> On May 3, 2019, at 1:18 AM, Jiri Olsa <jo...@kernel.org> wrote: > > hi, > this patchset adds dso support to read and display > bpf code in intel_pt trace output. I had to change > some of the kernel maps processing code, so hopefully > I did not break too many things ;-) > > It's now possible to see bpf code flow via: > > # perf-with-kcore record pt -e intel_pt//ku -- sleep 1 > # perf-with-kcore script pt --insn-trace --xed > ... > sleep 36660 [016] 1057036.806464404: ffffffff811dfba5 > trace_call_bpf+0x65 ([kernel.kallsyms]) nopl %eax, > (%rax,%rax,1) > sleep 36660 [016] 1057036.806464404: ffffffff811dfbaa > trace_call_bpf+0x6a ([kernel.kallsyms]) movq 0x30(%rbx), %rax > sleep 36660 [016] 1057036.806464404: ffffffff811dfbae > trace_call_bpf+0x6e ([kernel.kallsyms]) leaq 0x38(%rbx), %rsi > sleep 36660 [016] 1057036.806464404: ffffffff811dfbb2 > trace_call_bpf+0x72 ([kernel.kallsyms]) mov %r13, %rdi > sleep 36660 [016] 1057036.806464404: ffffffff811dfbb5 > trace_call_bpf+0x75 ([kernel.kallsyms]) callq > 0xffffffff81c00c30 > sleep 36660 [016] 1057036.806464404: ffffffff81c00c30 > __x86_indirect_thunk_rax+0x0 ([kernel.kallsyms]) callq > 0xffffffff81c00c3c > sleep 36660 [016] 1057036.806464404: ffffffff81c00c3c > __x86_indirect_thunk_rax+0xc ([kernel.kallsyms]) movq %rax, > (%rsp) > sleep 36660 [016] 1057036.806464404: ffffffff81c00c40 > __x86_indirect_thunk_rax+0x10 ([kernel.kallsyms]) retq > sleep 36660 [016] 1057036.806464725: ffffffffa05e89ef > bpf_prog_da4fe6b3d2c29b25_trace_return+0x0 > (bpf_prog_da4fe6b3d2c29b25_trace_return) pushq %rbp > sleep 36660 [016] 1057036.806464725: ffffffffa05e89f0 > bpf_prog_da4fe6b3d2c29b25_trace_return+0x1 > (bpf_prog_da4fe6b3d2c29b25_trace_return) mov %rsp, %rbp > sleep 36660 [016] 1057036.806464725: ffffffffa05e89f3 > bpf_prog_da4fe6b3d2c29b25_trace_return+0x4 > (bpf_prog_da4fe6b3d2c29b25_trace_return) sub $0x158, %rsp > sleep 36660 [016] 1057036.806464725: ffffffffa05e89fa > bpf_prog_da4fe6b3d2c29b25_trace_return+0xb > (bpf_prog_da4fe6b3d2c29b25_trace_return) sub $0x28, %rbp > sleep 36660 [016] 1057036.806464725: ffffffffa05e89fe > bpf_prog_da4fe6b3d2c29b25_trace_return+0xf > (bpf_prog_da4fe6b3d2c29b25_trace_return) movq %rbx, (%rbp) > sleep 36660 [016] 1057036.806464725: ffffffffa05e8a02 > bpf_prog_da4fe6b3d2c29b25_trace_return+0x13 > (bpf_prog_da4fe6b3d2c29b25_trace_return) movq %r13, 0x8(%rbp) > sleep 36660 [016] 1057036.806464725: ffffffffa05e8a06 > bpf_prog_da4fe6b3d2c29b25_trace_return+0x17 > (bpf_prog_da4fe6b3d2c29b25_trace_return) movq %r14, 0x10(%rbp) > sleep 36660 [016] 1057036.806464725: ffffffffa05e8a0a > bpf_prog_da4fe6b3d2c29b25_trace_return+0x1b > (bpf_prog_da4fe6b3d2c29b25_trace_return) movq %r15, 0x18(%rbp) > sleep 36660 [016] 1057036.806464725: ffffffffa05e8a0e > bpf_prog_da4fe6b3d2c29b25_trace_return+0x1f > (bpf_prog_da4fe6b3d2c29b25_trace_return) xor %eax, %eax > sleep 36660 [016] 1057036.806464725: ffffffffa05e8a10 > bpf_prog_da4fe6b3d2c29b25_trace_return+0x21 > (bpf_prog_da4fe6b3d2c29b25_trace_return) movq %rax, 0x20(%rbp) > sleep 36660 [016] 1057036.806464725: ffffffffa05e8a14 > bpf_prog_da4fe6b3d2c29b25_trace_return+0x25 > (bpf_prog_da4fe6b3d2c29b25_trace_return) mov %rdi, %rbx > sleep 36660 [016] 1057036.806464725: ffffffffa05e8a17 > bpf_prog_da4fe6b3d2c29b25_trace_return+0x28 > (bpf_prog_da4fe6b3d2c29b25_trace_return) callq 0xffffffff811fed50 > sleep 36660 [016] 1057036.806464725: ffffffff811fed50 > bpf_get_current_pid_tgid+0x0 ([kernel.kallsyms]) nopl %eax, > (%rax,%rax,1) > sleep 36660 [016] 1057036.806464725: ffffffff811fed55 > bpf_get_current_pid_tgid+0x5 ([kernel.kallsyms]) movq > %gs:0x15c00, %rdx > sleep 36660 [016] 1057036.806464725: ffffffff811fed5e > bpf_get_current_pid_tgid+0xe ([kernel.kallsyms]) test %rdx, %rdx > sleep 36660 [016] 1057036.806464725: ffffffff811fed61 > bpf_get_current_pid_tgid+0x11 ([kernel.kallsyms]) jz > 0xffffffff811fed79 > sleep 36660 [016] 1057036.806464725: ffffffff811fed63 > bpf_get_current_pid_tgid+0x13 ([kernel.kallsyms]) movsxdl > 0x494(%rdx), %rax > sleep 36660 [016] 1057036.806464725: ffffffff811fed6a > bpf_get_current_pid_tgid+0x1a ([kernel.kallsyms]) movsxdl > 0x490(%rdx), %rdx > sleep 36660 [016] 1057036.806464725: ffffffff811fed71 > bpf_get_current_pid_tgid+0x21 ([kernel.kallsyms]) shl $0x20, %rax > sleep 36660 [016] 1057036.806464725: ffffffff811fed75 > bpf_get_current_pid_tgid+0x25 ([kernel.kallsyms]) or %rdx, %rax > sleep 36660 [016] 1057036.806464725: ffffffff811fed78 > bpf_get_current_pid_tgid+0x28 ([kernel.kallsyms]) retq > sleep 36660 [016] 1057036.806464725: ffffffffa05e8a1c > bpf_prog_da4fe6b3d2c29b25_trace_return+0x2d > (bpf_prog_da4fe6b3d2c29b25_trace_return) movq %rax, -0x8(%rbp) > sleep 36660 [016] 1057036.806464725: ffffffffa05e8a20 > bpf_prog_da4fe6b3d2c29b25_trace_return+0x31 > (bpf_prog_da4fe6b3d2c29b25_trace_return) xor %edi, %edi > sleep 36660 [016] 1057036.806464725: ffffffffa05e8a22 > bpf_prog_da4fe6b3d2c29b25_trace_return+0x33 > (bpf_prog_da4fe6b3d2c29b25_trace_return) movq %rdi, -0x10(%rbp) > sleep 36660 [016] 1057036.806464725: ffffffffa05e8a26 > bpf_prog_da4fe6b3d2c29b25_trace_return+0x37 > (bpf_prog_da4fe6b3d2c29b25_trace_return) movq %rdi, -0x18(%rbp) > > # perf-core/perf-with-kcore script pt --call-trace > ... > sleep 36660 [016] 1057036.806464404: ([kernel.kallsyms] > ) kretprobe_perf_func > sleep 36660 [016] 1057036.806464404: ([kernel.kallsyms] > ) trace_call_bpf > sleep 36660 [016] 1057036.806464404: ([kernel.kallsyms] > ) __x86_indirect_thunk_rax > sleep 36660 [016] 1057036.806464404: ([kernel.kallsyms] > ) __x86_indirect_thunk_rax > sleep 36660 [016] 1057036.806464725: > (bpf_prog_da4fe6b3d2c29b25_trace_return ) > bpf_get_current_pid_tgid > sleep 36660 [016] 1057036.806464725: > (bpf_prog_da4fe6b3d2c29b25_trace_return ) > bpf_ktime_get_ns > sleep 36660 [016] 1057036.806464725: ([kernel.kallsyms] > ) __x86_indirect_thunk_rax > sleep 36660 [016] 1057036.806464725: ([kernel.kallsyms] > ) __x86_indirect_thunk_rax > sleep 36660 [016] 1057036.806465045: > (bpf_prog_da4fe6b3d2c29b25_trace_return ) > __htab_map_lookup_elem > sleep 36660 [016] 1057036.806465366: ([kernel.kallsyms] > ) memcmp > sleep 36660 [016] 1057036.806465687: > (bpf_prog_da4fe6b3d2c29b25_trace_return ) > bpf_probe_read > sleep 36660 [016] 1057036.806465687: ([kernel.kallsyms] > ) probe_kernel_read > sleep 36660 [016] 1057036.806465687: ([kernel.kallsyms] > ) __check_object_size > sleep 36660 [016] 1057036.806465687: ([kernel.kallsyms] > ) check_stack_object > sleep 36660 [016] 1057036.806465687: ([kernel.kallsyms] > ) > copy_user_enhanced_fast_string > sleep 36660 [016] 1057036.806465687: > (bpf_prog_da4fe6b3d2c29b25_trace_return ) > bpf_probe_read > sleep 36660 [016] 1057036.806465687: ([kernel.kallsyms] > ) probe_kernel_read > sleep 36660 [016] 1057036.806465687: ([kernel.kallsyms] > ) __check_object_size > sleep 36660 [016] 1057036.806465687: ([kernel.kallsyms] > ) check_stack_object > sleep 36660 [016] 1057036.806465687: ([kernel.kallsyms] > ) > copy_user_enhanced_fast_string > sleep 36660 [016] 1057036.806466008: > (bpf_prog_da4fe6b3d2c29b25_trace_return ) > bpf_get_current_uid_gid > sleep 36660 [016] 1057036.806466008: ([kernel.kallsyms] > ) from_kgid > sleep 36660 [016] 1057036.806466008: ([kernel.kallsyms] > ) from_kuid > sleep 36660 [016] 1057036.806466008: > (bpf_prog_da4fe6b3d2c29b25_trace_return ) > bpf_perf_event_output > sleep 36660 [016] 1057036.806466328: ([kernel.kallsyms] > ) perf_event_output > sleep 36660 [016] 1057036.806466328: ([kernel.kallsyms] > ) perf_prepare_sample > sleep 36660 [016] 1057036.806466328: ([kernel.kallsyms] > ) perf_misc_flags > sleep 36660 [016] 1057036.806466328: ([kernel.kallsyms] > ) > __x86_indirect_thunk_rax > sleep 36660 [016] 1057036.806466328: ([kernel.kallsyms] > ) > __x86_indirect_thunk_rax > > > v2 changes: > - fix missing pthread_mutex_unlock [Stanislav Fomichev] > - removed eBPF dso reusing [Adrian Hunter] > - merge eBPF and kcore maps [Adrian Hunter] > - few patches already applied > - added some perf script helper options > - patches are rebased on top of Arnaldo's perf/core with perf/urgent merged > in > > It's also available in here: > git://git.kernel.org/pub/scm/linux/kernel/git/jolsa/perf.git > perf/fixes > > thanks, > jirka Besides minor comments in a few patches, for the series: Acked-by: Song Liu <songliubrav...@fb.com> > > Cc: Jesper Dangaard Brouer <bro...@redhat.com> > Cc: Alexei Starovoitov <a...@kernel.org> > Cc: Daniel Borkmann <dan...@iogearbox.net> > --- > Jiri Olsa (12): > perf tools: Separate generic code in dso__data_file_size > perf tools: Separate generic code in dso_cache__read > perf tools: Simplify dso_cache__read function > perf tools: Add bpf dso read and size hooks > perf tools: Read also the end of the kernel > perf tools: Keep zero in pgoff bpf map > perf script: Pad dso name for --call-trace > perf tools: Preserve eBPF maps when loading kcore > perf tests: Add map_groups__merge_in test > perf script: Add --show-bpf-events to show eBPF related events > perf script: Remove superfluous bpf event titles > perf script: Add --show-all-events option > > tools/include/linux/kernel.h | 1 + > tools/lib/vsprintf.c | 19 +++++++++++++++++++ > tools/perf/Documentation/perf-script.txt | 6 ++++++ > tools/perf/builtin-script.c | 56 > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > tools/perf/tests/Build | 1 + > tools/perf/tests/builtin-test.c | 4 ++++ > tools/perf/tests/map_groups.c | 120 > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > tools/perf/tests/tests.h | 1 + > tools/perf/util/dso.c | 125 > +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++------------------------------------ > tools/perf/util/event.c | 4 ++-- > tools/perf/util/machine.c | 31 ++++++++++++++++++++----------- > tools/perf/util/map.c | 6 ++++++ > tools/perf/util/map_groups.h | 2 ++ > tools/perf/util/symbol.c | 97 > +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---- > tools/perf/util/symbol_conf.h | 1 + > 15 files changed, 421 insertions(+), 53 deletions(-) > create mode 100644 tools/perf/tests/map_groups.c
