linux-kernel - Re: [PATCH 10/48] perf tools: Introduce bpf-output event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <56CD0FC4.3070305@huawei.com>
Date:	Wed, 24 Feb 2016 10:04:52 +0800
From:	"Wangnan (F)" <wangnan0@...wei.com>
To:	Arnaldo Carvalho de Melo <acme@...nel.org>
CC:	Alexei Starovoitov <ast@...nel.org>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Brendan Gregg <brendan.d.gregg@...il.com>,
	Adrian Hunter <adrian.hunter@...el.com>,
	Cody P Schafer <dev@...yps.com>,
	"David S. Miller" <davem@...emloft.net>,
	He Kuang <hekuang@...wei.com>,
	Jérémie Galarneau 
	<jeremie.galarneau@...icios.com>, Jiri Olsa <jolsa@...nel.org>,
	Kirill Smelkov <kirr@...edi.com>,
	Li Zefan <lizefan@...wei.com>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>, <pi3orama@....com>,
	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 10/48] perf tools: Introduce bpf-output event



On 2016/2/24 9:58, Wangnan (F) wrote:
>
>
> On 2016/2/24 1:45, Arnaldo Carvalho de Melo wrote:
>> Em Mon, Feb 22, 2016 at 09:10:37AM +0000, Wang Nan escreveu:
>>> Commit a43eec304259a6c637f4014a6d4767159b6a3aa3 (bpf: introduce
>>> bpf_perf_event_output() helper) add a helper to enable BPF program
>>> output data to perf ring buffer through a new type of perf event
>>> PERF_COUNT_SW_BPF_OUTPUT. This patch enable perf to create perf
>>> event of that type. Now perf user can use following cmdline to
>>> receive output data from BPF programs:
>>>
>>>   # ./perf record -a -e bpf-output/no-inherit,name=evt/ \
>>>                      -e ./test_bpf_output.c/map:channel.event=evt/ ls /
>>>   # ./perf script
>>>              perf  1560 [004] 347747.086295:                       
>>> evt:  ffffffff811fd201 sys_write ...
>>>              perf  1560 [004] 347747.086300:                       
>>> evt:  ffffffff811fd201 sys_write ...
>>>              perf  1560 [004] 347747.086315:                       
>>> evt:  ffffffff811fd201 sys_write ...
>>>              ...
>>>
>>> Test result:
>>>   # cat ./test_bpf_output.c
>>>   /************************ BEGIN **************************/
>>>   #include <uapi/linux/bpf.h>
>>>   struct bpf_map_def {
>>>       unsigned int type;
>>>       unsigned int key_size;
>>>       unsigned int value_size;
>>>       unsigned int max_entries;
>>>   };
>>>
>>>   #define SEC(NAME) __attribute__((section(NAME), used))
>>>   static u64 (*ktime_get_ns)(void) =
>>>       (void *)BPF_FUNC_ktime_get_ns;
>>>   static int (*trace_printk)(const char *fmt, int fmt_size, ...) =
>>>       (void *)BPF_FUNC_trace_printk;
>>>   static int (*get_smp_processor_id)(void) =
>>>       (void *)BPF_FUNC_get_smp_processor_id;
>>>   static int (*perf_event_output)(void *, struct bpf_map_def *, int, 
>>> void *, unsigned long) =
>>>       (void *)BPF_FUNC_perf_event_output;
>>>
>>>   struct bpf_map_def SEC("maps") channel = {
>>>       .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
>>>       .key_size = sizeof(int),
>>>       .value_size = sizeof(u32),
>>>       .max_entries = __NR_CPUS__,
>>>   };
>>>
>>>   SEC("func_write=sys_write")
>>>   int func_write(void *ctx)
>>>   {
>>>       struct {
>>>           u64 ktime;
>>>           int cpuid;
>>>       } __attribute__((packed)) output_data;
>>>       char error_data[] = "Error: failed to output: %d\n";
>>>
>>>       output_data.cpuid = get_smp_processor_id();
>>>       output_data.ktime = ktime_get_ns();
>>>       int err = perf_event_output(ctx, &channel, 
>>> get_smp_processor_id(),
>>>                       &output_data, sizeof(output_data));
>>>       if (err)
>>>           trace_printk(error_data, sizeof(error_data), err);
>>>       return 0;
>>>   }
>>>   char _license[] SEC("license") = "GPL";
>>>   int _version SEC("version") = LINUX_VERSION_CODE;
>>>   /************************ END ***************************/
>>>
>>>   # ./perf record -a -e bpf-output/no-inherit,name=evt/ \
>>>                      -e ./test_bpf_output.c/map:channel.event=evt/ ls /
>>>   # ./perf script | grep ls
>>>            ls  2242 [003] 347851.557563: evt:  ffffffff811fd201 
>>> sys_write ...
>>>            ls  2242 [003] 347851.557571: evt:  ffffffff811fd201 
>>> sys_write ...
>> So, there is something strange here:
>>
>>          if (unlikely(event->oncpu != smp_processor_id()))
>>                  return -EOPNOTSUPP;
>>
>

All failures have 'event->oncpu == -1' here. I guess we should suppress 
warning in
this case. But why event->oncpu becomes -1?

Thank you.