How to attach perf_events?

[mrproliu]

In BCC, we have BPF.attach_perf_event to attach the perf_event and could use sample_period parameter to trigger with an interval.
But I can't see how to attach perf_events in cilium/ebpf?

[florianl]

cilium/ebpf is a Go implementation around the eBPF ecosystem and it is independent of the perf subsystem of the Linux kernel. BCC decided to do a mix and implement both but also decided to implement only a part of the complete perf userspace API.
Go implementations of the perf subsystem are for example acln0/perf or hodgesds/perf-utils to name only two. Both packages can be used along with cilium/ebpf to attach eBPF programs to perf events.
Also the standard library provides an option to do so with unix#PerfEventOpen.
General speaking there are usually four steps involved to attach an eBPF program to a perf event:

1. Open the perf event
2. Load the eBPF program
3. Set the eBPF program on the perf event
4. Enable the perf event

But there are some caveats to keep in mind. One can not attach an eBPF program to every perf event and attaching an eBPF program to a perf event represents only a very small subset of the perf subsystem.

[ti-mo]

@mrproliu have you tried running this on a more recent kernel? There's a known issue with uprobes on older kernels: #406. You're not setting uprobes here, but could be related, who knows. 🤷

[mrproliu]

@mrproliu have you tried running this on a more recent kernel? There's a known issue with uprobes on older kernels: #406. You're not setting uprobes here, but could be related, who knows. 🤷

I have printed the uname -a result, you could see it's >= 4.19, do I miss anything?

[ti-mo]

I see you're using 4.19, hence my suggestion of trying something more recent.

[mrproliu]

I have updated the kernel, but it still not working, also don't have any output :(

$ uname -a
Linux bpf-test2 5.11.0-1028-gcp #32~20.04.1-Ubuntu SMP Wed Jan 12 20:08:27 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

[ti-mo]

I've marked @florianl's response as the answer, I think it nicely outlines how to implement what was asked in the original question.

The resulting thread has turned into troubleshooting, so not sure if we can continue discussing this here.