Skip to contentSkip to conversation

bpf: implement BPF_PERF_EVENT_QUERY for perf event query

PATCH In review Yonghong Song 5 participants 15 messages May 15, 2018 – May 17, 2018

Subsystems (12)
Networking Network drivers Kselftest BPF +8 more subsystems
lore
Share & tools
lore

Yonghong Song

author
#0 lore raw

cover bpf: implement BPF_PERF_EVENT_QUERY for perf event query

Currently, suppose a userspace application has loaded a bpf program and attached it to a tracepoint/kprobe/uprobe, and a bpf introspection tool, e.g., bpftool, wants to show which bpf program is attached to which tracepoint/kprobe/uprobe. Such attachment information will be really useful to understand the overall bpf deployment in the system.

There is a name field (16 bytes) for each program, which could be used to encode the attachment point. There are some drawbacks for this approaches. First, bpftool user (e.g., an admin) may not really understand the association between the name and the attachment point. Second, if one program is attached to multiple places, encoding a proper name which can imply all these attachments becomes difficult.

This patch introduces a new bpf subcommand BPF_PERF_EVENT_QUERY. Given a pid and fd, if the <pid, fd> is associated with a tracepoint/kprobe/uprobea perf event, BPF_PERF_EVENT_QUERY will return
. prog_id
. tracepoint name, or
. k[ret]probe funcname + offset or kernel addr, or
. u[ret]probe filename + offset
to the userspace.
The user can use "bpftool prog" to find more information about bpf program itself with prog_id.

Patch #1 adds function perf_get_event() in kernel/events/core.c. Patch #2 implements the bpf subcommand BPF_PERF_EVENT_QUERY. Patch #3 syncs tools bpf.h header and also add bpf_trace_event_query() in the libbpf library for samples/selftests/bpftool to use. Patch #4 adds ksym_get_addr() utility function.
Patch #5 add a test in samples/bpf for querying k[ret]probes and u[ret]probes.
Patch #6 add a test in tools/testing/selftests/bpf for querying raw_tracepoint and tracepoint.
Patch #7 add a new subcommand "perf" to bpftool.

Yonghong Song (7):
perf/core: add perf_get_event() to return perf_event given a struct
file
bpf: introduce bpf subcommand BPF_PERF_EVENT_QUERY tools/bpf: sync kernel header bpf.h and add bpf_trace_event_query in
libbpf
tools/bpf: add ksym_get_addr() in trace_helpers samples/bpf: add a samples/bpf test for BPF_PERF_EVENT_QUERY tools/bpf: add two BPF_PERF_EVENT_QUERY tests in test_progs tools/bpftool: add perf subcommand

 include/linux/perf_event.h                  |   5 +
 include/linux/trace_events.h                |  15 ++
 include/uapi/linux/bpf.h                    |  25 ++
 kernel/bpf/syscall.c                        | 113 +++++++++
 kernel/events/core.c                        |   8 +
 kernel/trace/bpf_trace.c                    |  53 ++++
 kernel/trace/trace_kprobe.c                 |  29 +++
 kernel/trace/trace_uprobe.c                 |  22 ++
 samples/bpf/Makefile                        |   4 +
 samples/bpf/perf_event_query_kern.c         |  19 ++
 samples/bpf/perf_event_query_user.c         | 376 ++++++++++++++++++++++++++++
 tools/bpf/bpftool/main.c                    |   3 +-
 tools/bpf/bpftool/main.h                    |   1 +
 tools/bpf/bpftool/perf.c                    | 188 ++++++++++++++
 tools/include/uapi/linux/bpf.h              |  25 ++
 tools/lib/bpf/bpf.c                         |  23 ++
 tools/lib/bpf/bpf.h                         |   3 +
 tools/testing/selftests/bpf/test_progs.c    | 133 ++++++++++
 tools/testing/selftests/bpf/trace_helpers.c |  12 +
 tools/testing/selftests/bpf/trace_helpers.h |   1 +
 20 files changed, 1057 insertions(+), 1 deletion(-)
 create mode 100644 samples/bpf/perf_event_query_kern.c
 create mode 100644 samples/bpf/perf_event_query_user.c
 create mode 100644 tools/bpf/bpftool/perf.c
Signature · 1 line
2.9.5
author
#1 lore raw

PATCH 1/7 perf/core: add perf_get_event() to return perf_event given a struct file

A new extern function, perf_get_event(), is added to return a perf event given a struct file. This function will be used in later patches.

Signed-off-by Yonghong Song <[email protected]>
---
 include/linux/perf_event.h | 5 +++++
 kernel/events/core.c       | 8 ++++++++
 2 files changed, 13 insertions(+)
include/linux/perf_event.h +5 -0
index e71e99e..b5c1ad3 100644
@@ -868,6 +868,7 @@ extern void perf_event_exit_task(struct task_struct *child);
 extern void perf_event_free_task(struct task_struct *task);
 extern void perf_event_delayed_put(struct task_struct *task);
 extern struct file *perf_event_get(unsigned int fd);
+extern struct perf_event *perf_get_event(struct file *file);
 extern const struct perf_event_attr *perf_event_attrs(struct perf_event *event);
 extern void perf_event_print_debug(void);
 extern void perf_pmu_disable(struct pmu *pmu);

@@ -1289,6 +1290,10 @@ static inline void perf_event_exit_task(struct task_struct *child)	{ }
 static inline void perf_event_free_task(struct task_struct *task)	{ }
 static inline void perf_event_delayed_put(struct task_struct *task)	{ }
 static inline struct file *perf_event_get(unsigned int fd)	{ return ERR_PTR(-EINVAL); }
+static inline struct perf_event *perf_get_event(struct file *file)
+{
+	return ERR_PTR(-EINVAL);
+}
 static inline const struct perf_event_attr *perf_event_attrs(struct perf_event *event)
 {
 	return ERR_PTR(-EINVAL);
kernel/events/core.c +8 -0
index 67612ce..1e3cddb 100644
@@ -11212,6 +11212,14 @@ struct file *perf_event_get(unsigned int fd)
 	return file;
 }
 
+struct perf_event *perf_get_event(struct file *file)
+{
+	if (file->f_op != &perf_fops)
+		return ERR_PTR(-EINVAL);
+
+	return file->private_data;
+}
+
 const struct perf_event_attr *perf_event_attrs(struct perf_event *event)
 {
 	if (!event)
Signature · 1 line
2.9.5
author
#2 lore raw

PATCH 2/7 bpf: introduce bpf subcommand BPF_PERF_EVENT_QUERY

In reply to Yonghong Song

Currently, suppose a userspace application has loaded a bpf program and attached it to a tracepoint/kprobe/uprobe, and a bpf introspection tool, e.g., bpftool, wants to show which bpf program is attached to which tracepoint/kprobe/uprobe. Such attachment information will be really useful to understand the overall bpf deployment in the system.

There is a name field (16 bytes) for each program, which could be used to encode the attachment point. There are some drawbacks for this approaches. First, bpftool user (e.g., an admin) may not really understand the association between the name and the attachment point. Second, if one program is attached to multiple places, encoding a proper name which can imply all these attachments becomes difficult.

This patch introduces a new bpf subcommand BPF_PERF_EVENT_QUERY. Given a pid and fd, if the <pid, fd> is associated with a tracepoint/kprobe/uprobea perf event, BPF_PERF_EVENT_QUERY will return
. prog_id
. tracepoint name, or
. k[ret]probe funcname + offset or kernel addr, or
. u[ret]probe filename + offset
to the userspace.
The user can use "bpftool prog" to find more information about bpf program itself with prog_id.

Signed-off-by Yonghong Song <[email protected]>
---
 include/linux/trace_events.h |  15 ++++++
 include/uapi/linux/bpf.h     |  25 ++++++++++
 kernel/bpf/syscall.c         | 113 +++++++++++++++++++++++++++++++++++++++++++
 kernel/trace/bpf_trace.c     |  53 ++++++++++++++++++++
 kernel/trace/trace_kprobe.c  |  29 +++++++++++
 kernel/trace/trace_uprobe.c  |  22 +++++++++
 6 files changed, 257 insertions(+)
include/linux/trace_events.h +15 -0
index 2bde3ef..ec1f604 100644
@@ -473,6 +473,9 @@ int perf_event_query_prog_array(struct perf_event *event, void __user *info);
 int bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *prog);
 int bpf_probe_unregister(struct bpf_raw_event_map *btp, struct bpf_prog *prog);
 struct bpf_raw_event_map *bpf_find_raw_tracepoint(const char *name);
+int bpf_get_perf_event_info(struct file *file, u32 *prog_id, u32 *prog_info,
+			    const char **buf, u64 *probe_offset,
+			    u64 *probe_addr);
 #else
 static inline unsigned int trace_call_bpf(struct trace_event_call *call, void *ctx)
 {

@@ -504,6 +507,12 @@ static inline struct bpf_raw_event_map *bpf_find_raw_tracepoint(const char *name
 {
 	return NULL;
 }
+static inline int bpf_get_perf_event_info(struct file *file, u32 *prog_id,
+					  u32 *prog_info, const char **buf,
+					  u64 *probe_offset, u64 *probe_addr)
+{
+	return -EOPNOTSUPP;
+}
 #endif
 
 enum {

@@ -560,10 +569,16 @@ extern void perf_trace_del(struct perf_event *event, int flags);
 #ifdef CONFIG_KPROBE_EVENTS
 extern int  perf_kprobe_init(struct perf_event *event, bool is_retprobe);
 extern void perf_kprobe_destroy(struct perf_event *event);
+extern int bpf_get_kprobe_info(struct perf_event *event, u32 *prog_info,
+			       const char **symbol, u64 *probe_offset,
+			       u64 *probe_addr, bool perf_type_tracepoint);
 #endif
 #ifdef CONFIG_UPROBE_EVENTS
 extern int  perf_uprobe_init(struct perf_event *event, bool is_retprobe);
 extern void perf_uprobe_destroy(struct perf_event *event);
+extern int bpf_get_uprobe_info(struct perf_event *event, u32 *prog_info,
+			       const char **filename, u64 *probe_offset,
+			       bool perf_type_tracepoint);
 #endif
 extern int  ftrace_profile_set_filter(struct perf_event *event, int event_id,
 				     char *filter_str);
include/uapi/linux/bpf.h +25 -0
index d94d333..b78eca1 100644
@@ -97,6 +97,7 @@ enum bpf_cmd {
 	BPF_RAW_TRACEPOINT_OPEN,
 	BPF_BTF_LOAD,
 	BPF_BTF_GET_FD_BY_ID,
+	BPF_PERF_EVENT_QUERY,
 };
 
 enum bpf_map_type {

@@ -379,6 +380,22 @@ union bpf_attr {
 		__u32		btf_log_size;
 		__u32		btf_log_level;
 	};
+
+	struct {
+		int		pid;		/* input: pid */
+		int		fd;		/* input: fd */
+		__u32		flags;		/* input: flags */
+		__u32		buf_len;	/* input: buf len */
+		__aligned_u64	buf;		/* input/output:
+						 *   tp_name for tracepoint
+						 *   symbol for kprobe
+						 *   filename for uprobe
+						 */
+		__u32		prog_id;	/* output: prod_id */
+		__u32		prog_info;	/* output: BPF_PERF_INFO_* */
+		__u64		probe_offset;	/* output: probe_offset */
+		__u64		probe_addr;	/* output: probe_addr */
+	} perf_event_query;
 } __attribute__((aligned(8)));
 
 /* The description below is an attempt at providing documentation to eBPF

@@ -2450,4 +2467,12 @@ struct bpf_fib_lookup {
 	__u8	dmac[6];     /* ETH_ALEN */
 };
 
+enum {
+	BPF_PERF_INFO_TP_NAME,		/* tp name */
+	BPF_PERF_INFO_KPROBE,		/* (symbol + offset) or addr */
+	BPF_PERF_INFO_KRETPROBE,	/* (symbol + offset) or addr */
+	BPF_PERF_INFO_UPROBE,		/* filename + offset */
+	BPF_PERF_INFO_URETPROBE,	/* filename + offset */
+};
+
 #endif /* _UAPI__LINUX_BPF_H__ */
kernel/bpf/syscall.c +113 -0

132 lines not on this page · raw message

kernel/trace/bpf_trace.c +53 -0

62 lines not on this page · raw message

kernel/trace/trace_kprobe.c +29 -0
index 02aed76..595d154 100644
@@ -1287,6 +1287,35 @@ kretprobe_perf_func(struct trace_kprobe *tk, struct kretprobe_instance *ri,
 			      head, NULL);
 }
 NOKPROBE_SYMBOL(kretprobe_perf_func);
+
+int bpf_get_kprobe_info(struct perf_event *event, u32 *prog_info,
+			const char **symbol, u64 *probe_offset,
+			u64 *probe_addr, bool perf_type_tracepoint)
+{
+	const char *pevent = trace_event_name(event->tp_event);
+	const char *group = event->tp_event->class->system;
+	struct trace_kprobe *tk;
+
+	if (perf_type_tracepoint)
+		tk = find_trace_kprobe(pevent, group);
+	else
+		tk = event->tp_event->data;
+	if (!tk)
+		return -EINVAL;
+
+	*prog_info = trace_kprobe_is_return(tk) ? BPF_PERF_INFO_KRETPROBE
+						: BPF_PERF_INFO_KPROBE;
+	if (tk->symbol) {
+		*symbol = tk->symbol;
+		*probe_offset = tk->rp.kp.offset;
+		*probe_addr = 0;
+	} else {
+		*symbol = NULL;
+		*probe_offset = 0;
+		*probe_addr = (u64)tk->rp.kp.addr;
+	}
+	return 0;
+}
 #endif	/* CONFIG_PERF_EVENTS */
 
 /*
kernel/trace/trace_uprobe.c +22 -0
index ac89287..e781a9f 100644
@@ -1161,6 +1161,28 @@ static void uretprobe_perf_func(struct trace_uprobe *tu, unsigned long func,
 {
 	__uprobe_perf_func(tu, func, regs, ucb, dsize);
 }
+
+int bpf_get_uprobe_info(struct perf_event *event, u32 *prog_info,
+			const char **filename, u64 *probe_offset,
+			bool perf_type_tracepoint)
+{
+	const char *pevent = trace_event_name(event->tp_event);
+	const char *group = event->tp_event->class->system;
+	struct trace_uprobe *tu;
+
+	if (perf_type_tracepoint)
+		tu = find_probe_event(pevent, group);
+	else
+		tu = event->tp_event->data;
+	if (!tu)
+		return -EINVAL;
+
+	*prog_info = is_ret_probe(tu) ? BPF_PERF_INFO_URETPROBE
+				      : BPF_PERF_INFO_UPROBE;
+	*filename = tu->filename;
+	*probe_offset = tu->offset;
+	return 0;
+}
 #endif	/* CONFIG_PERF_EVENTS */
 
 static int
Signature · 1 line
2.9.5
maintainer
#3 lore raw

Re: [PATCH bpf-next 2/7] bpf: introduce bpf subcommand BPF_PERF_EVENT_QUERY

Quoted 27 lines · Yonghong Song

Currently, suppose a userspace application has loaded a bpf program and attached it to a tracepoint/kprobe/uprobe, and a bpf introspection tool, e.g., bpftool, wants to show which bpf program is attached to which tracepoint/kprobe/uprobe. Such attachment information will be really useful to understand the overall bpf deployment in the system.

There is a name field (16 bytes) for each program, which could be used to encode the attachment point. There are some drawbacks for this approaches. First, bpftool user (e.g., an admin) may not really understand the association between the name and the attachment point. Second, if one program is attached to multiple places, encoding a proper name which can imply all these attachments becomes difficult.

This patch introduces a new bpf subcommand BPF_PERF_EVENT_QUERY. Given a pid and fd, if the <pid, fd> is associated with a tracepoint/kprobe/uprobea perf event, BPF_PERF_EVENT_QUERY will return
. prog_id
. tracepoint name, or
. k[ret]probe funcname + offset or kernel addr, or
. u[ret]probe filename + offset
to the userspace.
The user can use "bpftool prog" to find more information about bpf program itself with prog_id.

Signed-off-by Yonghong Song <[email protected]>
Quoted 8 lines
---
 include/linux/trace_events.h |  15 ++++++
 include/uapi/linux/bpf.h     |  25 ++++++++++
 kernel/bpf/syscall.c         | 113 +++++++++++++++++++++++++++++++++++++++++++
 kernel/trace/bpf_trace.c     |  53 ++++++++++++++++++++
 kernel/trace/trace_kprobe.c  |  29 +++++++++++
 kernel/trace/trace_uprobe.c  |  22 +++++++++
 6 files changed, 257 insertions(+)

Why is the command called *_PERF_EVENT_* ? Are there not a lot of !perf places to attach BPF proglets?

author
#4 lore raw

Re: [PATCH bpf-next 2/7] bpf: introduce bpf subcommand BPF_PERF_EVENT_QUERY

Quoted 37 lines · Peter Zijlstra
Quoted 27 lines · Yonghong Song

Currently, suppose a userspace application has loaded a bpf program and attached it to a tracepoint/kprobe/uprobe, and a bpf introspection tool, e.g., bpftool, wants to show which bpf program is attached to which tracepoint/kprobe/uprobe. Such attachment information will be really useful to understand the overall bpf deployment in the system.

There is a name field (16 bytes) for each program, which could be used to encode the attachment point. There are some drawbacks for this approaches. First, bpftool user (e.g., an admin) may not really understand the association between the name and the attachment point. Second, if one program is attached to multiple places, encoding a proper name which can imply all these attachments becomes difficult.

This patch introduces a new bpf subcommand BPF_PERF_EVENT_QUERY. Given a pid and fd, if the <pid, fd> is associated with a tracepoint/kprobe/uprobea perf event, BPF_PERF_EVENT_QUERY will return
. prog_id
. tracepoint name, or
. k[ret]probe funcname + offset or kernel addr, or
. u[ret]probe filename + offset
to the userspace.
The user can use "bpftool prog" to find more information about bpf program itself with prog_id.

Signed-off-by Yonghong Song <[email protected]>
Quoted 8 lines
---
  include/linux/trace_events.h |  15 ++++++
  include/uapi/linux/bpf.h     |  25 ++++++++++
  kernel/bpf/syscall.c         | 113 +++++++++++++++++++++++++++++++++++++++++++
  kernel/trace/bpf_trace.c     |  53 ++++++++++++++++++++
  kernel/trace/trace_kprobe.c  |  29 +++++++++++
  kernel/trace/trace_uprobe.c  |  22 +++++++++
  6 files changed, 257 insertions(+)
Quoted 2 lines

Why is the command called *_PERF_EVENT_* ? Are there not a lot of !perf places to attach BPF proglets?

Just gave a complete picture, the below are major places to attach BPF programs:
. perf based (through perf ioctl)
. raw tracepoint based (through bpf interface)

. netlink interface for tc, xdp, tunneling
. setsockopt for socket filters
. cgroup based (bpf attachment subcommand)
mostly networking and io devices
. some other networking socket related (sk_skb stream/parser/verdict,
sk_msg verdict) through bpf attachment subcommand.

Currently, for cgroup based attachment, we have BPF_PROG_QUERY with input cgroup file descriptor. For other networking based queries, we may need to enumerate tc filters, networking devices, open sockets, etc.
to get the attachment information.

So to have one BPF_QUERY command line may be too complex to cover all cases.

But you are right that BPF_PERF_EVENT_QUERY name is too narrow since
it should be used for other (pid, fd) based queries as well (e.g., socket, or other potential uses in the future).

How about the subcommand name BPF_TASK_FD_QUERY and make bpf_attr.task_fd_query extensible?

Thanks!

maintainer
#5 lore raw

Re: [PATCH bpf-next 2/7] bpf: introduce bpf subcommand BPF_PERF_EVENT_QUERY

Quoted 57 lines · Yonghong Song
Quoted 37 lines · Peter Zijlstra
Quoted 27 lines · Yonghong Song

Currently, suppose a userspace application has loaded a bpf program and attached it to a tracepoint/kprobe/uprobe, and a bpf introspection tool, e.g., bpftool, wants to show which bpf program is attached to which tracepoint/kprobe/uprobe. Such attachment information will be really useful to understand the overall bpf deployment in the system.

There is a name field (16 bytes) for each program, which could be used to encode the attachment point. There are some drawbacks for this approaches. First, bpftool user (e.g., an admin) may not really understand the association between the name and the attachment point. Second, if one program is attached to multiple places, encoding a proper name which can imply all these attachments becomes difficult.

This patch introduces a new bpf subcommand BPF_PERF_EVENT_QUERY. Given a pid and fd, if the <pid, fd> is associated with a tracepoint/kprobe/uprobea perf event, BPF_PERF_EVENT_QUERY will return . prog_id
    . tracepoint name, or
    . k[ret]probe funcname + offset or kernel addr, or
    . u[ret]probe filename + offset
to the userspace.
The user can use "bpftool prog" to find more information about bpf program itself with prog_id.

Signed-off-by Yonghong Song <[email protected]>
Quoted 8 lines

---
  include/linux/trace_events.h |  15 ++++++ include/uapi/linux/bpf.h     |  25 ++++++++++ kernel/bpf/syscall.c         | 113 +++++++++++++++++++++++++++++++++++++++++++ kernel/trace/bpf_trace.c     |  53 ++++++++++++++++++++ kernel/trace/trace_kprobe.c  |  29 +++++++++++ kernel/trace/trace_uprobe.c  |  22 +++++++++

  6 files changed, 257 insertions(+)
Quoted 2 lines

Why is the command called *_PERF_EVENT_* ? Are there not a lot of !perf places to attach BPF proglets?

Just gave a complete picture, the below are major places to attach BPF programs:
   . perf based (through perf ioctl)
   . raw tracepoint based (through bpf interface)

   . netlink interface for tc, xdp, tunneling
   . setsockopt for socket filters
   . cgroup based (bpf attachment subcommand)
     mostly networking and io devices
   . some other networking socket related (sk_skb stream/parser/verdict, sk_msg verdict) through bpf attachment subcommand.

Currently, for cgroup based attachment, we have BPF_PROG_QUERY with input cgroup file descriptor. For other networking based queries, we may need to enumerate tc filters, networking devices, open sockets, etc.
to get the attachment information.

Quoted 7 lines

So to have one BPF_QUERY command line may be too complex to cover all cases.

But you are right that BPF_PERF_EVENT_QUERY name is too narrow since
it should be used for other (pid, fd) based queries as well (e.g., socket, or other potential uses in the future).

How about the subcommand name BPF_TASK_FD_QUERY and make bpf_attr.task_fd_query extensible?

I like the introspection output it provides in 7/7, it's really great! So the query interface would only ever be tied to BPF progs whose attach life time is tied to the life time of the application and as soon as all refs on the fd are released it's unloaded from the system. BPF_TASK_FD_QUERY seems okay to me, or something like BPF_ATTACH_QUERY. Even if the name is slightly more generic, it might be more fitting with other cmds like BPF_PROG_QUERY we have where we tell an attach point to retrieve all progs from it (though only tied to cgroups right now, it may not be in future).

For all the others that are not strictly tied to the task but global, bpftool would then need to be extended to query the various other interfaces like netlink for retrieval which is on todo for some point in future as well. So this set nicely complements this introspection aspect.

Thanks,
Daniel

author
#6 lore raw

Re: [PATCH bpf-next 2/7] bpf: introduce bpf subcommand BPF_PERF_EVENT_QUERY

Quoted 66 lines · Daniel Borkmann
Quoted 57 lines · Yonghong Song
Quoted 37 lines · Peter Zijlstra
Quoted 27 lines · Yonghong Song

Currently, suppose a userspace application has loaded a bpf program and attached it to a tracepoint/kprobe/uprobe, and a bpf introspection tool, e.g., bpftool, wants to show which bpf program is attached to which tracepoint/kprobe/uprobe. Such attachment information will be really useful to understand the overall bpf deployment in the system.

There is a name field (16 bytes) for each program, which could be used to encode the attachment point. There are some drawbacks for this approaches. First, bpftool user (e.g., an admin) may not really understand the association between the name and the attachment point. Second, if one program is attached to multiple places, encoding a proper name which can imply all these attachments becomes difficult.

This patch introduces a new bpf subcommand BPF_PERF_EVENT_QUERY. Given a pid and fd, if the <pid, fd> is associated with a tracepoint/kprobe/uprobea perf event, BPF_PERF_EVENT_QUERY will return
    . prog_id
    . tracepoint name, or
    . k[ret]probe funcname + offset or kernel addr, or
    . u[ret]probe filename + offset
to the userspace.
The user can use "bpftool prog" to find more information about bpf program itself with prog_id.

Signed-off-by Yonghong Song <[email protected]>
Quoted 8 lines
---
   include/linux/trace_events.h |  15 ++++++
   include/uapi/linux/bpf.h     |  25 ++++++++++
   kernel/bpf/syscall.c         | 113 +++++++++++++++++++++++++++++++++++++++++++
   kernel/trace/bpf_trace.c     |  53 ++++++++++++++++++++
   kernel/trace/trace_kprobe.c  |  29 +++++++++++
   kernel/trace/trace_uprobe.c  |  22 +++++++++
   6 files changed, 257 insertions(+)
Quoted 2 lines

Why is the command called *_PERF_EVENT_* ? Are there not a lot of !perf places to attach BPF proglets?

Just gave a complete picture, the below are major places to attach BPF programs:
   . perf based (through perf ioctl)
   . raw tracepoint based (through bpf interface)

   . netlink interface for tc, xdp, tunneling
   . setsockopt for socket filters
   . cgroup based (bpf attachment subcommand)
     mostly networking and io devices
   . some other networking socket related (sk_skb stream/parser/verdict, sk_msg verdict) through bpf attachment subcommand.

Currently, for cgroup based attachment, we have BPF_PROG_QUERY with input cgroup file descriptor. For other networking based queries, we may need to enumerate tc filters, networking devices, open sockets, etc.
to get the attachment information.

Quoted 7 lines

So to have one BPF_QUERY command line may be too complex to cover all cases.

But you are right that BPF_PERF_EVENT_QUERY name is too narrow since
it should be used for other (pid, fd) based queries as well (e.g., socket, or other potential uses in the future).

How about the subcommand name BPF_TASK_FD_QUERY and make bpf_attr.task_fd_query extensible?

Quoted 8 lines

I like the introspection output it provides in 7/7, it's really great! So the query interface would only ever be tied to BPF progs whose attach life time is tied to the life time of the application and as soon as all refs on the fd are released it's unloaded from the system. BPF_TASK_FD_QUERY seems okay to me, or something like BPF_ATTACH_QUERY. Even if the name is slightly more generic, it might be more fitting with other cmds like BPF_PROG_QUERY we have where we tell an attach point to retrieve all progs from it (though only tied to cgroups right now, it may not be in future).

I think BPF_TASK_FD_QUERY is okay. Using BPF_ATTACH_QUERY indeed seems a little bit broader to me as other query subcommands are possible to query attachments with different input.

BPF_PROG_QUERY is also trying to query attachment. Currently, given a cgroup fd, it will query prog array attached. Sean has the patch to attach bpf programs to a RC device, and given a device fd, it will query prog array attached to that device.

Quoted 5 lines

For all the others that are not strictly tied to the task but global, bpftool would then need to be extended to query the various other interfaces like netlink for retrieval which is on todo for some point in future as well. So this set nicely complements this introspection aspect.

Totally agree.
Thanks!

Quoted 4 lines

Thanks,
Daniel

build bot
#7 lore raw

Re: [PATCH bpf-next 2/7] bpf: introduce bpf subcommand BPF_PERF_EVENT_QUERY

In reply to Yonghong Song
Thank you for the patch! Perhaps something to improve:

Hi Yonghong,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on bpf-next/master]

url:    https://github.com/0day-ci/linux/commits/Yonghong-Song/bpf-implement-BPF_PERF_EVENT_QUERY-for-perf-event-query/20180518-060508
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
config: i386-randconfig-x000-201819 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-16) 7.3.0
reproduce:
        # save the attached .config to linux build tree
        make ARCH=i386

All warnings (new ones prefixed by >>):

kernel/trace/trace_kprobe.c: In function 'bpf_get_kprobe_info':

>> kernel/trace/trace_kprobe.c:1315:17: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
      *probe_addr = (u64)tk->rp.kp.addr;
                    ^

vim +1315 kernel/trace/trace_kprobe.c

1290
1291 int bpf_get_kprobe_info(struct perf_event *event, u32 *prog_info,
1292 const char **symbol, u64 *probe_offset,
1293 u64 *probe_addr, bool perf_type_tracepoint)
1294 {
1295 const char *pevent = trace_event_name(event->tp_event);
1296 const char *group = event->tp_event->class->system;
1297 struct trace_kprobe *tk;
1298
1299 if (perf_type_tracepoint)
1300 tk = find_trace_kprobe(pevent, group);
1301 else
1302 tk = event->tp_event->data;
1303 if (!tk)
1304 return -EINVAL;
1305
1306 *prog_info = trace_kprobe_is_return(tk) ? BPF_PERF_INFO_KRETPROBE
1307 : BPF_PERF_INFO_KPROBE;
1308 if (tk->symbol) {
1309 *symbol = tk->symbol;
1310 *probe_offset = tk->rp.kp.offset;
1311 *probe_addr = 0;
1312 } else {
1313 *symbol = NULL;
1314 *probe_offset = 0;

> 1315			*probe_addr = (u64)tk->rp.kp.addr;

1316 }
1317 return 0;
1318 }
1319 #endif /* CONFIG_PERF_EVENTS */
1320

---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation

author
#8 lore raw

PATCH 3/7 tools/bpf: sync kernel header bpf.h and add bpf_trace_event_query in libbpf

In reply to Yonghong Song

Sync kernel header bpf.h to tools/include/uapi/linux/bpf.h and implement bpf_trace_event_query() in libbpf. The test programs in samples/bpf and tools/testing/selftests/bpf, and later bpftool will use this libbpf function to query kernel.

Signed-off-by Yonghong Song <[email protected]>
---
 tools/include/uapi/linux/bpf.h | 25 +++++++++++++++++++++++++
 tools/lib/bpf/bpf.c            | 23 +++++++++++++++++++++++
 tools/lib/bpf/bpf.h            |  3 +++
 3 files changed, 51 insertions(+)
tools/include/uapi/linux/bpf.h +25 -0
index 1205d86..a209f01 100644
@@ -97,6 +97,7 @@ enum bpf_cmd {
 	BPF_RAW_TRACEPOINT_OPEN,
 	BPF_BTF_LOAD,
 	BPF_BTF_GET_FD_BY_ID,
+	BPF_PERF_EVENT_QUERY,
 };
 
 enum bpf_map_type {

@@ -379,6 +380,22 @@ union bpf_attr {
 		__u32		btf_log_size;
 		__u32		btf_log_level;
 	};
+
+	struct {
+		int		pid;		/* input: pid */
+		int		fd;		/* input: fd */
+		__u32		flags;		/* input: flags */
+		__u32		buf_len;	/* input: buf len */
+		__aligned_u64	buf;		/* input/output:
+						 *   tp_name for tracepoint
+						 *   symbol for kprobe
+						 *   filename for uprobe
+						 */
+		__u32		prog_id;	/* output: prod_id */
+		__u32		prog_info;	/* output: BPF_PERF_INFO_* */
+		__u64		probe_offset;	/* output: probe_offset */
+		__u64		probe_addr;	/* output: probe_addr */
+	} perf_event_query;
 } __attribute__((aligned(8)));
 
 /* The description below is an attempt at providing documentation to eBPF

@@ -2450,4 +2467,12 @@ struct bpf_fib_lookup {
 	__u8	dmac[6];     /* ETH_ALEN */
 };
 
+enum {
+	BPF_PERF_INFO_TP_NAME,		/* tp name */
+	BPF_PERF_INFO_KPROBE,		/* (symbol + offset) or addr */
+	BPF_PERF_INFO_KRETPROBE,	/* (symbol + offset) or addr */
+	BPF_PERF_INFO_UPROBE,		/* filename + offset */
+	BPF_PERF_INFO_URETPROBE,	/* filename + offset */
+};
+
 #endif /* _UAPI__LINUX_BPF_H__ */
tools/lib/bpf/bpf.c +23 -0
index a3a8fb2..e0152aa 100644
@@ -641,3 +641,26 @@ int bpf_load_btf(void *btf, __u32 btf_size, char *log_buf, __u32 log_buf_size,
 
 	return fd;
 }
+
+int bpf_trace_event_query(int pid, int fd, char *buf, __u32 buf_len,
+			  __u32 *prog_id, __u32 *prog_info,
+			  __u64 *probe_offset, __u64 *probe_addr)
+{
+	union bpf_attr attr = {};
+	int err;
+
+	attr.perf_event_query.pid = pid;
+	attr.perf_event_query.fd = fd;
+	attr.perf_event_query.buf = ptr_to_u64(buf);
+	attr.perf_event_query.buf_len = buf_len;
+
+	err = sys_bpf(BPF_PERF_EVENT_QUERY, &attr, sizeof(attr));
+	if (!err) {
+		*prog_id = attr.perf_event_query.prog_id;
+		*prog_info = attr.perf_event_query.prog_info;
+		*probe_offset = attr.perf_event_query.probe_offset;
+		*probe_addr = attr.perf_event_query.probe_addr;
+	}
+
+	return err;
+}
tools/lib/bpf/bpf.h +3 -0
index fb3a146..53d05fc 100644
@@ -105,4 +105,7 @@ int bpf_prog_query(int target_fd, enum bpf_attach_type type, __u32 query_flags,
 int bpf_raw_tracepoint_open(const char *name, int prog_fd);
 int bpf_load_btf(void *btf, __u32 btf_size, char *log_buf, __u32 log_buf_size,
 		 bool do_log);
+int bpf_trace_event_query(int pid, int fd, char *buf, __u32 buf_len,
+			  __u32 *prog_id, __u32 *prog_info,
+			  __u64 *probe_offset, __u64 *probe_addr);
 #endif
Signature · 1 line
2.9.5
author
#9 lore raw

PATCH 4/7 tools/bpf: add ksym_get_addr() in trace_helpers

In reply to Yonghong Song

Given a kernel function name, ksym_get_addr() will return the kernel address for this function, or 0 if it cannot find this function name in /proc/kallsyms. This function will be used later when a kernel address is used to initiate a kprobe perf event.

Signed-off-by Yonghong Song <[email protected]>
---
 tools/testing/selftests/bpf/trace_helpers.c | 12 ++++++++++++
 tools/testing/selftests/bpf/trace_helpers.h |  1 +
 2 files changed, 13 insertions(+)
tools/testing/selftests/bpf/trace_helpers.c +12 -0
index 8fb4fe8..3868dcb 100644
@@ -72,6 +72,18 @@ struct ksym *ksym_search(long key)
 	return &syms[0];
 }
 
+long ksym_get_addr(const char *name)
+{
+	int i;
+
+	for (i = 0; i < sym_cnt; i++) {
+		if (strcmp(syms[i].name, name) == 0)
+			return syms[i].addr;
+	}
+
+	return 0;
+}
+
 static int page_size;
 static int page_cnt = 8;
 static struct perf_event_mmap_page *header;
tools/testing/selftests/bpf/trace_helpers.h +1 -0
index 36d90e3..3b4bcf7 100644
@@ -11,6 +11,7 @@ struct ksym {
 
 int load_kallsyms(void);
 struct ksym *ksym_search(long key);
+long ksym_get_addr(const char *name);
 
 typedef enum bpf_perf_event_ret (*perf_event_print_fn)(void *data, int size);
Signature · 1 line
2.9.5
author
#10 lore raw

PATCH 5/7 samples/bpf: add a samples/bpf test for BPF_PERF_EVENT_QUERY

In reply to Yonghong Song

This is mostly to test kprobe/uprobe which needs kernel headers.

Signed-off-by Yonghong Song <[email protected]>
---
 samples/bpf/Makefile                |   4 +
 samples/bpf/perf_event_query_kern.c |  19 ++
 samples/bpf/perf_event_query_user.c | 376 ++++++++++++++++++++++++++++++++++++
 3 files changed, 399 insertions(+)
 create mode 100644 samples/bpf/perf_event_query_kern.c
 create mode 100644 samples/bpf/perf_event_query_user.c
samples/bpf/Makefile +4 -0
index 62d1aa1..c23e8fe 100644
@@ -51,6 +51,7 @@ hostprogs-y += cpustat
 hostprogs-y += xdp_adjust_tail
 hostprogs-y += xdpsock
 hostprogs-y += xdp_fwd
+hostprogs-y += perf_event_query
 
 # Libbpf dependencies
 LIBBPF = $(TOOLS_PATH)/lib/bpf/libbpf.a

@@ -105,6 +106,7 @@ cpustat-objs := bpf_load.o cpustat_user.o
 xdp_adjust_tail-objs := xdp_adjust_tail_user.o
 xdpsock-objs := bpf_load.o xdpsock_user.o
 xdp_fwd-objs := bpf_load.o xdp_fwd_user.o
+perf_event_query-objs := bpf_load.o perf_event_query_user.o $(TRACE_HELPERS)
 
 # Tell kbuild to always build the programs
 always := $(hostprogs-y)

@@ -160,6 +162,7 @@ always += cpustat_kern.o
 always += xdp_adjust_tail_kern.o
 always += xdpsock_kern.o
 always += xdp_fwd_kern.o
+always += perf_event_query_kern.o
 
 HOSTCFLAGS += -I$(objtree)/usr/include
 HOSTCFLAGS += -I$(srctree)/tools/lib/

@@ -175,6 +178,7 @@ HOSTCFLAGS_offwaketime_user.o += -I$(srctree)/tools/lib/bpf/
 HOSTCFLAGS_spintest_user.o += -I$(srctree)/tools/lib/bpf/
 HOSTCFLAGS_trace_event_user.o += -I$(srctree)/tools/lib/bpf/
 HOSTCFLAGS_sampleip_user.o += -I$(srctree)/tools/lib/bpf/
+HOSTCFLAGS_perf_event_query_user.o += -I$(srctree)/tools/lib/bpf/
 
 HOST_LOADLIBES		+= $(LIBBPF) -lelf
 HOSTLOADLIBES_tracex4		+= -lrt
samples/bpf/perf_event_query_kern.c new file +19 -0
new file mode 100644
index 0000000..f4b0a9e
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/version.h>
+#include <linux/ptrace.h>
+#include <uapi/linux/bpf.h>
+#include "bpf_helpers.h"
+
+SEC("kprobe/blk_start_request")
+int bpf_prog1(struct pt_regs *ctx)
+{
+	return 0;
+}
+
+SEC("kretprobe/blk_account_io_completion")
+int bpf_prog2(struct pt_regs *ctx)
+{
+	return 0;
+}
+char _license[] SEC("license") = "GPL";
+u32 _version SEC("version") = LINUX_VERSION_CODE;
samples/bpf/perf_event_query_user.c new file +376 -0

376 lines not on this page · raw message

Signature · 1 line
2.9.5
author
#11 lore raw

PATCH 6/7 tools/bpf: add two BPF_PERF_EVENT_QUERY tests in test_progs

In reply to Yonghong Song

The new tests are added to query perf_event information for raw_tracepoint and tracepoint attachment. For tracepoint, both syscalls and non-syscalls tracepoints are queries as they are treated slightly differently inside the kernel.

Signed-off-by Yonghong Song <[email protected]>
---
 tools/testing/selftests/bpf/test_progs.c | 133 +++++++++++++++++++++++++++++++
 1 file changed, 133 insertions(+)
tools/testing/selftests/bpf/test_progs.c +133 -0
index 3ecf733..138d1e9 100644
@@ -1542,6 +1542,137 @@ static void test_get_stack_raw_tp(void)
 	bpf_object__close(obj);
 }
 
+static void test_query_trace_event_rawtp(void)
+{
+	const char *file = "./test_get_stack_rawtp.o";
+	struct perf_event_attr attr = {};
+	int efd, err, prog_fd, pmu_fd;
+	struct bpf_object *obj;
+	__u32 duration = 0;
+	char buf[256];
+	__u32 prog_id, prog_info;
+	__u64 probe_offset, probe_addr;
+
+	err = bpf_prog_load(file, BPF_PROG_TYPE_RAW_TRACEPOINT, &obj, &prog_fd);
+	if (CHECK(err, "prog_load raw tp", "err %d errno %d\n", err, errno))
+		return;
+
+	efd = bpf_raw_tracepoint_open("sys_enter", prog_fd);
+	if (CHECK(efd < 0, "raw_tp_open", "err %d errno %d\n", efd, errno))
+		goto close_prog;
+
+	attr.sample_type = PERF_SAMPLE_RAW;
+	attr.type = PERF_TYPE_SOFTWARE;
+	attr.config = PERF_COUNT_SW_BPF_OUTPUT;
+	pmu_fd = syscall(__NR_perf_event_open, &attr, getpid(), -1, -1, 0);
+	if (CHECK(pmu_fd < 0, "perf_event_open", "err %d errno %d\n", pmu_fd,
+		  errno))
+		goto close_prog;
+
+	err = ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0);
+	if (CHECK(err < 0, "ioctl PERF_EVENT_IOC_ENABLE", "err %d errno %d\n",
+		  err, errno))
+		goto close_prog;
+
+	/* query (getpid(), efd */
+	err = bpf_trace_event_query(getpid(), efd, buf, 256, &prog_id,
+				    &prog_info, &probe_offset, &probe_addr);
+	if (CHECK(err < 0, "bpf_trace_event_query", "err %d errno %d\n", err,
+		  errno))
+		goto close_prog;
+
+	err = (prog_info == BPF_PERF_INFO_TP_NAME) &&
+	      (strcmp(buf, "sys_enter") == 0);
+	if (CHECK(!err, "check_results", "prog_info %d tp_name %s\n",
+		  prog_info, buf))
+		goto close_prog;
+
+	goto close_prog_noerr;
+close_prog:
+	error_cnt++;
+close_prog_noerr:
+	bpf_object__close(obj);
+}
+
+static void test_query_trace_event_tp_core(const char *probe_name,
+					   const char *tp_name)
+{
+	const char *file = "./test_tracepoint.o";
+	int err, bytes, efd, prog_fd, pmu_fd;
+	struct perf_event_attr attr = {};
+	struct bpf_object *obj;
+	__u32 duration = 0;
+	char buf[256];
+	__u32 prog_id, prog_info;
+	__u64 probe_offset, probe_addr;
+
+	err = bpf_prog_load(file, BPF_PROG_TYPE_TRACEPOINT, &obj, &prog_fd);
+	if (CHECK(err, "bpf_prog_load", "err %d errno %d\n", err, errno))
+		goto close_prog;
+
+	snprintf(buf, sizeof(buf),
+		 "/sys/kernel/debug/tracing/events/%s/id", probe_name);
+	efd = open(buf, O_RDONLY, 0);
+	if (CHECK(efd < 0, "open", "err %d errno %d\n", efd, errno))
+		goto close_prog;
+	bytes = read(efd, buf, sizeof(buf));
+	close(efd);
+	if (CHECK(bytes <= 0 || bytes >= sizeof(buf), "read",
+		  "bytes %d errno %d\n", bytes, errno))
+		goto close_prog;
+
+	attr.config = strtol(buf, NULL, 0);
+	attr.type = PERF_TYPE_TRACEPOINT;
+	attr.sample_type = PERF_SAMPLE_RAW;
+	attr.sample_period = 1;
+	attr.wakeup_events = 1;
+	pmu_fd = syscall(__NR_perf_event_open, &attr, -1 /* pid */,
+			 0 /* cpu 0 */, -1 /* group id */,
+			 0 /* flags */);
+	if (CHECK(err, "perf_event_open", "err %d errno %d\n", err, errno))
+		goto close_pmu;
+
+	err = ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0);
+	if (CHECK(err, "perf_event_ioc_enable", "err %d errno %d\n", err,
+		  errno))
+		goto close_pmu;
+
+	err = ioctl(pmu_fd, PERF_EVENT_IOC_SET_BPF, prog_fd);
+	if (CHECK(err, "perf_event_ioc_set_bpf", "err %d errno %d\n", err,
+		  errno))
+		goto close_pmu;
+
+	/* query (getpid(), pmu_fd */
+	err = bpf_trace_event_query(getpid(), pmu_fd, buf, 256, &prog_id,
+				    &prog_info, &probe_offset, &probe_addr);
+	if (CHECK(err < 0, "bpf_trace_event_query", "err %d errno %d\n", err,
+		  errno))
+		goto close_pmu;
+
+	err = (prog_info == BPF_PERF_INFO_TP_NAME) && !strcmp(buf, tp_name);
+	if (CHECK(!err, "check_results", "prog_info %d tp_name %s\n",
+		  prog_info, buf))
+		goto close_pmu;
+
+	close(pmu_fd);
+	goto close_prog_noerr;
+
+close_pmu:
+	close(pmu_fd);
+close_prog:
+	error_cnt++;
+close_prog_noerr:
+	bpf_object__close(obj);
+}
+
+static void test_query_trace_event_tp(void)
+{
+	test_query_trace_event_tp_core("sched/sched_switch",
+				       "sched_switch");
+	test_query_trace_event_tp_core("syscalls/sys_enter_read",
+				       "sys_enter_read");
+}
+
 int main(void)
 {
 	jit_enabled = is_jit_enabled();

@@ -1561,6 +1692,8 @@ int main(void)
 	test_stacktrace_build_id_nmi();
 	test_stacktrace_map_raw_tp();
 	test_get_stack_raw_tp();
+	test_query_trace_event_rawtp();
+	test_query_trace_event_tp();
 
 	printf("Summary: %d PASSED, %d FAILED\n", pass_cnt, error_cnt);
 	return error_cnt ? EXIT_FAILURE : EXIT_SUCCESS;
Signature · 1 line
2.9.5
author
#12 lore raw

PATCH 7/7 tools/bpftool: add perf subcommand

In reply to Yonghong Song

The new command "bpftool perf [show]" will traverse all processes under /proc, and if any fd is associated with a perf event, it will print out related perf event information.

Below is an example to show the results using bcc commands. Running the following 4 bcc commands:
kprobe: trace.py '__x64_sys_nanosleep'
kretprobe: trace.py 'r::__x64_sys_nanosleep'
tracepoint: trace.py 't:syscalls:sys_enter_nanosleep'
uprobe: trace.py 'p:/home/yhs/a.out:main'

The bpftool command line and result:

  $ bpftool perf
  21711: prog_id 5 kprobe func __x64_sys_write offset 0
  21765: prog_id 7 kretprobe func __x64_sys_nanosleep offset 0
  21767: prog_id 8 tracepoint sys_enter_nanosleep
  21800: prog_id 9 uprobe filename /home/yhs/a.out offset 1159
  $ bpftool -j perf
  {"pid":21711,"prog_id":5,"prog_info":"kprobe","func":"__x64_sys_write","offset":0}, \
  {"pid":21765,"prog_id":7,"prog_info":"kretprobe","func":"__x64_sys_nanosleep","offset":0}, \
  {"pid":21767,"prog_id":8,"prog_info":"tracepoint","tracepoint":"sys_enter_nanosleep"}, \
  {"pid":21800,"prog_id":9,"prog_info":"uprobe","filename":"/home/yhs/a.out","offset":1159}
  $ bpftool prog
  5: kprobe  name probe___x64_sys  tag e495a0c82f2c7a8d  gpl
	  loaded_at 2018-05-15T04:46:37-0700  uid 0
	  xlated 200B  not jited  memlock 4096B  map_ids 4
  7: kprobe  name probe___x64_sys  tag f2fdee479a503abf  gpl
	  loaded_at 2018-05-15T04:48:32-0700  uid 0
	  xlated 200B  not jited  memlock 4096B  map_ids 7
  8: tracepoint  name tracepoint__sys  tag 5390badef2395fcf  gpl
	  loaded_at 2018-05-15T04:48:48-0700  uid 0
	  xlated 200B  not jited  memlock 4096B  map_ids 8
  9: kprobe  name probe_main_1  tag 0a87bdc2e2953b6d  gpl
	  loaded_at 2018-05-15T04:49:52-0700  uid 0
	  xlated 200B  not jited  memlock 4096B  map_ids 9
  $ ps ax | grep "python ./trace.py"
  21711 pts/0    T      0:03 python ./trace.py __x64_sys_write
  21765 pts/0    S+     0:00 python ./trace.py r::__x64_sys_nanosleep
  21767 pts/2    S+     0:00 python ./trace.py t:syscalls:sys_enter_nanosleep
  21800 pts/3    S+     0:00 python ./trace.py p:/home/yhs/a.out:main
  22374 pts/1    S+     0:00 grep --color=auto python ./trace.py
Signed-off-by Yonghong Song <[email protected]>
---
 tools/bpf/bpftool/main.c |   3 +-
 tools/bpf/bpftool/main.h |   1 +
 tools/bpf/bpftool/perf.c | 188 +++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 191 insertions(+), 1 deletion(-)
 create mode 100644 tools/bpf/bpftool/perf.c
tools/bpf/bpftool/main.c +2 -1
index 1ec852d..eea7f14 100644
@@ -87,7 +87,7 @@ static int do_help(int argc, char **argv)
 		"       %s batch file FILE\n"
 		"       %s version\n"
 		"\n"
-		"       OBJECT := { prog | map | cgroup }\n"
+		"       OBJECT := { prog | map | cgroup | perf }\n"
 		"       " HELP_SPEC_OPTIONS "\n"
 		"",
 		bin_name, bin_name, bin_name);

@@ -216,6 +216,7 @@ static const struct cmd cmds[] = {
 	{ "prog",	do_prog },
 	{ "map",	do_map },
 	{ "cgroup",	do_cgroup },
+	{ "perf",	do_perf },
 	{ "version",	do_version },
 	{ 0 }
 };
tools/bpf/bpftool/main.h +1 -0
index 6173cd9..63fdb31 100644
@@ -119,6 +119,7 @@ int do_prog(int argc, char **arg);
 int do_map(int argc, char **arg);
 int do_event_pipe(int argc, char **argv);
 int do_cgroup(int argc, char **arg);
+int do_perf(int argc, char **arg);
 
 int prog_parse_fd(int *argc, char ***argv);
 int map_parse_fd_and_info(int *argc, char ***argv, void *info, __u32 *info_len);
tools/bpf/bpftool/perf.c new file +188 -0

188 lines not on this page · raw message

Signature · 1 line
2.9.5
#13 lore raw

Re: [PATCH bpf-next 7/7] tools/bpftool: add perf subcommand

Quoted 20 lines · Yonghong Song

The new command "bpftool perf [show]" will traverse all processes under /proc, and if any fd is associated with a perf event, it will print out related perf event information.

Below is an example to show the results using bcc commands. Running the following 4 bcc commands:
kprobe: trace.py '__x64_sys_nanosleep'
kretprobe: trace.py 'r::__x64_sys_nanosleep'
tracepoint: trace.py 't:syscalls:sys_enter_nanosleep'
uprobe: trace.py 'p:/home/yhs/a.out:main'

The bpftool command line and result:

  $ bpftool perf
  21711: prog_id 5 kprobe func __x64_sys_write offset 0
  21765: prog_id 7 kretprobe func __x64_sys_nanosleep offset 0
  21767: prog_id 8 tracepoint sys_enter_nanosleep
  21800: prog_id 9 uprobe filename /home/yhs/a.out offset 1159
Quoted 5 lines
  $ bpftool -j perf
  {"pid":21711,"prog_id":5,"prog_info":"kprobe","func":"__x64_sys_write","offset":0}, \
  {"pid":21765,"prog_id":7,"prog_info":"kretprobe","func":"__x64_sys_nanosleep","offset":0}, \
  {"pid":21767,"prog_id":8,"prog_info":"tracepoint","tracepoint":"sys_enter_nanosleep"}, \
  {"pid":21800,"prog_id":9,"prog_info":"uprobe","filename":"/home/yhs/a.out","offset":1159}

You need to wrap the objects inside an array, so

	if (json_output)
		jsonw_start_array(json_wtr);
	nftw();
	if (json_output)
		jsonw_end_array(json_wtr);

otherwise output will not be a valid JSON. To validate JSON try:

$ bpftool -j perf | python -m json.tool
Quoted 21 lines
  $ bpftool prog
  5: kprobe  name probe___x64_sys  tag e495a0c82f2c7a8d  gpl
	  loaded_at 2018-05-15T04:46:37-0700  uid 0
	  xlated 200B  not jited  memlock 4096B  map_ids 4
  7: kprobe  name probe___x64_sys  tag f2fdee479a503abf  gpl
	  loaded_at 2018-05-15T04:48:32-0700  uid 0
	  xlated 200B  not jited  memlock 4096B  map_ids 7
  8: tracepoint  name tracepoint__sys  tag 5390badef2395fcf  gpl
	  loaded_at 2018-05-15T04:48:48-0700  uid 0
	  xlated 200B  not jited  memlock 4096B  map_ids 8
  9: kprobe  name probe_main_1  tag 0a87bdc2e2953b6d  gpl
	  loaded_at 2018-05-15T04:49:52-0700  uid 0
	  xlated 200B  not jited  memlock 4096B  map_ids 9
  $ ps ax | grep "python ./trace.py"
  21711 pts/0    T      0:03 python ./trace.py __x64_sys_write
  21765 pts/0    S+     0:00 python ./trace.py r::__x64_sys_nanosleep
  21767 pts/2    S+     0:00 python ./trace.py t:syscalls:sys_enter_nanosleep
  21800 pts/3    S+     0:00 python ./trace.py p:/home/yhs/a.out:main
  22374 pts/1    S+     0:00 grep --color=auto python ./trace.py
Quoted 5 lines
Signed-off-by Yonghong Song <[email protected]>
---
 tools/bpf/bpftool/main.c |   3 +-
 tools/bpf/bpftool/main.h |   1 +
 tools/bpf/bpftool/perf.c | 188 +++++++++++++++++++++++++++++++++++++++++++++++

Would you be able to also extend the Documentation/ and bash completions?

Quoted 96 lines
 3 files changed, 191 insertions(+), 1 deletion(-)
 create mode 100644 tools/bpf/bpftool/perf.c
tools/bpf/bpftool/main.c +2 -1
index 1ec852d..eea7f14 100644
@@ -87,7 +87,7 @@ static int do_help(int argc, char **argv)
 		"       %s batch file FILE\n"
 		"       %s version\n"
 		"\n"
-		"       OBJECT := { prog | map | cgroup }\n"
+		"       OBJECT := { prog | map | cgroup | perf }\n"
 		"       " HELP_SPEC_OPTIONS "\n"
 		"",
 		bin_name, bin_name, bin_name);

@@ -216,6 +216,7 @@ static const struct cmd cmds[] = {
 	{ "prog",	do_prog },
 	{ "map",	do_map },
 	{ "cgroup",	do_cgroup },
+	{ "perf",	do_perf },
 	{ "version",	do_version },
 	{ 0 }
 };
tools/bpf/bpftool/main.h +1 -0
index 6173cd9..63fdb31 100644
@@ -119,6 +119,7 @@ int do_prog(int argc, char **arg);
 int do_map(int argc, char **arg);
 int do_event_pipe(int argc, char **argv);
 int do_cgroup(int argc, char **arg);
+int do_perf(int argc, char **arg);
 
 int prog_parse_fd(int *argc, char ***argv);
 int map_parse_fd_and_info(int *argc, char ***argv, void *info, __u32 *info_len);
tools/bpf/bpftool/perf.c new file +54 -0
new file mode 100644
index 0000000..6d676e4
@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: GPL-2.0+
+// Copyright (C) 2018 Facebook
+// Author: Yonghong Song <[email protected]>
+
+#define _GNU_SOURCE
+#include <fcntl.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <ftw.h>
+
+#include <bpf.h>
+
+#include "main.h"
+
+static void print_perf_json(int pid, __u32 prog_id, __u32 prog_info,
+			    char *buf, __u64 probe_offset, __u64 probe_addr)
+{
+	jsonw_start_object(json_wtr);
+	jsonw_int_field(json_wtr, "pid", pid);
+	jsonw_uint_field(json_wtr, "prog_id", prog_id);
+	switch (prog_info) {
+	case BPF_PERF_INFO_TP_NAME:
+		jsonw_string_field(json_wtr, "prog_info", "tracepoint");
+		jsonw_string_field(json_wtr, "tracepoint", buf);
+		break;
+	case BPF_PERF_INFO_KPROBE:
+		jsonw_string_field(json_wtr, "prog_info", "kprobe");
+		if (buf[0] != '\0') {
+			jsonw_string_field(json_wtr, "func", buf);
+			jsonw_lluint_field(json_wtr, "offset", probe_offset);
+		} else {
+			jsonw_lluint_field(json_wtr, "addr", probe_addr);
+		}
+		break;
+	case BPF_PERF_INFO_KRETPROBE:
+		jsonw_string_field(json_wtr, "prog_info", "kretprobe");
+		if (buf[0] != '\0') {
+			jsonw_string_field(json_wtr, "func", buf);
+			jsonw_lluint_field(json_wtr, "offset", probe_offset);
+		} else {
+			jsonw_lluint_field(json_wtr, "addr", probe_addr);
+		}
+		break;
+	case BPF_PERF_INFO_UPROBE:
+		jsonw_string_field(json_wtr, "prog_info", "uprobe");
+		jsonw_string_field(json_wtr, "filename", buf);
+		jsonw_lluint_field(json_wtr, "offset", probe_offset);
+		break;
+	case BPF_PERF_INFO_URETPROBE:
+		jsonw_string_field(json_wtr, "prog_info", "uretprobe");
+		jsonw_string_field(json_wtr, "filename", buf);

tools/bpf/bpftool/perf.c line 64

Quoted 10 lines
tools/bpf/bpftool/perf.c new file +10 -0
+		jsonw_lluint_field(json_wtr, "offset", probe_offset);
+		break;
+	}
+	jsonw_end_object(json_wtr);
+}
+
+static void print_perf_plain(int pid, __u32 prog_id, __u32 prog_info,
+			    char *buf, __u64 probe_offset, __u64 probe_addr)
+{
+	printf("%d: prog_id %u ", pid, prog_id);

nit: for consistency with prog and map listings consider using double spaces after prog_id (i.e. between fields). Not a hard requirement, though, perhaps I'm the only one who finds that more readable :)

Quoted 35 lines
tools/bpf/bpftool/perf.c new file +35 -0
+	switch (prog_info) {
+	case BPF_PERF_INFO_TP_NAME:
+		printf("tracepoint %s\n", buf);
+		break;
+	case BPF_PERF_INFO_KPROBE:
+		if (buf[0] != '\0')
+			printf("kprobe func %s offset %llu\n", buf,
+			       probe_offset);
+		else
+			printf("kprobe addr %llu\n", probe_addr);
+		break;
+	case BPF_PERF_INFO_KRETPROBE:
+		if (buf[0] != '\0')
+			printf("kretprobe func %s offset %llu\n", buf,
+			       probe_offset);
+		else
+			printf("kretprobe addr %llu\n", probe_addr);
+		break;
+	case BPF_PERF_INFO_UPROBE:
+		printf("uprobe filename %s offset %llu\n", buf, probe_offset);
+		break;
+	case BPF_PERF_INFO_URETPROBE:
+		printf("uretprobe filename %s offset %llu\n", buf,
+		       probe_offset);
+		break;
+	}
+}
+
+static int show_proc(const char *fpath, const struct stat *sb,
+		     int tflag, struct FTW *ftwbuf)
+{
+	__u64 probe_offset, probe_addr;
+	__u32 prog_id, prog_info;
+	int err, pid = 0, fd = 0;
+	const char *pch;

tools/bpf/bpftool/perf.c line 109

Quoted 10 lines
tools/bpf/bpftool/perf.c new file +10 -0
+	char buf[4096];
+
+	/* prefix always /proc */
+	pch = fpath + 5;
+	if (*pch == '\0')
+		return 0;
+
+	/* pid should be all numbers */
+	pch++;
+	while (*pch >= '0' && *pch <= '9') {

nit: isdigit()? strtoul() with its endptr also an option. That said
the code is actually quite readable as is, so I'm not sure if it's worth complicating it.

tools/bpf/bpftool/perf.c line 121

Quoted 12 lines
tools/bpf/bpftool/perf.c new file +12 -0
+		pid = pid * 10 + *pch - '0';
+		pch++;
+	}
+	if (*pch == '\0')
+		return 0;
+	if (*pch != '/')
+		return FTW_SKIP_SUBTREE;
+
+	/* check /proc/<pid>/fd directory */
+	pch++;
+	if (*pch == '\0' || *pch != 'f')
+		return FTW_SKIP_SUBTREE;

but == '\0' implies != 'f'

tools/bpf/bpftool/perf.c line 124

Quoted 3 lines
tools/bpf/bpftool/perf.c new file +3 -0
+	pch++;
+	if (*pch == '\0' || *pch != 'd')
+		return FTW_SKIP_SUBTREE;

nit: possibly just:

     if (strncmp(pch, "fd", 2))
          return FTW_SKIP_SUBTREE;
     pch += 2;
Quoted 8 lines
tools/bpf/bpftool/perf.c new file +8 -0
+	pch++;
+	if (*pch == '\0')
+		return 0;
+	if (*pch != '/')
+		return FTW_SKIP_SUBTREE;
+
+	/* check /proc/<pid>/fd/<fd_num> */
+	pch++;

tools/bpf/bpftool/perf.c line 142

Quoted 10 lines
tools/bpf/bpftool/perf.c new file +10 -0
+	while (*pch >= '0' && *pch <= '9') {
+		fd = fd * 10 + *pch - '0';
+		pch++;
+	}
+	if (*pch != '\0')
+		return FTW_SKIP_SUBTREE;
+
+	/* query (pid, fd) for potential perf events */
+	err = bpf_trace_event_query(pid, fd, buf, sizeof(buf),
+		&prog_id, &prog_info, &probe_offset, &probe_addr);

nit: continuation line not aligned with opening bracket

Quoted 7 lines
tools/bpf/bpftool/perf.c new file +7 -0
+	if (err < 0)
+		return 0;
+
+	if (json_output)
+		print_perf_json(pid, prog_id, prog_info, buf, probe_offset,
+				probe_addr);
+	else

tools/bpf/bpftool/perf.c line 159

Quoted 10 lines
tools/bpf/bpftool/perf.c new file +10 -0
+		print_perf_plain(pid, prog_id, prog_info, buf, probe_offset,
+				 probe_addr);
+
+	return 0;
+}
+
+static int do_show(int argc, char **argv)
+{
+	int nopenfd = 16;
+	int flags = FTW_ACTIONRETVAL | FTW_PHYS;

nit: reverse christmas tree networking style if you don't mind

tools/bpf/bpftool/perf.c line 162

Quoted 2 lines
tools/bpf/bpftool/perf.c new file +2 -0
+	if (nftw("/proc", show_proc, nopenfd, flags) == -1) {
+		perror("nftw");

nit: p_err("%s", strerror(errno)); would also show up in JSON output

Quoted 8 lines
tools/bpf/bpftool/perf.c new file +8 -0
+		return -1;
+	}
+
+	return 0;
+}
+
+static int do_help(int argc, char **argv)
+{

tools/bpf/bpftool/perf.c line 180

Quoted 10 lines
tools/bpf/bpftool/perf.c new file +10 -0
+	fprintf(stderr,
+		"Usage: %s %s { show | help }\n"
+		"",
+		bin_name, argv[-2]);
+
+	return 0;
+}
+
+static const struct cmd cmds[] = {
+	{ "show",	do_show },

Other commands alias show and list, so could you add:

	{ "list",	do_show },

and list to help output?

tools/bpf/bpftool/perf.c line 188

Quoted 8 lines
tools/bpf/bpftool/perf.c new file +8 -0
+	{ "help",	do_help },
+	{ 0 }
+};
+
+int do_perf(int argc, char **argv)
+{
+	return cmd_select(cmds, argc, argv, do_help);
+}

Thanks a lot for adding bpftool support, and with JSON output included!

author
#14 lore raw

Re: [PATCH bpf-next 7/7] tools/bpftool: add perf subcommand

Quoted 35 lines · Jakub Kicinski
Quoted 20 lines · Yonghong Song

The new command "bpftool perf [show]" will traverse all processes under /proc, and if any fd is associated with a perf event, it will print out related perf event information.

Below is an example to show the results using bcc commands. Running the following 4 bcc commands:
kprobe: trace.py '__x64_sys_nanosleep'
kretprobe: trace.py 'r::__x64_sys_nanosleep'
tracepoint: trace.py 't:syscalls:sys_enter_nanosleep'
uprobe: trace.py 'p:/home/yhs/a.out:main'

The bpftool command line and result:

   $ bpftool perf
   21711: prog_id 5 kprobe func __x64_sys_write offset 0
   21765: prog_id 7 kretprobe func __x64_sys_nanosleep offset 0
   21767: prog_id 8 tracepoint sys_enter_nanosleep
   21800: prog_id 9 uprobe filename /home/yhs/a.out offset 1159
Quoted 5 lines
   $ bpftool -j perf
   {"pid":21711,"prog_id":5,"prog_info":"kprobe","func":"__x64_sys_write","offset":0}, \
   {"pid":21765,"prog_id":7,"prog_info":"kretprobe","func":"__x64_sys_nanosleep","offset":0}, \
   {"pid":21767,"prog_id":8,"prog_info":"tracepoint","tracepoint":"sys_enter_nanosleep"}, \
   {"pid":21800,"prog_id":9,"prog_info":"uprobe","filename":"/home/yhs/a.out","offset":1159}

You need to wrap the objects inside an array, so

	if (json_output)
		jsonw_start_array(json_wtr);
	nftw();
	if (json_output)
		jsonw_end_array(json_wtr);
Quoted 3 lines

otherwise output will not be a valid JSON. To validate JSON try:

$ bpftool -j perf | python -m json.tool

Thanks for detailed review! All of your comments make sense. I will address them in next revision after getting some feedback for other patches.

Quoted 298 lines
Quoted 22 lines
   $ bpftool prog
   5: kprobe  name probe___x64_sys  tag e495a0c82f2c7a8d  gpl
	  loaded_at 2018-05-15T04:46:37-0700  uid 0
	  xlated 200B  not jited  memlock 4096B  map_ids 4
   7: kprobe  name probe___x64_sys  tag f2fdee479a503abf  gpl
	  loaded_at 2018-05-15T04:48:32-0700  uid 0
	  xlated 200B  not jited  memlock 4096B  map_ids 7
   8: tracepoint  name tracepoint__sys  tag 5390badef2395fcf  gpl
	  loaded_at 2018-05-15T04:48:48-0700  uid 0
	  xlated 200B  not jited  memlock 4096B  map_ids 8
   9: kprobe  name probe_main_1  tag 0a87bdc2e2953b6d  gpl
	  loaded_at 2018-05-15T04:49:52-0700  uid 0
	  xlated 200B  not jited  memlock 4096B  map_ids 9
   $ ps ax | grep "python ./trace.py"
   21711 pts/0    T      0:03 python ./trace.py __x64_sys_write
   21765 pts/0    S+     0:00 python ./trace.py r::__x64_sys_nanosleep
   21767 pts/2    S+     0:00 python ./trace.py t:syscalls:sys_enter_nanosleep
   21800 pts/3    S+     0:00 python ./trace.py p:/home/yhs/a.out:main
   22374 pts/1    S+     0:00 grep --color=auto python ./trace.py
Quoted 5 lines
Signed-off-by Yonghong Song <[email protected]>
---
  tools/bpf/bpftool/main.c |   3 +-
  tools/bpf/bpftool/main.h |   1 +
  tools/bpf/bpftool/perf.c | 188 +++++++++++++++++++++++++++++++++++++++++++++++

Would you be able to also extend the Documentation/ and bash completions?

Quoted 96 lines
  3 files changed, 191 insertions(+), 1 deletion(-)

create mode 100644 tools/bpf/bpftool/perf.c

tools/bpf/bpftool/main.c +2 -1
index 1ec852d..eea7f14 100644
@@ -87,7 +87,7 @@ static int do_help(int argc, char **argv)
  		"       %s batch file FILE\n"
  		"       %s version\n"
  		"\n"
-		"       OBJECT := { prog | map | cgroup }\n"
+		"       OBJECT := { prog | map | cgroup | perf }\n"
  		"       " HELP_SPEC_OPTIONS "\n"
  		"",
  		bin_name, bin_name, bin_name);

@@ -216,6 +216,7 @@ static const struct cmd cmds[] = {
  	{ "prog",	do_prog },
  	{ "map",	do_map },
  	{ "cgroup",	do_cgroup },
+	{ "perf",	do_perf },
  	{ "version",	do_version },
  	{ 0 }
  };
tools/bpf/bpftool/main.h +1 -0
index 6173cd9..63fdb31 100644
@@ -119,6 +119,7 @@ int do_prog(int argc, char **arg);
  int do_map(int argc, char **arg);
  int do_event_pipe(int argc, char **argv);
  int do_cgroup(int argc, char **arg);
+int do_perf(int argc, char **arg);
 
  int prog_parse_fd(int *argc, char ***argv);
  int map_parse_fd_and_info(int *argc, char ***argv, void *info, __u32 *info_len);
tools/bpf/bpftool/perf.c new file +54 -0
new file mode 100644
index 0000000..6d676e4
@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: GPL-2.0+
+// Copyright (C) 2018 Facebook
+// Author: Yonghong Song <[email protected]>
+
+#define _GNU_SOURCE
+#include <fcntl.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <ftw.h>
+
+#include <bpf.h>
+
+#include "main.h"
+
+static void print_perf_json(int pid, __u32 prog_id, __u32 prog_info,
+			    char *buf, __u64 probe_offset, __u64 probe_addr)
+{
+	jsonw_start_object(json_wtr);
+	jsonw_int_field(json_wtr, "pid", pid);
+	jsonw_uint_field(json_wtr, "prog_id", prog_id);
+	switch (prog_info) {
+	case BPF_PERF_INFO_TP_NAME:
+		jsonw_string_field(json_wtr, "prog_info", "tracepoint");
+		jsonw_string_field(json_wtr, "tracepoint", buf);
+		break;
+	case BPF_PERF_INFO_KPROBE:
+		jsonw_string_field(json_wtr, "prog_info", "kprobe");
+		if (buf[0] != '\0') {
+			jsonw_string_field(json_wtr, "func", buf);
+			jsonw_lluint_field(json_wtr, "offset", probe_offset);
+		} else {
+			jsonw_lluint_field(json_wtr, "addr", probe_addr);
+		}
+		break;
+	case BPF_PERF_INFO_KRETPROBE:
+		jsonw_string_field(json_wtr, "prog_info", "kretprobe");
+		if (buf[0] != '\0') {
+			jsonw_string_field(json_wtr, "func", buf);
+			jsonw_lluint_field(json_wtr, "offset", probe_offset);
+		} else {
+			jsonw_lluint_field(json_wtr, "addr", probe_addr);
+		}
+		break;
+	case BPF_PERF_INFO_UPROBE:
+		jsonw_string_field(json_wtr, "prog_info", "uprobe");
+		jsonw_string_field(json_wtr, "filename", buf);
+		jsonw_lluint_field(json_wtr, "offset", probe_offset);
+		break;
+	case BPF_PERF_INFO_URETPROBE:
+		jsonw_string_field(json_wtr, "prog_info", "uretprobe");
+		jsonw_string_field(json_wtr, "filename", buf);

tools/bpf/bpftool/perf.c line 64

Quoted 10 lines
tools/bpf/bpftool/perf.c new file +10 -0
+		jsonw_lluint_field(json_wtr, "offset", probe_offset);
+		break;
+	}
+	jsonw_end_object(json_wtr);
+}
+
+static void print_perf_plain(int pid, __u32 prog_id, __u32 prog_info,
+			    char *buf, __u64 probe_offset, __u64 probe_addr)
+{
+	printf("%d: prog_id %u ", pid, prog_id);

nit: for consistency with prog and map listings consider using double spaces after prog_id (i.e. between fields). Not a hard requirement, though, perhaps I'm the only one who finds that more readable :)

Quoted 35 lines
tools/bpf/bpftool/perf.c new file +35 -0
+	switch (prog_info) {
+	case BPF_PERF_INFO_TP_NAME:
+		printf("tracepoint %s\n", buf);
+		break;
+	case BPF_PERF_INFO_KPROBE:
+		if (buf[0] != '\0')
+			printf("kprobe func %s offset %llu\n", buf,
+			       probe_offset);
+		else
+			printf("kprobe addr %llu\n", probe_addr);
+		break;
+	case BPF_PERF_INFO_KRETPROBE:
+		if (buf[0] != '\0')
+			printf("kretprobe func %s offset %llu\n", buf,
+			       probe_offset);
+		else
+			printf("kretprobe addr %llu\n", probe_addr);
+		break;
+	case BPF_PERF_INFO_UPROBE:
+		printf("uprobe filename %s offset %llu\n", buf, probe_offset);
+		break;
+	case BPF_PERF_INFO_URETPROBE:
+		printf("uretprobe filename %s offset %llu\n", buf,
+		       probe_offset);
+		break;
+	}
+}
+
+static int show_proc(const char *fpath, const struct stat *sb,
+		     int tflag, struct FTW *ftwbuf)
+{
+	__u64 probe_offset, probe_addr;
+	__u32 prog_id, prog_info;
+	int err, pid = 0, fd = 0;
+	const char *pch;

tools/bpf/bpftool/perf.c line 109

Quoted 10 lines
tools/bpf/bpftool/perf.c new file +10 -0
+	char buf[4096];
+
+	/* prefix always /proc */
+	pch = fpath + 5;
+	if (*pch == '\0')
+		return 0;
+
+	/* pid should be all numbers */
+	pch++;
+	while (*pch >= '0' && *pch <= '9') {

nit: isdigit()? strtoul() with its endptr also an option. That said
the code is actually quite readable as is, so I'm not sure if it's worth complicating it.

tools/bpf/bpftool/perf.c line 121

Quoted 12 lines
tools/bpf/bpftool/perf.c new file +12 -0
+		pid = pid * 10 + *pch - '0';
+		pch++;
+	}
+	if (*pch == '\0')
+		return 0;
+	if (*pch != '/')
+		return FTW_SKIP_SUBTREE;
+
+	/* check /proc/<pid>/fd directory */
+	pch++;
+	if (*pch == '\0' || *pch != 'f')
+		return FTW_SKIP_SUBTREE;

but == '\0' implies != 'f'

tools/bpf/bpftool/perf.c line 124

Quoted 3 lines
tools/bpf/bpftool/perf.c new file +3 -0
+	pch++;
+	if (*pch == '\0' || *pch != 'd')
+		return FTW_SKIP_SUBTREE;

nit: possibly just:

      if (strncmp(pch, "fd", 2))
           return FTW_SKIP_SUBTREE;
      pch += 2;
Quoted 8 lines
tools/bpf/bpftool/perf.c new file +8 -0
+	pch++;
+	if (*pch == '\0')
+		return 0;
+	if (*pch != '/')
+		return FTW_SKIP_SUBTREE;
+
+	/* check /proc/<pid>/fd/<fd_num> */
+	pch++;

tools/bpf/bpftool/perf.c line 142

Quoted 10 lines
tools/bpf/bpftool/perf.c new file +10 -0
+	while (*pch >= '0' && *pch <= '9') {
+		fd = fd * 10 + *pch - '0';
+		pch++;
+	}
+	if (*pch != '\0')
+		return FTW_SKIP_SUBTREE;
+
+	/* query (pid, fd) for potential perf events */
+	err = bpf_trace_event_query(pid, fd, buf, sizeof(buf),
+		&prog_id, &prog_info, &probe_offset, &probe_addr);

nit: continuation line not aligned with opening bracket

Quoted 7 lines
tools/bpf/bpftool/perf.c new file +7 -0
+	if (err < 0)
+		return 0;
+
+	if (json_output)
+		print_perf_json(pid, prog_id, prog_info, buf, probe_offset,
+				probe_addr);
+	else

tools/bpf/bpftool/perf.c line 159

Quoted 10 lines
tools/bpf/bpftool/perf.c new file +10 -0
+		print_perf_plain(pid, prog_id, prog_info, buf, probe_offset,
+				 probe_addr);
+
+	return 0;
+}
+
+static int do_show(int argc, char **argv)
+{
+	int nopenfd = 16;
+	int flags = FTW_ACTIONRETVAL | FTW_PHYS;

nit: reverse christmas tree networking style if you don't mind

tools/bpf/bpftool/perf.c line 162

Quoted 2 lines
tools/bpf/bpftool/perf.c new file +2 -0
+	if (nftw("/proc", show_proc, nopenfd, flags) == -1) {
+		perror("nftw");

nit: p_err("%s", strerror(errno)); would also show up in JSON output

Quoted 8 lines
tools/bpf/bpftool/perf.c new file +8 -0
+		return -1;
+	}
+
+	return 0;
+}
+
+static int do_help(int argc, char **argv)
+{

tools/bpf/bpftool/perf.c line 180

Quoted 10 lines
tools/bpf/bpftool/perf.c new file +10 -0
+	fprintf(stderr,
+		"Usage: %s %s { show | help }\n"
+		"",
+		bin_name, argv[-2]);
+
+	return 0;
+}
+
+static const struct cmd cmds[] = {
+	{ "show",	do_show },

Other commands alias show and list, so could you add:

	{ "list",	do_show },

and list to help output?

tools/bpf/bpftool/perf.c line 188

Quoted 8 lines
tools/bpf/bpftool/perf.c new file +8 -0
+	{ "help",	do_help },
+	{ 0 }
+};
+
+int do_perf(int argc, char **argv)
+{
+	return cmd_select(cmds, argc, argv, do_help);
+}

Thanks a lot for adding bpftool support, and with JSON output included!