305 lines · plain
1=========================================2user_events: User-based Event Tracing3=========================================4 5:Author: Beau Belgrave6 7Overview8--------9User based trace events allow user processes to create events and trace data10that can be viewed via existing tools, such as ftrace and perf.11To enable this feature, build your kernel with CONFIG_USER_EVENTS=y.12 13Programs can view status of the events via14/sys/kernel/tracing/user_events_status and can both register and write15data out via /sys/kernel/tracing/user_events_data.16 17Programs can also use /sys/kernel/tracing/dynamic_events to register and18delete user based events via the u: prefix. The format of the command to19dynamic_events is the same as the ioctl with the u: prefix applied. This20requires CAP_PERFMON due to the event persisting, otherwise -EPERM is returned.21 22Typically programs will register a set of events that they wish to expose to23tools that can read trace_events (such as ftrace and perf). The registration24process tells the kernel which address and bit to reflect if any tool has25enabled the event and data should be written. The registration will give back26a write index which describes the data when a write() or writev() is called27on the /sys/kernel/tracing/user_events_data file.28 29The structures referenced in this document are contained within the30/include/uapi/linux/user_events.h file in the source tree.31 32**NOTE:** *Both user_events_status and user_events_data are under the tracefs33filesystem and may be mounted at different paths than above.*34 35Registering36-----------37Registering within a user process is done via ioctl() out to the38/sys/kernel/tracing/user_events_data file. The command to issue is39DIAG_IOCSREG.40 41This command takes a packed struct user_reg as an argument::42 43 struct user_reg {44 /* Input: Size of the user_reg structure being used */45 __u32 size;46 47 /* Input: Bit in enable address to use */48 __u8 enable_bit;49 50 /* Input: Enable size in bytes at address */51 __u8 enable_size;52 53 /* Input: Flags to use, if any */54 __u16 flags;55 56 /* Input: Address to update when enabled */57 __u64 enable_addr;58 59 /* Input: Pointer to string with event name, description and flags */60 __u64 name_args;61 62 /* Output: Index of the event to use when writing data */63 __u32 write_index;64 } __attribute__((__packed__));65 66The struct user_reg requires all the above inputs to be set appropriately.67 68+ size: This must be set to sizeof(struct user_reg).69 70+ enable_bit: The bit to reflect the event status at the address specified by71 enable_addr.72 73+ enable_size: The size of the value specified by enable_addr.74 This must be 4 (32-bit) or 8 (64-bit). 64-bit values are only allowed to be75 used on 64-bit kernels, however, 32-bit can be used on all kernels.76 77+ flags: The flags to use, if any.78 Callers should first attempt to use flags and retry without flags to ensure79 support for lower versions of the kernel. If a flag is not supported -EINVAL80 is returned.81 82+ enable_addr: The address of the value to use to reflect event status. This83 must be naturally aligned and write accessible within the user program.84 85+ name_args: The name and arguments to describe the event, see command format86 for details.87 88The following flags are currently supported.89 90+ USER_EVENT_REG_PERSIST: The event will not delete upon the last reference91 closing. Callers may use this if an event should exist even after the92 process closes or unregisters the event. Requires CAP_PERFMON otherwise93 -EPERM is returned.94 95+ USER_EVENT_REG_MULTI_FORMAT: The event can contain multiple formats. This96 allows programs to prevent themselves from being blocked when their event97 format changes and they wish to use the same name. When this flag is used the98 tracepoint name will be in the new format of "name.unique_id" vs the older99 format of "name". A tracepoint will be created for each unique pair of name100 and format. This means if several processes use the same name and format,101 they will use the same tracepoint. If yet another process uses the same name,102 but a different format than the other processes, it will use a different103 tracepoint with a new unique id. Recording programs need to scan tracefs for104 the various different formats of the event name they are interested in105 recording. The system name of the tracepoint will also use "user_events_multi"106 instead of "user_events". This prevents single-format event names conflicting107 with any multi-format event names within tracefs. The unique_id is output as108 a hex string. Recording programs should ensure the tracepoint name starts with109 the event name they registered and has a suffix that starts with . and only110 has hex characters. For example to find all versions of the event "test" you111 can use the regex "^test\.[0-9a-fA-F]+$".112 113Upon successful registration the following is set.114 115+ write_index: The index to use for this file descriptor that represents this116 event when writing out data. The index is unique to this instance of the file117 descriptor that was used for the registration. See writing data for details.118 119User based events show up under tracefs like any other event under the120subsystem named "user_events". This means tools that wish to attach to the121events need to use /sys/kernel/tracing/events/user_events/[name]/enable122or perf record -e user_events:[name] when attaching/recording.123 124**NOTE:** The event subsystem name by default is "user_events". Callers should125not assume it will always be "user_events". Operators reserve the right in the126future to change the subsystem name per-process to accommodate event isolation.127In addition if the USER_EVENT_REG_MULTI_FORMAT flag is used the tracepoint name128will have a unique id appended to it and the system name will be129"user_events_multi" as described above.130 131Command Format132^^^^^^^^^^^^^^133The command string format is as follows::134 135 name[:FLAG1[,FLAG2...]] [Field1[;Field2...]]136 137Supported Flags138^^^^^^^^^^^^^^^139None yet140 141Field Format142^^^^^^^^^^^^143::144 145 type name [size]146 147Basic types are supported (__data_loc, u32, u64, int, char, char[20], etc).148User programs are encouraged to use clearly sized types like u32.149 150**NOTE:** *Long is not supported since size can vary between user and kernel.*151 152The size is only valid for types that start with a struct prefix.153This allows user programs to describe custom structs out to tools, if required.154 155For example, a struct in C that looks like this::156 157 struct mytype {158 char data[20];159 };160 161Would be represented by the following field::162 163 struct mytype myname 20164 165Deleting166--------167Deleting an event from within a user process is done via ioctl() out to the168/sys/kernel/tracing/user_events_data file. The command to issue is169DIAG_IOCSDEL.170 171This command only requires a single string specifying the event to delete by172its name. Delete will only succeed if there are no references left to the173event (in both user and kernel space). User programs should use a separate file174to request deletes than the one used for registration due to this.175 176**NOTE:** By default events will auto-delete when there are no references left177to the event. If programs do not want auto-delete, they must use the178USER_EVENT_REG_PERSIST flag when registering the event. Once that flag is used179the event exists until DIAG_IOCSDEL is invoked. Both register and delete of an180event that persists requires CAP_PERFMON, otherwise -EPERM is returned. When181there are multiple formats of the same event name, all events with the same182name will be attempted to be deleted. If only a specific version is wanted to183be deleted then the /sys/kernel/tracing/dynamic_events file should be used for184that specific format of the event.185 186Unregistering187-------------188If after registering an event it is no longer wanted to be updated then it can189be disabled via ioctl() out to the /sys/kernel/tracing/user_events_data file.190The command to issue is DIAG_IOCSUNREG. This is different than deleting, where191deleting actually removes the event from the system. Unregistering simply tells192the kernel your process is no longer interested in updates to the event.193 194This command takes a packed struct user_unreg as an argument::195 196 struct user_unreg {197 /* Input: Size of the user_unreg structure being used */198 __u32 size;199 200 /* Input: Bit to unregister */201 __u8 disable_bit;202 203 /* Input: Reserved, set to 0 */204 __u8 __reserved;205 206 /* Input: Reserved, set to 0 */207 __u16 __reserved2;208 209 /* Input: Address to unregister */210 __u64 disable_addr;211 } __attribute__((__packed__));212 213The struct user_unreg requires all the above inputs to be set appropriately.214 215+ size: This must be set to sizeof(struct user_unreg).216 217+ disable_bit: This must be set to the bit to disable (same bit that was218 previously registered via enable_bit).219 220+ disable_addr: This must be set to the address to disable (same address that was221 previously registered via enable_addr).222 223**NOTE:** Events are automatically unregistered when execve() is invoked. During224fork() the registered events will be retained and must be unregistered manually225in each process if wanted.226 227Status228------229When tools attach/record user based events the status of the event is updated230in realtime. This allows user programs to only incur the cost of the write() or231writev() calls when something is actively attached to the event.232 233The kernel will update the specified bit that was registered for the event as234tools attach/detach from the event. User programs simply check if the bit is set235to see if something is attached or not.236 237Administrators can easily check the status of all registered events by reading238the user_events_status file directly via a terminal. The output is as follows::239 240 Name [# Comments]241 ...242 243 Active: ActiveCount244 Busy: BusyCount245 246For example, on a system that has a single event the output looks like this::247 248 test249 250 Active: 1251 Busy: 0252 253If a user enables the user event via ftrace, the output would change to this::254 255 test # Used by ftrace256 257 Active: 1258 Busy: 1259 260Writing Data261------------262After registering an event the same fd that was used to register can be used263to write an entry for that event. The write_index returned must be at the start264of the data, then the remaining data is treated as the payload of the event.265 266For example, if write_index returned was 1 and I wanted to write out an int267payload of the event. Then the data would have to be 8 bytes (2 ints) in size,268with the first 4 bytes being equal to 1 and the last 4 bytes being equal to the269value I want as the payload.270 271In memory this would look like this::272 273 int index;274 int payload;275 276User programs might have well known structs that they wish to use to emit out277as payloads. In those cases writev() can be used, with the first vector being278the index and the following vector(s) being the actual event payload.279 280For example, if I have a struct like this::281 282 struct payload {283 int src;284 int dst;285 int flags;286 } __attribute__((__packed__));287 288It's advised for user programs to do the following::289 290 struct iovec io[2];291 struct payload e;292 293 io[0].iov_base = &write_index;294 io[0].iov_len = sizeof(write_index);295 io[1].iov_base = &e;296 io[1].iov_len = sizeof(e);297 298 writev(fd, (const struct iovec*)io, 2);299 300**NOTE:** *The write_index is not emitted out into the trace being recorded.*301 302Example Code303------------304See sample code in samples/user_events.305