linux-kernel - [RFC PATCH v5 27/30] perf record: Probe at kprobe points

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 1 Jun 2015 07:38:13 +0000
From:	Wang Nan <wangnan0@...wei.com>
To:	<namhyung@...nel.org>, <alexei.starovoitov@...il.com>,
	<masami.hiramatsu.pt@...achi.com>, <acme@...nel.org>,
	<paulus@...ba.org>, <a.p.zijlstra@...llo.nl>, <mingo@...hat.com>,
	<jolsa@...nel.org>, <dsahern@...il.com>, <daniel@...earbox.net>,
	<brendan.d.gregg@...il.com>
CC:	<lizefan@...wei.com>, <hekuang@...wei.com>, <xiakaixu@...wei.com>,
	<linux-kernel@...r.kernel.org>, <pi3orama@....com>
Subject: [RFC PATCH v5 27/30] perf record: Probe at kprobe points

In this patch, kprobe points are created using add_perf_probe_events.
Since all events are already grouped together in an array, calling
add_perf_probe_events() once creates all of them.

probe_conf.max_probes is set to MAX_PROBES to support glob matching.

Signed-off-by: Wang Nan <wangnan0@...wei.com>
---
 tools/perf/builtin-record.c  | 14 ++++++++++++-
 tools/perf/util/bpf-loader.c | 47 ++++++++++++++++++++++++++++++++++++++++++++
 tools/perf/util/bpf-loader.h |  4 ++++
 3 files changed, 64 insertions(+), 1 deletion(-)

diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 91aa2a3..a7c178e 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -29,6 +29,7 @@
 #include "util/data.h"
 #include "util/auxtrace.h"
 #include "util/parse-branch-options.h"
+#include "util/bpf-loader.h"
 
 #include <unistd.h>
 #include <sched.h>
@@ -1108,7 +1109,17 @@ int cmd_record(int argc, const char **argv, const char *prefix __maybe_unused)
 	if (err)
 		return err;
 
-	err = -ENOMEM;
+	/*
+	 * bpf__probe must be called before symbol__init() because we
+	 * need init_symbol_maps. If called after symbol__init,
+	 * symbol_conf.sort_by_name won't take effect.
+	 */
+	err = bpf__probe();
+	if (err) {
+		pr_err("Probing at events in BPF object failed.\n");
+		pr_err("Try perf probe -d '*' to remove existing probe events.\n");
+		return err;
+	}
 
 	symbol__init(NULL);
 
@@ -1169,6 +1180,7 @@ out_symbol_exit:
 	perf_evlist__delete(rec->evlist);
 	symbol__exit();
 	auxtrace_record__free(rec->itr);
+	bpf__unprobe();
 	return err;
 }
 
diff --git a/tools/perf/util/bpf-loader.c b/tools/perf/util/bpf-loader.c
index 1022729..21470f8 100644
--- a/tools/perf/util/bpf-loader.c
+++ b/tools/perf/util/bpf-loader.c
@@ -179,3 +179,50 @@ void bpf__clear(void)
 	bpf_object__for_each(obj, tmp)
 		bpf_object__close(obj);
 }
+
+static bool is_probing = false;
+
+int bpf__unprobe(void)
+{
+	struct strfilter *delfilter;
+	int ret;
+
+	if (!is_probing)
+		return 0;
+
+	delfilter = strfilter__new(PERF_BPF_PROBE_GROUP ":*", NULL);
+	if (!delfilter) {
+		pr_err("Failed to create delfilter when unprobing\n");
+		return -ENOMEM;
+	}
+
+	ret = del_perf_probe_events(delfilter);
+	strfilter__delete(delfilter);
+	if (ret < 0 && is_probing)
+		pr_err("Error: failed to delete events: %s\n",
+			strerror(-ret));
+	else
+		is_probing = false;
+	return ret < 0 ? ret : 0;
+}
+
+int bpf__probe(void)
+{
+	int err;
+
+	if (nr_probe_events <= 0)
+		return 0;
+
+	probe_conf.max_probes = MAX_PROBES;
+	/* Let add_perf_probe_events keeps probe_trace_event */
+	err = add_perf_probe_events(probe_event_array,
+				    nr_probe_events,
+				    false);
+	/* add_perf_probe_events return negative when fail */
+	if (err < 0)
+		pr_err("bpf probe: failed to probe events\n");
+	else
+		is_probing = true;
+
+	return err < 0 ? err : 0;
+}
diff --git a/tools/perf/util/bpf-loader.h b/tools/perf/util/bpf-loader.h
index 9d1582f..eed7bdf 100644
--- a/tools/perf/util/bpf-loader.h
+++ b/tools/perf/util/bpf-loader.h
@@ -12,6 +12,8 @@
 
 #ifdef HAVE_LIBBPF_SUPPORT
 int bpf__prepare_load(const char *filename);
+int bpf__probe(void);
+int bpf__unprobe(void);
 
 void bpf__clear(void);
 #else
@@ -21,6 +23,8 @@ static inline int bpf__prepare_load(const char *filename __maybe_unused)
 	return -1;
 }
 
+static inline int bpf__probe(void) { return 0; }
+static inline int bpf__unprobe(void) { return 0; }
 static inline void bpf__clear(void) { }
 #endif
 #endif
-- 
1.8.3.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/