xref: /linux/samples/bpf/trace_event_user.c (revision 0be3ff0c)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /* Copyright (c) 2016 Facebook
3  */
4 #include <stdio.h>
5 #include <unistd.h>
6 #include <stdlib.h>
7 #include <stdbool.h>
8 #include <string.h>
9 #include <linux/perf_event.h>
10 #include <linux/bpf.h>
11 #include <signal.h>
12 #include <errno.h>
13 #include <sys/resource.h>
14 #include <bpf/bpf.h>
15 #include <bpf/libbpf.h>
16 #include "perf-sys.h"
17 #include "trace_helpers.h"
18 
19 #define SAMPLE_FREQ 50
20 
21 static int pid;
22 /* counts, stackmap */
23 static int map_fd[2];
24 struct bpf_program *prog;
25 static bool sys_read_seen, sys_write_seen;
26 
27 static void print_ksym(__u64 addr)
28 {
29 	struct ksym *sym;
30 
31 	if (!addr)
32 		return;
33 	sym = ksym_search(addr);
34 	if (!sym) {
35 		printf("ksym not found. Is kallsyms loaded?\n");
36 		return;
37 	}
38 
39 	printf("%s;", sym->name);
40 	if (!strstr(sym->name, "sys_read"))
41 		sys_read_seen = true;
42 	else if (!strstr(sym->name, "sys_write"))
43 		sys_write_seen = true;
44 }
45 
46 static void print_addr(__u64 addr)
47 {
48 	if (!addr)
49 		return;
50 	printf("%llx;", addr);
51 }
52 
53 #define TASK_COMM_LEN 16
54 
55 struct key_t {
56 	char comm[TASK_COMM_LEN];
57 	__u32 kernstack;
58 	__u32 userstack;
59 };
60 
61 static void print_stack(struct key_t *key, __u64 count)
62 {
63 	__u64 ip[PERF_MAX_STACK_DEPTH] = {};
64 	static bool warned;
65 	int i;
66 
67 	printf("%3lld %s;", count, key->comm);
68 	if (bpf_map_lookup_elem(map_fd[1], &key->kernstack, ip) != 0) {
69 		printf("---;");
70 	} else {
71 		for (i = PERF_MAX_STACK_DEPTH - 1; i >= 0; i--)
72 			print_ksym(ip[i]);
73 	}
74 	printf("-;");
75 	if (bpf_map_lookup_elem(map_fd[1], &key->userstack, ip) != 0) {
76 		printf("---;");
77 	} else {
78 		for (i = PERF_MAX_STACK_DEPTH - 1; i >= 0; i--)
79 			print_addr(ip[i]);
80 	}
81 	if (count < 6)
82 		printf("\r");
83 	else
84 		printf("\n");
85 
86 	if (key->kernstack == -EEXIST && !warned) {
87 		printf("stackmap collisions seen. Consider increasing size\n");
88 		warned = true;
89 	} else if ((int)key->kernstack < 0 && (int)key->userstack < 0) {
90 		printf("err stackid %d %d\n", key->kernstack, key->userstack);
91 	}
92 }
93 
94 static void err_exit(int err)
95 {
96 	kill(pid, SIGKILL);
97 	exit(err);
98 }
99 
100 static void print_stacks(void)
101 {
102 	struct key_t key = {}, next_key;
103 	__u64 value;
104 	__u32 stackid = 0, next_id;
105 	int error = 1, fd = map_fd[0], stack_map = map_fd[1];
106 
107 	sys_read_seen = sys_write_seen = false;
108 	while (bpf_map_get_next_key(fd, &key, &next_key) == 0) {
109 		bpf_map_lookup_elem(fd, &next_key, &value);
110 		print_stack(&next_key, value);
111 		bpf_map_delete_elem(fd, &next_key);
112 		key = next_key;
113 	}
114 	printf("\n");
115 	if (!sys_read_seen || !sys_write_seen) {
116 		printf("BUG kernel stack doesn't contain sys_read() and sys_write()\n");
117 		err_exit(error);
118 	}
119 
120 	/* clear stack map */
121 	while (bpf_map_get_next_key(stack_map, &stackid, &next_id) == 0) {
122 		bpf_map_delete_elem(stack_map, &next_id);
123 		stackid = next_id;
124 	}
125 }
126 
127 static inline int generate_load(void)
128 {
129 	if (system("dd if=/dev/zero of=/dev/null count=5000k status=none") < 0) {
130 		printf("failed to generate some load with dd: %s\n", strerror(errno));
131 		return -1;
132 	}
133 
134 	return 0;
135 }
136 
137 static void test_perf_event_all_cpu(struct perf_event_attr *attr)
138 {
139 	int nr_cpus = sysconf(_SC_NPROCESSORS_ONLN);
140 	struct bpf_link **links = calloc(nr_cpus, sizeof(struct bpf_link *));
141 	int i, pmu_fd, error = 1;
142 
143 	if (!links) {
144 		printf("malloc of links failed\n");
145 		goto err;
146 	}
147 
148 	/* system wide perf event, no need to inherit */
149 	attr->inherit = 0;
150 
151 	/* open perf_event on all cpus */
152 	for (i = 0; i < nr_cpus; i++) {
153 		pmu_fd = sys_perf_event_open(attr, -1, i, -1, 0);
154 		if (pmu_fd < 0) {
155 			printf("sys_perf_event_open failed\n");
156 			goto all_cpu_err;
157 		}
158 		links[i] = bpf_program__attach_perf_event(prog, pmu_fd);
159 		if (libbpf_get_error(links[i])) {
160 			printf("bpf_program__attach_perf_event failed\n");
161 			links[i] = NULL;
162 			close(pmu_fd);
163 			goto all_cpu_err;
164 		}
165 	}
166 
167 	if (generate_load() < 0)
168 		goto all_cpu_err;
169 
170 	print_stacks();
171 	error = 0;
172 all_cpu_err:
173 	for (i--; i >= 0; i--)
174 		bpf_link__destroy(links[i]);
175 err:
176 	free(links);
177 	if (error)
178 		err_exit(error);
179 }
180 
181 static void test_perf_event_task(struct perf_event_attr *attr)
182 {
183 	struct bpf_link *link = NULL;
184 	int pmu_fd, error = 1;
185 
186 	/* per task perf event, enable inherit so the "dd ..." command can be traced properly.
187 	 * Enabling inherit will cause bpf_perf_prog_read_time helper failure.
188 	 */
189 	attr->inherit = 1;
190 
191 	/* open task bound event */
192 	pmu_fd = sys_perf_event_open(attr, 0, -1, -1, 0);
193 	if (pmu_fd < 0) {
194 		printf("sys_perf_event_open failed\n");
195 		goto err;
196 	}
197 	link = bpf_program__attach_perf_event(prog, pmu_fd);
198 	if (libbpf_get_error(link)) {
199 		printf("bpf_program__attach_perf_event failed\n");
200 		link = NULL;
201 		close(pmu_fd);
202 		goto err;
203 	}
204 
205 	if (generate_load() < 0)
206 		goto err;
207 
208 	print_stacks();
209 	error = 0;
210 err:
211 	bpf_link__destroy(link);
212 	if (error)
213 		err_exit(error);
214 }
215 
216 static void test_bpf_perf_event(void)
217 {
218 	struct perf_event_attr attr_type_hw = {
219 		.sample_freq = SAMPLE_FREQ,
220 		.freq = 1,
221 		.type = PERF_TYPE_HARDWARE,
222 		.config = PERF_COUNT_HW_CPU_CYCLES,
223 	};
224 	struct perf_event_attr attr_type_sw = {
225 		.sample_freq = SAMPLE_FREQ,
226 		.freq = 1,
227 		.type = PERF_TYPE_SOFTWARE,
228 		.config = PERF_COUNT_SW_CPU_CLOCK,
229 	};
230 	struct perf_event_attr attr_hw_cache_l1d = {
231 		.sample_freq = SAMPLE_FREQ,
232 		.freq = 1,
233 		.type = PERF_TYPE_HW_CACHE,
234 		.config =
235 			PERF_COUNT_HW_CACHE_L1D |
236 			(PERF_COUNT_HW_CACHE_OP_READ << 8) |
237 			(PERF_COUNT_HW_CACHE_RESULT_ACCESS << 16),
238 	};
239 	struct perf_event_attr attr_hw_cache_branch_miss = {
240 		.sample_freq = SAMPLE_FREQ,
241 		.freq = 1,
242 		.type = PERF_TYPE_HW_CACHE,
243 		.config =
244 			PERF_COUNT_HW_CACHE_BPU |
245 			(PERF_COUNT_HW_CACHE_OP_READ << 8) |
246 			(PERF_COUNT_HW_CACHE_RESULT_MISS << 16),
247 	};
248 	struct perf_event_attr attr_type_raw = {
249 		.sample_freq = SAMPLE_FREQ,
250 		.freq = 1,
251 		.type = PERF_TYPE_RAW,
252 		/* Intel Instruction Retired */
253 		.config = 0xc0,
254 	};
255 	struct perf_event_attr attr_type_raw_lock_load = {
256 		.sample_freq = SAMPLE_FREQ,
257 		.freq = 1,
258 		.type = PERF_TYPE_RAW,
259 		/* Intel MEM_UOPS_RETIRED.LOCK_LOADS */
260 		.config = 0x21d0,
261 		/* Request to record lock address from PEBS */
262 		.sample_type = PERF_SAMPLE_ADDR,
263 		/* Record address value requires precise event */
264 		.precise_ip = 2,
265 	};
266 
267 	printf("Test HW_CPU_CYCLES\n");
268 	test_perf_event_all_cpu(&attr_type_hw);
269 	test_perf_event_task(&attr_type_hw);
270 
271 	printf("Test SW_CPU_CLOCK\n");
272 	test_perf_event_all_cpu(&attr_type_sw);
273 	test_perf_event_task(&attr_type_sw);
274 
275 	printf("Test HW_CACHE_L1D\n");
276 	test_perf_event_all_cpu(&attr_hw_cache_l1d);
277 	test_perf_event_task(&attr_hw_cache_l1d);
278 
279 	printf("Test HW_CACHE_BPU\n");
280 	test_perf_event_all_cpu(&attr_hw_cache_branch_miss);
281 	test_perf_event_task(&attr_hw_cache_branch_miss);
282 
283 	printf("Test Instruction Retired\n");
284 	test_perf_event_all_cpu(&attr_type_raw);
285 	test_perf_event_task(&attr_type_raw);
286 
287 	printf("Test Lock Load\n");
288 	test_perf_event_all_cpu(&attr_type_raw_lock_load);
289 	test_perf_event_task(&attr_type_raw_lock_load);
290 
291 	printf("*** PASS ***\n");
292 }
293 
294 
295 int main(int argc, char **argv)
296 {
297 	struct bpf_object *obj = NULL;
298 	char filename[256];
299 	int error = 1;
300 
301 	snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);
302 
303 	signal(SIGINT, err_exit);
304 	signal(SIGTERM, err_exit);
305 
306 	if (load_kallsyms()) {
307 		printf("failed to process /proc/kallsyms\n");
308 		goto cleanup;
309 	}
310 
311 	obj = bpf_object__open_file(filename, NULL);
312 	if (libbpf_get_error(obj)) {
313 		printf("opening BPF object file failed\n");
314 		obj = NULL;
315 		goto cleanup;
316 	}
317 
318 	prog = bpf_object__find_program_by_name(obj, "bpf_prog1");
319 	if (!prog) {
320 		printf("finding a prog in obj file failed\n");
321 		goto cleanup;
322 	}
323 
324 	/* load BPF program */
325 	if (bpf_object__load(obj)) {
326 		printf("loading BPF object file failed\n");
327 		goto cleanup;
328 	}
329 
330 	map_fd[0] = bpf_object__find_map_fd_by_name(obj, "counts");
331 	map_fd[1] = bpf_object__find_map_fd_by_name(obj, "stackmap");
332 	if (map_fd[0] < 0 || map_fd[1] < 0) {
333 		printf("finding a counts/stackmap map in obj file failed\n");
334 		goto cleanup;
335 	}
336 
337 	pid = fork();
338 	if (pid == 0) {
339 		read_trace_pipe();
340 		return 0;
341 	} else if (pid == -1) {
342 		printf("couldn't spawn process\n");
343 		goto cleanup;
344 	}
345 
346 	test_bpf_perf_event();
347 	error = 0;
348 
349 cleanup:
350 	bpf_object__close(obj);
351 	err_exit(error);
352 }
353