1========================================= 2user_events: User-based Event Tracing 3========================================= 4 5:Author: Beau Belgrave 6 7Overview 8-------- 9User based trace events allow user processes to create events and trace data 10that can be viewed via existing tools, such as ftrace and perf. 11To enable this feature, build your kernel with CONFIG_USER_EVENTS=y. 12 13Programs can view status of the events via 14/sys/kernel/tracing/user_events_status and can both register and write 15data out via /sys/kernel/tracing/user_events_data. 16 17Programs can also use /sys/kernel/tracing/dynamic_events to register and 18delete user based events via the u: prefix. The format of the command to 19dynamic_events is the same as the ioctl with the u: prefix applied. This 20requires CAP_PERFMON due to the event persisting, otherwise -EPERM is returned. 21 22Typically programs will register a set of events that they wish to expose to 23tools that can read trace_events (such as ftrace and perf). The registration 24process tells the kernel which address and bit to reflect if any tool has 25enabled the event and data should be written. The registration will give back 26a write index which describes the data when a write() or writev() is called 27on the /sys/kernel/tracing/user_events_data file. 28 29The structures referenced in this document are contained within the 30/include/uapi/linux/user_events.h file in the source tree. 31 32**NOTE:** *Both user_events_status and user_events_data are under the tracefs 33filesystem and may be mounted at different paths than above.* 34 35Registering 36----------- 37Registering within a user process is done via ioctl() out to the 38/sys/kernel/tracing/user_events_data file. The command to issue is 39DIAG_IOCSREG. 40 41This command takes a packed struct user_reg as an argument:: 42 43 struct user_reg { 44 /* Input: Size of the user_reg structure being used */ 45 __u32 size; 46 47 /* Input: Bit in enable address to use */ 48 __u8 enable_bit; 49 50 /* Input: Enable size in bytes at address */ 51 __u8 enable_size; 52 53 /* Input: Flags to use, if any */ 54 __u16 flags; 55 56 /* Input: Address to update when enabled */ 57 __u64 enable_addr; 58 59 /* Input: Pointer to string with event name, description and flags */ 60 __u64 name_args; 61 62 /* Output: Index of the event to use when writing data */ 63 __u32 write_index; 64 } __attribute__((__packed__)); 65 66The struct user_reg requires all the above inputs to be set appropriately. 67 68+ size: This must be set to sizeof(struct user_reg). 69 70+ enable_bit: The bit to reflect the event status at the address specified by 71 enable_addr. 72 73+ enable_size: The size of the value specified by enable_addr. 74 This must be 4 (32-bit) or 8 (64-bit). 64-bit values are only allowed to be 75 used on 64-bit kernels, however, 32-bit can be used on all kernels. 76 77+ flags: The flags to use, if any. 78 Callers should first attempt to use flags and retry without flags to ensure 79 support for lower versions of the kernel. If a flag is not supported -EINVAL 80 is returned. 81 82+ enable_addr: The address of the value to use to reflect event status. This 83 must be naturally aligned and write accessible within the user program. 84 85+ name_args: The name and arguments to describe the event, see command format 86 for details. 87 88The following flags are currently supported. 89 90+ USER_EVENT_REG_PERSIST: The event will not delete upon the last reference 91 closing. Callers may use this if an event should exist even after the 92 process closes or unregisters the event. Requires CAP_PERFMON otherwise 93 -EPERM is returned. 94 95Upon successful registration the following is set. 96 97+ write_index: The index to use for this file descriptor that represents this 98 event when writing out data. The index is unique to this instance of the file 99 descriptor that was used for the registration. See writing data for details. 100 101User based events show up under tracefs like any other event under the 102subsystem named "user_events". This means tools that wish to attach to the 103events need to use /sys/kernel/tracing/events/user_events/[name]/enable 104or perf record -e user_events:[name] when attaching/recording. 105 106**NOTE:** The event subsystem name by default is "user_events". Callers should 107not assume it will always be "user_events". Operators reserve the right in the 108future to change the subsystem name per-process to accommodate event isolation. 109 110Command Format 111^^^^^^^^^^^^^^ 112The command string format is as follows:: 113 114 name[:FLAG1[,FLAG2...]] [Field1[;Field2...]] 115 116Supported Flags 117^^^^^^^^^^^^^^^ 118None yet 119 120Field Format 121^^^^^^^^^^^^ 122:: 123 124 type name [size] 125 126Basic types are supported (__data_loc, u32, u64, int, char, char[20], etc). 127User programs are encouraged to use clearly sized types like u32. 128 129**NOTE:** *Long is not supported since size can vary between user and kernel.* 130 131The size is only valid for types that start with a struct prefix. 132This allows user programs to describe custom structs out to tools, if required. 133 134For example, a struct in C that looks like this:: 135 136 struct mytype { 137 char data[20]; 138 }; 139 140Would be represented by the following field:: 141 142 struct mytype myname 20 143 144Deleting 145-------- 146Deleting an event from within a user process is done via ioctl() out to the 147/sys/kernel/tracing/user_events_data file. The command to issue is 148DIAG_IOCSDEL. 149 150This command only requires a single string specifying the event to delete by 151its name. Delete will only succeed if there are no references left to the 152event (in both user and kernel space). User programs should use a separate file 153to request deletes than the one used for registration due to this. 154 155**NOTE:** By default events will auto-delete when there are no references left 156to the event. If programs do not want auto-delete, they must use the 157USER_EVENT_REG_PERSIST flag when registering the event. Once that flag is used 158the event exists until DIAG_IOCSDEL is invoked. Both register and delete of an 159event that persists requires CAP_PERFMON, otherwise -EPERM is returned. 160 161Unregistering 162------------- 163If after registering an event it is no longer wanted to be updated then it can 164be disabled via ioctl() out to the /sys/kernel/tracing/user_events_data file. 165The command to issue is DIAG_IOCSUNREG. This is different than deleting, where 166deleting actually removes the event from the system. Unregistering simply tells 167the kernel your process is no longer interested in updates to the event. 168 169This command takes a packed struct user_unreg as an argument:: 170 171 struct user_unreg { 172 /* Input: Size of the user_unreg structure being used */ 173 __u32 size; 174 175 /* Input: Bit to unregister */ 176 __u8 disable_bit; 177 178 /* Input: Reserved, set to 0 */ 179 __u8 __reserved; 180 181 /* Input: Reserved, set to 0 */ 182 __u16 __reserved2; 183 184 /* Input: Address to unregister */ 185 __u64 disable_addr; 186 } __attribute__((__packed__)); 187 188The struct user_unreg requires all the above inputs to be set appropriately. 189 190+ size: This must be set to sizeof(struct user_unreg). 191 192+ disable_bit: This must be set to the bit to disable (same bit that was 193 previously registered via enable_bit). 194 195+ disable_addr: This must be set to the address to disable (same address that was 196 previously registered via enable_addr). 197 198**NOTE:** Events are automatically unregistered when execve() is invoked. During 199fork() the registered events will be retained and must be unregistered manually 200in each process if wanted. 201 202Status 203------ 204When tools attach/record user based events the status of the event is updated 205in realtime. This allows user programs to only incur the cost of the write() or 206writev() calls when something is actively attached to the event. 207 208The kernel will update the specified bit that was registered for the event as 209tools attach/detach from the event. User programs simply check if the bit is set 210to see if something is attached or not. 211 212Administrators can easily check the status of all registered events by reading 213the user_events_status file directly via a terminal. The output is as follows:: 214 215 Name [# Comments] 216 ... 217 218 Active: ActiveCount 219 Busy: BusyCount 220 221For example, on a system that has a single event the output looks like this:: 222 223 test 224 225 Active: 1 226 Busy: 0 227 228If a user enables the user event via ftrace, the output would change to this:: 229 230 test # Used by ftrace 231 232 Active: 1 233 Busy: 1 234 235Writing Data 236------------ 237After registering an event the same fd that was used to register can be used 238to write an entry for that event. The write_index returned must be at the start 239of the data, then the remaining data is treated as the payload of the event. 240 241For example, if write_index returned was 1 and I wanted to write out an int 242payload of the event. Then the data would have to be 8 bytes (2 ints) in size, 243with the first 4 bytes being equal to 1 and the last 4 bytes being equal to the 244value I want as the payload. 245 246In memory this would look like this:: 247 248 int index; 249 int payload; 250 251User programs might have well known structs that they wish to use to emit out 252as payloads. In those cases writev() can be used, with the first vector being 253the index and the following vector(s) being the actual event payload. 254 255For example, if I have a struct like this:: 256 257 struct payload { 258 int src; 259 int dst; 260 int flags; 261 } __attribute__((__packed__)); 262 263It's advised for user programs to do the following:: 264 265 struct iovec io[2]; 266 struct payload e; 267 268 io[0].iov_base = &write_index; 269 io[0].iov_len = sizeof(write_index); 270 io[1].iov_base = &e; 271 io[1].iov_len = sizeof(e); 272 273 writev(fd, (const struct iovec*)io, 2); 274 275**NOTE:** *The write_index is not emitted out into the trace being recorded.* 276 277Example Code 278------------ 279See sample code in samples/user_events. 280