linux-kernel - [RFC PATCH v2 32/37] tools perf bpf: probe at kprobe points.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 15 May 2015 07:51:25 +0000
From:	Wang Nan <wangnan0@...wei.com>
To:	<paulus@...ba.org>, <a.p.zijlstra@...llo.nl>, <mingo@...hat.com>,
	<acme@...nel.org>, <namhyung@...nel.org>, <jolsa@...nel.org>,
	<adrian.hunter@...el.com>, <dsahern@...il.com>, <ast@...mgrid.com>,
	<daniel@...earbox.net>, <brendan.d.gregg@...il.com>,
	<masami.hiramatsu.pt@...achi.com>
CC:	<linux-kernel@...r.kernel.org>, <lizefan@...wei.com>,
	<pi3orama@....com>, <wangnan0@...wei.com>
Subject: [RFC PATCH v2 32/37] tools perf bpf: probe at kprobe points.

In this patch, kprobe points are created using add_perf_probe_events.
Since all events are already grouped together in an array, calling
add_perf_probe_events() once creates all of them.

To ensure recover the system when existing, a bpf_unprobe() is also
provided and hooked to atexit(). Because all of events are in group
"perf_bpf_probe" (PERF_BPF_PROBE_GROUP), use 'perf_bpf_probe:*' string
to remove all of them should be a simple method. However, this also
introduces a constrain that only one instance of 'perf bpf' is allowed
to be active.

Due to the atexit hook, this patch must ensure bpf_unprobe() won't
error if it has been executed. A global flag 'is_probing' is used to
track probing state. bpf_unprobe() will do nothing if it is unset.

Signed-off-by: Wang Nan <wangnan0@...wei.com>
---
 tools/perf/builtin-bpf.c     |  8 ++++++++
 tools/perf/util/bpf-loader.c | 48 ++++++++++++++++++++++++++++++++++++++++++++
 tools/perf/util/bpf-loader.h |  2 ++
 3 files changed, 58 insertions(+)

diff --git a/tools/perf/builtin-bpf.c b/tools/perf/builtin-bpf.c
index e922921..95e0c65 100644
--- a/tools/perf/builtin-bpf.c
+++ b/tools/perf/builtin-bpf.c
@@ -157,10 +157,18 @@ static int cmd_bpf_record(int argc, const char **argv,
 		}
 	}
 
+	if (bpf_probe()) {
+		pr_err("bpf: failed to probe\n");
+		goto errout;
+	}
+
 	return start_bpf_record(argc, argv);
 usage:
 	usage_with_options(bpf_record_usage, options);
 	return -1;
+errout:
+	bpf_clear();
+	return -1;
 }
 
 
diff --git a/tools/perf/util/bpf-loader.c b/tools/perf/util/bpf-loader.c
index 3dc9b61..c820d1a 100644
--- a/tools/perf/util/bpf-loader.c
+++ b/tools/perf/util/bpf-loader.c
@@ -160,9 +160,57 @@ void bpf_clear(void)
 {
 	size_t i;
 
+	bpf_unprobe();
 	for (i = 0; i < params.nr_events; i++)
 		clear_perf_probe_event(&params.event_array[i]);
 
 	for (i = 0; i < params.nr_objects; i++)
 		bpf_close_object(params.objects[i]);
 }
+
+static bool is_probing = false;
+
+int bpf_unprobe(void)
+{
+	struct strlist *dellist;
+	int ret;
+
+	if (!is_probing)
+		return 0;
+
+	dellist = strlist__new(true, PERF_BPF_PROBE_GROUP ":*");
+	if (!dellist) {
+		pr_err("Failed to create dellist when unprobing\n");
+		return -ENOMEM;
+	}
+
+	ret = del_perf_probe_events(dellist);
+	strlist__delete(dellist);
+	if (ret < 0)
+		pr_err("  Error: failed to delete events: %s\n",
+			strerror(-ret));
+	else
+		is_probing = false;
+	return ret < 0 ? ret : 0;
+}
+
+static void bpf_unprobe_atexit(void)
+{
+	bpf_unprobe();
+}
+
+int bpf_probe(void)
+{
+	int err = add_perf_probe_events(params.event_array,
+					params.nr_events,
+					MAX_PROBES, 0);
+	/* add_perf_probe_events return negative when fail */
+	if (err < 0)
+		pr_err("bpf probe: failed to probe events\n");
+	else {
+		is_probing = true;
+		atexit(bpf_unprobe_atexit);
+	}
+
+	return err < 0 ? err : 0;
+}
diff --git a/tools/perf/util/bpf-loader.h b/tools/perf/util/bpf-loader.h
index 74eebc3..30dea2e 100644
--- a/tools/perf/util/bpf-loader.h
+++ b/tools/perf/util/bpf-loader.h
@@ -8,6 +8,8 @@
 #define __BPF_LOADER_H
 
 int bpf_prepare_load(const char *filename);
+int bpf_probe(void);
+int bpf_unprobe(void);
 
 void bpf_clear(void);
 #endif
-- 
1.8.3.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/