bpf_perf_event_read_value for reading multiplexed counters

[marceloamaral]

When we want to use more hardware counters than available PMUs (typically 3), linux applies counter multiplexing.

Counter multiplexing impacts the accuracy of the counters and normalization must be applied, as described in the bpf.h.

When there are more PMU based perf events opened than available counters,
kernel will multiplex these events so each event gets certain
percentage (but not all) of the PMU time. In case that
multiplexing happens, the number of samples or counter value
will not reflect the case compared to when no multiplexing
occurs. This makes comparison between different runs difficult.
Typically, the counter value should be normalized before
comparing to other experiments. The usual normalization is done
as follows.
  			normalized_counter = counter * t_enabled / t_running

To get the enable and running time of the counter, we need to use the function bpf_perf_event_read_value, which reads the struct bpf_perf_event_value which contains the counter value and times.

However, I tried to use bpf_perf_event_read_value in many different ways without any success so far.

struct bpf_perf_event_value value_buf;
bpf_perf_event_read_value(&cpu_cycles, cpu_id, &value_buf, sizeof(value_buf));

The error is:

58: (85) call bpf_perf_event_read_value#55
unknown func bpf_perf_event_read_value#55
processed 53 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 3

Could you please provide an example of how we can use it?

[boussole]

May be it's too late but want to give an answer because just got this error at 5.4 kernel
unknown func bpf_perf_event_read_value#55 means that verifier knows about this function but this function is forbidden for this type of bpf.

here you may see that in my (5.4) kernel this function is allowed only for krobe type of bpf

I use raw_tp bpf and only this and this functions are allowed

Later kernels allow this function in any type of bpf here