linux-kernel - [PATCH 22/39] perf record: Probe at kprobe points

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1436445342-1402-23-git-send-email-wangnan0@huawei.com>
Date:	Thu, 9 Jul 2015 12:35:25 +0000
From:	Wang Nan <wangnan0@...wei.com>
To:	<acme@...nel.org>, <ast@...mgrid.com>
CC:	<linux-kernel@...r.kernel.org>, <lizefan@...wei.com>,
	<hekuang@...wei.com>, <xiakaixu@...wei.com>, <pi3orama@....com>
Subject: [PATCH 22/39] perf record: Probe at kprobe points

In this patch, kprobe points are created using add_perf_probe_events.
Since all events are already grouped together in an array, calling
add_perf_probe_events() creates all of them.

probe_conf.max_probes is set to MAX_PROBES to support glob matching.

Signed-off-by: Wang Nan <wangnan0@...wei.com>
---
 tools/perf/builtin-record.c  | 18 ++++++++++++++++-
 tools/perf/util/bpf-loader.c | 48 ++++++++++++++++++++++++++++++++++++++++++++
 tools/perf/util/bpf-loader.h |  4 ++++
 3 files changed, 69 insertions(+), 1 deletion(-)

diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 283fe96..33b213a 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -29,6 +29,7 @@
 #include "util/data.h"
 #include "util/auxtrace.h"
 #include "util/parse-branch-options.h"
+#include "util/bpf-loader.h"
 
 #include <unistd.h>
 #include <sched.h>
@@ -1111,7 +1112,21 @@ int cmd_record(int argc, const char **argv, const char *prefix __maybe_unused)
 	if (err)
 		return err;
 
-	err = -ENOMEM;
+	/*
+	 * bpf__probe must be called before symbol__init() because we
+	 * need init_symbol_maps. If called after symbol__init,
+	 * symbol_conf.sort_by_name won't take effect.
+	 *
+	 * bpf__unprobe() is safe even if bpf__probe() failed, and it
+	 * also calls symbol__init. Therefore, goto out_symbol_exit
+	 * is safe when probe failed.
+	 */
+	err = bpf__probe();
+	if (err) {
+		pr_err("Probing at events in BPF object failed.\n");
+		pr_err("Try perf probe -d '*' to remove existing probe events.\n");
+		goto out_symbol_exit;
+	}
 
 	symbol__init(NULL);
 
@@ -1172,6 +1187,7 @@ out_symbol_exit:
 	perf_evlist__delete(rec->evlist);
 	symbol__exit();
 	auxtrace_record__free(rec->itr);
+	bpf__unprobe();
 	return err;
 }
 
diff --git a/tools/perf/util/bpf-loader.c b/tools/perf/util/bpf-loader.c
index e33995d..10fe661 100644
--- a/tools/perf/util/bpf-loader.c
+++ b/tools/perf/util/bpf-loader.c
@@ -193,3 +193,51 @@ void bpf__clear(void)
 	bpf_object__for_each_safe(obj, tmp)
 		bpf_object__close(obj);
 }
+
+static bool is_probing;
+
+int bpf__unprobe(void)
+{
+	struct strfilter *delfilter;
+	int ret;
+
+	if (!is_probing)
+		return 0;
+
+	delfilter = strfilter__new(PERF_BPF_PROBE_GROUP ":*", NULL);
+	if (!delfilter) {
+		pr_err("Failed to create delfilter when unprobing\n");
+		return -ENOMEM;
+	}
+
+	ret = del_perf_probe_events(delfilter);
+	strfilter__delete(delfilter);
+	if (ret < 0 && is_probing)
+		pr_err("Error: failed to delete events: %s\n",
+			strerror(-ret));
+	else
+		is_probing = false;
+	return ret < 0 ? ret : 0;
+}
+
+int bpf__probe(void)
+{
+	int err;
+
+	if (nr_probe_events <= 0)
+		return 0;
+
+	probe_conf.max_probes = MAX_PROBES;
+	/* Let add_perf_probe_events keeps probe_trace_event */
+	err = add_perf_probe_events(probe_event_array,
+				    nr_probe_events,
+				    false);
+
+	/* add_perf_probe_events return negative when fail */
+	if (err < 0)
+		pr_err("bpf probe: failed to probe events\n");
+	else
+		is_probing = true;
+
+	return err < 0 ? err : 0;
+}
diff --git a/tools/perf/util/bpf-loader.h b/tools/perf/util/bpf-loader.h
index 5a3c954..374aec0 100644
--- a/tools/perf/util/bpf-loader.h
+++ b/tools/perf/util/bpf-loader.h
@@ -12,6 +12,8 @@
 
 #ifdef HAVE_LIBBPF_SUPPORT
 int bpf__prepare_load(const char *filename, bool source);
+int bpf__probe(void);
+int bpf__unprobe(void);
 
 void bpf__clear(void);
 #else
@@ -22,6 +24,8 @@ static inline int bpf__prepare_load(const char *filename __maybe_unused,
 	return -1;
 }
 
+static inline int bpf__probe(void) { return 0; }
+static inline int bpf__unprobe(void) { return 0; }
 static inline void bpf__clear(void) { }
 #endif
 #endif
-- 
1.8.3.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/