Re: [PATCH v1 1/4] perf parse-events: Remove BPF event support

[Arnaldo Carvalho de Melo]

Em Thu, Aug 10, 2023 at 11:48:50AM -0700, Ian Rogers escreveu:
> New features like the BPF --filter support in perf record have made
> the BPF event functionality somewhat redundant. As shown by commit
> fcb027c1a4f6 ("perf tools: Revert enable indices setting syntax for
> BPF map") and commit 14e4b9f4289a ("perf trace: Raw augmented syscalls
> fix libbpf 1.0+ compatibility") the BPF event support hasn't been well
> maintained and it adds considerable complexity in areas like event
> parsing, not least as '/' is a separator for event modifiers as well
> as in paths.
 
> The BPF events also motivate llvm and clang libraries as dependencies
> (to compile BPF events that are BPF C code) that have build and
> distribution complexity. For this reason they are only enabled with
> the build option LIBLLVMCLANG=1 which isn't done on major
> distributions like Debian, Fedora and Gentoo. Removing BPF events
> means we can also remove libclang and libllvm dependencies.

As we discussed, libclang and libllvm are not needed for turning .c BPF
events into .o nor for loading the .o files.

For instance, using the perf binary shipped on Fedora, i.e. the default
build for perf when libbpf is available:

root@quaco ~]# type perf
perf is /usr/bin/perf
[root@quaco ~]# rpm -qf /usr/bin/perf
perf-6.4.4-200.fc38.x86_64
[root@quaco ~]# ldd which perf | grep llvm
[root@quaco ~]# ldd which perf | grep clang
[root@quaco ~]# set -o vi
[root@quaco ~]# perf trace --call-graph=dwarf --max-stack=3 --max-events=2 -e /home/acme/git/perf-tools-next/tools/perf/examples/bpf/augmented_raw_syscalls.c,open*
addr2line: addr2line configuration failed
addr2line: addr2line configuration failed
     0.000 cgroupify/24006 openat(dfd: 4, filename: ".", flags: RDONLY|CLOEXEC|DIRECTORY|NONBLOCK) = 5
                                       syscall_exit_to_user_mode_prepare ([kernel.kallsyms])
                                       syscall_exit_to_user_mode_prepare ([kernel.kallsyms])
                                       syscall_exit_to_user_mode ([kernel.kallsyms])
                                       __openat_nocancel (/usr/lib64/libc.so.6)
                                       __opendirat (/usr/lib64/libc.so.6)
                                       scandirat (/usr/lib64/libc.so.6)
     0.235 cgroupify/24006 openat(dfd: 4, filename: "176965/cgroup.procs") = 5
                                       syscall_exit_to_user_mode_prepare ([kernel.kallsyms])
                                       syscall_exit_to_user_mode_prepare ([kernel.kallsyms])
                                       syscall_exit_to_user_mode ([kernel.kallsyms])
                                       __GI___openat (/usr/lib64/libc.so.6)
                                       [0x2c5d] (/usr/libexec/cgroupify)
                                       [0x2d4d] (/usr/libexec/cgroupify)
[root@quaco ~]#
[root@quaco ~]# cat ~/.perfconfig
# this file is auto-generated.
[llvm]
    dump-obj = true
    clang-opt = -g
[trace]
    show_zeros = no
    show_duration = no
    no_inherit = yes
    args_alignment = 40
[annotate]
    hide_src_code = true
[root@quaco ~]# ls -la /home/acme/git/perf-tools-next/tools/perf/examples/bpf/augmented_raw_syscalls.o
-rw-r--r--. 1 root root 34664 Aug 10 15:17 /home/acme/git/perf-tools-next/tools/perf/examples/bpf/augmented_raw_syscalls.o
[root@quaco ~]# file /home/acme/git/perf-tools-next/tools/perf/examples/bpf/augmented_raw_syscalls.o
/home/acme/git/perf-tools-next/tools/perf/examples/bpf/augmented_raw_syscalls.o: ELF 64-bit LSB relocatable, eBPF, version 1 (SYSV), with debug_info, not stripped
[root@quaco ~]# perf trace -e /home/acme/git/perf-tools-next/tools/perf/examples/bpf/augmented_raw_syscalls.o,open* --max-events=5
     0.000 DNS Res~ver #1/109960 openat(dfd: CWD, filename: "/etc/hosts", flags: RDONLY|CLOEXEC) = 1020
     0.262 systemd-resolv/960 openat(dfd: CWD, filename: "/proc/sys/net/ipv6/conf/all/disable_ipv6", flags: RDONLY|CLOEXEC|NOCTTY) = 24
     0.323 systemd-resolv/960 openat(dfd: CWD, filename: "/proc/sys/net/ipv6/conf/all/disable_ipv6", flags: RDONLY|CLOEXEC|NOCTTY) = 24
    23.583 cgroupify/24006 openat(dfd: 4, filename: ".", flags: RDONLY|CLOEXEC|DIRECTORY|NONBLOCK) = 5
    23.719 cgroupify/24006 openat(dfd: 4, filename: "176965/cgroup.procs") ...

that llvm.dump-obj=true will keep the generated .o and then you can use
it perf calls clang to turn the .c into .o and then loads it if you pass
it a .o it skips compilation and uses it directly

I agree we have to remove the linking with libclang and libllvm and I
thank you for doing this work. Particularly I liked the conversion of
the augmented_raw_syscalls.c to be a BPF skeleton that gets build when
we use BUILD_BPF_SKEL=1, which will be the default when what is needed
is available, skipped when not.

That patch keeps the whole infrastructure in 'perf trace' to use the
pointer contents collected by the augmented_raw_syscalls.c that became
augmented_raw_syscalls.bpf.c, really cool.

Right now it is not applying due to some clash with other changes and
when I tried to apply it manually there were some formatting issues:

⬢[acme@toolbox perf-tools-next]$ head ~/wb/1.patch