• Daniel Borkmann's avatar
    bpf: add initial bpf tracepoints · a67edbf4
    Daniel Borkmann authored
    This work adds a number of tracepoints to paths that are either
    considered slow-path or exception-like states, where monitoring or
    inspecting them would be desirable.
    
    For bpf(2) syscall, tracepoints have been placed for main commands
    when they succeed. In XDP case, tracepoint is for exceptions, that
    is, f.e. on abnormal BPF program exit such as unknown or XDP_ABORTED
    return code, or when error occurs during XDP_TX action and the packet
    could not be forwarded.
    
    Both have been split into separate event headers, and can be further
    extended. Worst case, if they unexpectedly should get into our way in
    future, they can also removed [1]. Of course, these tracepoints (like
    any other) can be analyzed by eBPF itself, etc. Example output:
    
      # ./perf record -a -e bpf:* sleep 10
      # ./perf script
      sock_example  6197 [005]   283.980322:      bpf:bpf_map_create: map type=ARRAY ufd=4 key=4 val=8 max=256 flags=0
      sock_example  6197 [005]   283.980721:       bpf:bpf_prog_load: prog=a5ea8fa30ea6849c type=SOCKET_FILTER ufd=5
      sock_example  6197 [005]   283.988423:   bpf:bpf_prog_get_type: prog=a5ea8fa30ea6849c type=SOCKET_FILTER
      sock_example  6197 [005]   283.988443: bpf:bpf_map_lookup_elem: map type=ARRAY ufd=4 key=[06 00 00 00] val=[00 00 00 00 00 00 00 00]
      [...]
      sock_example  6197 [005]   288.990868: bpf:bpf_map_lookup_elem: map type=ARRAY ufd=4 key=[01 00 00 00] val=[14 00 00 00 00 00 00 00]
           swapper     0 [005]   289.338243:    bpf:bpf_prog_put_rcu: prog=a5ea8fa30ea6849c type=SOCKET_FILTER
    
      [1] https://lwn.net/Articles/705270/Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    a67edbf4
syscall.c 23.6 KB