[PATCH v1 0/7] Fix perf trace libbpf 1.0+ compatibility

[PATCH v1 0/7] Fix perf trace libbpf 1.0+ compatibility

[Ian Rogers]

Perf trace can augment system calls with a BPF program passed as an
event. The BPF code for this lives in examples. This patch fixes the
example code to not used deprecated/removed APIs in libbpf. As libbpf
has similar header files to tools/perf/include/bpf the code is
transitioned to use the more standard libbpf code and the perf BPF
header files removed.

Ian Rogers (7):
  perf trace: Raw augmented syscalls fix libbpf 1.0+ compatibility
  perf trace: Etcsnoop fix libbpf 1.0+ compatibility
  perf trace: Augmented syscalls fix libbpf 1.0+ compatibility
  perf trace: hello fix libbpf 1.0+ compatibility
  perf trace: empty fix libbpf 1.0+ compatibility
  perf trace: 5sec fix libbpf 1.0+ compatibility
  perf bpf: Remove now unused BPF headers

 tools/perf/Makefile.perf                      |  5 --
 tools/perf/examples/bpf/5sec.c                |  8 +-
 .../examples/bpf/augmented_raw_syscalls.c     | 75 ++++++++++++++-----
 tools/perf/examples/bpf/augmented_syscalls.c  | 58 +++++++++-----
 tools/perf/examples/bpf/empty.c               | 13 +++-
 tools/perf/examples/bpf/etcsnoop.c            | 41 ++++++++--
 tools/perf/examples/bpf/hello.c               | 24 +++++-
 tools/perf/include/bpf/bpf.h                  | 70 -----------------
 tools/perf/include/bpf/linux/socket.h         | 24 ------
 tools/perf/include/bpf/pid_filter.h           | 21 ------
 tools/perf/include/bpf/stdio.h                | 16 ----
 tools/perf/include/bpf/unistd.h               | 10 ---
 12 files changed, 169 insertions(+), 196 deletions(-)
 delete mode 100644 tools/perf/include/bpf/bpf.h
 delete mode 100644 tools/perf/include/bpf/linux/socket.h
 delete mode 100644 tools/perf/include/bpf/pid_filter.h
 delete mode 100644 tools/perf/include/bpf/stdio.h
 delete mode 100644 tools/perf/include/bpf/unistd.h

-- 
2.38.1.273.g43a17bfeac-goog

[PATCH v1 1/7] perf trace: Raw augmented syscalls fix libbpf 1.0+ compatibility

[Ian Rogers]

Don't use deprecated and now broken map style. Avoid use of
tools/perf/include/bpf/bpf.h and use the more regular BPF headers.

Signed-off-by: Ian Rogers <irogers@google.com>
---
 .../examples/bpf/augmented_raw_syscalls.c     | 75 ++++++++++++++-----
 1 file changed, 58 insertions(+), 17 deletions(-)

diff --git a/tools/perf/examples/bpf/augmented_raw_syscalls.c b/tools/perf/examples/bpf/augmented_raw_syscalls.c
index a262dcd020f4..13c72fd602c3 100644
--- a/tools/perf/examples/bpf/augmented_raw_syscalls.c
+++ b/tools/perf/examples/bpf/augmented_raw_syscalls.c
@@ -14,13 +14,19 @@
  * code that will combine entry/exit in a strace like way.
  */
 
-#include <unistd.h>
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
 #include <linux/limits.h>
-#include <linux/socket.h>
-#include <pid_filter.h>
+#include <stdbool.h>
+#include <sys/socket.h>
 
 /* bpf-output associated map */
-bpf_map(__augmented_syscalls__, PERF_EVENT_ARRAY, int, u32, __NR_CPUS__);
+struct __augmented_syscalls__ {
+	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+	__type(key, int);
+	__type(value, __u32);
+	__uint(max_entries, __NR_CPUS__);
+} __augmented_syscalls__ SEC(".maps");
 
 /*
  * string_args_len: one per syscall arg, 0 means not a string or don't copy it,
@@ -29,24 +35,39 @@ bpf_map(__augmented_syscalls__, PERF_EVENT_ARRAY, int, u32, __NR_CPUS__);
  */
 struct syscall {
 	bool	enabled;
-	u16	string_args_len[6];
+	__u16	string_args_len[6];
 };
 
-bpf_map(syscalls, ARRAY, int, struct syscall, 512);
+struct syscalls {
+	__uint(type, BPF_MAP_TYPE_ARRAY);
+	__type(key, int);
+	__type(value, struct syscall);
+	__uint(max_entries, 512);
+} syscalls SEC(".maps");
 
 /*
  * What to augment at entry?
  *
  * Pointer arg payloads (filenames, etc) passed from userspace to the kernel
  */
-bpf_map(syscalls_sys_enter, PROG_ARRAY, u32, u32, 512);
+struct syscalls_sys_enter {
+	__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
+	__type(key, __u32);
+	__type(value, __u32);
+	__uint(max_entries, 512);
+} syscalls_sys_enter SEC(".maps");
 
 /*
  * What to augment at exit?
  *
  * Pointer arg payloads returned from the kernel (struct stat, etc) to userspace.
  */
-bpf_map(syscalls_sys_exit, PROG_ARRAY, u32, u32, 512);
+struct syscalls_sys_exit {
+	__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
+	__type(key, __u32);
+	__type(value, __u32);
+	__uint(max_entries, 512);
+} syscalls_sys_exit SEC(".maps");
 
 struct syscall_enter_args {
 	unsigned long long common_tp_fields;
@@ -66,7 +87,12 @@ struct augmented_arg {
 	char		value[PATH_MAX];
 };
 
-pid_filter(pids_filtered);
+struct pids_filtered {
+	__uint(type, BPF_MAP_TYPE_HASH);
+	__type(key, pid_t);
+	__type(value, bool);
+	__uint(max_entries, 64);
+} pids_filtered SEC(".maps");
 
 struct augmented_args_payload {
        struct syscall_enter_args args;
@@ -79,7 +105,12 @@ struct augmented_args_payload {
 };
 
 // We need more tmp space than the BPF stack can give us
-bpf_map(augmented_args_tmp, PERCPU_ARRAY, int, struct augmented_args_payload, 1);
+struct augmented_args_tmp {
+	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
+	__type(key, int);
+	__type(value, struct augmented_args_payload);
+	__uint(max_entries, 1);
+} augmented_args_tmp SEC(".maps");
 
 static inline struct augmented_args_payload *augmented_args_payload(void)
 {
@@ -90,14 +121,14 @@ static inline struct augmented_args_payload *augmented_args_payload(void)
 static inline int augmented__output(void *ctx, struct augmented_args_payload *args, int len)
 {
 	/* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */
-	return perf_event_output(ctx, &__augmented_syscalls__, BPF_F_CURRENT_CPU, args, len);
+	return bpf_perf_event_output(ctx, &__augmented_syscalls__, BPF_F_CURRENT_CPU, args, len);
 }
 
 static inline
 unsigned int augmented_arg__read_str(struct augmented_arg *augmented_arg, const void *arg, unsigned int arg_len)
 {
 	unsigned int augmented_len = sizeof(*augmented_arg);
-	int string_len = probe_read_str(&augmented_arg->value, arg_len, arg);
+	int string_len = bpf_probe_read_str(&augmented_arg->value, arg_len, arg);
 
 	augmented_arg->size = augmented_arg->err = 0;
 	/*
@@ -146,7 +177,7 @@ int sys_enter_connect(struct syscall_enter_args *args)
 	if (socklen > sizeof(augmented_args->saddr))
 		socklen = sizeof(augmented_args->saddr);
 
-	probe_read(&augmented_args->saddr, socklen, sockaddr_arg);
+	bpf_probe_read(&augmented_args->saddr, socklen, sockaddr_arg);
 
 	return augmented__output(args, augmented_args, len + socklen);
 }
@@ -165,7 +196,7 @@ int sys_enter_sendto(struct syscall_enter_args *args)
 	if (socklen > sizeof(augmented_args->saddr))
 		socklen = sizeof(augmented_args->saddr);
 
-	probe_read(&augmented_args->saddr, socklen, sockaddr_arg);
+	bpf_probe_read(&augmented_args->saddr, socklen, sockaddr_arg);
 
 	return augmented__output(args, augmented_args, len + socklen);
 }
@@ -234,6 +265,16 @@ int sys_enter_renameat(struct syscall_enter_args *args)
 	return augmented__output(args, augmented_args, len);
 }
 
+static pid_t getpid(void)
+{
+	return bpf_get_current_pid_tgid();
+}
+
+static bool pid_filter__has(struct pids_filtered *pids, pid_t pid)
+{
+	return bpf_map_lookup_elem(pids, &pid) != NULL;
+}
+
 SEC("raw_syscalls:sys_enter")
 int sys_enter(struct syscall_enter_args *args)
 {
@@ -257,7 +298,7 @@ int sys_enter(struct syscall_enter_args *args)
 	if (augmented_args == NULL)
 		return 1;
 
-	probe_read(&augmented_args->args, sizeof(augmented_args->args), args);
+	bpf_probe_read(&augmented_args->args, sizeof(augmented_args->args), args);
 
 	/*
 	 * Jump to syscall specific augmenter, even if the default one,
@@ -278,7 +319,7 @@ int sys_exit(struct syscall_exit_args *args)
 	if (pid_filter__has(&pids_filtered, getpid()))
 		return 0;
 
-	probe_read(&exit_args, sizeof(exit_args), args);
+	bpf_probe_read(&exit_args, sizeof(exit_args), args);
 	/*
 	 * Jump to syscall specific return augmenter, even if the default one,
 	 * "!raw_syscalls:unaugmented" that will just return 1 to return the
@@ -291,4 +332,4 @@ int sys_exit(struct syscall_exit_args *args)
 	return 0;
 }
 
-license(GPL);
+char _license[] SEC("license") = "GPL";
-- 
2.38.1.273.g43a17bfeac-goog

[PATCH v1 2/7] perf trace: Etcsnoop fix libbpf 1.0+ compatibility

[Ian Rogers]

Don't use deprecated and now broken map style. Avoid use of
tools/perf/include/bpf/bpf.h and use the more regular BPF headers.
Add "< 0" checks to fix BPF verifier failures about potentially
negative values being passed to bpf_perf_event_output. Add a
raw_syscalls:sys_enter to avoid the evlist being empty and causing
perf trace to exit during argument parsing.

Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/examples/bpf/etcsnoop.c | 41 ++++++++++++++++++++++++------
 1 file changed, 33 insertions(+), 8 deletions(-)

diff --git a/tools/perf/examples/bpf/etcsnoop.c b/tools/perf/examples/bpf/etcsnoop.c
index e81b535346c0..a04109d9b2b5 100644
--- a/tools/perf/examples/bpf/etcsnoop.c
+++ b/tools/perf/examples/bpf/etcsnoop.c
@@ -5,7 +5,7 @@
  *
  * Test it with:
  *
- * perf trace -e tools/perf/examples/bpf/augmented_syscalls.c cat /etc/passwd > /dev/null
+ * perf trace -e tools/perf/examples/bpf/etcsnoop.c cat /etc/passwd > /dev/null
  *
  * It'll catch some openat syscalls related to the dynamic linked and
  * the last one should be the one for '/etc/passwd'.
@@ -19,10 +19,17 @@
  * tools/perf/include/bpf/stdio.h.
  */
 
-#include <stdio.h>
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
 
 /* bpf-output associated map */
-bpf_map(__augmented_syscalls__, PERF_EVENT_ARRAY, int, u32, __NR_CPUS__);
+struct __augmented_syscalls__ {
+	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+	__type(key, int);
+	__type(value, __u32);
+	__uint(max_entries, __NR_CPUS__);
+} __augmented_syscalls__ SEC(".maps");
+
 
 struct augmented_filename {
 	int	size;
@@ -30,6 +37,9 @@ struct augmented_filename {
 	char	value[64];
 };
 
+#define syscall_enter(name) \
+	SEC("!syscalls:sys_enter_" #name) syscall_enter_ ## name
+
 #define augmented_filename_syscall_enter(syscall) 						\
 struct augmented_enter_##syscall##_args {			 				\
 	struct syscall_enter_##syscall##_args	args;				 		\
@@ -39,17 +49,25 @@ int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args)				\
 {												\
 	char etc[6] = "/etc/";									\
 	struct augmented_enter_##syscall##_args augmented_args = { .filename.reserved = 0, }; 	\
-	probe_read(&augmented_args.args, sizeof(augmented_args.args), args);			\
-	augmented_args.filename.size = probe_read_str(&augmented_args.filename.value, 		\
+	long size;										\
+												\
+	if (bpf_probe_read(&augmented_args.args, sizeof(augmented_args.args), args) < 0)	\
+		return -1;									\
+												\
+	size = bpf_probe_read_str(&augmented_args.filename.value,				\
 						      sizeof(augmented_args.filename.value), 	\
 						      args->filename_ptr); 			\
+	if (size < 0)										\
+		return -1;									\
+												\
+	augmented_args.filename.size = size;							\
 	if (__builtin_memcmp(augmented_args.filename.value, etc, 4) != 0)			\
 		return 0;									\
 	/* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */	\
-	return perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, 		\
+	return bpf_perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU,		\
 				 &augmented_args,						\
 				 (sizeof(augmented_args) - sizeof(augmented_args.filename.value) + \
-				 augmented_args.filename.size));				\
+				 size));				\
 }
 
 struct syscall_enter_openat_args {
@@ -73,4 +91,11 @@ struct syscall_enter_open_args {
 
 augmented_filename_syscall_enter(open);
 
-license(GPL);
+struct syscall_enter_args;
+
+SEC("raw_syscalls:sys_enter")
+int sys_enter(struct syscall_enter_args *args)
+{
+	return 0;
+}
+char _license[] SEC("license") = "GPL";
-- 
2.38.1.273.g43a17bfeac-goog

[PATCH v1 3/7] perf trace: Augmented syscalls fix libbpf 1.0+ compatibility

[Ian Rogers]

Don't use deprecated and now broken map style. Avoid use of
tools/perf/include/bpf/bpf.h and use the more regular BPF headers.
Add "< 0" checks to fix BPF verifier failures about potentially
negative values being passed to bpf_perf_event_output replacing an
existing mask. Add a raw_syscalls:sys_enter to avoid the evlist being
empty and causing perf trace to exit during argument parsing.

Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/examples/bpf/augmented_syscalls.c | 58 ++++++++++++++------
 1 file changed, 41 insertions(+), 17 deletions(-)

diff --git a/tools/perf/examples/bpf/augmented_syscalls.c b/tools/perf/examples/bpf/augmented_syscalls.c
index 524fdb8534b3..a809e1eab95d 100644
--- a/tools/perf/examples/bpf/augmented_syscalls.c
+++ b/tools/perf/examples/bpf/augmented_syscalls.c
@@ -16,11 +16,17 @@
  * contents of pointer arguments.
  */
 
-#include <stdio.h>
-#include <linux/socket.h>
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include <sys/socket.h>
 
 /* bpf-output associated map */
-bpf_map(__augmented_syscalls__, PERF_EVENT_ARRAY, int, u32, __NR_CPUS__);
+struct __augmented_syscalls__ {
+	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+	__type(key, int);
+	__type(value, __u32);
+	__uint(max_entries, __NR_CPUS__);
+} __augmented_syscalls__ SEC(".maps");
 
 struct syscall_exit_args {
 	unsigned long long common_tp_fields;
@@ -34,6 +40,12 @@ struct augmented_filename {
 	char		value[256];
 };
 
+#define syscall_enter(name)						\
+	SEC("!syscalls:sys_enter_" #name) syscall_enter_ ## name
+
+#define syscall_exit(name)					\
+	SEC("!syscalls:sys_exit_" #name) syscall_exit_ ## name
+
 #define augmented_filename_syscall(syscall)							\
 struct augmented_enter_##syscall##_args {			 				\
 	struct syscall_enter_##syscall##_args	args;				 		\
@@ -42,18 +54,23 @@ struct augmented_enter_##syscall##_args {			 				\
 int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args)				\
 {												\
 	struct augmented_enter_##syscall##_args augmented_args = { .filename.reserved = 0, }; 	\
-	unsigned int len = sizeof(augmented_args);						\
-	probe_read(&augmented_args.args, sizeof(augmented_args.args), args);			\
-	augmented_args.filename.size = probe_read_str(&augmented_args.filename.value, 		\
+	long size;										\
+												\
+	if (bpf_probe_read(&augmented_args.args, sizeof(augmented_args.args), args) < 0)	\
+		return -1;									\
+												\
+	size = bpf_probe_read_str(&augmented_args.filename.value,				\
 						      sizeof(augmented_args.filename.value), 	\
 						      args->filename_ptr); 			\
-	if (augmented_args.filename.size < sizeof(augmented_args.filename.value)) {		\
-		len -= sizeof(augmented_args.filename.value) - augmented_args.filename.size;	\
-		len &= sizeof(augmented_args.filename.value) - 1;				\
-	}											\
+	if (size < 0)										\
+		return -1;									\
+												\
+	augmented_args.filename.size = size;							\
 	/* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */	\
-	return perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, 		\
-				 &augmented_args, len);						\
+	return bpf_perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU,		\
+				 &augmented_args,						\
+				 (sizeof(augmented_args) - sizeof(augmented_args.filename.value) + \
+				 size));				\
 }												\
 int syscall_exit(syscall)(struct syscall_exit_args *args)					\
 {												\
@@ -106,7 +123,7 @@ augmented_filename_syscall(newstat);
 #define _K_SS_MAXSIZE 128
 #endif
 
-#define augmented_sockaddr_syscall(syscall)						\
+#define augmented_sockaddr_syscall(syscall)							\
 struct augmented_enter_##syscall##_args {			 				\
 	struct syscall_enter_##syscall##_args	args;				 		\
 	struct sockaddr_storage			addr;						\
@@ -115,14 +132,14 @@ int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args)				\
 {												\
 	struct augmented_enter_##syscall##_args augmented_args;				 	\
 	unsigned long addrlen = sizeof(augmented_args.addr);					\
-	probe_read(&augmented_args.args, sizeof(augmented_args.args), args);			\
+	bpf_probe_read(&augmented_args.args, sizeof(augmented_args.args), args);		\
 /* FIXME_CLANG_OPTIMIZATION_THAT_ACCESSES_USER_CONTROLLED_ADDRLEN_DESPITE_THIS_CHECK */		\
 /*	if (addrlen > augmented_args.args.addrlen)				     */		\
 /*		addrlen = augmented_args.args.addrlen;				     */		\
 /*										     */		\
-	probe_read(&augmented_args.addr, addrlen, args->addr_ptr); 				\
+	bpf_probe_read(&augmented_args.addr, addrlen, args->addr_ptr);				\
 	/* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */	\
-	return perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, 		\
+	return bpf_perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU,		\
 				 &augmented_args, 						\
 				sizeof(augmented_args) - sizeof(augmented_args.addr) + addrlen);\
 }												\
@@ -166,4 +183,11 @@ struct syscall_enter_sendto_args {
 
 augmented_sockaddr_syscall(sendto);
 
-license(GPL);
+struct syscall_enter_args;
+
+SEC("raw_syscalls:sys_enter")
+int sys_enter(struct syscall_enter_args *args)
+{
+	return 0;
+}
+char _license[] SEC("license") = "GPL";
-- 
2.38.1.273.g43a17bfeac-goog

[PATCH v1 4/7] perf trace: hello fix libbpf 1.0+ compatibility

[Ian Rogers]

Don't use deprecated and now broken map style. Avoid use of
tools/perf/include/bpf/bpf.h and use the more regular BPF headers.
Switch to raw_syscalls:sys_enter to avoid the evlist being
empty and fixing generating output.

Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/examples/bpf/hello.c | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/tools/perf/examples/bpf/hello.c b/tools/perf/examples/bpf/hello.c
index cf3c2fdc7f79..e9080b0df158 100644
--- a/tools/perf/examples/bpf/hello.c
+++ b/tools/perf/examples/bpf/hello.c
@@ -1,9 +1,27 @@
-#include <stdio.h>
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
 
-int syscall_enter(openat)(void *args)
+struct __bpf_stdout__ {
+	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+	__type(key, int);
+	__type(value, __u32);
+	__uint(max_entries, __NR_CPUS__);
+} __bpf_stdout__ SEC(".maps");
+
+#define puts(from) \
+	({ const int __len = sizeof(from); \
+	   char __from[sizeof(from)] = from;			\
+	   bpf_perf_event_output(args, &__bpf_stdout__, BPF_F_CURRENT_CPU, \
+			  &__from, __len & (sizeof(from) - 1)); })
+
+struct syscall_enter_args;
+
+SEC("raw_syscalls:sys_enter")
+int sys_enter(struct syscall_enter_args *args)
 {
 	puts("Hello, world\n");
 	return 0;
 }
 
-license(GPL);
+char _license[] SEC("license") = "GPL";
-- 
2.38.1.273.g43a17bfeac-goog

[PATCH v1 5/7] perf trace: empty fix libbpf 1.0+ compatibility

[Ian Rogers]

Avoid use of tools/perf/include/bpf/bpf.h and use the more regular BPF
headers.  Add raw_syscalls:sys_enter to avoid the evlist being empty.

Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/examples/bpf/empty.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/tools/perf/examples/bpf/empty.c b/tools/perf/examples/bpf/empty.c
index 7d7fb0c9fe76..3e296c0c53d7 100644
--- a/tools/perf/examples/bpf/empty.c
+++ b/tools/perf/examples/bpf/empty.c
@@ -1,3 +1,12 @@
-#include <bpf/bpf.h>
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
 
-license(GPL);
+struct syscall_enter_args;
+
+SEC("raw_syscalls:sys_enter")
+int sys_enter(struct syscall_enter_args *args)
+{
+	return 0;
+}
+char _license[] SEC("license") = "GPL";
-- 
2.38.1.273.g43a17bfeac-goog

[PATCH v1 6/7] perf trace: 5sec fix libbpf 1.0+ compatibility

[Ian Rogers]

Avoid use of tools/perf/include/bpf/bpf.h and use the more regular BPF
headers.

Note, on testing the probe was unable to attach and the program failed.

Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/examples/bpf/5sec.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tools/perf/examples/bpf/5sec.c b/tools/perf/examples/bpf/5sec.c
index e6b6181c6dc6..f22312c64713 100644
--- a/tools/perf/examples/bpf/5sec.c
+++ b/tools/perf/examples/bpf/5sec.c
@@ -39,13 +39,15 @@
    Copyright (C) 2018 Red Hat, Inc., Arnaldo Carvalho de Melo <acme@redhat.com>
 */
 
-#include <bpf.h>
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
 
 #define NSEC_PER_SEC	1000000000L
 
-int probe(hrtimer_nanosleep, rqtp)(void *ctx, int err, long long sec)
+SEC("hrtimer_nanosleep=hrtimer_nanosleep rqtp")
+int hrtimer_nanosleep(void *ctx, int err, long long sec)
 {
 	return sec / NSEC_PER_SEC == 5ULL;
 }
+char _license[] SEC("license") = "GPL";
 
-license(GPL);
-- 
2.38.1.273.g43a17bfeac-goog

[PATCH v1 7/7] perf bpf: Remove now unused BPF headers

[Ian Rogers]

Example code has migrated to use standard BPF header files, remove
unnecessary perf equivalents. Update install step to not try to copy
these.

Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/Makefile.perf              |  5 --
 tools/perf/include/bpf/bpf.h          | 70 ---------------------------
 tools/perf/include/bpf/linux/socket.h | 24 ---------
 tools/perf/include/bpf/pid_filter.h   | 21 --------
 tools/perf/include/bpf/stdio.h        | 16 ------
 tools/perf/include/bpf/unistd.h       | 10 ----
 6 files changed, 146 deletions(-)
 delete mode 100644 tools/perf/include/bpf/bpf.h
 delete mode 100644 tools/perf/include/bpf/linux/socket.h
 delete mode 100644 tools/perf/include/bpf/pid_filter.h
 delete mode 100644 tools/perf/include/bpf/stdio.h
 delete mode 100644 tools/perf/include/bpf/unistd.h

diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index a432e59afc42..67819f905611 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -960,11 +960,6 @@ endif
 	$(call QUIET_INSTALL, libexec) \
 		$(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perfexec_instdir_SQ)'
 ifndef NO_LIBBPF
-	$(call QUIET_INSTALL, bpf-headers) \
-		$(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perf_include_instdir_SQ)/bpf'; \
-		$(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perf_include_instdir_SQ)/bpf/linux'; \
-		$(INSTALL) include/bpf/*.h -m 644 -t '$(DESTDIR_SQ)$(perf_include_instdir_SQ)/bpf'; \
-		$(INSTALL) include/bpf/linux/*.h -m 644 -t '$(DESTDIR_SQ)$(perf_include_instdir_SQ)/bpf/linux'
 	$(call QUIET_INSTALL, bpf-examples) \
 		$(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perf_examples_instdir_SQ)/bpf'; \
 		$(INSTALL) examples/bpf/*.c -m 644 -t '$(DESTDIR_SQ)$(perf_examples_instdir_SQ)/bpf'
diff --git a/tools/perf/include/bpf/bpf.h b/tools/perf/include/bpf/bpf.h
deleted file mode 100644
index b422aeef5339..000000000000
--- a/tools/perf/include/bpf/bpf.h
+++ /dev/null
@@ -1,70 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-#ifndef _PERF_BPF_H
-#define _PERF_BPF_H
-
-#include <uapi/linux/bpf.h>
-
-/*
- * A helper structure used by eBPF C program to describe map attributes to
- * elf_bpf loader, taken from tools/testing/selftests/bpf/bpf_helpers.h:
- */
-struct bpf_map {
-        unsigned int type;
-        unsigned int key_size;
-        unsigned int value_size;
-        unsigned int max_entries;
-        unsigned int map_flags;
-        unsigned int inner_map_idx;
-        unsigned int numa_node;
-};
-
-#define bpf_map(name, _type, type_key, type_val, _max_entries)	\
-struct bpf_map SEC("maps") name = {				\
-	.type	     = BPF_MAP_TYPE_##_type,			\
-	.key_size    = sizeof(type_key),			\
-	.value_size  = sizeof(type_val),			\
-	.max_entries = _max_entries,				\
-};								\
-struct ____btf_map_##name {					\
-	type_key key;						\
-	type_val value;                                 	\
-};								\
-struct ____btf_map_##name __attribute__((section(".maps." #name), used)) \
-	____btf_map_##name = { }
-
-/*
- * FIXME: this should receive .max_entries as a parameter, as careful
- *	  tuning of these limits is needed to avoid hitting limits that
- *	  prevents other BPF constructs, such as tracepoint handlers,
- *	  to get installed, with cryptic messages from libbpf, etc.
- *	  For the current need, 'perf trace --filter-pids', 64 should
- *	  be good enough, but this surely needs to be revisited.
- */
-#define pid_map(name, value_type) bpf_map(name, HASH, pid_t, value_type, 64)
-
-static int (*bpf_map_update_elem)(struct bpf_map *map, void *key, void *value, u64 flags) = (void *)BPF_FUNC_map_update_elem;
-static void *(*bpf_map_lookup_elem)(struct bpf_map *map, void *key) = (void *)BPF_FUNC_map_lookup_elem;
-
-static void (*bpf_tail_call)(void *ctx, void *map, int index) = (void *)BPF_FUNC_tail_call;
-
-#define SEC(NAME) __attribute__((section(NAME),  used))
-
-#define probe(function, vars) \
-	SEC(#function "=" #function " " #vars) function
-
-#define syscall_enter(name) \
-	SEC("syscalls:sys_enter_" #name) syscall_enter_ ## name
-
-#define syscall_exit(name) \
-	SEC("syscalls:sys_exit_" #name) syscall_exit_ ## name
-
-#define license(name) \
-char _license[] SEC("license") = #name; \
-int _version SEC("version") = LINUX_VERSION_CODE;
-
-static int (*probe_read)(void *dst, int size, const void *unsafe_addr) = (void *)BPF_FUNC_probe_read;
-static int (*probe_read_str)(void *dst, int size, const void *unsafe_addr) = (void *)BPF_FUNC_probe_read_str;
-
-static int (*perf_event_output)(void *, struct bpf_map *, int, void *, unsigned long) = (void *)BPF_FUNC_perf_event_output;
-
-#endif /* _PERF_BPF_H */
diff --git a/tools/perf/include/bpf/linux/socket.h b/tools/perf/include/bpf/linux/socket.h
deleted file mode 100644
index 7f844568dab8..000000000000
--- a/tools/perf/include/bpf/linux/socket.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#ifndef _UAPI_LINUX_SOCKET_H
-#define _UAPI_LINUX_SOCKET_H
-
-/*
- * Desired design of maximum size and alignment (see RFC2553)
- */
-#define _K_SS_MAXSIZE	128	/* Implementation specific max size */
-#define _K_SS_ALIGNSIZE	(__alignof__ (struct sockaddr *))
-				/* Implementation specific desired alignment */
-
-typedef unsigned short __kernel_sa_family_t;
-
-struct __kernel_sockaddr_storage {
-	__kernel_sa_family_t	ss_family;		/* address family */
-	/* Following field(s) are implementation specific */
-	char		__data[_K_SS_MAXSIZE - sizeof(unsigned short)];
-				/* space to achieve desired size, */
-				/* _SS_MAXSIZE value minus size of ss_family */
-} __attribute__ ((aligned(_K_SS_ALIGNSIZE)));	/* force desired alignment */
-
-#define sockaddr_storage __kernel_sockaddr_storage
-
-#endif /* _UAPI_LINUX_SOCKET_H */
diff --git a/tools/perf/include/bpf/pid_filter.h b/tools/perf/include/bpf/pid_filter.h
deleted file mode 100644
index 6e61c4bdf548..000000000000
--- a/tools/perf/include/bpf/pid_filter.h
+++ /dev/null
@@ -1,21 +0,0 @@
-// SPDX-License-Identifier: LGPL-2.1
-
-#ifndef _PERF_BPF_PID_FILTER_
-#define _PERF_BPF_PID_FILTER_
-
-#include <bpf.h>
-
-#define pid_filter(name) pid_map(name, bool)
-
-static int pid_filter__add(struct bpf_map *pids, pid_t pid)
-{
-	bool value = true;
-	return bpf_map_update_elem(pids, &pid, &value, BPF_NOEXIST);
-}
-
-static bool pid_filter__has(struct bpf_map *pids, pid_t pid)
-{
-	return bpf_map_lookup_elem(pids, &pid) != NULL;
-}
-
-#endif // _PERF_BPF_PID_FILTER_
diff --git a/tools/perf/include/bpf/stdio.h b/tools/perf/include/bpf/stdio.h
deleted file mode 100644
index 316af5b2ff35..000000000000
--- a/tools/perf/include/bpf/stdio.h
+++ /dev/null
@@ -1,16 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-
-#include <bpf.h>
-
-struct bpf_map SEC("maps") __bpf_stdout__ = {
-       .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
-       .key_size = sizeof(int),
-       .value_size = sizeof(u32),
-       .max_entries = __NR_CPUS__,
-};
-
-#define puts(from) \
-	({ const int __len = sizeof(from); \
-	   char __from[__len] = from; \
-	   perf_event_output(args, &__bpf_stdout__, BPF_F_CURRENT_CPU, \
-			  &__from, __len & (sizeof(from) - 1)); })
diff --git a/tools/perf/include/bpf/unistd.h b/tools/perf/include/bpf/unistd.h
deleted file mode 100644
index ca7877f9a976..000000000000
--- a/tools/perf/include/bpf/unistd.h
+++ /dev/null
@@ -1,10 +0,0 @@
-// SPDX-License-Identifier: LGPL-2.1
-
-#include <bpf.h>
-
-static int (*bpf_get_current_pid_tgid)(void) = (void *)BPF_FUNC_get_current_pid_tgid;
-
-static pid_t getpid(void)
-{
-	return bpf_get_current_pid_tgid();
-}
-- 
2.38.1.273.g43a17bfeac-goog

Re: [PATCH v1 6/7] perf trace: 5sec fix libbpf 1.0+ compatibility

[Arnaldo Carvalho de Melo]

Em Wed, Nov 02, 2022 at 09:54:36PM -0700, Ian Rogers escreveu:
> Avoid use of tools/perf/include/bpf/bpf.h and use the more regular BPF
> headers.
> 
> Note, on testing the probe was unable to attach and the program failed.

Humm, trying to test:

[root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.c |& head -15
In file included from /home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:
In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/bpf.h:9:
In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/workqueue.h:9:
In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/timer.h:6:
In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/ktime.h:24:
In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/time.h:6:
In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/math64.h:6:
In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/math.h:6:
/lib/modules/5.19.16-200.fc36.x86_64/build/./arch/x86/include/asm/div64.h:85:28: error: invalid output constraint '=a' in asm
        asm ("mulq %2; divq %3" : "=a" (q)
                                  ^
In file included from /home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:
In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/bpf.h:9:
In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/workqueue.h:9:
In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/timer.h:6:
[root@quaco ~]#

So I go and try to remove that <linux/bpf.h>:

[acme@quaco perf]$ git diff
diff --git a/tools/perf/examples/bpf/5sec.c b/tools/perf/examples/bpf/5sec.c
index 3bd7fc17631f0440..e0d5525c6a1374ae 100644
--- a/tools/perf/examples/bpf/5sec.c
+++ b/tools/perf/examples/bpf/5sec.c
@@ -39,7 +39,6 @@
    Copyright (C) 2018 Red Hat, Inc., Arnaldo Carvalho de Melo <acme@redhat.com>
 */

-#include <linux/bpf.h>
 #include <bpf/bpf_helpers.h>

 #define NSEC_PER_SEC   1000000000L
[acme@quaco perf]$

[root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
/home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:10: fatal error: 'bpf/bpf_helpers.h' file not found
#include <bpf/bpf_helpers.h>
         ^~~~~~~~~~~~~~~~~~~
1 error generated.
ERROR:	unable to compile /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
Hint:	Check error message shown above.
Hint:	You can also pre-compile it into .o using:
     		clang -target bpf -O2 -c /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
     	with proper -I and -D options.
event syntax error: '/home/acme/git/perf/tools/perf/examples/bpf/5sec.c'
                     \___ Failed to load /home/acme/git/perf/tools/perf/examples/bpf/5sec.c from source: Error when compiling BPF scriptlet

(add -v to see detail)
Run 'perf list' for a list of valid events

 Usage: perf trace [<options>] [<command>]
    or: perf trace [<options>] -- <command> [<options>]
    or: perf trace record [<options>] [<command>]
    or: perf trace record [<options>] -- <command> [<options>]

    -e, --event <event>   event/syscall selector. use 'perf list' to list available events
[root@quaco ~]#

It is not even finding it, in this machine I have libbpf 0.7.0, so there
is a /usr/include/bpf/bpf_helpers.h, but probably that isn't in the
include path set up to build the tools/perf/examples/bpf/ files, perhaps
it should use:

-Itools/lib/  so that it gets tools/lib/bpf_helpers.h?

Trying to get this tested...

- Arnaldo
 
> Signed-off-by: Ian Rogers <irogers@google.com>
> ---
>  tools/perf/examples/bpf/5sec.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/perf/examples/bpf/5sec.c b/tools/perf/examples/bpf/5sec.c
> index e6b6181c6dc6..f22312c64713 100644
> --- a/tools/perf/examples/bpf/5sec.c
> +++ b/tools/perf/examples/bpf/5sec.c
> @@ -39,13 +39,15 @@
>     Copyright (C) 2018 Red Hat, Inc., Arnaldo Carvalho de Melo <acme@redhat.com>
>  */
>  
> -#include <bpf.h>
> +#include <linux/bpf.h>
> +#include <bpf/bpf_helpers.h>
>  
>  #define NSEC_PER_SEC	1000000000L
>  
> -int probe(hrtimer_nanosleep, rqtp)(void *ctx, int err, long long sec)
> +SEC("hrtimer_nanosleep=hrtimer_nanosleep rqtp")
> +int hrtimer_nanosleep(void *ctx, int err, long long sec)
>  {
>  	return sec / NSEC_PER_SEC == 5ULL;
>  }
> +char _license[] SEC("license") = "GPL";
>  
> -license(GPL);
> -- 
> 2.38.1.273.g43a17bfeac-goog

-- 

- Arnaldo

Re: [PATCH v1 6/7] perf trace: 5sec fix libbpf 1.0+ compatibility

[Arnaldo Carvalho de Melo]

Em Thu, Nov 03, 2022 at 12:36:36PM -0300, Arnaldo Carvalho de Melo escreveu:
> Em Wed, Nov 02, 2022 at 09:54:36PM -0700, Ian Rogers escreveu:
> > Avoid use of tools/perf/include/bpf/bpf.h and use the more regular BPF
> > headers.
> > 
> > Note, on testing the probe was unable to attach and the program failed.
> 
> Humm, trying to test:
> 
> [root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.c |& head -15
> In file included from /home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:
> In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/bpf.h:9:
> In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/workqueue.h:9:
> In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/timer.h:6:
> In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/ktime.h:24:
> In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/time.h:6:
> In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/math64.h:6:
> In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/math.h:6:
> /lib/modules/5.19.16-200.fc36.x86_64/build/./arch/x86/include/asm/div64.h:85:28: error: invalid output constraint '=a' in asm
>         asm ("mulq %2; divq %3" : "=a" (q)
>                                   ^
> In file included from /home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:
> In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/bpf.h:9:
> In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/workqueue.h:9:
> In file included from /lib/modules/5.19.16-200.fc36.x86_64/build/./include/linux/timer.h:6:
> [root@quaco ~]#
> 
> So I go and try to remove that <linux/bpf.h>:
> 
> [acme@quaco perf]$ git diff
> diff --git a/tools/perf/examples/bpf/5sec.c b/tools/perf/examples/bpf/5sec.c
> index 3bd7fc17631f0440..e0d5525c6a1374ae 100644
> --- a/tools/perf/examples/bpf/5sec.c
> +++ b/tools/perf/examples/bpf/5sec.c
> @@ -39,7 +39,6 @@
>     Copyright (C) 2018 Red Hat, Inc., Arnaldo Carvalho de Melo <acme@redhat.com>
>  */
> 
> -#include <linux/bpf.h>
>  #include <bpf/bpf_helpers.h>
> 
>  #define NSEC_PER_SEC   1000000000L
> [acme@quaco perf]$
> 
> [root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
> /home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:10: fatal error: 'bpf/bpf_helpers.h' file not found
> #include <bpf/bpf_helpers.h>
>          ^~~~~~~~~~~~~~~~~~~
> 1 error generated.
> ERROR:	unable to compile /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
> Hint:	Check error message shown above.
> Hint:	You can also pre-compile it into .o using:
>      		clang -target bpf -O2 -c /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
>      	with proper -I and -D options.
> event syntax error: '/home/acme/git/perf/tools/perf/examples/bpf/5sec.c'
>                      \___ Failed to load /home/acme/git/perf/tools/perf/examples/bpf/5sec.c from source: Error when compiling BPF scriptlet
> 
> (add -v to see detail)
> Run 'perf list' for a list of valid events
> 
>  Usage: perf trace [<options>] [<command>]
>     or: perf trace [<options>] -- <command> [<options>]
>     or: perf trace record [<options>] [<command>]
>     or: perf trace record [<options>] -- <command> [<options>]
> 
>     -e, --event <event>   event/syscall selector. use 'perf list' to list available events
> [root@quaco ~]#
> 
> It is not even finding it, in this machine I have libbpf 0.7.0, so there
> is a /usr/include/bpf/bpf_helpers.h, but probably that isn't in the
> include path set up to build the tools/perf/examples/bpf/ files, perhaps
> it should use:
> 
> -Itools/lib/  so that it gets tools/lib/bpf_helpers.h?
> 
> Trying to get this tested...

Running with -v:

llvm compiling command : /usr/lib64/ccache/clang -D__KERNEL__ -D__NR_CPUS__=8 -DLINUX_VERSION_CODE=0x51310 -g -I/home/acme/lib/perf/include/bpf -nostdinc -I./arch/x86/include -I./arch/x86/include/generated  -I./include -I./arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/compiler-version.h -include ./include/linux/kconfig.h  -Wno-unused-value -Wno-pointer-sign -working-directory /lib/modules/5.19.16-200.fc36.x86_64/build -c /home/acme/git/perf/tools/perf/examples/bpf/5sec.c -target bpf  -g -O2 -o -
/home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:10: fatal error: 'bpf/bpf_helpers.h' file not found

There is still that -I/home/acme/lib/perf/include/bpf, I'll remove it
from the include path and try to replace it with the libbpf path...

- Arnaldo

Re: [PATCH v1 6/7] perf trace: 5sec fix libbpf 1.0+ compatibility

[Arnaldo Carvalho de Melo]

Em Thu, Nov 03, 2022 at 12:39:59PM -0300, Arnaldo Carvalho de Melo escreveu:
> Em Thu, Nov 03, 2022 at 12:36:36PM -0300, Arnaldo Carvalho de Melo escreveu:
> > [root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
> > /home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:10: fatal error: 'bpf/bpf_helpers.h' file not found
> > #include <bpf/bpf_helpers.h>
> >          ^~~~~~~~~~~~~~~~~~~
> > 1 error generated.
> > ERROR:	unable to compile /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
> > Hint:	Check error message shown above.
> > Hint:	You can also pre-compile it into .o using:
> >      		clang -target bpf -O2 -c /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
> >      	with proper -I and -D options.
> > event syntax error: '/home/acme/git/perf/tools/perf/examples/bpf/5sec.c'
> >                      \___ Failed to load /home/acme/git/perf/tools/perf/examples/bpf/5sec.c from source: Error when compiling BPF scriptlet
> > 
> > (add -v to see detail)
> > Run 'perf list' for a list of valid events
> > 
> >  Usage: perf trace [<options>] [<command>]
> >     or: perf trace [<options>] -- <command> [<options>]
> >     or: perf trace record [<options>] [<command>]
> >     or: perf trace record [<options>] -- <command> [<options>]
> > 
> >     -e, --event <event>   event/syscall selector. use 'perf list' to list available events
> > [root@quaco ~]#
> > 
> > It is not even finding it, in this machine I have libbpf 0.7.0, so there
> > is a /usr/include/bpf/bpf_helpers.h, but probably that isn't in the
> > include path set up to build the tools/perf/examples/bpf/ files, perhaps
> > it should use:
> > 
> > -Itools/lib/  so that it gets tools/lib/bpf_helpers.h?
> > 
> > Trying to get this tested...
> 
> Running with -v:
> 
> llvm compiling command : /usr/lib64/ccache/clang -D__KERNEL__ -D__NR_CPUS__=8 -DLINUX_VERSION_CODE=0x51310 -g -I/home/acme/lib/perf/include/bpf -nostdinc -I./arch/x86/include -I./arch/x86/include/generated  -I./include -I./arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/compiler-version.h -include ./include/linux/kconfig.h  -Wno-unused-value -Wno-pointer-sign -working-directory /lib/modules/5.19.16-200.fc36.x86_64/build -c /home/acme/git/perf/tools/perf/examples/bpf/5sec.c -target bpf  -g -O2 -o -
> /home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:10: fatal error: 'bpf/bpf_helpers.h' file not found
> 
> There is still that -I/home/acme/lib/perf/include/bpf, I'll remove it
> from the include path and try to replace it with the libbpf path...

Ok, works with the patch below, that needs some more renaming from "perf_" to
"libbpf_", etc:

[root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.c  sleep 5
     0.000 sleep/160828 perf_bpf_probe:hrtimer_nanosleep(__probe_ip: -1474734416, rqtp: 5000000000)
[root@quaco ~]#

Since I have:

[root@quaco ~]# cat ~/.perfconfig
[llvm]
	dump-obj = true
	clang-opt = -g
#

I end up with:

[root@quaco ~]# ls -la /home/acme/git/perf/tools/perf/examples/bpf/5sec.o
-rw-r--r--. 1 root root 3696 Nov  3 12:47 /home/acme/git/perf/tools/perf/examples/bpf/5sec.o
[root@quaco ~]# file /home/acme/git/perf/tools/perf/examples/bpf/5sec.o
/home/acme/git/perf/tools/perf/examples/bpf/5sec.o: ELF 64-bit LSB relocatable, eBPF, version 1 (SYSV), with debug_info, not stripped
[root@quaco ~]#

and can test with the pre-built .o eBPF bytecode + capped backtrace:

[root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.o/max-stack=6/  sleep 5
     0.000 sleep/161037 perf_bpf_probe:hrtimer_nanosleep(__probe_ip: -1474734416, rqtp: 5000000000)
                                       hrtimer_nanosleep ([kernel.kallsyms])
                                       common_nsleep ([kernel.kallsyms])
                                       __x64_sys_clock_nanosleep ([kernel.kallsyms])
                                       do_syscall_64 ([kernel.kallsyms])
                                       entry_SYSCALL_64_after_hwframe ([kernel.kallsyms])
                                       __GI___clock_nanosleep (/usr/lib64/libc.so.6)
[root@quaco ~]#

I'll test the other examples with these changes after I drive Pedro to
school and get back to the office.

- Arnaldo

diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
index d3d3c13a9f25b55c..067a6e56eeacc9fc 100644
--- a/tools/perf/Makefile.config
+++ b/tools/perf/Makefile.config
@@ -1239,7 +1239,7 @@ includedir = $(abspath $(prefix)/$(includedir_relative))
 mandir = share/man
 infodir = share/info
 perfexecdir = libexec/perf-core
-perf_include_dir = lib/perf/include
+perf_include_dir = /usr/include
 perf_examples_dir = lib/perf/examples
 sharedir = $(prefix)/share
 template_dir = share/perf-core/templates
diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
index 2dc7970074196ca8..a5cac85783d8711f 100644
--- a/tools/perf/util/llvm-utils.c
+++ b/tools/perf/util/llvm-utils.c
@@ -495,7 +495,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
 
 	snprintf(linux_version_code_str, sizeof(linux_version_code_str),
 		 "0x%x", kernel_version);
-	if (asprintf(&perf_bpf_include_opts, "-I%s/bpf", perf_include_dir) < 0)
+	if (asprintf(&perf_bpf_include_opts, "-I%s/", perf_include_dir) < 0)
 		goto errout;
 	force_set_env("NR_CPUS", nr_cpus_avail_str);
 	force_set_env("LINUX_VERSION_CODE", linux_version_code_str);

Re: [PATCH v1 6/7] perf trace: 5sec fix libbpf 1.0+ compatibility

[Ian Rogers]

On Thu, Nov 3, 2022 at 8:52 AM Arnaldo Carvalho de Melo <acme@kernel.org> wrote:
>
> Em Thu, Nov 03, 2022 at 12:39:59PM -0300, Arnaldo Carvalho de Melo escreveu:
> > Em Thu, Nov 03, 2022 at 12:36:36PM -0300, Arnaldo Carvalho de Melo escreveu:
> > > [root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
> > > /home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:10: fatal error: 'bpf/bpf_helpers.h' file not found
> > > #include <bpf/bpf_helpers.h>
> > >          ^~~~~~~~~~~~~~~~~~~
> > > 1 error generated.
> > > ERROR:      unable to compile /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
> > > Hint:       Check error message shown above.
> > > Hint:       You can also pre-compile it into .o using:
> > >                     clang -target bpf -O2 -c /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
> > >             with proper -I and -D options.
> > > event syntax error: '/home/acme/git/perf/tools/perf/examples/bpf/5sec.c'
> > >                      \___ Failed to load /home/acme/git/perf/tools/perf/examples/bpf/5sec.c from source: Error when compiling BPF scriptlet
> > >
> > > (add -v to see detail)
> > > Run 'perf list' for a list of valid events
> > >
> > >  Usage: perf trace [<options>] [<command>]
> > >     or: perf trace [<options>] -- <command> [<options>]
> > >     or: perf trace record [<options>] [<command>]
> > >     or: perf trace record [<options>] -- <command> [<options>]
> > >
> > >     -e, --event <event>   event/syscall selector. use 'perf list' to list available events
> > > [root@quaco ~]#
> > >
> > > It is not even finding it, in this machine I have libbpf 0.7.0, so there
> > > is a /usr/include/bpf/bpf_helpers.h, but probably that isn't in the
> > > include path set up to build the tools/perf/examples/bpf/ files, perhaps
> > > it should use:
> > >
> > > -Itools/lib/  so that it gets tools/lib/bpf_helpers.h?
> > >
> > > Trying to get this tested...
> >
> > Running with -v:
> >
> > llvm compiling command : /usr/lib64/ccache/clang -D__KERNEL__ -D__NR_CPUS__=8 -DLINUX_VERSION_CODE=0x51310 -g -I/home/acme/lib/perf/include/bpf -nostdinc -I./arch/x86/include -I./arch/x86/include/generated  -I./include -I./arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/compiler-version.h -include ./include/linux/kconfig.h  -Wno-unused-value -Wno-pointer-sign -working-directory /lib/modules/5.19.16-200.fc36.x86_64/build -c /home/acme/git/perf/tools/perf/examples/bpf/5sec.c -target bpf  -g -O2 -o -
> > /home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:10: fatal error: 'bpf/bpf_helpers.h' file not found
> >
> > There is still that -I/home/acme/lib/perf/include/bpf, I'll remove it
> > from the include path and try to replace it with the libbpf path...
>
> Ok, works with the patch below, that needs some more renaming from "perf_" to
> "libbpf_", etc:
>
> [root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.c  sleep 5
>      0.000 sleep/160828 perf_bpf_probe:hrtimer_nanosleep(__probe_ip: -1474734416, rqtp: 5000000000)
> [root@quaco ~]#
>
> Since I have:
>
> [root@quaco ~]# cat ~/.perfconfig
> [llvm]
>         dump-obj = true
>         clang-opt = -g
> #
>
> I end up with:
>
> [root@quaco ~]# ls -la /home/acme/git/perf/tools/perf/examples/bpf/5sec.o
> -rw-r--r--. 1 root root 3696 Nov  3 12:47 /home/acme/git/perf/tools/perf/examples/bpf/5sec.o
> [root@quaco ~]# file /home/acme/git/perf/tools/perf/examples/bpf/5sec.o
> /home/acme/git/perf/tools/perf/examples/bpf/5sec.o: ELF 64-bit LSB relocatable, eBPF, version 1 (SYSV), with debug_info, not stripped
> [root@quaco ~]#
>
> and can test with the pre-built .o eBPF bytecode + capped backtrace:
>
> [root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.o/max-stack=6/  sleep 5
>      0.000 sleep/161037 perf_bpf_probe:hrtimer_nanosleep(__probe_ip: -1474734416, rqtp: 5000000000)
>                                        hrtimer_nanosleep ([kernel.kallsyms])
>                                        common_nsleep ([kernel.kallsyms])
>                                        __x64_sys_clock_nanosleep ([kernel.kallsyms])
>                                        do_syscall_64 ([kernel.kallsyms])
>                                        entry_SYSCALL_64_after_hwframe ([kernel.kallsyms])
>                                        __GI___clock_nanosleep (/usr/lib64/libc.so.6)
> [root@quaco ~]#
>
> I'll test the other examples with these changes after I drive Pedro to
> school and get back to the office.

Thanks, I was somewhat coding in the dark with this as I was using a
bpf object file and clearly there's been some attention missed for a
while in these code paths. I couldn't get the hello variant to do
anything with the openat tracing it was set up for, for example, the
change puts the call on the sys_enter raw syscall. I suspect you
remember how these things should be and I'm happy to roll a v2, have
you fix it, etc.

Fwiw, two things I'd like to see further here is somehow the augmented
code to be the default (with a BPF skeleton possibly) and an ability
for perf_event_open tracing to dump the perf_event_attr. I'm unclear
on the advantages of having different augmenters. Perhaps we could
just drop support for different augmenters, use BPF skeletons for the
raw syscall version and keep the BPF logic in parse events for adding
filters - the process of doing augmentation isn't clear to me even
after having produced these changes. There is quite a bit of plumbing
necessary to remove the notion that the BPF object comes from event
parsing and I suspect to achieve this in the current code there is
some overhead that the skeleton could remove - like the empty
sys_enter functions I added.

Anyway, fixing libbpf 1.0+ and removing a header file called bpf.h
were what I was after achieving here :-)

Thanks,
Ian


> - Arnaldo
>
> diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
> index d3d3c13a9f25b55c..067a6e56eeacc9fc 100644
> --- a/tools/perf/Makefile.config
> +++ b/tools/perf/Makefile.config
> @@ -1239,7 +1239,7 @@ includedir = $(abspath $(prefix)/$(includedir_relative))
>  mandir = share/man
>  infodir = share/info
>  perfexecdir = libexec/perf-core
> -perf_include_dir = lib/perf/include
> +perf_include_dir = /usr/include
>  perf_examples_dir = lib/perf/examples
>  sharedir = $(prefix)/share
>  template_dir = share/perf-core/templates
> diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
> index 2dc7970074196ca8..a5cac85783d8711f 100644
> --- a/tools/perf/util/llvm-utils.c
> +++ b/tools/perf/util/llvm-utils.c
> @@ -495,7 +495,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
>
>         snprintf(linux_version_code_str, sizeof(linux_version_code_str),
>                  "0x%x", kernel_version);
> -       if (asprintf(&perf_bpf_include_opts, "-I%s/bpf", perf_include_dir) < 0)
> +       if (asprintf(&perf_bpf_include_opts, "-I%s/", perf_include_dir) < 0)
>                 goto errout;
>         force_set_env("NR_CPUS", nr_cpus_avail_str);
>         force_set_env("LINUX_VERSION_CODE", linux_version_code_str);

Re: [PATCH v1 6/7] perf trace: 5sec fix libbpf 1.0+ compatibility

[Arnaldo Carvalho de Melo]

Em Thu, Nov 03, 2022 at 09:04:49AM -0700, Ian Rogers escreveu:
> On Thu, Nov 3, 2022 at 8:52 AM Arnaldo Carvalho de Melo <acme@kernel.org> wrote:
> > Em Thu, Nov 03, 2022 at 12:39:59PM -0300, Arnaldo Carvalho de Melo escreveu:
> > > Em Thu, Nov 03, 2022 at 12:36:36PM -0300, Arnaldo Carvalho de Melo escreveu:
> > > > [root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
> > > > /home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:10: fatal error: 'bpf/bpf_helpers.h' file not found
> > > > #include <bpf/bpf_helpers.h>
> > > >          ^~~~~~~~~~~~~~~~~~~
> > > > 1 error generated.
> > > > ERROR:      unable to compile /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
> > > > Hint:       Check error message shown above.
> > > > Hint:       You can also pre-compile it into .o using:
> > > >                     clang -target bpf -O2 -c /home/acme/git/perf/tools/perf/examples/bpf/5sec.c
> > > >             with proper -I and -D options.
> > > > event syntax error: '/home/acme/git/perf/tools/perf/examples/bpf/5sec.c'
> > > >                      \___ Failed to load /home/acme/git/perf/tools/perf/examples/bpf/5sec.c from source: Error when compiling BPF scriptlet
> > > >
> > > > (add -v to see detail)
> > > > Run 'perf list' for a list of valid events
> > > >
> > > >  Usage: perf trace [<options>] [<command>]
> > > >     or: perf trace [<options>] -- <command> [<options>]
> > > >     or: perf trace record [<options>] [<command>]
> > > >     or: perf trace record [<options>] -- <command> [<options>]
> > > >
> > > >     -e, --event <event>   event/syscall selector. use 'perf list' to list available events
> > > > [root@quaco ~]#
> > > >
> > > > It is not even finding it, in this machine I have libbpf 0.7.0, so there
> > > > is a /usr/include/bpf/bpf_helpers.h, but probably that isn't in the
> > > > include path set up to build the tools/perf/examples/bpf/ files, perhaps
> > > > it should use:
> > > >
> > > > -Itools/lib/  so that it gets tools/lib/bpf_helpers.h?
> > > >
> > > > Trying to get this tested...
> > >
> > > Running with -v:
> > >
> > > llvm compiling command : /usr/lib64/ccache/clang -D__KERNEL__ -D__NR_CPUS__=8 -DLINUX_VERSION_CODE=0x51310 -g -I/home/acme/lib/perf/include/bpf -nostdinc -I./arch/x86/include -I./arch/x86/include/generated  -I./include -I./arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/compiler-version.h -include ./include/linux/kconfig.h  -Wno-unused-value -Wno-pointer-sign -working-directory /lib/modules/5.19.16-200.fc36.x86_64/build -c /home/acme/git/perf/tools/perf/examples/bpf/5sec.c -target bpf  -g -O2 -o -
> > > /home/acme/git/perf/tools/perf/examples/bpf/5sec.c:42:10: fatal error: 'bpf/bpf_helpers.h' file not found
> > >
> > > There is still that -I/home/acme/lib/perf/include/bpf, I'll remove it
> > > from the include path and try to replace it with the libbpf path...
> >
> > Ok, works with the patch below, that needs some more renaming from "perf_" to
> > "libbpf_", etc:
> >
> > [root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.c  sleep 5
> >      0.000 sleep/160828 perf_bpf_probe:hrtimer_nanosleep(__probe_ip: -1474734416, rqtp: 5000000000)
> > [root@quaco ~]#
> >
> > Since I have:
> >
> > [root@quaco ~]# cat ~/.perfconfig
> > [llvm]
> >         dump-obj = true
> >         clang-opt = -g
> > #

> > I end up with:

> > [root@quaco ~]# ls -la /home/acme/git/perf/tools/perf/examples/bpf/5sec.o
> > -rw-r--r--. 1 root root 3696 Nov  3 12:47 /home/acme/git/perf/tools/perf/examples/bpf/5sec.o
> > [root@quaco ~]# file /home/acme/git/perf/tools/perf/examples/bpf/5sec.o
> > /home/acme/git/perf/tools/perf/examples/bpf/5sec.o: ELF 64-bit LSB relocatable, eBPF, version 1 (SYSV), with debug_info, not stripped
> > [root@quaco ~]#

> > and can test with the pre-built .o eBPF bytecode + capped backtrace:

> > [root@quaco ~]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/5sec.o/max-stack=6/  sleep 5
> >      0.000 sleep/161037 perf_bpf_probe:hrtimer_nanosleep(__probe_ip: -1474734416, rqtp: 5000000000)
> >                                        hrtimer_nanosleep ([kernel.kallsyms])
> >                                        common_nsleep ([kernel.kallsyms])
> >                                        __x64_sys_clock_nanosleep ([kernel.kallsyms])
> >                                        do_syscall_64 ([kernel.kallsyms])
> >                                        entry_SYSCALL_64_after_hwframe ([kernel.kallsyms])
> >                                        __GI___clock_nanosleep (/usr/lib64/libc.so.6)
> > [root@quaco ~]#

> > I'll test the other examples with these changes after I drive Pedro to
> > school and get back to the office.

> Thanks, I was somewhat coding in the dark with this as I was using a
> bpf object file and clearly there's been some attention missed for a
> while in these code paths.

Sure, the way libbpf provided its services has been changing.

> I couldn't get the hello variant to do anything with the openat
> tracing it was set up for, for example, the change puts the call on
> the sys_enter raw syscall. I suspect you remember how these things
> should be and I'm happy to roll a v2, have you fix it, etc.

So, with my change:

[root@quaco ~]# perf trace -e ~acme/git/perf/tools/perf/examples/bpf/hello.c --call-graph=dwarf sleep 0.09
BFD: DWARF error: could not find variable specification at offset 0x6ed3
BFD: DWARF error: could not find variable specification at offset 0x3ca3
BFD: DWARF error: could not find variable specification at offset 0x1b8f
BFD: DWARF error: could not find variable specification at offset 0x3853
BFD: DWARF error: could not find variable specification at offset 0x71eb
     0.000 sleep/167762 __bpf_stdout__(Hello, world)
                                       syscall_trace_enter.constprop.0 ([kernel.kallsyms])
                                       syscall_trace_enter.constprop.0 ([kernel.kallsyms])
                                       do_syscall_64 ([kernel.kallsyms])
                                       entry_SYSCALL_64_after_hwframe ([kernel.kallsyms])
                                       __brk (/usr/lib64/ld-linux-x86-64.so.2)
                                       _dl_sysdep_start (/usr/lib64/ld-linux-x86-64.so.2)
                                       _dl_start_final (inlined)
                                       _dl_start (/usr/lib64/ld-linux-x86-64.so.2)
                                       _start (/usr/lib64/ld-linux-x86-64.so.2)
BFD: DWARF error: could not find variable specification at offset 0x3e33
BFD: DWARF error: could not find variable specification at offset 0x4eef
BFD: DWARF error: could not find variable specification at offset 0x6edf
     0.021 sleep/167762 __bpf_stdout__(Hello, world)
                                       syscall_trace_enter.constprop.0 ([kernel.kallsyms])
                                       syscall_trace_enter.constprop.0 ([kernel.kallsyms])
                                       do_syscall_64 ([kernel.kallsyms])
                                       entry_SYSCALL_64_after_hwframe ([kernel.kallsyms])
                                       get_cet_status (inlined)
                                       init_cpu_features (inlined)
                                       dl_platform_init (inlined)
                                       _dl_sysdep_start (/usr/lib64/ld-linux-x86-64.so.2)
                                       _dl_start_final (inlined)
                                       _dl_start (/usr/lib64/ld-linux-x86-64.so.2)
                                       _start (/usr/lib64/ld-linux-x86-64.so.2)
     0.040 sleep/167762 __bpf_stdout__(Hello, world)
                                       syscall_trace_enter.constprop.0 ([kernel.kallsyms])
                                       syscall_trace_enter.constprop.0 ([kernel.kallsyms])
                                       do_syscall_64 ([kernel.kallsyms])
                                       entry_SYSCALL_64_after_hwframe ([kernel.kallsyms])
                                       __access (inlined)
                                       dl_main (/usr/lib64/ld-linux-x86-64.so.2)
                                       _dl_sysdep_start (/usr/lib64/ld-linux-x86-64.so.2)
                                       _dl_start_final (inlined)
                                       _dl_start (/usr/lib64/ld-linux-x86-64.so.2)
                                       _start (/usr/lib64/ld-linux-x86-64.so.2)
<SNIP>

Those BFD warnings need some investigation.
 
> Fwiw, two things I'd like to see further here is somehow the augmented
> code to be the default (with a BPF skeleton possibly)

Yeah, that was/is an experiment in getting perf and bpf together, one
that predates BPF skeletons, that is now the way of doing things for
perf+bpf (just do a 'ls tools/perf/util/bpf_skel/'), doing it with BPF
skeletons, which your patchkit paves the way to, delights me 8-)

> and an ability for perf_event_open tracing to dump the
> perf_event_attr. I'm unclear on the advantages of having different
> augmenters.

So, no advantage in having different augmenters besides the
experimentation before BPF skeletons, and as I wasn't the one working on
the BPF + perf glueing that gave birth to tools/lib/bpf/, I was just
trying to exercise what Wang Nan was doing, however, in hindsight,
brittle that initial interface was, but experimenting we went.

> Perhaps we could just drop support for different
> augmenters, use BPF skeletons for the raw syscall version and keep the
> BPF logic in parse events for adding filters - the process of doing
> augmentation isn't clear to me even after having produced these
> changes.

Basically you add extra data to existing tracepoints, with
per-tracepoint handlers in 'perf trace' consuming that extra data.

Mostly collecting pointer contents, the canonical one is for pathnames.

Then 'perf trace' tries to be smart and reuses "augmenters" (copies of
pointer contents) on all the syscalls that consume the same type.

> There is quite a bit of plumbing necessary to remove the
> notion that the BPF object comes from event parsing

No need for that, that concept may stay, I think, being able to attach
a .c file to some point in the kernel and then provide a trace_printk()
like interface (that bpf-output codebase) seems interesting.

The augmenter is something of a protocol that 'perf trace' can consume,
but then other 'perf script' can as well consume and do extra stuff we
don´t envision now with whatever BPF programs add to the perf ring
buffer (perf.data files).

> and I suspect to achieve this in the current code there is some
> overhead that the skeleton could remove - like the empty sys_enter
> functions I added.

I didn't look at those yet, unsure if they are needed/
 
> Anyway, fixing libbpf 1.0+ and removing a header file called bpf.h
> were what I was after achieving here :-)

Thanks for moving the needle here.

Providing extra test results:

[root@quaco perf]# perf trace -e tools/perf/examples/bpf/empty.c
^C[root@quaco perf]#

Perfect, if I instead change it to not unconditionally filter the thing
is being hooked: all syscalls..

[root@quaco perf]# perf trace -e tools/perf/examples/bpf/empty.c/max-stack=3/ --max-events 3
     0.000 pipewire/2290 raw_syscalls:sys_enter(args: 140270486487156)
                                       syscall_trace_enter.constprop.0 ([kernel.kallsyms])
                                       syscall_trace_enter.constprop.0 ([kernel.kallsyms])
                                       do_syscall_64 ([kernel.kallsyms])
     0.011 pipewire/2290 raw_syscalls:sys_enter(id: 16, args: 140270486487324)
                                       syscall_trace_enter.constprop.0 ([kernel.kallsyms])
                                       syscall_trace_enter.constprop.0 ([kernel.kallsyms])
                                       do_syscall_64 ([kernel.kallsyms])
     0.022 pipewire/2290 raw_syscalls:sys_enter(id: 1, args: 140270486487492)
                                       syscall_trace_enter.constprop.0 ([kernel.kallsyms])
                                       syscall_trace_enter.constprop.0 ([kernel.kallsyms])
                                       do_syscall_64 ([kernel.kallsyms])
[root@quaco perf]#

And for the most "sophisticated" of those examples, that should be made
the default mode for 'perf trace': 

[root@quaco perf]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c,open*,connect* --max-events 5
/home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c:20:10: fatal error: 'stdbool.h' file not found
#include <stdbool.h>
         ^~~~~~~~~~~
1 error generated.
ERROR:	unable to compile /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c
Hint:	Check error message shown above.
Hint:	You can also pre-compile it into .o using:
     		clang -target bpf -O2 -c /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c
     	with proper -I and -D options.
event syntax error: '/home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c'
                     \___ Failed to load /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c from source: Error when compiling BPF scriptlet

(add -v to see detail)
Run 'perf list' for a list of valid events

 Usage: perf trace [<options>] [<command>]
    or: perf trace [<options>] -- <command> [<options>]
    or: perf trace record [<options>] [<command>]
    or: perf trace record [<options>] -- <command> [<options>]

    -e, --event <event>   event/syscall selector. use 'perf list' to list available events
[root@quaco perf]#

Not a good start:

[root@quaco perf]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c,string --max-events 6
     0.000 ( 0.019 ms): systemd-oomd/972 openat(dfd: CWD, filename: "/proc/meminfo", flags: RDONLY|CLOEXEC)    = 12
     0.026 ( 0.003 ms): systemd-oomd/972 newfstatat(dfd: 12, filename: "", statbuf: 0x7ffd2bc73cc0, flag: 4096) = 0
18446744073709.520 ( 0.044 ms): cgroupify/36478 openat(dfd: 4, filename: ".", flags: RDONLY|CLOEXEC|DIRECTORY|NONBLOCK) = 5
     0.015 ( 0.004 ms): cgroupify/36478 newfstatat(dfd: 5, filename: "", statbuf: 0x7fffca5b4130, flag: 4096) = 0
     0.075 ( 0.011 ms): cgroupify/36478 openat(dfd: 4, filename: "59457/cgroup.procs")                        = 5
     0.105 ( 0.009 ms): cgroupify/36478 openat(dfd: 4, filename: "37855/cgroup.procs")                        = 5
[root@quaco perf]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c,string --max-events 10
     0.000 ( 0.065 ms): thermald/1144 openat(dfd: CWD, filename: "/sys/class/powercap/intel-rapl/intel-rapl:0/intel-rapl:0:2/energy_uj") = 13
     0.105 ( 0.008 ms): thermald/1144 openat(dfd: CWD, filename: "/sys/class/powercap/intel-rapl/intel-rapl:0/energy_uj") = 13
     0.125 ( 0.028 ms): thermald/1144 openat(dfd: CWD, filename: "/sys/class/thermal/thermal_zone3/temp")   = 13
     1.079 ( 0.022 ms): thermald/1144 openat(dfd: CWD, filename: "/sys/bus/platform/devices/INT3400:00/odvp6") = 13
     1.113 ( 0.009 ms): thermald/1144 newfstatat(dfd: CWD, filename: "/var/run/thermald/debug_mode", statbuf: 0x7f0e733fb790) = -1 ENOENT (No such file or directory)
     1.127 ( 0.007 ms): thermald/1144 openat(dfd: CWD, filename: "/sys/bus/platform/devices/INT3400:00/odvp18") = 13
     1.141 ( 0.003 ms): thermald/1144 newfstatat(dfd: CWD, filename: "/var/run/thermald/debug_mode", statbuf: 0x7f0e733fb790) = -1 ENOENT (No such file or directory)
     1.147 ( 0.006 ms): thermald/1144 openat(dfd: CWD, filename: "/sys/bus/platform/devices/INT3400:00/odvp18") = 13
     1.159 ( 0.003 ms): thermald/1144 newfstatat(dfd: CWD, filename: "/var/run/thermald/debug_mode", statbuf: 0x7f0e733fb790) = -1 ENOENT (No such file or directory)
     1.165 ( 0.024 ms): thermald/1144 openat(dfd: CWD, filename: "/sys/bus/platform/devices/INT3400:00/odvp18") = 13
[root@quaco perf]#

This after sidestepping the sockaddr and stddef cases and making
'empty.c' become 'everything.c' by making the hook on
raw_syscalls:sys_enter return 1, i.e. don't filter this out, please:

diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
index d3d3c13a9f25b55c..067a6e56eeacc9fc 100644
diff --git a/tools/perf/examples/bpf/augmented_raw_syscalls.c b/tools/perf/examples/bpf/augmented_raw_syscalls.c
index 13c72fd602c307e4..1d2894fa1083b81a 100644
--- a/tools/perf/examples/bpf/augmented_raw_syscalls.c
+++ b/tools/perf/examples/bpf/augmented_raw_syscalls.c
@@ -17,8 +17,9 @@
 #include <linux/bpf.h>
 #include <bpf/bpf_helpers.h>
 #include <linux/limits.h>
-#include <stdbool.h>
-#include <sys/socket.h>
+
+typedef char bool;
+typedef int pid_t;
 
 /* bpf-output associated map */
 struct __augmented_syscalls__ {
@@ -100,7 +101,7 @@ struct augmented_args_payload {
 		struct {
 			struct augmented_arg arg, arg2;
 		};
-		struct sockaddr_storage saddr;
+	//	struct sockaddr_storage saddr;
 	};
 };
 
@@ -157,6 +158,7 @@ int syscall_unaugmented(struct syscall_enter_args *args)
 	return 1;
 }
 
+#if 0
 /*
  * These will be tail_called from SEC("raw_syscalls:sys_enter"), so will find in
  * augmented_args_tmp what was read by that raw_syscalls:sys_enter and go
@@ -200,6 +202,7 @@ int sys_enter_sendto(struct syscall_enter_args *args)
 
 	return augmented__output(args, augmented_args, len + socklen);
 }
+#endif
 
 SEC("!syscalls:sys_enter_open")
 int sys_enter_open(struct syscall_enter_args *args)
diff --git a/tools/perf/examples/bpf/empty.c b/tools/perf/examples/bpf/empty.c
index 3e296c0c53d7d8e2..e4872c48a484f218 100644
--- a/tools/perf/examples/bpf/empty.c
+++ b/tools/perf/examples/bpf/empty.c
@@ -7,6 +7,6 @@ struct syscall_enter_args;
 SEC("raw_syscalls:sys_enter")
 int sys_enter(struct syscall_enter_args *args)
 {
-	return 0;
+	return 1;
 }
 char _license[] SEC("license") = "GPL";

Re: [PATCH v1 6/7] perf trace: 5sec fix libbpf 1.0+ compatibility

[Arnaldo Carvalho de Melo]

With this:

diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
index d3d3c13a9f25b55c..067a6e56eeacc9fc 100644
--- a/tools/perf/Makefile.config
+++ b/tools/perf/Makefile.config
@@ -1239,7 +1239,7 @@ includedir = $(abspath $(prefix)/$(includedir_relative))
 mandir = share/man
 infodir = share/info
 perfexecdir = libexec/perf-core
-perf_include_dir = lib/perf/include
+perf_include_dir = /usr/include
 perf_examples_dir = lib/perf/examples
 sharedir = $(prefix)/share
 template_dir = share/perf-core/templates
diff --git a/tools/perf/examples/bpf/augmented_raw_syscalls.c b/tools/perf/examples/bpf/augmented_raw_syscalls.c
index 13c72fd602c307e4..98a2731c011339ba 100644
--- a/tools/perf/examples/bpf/augmented_raw_syscalls.c
+++ b/tools/perf/examples/bpf/augmented_raw_syscalls.c
@@ -17,8 +17,9 @@
 #include <linux/bpf.h>
 #include <bpf/bpf_helpers.h>
 #include <linux/limits.h>
-#include <stdbool.h>
-#include <sys/socket.h>
+
+typedef char bool;
+typedef int pid_t;
 
 /* bpf-output associated map */
 struct __augmented_syscalls__ {
@@ -94,6 +95,30 @@ struct pids_filtered {
 	__uint(max_entries, 64);
 } pids_filtered SEC(".maps");
 
+/*
+ * Desired design of maximum size and alignment (see RFC2553)
+ */
+#define _K_SS_MAXSIZE   128     /* Implementation specific max size */
+
+typedef unsigned short sa_family_t;
+
+/*
+ * The definition uses anonymous union and struct in order to control the
+ * default alignment.
+ */
+struct sockaddr_storage {
+        union {
+                struct {
+                        sa_family_t    ss_family; /* address family */
+                        /* Following field(s) are implementation specific */
+                        char __data[_K_SS_MAXSIZE - sizeof(unsigned short)];
+                                /* space to achieve desired size, */
+                                /* _SS_MAXSIZE value minus size of ss_family */
+                };
+                void *__align; /* implementation specific desired alignment */
+        };
+};
+
 struct augmented_args_payload {
        struct syscall_enter_args args;
        union {
diff --git a/tools/perf/examples/bpf/empty.c b/tools/perf/examples/bpf/empty.c
index 3e296c0c53d7d8e2..e4872c48a484f218 100644
--- a/tools/perf/examples/bpf/empty.c
+++ b/tools/perf/examples/bpf/empty.c
@@ -7,6 +7,6 @@ struct syscall_enter_args;
 SEC("raw_syscalls:sys_enter")
 int sys_enter(struct syscall_enter_args *args)
 {
-	return 0;
+	return 1;
 }
 char _license[] SEC("license") = "GPL";
diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
index 2dc7970074196ca8..a5cac85783d8711f 100644
--- a/tools/perf/util/llvm-utils.c
+++ b/tools/perf/util/llvm-utils.c
@@ -495,7 +495,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
 
 	snprintf(linux_version_code_str, sizeof(linux_version_code_str),
 		 "0x%x", kernel_version);
-	if (asprintf(&perf_bpf_include_opts, "-I%s/bpf", perf_include_dir) < 0)
+	if (asprintf(&perf_bpf_include_opts, "-I%s/", perf_include_dir) < 0)
 		goto errout;
 	force_set_env("NR_CPUS", nr_cpus_avail_str);
 	force_set_env("LINUX_VERSION_CODE", linux_version_code_str);


The connect calls gets served, tomorrow, if you don't beat me I'll apply
the series after adding these minimal changes so that we have this
working with libbpf 1.0 and then we can move from there, with a switch
to a BPF skel, simplest things first, then deal with faults at pointer
payload copy, which is another avenue, AFAIK with solutions already.

Thanks,

- Arnaldo

[root@quaco perf]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c,connect* --max-events 10
     0.000 ( 0.074 ms): fetchmail/175578 connect(fd: 3, uservaddr: { .family: LOCAL, path: /run/systemd/resolve/io.systemd.Resolve }, addrlen: 42) = 0
     0.397 ( 0.011 ms): systemd-resolv/973 connect(fd: 23, uservaddr: { .family: INET, port: 53, addr: 127.0.0.1 }, addrlen: 16) = 0
     0.532 ( 0.006 ms): systemd-resolv/973 connect(fd: 24, uservaddr: { .family: INET, port: 53, addr: 127.0.0.1 }, addrlen: 16) = 0
     0.910 ( 0.007 ms): systemd-resolv/973 connect(fd: 23, uservaddr: { .family: INET, port: 53, addr: 127.0.0.1 }, addrlen: 16) = 0
     0.962 ( 0.003 ms): systemd-resolv/973 connect(fd: 24, uservaddr: { .family: INET, port: 53, addr: 127.0.0.1 }, addrlen: 16) = 0
     1.337 ( 0.007 ms): fetchmail/175578 connect(fd: 3, uservaddr: { .family: INET, port: 0, addr: 67.195.176.151 }, addrlen: 16) = 0
     1.348 ( 0.014 ms): fetchmail/175578 connect(fd: 3, uservaddr: { .family: UNSPEC }, addrlen: 16)           = 0
     1.363 ( 0.003 ms): fetchmail/175578 connect(fd: 3, uservaddr: { .family: INET, port: 0, addr: 76.13.33.33 }, addrlen: 16) = 0
     1.527 ( 0.014 ms): fetchmail/175578 connect(fd: 3, uservaddr: { .family: LOCAL, path: /run/systemd/resolve/io.systemd.Resolve }, addrlen: 42) = 0
     1.726 ( 0.008 ms): systemd-resolv/973 connect(fd: 23, uservaddr: { .family: INET, port: 53, addr: 127.0.0.1 }, addrlen: 16) = 0
[root@quaco perf]#

Re: [PATCH v1 6/7] perf trace: 5sec fix libbpf 1.0+ compatibility

[Ian Rogers]

On Thu, Nov 3, 2022 at 2:35 PM Arnaldo Carvalho de Melo <acme@kernel.org> wrote:
>
> With this:
>
> diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
> index d3d3c13a9f25b55c..067a6e56eeacc9fc 100644
> --- a/tools/perf/Makefile.config
> +++ b/tools/perf/Makefile.config
> @@ -1239,7 +1239,7 @@ includedir = $(abspath $(prefix)/$(includedir_relative))
>  mandir = share/man
>  infodir = share/info
>  perfexecdir = libexec/perf-core
> -perf_include_dir = lib/perf/include
> +perf_include_dir = /usr/include
>  perf_examples_dir = lib/perf/examples
>  sharedir = $(prefix)/share
>  template_dir = share/perf-core/templates
> diff --git a/tools/perf/examples/bpf/augmented_raw_syscalls.c b/tools/perf/examples/bpf/augmented_raw_syscalls.c
> index 13c72fd602c307e4..98a2731c011339ba 100644
> --- a/tools/perf/examples/bpf/augmented_raw_syscalls.c
> +++ b/tools/perf/examples/bpf/augmented_raw_syscalls.c
> @@ -17,8 +17,9 @@
>  #include <linux/bpf.h>
>  #include <bpf/bpf_helpers.h>
>  #include <linux/limits.h>
> -#include <stdbool.h>
> -#include <sys/socket.h>
> +
> +typedef char bool;
> +typedef int pid_t;
>
>  /* bpf-output associated map */
>  struct __augmented_syscalls__ {
> @@ -94,6 +95,30 @@ struct pids_filtered {
>         __uint(max_entries, 64);
>  } pids_filtered SEC(".maps");
>
> +/*
> + * Desired design of maximum size and alignment (see RFC2553)
> + */
> +#define _K_SS_MAXSIZE   128     /* Implementation specific max size */
> +
> +typedef unsigned short sa_family_t;
> +
> +/*
> + * The definition uses anonymous union and struct in order to control the
> + * default alignment.
> + */
> +struct sockaddr_storage {
> +        union {
> +                struct {
> +                        sa_family_t    ss_family; /* address family */
> +                        /* Following field(s) are implementation specific */
> +                        char __data[_K_SS_MAXSIZE - sizeof(unsigned short)];
> +                                /* space to achieve desired size, */
> +                                /* _SS_MAXSIZE value minus size of ss_family */
> +                };
> +                void *__align; /* implementation specific desired alignment */
> +        };
> +};
> +
>  struct augmented_args_payload {
>         struct syscall_enter_args args;
>         union {
> diff --git a/tools/perf/examples/bpf/empty.c b/tools/perf/examples/bpf/empty.c
> index 3e296c0c53d7d8e2..e4872c48a484f218 100644
> --- a/tools/perf/examples/bpf/empty.c
> +++ b/tools/perf/examples/bpf/empty.c
> @@ -7,6 +7,6 @@ struct syscall_enter_args;
>  SEC("raw_syscalls:sys_enter")
>  int sys_enter(struct syscall_enter_args *args)
>  {
> -       return 0;
> +       return 1;
>  }
>  char _license[] SEC("license") = "GPL";
> diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
> index 2dc7970074196ca8..a5cac85783d8711f 100644
> --- a/tools/perf/util/llvm-utils.c
> +++ b/tools/perf/util/llvm-utils.c
> @@ -495,7 +495,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
>
>         snprintf(linux_version_code_str, sizeof(linux_version_code_str),
>                  "0x%x", kernel_version);
> -       if (asprintf(&perf_bpf_include_opts, "-I%s/bpf", perf_include_dir) < 0)
> +       if (asprintf(&perf_bpf_include_opts, "-I%s/", perf_include_dir) < 0)
>                 goto errout;
>         force_set_env("NR_CPUS", nr_cpus_avail_str);
>         force_set_env("LINUX_VERSION_CODE", linux_version_code_str);
>
>
> The connect calls gets served, tomorrow, if you don't beat me I'll apply
> the series after adding these minimal changes so that we have this
> working with libbpf 1.0 and then we can move from there, with a switch
> to a BPF skel, simplest things first, then deal with faults at pointer
> payload copy, which is another avenue, AFAIK with solutions already.

So I was trying to be clean and not redefine too much. My clang
command line was:

clang -target bpf -O2 -g -c -I/usr/include/x86_64-linux-gnu
-D__NR_CPUS__=16 -D__x86_64__=1

It'd be nice to just drop the need for __NR_CPUS__ and have it be
dynamic, the skeleton approach would require this. Not sure how to
workaround the x86 define and path :-/ Perhaps send out your changes
for review and I can look at and test them.

Thanks,
Ian

> Thanks,
>
> - Arnaldo
>
> [root@quaco perf]# perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c,connect* --max-events 10
>      0.000 ( 0.074 ms): fetchmail/175578 connect(fd: 3, uservaddr: { .family: LOCAL, path: /run/systemd/resolve/io.systemd.Resolve }, addrlen: 42) = 0
>      0.397 ( 0.011 ms): systemd-resolv/973 connect(fd: 23, uservaddr: { .family: INET, port: 53, addr: 127.0.0.1 }, addrlen: 16) = 0
>      0.532 ( 0.006 ms): systemd-resolv/973 connect(fd: 24, uservaddr: { .family: INET, port: 53, addr: 127.0.0.1 }, addrlen: 16) = 0
>      0.910 ( 0.007 ms): systemd-resolv/973 connect(fd: 23, uservaddr: { .family: INET, port: 53, addr: 127.0.0.1 }, addrlen: 16) = 0
>      0.962 ( 0.003 ms): systemd-resolv/973 connect(fd: 24, uservaddr: { .family: INET, port: 53, addr: 127.0.0.1 }, addrlen: 16) = 0
>      1.337 ( 0.007 ms): fetchmail/175578 connect(fd: 3, uservaddr: { .family: INET, port: 0, addr: 67.195.176.151 }, addrlen: 16) = 0
>      1.348 ( 0.014 ms): fetchmail/175578 connect(fd: 3, uservaddr: { .family: UNSPEC }, addrlen: 16)           = 0
>      1.363 ( 0.003 ms): fetchmail/175578 connect(fd: 3, uservaddr: { .family: INET, port: 0, addr: 76.13.33.33 }, addrlen: 16) = 0
>      1.527 ( 0.014 ms): fetchmail/175578 connect(fd: 3, uservaddr: { .family: LOCAL, path: /run/systemd/resolve/io.systemd.Resolve }, addrlen: 42) = 0
>      1.726 ( 0.008 ms): systemd-resolv/973 connect(fd: 23, uservaddr: { .family: INET, port: 53, addr: 127.0.0.1 }, addrlen: 16) = 0
> [root@quaco perf]#

Re: [PATCH v1 6/7] perf trace: 5sec fix libbpf 1.0+ compatibility

[Arnaldo Carvalho de Melo]

Em Thu, Nov 03, 2022 at 03:01:21PM -0700, Ian Rogers escreveu:
> On Thu, Nov 3, 2022 at 2:35 PM Arnaldo Carvalho de Melo <acme@kernel.org> wrote:
> >
> > With this:
> >
> > diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
> > index d3d3c13a9f25b55c..067a6e56eeacc9fc 100644
> > --- a/tools/perf/Makefile.config
> > +++ b/tools/perf/Makefile.config
> > @@ -1239,7 +1239,7 @@ includedir = $(abspath $(prefix)/$(includedir_relative))
> >  mandir = share/man
> >  infodir = share/info
> >  perfexecdir = libexec/perf-core
> > -perf_include_dir = lib/perf/include
> > +perf_include_dir = /usr/include
> >  perf_examples_dir = lib/perf/examples
> >  sharedir = $(prefix)/share
> >  template_dir = share/perf-core/templates
> > diff --git a/tools/perf/examples/bpf/augmented_raw_syscalls.c b/tools/perf/examples/bpf/augmented_raw_syscalls.c
> > index 13c72fd602c307e4..98a2731c011339ba 100644
> > --- a/tools/perf/examples/bpf/augmented_raw_syscalls.c
> > +++ b/tools/perf/examples/bpf/augmented_raw_syscalls.c
> > @@ -17,8 +17,9 @@
> >  #include <linux/bpf.h>
> >  #include <bpf/bpf_helpers.h>
> >  #include <linux/limits.h>
> > -#include <stdbool.h>
> > -#include <sys/socket.h>
> > +
> > +typedef char bool;
> > +typedef int pid_t;
> >
> >  /* bpf-output associated map */
> >  struct __augmented_syscalls__ {
> > @@ -94,6 +95,30 @@ struct pids_filtered {
> >         __uint(max_entries, 64);
> >  } pids_filtered SEC(".maps");
> >
> > +/*
> > + * Desired design of maximum size and alignment (see RFC2553)
> > + */
> > +#define _K_SS_MAXSIZE   128     /* Implementation specific max size */
> > +
> > +typedef unsigned short sa_family_t;
> > +
> > +/*
> > + * The definition uses anonymous union and struct in order to control the
> > + * default alignment.
> > + */
> > +struct sockaddr_storage {
> > +        union {
> > +                struct {
> > +                        sa_family_t    ss_family; /* address family */
> > +                        /* Following field(s) are implementation specific */
> > +                        char __data[_K_SS_MAXSIZE - sizeof(unsigned short)];
> > +                                /* space to achieve desired size, */
> > +                                /* _SS_MAXSIZE value minus size of ss_family */
> > +                };
> > +                void *__align; /* implementation specific desired alignment */
> > +        };
> > +};
> > +
> >  struct augmented_args_payload {
> >         struct syscall_enter_args args;
> >         union {
> > diff --git a/tools/perf/examples/bpf/empty.c b/tools/perf/examples/bpf/empty.c
> > index 3e296c0c53d7d8e2..e4872c48a484f218 100644
> > --- a/tools/perf/examples/bpf/empty.c
> > +++ b/tools/perf/examples/bpf/empty.c
> > @@ -7,6 +7,6 @@ struct syscall_enter_args;
> >  SEC("raw_syscalls:sys_enter")
> >  int sys_enter(struct syscall_enter_args *args)
> >  {
> > -       return 0;
> > +       return 1;
> >  }
> >  char _license[] SEC("license") = "GPL";
> > diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
> > index 2dc7970074196ca8..a5cac85783d8711f 100644
> > --- a/tools/perf/util/llvm-utils.c
> > +++ b/tools/perf/util/llvm-utils.c
> > @@ -495,7 +495,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
> >
> >         snprintf(linux_version_code_str, sizeof(linux_version_code_str),
> >                  "0x%x", kernel_version);
> > -       if (asprintf(&perf_bpf_include_opts, "-I%s/bpf", perf_include_dir) < 0)
> > +       if (asprintf(&perf_bpf_include_opts, "-I%s/", perf_include_dir) < 0)
> >                 goto errout;
> >         force_set_env("NR_CPUS", nr_cpus_avail_str);
> >         force_set_env("LINUX_VERSION_CODE", linux_version_code_str);
> >
> >
> > The connect calls gets served, tomorrow, if you don't beat me I'll apply
> > the series after adding these minimal changes so that we have this
> > working with libbpf 1.0 and then we can move from there, with a switch
> > to a BPF skel, simplest things first, then deal with faults at pointer
> > payload copy, which is another avenue, AFAIK with solutions already.
> 
> So I was trying to be clean and not redefine too much. My clang
> command line was:
> 
> clang -target bpf -O2 -g -c -I/usr/include/x86_64-linux-gnu
> -D__NR_CPUS__=16 -D__x86_64__=1

Sure, I haven't even checked why that is needed, maybe its not anymore.

I just tried the first hunch about the header files, those other
variables maybe were needed long ago, maybe its just more stuff to trow
out in the direction of doing it the modern way, BPF skels.
 
> It'd be nice to just drop the need for __NR_CPUS__ and have it be
> dynamic, the skeleton approach would require this. Not sure how to
> workaround the x86 define and path :-/ Perhaps send out your changes
> for review and I can look at and test them.

Done deal, early tomorrow I'll send it and wait for your review.

- Arnaldo

Re: [PATCH v1 6/7] perf trace: 5sec fix libbpf 1.0+ compatibility

[Arnaldo Carvalho de Melo]

Em Thu, Nov 03, 2022 at 09:21:06PM -0300, Arnaldo Carvalho de Melo escreveu:
> Em Thu, Nov 03, 2022 at 03:01:21PM -0700, Ian Rogers escreveu:
> > On Thu, Nov 3, 2022 at 2:35 PM Arnaldo Carvalho de Melo <acme@kernel.org> wrote:
> > >
> > > With this:
> > >
> > > diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
> > > index d3d3c13a9f25b55c..067a6e56eeacc9fc 100644
> > > --- a/tools/perf/Makefile.config
> > > +++ b/tools/perf/Makefile.config
> > > @@ -1239,7 +1239,7 @@ includedir = $(abspath $(prefix)/$(includedir_relative))
> > >  mandir = share/man
> > >  infodir = share/info
> > >  perfexecdir = libexec/perf-core
> > > -perf_include_dir = lib/perf/include
> > > +perf_include_dir = /usr/include
> > >  perf_examples_dir = lib/perf/examples
> > >  sharedir = $(prefix)/share
> > >  template_dir = share/perf-core/templates
> > > diff --git a/tools/perf/examples/bpf/augmented_raw_syscalls.c b/tools/perf/examples/bpf/augmented_raw_syscalls.c
> > > index 13c72fd602c307e4..98a2731c011339ba 100644
> > > --- a/tools/perf/examples/bpf/augmented_raw_syscalls.c
> > > +++ b/tools/perf/examples/bpf/augmented_raw_syscalls.c
> > > @@ -17,8 +17,9 @@
> > >  #include <linux/bpf.h>
> > >  #include <bpf/bpf_helpers.h>
> > >  #include <linux/limits.h>
> > > -#include <stdbool.h>
> > > -#include <sys/socket.h>
> > > +
> > > +typedef char bool;
> > > +typedef int pid_t;
> > >
> > >  /* bpf-output associated map */
> > >  struct __augmented_syscalls__ {
> > > @@ -94,6 +95,30 @@ struct pids_filtered {
> > >         __uint(max_entries, 64);
> > >  } pids_filtered SEC(".maps");
> > >
> > > +/*
> > > + * Desired design of maximum size and alignment (see RFC2553)
> > > + */
> > > +#define _K_SS_MAXSIZE   128     /* Implementation specific max size */
> > > +
> > > +typedef unsigned short sa_family_t;
> > > +
> > > +/*
> > > + * The definition uses anonymous union and struct in order to control the
> > > + * default alignment.
> > > + */
> > > +struct sockaddr_storage {
> > > +        union {
> > > +                struct {
> > > +                        sa_family_t    ss_family; /* address family */
> > > +                        /* Following field(s) are implementation specific */
> > > +                        char __data[_K_SS_MAXSIZE - sizeof(unsigned short)];
> > > +                                /* space to achieve desired size, */
> > > +                                /* _SS_MAXSIZE value minus size of ss_family */
> > > +                };
> > > +                void *__align; /* implementation specific desired alignment */
> > > +        };
> > > +};
> > > +
> > >  struct augmented_args_payload {
> > >         struct syscall_enter_args args;
> > >         union {
> > > diff --git a/tools/perf/examples/bpf/empty.c b/tools/perf/examples/bpf/empty.c
> > > index 3e296c0c53d7d8e2..e4872c48a484f218 100644
> > > --- a/tools/perf/examples/bpf/empty.c
> > > +++ b/tools/perf/examples/bpf/empty.c
> > > @@ -7,6 +7,6 @@ struct syscall_enter_args;
> > >  SEC("raw_syscalls:sys_enter")
> > >  int sys_enter(struct syscall_enter_args *args)
> > >  {
> > > -       return 0;
> > > +       return 1;
> > >  }
> > >  char _license[] SEC("license") = "GPL";
> > > diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
> > > index 2dc7970074196ca8..a5cac85783d8711f 100644
> > > --- a/tools/perf/util/llvm-utils.c
> > > +++ b/tools/perf/util/llvm-utils.c
> > > @@ -495,7 +495,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
> > >
> > >         snprintf(linux_version_code_str, sizeof(linux_version_code_str),
> > >                  "0x%x", kernel_version);
> > > -       if (asprintf(&perf_bpf_include_opts, "-I%s/bpf", perf_include_dir) < 0)
> > > +       if (asprintf(&perf_bpf_include_opts, "-I%s/", perf_include_dir) < 0)
> > >                 goto errout;
> > >         force_set_env("NR_CPUS", nr_cpus_avail_str);
> > >         force_set_env("LINUX_VERSION_CODE", linux_version_code_str);
> > >
> > >
> > > The connect calls gets served, tomorrow, if you don't beat me I'll apply
> > > the series after adding these minimal changes so that we have this
> > > working with libbpf 1.0 and then we can move from there, with a switch
> > > to a BPF skel, simplest things first, then deal with faults at pointer
> > > payload copy, which is another avenue, AFAIK with solutions already.
> > 
> > So I was trying to be clean and not redefine too much. My clang
> > command line was:
> > 
> > clang -target bpf -O2 -g -c -I/usr/include/x86_64-linux-gnu
> > -D__NR_CPUS__=16 -D__x86_64__=1
> 
> Sure, I haven't even checked why that is needed, maybe its not anymore.
> 
> I just tried the first hunch about the header files, those other
> variables maybe were needed long ago, maybe its just more stuff to trow
> out in the direction of doing it the modern way, BPF skels.
>  
> > It'd be nice to just drop the need for __NR_CPUS__ and have it be
> > dynamic, the skeleton approach would require this. Not sure how to
> > workaround the x86 define and path :-/ Perhaps send out your changes
> > for review and I can look at and test them.
> 
> Done deal, early tomorrow I'll send it and wait for your review.

Did it now, please take a look at my tmp.perf/core branch.

Tomorrow I'll add the Tested-by tags.

- Arnaldo

Re: [PATCH v1 0/7] Fix perf trace libbpf 1.0+ compatibility

[Leo Yan]

Hi Ian, Arnaldo,

On Wed, Nov 02, 2022 at 09:54:30PM -0700, Ian Rogers wrote:
> Perf trace can augment system calls with a BPF program passed as an
> event. The BPF code for this lives in examples. This patch fixes the
> example code to not used deprecated/removed APIs in libbpf. As libbpf
> has similar header files to tools/perf/include/bpf the code is
> transitioned to use the more standard libbpf code and the perf BPF
> header files removed.

I think you missed to update the code examples/bpf/sys_enter_openat.c,
either you could remove it (since it's duplicate with
augmented_raw_syscalls.c), or we should apply below fixing:

From f30af3b43060e482c54e113cbe90223173c69abd Mon Sep 17 00:00:00 2001
From: Leo Yan <leo.yan@linaro.org>
Date: Fri, 11 Nov 2022 12:02:24 +0000
Subject: [PATCH] perf trace: sys_enter_openat.c fix libbpf 1.0+ compatibility

Avoid use of tools/perf/include/bpf/bpf.h and use the more regular BPF
headers.

With fixing:

  # ./perf trace -e examples/bpf/sys_enter_openat.c
  0.000 irqbalance/1025 syscalls:sys_enter_openat(AT_FDCWD, "", O_RDONLY)
  1.596 irqbalance/1025 syscalls:sys_enter_openat(AT_FDCWD, "", O_RDONLY)
  1.832 irqbalance/1025 syscalls:sys_enter_openat(AT_FDCWD, "", O_RDONLY)
  1.864 irqbalance/1025 syscalls:sys_enter_openat(AT_FDCWD, "", O_RDONLY)

Signed-off-by: Leo Yan <leo.yan@linaro.org>
---
 tools/perf/examples/bpf/sys_enter_openat.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/tools/perf/examples/bpf/sys_enter_openat.c b/tools/perf/examples/bpf/sys_enter_openat.c
index c4481c390d23..8edfa7c147d1 100644
--- a/tools/perf/examples/bpf/sys_enter_openat.c
+++ b/tools/perf/examples/bpf/sys_enter_openat.c
@@ -14,7 +14,9 @@
  * the return value.
  */
 
-#include <bpf/bpf.h>
+#include <linux/bpf.h>
+#include <linux/limits.h>
+#include <bpf/bpf_helpers.h>
 
 struct syscall_enter_openat_args {
 	unsigned long long unused;
@@ -25,9 +27,10 @@ struct syscall_enter_openat_args {
 	long		   mode;
 };
 
-int syscall_enter(openat)(struct syscall_enter_openat_args *args)
+SEC("syscalls:sys_enter_openat")
+int syscall_enter_openat(struct syscall_enter_openat_args *args)
 {
 	return 1;
 }
 
-license(GPL);
+char _license[] SEC("license") = "GPL";

Re: [PATCH v1 0/7] Fix perf trace libbpf 1.0+ compatibility

[Ian Rogers]

On Fri, Nov 11, 2022 at 4:09 AM Leo Yan <leo.yan@linaro.org> wrote:
>
> Hi Ian, Arnaldo,
>
> On Wed, Nov 02, 2022 at 09:54:30PM -0700, Ian Rogers wrote:
> > Perf trace can augment system calls with a BPF program passed as an
> > event. The BPF code for this lives in examples. This patch fixes the
> > example code to not used deprecated/removed APIs in libbpf. As libbpf
> > has similar header files to tools/perf/include/bpf the code is
> > transitioned to use the more standard libbpf code and the perf BPF
> > header files removed.
>
> I think you missed to update the code examples/bpf/sys_enter_openat.c,
> either you could remove it (since it's duplicate with
> augmented_raw_syscalls.c), or we should apply below fixing:

Arnaldo, what do you think?

Thanks,
Ian

> From f30af3b43060e482c54e113cbe90223173c69abd Mon Sep 17 00:00:00 2001
> From: Leo Yan <leo.yan@linaro.org>
> Date: Fri, 11 Nov 2022 12:02:24 +0000
> Subject: [PATCH] perf trace: sys_enter_openat.c fix libbpf 1.0+ compatibility
>
> Avoid use of tools/perf/include/bpf/bpf.h and use the more regular BPF
> headers.
>
> With fixing:
>
>   # ./perf trace -e examples/bpf/sys_enter_openat.c
>   0.000 irqbalance/1025 syscalls:sys_enter_openat(AT_FDCWD, "", O_RDONLY)
>   1.596 irqbalance/1025 syscalls:sys_enter_openat(AT_FDCWD, "", O_RDONLY)
>   1.832 irqbalance/1025 syscalls:sys_enter_openat(AT_FDCWD, "", O_RDONLY)
>   1.864 irqbalance/1025 syscalls:sys_enter_openat(AT_FDCWD, "", O_RDONLY)
>
> Signed-off-by: Leo Yan <leo.yan@linaro.org>
> ---
>  tools/perf/examples/bpf/sys_enter_openat.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/tools/perf/examples/bpf/sys_enter_openat.c b/tools/perf/examples/bpf/sys_enter_openat.c
> index c4481c390d23..8edfa7c147d1 100644
> --- a/tools/perf/examples/bpf/sys_enter_openat.c
> +++ b/tools/perf/examples/bpf/sys_enter_openat.c
> @@ -14,7 +14,9 @@
>   * the return value.
>   */
>
> -#include <bpf/bpf.h>
> +#include <linux/bpf.h>
> +#include <linux/limits.h>
> +#include <bpf/bpf_helpers.h>
>
>  struct syscall_enter_openat_args {
>         unsigned long long unused;
> @@ -25,9 +27,10 @@ struct syscall_enter_openat_args {
>         long               mode;
>  };
>
> -int syscall_enter(openat)(struct syscall_enter_openat_args *args)
> +SEC("syscalls:sys_enter_openat")
> +int syscall_enter_openat(struct syscall_enter_openat_args *args)
>  {
>         return 1;
>  }
>
> -license(GPL);
> +char _license[] SEC("license") = "GPL";