Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1251975 > unrolled thread

Re: [PATCH 04/31] perf record, bpf: Create probe points for BPF programs

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [PATCH 04/31] perf record, bpf: Create probe points for BPF  programs Arnaldo Carvalho de Melo <acme@kernel.org> - 2015-10-20 21:20 +0200
    Re: [PATCH 04/31] perf record, bpf: Create probe points for BPF  programs David Ahern <dsahern@gmail.com> - 2015-10-20 21:20 +0200
      Re: [PATCH 04/31] perf record, bpf: Create probe points for BPF  programs Arnaldo Carvalho de Melo <arnaldo.melo@gmail.com> - 2015-10-20 21:30 +0200
    Re: [PATCH 04/31] perf record, bpf: Create probe points for BPF  programs Arnaldo Carvalho de Melo <acme@kernel.org> - 2015-10-20 22:40 +0200
    Re: [PATCH 04/31] perf record, bpf: Create probe points for BPF programs "Wangnan (F)" <wangnan0@huawei.com> - 2015-10-21 04:30 +0200
    Re: [PATCH 04/31] perf record, bpf: Create probe points for BPF programs "Wangnan (F)" <wangnan0@huawei.com> - 2015-10-21 05:40 +0200
      Re: [PATCH 04/31] perf record, bpf: Create probe points for BPF  programs Arnaldo Carvalho de Melo <acme@kernel.org> - 2015-10-21 15:30 +0200
        Re: [PATCH 04/31] perf record, bpf: Create probe points for BPF  programs Arnaldo Carvalho de Melo <acme@kernel.org> - 2015-10-22 18:20 +0200

#1251975 — Re: [PATCH 04/31] perf record, bpf: Create probe points for BPF programs

Em Wed, Oct 14, 2015 at 12:41:15PM +0000, Wang Nan escreveu:
> This patch introduces bpf__{un,}probe() functions to enable callers to
> create kprobe points based on section names a BPF program. It parses
> the section names in the program and creates corresponding 'struct
> perf_probe_event' structures. The parse_perf_probe_command() function is
> used to do the main parsing work. The resuling 'struct perf_probe_event'
> is stored into program private data for further using.
> 
> By utilizing the new probing API, this patch creates probe points during
> event parsing.
> 
> To ensure probe points be removed correctly, register an atexit hook
> so even perf quit through exit() bpf__clear() is still called, so probing
> points are cleared. Note that bpf_clear() should be registered before
> bpf__probe() is called, so failure of bpf__probe() can still trigger
> bpf__clear() to remove probe points which are already probed.
> 
> strerror style error reporting scaffold is created by this patch.
> bpf__strerror_probe() is the first error reporting function in bpf-loader.c.

So, this one, for a non-root user gives me:

[acme@felicio linux]$ perf record --event /tmp/foo.o sleep 1
event syntax error: '/tmp/foo.o'
                     \___ Invalid argument

(add -v to see detail)
Run 'perf list' for a list of valid events

 Usage: perf record [<options>] [<command>]
    or: perf record [<options>] -- <command> [<options>]

    -e, --event <event>   event selector. use 'perf list' to list available events
[acme@felicio linux]$

--------------------

I.e. no libbpf error (good!) but then, just an -EINVAL as the "event syntax
error", which clearly isn't a syntax error, we need to tell the user that he or she
needs special perfmissions for using sys_bpf() :-)

As root:

[root@felicio ~]# perf record --event /tmp/foo.o sleep
event syntax error: '/tmp/foo.o'
                     \___ Invalid argument

(add -v to see detail)
Run 'perf list' for a list of valid events

 Usage: perf record [<options>] [<command>]
    or: perf record [<options>] -- <command> [<options>]

    -e, --event <event>   event selector. use 'perf list' to list available events
[root@felicio ~]# ls -la /tmp/foo.o
-rw-rw-r--. 1 acme acme 824 Oct 20 12:35 /tmp/foo.o
[root@felicio ~]# file /tmp/foo.o
/tmp/foo.o: ELF 64-bit LSB relocatable, no machine, version 1 (SYSV), not stripped


Humm, its something else, this is an ancient kernel, 4.2.0, probably without
eBPF support? Nope, its there:

[root@felicio ~]# grep -i sys_bpf /proc/kallsyms
ffffffff811829d0 T SyS_bpf
ffffffff811829d0 T sys_bpf
[root@felicio ~]#

Its something else, we need to improve this error reporting:

[root@felicio ~]# perf record -v --event /tmp/foo.o sleep 1
libbpf: loading /tmp/foo.o
libbpf: section .strtab, size 60, link 0, flags 0, type=3
libbpf: section .text, size 0, link 0, flags 6, type=1
libbpf: section .data, size 0, link 0, flags 3, type=1
libbpf: section .bss, size 0, link 0, flags 3, type=8
libbpf: section do_fork, size 16, link 0, flags 6, type=1
libbpf: found program do_fork
libbpf: section license, size 4, link 0, flags 3, type=1
libbpf: license of /tmp/foo.o is GPL
libbpf: section version, size 4, link 0, flags 3, type=1
libbpf: kernel version of /tmp/foo.o is 40100
libbpf: section .symtab, size 96, link 1, flags 0, type=2
bpf: config program 'do_fork'
symbol:do_fork file:(null) line:0 offset:0 return:0 lazy:(null)
bpf: 'do_fork': event name is missing
event syntax error: '/tmp/foo.o'
                     \___ Invalid argument

(add -v to see detail)
Run 'perf list' for a list of valid events

 Usage: perf record [<options>] [<command>]
    or: perf record [<options>] -- <command> [<options>]

    -e, --event <event>   event selector. use 'perf list' to list available events
[root@felicio ~]#

[root@felicio ~]# grep do_fork /proc/kallsyms 
ffffffff81099ab0 T _do_fork
ffffffff81ccc800 d do_fork_test
[root@felicio ~]#

$ echo '__attribute__((section("_do_fork"), used)) int fork(void *ctx) {return 0;} char _license[] __attribute__((section("license"), used)) = "GPL";int _version __attribute__((section("version"), used)) = 0x40100;' | clang -D__KERNEL__ $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c - -target bpf -O2 -o /tmp/foo.o

[root@felicio ~]# perf record  -v --event /tmp/foo.o sleep 1
libbpf: loading /tmp/foo.o
libbpf: section .strtab, size 61, link 0, flags 0, type=3
libbpf: section .text, size 0, link 0, flags 6, type=1
libbpf: section .data, size 0, link 0, flags 3, type=1
libbpf: section .bss, size 0, link 0, flags 3, type=8
libbpf: section _do_fork, size 16, link 0, flags 6, type=1
libbpf: found program _do_fork
libbpf: section license, size 4, link 0, flags 3, type=1
libbpf: license of /tmp/foo.o is GPL
libbpf: section version, size 4, link 0, flags 3, type=1
libbpf: kernel version of /tmp/foo.o is 40100
libbpf: section .symtab, size 96, link 1, flags 0, type=2
bpf: config program '_do_fork'
symbol:_do_fork file:(null) line:0 offset:0 return:0 lazy:(null)
bpf: '_do_fork': event name is missing
event syntax error: '/tmp/foo.o'
                     \___ Invalid argument

(add -v to see detail)
Run 'perf list' for a list of valid events

 Usage: perf record [<options>] [<command>]
    or: perf record [<options>] -- <command> [<options>]

    -e, --event <event>   event selector. use 'perf list' to list available events
[root@felicio ~]#

So it still doesn't work, doesn't look like it is trying to find a vmlinux,
will look at another patch IIRC is in this patchkit allowing us to tell
'perf record' where to find it... But it can as well use kallsyms...

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1251977

On 10/20/15 1:12 PM, Arnaldo Carvalho de Melo wrote:
> I.e. no libbpf error (good!) but then, just an -EINVAL as the "event syntax
> error", which clearly isn't a syntax error, we need to tell the user that he or she
> needs special perfmissions for using sys_bpf():-)

perfmissions? Are you coining new words -- permissions for perf? ;-)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1251982

Em Tue, Oct 20, 2015 at 01:16:04PM -0600, David Ahern escreveu:
> On 10/20/15 1:12 PM, Arnaldo Carvalho de Melo wrote:
> >I.e. no libbpf error (good!) but then, just an -EINVAL as the "event syntax
> >error", which clearly isn't a syntax error, we need to tell the user that he or she
> >needs special perfmissions for using sys_bpf():-)
> 
> perfmissions? Are you coining new words -- permissions for perf? ;-)

LOL, totally unintended 8-)

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1252014

Em Tue, Oct 20, 2015 at 04:12:14PM -0300, Arnaldo Carvalho de Melo escreveu:
> Em Wed, Oct 14, 2015 at 12:41:15PM +0000, Wang Nan escreveu:
> > This patch introduces bpf__{un,}probe() functions to enable callers to
> > create kprobe points based on section names a BPF program. It parses
> > the section names in the program and creates corresponding 'struct
> > perf_probe_event' structures. The parse_perf_probe_command() function is
> > used to do the main parsing work. The resuling 'struct perf_probe_event'
> > is stored into program private data for further using.
> > 
> > By utilizing the new probing API, this patch creates probe points during
> > event parsing.
> > 
> > To ensure probe points be removed correctly, register an atexit hook
> > so even perf quit through exit() bpf__clear() is still called, so probing
> > points are cleared. Note that bpf_clear() should be registered before
> > bpf__probe() is called, so failure of bpf__probe() can still trigger
> > bpf__clear() to remove probe points which are already probed.
> > 
> > strerror style error reporting scaffold is created by this patch.
> > bpf__strerror_probe() is the first error reporting function in bpf-loader.c.
> 
> So, this one, for a non-root user gives me:
> 
> [acme@felicio linux]$ perf record --event /tmp/foo.o sleep 1
> event syntax error: '/tmp/foo.o'
>                      \___ Invalid argument
> 
> (add -v to see detail)
> Run 'perf list' for a list of valid events
> 
>  Usage: perf record [<options>] [<command>]
>     or: perf record [<options>] -- <command> [<options>]
> 
>     -e, --event <event>   event selector. use 'perf list' to list available events
> [acme@felicio linux]$
> 
> --------------------
> 
> I.e. no libbpf error (good!) but then, just an -EINVAL as the "event syntax
> error", which clearly isn't a syntax error, we need to tell the user that he or she
> needs special perfmissions for using sys_bpf() :-)
> 
> As root:
> 
> [root@felicio ~]# perf record --event /tmp/foo.o sleep
> event syntax error: '/tmp/foo.o'
>                      \___ Invalid argument
> 
> (add -v to see detail)
> Run 'perf list' for a list of valid events
> 
>  Usage: perf record [<options>] [<command>]
>     or: perf record [<options>] -- <command> [<options>]
> 
>     -e, --event <event>   event selector. use 'perf list' to list available events
> [root@felicio ~]# ls -la /tmp/foo.o
> -rw-rw-r--. 1 acme acme 824 Oct 20 12:35 /tmp/foo.o
> [root@felicio ~]# file /tmp/foo.o
> /tmp/foo.o: ELF 64-bit LSB relocatable, no machine, version 1 (SYSV), not stripped
> 
> 
> Humm, its something else, this is an ancient kernel, 4.2.0, probably without
> eBPF support? Nope, its there:
> 
> [root@felicio ~]# grep -i sys_bpf /proc/kallsyms
> ffffffff811829d0 T SyS_bpf
> ffffffff811829d0 T sys_bpf
> [root@felicio ~]#
> 
> Its something else, we need to improve this error reporting:
> 
> [root@felicio ~]# perf record -v --event /tmp/foo.o sleep 1
> libbpf: loading /tmp/foo.o
> libbpf: section .strtab, size 60, link 0, flags 0, type=3
> libbpf: section .text, size 0, link 0, flags 6, type=1
> libbpf: section .data, size 0, link 0, flags 3, type=1
> libbpf: section .bss, size 0, link 0, flags 3, type=8
> libbpf: section do_fork, size 16, link 0, flags 6, type=1
> libbpf: found program do_fork
> libbpf: section license, size 4, link 0, flags 3, type=1
> libbpf: license of /tmp/foo.o is GPL
> libbpf: section version, size 4, link 0, flags 3, type=1
> libbpf: kernel version of /tmp/foo.o is 40100
> libbpf: section .symtab, size 96, link 1, flags 0, type=2
> bpf: config program 'do_fork'
> symbol:do_fork file:(null) line:0 offset:0 return:0 lazy:(null)
> bpf: 'do_fork': event name is missing
> event syntax error: '/tmp/foo.o'
>                      \___ Invalid argument
> 
> (add -v to see detail)
> Run 'perf list' for a list of valid events
> 
>  Usage: perf record [<options>] [<command>]
>     or: perf record [<options>] -- <command> [<options>]
> 
>     -e, --event <event>   event selector. use 'perf list' to list available events
> [root@felicio ~]#
> 
> [root@felicio ~]# grep do_fork /proc/kallsyms 
> ffffffff81099ab0 T _do_fork
> ffffffff81ccc800 d do_fork_test
> [root@felicio ~]#
> 
> $ echo '__attribute__((section("_do_fork"), used)) int fork(void *ctx) {return 0;} char _license[] __attribute__((section("license"), used)) = "GPL";int _version __attribute__((section("version"), used)) = 0x40100;' | clang -D__KERNEL__ $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c - -target bpf -O2 -o /tmp/foo.o
> 
> [root@felicio ~]# perf record  -v --event /tmp/foo.o sleep 1
> libbpf: loading /tmp/foo.o
> libbpf: section .strtab, size 61, link 0, flags 0, type=3
> libbpf: section .text, size 0, link 0, flags 6, type=1
> libbpf: section .data, size 0, link 0, flags 3, type=1
> libbpf: section .bss, size 0, link 0, flags 3, type=8
> libbpf: section _do_fork, size 16, link 0, flags 6, type=1
> libbpf: found program _do_fork
> libbpf: section license, size 4, link 0, flags 3, type=1
> libbpf: license of /tmp/foo.o is GPL
> libbpf: section version, size 4, link 0, flags 3, type=1
> libbpf: kernel version of /tmp/foo.o is 40100
> libbpf: section .symtab, size 96, link 1, flags 0, type=2
> bpf: config program '_do_fork'
> symbol:_do_fork file:(null) line:0 offset:0 return:0 lazy:(null)
> bpf: '_do_fork': event name is missing
> event syntax error: '/tmp/foo.o'
>                      \___ Invalid argument
> 
> (add -v to see detail)
> Run 'perf list' for a list of valid events
> 
>  Usage: perf record [<options>] [<command>]
>     or: perf record [<options>] -- <command> [<options>]
> 
>     -e, --event <event>   event selector. use 'perf list' to list available events
> [root@felicio ~]#
> 
> So it still doesn't work, doesn't look like it is trying to find a vmlinux,
> will look at another patch IIRC is in this patchkit allowing us to tell
> 'perf record' where to find it... But it can as well use kallsyms...


That doesn't seem to be the problem, the last check after
parse_perf_probe_command() is failing:


+       pr_debug("bpf: config program '%s'\n", config_str);
+       err = parse_perf_probe_command(config_str, pev);
+       if (err < 0) {
+               pr_debug("bpf: '%s' is not a valid config string\n",
+                        config_str);
+               err = -EINVAL;
+               goto errout;
+       }
+
+       if (pev->group && strcmp(pev->group, PERF_BPF_PROBE_GROUP)) {
+               pr_debug("bpf: '%s': group for event is set and not '%s'.\n",
+                        config_str, PERF_BPF_PROBE_GROUP);
+               err = -EINVAL;
+               goto errout;
+       } else if (!pev->group)
+               pev->group = strdup(PERF_BPF_PROBE_GROUP);
+
+       if (!pev->group) {
+               pr_debug("bpf: strdup failed\n");
+               err = -ENOMEM;
+               goto errout;
+       }
+
+       if (!pev->event) {
+               pr_debug("bpf: '%s': event name is missing\n",
+                        config_str);
+               err = -EINVAL;
+               goto errout;
+       }
+       pr_debug("bpf: config '%s' is ok\n", config_str);


I.e. pev->event is NULL, is this expected at this point? I'll continue
investigating later.

What I have is at the perf/ebpf branch in my tree.

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1252430 — Re: [PATCH 04/31] perf record, bpf: Create probe points for BPF programs

On 2015/10/21 3:12, Arnaldo Carvalho de Melo wrote:
> Em Wed, Oct 14, 2015 at 12:41:15PM +0000, Wang Nan escreveu:
>> This patch introduces bpf__{un,}probe() functions to enable callers to
>> create kprobe points based on section names a BPF program. It parses
>> the section names in the program and creates corresponding 'struct
>> perf_probe_event' structures. The parse_perf_probe_command() function is
>> used to do the main parsing work. The resuling 'struct perf_probe_event'
>> is stored into program private data for further using.
>>
>> By utilizing the new probing API, this patch creates probe points during
>> event parsing.
>>
>> To ensure probe points be removed correctly, register an atexit hook
>> so even perf quit through exit() bpf__clear() is still called, so probing
>> points are cleared. Note that bpf_clear() should be registered before
>> bpf__probe() is called, so failure of bpf__probe() can still trigger
>> bpf__clear() to remove probe points which are already probed.
>>
>> strerror style error reporting scaffold is created by this patch.
>> bpf__strerror_probe() is the first error reporting function in bpf-loader.c.
> So, this one, for a non-root user gives me:
>
> [acme@felicio linux]$ perf record --event /tmp/foo.o sleep 1
> event syntax error: '/tmp/foo.o'
>                       \___ Invalid argument
>
> (add -v to see detail)
> Run 'perf list' for a list of valid events
>
>   Usage: perf record [<options>] [<command>]
>      or: perf record [<options>] -- <command> [<options>]
>
>      -e, --event <event>   event selector. use 'perf list' to list available events
> [acme@felicio linux]$

It should be:

  # perf record -e ./test_config_map.o ls
  Failed to init vmlinux path.
  event syntax error: './test_config_map.o'
                       \___ You need to be root, and 
/proc/sys/kernel/kptr_restrict should be 0


  (add -v to see detail)
  Run 'perf list' for a list of valid events

   usage: perf record [<options>] [<command>]
      or: perf record [<options>] -- <command> [<options>]

      -e, --event <event>   event selector. use 'perf list' to list 
available events

So this is another problem related to probing. I'll have a look at your lot.

Thank you.

> --------------------
>
> I.e. no libbpf error (good!) but then, just an -EINVAL as the "event syntax
> error", which clearly isn't a syntax error, we need to tell the user that he or she
> needs special perfmissions for using sys_bpf() :-)
>
> As root:
>
> [root@felicio ~]# perf record --event /tmp/foo.o sleep
> event syntax error: '/tmp/foo.o'
>                       \___ Invalid argument
>
> (add -v to see detail)
> Run 'perf list' for a list of valid events
>
>   Usage: perf record [<options>] [<command>]
>      or: perf record [<options>] -- <command> [<options>]
>
>      -e, --event <event>   event selector. use 'perf list' to list available events
> [root@felicio ~]# ls -la /tmp/foo.o
> -rw-rw-r--. 1 acme acme 824 Oct 20 12:35 /tmp/foo.o
> [root@felicio ~]# file /tmp/foo.o
> /tmp/foo.o: ELF 64-bit LSB relocatable, no machine, version 1 (SYSV), not stripped
>
>
> Humm, its something else, this is an ancient kernel, 4.2.0, probably without
> eBPF support? Nope, its there:
>
> [root@felicio ~]# grep -i sys_bpf /proc/kallsyms
> ffffffff811829d0 T SyS_bpf
> ffffffff811829d0 T sys_bpf
> [root@felicio ~]#
>
> Its something else, we need to improve this error reporting:
>
> [root@felicio ~]# perf record -v --event /tmp/foo.o sleep 1
> libbpf: loading /tmp/foo.o
> libbpf: section .strtab, size 60, link 0, flags 0, type=3
> libbpf: section .text, size 0, link 0, flags 6, type=1
> libbpf: section .data, size 0, link 0, flags 3, type=1
> libbpf: section .bss, size 0, link 0, flags 3, type=8
> libbpf: section do_fork, size 16, link 0, flags 6, type=1
> libbpf: found program do_fork
> libbpf: section license, size 4, link 0, flags 3, type=1
> libbpf: license of /tmp/foo.o is GPL
> libbpf: section version, size 4, link 0, flags 3, type=1
> libbpf: kernel version of /tmp/foo.o is 40100
> libbpf: section .symtab, size 96, link 1, flags 0, type=2
> bpf: config program 'do_fork'
> symbol:do_fork file:(null) line:0 offset:0 return:0 lazy:(null)
> bpf: 'do_fork': event name is missing
> event syntax error: '/tmp/foo.o'
>                       \___ Invalid argument
>
> (add -v to see detail)
> Run 'perf list' for a list of valid events
>
>   Usage: perf record [<options>] [<command>]
>      or: perf record [<options>] -- <command> [<options>]
>
>      -e, --event <event>   event selector. use 'perf list' to list available events
> [root@felicio ~]#
>
> [root@felicio ~]# grep do_fork /proc/kallsyms
> ffffffff81099ab0 T _do_fork
> ffffffff81ccc800 d do_fork_test
> [root@felicio ~]#
>
> $ echo '__attribute__((section("_do_fork"), used)) int fork(void *ctx) {return 0;} char _license[] __attribute__((section("license"), used)) = "GPL";int _version __attribute__((section("version"), used)) = 0x40100;' | clang -D__KERNEL__ $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c - -target bpf -O2 -o /tmp/foo.o
>
> [root@felicio ~]# perf record  -v --event /tmp/foo.o sleep 1
> libbpf: loading /tmp/foo.o
> libbpf: section .strtab, size 61, link 0, flags 0, type=3
> libbpf: section .text, size 0, link 0, flags 6, type=1
> libbpf: section .data, size 0, link 0, flags 3, type=1
> libbpf: section .bss, size 0, link 0, flags 3, type=8
> libbpf: section _do_fork, size 16, link 0, flags 6, type=1
> libbpf: found program _do_fork
> libbpf: section license, size 4, link 0, flags 3, type=1
> libbpf: license of /tmp/foo.o is GPL
> libbpf: section version, size 4, link 0, flags 3, type=1
> libbpf: kernel version of /tmp/foo.o is 40100
> libbpf: section .symtab, size 96, link 1, flags 0, type=2
> bpf: config program '_do_fork'
> symbol:_do_fork file:(null) line:0 offset:0 return:0 lazy:(null)
> bpf: '_do_fork': event name is missing
> event syntax error: '/tmp/foo.o'
>                       \___ Invalid argument
>
> (add -v to see detail)
> Run 'perf list' for a list of valid events
>
>   Usage: perf record [<options>] [<command>]
>      or: perf record [<options>] -- <command> [<options>]
>
>      -e, --event <event>   event selector. use 'perf list' to list available events
> [root@felicio ~]#
>
> So it still doesn't work, doesn't look like it is trying to find a vmlinux,
> will look at another patch IIRC is in this patchkit allowing us to tell
> 'perf record' where to find it... But it can as well use kallsyms...
>
> - Arnaldo


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1252450 — Re: [PATCH 04/31] perf record, bpf: Create probe points for BPF programs

On 2015/10/21 3:12, Arnaldo Carvalho de Melo wrote:
> Em Wed, Oct 14, 2015 at 12:41:15PM +0000, Wang Nan escreveu:
>> This patch introduces bpf__{un,}probe() functions to enable callers to
>> create kprobe points based on section names a BPF program. It parses
>> the section names in the program and creates corresponding 'struct
>> perf_probe_event' structures. The parse_perf_probe_command() function is
>> used to do the main parsing work. The resuling 'struct perf_probe_event'
>> is stored into program private data for further using.
>>
>> By utilizing the new probing API, this patch creates probe points during
>> event parsing.
>>
>> To ensure probe points be removed correctly, register an atexit hook
>> so even perf quit through exit() bpf__clear() is still called, so probing
>> points are cleared. Note that bpf_clear() should be registered before
>> bpf__probe() is called, so failure of bpf__probe() can still trigger
>> bpf__clear() to remove probe points which are already probed.
>>
>> strerror style error reporting scaffold is created by this patch.
>> bpf__strerror_probe() is the first error reporting function in bpf-loader.c.
> So, this one, for a non-root user gives me:
>
> [acme@felicio linux]$ perf record --event /tmp/foo.o sleep 1
> event syntax error: '/tmp/foo.o'
>                       \___ Invalid argument
>
> (add -v to see detail)
> Run 'perf list' for a list of valid events
>
>   Usage: perf record [<options>] [<command>]
>      or: perf record [<options>] -- <command> [<options>]
>
>      -e, --event <event>   event selector. use 'perf list' to list available events
> [acme@felicio linux]$
>
> --------------------
>
> I.e. no libbpf error (good!) but then, just an -EINVAL as the "event syntax
> error", which clearly isn't a syntax error, we need to tell the user that he or she
> needs special perfmissions for using sys_bpf() :-)
>
> As root:
>
> [root@felicio ~]# perf record --event /tmp/foo.o sleep
> event syntax error: '/tmp/foo.o'
>                       \___ Invalid argument
>
> (add -v to see detail)
> Run 'perf list' for a list of valid events
>
>   Usage: perf record [<options>] [<command>]
>      or: perf record [<options>] -- <command> [<options>]
>
>      -e, --event <event>   event selector. use 'perf list' to list available events
> [root@felicio ~]# ls -la /tmp/foo.o
> -rw-rw-r--. 1 acme acme 824 Oct 20 12:35 /tmp/foo.o
> [root@felicio ~]# file /tmp/foo.o
> /tmp/foo.o: ELF 64-bit LSB relocatable, no machine, version 1 (SYSV), not stripped
>
>
> Humm, its something else, this is an ancient kernel, 4.2.0, probably without
> eBPF support? Nope, its there:
>
> [root@felicio ~]# grep -i sys_bpf /proc/kallsyms
> ffffffff811829d0 T SyS_bpf
> ffffffff811829d0 T sys_bpf
> [root@felicio ~]#
>
> Its something else, we need to improve this error reporting:
>
> [root@felicio ~]# perf record -v --event /tmp/foo.o sleep 1
> libbpf: loading /tmp/foo.o
> libbpf: section .strtab, size 60, link 0, flags 0, type=3
> libbpf: section .text, size 0, link 0, flags 6, type=1
> libbpf: section .data, size 0, link 0, flags 3, type=1
> libbpf: section .bss, size 0, link 0, flags 3, type=8
> libbpf: section do_fork, size 16, link 0, flags 6, type=1
> libbpf: found program do_fork
> libbpf: section license, size 4, link 0, flags 3, type=1
> libbpf: license of /tmp/foo.o is GPL
> libbpf: section version, size 4, link 0, flags 3, type=1
> libbpf: kernel version of /tmp/foo.o is 40100
> libbpf: section .symtab, size 96, link 1, flags 0, type=2
> bpf: config program 'do_fork'
> symbol:do_fork file:(null) line:0 offset:0 return:0 lazy:(null)
> bpf: 'do_fork': event name is missing

BPF report the problem, but it is a little bit hard to understand...

> event syntax error: '/tmp/foo.o'
>                       \___ Invalid argument
>
> (add -v to see detail)
> Run 'perf list' for a list of valid events
>
>   Usage: perf record [<options>] [<command>]
>      or: perf record [<options>] -- <command> [<options>]
>
>      -e, --event <event>   event selector. use 'perf list' to list available events
> [root@felicio ~]#
>
> [root@felicio ~]# grep do_fork /proc/kallsyms
> ffffffff81099ab0 T _do_fork
> ffffffff81ccc800 d do_fork_test
> [root@felicio ~]#
>
> $ echo '__attribute__((section("_do_fork"), used)) int fork(void *ctx) {return 0;} char _license[] __attribute__((section("license"), used)) = "GPL";int _version __attribute__((section("version"), used)) = 0x40100;' | clang -D__KERNEL__ $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c - -target bpf -O2 -o /tmp/foo.o

In your program you only provide "do_fork", but we need "key=value" syntax.
"key" will become the name of created kprobe. Please try 
"__attribute__((section("func=do_fork"), used)) "
instead.

I think when event name is missing we'd better construct one name for it
like perf probe, but then we need to deal with perf probe code again. It
may require another patch.

For this patch, I think we can assign a new errorno so bpf__strerror_probe()
can give more information to let user know whether the problem is reside 
in bpf
program or perf configuration. Do you think ENOEXEC is a good choice?

Thank you.

>
> [root@felicio ~]# perf record  -v --event /tmp/foo.o sleep 1
> libbpf: loading /tmp/foo.o
> libbpf: section .strtab, size 61, link 0, flags 0, type=3
> libbpf: section .text, size 0, link 0, flags 6, type=1
> libbpf: section .data, size 0, link 0, flags 3, type=1
> libbpf: section .bss, size 0, link 0, flags 3, type=8
> libbpf: section _do_fork, size 16, link 0, flags 6, type=1
> libbpf: found program _do_fork
> libbpf: section license, size 4, link 0, flags 3, type=1
> libbpf: license of /tmp/foo.o is GPL
> libbpf: section version, size 4, link 0, flags 3, type=1
> libbpf: kernel version of /tmp/foo.o is 40100
> libbpf: section .symtab, size 96, link 1, flags 0, type=2
> bpf: config program '_do_fork'
> symbol:_do_fork file:(null) line:0 offset:0 return:0 lazy:(null)
> bpf: '_do_fork': event name is missing
> event syntax error: '/tmp/foo.o'
>                       \___ Invalid argument
>
> (add -v to see detail)
> Run 'perf list' for a list of valid events
>
>   Usage: perf record [<options>] [<command>]
>      or: perf record [<options>] -- <command> [<options>]
>
>      -e, --event <event>   event selector. use 'perf list' to list available events
> [root@felicio ~]#
>
> So it still doesn't work, doesn't look like it is trying to find a vmlinux,
> will look at another patch IIRC is in this patchkit allowing us to tell
> 'perf record' where to find it... But it can as well use kallsyms...
>
> - Arnaldo


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1252807

Em Wed, Oct 21, 2015 at 11:31:57AM +0800, Wangnan (F) escreveu:
> 
> 
> On 2015/10/21 3:12, Arnaldo Carvalho de Melo wrote:
> >Em Wed, Oct 14, 2015 at 12:41:15PM +0000, Wang Nan escreveu:
> >>This patch introduces bpf__{un,}probe() functions to enable callers to
> >>create kprobe points based on section names a BPF program. It parses
> >>the section names in the program and creates corresponding 'struct
> >>perf_probe_event' structures. The parse_perf_probe_command() function is
> >>used to do the main parsing work. The resuling 'struct perf_probe_event'
> >>is stored into program private data for further using.
> >>
> >>By utilizing the new probing API, this patch creates probe points during
> >>event parsing.
> >>
> >>To ensure probe points be removed correctly, register an atexit hook
> >>so even perf quit through exit() bpf__clear() is still called, so probing
> >>points are cleared. Note that bpf_clear() should be registered before
> >>bpf__probe() is called, so failure of bpf__probe() can still trigger
> >>bpf__clear() to remove probe points which are already probed.
> >>
> >>strerror style error reporting scaffold is created by this patch.
> >>bpf__strerror_probe() is the first error reporting function in bpf-loader.c.
> >So, this one, for a non-root user gives me:
> >
> >[acme@felicio linux]$ perf record --event /tmp/foo.o sleep 1
> >event syntax error: '/tmp/foo.o'
> >                      \___ Invalid argument
> >
> >(add -v to see detail)
> >Run 'perf list' for a list of valid events
> >
> >  Usage: perf record [<options>] [<command>]
> >     or: perf record [<options>] -- <command> [<options>]
> >
> >     -e, --event <event>   event selector. use 'perf list' to list available events
> >[acme@felicio linux]$
> >
> >--------------------
> >
> >I.e. no libbpf error (good!) but then, just an -EINVAL as the "event syntax
> >error", which clearly isn't a syntax error, we need to tell the user that he or she
> >needs special perfmissions for using sys_bpf() :-)
> >
> >As root:
> >
> >[root@felicio ~]# perf record --event /tmp/foo.o sleep
> >event syntax error: '/tmp/foo.o'
> >                      \___ Invalid argument
> >
> >(add -v to see detail)
> >Run 'perf list' for a list of valid events
> >
> >  Usage: perf record [<options>] [<command>]
> >     or: perf record [<options>] -- <command> [<options>]
> >
> >     -e, --event <event>   event selector. use 'perf list' to list available events
> >[root@felicio ~]# ls -la /tmp/foo.o
> >-rw-rw-r--. 1 acme acme 824 Oct 20 12:35 /tmp/foo.o
> >[root@felicio ~]# file /tmp/foo.o
> >/tmp/foo.o: ELF 64-bit LSB relocatable, no machine, version 1 (SYSV), not stripped
> >
> >
> >Humm, its something else, this is an ancient kernel, 4.2.0, probably without
> >eBPF support? Nope, its there:
> >
> >[root@felicio ~]# grep -i sys_bpf /proc/kallsyms
> >ffffffff811829d0 T SyS_bpf
> >ffffffff811829d0 T sys_bpf
> >[root@felicio ~]#
> >
> >Its something else, we need to improve this error reporting:
> >
> >[root@felicio ~]# perf record -v --event /tmp/foo.o sleep 1
> >libbpf: loading /tmp/foo.o
> >libbpf: section .strtab, size 60, link 0, flags 0, type=3
> >libbpf: section .text, size 0, link 0, flags 6, type=1
> >libbpf: section .data, size 0, link 0, flags 3, type=1
> >libbpf: section .bss, size 0, link 0, flags 3, type=8
> >libbpf: section do_fork, size 16, link 0, flags 6, type=1
> >libbpf: found program do_fork
> >libbpf: section license, size 4, link 0, flags 3, type=1
> >libbpf: license of /tmp/foo.o is GPL
> >libbpf: section version, size 4, link 0, flags 3, type=1
> >libbpf: kernel version of /tmp/foo.o is 40100
> >libbpf: section .symtab, size 96, link 1, flags 0, type=2
> >bpf: config program 'do_fork'
> >symbol:do_fork file:(null) line:0 offset:0 return:0 lazy:(null)
> >bpf: 'do_fork': event name is missing
> 
> BPF report the problem, but it is a little bit hard to understand...
> 
> >event syntax error: '/tmp/foo.o'
> >                      \___ Invalid argument
> >
> >(add -v to see detail)
> >Run 'perf list' for a list of valid events
> >
> >  Usage: perf record [<options>] [<command>]
> >     or: perf record [<options>] -- <command> [<options>]
> >
> >     -e, --event <event>   event selector. use 'perf list' to list available events
> >[root@felicio ~]#
> >
> >[root@felicio ~]# grep do_fork /proc/kallsyms
> >ffffffff81099ab0 T _do_fork
> >ffffffff81ccc800 d do_fork_test
> >[root@felicio ~]#
> >
> >$ echo '__attribute__((section("_do_fork"), used)) int fork(void *ctx) {return 0;} char _license[] __attribute__((section("license"), used)) = "GPL";int _version __attribute__((section("version"), used)) = 0x40100;' | clang -D__KERNEL__ $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c - -target bpf -O2 -o /tmp/foo.o
 
> In your program you only provide "do_fork", but we need "key=value"
> syntax.  "key" will become the name of created kprobe. Please try
> "__attribute__((section("func=do_fork"), used)) " instead.
 
> I think when event name is missing we'd better construct one name for
> it like perf probe, but then we need to deal with perf probe code
> again. It may require another patch.

Nah, lets go with what we have, i.e. I'll take that into account and
test with the expected form.
 
> For this patch, I think we can assign a new errorno so
> bpf__strerror_probe() can give more information to let user know
> whether the problem is reside in bpf program or perf configuration. Do
> you think ENOEXEC is a good choice?

Unsure if we should use existing errno codes in cases like this,
probably better to use a BPF_ERRNO__ENOALIAS or somesuch.

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1253957

Em Wed, Oct 21, 2015 at 10:28:03AM -0300, Arnaldo Carvalho de Melo escreveu:
> Em Wed, Oct 21, 2015 at 11:31:57AM +0800, Wangnan (F) escreveu:
> > >bpf: config program 'do_fork'
> > >symbol:do_fork file:(null) line:0 offset:0 return:0 lazy:(null)
> > >bpf: 'do_fork': event name is missing
> > 
> > BPF report the problem, but it is a little bit hard to understand...
> > 
> > >event syntax error: '/tmp/foo.o'
> > >                      \___ Invalid argument
> > >
> > >(add -v to see detail)
> > >Run 'perf list' for a list of valid events
> > >
> > >  Usage: perf record [<options>] [<command>]
> > >     or: perf record [<options>] -- <command> [<options>]
> > >
> > >     -e, --event <event>   event selector. use 'perf list' to list available events
> > >[root@felicio ~]#
> > >
> > >[root@felicio ~]# grep do_fork /proc/kallsyms
> > >ffffffff81099ab0 T _do_fork
> > >ffffffff81ccc800 d do_fork_test
> > >[root@felicio ~]#
> > >
> > >$ echo '__attribute__((section("_do_fork"), used)) int fork(void *ctx) {return 0;} char _license[] __attribute__((section("license"), used)) = "GPL";int _version __attribute__((section("version"), used)) = 0x40100;' | clang -D__KERNEL__ $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c - -target bpf -O2 -o /tmp/foo.o
>  
> > In your program you only provide "do_fork", but we need "key=value"
> > syntax.  "key" will become the name of created kprobe. Please try
> > "__attribute__((section("func=do_fork"), used)) " instead.
>  
> > I think when event name is missing we'd better construct one name for
> > it like perf probe, but then we need to deal with perf probe code
> > again. It may require another patch.
> 
> Nah, lets go with what we have, i.e. I'll take that into account and
> test with the expected form.

So, pushed this cset with my committer testing notes:

https://git.kernel.org/cgit/linux/kernel/git/acme/linux.git/commit/?h=perf/ebpf&id=bd3c477e57233819580f5824dea3a6922a860a24

continuing...

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web