linux-kernel - Re: [PATCH 03/31] perf tools: Enable passing bpf object file to --event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 20 Oct 2015 12:42:48 -0300
From:	Arnaldo Carvalho de Melo <acme@...nel.org>
To:	Wang Nan <wangnan0@...wei.com>
Cc:	ast@...mgrid.com, brendan.d.gregg@...il.com,
	a.p.zijlstra@...llo.nl, daniel@...earbox.net, dsahern@...il.com,
	hekuang@...wei.com, jolsa@...nel.org, lizefan@...wei.com,
	masami.hiramatsu.pt@...achi.com, namhyung@...nel.org,
	paulus@...ba.org, linux-kernel@...r.kernel.org, pi3orama@....com,
	xiakaixu@...wei.com
Subject: Re: [PATCH 03/31] perf tools: Enable passing bpf object file to
 --event

Em Tue, Oct 20, 2015 at 12:15:58PM -0300, Arnaldo Carvalho de Melo escreveu:
> Em Tue, Oct 20, 2015 at 12:12:55PM -0300, Arnaldo Carvalho de Melo escreveu:
> > Em Wed, Oct 14, 2015 at 12:41:14PM +0000, Wang Nan escreveu:
> > > By introducing new rules in tools/perf/util/parse-events.[ly], this
> > > patch enables 'perf record --event bpf_file.o' to select events by an
> > > eBPF object file. It calls parse_events_load_bpf() to load that file,
> > > which uses bpf__prepare_load() and finally calls bpf_object__open() for
> > > the object files.
> > > 
> > > After applying this patch, commands like:
> > > 
> > >  # perf record --event foo.o sleep
> > > 
> > > become possible.
> > 
> > So, trying the above command I get almost perfect output:
> > 
> >   [root@...icio ~]# perf record --event foo.o sleep
> >   libbpf: failed to open foo.o: No such file or directory
> >   event syntax error: 'foo.o'
> >                        \___ BPF object file 'foo.o' is invalid
> > 
> >   (add -v to see detail)
> >   Run 'perf list' for a list of valid events
> > 
> >    Usage: perf record [<options>] [<command>]
> >       or: perf record [<options>] -- <command> [<options>]
> > 
> >       -e, --event <event>   event selector. use 'perf list' to list available events
> >   [root@...icio ~]# 
> > 
> > 
> > Good thing would be to not have any message from libbpf and the right error
> > message from the parser, i.e. the first three lines become these two:
> > 
> > 
> >   event syntax error: 'foo.o'
> >                        \___ BPF object file 'foo.o' not found.o
> > 
> > But that can be fixed up in an upcoming patch, so I am applying this one now in
> > my new attempt at processing this patchkit.
> 
> Ditto for:
> 
>   [acme@...icio linux]$ perf record --event /tmp/build/perf/perf.o sleep
>   libbpf: /tmp/build/perf/perf.o is not an eBPF object file
>   event syntax error: '/tmp/build/perf/perf.o'
>                        \___ BPF object file '/tmp/build/perf/perf.o' is invalid
>   
>   (add -v to see detail)
>   Run 'perf list' for a list of valid events
> 
>    Usage: perf record [<options>] [<command>]
>       or: perf record [<options>] -- <command> [<options>]
> 
>       -e, --event <event>   event selector. use 'perf list' to list available events
>   [acme@...icio linux]$
> 
> Now trying to find a _valid_ ebpf object file to test with.

Managed after running:

 perf test LLVM

copy'n'pasting the output of those "set env" lines, replacing it with
export, etc to get to:

[acme@...icio linux]$ echo '__attribute__((section("do_fork"), used)) int fork(void *ctx) {return 0;} char _license[] __attribute__((section("license"), used)) = "GPL";int _version __attribute__((section("version"), used)) = 0x40100;' | $CLANG_EXEC -D__KERNEL__ $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c "$CLANG_SOURCE" -target bpf -O2 -o /tmp/foo.o
[acme@...icio linux]$ file /tmp/foo.o
/tmp/foo.o: ELF 64-bit LSB relocatable, no machine, version 1 (SYSV), not stripped
[acme@...icio linux]$ 

And finally:


[acme@...icio linux]$ file /tmp/foo.o 
/tmp/foo.o: ELF 64-bit LSB relocatable, no machine, version 1 (SYSV), not stripped
[acme@...icio linux]$ perf record --event /tmp/foo.o sleep 1
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.013 MB perf.data ]
[acme@...icio linux]$ perf evlist  -v
/tmp/foo.o: type: 1, size: 112, config: 0x9, { sample_period, sample_freq }: 4000, sample_type: IP|TID|TIME|PERIOD, disabled: 1, inherit: 1, mmap: 1, comm: 1, freq: 1, enable_on_exec: 1, task: 1, sample_id_all: 1, exclude_guest: 1, mmap2: 1, comm_exec: 1
[acme@...icio linux]$ perf evlist
/tmp/foo.o
[acme@...icio linux]$ 

So, type 1 is PERF_TYPE_SOFTWARE, config 0x9 is PERF_COUNT_SW_DUMMY, ok.

And it behaves accordingly, no samples, etc.

Added the sequence of testing with a non-existing file, with a normal ELF file
and then with a valid eBPF ELF file as committer notes.

Continuing.

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/