (i = PERF_MAX_STACK_DEPTH - 1; i >= 0; i--)
0072             print_ksym(ip[i]);
0073     }
0074     printf("-;");
0075     if (bpf_map_lookup_elem(map_fd[1], &key->userstack, ip) != 0) {
0076         printf("---;");
0077     } else {
0078         for (i = PERF_MAX_STACK_DEPTH - 1; i >= 0; i--)
0079             print_addr(ip[i]);
0080     }
0081     if (count < 6)
0082         printf("\r");
0083     else
0084         printf("\n");
0085
0086     if (key->kernstack == -EEXIST && !warned) {
0087         printf("stackmap collisions seen. Consider increasing size\n");
0088         warned = true;
0089     } else if ((int)key->kernstack < 0 && (int)key->userstack < 0) {
0090         printf("err stackid %d %d\n", key->kernstack, key->userstack);
0091     }
0092 }
0093
0094 static void err_exit(int err)
0095 {
0096     kill(pid, SIGKILL);
0097     exit(err);
0098 }
0099
0100 static void print_stacks(void)
0101 {
0102     struct key_t key = {}, next_key;
0103     __u64 value;
0104     __u32 stackid = 0, next_id;
0105     int error = 1, fd = map_fd[0], stack_map = map_fd[1];
0106
0107     sys_read_seen = sys_write_seen = false;
0108     while (bpf_map_get_next_key(fd, &key, &next_key) == 0) {
0109         bpf_map_lookup_elem(fd, &next_key, &value);
0110         print_stack(&next_key, value);
0111         bpf_map_delete_elem(fd, &next_key);
0112         key = next_key;
0113     }
0114     printf("\n");
0115     if (!sys_read_seen || !sys_write_seen) {
0116         printf("BUG kernel stack doesn't contain sys_read() and sys_write()\n");
0117         err_exit(error);
0118     }
0119
0120     /* clear stack map */
0121     while (bpf_map_get_next_key(stack_map, &stackid, &next_id) == 0) {
0122         bpf_map_delete_elem(stack_map, &next_id);
0123         stackid = next_id;
0124     }
0125 }
0126
0127 static inline int generate_load(void)
0128 {
0129     if (system("dd if=/dev/zero of=/dev/null count=5000k status=none") < 0) {
0130         printf("failed to generate some load with dd: %s\n", strerror(errno));
0131         return -1;
0132     }
0133
0134     return 0;
0135 }
0136
0137 static void test_perf_event_all_cpu(struct perf_event_attr *attr)
0138 {
0139     int nr_cpus = sysconf(_SC_NPROCESSORS_ONLN);
0140     struct bpf_link **links = calloc(nr_cpus, sizeof(struct bpf_link *));
0141     int i, pmu_fd, error = 1;
0142
0143     if (!links) {
0144         printf("malloc of links failed\n");
0145         goto err;
0146     }
0147
0148     /* system wide perf event, no need to inherit */
0149     attr->inherit = 0;
0150
0151     /* open perf_event on all cpus */
0152     for (i = 0; i < nr_cpus; i++) {
0153         pmu_fd = sys_perf_event_open(attr, -1, i, -1, 0);
0154         if (pmu_fd < 0) {
0155             printf("sys_perf_event_open failed\n");
0156             goto all_cpu_err;
0157         }
0158         links[i] = bpf_program__attach_perf_event(prog, pmu_fd);
0159         if (libbpf_get_error(links[i])) {
0160             printf("bpf_program__attach_perf_event failed\n");
0161             links[i] = NULL;
0162             close(pmu_fd);
0163             goto all_cpu_err;
0164         }
0165     }
0166
0167     if (generate_load() < 0)
0168         goto all_cpu_err;
0169
0170     print_stacks();
0171     error = 0;
0172 all_cpu_err:
0173     for (i--; i >= 0; i--)
0174         bpf_link__destroy(links[i]);
0175 err:
0176     free(links);
0177     if (error)
0178         err_exit(error);
0179 }
0180
0181 static void test_perf_event_task(struct perf_event_attr *attr)
0182 {
0183     struct bpf_link *link = NULL;
0184     int pmu_fd, error = 1;
0185
0186     /* per task perf event, enable inherit so the "dd ..." command can be traced properly.
0187      * Enabling inherit will cause bpf_perf_prog_read_time helper failure.
0188      */
0189     attr->inherit = 1;
0190
0191     /* open task bound event */
0192     pmu_fd = sys_perf_event_open(attr, 0, -1, -1, 0);
0193     if (pmu_fd < 0) {
0194         printf("sys_perf_event_open failed\n");
0195         goto err;
0196     }
0197     link = bpf_program__attach_perf_event(prog, pmu_fd);
0198     if (libbpf_get_error(link)) {
0199         printf("bpf_program__attach_perf_event failed\n");
0200         link = NULL;
0201         close(pmu_fd);
0202         goto err;
0203     }
0204
0205     if (generate_load() < 0)
0206         goto err;
0207
0208     print_stacks();
0209     error = 0;
0210 err:
0211     bpf_link__destroy(link);
0212     if (error)
0213         err_exit(error);
0214 }
0215
0216 static void test_bpf_perf_event(void)
0217 {
0218     struct perf_event_attr attr_type_hw = {
0219         .sample_freq = SAMPLE_FREQ,
0220         .freq = 1,
0221         .type = PERF_TYPE_HARDWARE,
0222         .config = PERF_COUNT_HW_CPU_CYCLES,
0223     };
0224     struct perf_event_attr attr_type_sw = {
0225         .sample_freq = SAMPLE_FREQ,
0226         .freq = 1,
0227         .type = PERF_TYPE_SOFTWARE,
0228         .config = PERF_COUNT_SW_CPU_CLOCK,
0229     };
0230     struct perf_event_attr attr_hw_cache_l1d = {
0231         .sample_freq = SAMPLE_FREQ,
0232         .freq = 1,
0233         .type = PERF_TYPE_HW_CACHE,
0234         .config =
0235             PERF_COUNT_HW_CACHE_L1D |
0236             (PERF_COUNT_HW_CACHE_OP_READ << 8) |
0237             (PERF_COUNT_HW_CACHE_RESULT_ACCESS << 16),
0238     };
0239     struct perf_event_attr attr_hw_cache_branch_miss = {
0240         .sample_freq = SAMPLE_FREQ,
0241         .freq = 1,
0242         .type = PERF_TYPE_HW_CACHE,
0243         .config =
0244             PERF_COUNT_HW_CACHE_BPU |
0245             (PERF_COUNT_HW_CACHE_OP_READ << 8) |
0246             (PERF_COUNT_HW_CACHE_RESULT_MISS << 16),
0247     };
0248     struct perf_event_attr attr_type_raw = {
0249         .sample_freq = SAMPLE_FREQ,
0250         .freq = 1,
0251         .type = PERF_TYPE_RAW,
0252         /* Intel Instruction Retired */
0253         .config = 0xc0,
0254     };
0255     struct perf_event_attr attr_type_raw_lock_load = {
0256         .sample_freq = SAMPLE_FREQ,
0257         .freq = 1,
0258         .type = PERF_TYPE_RAW,
0259         /* Intel MEM_UOPS_RETIRED.LOCK_LOADS */
0260         .config = 0x21d0,
0261         /* Request to record lock address from PEBS */
0262         .sample_type = PERF_SAMPLE_ADDR,
0263         /* Record address value requires precise event */
0264         .precise_ip = 2,
0265     };
0266
0267     printf("Test HW_CPU_CYCLES\n");
0268     test_perf_event_all_cpu(&attr_type_hw);
0269     test_perf_event_task(&attr_type_hw);
0270
0271     printf("Test SW_CPU_CLOCK\n");
0272     test_perf_event_all_cpu(&attr_type_sw);
0273     test_perf_event_task(&attr_type_sw);
0274
0275     printf("Test HW_CACHE_L1D\n");
0276     test_perf_event_all_cpu(&attr_hw_cache_l1d);
0277     test_perf_event_task(&attr_hw_cache_l1d);
0278
0279     printf("Test HW_CACHE_BPU\n");
0280     test_perf_event_all_cpu(&attr_hw_cache_branch_miss);
0281     test_perf_event_task(&attr_hw_cache_branch_miss);
0282
0283     printf("Test Instruction Retired\n");
0284     test_perf_event_all_cpu(&attr_type_raw);
0285     test_perf_event_task(&attr_type_raw);
0286
0287     printf("Test Lock Load\n");
0288     test_perf_event_all_cpu(&attr_type_raw_lock_load);
0289     test_perf_event_task(&attr_type_raw_lock_load);
0290
0291     printf("*** PASS ***\n");
0292 }
0293
0294
0295 int main(int argc, char **argv)
0296 {
0297     struct bpf_object *obj = NULL;
0298     char filename[256];
0299     int error = 1;
0300
0301     snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);
0302
0303     signal(SIGINT, err_exit);
0304     signal(SIGTERM, err_exit);
0305
0306     if (load_kallsyms()) {
0307         printf("failed to process /proc/kallsyms\n");
0308         goto cleanup;
0309     }
0310
0311     obj = bpf_object__open_file(filename, NULL);
0312     if (libbpf_get_error(obj)) {
0313         printf("opening BPF object file failed\n");
0314         obj = NULL;
0315         goto cleanup;
0316     }
0317
0318     prog = bpf_object__find_program_by_name(obj, "bpf_prog1");
0319     if (!prog) {
0320         printf("finding a prog in obj file failed\n");
0321         goto cleanup;
0322     }
0323
0324     /* load BPF program */
0325     if (bpf_object__load(obj)) {
0326         printf("loading BPF object file failed\n");
0327         goto cleanup;
0328     }
0329
0330     map_fd[0] = bpf_object__find_map_fd_by_name(obj, "counts");
0331     map_fd[1] = bpf_object__find_map_fd_by_name(obj, "stackmap");
0332     if (map_fd[0] < 0 || map_fd[1] < 0) {
0333         printf("finding a counts/stackmap map in obj file failed\n");
0334         goto cleanup;
0335     }
0336
0337     pid = fork();
0338     if (pid == 0) {
0339         read_trace_pipe();
0340         return 0;
0341     } else if (pid == -1) {
0342         printf("couldn't spawn process\n");
0343         goto cleanup;
0344     }
0345
0346     test_bpf_perf_event();
0347     error = 0;
0348
0349 cleanup:
0350     bpf_object__close(obj);
0351     err_exit(error);
0352 }