linux-kernel - Re: [PATCH 10/12] perf script: Add --show-bpf-events to show eBPF related events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 6 May 2019 21:42:44 +0000
From:   Song Liu <songliubraving@...com>
To:     Jiri Olsa <jolsa@...nel.org>
CC:     Arnaldo Carvalho de Melo <acme@...nel.org>,
        lkml <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Peter Zijlstra <a.p.zijlstra@...llo.nl>,
        Stanislav Fomichev <sdf@...ichev.me>,
        Adrian Hunter <adrian.hunter@...el.com>,
        Andi Kleen <ak@...ux.intel.com>
Subject: Re: [PATCH 10/12] perf script: Add --show-bpf-events to show eBPF
 related events



> On May 3, 2019, at 1:18 AM, Jiri Olsa <jolsa@...nel.org> wrote:
> 
> Adding --show-bpf-events to show eBPF related events:
>  PERF_RECORD_KSYMBOL
>  PERF_RECORD_BPF_EVENT
> 
> Usage:
>  # perf record -a
>  ...
>  # perf script --show-bpf-events
>  ...
>  swapper     0 [000]     0.000000: PERF_RECORD_KSYMBOL ksymbol event with addr ffffffffc0ef971d len 229 type 1 flags 0x0 name bpf_prog_2a142ef67aaad174
>  swapper     0 [000]     0.000000: PERF_RECORD_BPF_EVENT bpf event with type 1, flags 0, id 36
>  ...
> 
> Link: http://lkml.kernel.org/n/tip-9kvkcw7z4i1464jb7gasv4lb@git.kernel.org
> Signed-off-by: Jiri Olsa <jolsa@...nel.org>
> ---
> tools/perf/Documentation/perf-script.txt |  3 ++
> tools/perf/builtin-script.c              | 42 ++++++++++++++++++++++++
> 2 files changed, 45 insertions(+)
> 
> diff --git a/tools/perf/Documentation/perf-script.txt b/tools/perf/Documentation/perf-script.txt
> index 9b0d04dd2a61..af8282782911 100644
> --- a/tools/perf/Documentation/perf-script.txt
> +++ b/tools/perf/Documentation/perf-script.txt
> @@ -313,6 +313,9 @@ OPTIONS
> --show-round-events
> 	Display finished round events i.e. events of type PERF_RECORD_FINISHED_ROUND.
> 
> +--show-bpf-events
> +	Display bpf events i.e. events of type PERF_RECORD_KSYMBOL and PERF_RECORD_BPF_EVENT.
> +
> --demangle::
> 	Demangle symbol names to human readable form. It's enabled by default,
> 	disable with --no-demangle.
> diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
> index 7adaa6c63a0b..3a48a2627670 100644
> --- a/tools/perf/builtin-script.c
> +++ b/tools/perf/builtin-script.c
> @@ -1606,6 +1606,7 @@ struct perf_script {
> 	bool			show_namespace_events;
> 	bool			show_lost_events;
> 	bool			show_round_events;
> +	bool			show_bpf_events;
> 	bool			allocated;
> 	bool			per_event_dump;
> 	struct cpu_map		*cpus;
> @@ -2318,6 +2319,41 @@ process_finished_round_event(struct perf_tool *tool __maybe_unused,
> 	return 0;
> }
> 
> +static int
> +process_bpf_events(struct perf_tool *tool __maybe_unused,
> +		   union perf_event *event,
> +		   struct perf_sample *sample,
> +		   struct machine *machine)
> +{
> +	struct thread *thread;
> +	struct perf_script *script = container_of(tool, struct perf_script, tool);
> +	struct perf_session *session = script->session;
> +	struct perf_evsel *evsel = perf_evlist__id2evsel(session->evlist, sample->id);
> +
> +	if (machine__process_ksymbol(machine, event, sample) < 0)
> +		return -1;
> +
> +	if (!evsel->attr.sample_id_all) {
> +		perf_event__fprintf(event, stdout);
> +		return 0;
> +	}
> +
> +	thread = machine__findnew_thread(machine, sample->pid, sample->tid);
> +	if (thread == NULL) {
> +		pr_debug("problem processing MMAP event, skipping it.\n");
> +		return -1;
> +	}
> +
> +	if (!filter_cpu(sample)) {
> +		perf_sample__fprintf_start(sample, thread, evsel,
> +					   event->header.type, stdout);
> +		perf_event__fprintf(event, stdout);
> +	}
> +
> +	thread__put(thread);
> +	return 0;
> +}
> +
> static void sig_handler(int sig __maybe_unused)
> {
> 	session_done = 1;
> @@ -2420,6 +2456,10 @@ static int __cmd_script(struct perf_script *script)
> 		script->tool.ordered_events = false;
> 		script->tool.finished_round = process_finished_round_event;
> 	}
> +	if (script->show_bpf_events) {
> +		script->tool.ksymbol   = process_bpf_events;
> +		script->tool.bpf_event = process_bpf_events;

Why do we need both set to process_bpf_events?

Thanks,
Song

> +	}
> 
> 	if (perf_script__setup_per_event_dump(script)) {
> 		pr_err("Couldn't create the per event dump files\n");
> @@ -3439,6 +3479,8 @@ int cmd_script(int argc, const char **argv)
> 		    "Show lost events (if recorded)"),
> 	OPT_BOOLEAN('\0', "show-round-events", &script.show_round_events,
> 		    "Show round events (if recorded)"),
> +	OPT_BOOLEAN('\0', "show-bpf-events", &script.show_bpf_events,
> +		    "Show bpf related events (if recorded)"),
> 	OPT_BOOLEAN('\0', "per-event-dump", &script.per_event_dump,
> 		    "Dump trace output to files named by the monitored events"),
> 	OPT_BOOLEAN('f', "force", &symbol_conf.force, "don't complain, do it"),
> -- 
> 2.20.1
>