From mboxrd@z Thu Jan 1 00:00:00 1970 From: Yonghong Song Subject: [PATCH bpf-next v3 0/7] bpf: implement BPF_TASK_FD_QUERY Date: Tue, 22 May 2018 09:30:44 -0700 Message-ID: <20180522163048.3128924-1-yhs@fb.com> Mime-Version: 1.0 Content-Type: text/plain Cc: To: , , , Return-path: Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:37714 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751724AbeEVQav (ORCPT ); Tue, 22 May 2018 12:30:51 -0400 Received: from pps.filterd (m0044008.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w4MGT465024661 for ; Tue, 22 May 2018 09:30:50 -0700 Received: from mail.thefacebook.com ([199.201.64.23]) by mx0a-00082601.pphosted.com with ESMTP id 2j4n7f8bh2-2 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 22 May 2018 09:30:50 -0700 Sender: netdev-owner@vger.kernel.org List-ID: Currently, suppose a userspace application has loaded a bpf program and attached it to a tracepoint/kprobe/uprobe, and a bpf introspection tool, e.g., bpftool, wants to show which bpf program is attached to which tracepoint/kprobe/uprobe. Such attachment information will be really useful to understand the overall bpf deployment in the system. There is a name field (16 bytes) for each program, which could be used to encode the attachment point. There are some drawbacks for this approaches. First, bpftool user (e.g., an admin) may not really understand the association between the name and the attachment point. Second, if one program is attached to multiple places, encoding a proper name which can imply all these attachments becomes difficult. This patch introduces a new bpf subcommand BPF_TASK_FD_QUERY. Given a pid and fd, this command will return bpf related information to user space. Right now it only supports tracepoint/kprobe/uprobe perf event fd's. For such a fd, BPF_TASK_FD_QUERY will return . prog_id . tracepoint name, or . k[ret]probe funcname + offset or kernel addr, or . u[ret]probe filename + offset to the userspace. The user can use "bpftool prog" to find more information about bpf program itself with prog_id. Patch #1 adds function perf_get_event() in kernel/events/core.c. Patch #2 implements the bpf subcommand BPF_TASK_FD_QUERY. Patch #3 syncs tools bpf.h header and also add bpf_task_fd_query() in the libbpf library for samples/selftests/bpftool to use. Patch #4 adds ksym_get_addr() utility function. Patch #5 add a test in samples/bpf for querying k[ret]probes and u[ret]probes. Patch #6 add a test in tools/testing/selftests/bpf for querying raw_tracepoint and tracepoint. Patch #7 add a new subcommand "perf" to bpftool. Changelogs: v2 -> v3: . made perf_get_event() return perf_event pointer const. this was to ensure that event fields are not meddled. . detect whether newly BPF_TASK_FD_QUERY is supported or not in "bpftool perf" and warn users if it is not. v1 -> v2: . changed bpf subcommand name from BPF_PERF_EVENT_QUERY to BPF_TASK_FD_QUERY. . fixed various "bpftool perf" issues and added documentation and auto-completion. Yonghong Song (7): perf/core: add perf_get_event() to return perf_event given a struct file bpf: introduce bpf subcommand BPF_TASK_FD_QUERY tools/bpf: sync kernel header bpf.h and add bpf_trace_event_query in libbpf tools/bpf: add ksym_get_addr() in trace_helpers samples/bpf: add a samples/bpf test for BPF_TASK_FD_QUERY tools/bpf: add two BPF_TASK_FD_QUERY tests in test_progs tools/bpftool: add perf subcommand include/linux/perf_event.h | 5 + include/linux/trace_events.h | 16 + include/uapi/linux/bpf.h | 27 ++ kernel/bpf/syscall.c | 124 ++++++++ kernel/events/core.c | 8 + kernel/trace/bpf_trace.c | 48 +++ kernel/trace/trace_kprobe.c | 29 ++ kernel/trace/trace_uprobe.c | 22 ++ samples/bpf/Makefile | 4 + samples/bpf/task_fd_query_kern.c | 19 ++ samples/bpf/task_fd_query_user.c | 379 +++++++++++++++++++++++ tools/bpf/bpftool/Documentation/bpftool-perf.rst | 81 +++++ tools/bpf/bpftool/Documentation/bpftool.rst | 5 +- tools/bpf/bpftool/bash-completion/bpftool | 9 + tools/bpf/bpftool/main.c | 3 +- tools/bpf/bpftool/main.h | 1 + tools/bpf/bpftool/perf.c | 244 +++++++++++++++ tools/include/uapi/linux/bpf.h | 27 ++ tools/lib/bpf/bpf.c | 24 ++ tools/lib/bpf/bpf.h | 3 + tools/testing/selftests/bpf/test_progs.c | 133 ++++++++ tools/testing/selftests/bpf/trace_helpers.c | 12 + tools/testing/selftests/bpf/trace_helpers.h | 1 + 23 files changed, 1222 insertions(+), 2 deletions(-) create mode 100644 samples/bpf/task_fd_query_kern.c create mode 100644 samples/bpf/task_fd_query_user.c create mode 100644 tools/bpf/bpftool/Documentation/bpftool-perf.rst create mode 100644 tools/bpf/bpftool/perf.c -- 2.9.5