linux-kernel - Re: [PATCH 2/4] perf trace: Print content of bpf-output event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 8 Apr 2016 14:25:07 -0300
From:	Arnaldo Carvalho de Melo <acme@...nel.org>
To:	"Wangnan (F)" <wangnan0@...wei.com>
Cc:	pi3orama@....com, linux-kernel@...r.kernel.org, lizefan@...wei.com,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Jiri Olsa <jolsa@...nel.org>
Subject: Re: [PATCH 2/4] perf trace: Print content of bpf-output event

Em Fri, Apr 08, 2016 at 11:55:11PM +0800, Wangnan (F) escreveu:
> Sorry. This patch should be squash into patch 1/4. The commit message
> is wrong. The main part of described patch is already accepted and merged:
> 
> 1d6c940 perf trace: Print content of bpf-output event

I'll check
 
> Thank you.
> 
> On 2016/4/8 23:07, Wang Nan wrote:
> >With this patch the contend of BPF output event is printed by
> >'perf trace'. For example:
> >
> >  # ./perf trace -a --ev bpf-output/no-inherit,name=evt/ \
> >                    --ev ./test_bpf_trace.c/map:channel.event=evt/ \
> >                    usleep 100000
> >   ...
> >     1.787 ( 0.004 ms): usleep/3832 nanosleep(rqtp: 0x7ffc78b18980                                        ) ...
> >     1.787 (         ): evt:Raise a BPF event!..)
> >     1.788 (         ): perf_bpf_probe:func_begin:(ffffffff810e97d0))
> >   ...
> >   101.866 (87.038 ms): gmain/1654 poll(ufds: 0x7f57a80008c0, nfds: 2, timeout_msecs: 1000               ) ...
> >   101.866 (         ): evt:Raise a BPF event!..)
> >   101.867 (         ): perf_bpf_probe:func_end:(ffffffff810e97d0 <- ffffffff81796173))
> >   101.869 (100.087 ms): usleep/3832  ... [continued]: nanosleep()) = 0
> >   ...
> >
> >  (There is an extra ')' at the end of several lines. However, it is
> >   another problem, unrelated to this commit.)
> >
> >Where test_bpf_trace.c is:
> >  /************************ BEGIN **************************/
> >  #include <uapi/linux/bpf.h>
> >  struct bpf_map_def {
> >         unsigned int type;
> >         unsigned int key_size;
> >         unsigned int value_size;
> >         unsigned int max_entries;
> >  };
> >  #define SEC(NAME) __attribute__((section(NAME), used))
> >  static u64 (*ktime_get_ns)(void) =
> >         (void *)BPF_FUNC_ktime_get_ns;
> >  static int (*trace_printk)(const char *fmt, int fmt_size, ...) =
> >         (void *)BPF_FUNC_trace_printk;
> >  static int (*get_smp_processor_id)(void) =
> >         (void *)BPF_FUNC_get_smp_processor_id;
> >  static int (*perf_event_output)(void *, struct bpf_map_def *, int, void *, unsigned long) =
> >         (void *)BPF_FUNC_perf_event_output;
> >
> >  struct bpf_map_def SEC("maps") channel = {
> >         .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
> >         .key_size = sizeof(int),
> >         .value_size = sizeof(u32),
> >         .max_entries = __NR_CPUS__,
> >  };
> >
> >  static inline int __attribute__((always_inline))
> >  func(void *ctx, int type)
> >  {
> >	char output_str[] = "Raise a BPF event!";
> >	char err_str[] = "BAD %d\n";
> >	int err;
> >
> >         err = perf_event_output(ctx, &channel, get_smp_processor_id(),
> >			        &output_str, sizeof(output_str));
> >	if (err)
> >		trace_printk(err_str, sizeof(err_str), err);
> >         return 1;
> >  }
> >  SEC("func_begin=sys_nanosleep")
> >  int func_begin(void *ctx) {return func(ctx, 1);}
> >  SEC("func_end=sys_nanosleep%return")
> >  int func_end(void *ctx) { return func(ctx, 2);}
> >  char _license[] SEC("license") = "GPL";
> >  int _version SEC("version") = LINUX_VERSION_CODE;
> >  /************************* END ***************************/
> >
> >Signed-off-by: Wang Nan <wangnan0@...wei.com>
> >Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
> >Cc: Jiri Olsa <jolsa@...nel.org>
> >Cc: Li Zefan <lizefan@...wei.com>
> >Cc: pi3orama@....com
> >---
> >  tools/perf/builtin-trace.c | 13 +++++++++----
> >  1 file changed, 9 insertions(+), 4 deletions(-)
> >
> >diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> >index 6fbed86..fb8257f 100644
> >--- a/tools/perf/builtin-trace.c
> >+++ b/tools/perf/builtin-trace.c
> >@@ -2680,11 +2680,15 @@ out_enomem:
> >  	goto out;
> >  }
> >-static int validate_evlist(struct perf_evlist *evlist)
> >+static int validate_evlist(struct perf_evlist *evlist, bool *has_bpf_output)
> >  {
> >  	struct perf_evsel *evsel;
> >  	evlist__for_each(evlist, evsel) {
> >+		if (perf_evsel__is_bpf_output(evsel)) {
> >+			*has_bpf_output = true;
> >+			continue;
> >+		}
> >  		if (evsel->attr.type != PERF_TYPE_TRACEPOINT)
> >  			return -EINVAL;
> >  	}
> >@@ -3268,6 +3272,7 @@ int cmd_trace(int argc, const char **argv, const char *prefix __maybe_unused)
> >  	const char * const trace_subcommands[] = { "record", NULL };
> >  	int err;
> >  	char bf[BUFSIZ];
> >+	bool has_bpf_output = false;
> >  	signal(SIGSEGV, sighandler_dump_stack);
> >  	signal(SIGFPE, sighandler_dump_stack);
> >@@ -3284,12 +3289,12 @@ int cmd_trace(int argc, const char **argv, const char *prefix __maybe_unused)
> >  	argc = parse_options_subcommand(argc, argv, trace_options, trace_subcommands,
> >  				 trace_usage, PARSE_OPT_STOP_AT_NON_OPTION);
> >-	if (validate_evlist(trace.evlist)) {
> >-		pr_err("Only support tracepoint events!\n");
> >+	if (validate_evlist(trace.evlist, &has_bpf_output)) {
> >+		pr_err("Only support tracepoint and bpf-output events!\n");
> >  		return -EINVAL;
> >  	}
> >-	if (trace.trace_pgfaults) {
> >+	if (trace.trace_pgfaults || has_bpf_output) {
> >  		trace.opts.sample_address = true;
> >  		trace.opts.sample_time = true;
> >  	}
>