samples/bpf/trace_event_user.c
Source file repositories/reference/linux-study-clean/samples/bpf/trace_event_user.c
File Facts
- System
- Linux kernel
- Corpus path
samples/bpf/trace_event_user.c- Extension
.c- Size
- 8032 bytes
- Lines
- 353
- Domain
- Support Tooling And Documentation
- Bucket
- samples
- Inferred role
- Support Tooling And Documentation: implementation source
- Status
- source implementation candidate
Why This File Exists
Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.
- Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.
- Defines or uses C structs; map object ownership, embedded links, reference counts, and lock ownership.
Dependency Surface
stdio.hunistd.hstdlib.hstdbool.hstring.hlinux/perf_event.hlinux/bpf.hsignal.herrno.hsys/resource.hbpf/bpf.hbpf/libbpf.hperf-sys.htrace_helpers.h
Detected Declarations
struct key_tfunction print_ksymfunction print_addrfunction print_stackfunction err_exitfunction print_stacksfunction generate_loadfunction test_perf_event_all_cpufunction test_perf_event_taskfunction test_bpf_perf_eventfunction main
Annotated Snippet
struct key_t {
char comm[TASK_COMM_LEN];
__u32 kernstack;
__u32 userstack;
};
static void print_stack(struct key_t *key, __u64 count)
{
__u64 ip[PERF_MAX_STACK_DEPTH] = {};
static bool warned;
int i;
printf("%3lld %s;", count, key->comm);
if (bpf_map_lookup_elem(map_fd[1], &key->kernstack, ip) != 0) {
printf("---;");
} else {
for (i = PERF_MAX_STACK_DEPTH - 1; i >= 0; i--)
print_ksym(ip[i]);
}
printf("-;");
if (bpf_map_lookup_elem(map_fd[1], &key->userstack, ip) != 0) {
printf("---;");
} else {
for (i = PERF_MAX_STACK_DEPTH - 1; i >= 0; i--)
print_addr(ip[i]);
}
if (count < 6)
printf("\r");
else
printf("\n");
if (key->kernstack == -EEXIST && !warned) {
printf("stackmap collisions seen. Consider increasing size\n");
warned = true;
} else if ((int)key->kernstack < 0 && (int)key->userstack < 0) {
printf("err stackid %d %d\n", key->kernstack, key->userstack);
}
}
static void err_exit(int err)
{
kill(pid, SIGKILL);
exit(err);
}
static void print_stacks(void)
{
struct key_t key = {}, next_key;
__u64 value;
__u32 stackid = 0, next_id;
int error = 1, fd = map_fd[0], stack_map = map_fd[1];
sys_read_seen = sys_write_seen = false;
while (bpf_map_get_next_key(fd, &key, &next_key) == 0) {
bpf_map_lookup_elem(fd, &next_key, &value);
print_stack(&next_key, value);
bpf_map_delete_elem(fd, &next_key);
key = next_key;
}
printf("\n");
if (!sys_read_seen || !sys_write_seen) {
printf("BUG kernel stack doesn't contain sys_read() and sys_write()\n");
err_exit(error);
}
/* clear stack map */
while (bpf_map_get_next_key(stack_map, &stackid, &next_id) == 0) {
bpf_map_delete_elem(stack_map, &next_id);
stackid = next_id;
}
}
static inline int generate_load(void)
{
if (system("dd if=/dev/zero of=/dev/null count=5000k status=none") < 0) {
printf("failed to generate some load with dd: %s\n", strerror(errno));
return -1;
}
return 0;
}
static void test_perf_event_all_cpu(struct perf_event_attr *attr)
{
int nr_cpus = sysconf(_SC_NPROCESSORS_ONLN);
struct bpf_link **links = calloc(nr_cpus, sizeof(struct bpf_link *));
int i, pmu_fd, error = 1;
if (!links) {
printf("malloc of links failed\n");
Annotation
- Immediate include surface: `stdio.h`, `unistd.h`, `stdlib.h`, `stdbool.h`, `string.h`, `linux/perf_event.h`, `linux/bpf.h`, `signal.h`.
- Detected declarations: `struct key_t`, `function print_ksym`, `function print_addr`, `function print_stack`, `function err_exit`, `function print_stacks`, `function generate_load`, `function test_perf_event_all_cpu`, `function test_perf_event_task`, `function test_bpf_perf_event`.
- Atlas domain: Support Tooling And Documentation / samples.
- Implementation status: source implementation candidate.
Implementation Notes
- This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
- Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
- Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.