samples/bpf/trace_event_user.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /* Copyright (c) 2016 Facebook
   3  */
   4 #include <stdio.h>
   5 #include <unistd.h>
   6 #include <stdlib.h>
   7 #include <stdbool.h>
   8 #include <string.h>
   9 #include <linux/perf_event.h>
  10 #include <linux/bpf.h>
  11 #include <signal.h>
  12 #include <errno.h>
  13 #include <sys/resource.h>
  14 #include <bpf/bpf.h>
  15 #include <bpf/libbpf.h>
  16 #include "perf-sys.h"
  17 #include "trace_helpers.h"
  18
  19 #define __must_check
  20 #include <linux/err.h>
  21
  22 #define SAMPLE_FREQ 50
  23
  24 static int pid;
  25 /* counts, stackmap */
  26 static int map_fd[2];
  27 struct bpf_program *prog;
  28 static bool sys_read_seen, sys_write_seen;
  29
  30 static void print_ksym(__u64 addr)
  31 {
  32         struct ksym *sym;
  33
  34         if (!addr)
  35                 return;
  36         sym = ksym_search(addr);
  37         if (!sym) {
  38                 printf("ksym not found. Is kallsyms loaded?\n");
  39                 return;
  40         }
  41
  42         printf("%s;", sym->name);
  43         if (!strstr(sym->name, "sys_read"))
  44                 sys_read_seen = true;
  45         else if (!strstr(sym->name, "sys_write"))
  46                 sys_write_seen = true;
  47 }
  48
  49 static void print_addr(__u64 addr)
  50 {
  51         if (!addr)
  52                 return;
  53         printf("%llx;", addr);
  54 }
  55
  56 #define TASK_COMM_LEN 16
  57
  58 struct key_t {
  59         char comm[TASK_COMM_LEN];
  60         __u32 kernstack;
  61         __u32 userstack;
  62 };
  63
  64 static void print_stack(struct key_t *key, __u64 count)
  65 {
  66         __u64 ip[PERF_MAX_STACK_DEPTH] = {};
  67         static bool warned;
  68         int i;
  69
  70         printf("%3lld %s;", count, key->comm);
  71         if (bpf_map_lookup_elem(map_fd[1], &key->kernstack, ip) != 0) {
  72                 printf("---;");
  73         } else {
  74                 for (i = PERF_MAX_STACK_DEPTH - 1; i >= 0; i--)
  75                         print_ksym(ip[i]);
  76         }
  77         printf("-;");
  78         if (bpf_map_lookup_elem(map_fd[1], &key->userstack, ip) != 0) {
  79                 printf("---;");
  80         } else {
  81                 for (i = PERF_MAX_STACK_DEPTH - 1; i >= 0; i--)
  82                         print_addr(ip[i]);
  83         }
  84         if (count < 6)
  85                 printf("\r");
  86         else
  87                 printf("\n");
  88
  89         if (key->kernstack == -EEXIST && !warned) {
  90                 printf("stackmap collisions seen. Consider increasing size\n");
  91                 warned = true;
  92         } else if ((int)key->kernstack < 0 && (int)key->userstack < 0) {
  93                 printf("err stackid %d %d\n", key->kernstack, key->userstack);
  94         }
  95 }
  96
  97 static void err_exit(int err)
  98 {
  99         kill(pid, SIGKILL);
 100         exit(err);
 101 }
 102
 103 static void print_stacks(void)
 104 {
 105         struct key_t key = {}, next_key;
 106         __u64 value;
 107         __u32 stackid = 0, next_id;
 108         int error = 1, fd = map_fd[0], stack_map = map_fd[1];
 109
 110         sys_read_seen = sys_write_seen = false;
 111         while (bpf_map_get_next_key(fd, &key, &next_key) == 0) {
 112                 bpf_map_lookup_elem(fd, &next_key, &value);
 113                 print_stack(&next_key, value);
 114                 bpf_map_delete_elem(fd, &next_key);
 115                 key = next_key;
 116         }
 117         printf("\n");
 118         if (!sys_read_seen || !sys_write_seen) {
 119                 printf("BUG kernel stack doesn't contain sys_read() and sys_write()\n");
 120                 err_exit(error);
 121         }
 122
 123         /* clear stack map */
 124         while (bpf_map_get_next_key(stack_map, &stackid, &next_id) == 0) {
 125                 bpf_map_delete_elem(stack_map, &next_id);
 126                 stackid = next_id;
 127         }
 128 }
 129
 130 static inline int generate_load(void)
 131 {
 132         if (system("dd if=/dev/zero of=/dev/null count=5000k status=none") < 0) {
 133                 printf("failed to generate some load with dd: %s\n", strerror(errno));
 134                 return -1;
 135         }
 136
 137         return 0;
 138 }
 139
 140 static void test_perf_event_all_cpu(struct perf_event_attr *attr)
 141 {
 142         int nr_cpus = sysconf(_SC_NPROCESSORS_ONLN);
 143         struct bpf_link **links = calloc(nr_cpus, sizeof(struct bpf_link *));
 144         int i, pmu_fd, error = 1;
 145
 146         if (!links) {
 147                 printf("malloc of links failed\n");
 148                 goto err;
 149         }
 150
 151         /* system wide perf event, no need to inherit */
 152         attr->inherit = 0;
 153
 154         /* open perf_event on all cpus */
 155         for (i = 0; i < nr_cpus; i++) {
 156                 pmu_fd = sys_perf_event_open(attr, -1, i, -1, 0);
 157                 if (pmu_fd < 0) {
 158                         printf("sys_perf_event_open failed\n");
 159                         goto all_cpu_err;
 160                 }
 161                 links[i] = bpf_program__attach_perf_event(prog, pmu_fd);
 162                 if (IS_ERR(links[i])) {
 163                         printf("bpf_program__attach_perf_event failed\n");
 164                         links[i] = NULL;
 165                         close(pmu_fd);
 166                         goto all_cpu_err;
 167                 }
 168         }
 169
 170         if (generate_load() < 0)
 171                 goto all_cpu_err;
 172
 173         print_stacks();
 174         error = 0;
 175 all_cpu_err:
 176         for (i--; i >= 0; i--)
 177                 bpf_link__destroy(links[i]);
 178 err:
 179         free(links);
 180         if (error)
 181                 err_exit(error);
 182 }
 183
 184 static void test_perf_event_task(struct perf_event_attr *attr)
 185 {
 186         struct bpf_link *link = NULL;
 187         int pmu_fd, error = 1;
 188
 189         /* per task perf event, enable inherit so the "dd ..." command can be traced properly.
 190          * Enabling inherit will cause bpf_perf_prog_read_time helper failure.
 191          */
 192         attr->inherit = 1;
 193
 194         /* open task bound event */
 195         pmu_fd = sys_perf_event_open(attr, 0, -1, -1, 0);
 196         if (pmu_fd < 0) {
 197                 printf("sys_perf_event_open failed\n");
 198                 goto err;
 199         }
 200         link = bpf_program__attach_perf_event(prog, pmu_fd);
 201         if (IS_ERR(link)) {
 202                 printf("bpf_program__attach_perf_event failed\n");
 203                 link = NULL;
 204                 close(pmu_fd);
 205                 goto err;
 206         }
 207
 208         if (generate_load() < 0)
 209                 goto err;
 210
 211         print_stacks();
 212         error = 0;
 213 err:
 214         bpf_link__destroy(link);
 215         if (error)
 216                 err_exit(error);
 217 }
 218
 219 static void test_bpf_perf_event(void)
 220 {
 221         struct perf_event_attr attr_type_hw = {
 222                 .sample_freq = SAMPLE_FREQ,
 223                 .freq = 1,
 224                 .type = PERF_TYPE_HARDWARE,
 225                 .config = PERF_COUNT_HW_CPU_CYCLES,
 226         };
 227         struct perf_event_attr attr_type_sw = {
 228                 .sample_freq = SAMPLE_FREQ,
 229                 .freq = 1,
 230                 .type = PERF_TYPE_SOFTWARE,
 231                 .config = PERF_COUNT_SW_CPU_CLOCK,
 232         };
 233         struct perf_event_attr attr_hw_cache_l1d = {
 234                 .sample_freq = SAMPLE_FREQ,
 235                 .freq = 1,
 236                 .type = PERF_TYPE_HW_CACHE,
 237                 .config =
 238                         PERF_COUNT_HW_CACHE_L1D |
 239                         (PERF_COUNT_HW_CACHE_OP_READ << 8) |
 240                         (PERF_COUNT_HW_CACHE_RESULT_ACCESS << 16),
 241         };
 242         struct perf_event_attr attr_hw_cache_branch_miss = {
 243                 .sample_freq = SAMPLE_FREQ,
 244                 .freq = 1,
 245                 .type = PERF_TYPE_HW_CACHE,
 246                 .config =
 247                         PERF_COUNT_HW_CACHE_BPU |
 248                         (PERF_COUNT_HW_CACHE_OP_READ << 8) |
 249                         (PERF_COUNT_HW_CACHE_RESULT_MISS << 16),
 250         };
 251         struct perf_event_attr attr_type_raw = {
 252                 .sample_freq = SAMPLE_FREQ,
 253                 .freq = 1,
 254                 .type = PERF_TYPE_RAW,
 255                 /* Intel Instruction Retired */
 256                 .config = 0xc0,
 257         };
 258         struct perf_event_attr attr_type_raw_lock_load = {
 259                 .sample_freq = SAMPLE_FREQ,
 260                 .freq = 1,
 261                 .type = PERF_TYPE_RAW,
 262                 /* Intel MEM_UOPS_RETIRED.LOCK_LOADS */
 263                 .config = 0x21d0,
 264                 /* Request to record lock address from PEBS */
 265                 .sample_type = PERF_SAMPLE_ADDR,
 266                 /* Record address value requires precise event */
 267                 .precise_ip = 2,
 268         };
 269
 270         printf("Test HW_CPU_CYCLES\n");
 271         test_perf_event_all_cpu(&attr_type_hw);
 272         test_perf_event_task(&attr_type_hw);
 273
 274         printf("Test SW_CPU_CLOCK\n");
 275         test_perf_event_all_cpu(&attr_type_sw);
 276         test_perf_event_task(&attr_type_sw);
 277
 278         printf("Test HW_CACHE_L1D\n");
 279         test_perf_event_all_cpu(&attr_hw_cache_l1d);
 280         test_perf_event_task(&attr_hw_cache_l1d);
 281
 282         printf("Test HW_CACHE_BPU\n");
 283         test_perf_event_all_cpu(&attr_hw_cache_branch_miss);
 284         test_perf_event_task(&attr_hw_cache_branch_miss);
 285
 286         printf("Test Instruction Retired\n");
 287         test_perf_event_all_cpu(&attr_type_raw);
 288         test_perf_event_task(&attr_type_raw);
 289
 290         printf("Test Lock Load\n");
 291         test_perf_event_all_cpu(&attr_type_raw_lock_load);
 292         test_perf_event_task(&attr_type_raw_lock_load);
 293
 294         printf("*** PASS ***\n");
 295 }
 296
 297
 298 int main(int argc, char **argv)
 299 {
 300         struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY};
 301         struct bpf_object *obj = NULL;
 302         char filename[256];
 303         int error = 1;
 304
 305         snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);
 306         setrlimit(RLIMIT_MEMLOCK, &r);
 307
 308         signal(SIGINT, err_exit);
 309         signal(SIGTERM, err_exit);
 310
 311         if (load_kallsyms()) {
 312                 printf("failed to process /proc/kallsyms\n");
 313                 goto cleanup;
 314         }
 315
 316         obj = bpf_object__open_file(filename, NULL);
 317         if (IS_ERR(obj)) {
 318                 printf("opening BPF object file failed\n");
 319                 obj = NULL;
 320                 goto cleanup;
 321         }
 322
 323         prog = bpf_object__find_program_by_name(obj, "bpf_prog1");
 324         if (!prog) {
 325                 printf("finding a prog in obj file failed\n");
 326                 goto cleanup;
 327         }
 328
 329         /* load BPF program */
 330         if (bpf_object__load(obj)) {
 331                 printf("loading BPF object file failed\n");
 332                 goto cleanup;
 333         }
 334
 335         map_fd[0] = bpf_object__find_map_fd_by_name(obj, "counts");
 336         map_fd[1] = bpf_object__find_map_fd_by_name(obj, "stackmap");
 337         if (map_fd[0] < 0 || map_fd[1] < 0) {
 338                 printf("finding a counts/stackmap map in obj file failed\n");
 339                 goto cleanup;
 340         }
 341
 342         pid = fork();
 343         if (pid == 0) {
 344                 read_trace_pipe();
 345                 return 0;
 346         } else if (pid == -1) {
 347                 printf("couldn't spawn process\n");
 348                 goto cleanup;
 349         }
 350
 351         test_bpf_perf_event();
 352         error = 0;
 353
 354 cleanup:
 355         bpf_object__close(obj);
 356         err_exit(error);
 357 }