bpf/tracing: allow user space to query prog array on the same tp
Subsystems (10)
v4 cover bpf/tracing: allow user space to query prog array on the same tp
Commit e87c6bc3852b ("bpf: permit multiple bpf attachments for a single perf event") added support to attach multiple bpf programs to a single perf event. Given a perf event (kprobe, uprobe, or kernel tracepoint), the perf ioctl interface is used to query bpf programs attached to the same trace event.
There already exists a BPF_PROG_QUERY command for introspection currently used by cgroup+bpf. We did have an implementation for querying tracepoint+bpf through the same interface. However, it looks cleaner to use ioctl() style of api here, since attaching bpf prog to tracepoint/kuprobe is also done via ioctl.
Patch #1 had the core implementation and patch #2 added a test case in tools bpf selftests suite.
Changelogs:
v3 -> v4:
- Fix a compilation error with newer gcc like 6.3.1 while old gcc 4.8.5 is okay. I was using &uquery->ids to represent the address to the ids array to make it explicit that the address is passed, and this syntax is rightly rejected by gcc 6.3.1.
v2 -> v3:
- Change uapi structure perf_event_query_bpf to be more clearer based on Peter's suggestion, and adjust other codes accordingly.
v1 -> v2:
- Rebase on top of net-next.
- Use existing bpf_prog_array_length function instead of implementing the same functionality in function bpf_prog_array_copy_info.
Yonghong Song (2):
bpf/tracing: allow user space to query prog array on the same tp bpf/tracing: add a bpf test for new ioctl query interface
include/linux/bpf.h | 4 + include/uapi/linux/perf_event.h | 22 +++++ kernel/bpf/core.c | 21 ++++ kernel/events/core.c | 3 + kernel/trace/bpf_trace.c | 23 +++++ tools/include/uapi/linux/perf_event.h | 22 +++++ tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/test_progs.c | 134 ++++++++++++++++++++++++++ tools/testing/selftests/bpf/test_tracepoint.c | 26 +++++ 9 files changed, 256 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/bpf/test_tracepoint.c
Signature · 1 line
2.9.5
PATCH v4 1/2 bpf/tracing: allow user space to query prog array on the same tp
Commit e87c6bc3852b ("bpf: permit multiple bpf attachments for a single perf event") added support to attach multiple bpf programs to a single perf event.
Although this provides flexibility, users may want to know what other bpf programs attached to the same tp interface. Besides getting visibility for the underlying bpf system, such information may also help consolidate multiple bpf programs, understand potential performance issues due to a large array, and debug (e.g., one bpf program which overwrites return code may impact subsequent program results).
Commit 2541517c32be ("tracing, perf: Implement BPF programs attached to kprobes") utilized the existing perf ioctl interface and added the command PERF_EVENT_IOC_SET_BPF to attach a bpf program to a tracepoint. This patch adds a new ioctl command, given a perf event fd, to query the bpf program array attached to the same perf tracepoint event.
The new uapi ioctl command:
PERF_EVENT_IOC_QUERY_BPF
The new uapi/linux/perf_event.h structure:
struct perf_event_query_bpf {
__u32 ids_len;
__u32 prog_cnt;
__u32 ids[0];};
User space provides buffer "ids" for kernel to copy to. When returning from the kernel, the number of available programs in the array is set in "prog_cnt".
The usage:
struct perf_event_query_bpf *query = malloc(...); query.ids_len = ids_len;
err = ioctl(pmu_efd, PERF_EVENT_IOC_QUERY_BPF, &query);
if (err == 0) {
/* query.prog_cnt is the number of available progs,
* number of progs in ids: (ids_len == 0) ? 0 : query.prog_cnt
*/
} else if (errno == ENOSPC) {
/* query.ids_len number of progs copied,
* query.prog_cnt is the number of available progs
*/
} else {
/* other errors */}
--- include/linux/bpf.h | 4 ++++ include/uapi/linux/perf_event.h | 22 ++++++++++++++++++++++ kernel/bpf/core.c | 21 +++++++++++++++++++++ kernel/events/core.c | 3 +++ kernel/trace/bpf_trace.c | 23 +++++++++++++++++++++++ 5 files changed, 73 insertions(+)
include/linux/bpf.h +4 -0
@@ -254,6 +254,7 @@ typedef unsigned long (*bpf_ctx_copy_t)(void *dst, const void *src,u64 bpf_event_output (struct bpf_map *map,u64 flags,void *meta,u64 meta_size,void *ctx,u64 ctx_size,bpf_ctx_copy_t ctx_copy); +int bpf_event_query_prog_array (struct perf_event *event,void __user *info);int bpf_prog_test_run_xdp (struct bpf_prog *prog,const union bpf_attr *kattr,union bpf_attr __user *uattr);
@@ -285,6 +286,9 @@ int bpf_prog_array_copy_to_user(struct bpf_prog_array __rcu *progs,void bpf_prog_array_delete_safe (struct bpf_prog_array __rcu *progs,struct bpf_prog *old_prog); +int bpf_prog_array_copy_info (struct bpf_prog_array __rcu *array, +__u32 __user *prog_ids,u32 request_cnt, +__u32 __user *prog_cnt); int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array, struct bpf_prog *exclude_prog, struct bpf_prog *include_prog,
include/uapi/linux/perf_event.h +22 -0
@@ -418,6 +418,27 @@ struct perf_event_attr {__u16 __reserved_2;/* align to __u64 */ }; +/* +* Structure used by below PERF_EVENT_IOC_QUERY_BPF command +* to query bpf programs attached to the same perf tracepoint +* as the given perf event. +*/ +struct perf_event_query_bpf { +/* +* The below ids array length +*/ +__u32 ids_len; +/* +* Set by the kernel to indicate the number of +* available programs +*/ +__u32 prog_cnt; +/* +* User provided buffer to store program ids +*/ +__u32 ids[0 ]; +}; +#define perf_flags (attr) (*(&(attr)->read_format + 1))/*
@@ -433,6 +454,7 @@ struct perf_event_attr {#define PERF_EVENT_IOC_ID _IOR('$', 7, __u64 *)#define PERF_EVENT_IOC_SET_BPF _IOW('$', 8, __u32)#define PERF_EVENT_IOC_PAUSE_OUTPUT _IOW('$', 9, __u32) +#define PERF_EVENT_IOC_QUERY_BPF _IOWR('$', 10, struct perf_event_query_bpf *)enum perf_event_ioc_flags {PERF_IOC_FLAG_GROUP =1U <<0 ,
kernel/bpf/core.c +21 -0
@@ -1462,6 +1462,8 @@ int bpf_prog_array_copy_to_user(struct bpf_prog_array __rcu *progs,rcu_read_lock (); prog =rcu_dereference (progs)->progs;for (; *prog; prog++) { +if (*prog == &dummy_bpf_prog.prog) +continue ; id = (*prog)->aux->id;if (copy_to_user (prog_ids + i, &id,sizeof (id))) {rcu_read_unlock ();
@@ -1545,6 +1547,25 @@ int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,return 0 ; } +int bpf_prog_array_copy_info (struct bpf_prog_array __rcu *array, +__u32 __user *prog_ids,u32 request_cnt, +__u32 __user *prog_cnt) +{ +u32 cnt =0 ; + +if (array) + cnt =bpf_prog_array_length (array); + +if (copy_to_user (prog_cnt, &cnt,sizeof (cnt))) +return -EFAULT ; + +/* return early if user requested only program count or nothing to copy */ +if (!request_cnt || !cnt) +return 0 ; + +return bpf_prog_array_copy_to_user (array, prog_ids, request_cnt); +} +static void bpf_prog_free_deferred (struct work_struct *work) {struct bpf_prog_aux *aux;
kernel/events/core.c +3 -0
@@ -4723,6 +4723,9 @@ static long _perf_ioctl(struct perf_event *event, unsigned int cmd, unsigned lonrcu_read_unlock ();return 0 ; } + +case PERF_EVENT_IOC_QUERY_BPF : +return bpf_event_query_prog_array (event, (void __user *)arg);default :return -ENOTTY ; }
kernel/trace/bpf_trace.c +23 -0
@@ -820,3 +820,26 @@ void perf_event_detach_bpf_prog(struct perf_event *event) unlock:mutex_unlock (&bpf_event_mutex); } + +int bpf_event_query_prog_array (struct perf_event *event,void __user *info) +{ +struct perf_event_query_bpf __user *uquery = info; +struct perf_event_query_bpf query = {}; +int ret; + +if (!capable (CAP_SYS_ADMIN )) +return -EPERM ; +if (event->attr.type !=PERF_TYPE_TRACEPOINT ) +return -EINVAL ; +if (copy_from_user (&query, uquery,sizeof (query))) +return -EFAULT ; + +mutex_lock (&bpf_event_mutex); + ret =bpf_prog_array_copy_info (event->tp_event->prog_array, + uquery->ids, + query.ids_len, + &uquery->prog_cnt); +mutex_unlock (&bpf_event_mutex); + +return ret; +}
Signature · 1 line
2.9.5
Quoted 46 lines · Yonghong Song
Commit
e87c6bc3852b("bpf: permit multiple bpf attachments for a single perf event") added support to attach multiple bpf programs to a single perf event.
Although this provides flexibility, users may want to know what other bpf programs attached to the same tp interface. Besides getting visibility for the underlying bpf system, such information may also help consolidate multiple bpf programs, understand potential performance issues due to a large array, and debug (e.g., one bpf program which overwrites return code may impact subsequent program results).Commit
2541517c32be("tracing, perf: Implement BPF programs attached to kprobes") utilized the existing perf ioctl interface and added the commandPERF_EVENT_IOC_SET_BPFto attach a bpf program to a tracepoint. This patch adds a new ioctl command, given a perf event fd, to query the bpf program array attached to the same perf tracepoint event.The new uapi ioctl command:
PERF_EVENT_IOC_QUERY_BPFThe new
uapi/linux/perf_event.hstructure:struct perf_event_query_bpf { __u32 ids_len; __u32 prog_cnt; __u32 ids[0];};
User space provides buffer "ids" for kernel to copy to. When returning from the kernel, the number of available programs in the array is set in "
prog_cnt".The usage:
structperf_event_query_bpf*query = malloc(...); query.ids_len =ids_len;
err =ioctl(pmu_efd, PERF_EVENT_IOC_QUERY_BPF, &query);if (err == 0) { /* query.prog_cnt is the number of available progs, * number of progs in ids: (ids_len == 0) ? 0 : query.prog_cnt */ } else if (errno == ENOSPC) { /* query.ids_len number of progs copied, * query.prog_cnt is the number of available progs */ } else { /* other errors */
Quoted 4 lines
}
Signed-off-by Yonghong Song <[email protected]>
Peter Zijlstra
maintainerQuoted 4 lines · Yonghong Song
The usage:
structperf_event_query_bpf*query = malloc(...); query.ids_len =ids_len;
err =ioctl(pmu_efd, PERF_EVENT_IOC_QUERY_BPF, &query);
You didn't spot the fixes to your changelog ;-) The above should read something like:
struct perf_event_query_bpf *query =
malloc(sizeof(*query) + sizeof(u32) * ids_len);
query->ids_len = ids_len;
err = ioctl(pmu_efd, PERF_EVENT_IOC_QUERY_BPF, query);Quoted 6 lines · Peter Zijlstra
Quoted 4 lines · Yonghong Song
The usage:
structperf_event_query_bpf*query = malloc(...); query.ids_len =ids_len;
err =ioctl(pmu_efd, PERF_EVENT_IOC_QUERY_BPF, &query);
Quoted 7 lines
You didn't spot the fixes to your changelog ;-) The above should read something like:
struct perf_event_query_bpf *query = malloc(sizeof(*query) + sizeof(u32) * ids_len); query->ids_len = ids_len; err = ioctl(pmu_efd, PERF_EVENT_IOC_QUERY_BPF, query);
sure. I fixed up this nit in commit log of patch 1 and in test_progs.c of patch 2.
PATCH v4 2/2 bpf/tracing: add a bpf test for new ioctl query interface
In reply to Yonghong SongAdded a subtest in test_progs. The tracepoint is sched/sched_switch. Multiple bpf programs are attached to this tracepoint and the query interface is exercised.
--- tools/include/uapi/linux/perf_event.h | 22 +++++ tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/test_progs.c | 134 ++++++++++++++++++++++++++ tools/testing/selftests/bpf/test_tracepoint.c | 26 +++++ 4 files changed, 183 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/bpf/test_tracepoint.c
tools/include/uapi/linux/perf_event.h +22 -0
@@ -418,6 +418,27 @@ struct perf_event_attr {__u16 __reserved_2;/* align to __u64 */ }; +/* +* Structure used by below PERF_EVENT_IOC_QUERY_BPF command +* to query bpf programs attached to the same perf tracepoint +* as the given perf event. +*/ +struct perf_event_query_bpf { +/* +* The below ids array length +*/ +__u32 ids_len; +/* +* Set by the kernel to indicate the number of +* available programs +*/ +__u32 prog_cnt; +/* +* User provided buffer to store program ids +*/ +__u32 ids[0 ]; +}; +#define perf_flags (attr) (*(&(attr)->read_format + 1))/*
@@ -433,6 +454,7 @@ struct perf_event_attr {#define PERF_EVENT_IOC_ID _IOR('$', 7, __u64 *)#define PERF_EVENT_IOC_SET_BPF _IOW('$', 8, __u32)#define PERF_EVENT_IOC_PAUSE_OUTPUT _IOW('$', 9, __u32) +#define PERF_EVENT_IOC_QUERY_BPF _IOWR('$', 10, struct perf_event_query_bpf *)enum perf_event_ioc_flags {PERF_IOC_FLAG_GROUP =1U <<0 ,
tools/testing/selftests/bpf/Makefile +1 -1
@@ -29,7 +29,7 @@ TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map test TEST_GEN_FILES = test_pkt_access.o test_xdp.o test_l4lb.o test_tcp_estats.o test_obj_id.o \ test_pkt_md_access.o test_xdp_redirect.o test_xdp_meta.o sockmap_parse_prog.o \ - sockmap_verdict_prog.o dev_cgroup.o sample_ret0.o + sockmap_verdict_prog.o dev_cgroup.o sample_ret0.o test_tracepoint.o TEST_PROGS := test_kmod.sh test_xdp_redirect.sh test_xdp_meta.sh \ test_offload.py
tools/testing/selftests/bpf/test_progs.c +134 -0
154 lines not on this page · raw message
tools/testing/selftests/bpf/test_tracepoint.c new file +26 -0
@@ -0,0 +1,26 @@ +// SPDX-License-Identifier: GPL-2.0 +// Copyright (c) 2017 Facebook + +#include <linux/bpf.h> +#include "bpf_helpers.h" + +/* taken from /sys/kernel/debug/tracing/events/sched/sched_switch/format */ +struct sched_switch_args { +unsigned long long pad; +char prev_comm[16 ]; +int prev_pid; +int prev_prio; +long long prev_state; +char next_comm[16 ]; +int next_pid; +int next_prio; +}; + +SEC("tracepoint/sched/sched_switch") +int oncpu (struct sched_switch_args *ctx) +{ +return 0 ; +} + +char _license[] SEC("license") = "GPL"; +__u32 _version SEC("version") = 1; /* ignored by tracepoints, required by libbpf.a */
Signature · 1 line
2.9.5
Daniel Borkmann
maintainerQuoted 15 lines · Yonghong Song
Commit
e87c6bc3852b("bpf: permit multiple bpf attachments for a single perf event") added support to attach multiple bpf programs to a single perf event. Given a perf event (kprobe, uprobe, or kernel tracepoint), the perf ioctl interface is used to query bpf programs attached to the same trace event.There already exists a
BPF_PROG_QUERYcommand for introspection currently used by cgroup+bpf. We did have an implementation for querying tracepoint+bpf through the same interface. However, it looks cleaner to useioctl()style of api here, since attaching bpf prog to tracepoint/kuprobe is also done via ioctl.Patch #1 had the core implementation and patch #2 added a test case in tools bpf selftests suite.
Quoted 7 lines
Changelogs:
v3 -> v4:
- Fix a compilation error with newer gcc like 6.3.1 while old gcc 4.8.5 is okay. I was using&uquery->idsto represent the address to the ids array to make it explicit that the address is passed, and this syntax is rightly rejected by gcc 6.3.1.
Series applied to bpf-next, thanks Yonghong.