linux-kernel - Re: [PATCH v4 09/16] perf tools: Enable indices setting syntax for BPF maps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 11 Dec 2015 20:57:54 +0800
From:	pi3orama <pi3orama@....com>
To:	Arnaldo Carvalho de Melo <acme@...nel.org>
Cc:	Wang Nan <wangnan0@...wei.com>, namhyung@...nel.org,
	linux-kernel@...r.kernel.org, mingo@...nel.org, lizefan@...wei.com,
	Alexei Starovoitov <ast@...nel.org>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
Subject: Re: [PATCH v4 09/16] perf tools: Enable indices setting syntax for BPF maps



发自我的 iPhone

> 在 2015年12月11日，下午8:47，Arnaldo Carvalho de Melo <acme@...nel.org> 写道：
> 
> Em Fri, Dec 11, 2015 at 08:39:35PM +0800, pi3orama escreveu:
>> 
>> 
>> 发自我的 iPhone
>> 
>>> 在 2015年12月11日，下午8:15，Arnaldo Carvalho de Melo <acme@...nel.org> 写道：
>>> 
>>> Em Fri, Dec 11, 2015 at 09:11:45AM -0300, Arnaldo Carvalho de Melo escreveu:
>>>> Em Tue, Dec 08, 2015 at 02:25:37AM +0000, Wang Nan escreveu:
>>>>> This patch introduce a new syntax to perf event parser:
>>>>> 
>>>>> # perf record -e bpf_file.c/maps.mymap.value[0,3...5,7]=1234/ ...
>>>> 
>>>> Is the above example valid? Wouldn't this be "maps:mymap.value" ?
>>>> 
>>>>> 
>>>>> By utilizing the basic facilities in bpf-loader.c which allow setting
>>>>> different slots in a BPF map separately, the newly introduced syntax
>>>>> allows perf to control specific elements in a BPF map.
>>>>> 
>>>>> Test result:
>>>>> 
>>>>> # cat ./test_bpf_map_3.c
>>>>> /************************ BEGIN **************************/
>>>>> #define SEC(NAME) __attribute__((section(NAME), used))
>>>>> enum bpf_map_type {
>>>>>    BPF_MAP_TYPE_ARRAY = 2,
>>>>> };
>>>>> struct bpf_map_def {
>>>>>    unsigned int type;
>>>>>    unsigned int key_size;
>>>>>    unsigned int value_size;
>>>>>    unsigned int max_entries;
>>>>> };
>>>>> static void *(*map_lookup_elem)(struct bpf_map_def *, void *) =
>>>>>    (void *)1;
>>>>> static int (*bpf_trace_printk)(const char *fmt, int fmt_size, ...) =
>>>>>    (void *)6;
>>>> 
>>>> Can you explain the above a bit more? What are the magic 1 and 6 values?
>>> 
>>> So, from another patch:
>>> 
>>> static u64 (*bpf_ktime_get_ns)(void) =
>>>    (void *)5;
>>> static int (*bpf_trace_printk)(const char *fmt, int fmt_size, ...) =
>>>    (void *)6;
>>> static int (*bpf_get_smp_processor_id)(void) =
>>>    (void *)8;
>>> static int (*bpf_perf_event_output)(void *, struct bpf_map_def *, int,
>>> void *, unsigned long) =
>>>    (void *)23;
>>> 
>>> Where can I get this magical mistery table? Could this be hidden away in
>>> some .h file automagically included in bpf scriptlets so that n00bies
>>> like me don't have to be wtf'ing?
>> 
>> They are function numbers defined in bpf.h and bpf-common.h, but they are Linux
>> headers. Directly include them causes many error for llvm. Also, the function
>> prototypes are BPF specific and can't included in Linux source. We should have
>> a place holds those indices and prototypes together.
> 
> Sure, just please don't assume whoever is reading your patches has this
> background, provide comments above such places, so that reviewing gets
> facilitated.
> 
> I eventually figured this is some sort of trampoline to access kernel
> functions:
> 
> /* integer value in 'imm' field of BPF_CALL instruction selects which
> * helper function eBPF program intends to call
> */
> enum bpf_func_id {
>        BPF_FUNC_unspec,
>        BPF_FUNC_map_lookup_elem, /* void *map_lookup_elem(&map, &key) */
>        BPF_FUNC_map_update_elem, /* int map_update_elem(&map, &key, &value, flags) */
>        BPF_FUNC_map_delete_elem, /* int map_delete_elem(&map, &key) */
>        BPF_FUNC_probe_read,      /* int bpf_probe_read(void *dst, int size, void *src) */
> 
> 
> But if you had just:
> 
> /*
> * See enum_bpf_func_id in ./include/uapi/linux/bpf.h
> */
> 
> That would've helped.
> 

Thank you, but I think this is a good chance to setup the policy about the header
files for BPF. I suggested to put BPF specific headers into Linux kernel include dir,
but we must find a way to avoid Linux includes them. Another useful structure is
pt_regs, however which is not as important as before because we have prologue
now.

I'd like to have a try next week.

Thank you.

> - Arnaldo

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/