Add LBR decoder support

Author: bobrik

.vscode/config-schema.yaml

@@ -145,6 +145,7 @@ definitions:
                   - inet_ip
                   - kstack
                   - ksym
+                  - lbr
                   - majorminor
                   - pci_class
                   - pci_device

cmd/ebpf_exporter/main.go

@@ -42,6 +42,7 @@ func main() {
 	capabilities := kingpin.Flag("capabilities.keep", "Comma separated list of capabilities to keep (cap_syslog, cap_bpf, etc.), 'all' or 'none'").Default("all").String()
 	btfPath := kingpin.Flag("btf.path", "Optional BTF file path.").Default("").String()
 	skipCacheSize := kingpin.Flag("config.skip-cache-size", "Size of the LRU skip cache").Int()
+	lbrEnable := kingpin.Flag("lbr.enable", "Enable LBR.").Bool()
 	kingpin.Version(version.Print("ebpf_exporter"))
 	kingpin.HelpFlag.Short('h')
 	kingpin.Parse()
@@ -75,6 +76,15 @@ func main() {
 
 	started := time.Now()
 
+	if *lbrEnable {
+		notify("enabling lbr...")
+
+		err := exporter.EnableLBR()
+		if err != nil {
+			log.Fatalf("Error enabling LBR: %v", err)
+		}
+	}
+
 	notify("parsing config...")
 
 	configs, err := config.ParseConfigs(*configDir, strings.Split(*configNames, ","))

decoder/decoder.go

@@ -46,6 +46,7 @@ func NewSet(skipCacheSize int, monitor *cgroup.Monitor) (*Set, error) {
 			"inet_ip":      &InetIP{},
 			"kstack":       &KStack{ksym},
 			"ksym":         &KSym{ksym},
+			"lbr":          &LBR{ksym},
 			"majorminor":   &MajorMinor{},
 			"pci_class":    &PCIClass{},
 			"pci_device":   &PCIDevice{},

decoder/lbr.go

@@ -0,0 +1,38 @@
+package decoder
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/cloudflare/ebpf_exporter/v2/config"
+	"github.com/cloudflare/ebpf_exporter/v2/kallsyms"
+	"github.com/cloudflare/ebpf_exporter/v2/util"
+)
+
+// struct perf_branch_entry is 24 bytes
+const perfBranchEntrySize = 24
+
+// LBR is a decoder that transforms LBR entry array into a stack
+type LBR struct {
+	decoder *kallsyms.Decoder
+}
+
+// Decode transforms LBR entry array into a stack
+func (l *LBR) Decode(in []byte, _ config.Decoder) ([]byte, error) {
+	if len(in) == 0 {
+		return []byte("<empty>"), nil
+	}
+
+	byteOrder := util.GetHostByteOrder()
+
+	lines := make([]string, len(in)/perfBranchEntrySize)
+
+	for i := range lines {
+		from := uintptr(byteOrder.Uint64(in[i*24 : i*24+8]))
+		to := uintptr(byteOrder.Uint64(in[i*24+8 : i*24+16]))
+
+		lines[i] = fmt.Sprintf("0x%08x -> 0x%08x | %s ->  %s", from, to, l.decoder.Sym(from), l.decoder.Sym(to))
+	}
+
+	return []byte(strings.Join(lines, "\n")), nil
+}

examples/lbr-trace.bpf.c

@@ -0,0 +1,62 @@
+#include <vmlinux.h>
+#include <bpf/bpf_tracing.h>
+#include "tracing.bpf.h"
+
+// On Zen v4 this is the depth.
+#define LBR_DEPTH 16
+
+struct failure_span_t {
+    struct span_base_t span_base;
+    struct perf_branch_entry entries[LBR_DEPTH];
+    u32 errno;
+};
+
+struct {
+    __uint(type, BPF_MAP_TYPE_RINGBUF);
+    __uint(max_entries, 256 * 1024);
+} failure_spans SEC(".maps");
+
+SEC("fexit/do_sys_openat2")
+int BPF_PROG(do_sys_openat2, int dfd, const char *filename, struct open_how *how, int retval)
+{
+    struct failure_span_t span = { 0 };
+    struct failure_span_t *submit;
+    u64 ts;
+
+    if (retval >= 0) {
+        return 0;
+    }
+
+    s64 snapshot_bytes = bpf_get_branch_snapshot(span.entries, sizeof(span.entries), 0);
+    if (snapshot_bytes == 0) {
+        return 0;
+    }
+
+    u64 count = snapshot_bytes / sizeof(struct perf_branch_entry);
+    for (int i = 0; i < count; i++) {
+        if (i >= LBR_DEPTH) {
+            break;
+        }
+
+        bpf_printk("  lbr: %llx -> %llx", span.entries[i].from, span.entries[i].to);
+    }
+
+    ts = bpf_ktime_get_ns();
+
+    span.span_base.span_id = ts;
+    span.span_base.parent.trace_id_lo = ts;
+    span.errno = -retval;
+
+    submit = bpf_ringbuf_reserve(&failure_spans, sizeof(struct failure_span_t), 0);
+    if (!submit) {
+        return 0;
+    }
+
+    *submit = span;
+
+    bpf_ringbuf_submit(submit, 0);
+
+    return 0;
+}
+
+char LICENSE[] SEC("license") = "GPL";

examples/lbr-trace.yaml

@@ -0,0 +1,35 @@
+tracing:
+  spans:
+    - name: failure
+      ringbuf: failure_spans
+      service: syscall-failures
+      labels:
+        - name: trace_id
+          size: 16
+          decoders:
+            - name: hex
+        - name: parent_span_id
+          size: 8
+          decoders:
+            - name: hex
+        - name: span_id
+          size: 8
+          decoders:
+            - name: hex
+        - name: span_monotonic_timestamp_ns
+          size: 8
+          decoders:
+            - name: uint
+        - name: span_duration_ns
+          size: 8
+          decoders:
+            - name: uint
+        - name: data
+          size: 384
+          decoders:
+            - name: lbr
+        - name: errno
+          size: 4
+          decoders:
+            - name: uint
+            - name: errno

exporter/lbr.go

@@ -0,0 +1,32 @@
+package exporter
+
+import (
+	"fmt"
+
+	"github.com/elastic/go-perf"
+	"github.com/iovisor/gobpf/pkg/cpuonline"
+	"golang.org/x/sys/unix"
+)
+
+// EnableLBR configures a perf event that enables LBR
+func EnableLBR() error {
+	attr := &perf.Attr{}
+	attr.Type = perf.HardwareEvent
+	attr.Config = unix.PERF_COUNT_HW_CPU_CYCLES
+	attr.SampleFormat = perf.SampleFormat{BranchStack: true}
+	attr.BranchSampleFormat = perf.BranchSampleFormat{Privilege: perf.BranchPrivilegeKernel, Sample: perf.BranchSampleAnyReturn}
+
+	cpus, err := cpuonline.Get()
+	if err != nil {
+		return fmt.Errorf("failed to determine online cpus: %w", err)
+	}
+
+	for _, cpu := range cpus {
+		_, err := perf.Open(attr, perf.AllThreads, int(cpu), nil)
+		if err != nil {
+			return fmt.Errorf("failed to open perf_event: %w", err)
+		}
+	}
+
+	return nil
+}