On Sat, Jun 24, 2023 at 12:49 AM Quentin Monnet [off-list ref] wrote:

2023-06-23 14:15 UTC+0000 ~ Yafang Shao [off-list ref]

quoted

Enhance bpftool to display comprehensive information about exposed
perf_event links, covering uprobe, kprobe, tracepoint, and generic perf
event. The resulting output will include the following details:

$ tools/bpf/bpftool/bpftool link show
4: perf_event  prog 23
        uprobe /home/dev/waken/bpf/uprobe/a.out+0x1338
        bpf_cookie 0
        pids uprobe(27503)
5: perf_event  prog 24
        uretprobe /home/dev/waken/bpf/uprobe/a.out+0x1338
        bpf_cookie 0
        pids uprobe(27503)
6: perf_event  prog 31
        kprobe ffffffffa90a9660 kernel_clone
        bpf_cookie 0
        pids kprobe(27777)
7: perf_event  prog 30
        kretprobe ffffffffa90a9660 kernel_clone
        bpf_cookie 0
        pids kprobe(27777)
8: perf_event  prog 37
        tracepoint sched_switch
        bpf_cookie 0
        pids tracepoint(28036)
9: perf_event  prog 43
        event software:cpu-clock
        bpf_cookie 0
        pids perf_event(28261)
10: perf_event  prog 43
        event hw-cache:LLC-load-misses
        bpf_cookie 0
        pids perf_event(28261)
11: perf_event  prog 43
        event hardware:cpu-cycles
        bpf_cookie 0
        pids perf_event(28261)

$ tools/bpf/bpftool/bpftool link show -j
[{"id":4,"type":"perf_event","prog_id":23,"retprobe":false,"file":"/home/dev/waken/bpf/uprobe/a.out","offset":4920,"bpf_cookie":0,"pids":[{"pid":27503,"comm":"uprobe"}]},{"id":5,"type":"perf_event","prog_id":24,"retprobe":true,"file":"/home/dev/waken/bpf/uprobe/a.out","offset":4920,"bpf_cookie":0,"pids":[{"pid":27503,"comm":"uprobe"}]},{"id":6,"type":"perf_event","prog_id":31,"retprobe":false,"addr":18446744072250627680,"func":"kernel_clone","offset":0,"bpf_cookie":0,"pids":[{"pid":27777,"comm":"kprobe"}]},{"id":7,"type":"perf_event","prog_id":30,"retprobe":true,"addr":18446744072250627680,"func":"kernel_clone","offset":0,"bpf_cookie":0,"pids":[{"pid":27777,"comm":"kprobe"}]},{"id":8,"type":"perf_event","prog_id":37,"tracepoint":"sched_switch","bpf_cookie":0,"pids":[{"pid":28036,"comm":"tracepoint"}]},{"id":9,"type":"perf_event","prog_id":43,"event_type":"software","event_config":"cpu-clock","bpf_cookie":0,"pids":[{"pid":28261,"comm":"perf_event"}]},{"id":10,"type":"perf_event","prog_id":43,"event_type":"hw-cache","event_config":"LLC-load-misses","bpf_cookie":0,"pids":[{"pid":28261,"comm":"perf_event"}]},{"id":11,"type":"perf_event","prog_id":43,"event_type":"hardware","event_config":"cpu-cycles","bpf_cookie":0,"pids":[{"pid":28261,"comm":"perf_event"}]}]

For generic perf events, the displayed information in bpftool is limited to
the type and configuration, while other attributes such as sample_period,
sample_freq, etc., are not included.

The kernel function address won't be exposed if it is not permitted by
kptr_restrict. The result as follows when kptr_restrict is 2.

$ tools/bpf/bpftool/bpftool link show
4: perf_event  prog 23
        uprobe /home/dev/waken/bpf/uprobe/a.out+0x1338
5: perf_event  prog 24
        uretprobe /home/dev/waken/bpf/uprobe/a.out+0x1338
6: perf_event  prog 31
        kprobe kernel_clone
7: perf_event  prog 30
        kretprobe kernel_clone
8: perf_event  prog 37
        tracepoint sched_switch
9: perf_event  prog 43
        event software:cpu-clock
10: perf_event  prog 43
        event hw-cache:LLC-load-misses
11: perf_event  prog 43
        event hardware:cpu-cycles

Signed-off-by: Yafang Shao <redacted>
---
 tools/bpf/bpftool/link.c | 237 ++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 236 insertions(+), 1 deletion(-)

diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
index e5aeee3..31bee95 100644
--- a/tools/bpf/bpftool/link.c
+++ b/tools/bpf/bpftool/link.c

@@ -17,6 +17,8 @@
 #include "main.h"
 #include "xlated_dumper.h"

+#define PERF_HW_CACHE_LEN 128
+
 static struct hashmap *link_table;
 static struct dump_data dd = {};

@@ -274,6 +276,110 @@ static int cmp_u64(const void *A, const void *B)
      jsonw_end_array(json_wtr);
 }

+static void
+show_perf_event_kprobe_json(struct bpf_link_info *info, json_writer_t *wtr)
+{
+     jsonw_bool_field(wtr, "retprobe", info->perf_event.kprobe.flags & 0x1);
+     jsonw_uint_field(wtr, "addr", info->perf_event.kprobe.addr);
+     jsonw_string_field(wtr, "func",
+                        u64_to_ptr(info->perf_event.kprobe.func_name));
+     jsonw_uint_field(wtr, "offset", info->perf_event.kprobe.offset);
+}
+
+static void
+show_perf_event_uprobe_json(struct bpf_link_info *info, json_writer_t *wtr)
+{
+     jsonw_bool_field(wtr, "retprobe", info->perf_event.uprobe.flags & 0x1);
+     jsonw_string_field(wtr, "file",
+                        u64_to_ptr(info->perf_event.uprobe.file_name));
+     jsonw_uint_field(wtr, "offset", info->perf_event.uprobe.offset);
+}
+
+static void
+show_perf_event_tracepoint_json(struct bpf_link_info *info, json_writer_t *wtr)
+{
+     jsonw_string_field(wtr, "tracepoint",
+                        u64_to_ptr(info->perf_event.tracepoint.tp_name));
+}
+
+static char *perf_config_hw_cache_str(__u64 config)
+{
+     const char *hw_cache, *result, *op;
+     char *str = malloc(PERF_HW_CACHE_LEN);
+
+     if (!str) {
+             p_err("mem alloc failed");
+             return NULL;
+     }
+
+     hw_cache = perf_event_name(evsel__hw_cache, config & 0xff);
+     if (hw_cache)
+             snprintf(str, PERF_HW_CACHE_LEN, "%s-", hw_cache);
+     else
+             snprintf(str, PERF_HW_CACHE_LEN, "%lld-", config & 0xff);
+
+     op = perf_event_name(evsel__hw_cache_op, (config >> 8) & 0xff);
+     if (op)
+             snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str),
+                      "%s-", op);
+     else
+             snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str),
+                      "%lld-", (config >> 8) & 0xff);
+
+     result = perf_event_name(evsel__hw_cache_result, config >> 16);
+     if (result)
+             snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str),
+                      "%s", result);
+     else
+             snprintf(str + strlen(str), PERF_HW_CACHE_LEN - strlen(str),
+                      "%lld", config >> 16);
+     return str;
+}
+
+static const char *perf_config_str(__u32 type, __u64 config)
+{
+     const char *perf_config;
+
+     switch (type) {
+     case PERF_TYPE_HARDWARE:
+             perf_config = perf_event_name(event_symbols_hw, config);
+             break;
+     case PERF_TYPE_SOFTWARE:
+             perf_config = perf_event_name(event_symbols_sw, config);
+             break;
+     case PERF_TYPE_HW_CACHE:
+             perf_config = perf_config_hw_cache_str(config);
+             break;
+     default:
+             perf_config = NULL;
+             break;
+     }
+     return perf_config;
+}
+
+static void
+show_perf_event_event_json(struct bpf_link_info *info, json_writer_t *wtr)
+{
+     __u64 config = info->perf_event.event.config;
+     __u32 type = info->perf_event.event.type;
+     const char *perf_type, *perf_config;
+
+     perf_type = perf_event_name(perf_type_name, type);
+     if (perf_type)
+             jsonw_string_field(wtr, "event_type", perf_type);
+     else
+             jsonw_uint_field(wtr, "event_type", type);
+
+     perf_config = perf_config_str(type, config);
+     if (perf_config)
+             jsonw_string_field(wtr, "event_config", perf_config);
+     else
+             jsonw_uint_field(wtr, "event_config", config);
+
+     if (type == PERF_TYPE_HW_CACHE && perf_config)
+             free((void *)perf_config);
+}
+
 static int show_link_close_json(int fd, struct bpf_link_info *info)
 {
      struct bpf_prog_info prog_info;

@@ -329,6 +435,24 @@ static int show_link_close_json(int fd, struct bpf_link_info *info)
      case BPF_LINK_TYPE_KPROBE_MULTI:
              show_kprobe_multi_json(info, json_wtr);
              break;
+     case BPF_LINK_TYPE_PERF_EVENT:
+             switch (info->perf_event.type) {
+             case BPF_PERF_EVENT_EVENT:
+                     show_perf_event_event_json(info, json_wtr);
+                     break;
+             case BPF_PERF_EVENT_TRACEPOINT:
+                     show_perf_event_tracepoint_json(info, json_wtr);
+                     break;
+             case BPF_PERF_EVENT_KPROBE:
+                     show_perf_event_kprobe_json(info, json_wtr);
+                     break;
+             case BPF_PERF_EVENT_UPROBE:
+                     show_perf_event_uprobe_json(info, json_wtr);
+                     break;
+             default:
+                     break;
+             }
+             break;
      default:
              break;
      }

@@ -500,6 +624,75 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info)
      }
 }

+static void show_perf_event_kprobe_plain(struct bpf_link_info *info)
+{
+     const char *buf;
+
+     buf = (const char *)u64_to_ptr(info->perf_event.kprobe.func_name);
+     if (buf[0] == '\0' && !info->perf_event.kprobe.addr)
+             return;
+
+     if (info->perf_event.kprobe.flags & 0x1)
+             printf("\n\tkretprobe ");
+     else
+             printf("\n\tkprobe ");
+     if (info->perf_event.kprobe.addr)
+             printf("%llx ", info->perf_event.kprobe.addr);
+     printf("%s", buf);
+     if (info->perf_event.kprobe.offset)
+             printf("+%#x", info->perf_event.kprobe.offset);
+     printf("  ");
+}
+
+static void show_perf_event_uprobe_plain(struct bpf_link_info *info)
+{
+     const char *buf;
+
+     buf = (const char *)u64_to_ptr(info->perf_event.uprobe.file_name);
+     if (buf[0] == '\0')
+             return;
+
+     if (info->perf_event.uprobe.flags & 0x1)
+             printf("\n\turetprobe ");
+     else
+             printf("\n\tuprobe ");
+     printf("%s+%#x  ", buf, info->perf_event.uprobe.offset);
+}
+
+static void show_perf_event_tracepoint_plain(struct bpf_link_info *info)
+{
+     const char *buf;
+
+     buf = (const char *)u64_to_ptr(info->perf_event.tracepoint.tp_name);
+     if (buf[0] == '\0')
+             return;
+
+     printf("\n\ttracepoint %s  ", buf);
+}
+
+static void show_perf_event_event_plain(struct bpf_link_info *info)
+{
+     __u64 config = info->perf_event.event.config;
+     __u32 type = info->perf_event.event.type;
+     const char *perf_type, *perf_config;
+
+     printf("\n\tevent ");
+     perf_type = perf_event_name(perf_type_name, type);
+     if (perf_type)
+             printf("%s:", perf_type);
+     else
+             printf("%u :", type);
+
+     perf_config = perf_config_str(type, config);
+     if (perf_config)
+             printf("%s  ", perf_config);
+     else
+             printf("%llu  ", config);
+
+     if (type == PERF_TYPE_HW_CACHE && perf_config)
+             free((void *)perf_config);
+}
+
 static int show_link_close_plain(int fd, struct bpf_link_info *info)
 {
      struct bpf_prog_info prog_info;

@@ -548,6 +741,24 @@ static int show_link_close_plain(int fd, struct bpf_link_info *info)
      case BPF_LINK_TYPE_KPROBE_MULTI:
              show_kprobe_multi_plain(info);
              break;
+     case BPF_LINK_TYPE_PERF_EVENT:
+             switch (info->perf_event.type) {
+             case BPF_PERF_EVENT_EVENT:
+                     show_perf_event_event_plain(info);
+                     break;
+             case BPF_PERF_EVENT_TRACEPOINT:
+                     show_perf_event_tracepoint_plain(info);
+                     break;
+             case BPF_PERF_EVENT_KPROBE:
+                     show_perf_event_kprobe_plain(info);
+                     break;
+             case BPF_PERF_EVENT_UPROBE:
+                     show_perf_event_uprobe_plain(info);
+                     break;
+             default:
+                     break;
+             }
+             break;
      default:
              break;
      }

@@ -570,11 +781,12 @@ static int do_show_link(int fd)
      struct bpf_link_info info;
      __u32 len = sizeof(info);
      __u64 *addrs = NULL;
-     char buf[256];
+     char buf[PATH_MAX];
      int count;
      int err;

      memset(&info, 0, sizeof(info));
+     buf[0] = '\0';
 again:
      err = bpf_link_get_info_by_fd(fd, &info, &len);
      if (err) {

@@ -609,7 +821,30 @@ static int do_show_link(int fd)
                      goto again;
              }
      }
+     if (info.type == BPF_LINK_TYPE_PERF_EVENT) {
+             if (info.perf_event.type == BPF_PERF_EVENT_EVENT)
+                     goto out;

This "if (...) goto out;" seems unnecessary? If info.perf_event.type is
BPF_PERF_EVENT_EVENT we won't match any of the conditions below and
should reach the "out:" label anyway (and that label seems also
unnecessary)?

Makes sense. Will change it.

-- 
Regards
Yafang