linux-kernel - Re: [RFC PATCH 2/2] perf script: Print bpf-output events in 'perf script'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 25 Feb 2016 12:11:11 +0800
From:	"Wangnan (F)" <wangnan0@...wei.com>
To:	Arnaldo Carvalho de Melo <acme@...nel.org>
CC:	<jolsa@...nel.org>, <linux-kernel@...r.kernel.org>,
	"Arnaldo Carvalho de Melo" <acme@...hat.com>,
	Brendan Gregg <brendan.d.gregg@...il.com>,
	"Masami Hiramatsu" <masami.hiramatsu.pt@...achi.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Li Zefan <lizefan@...wei.com>, <pi3orama@....com>
Subject: Re: [RFC PATCH 2/2] perf script: Print bpf-output events in 'perf
 script'



On 2016/2/24 23:19, Arnaldo Carvalho de Melo wrote:
> Em Wed, Feb 24, 2016 at 11:20:45AM +0000, Wang Nan escreveu:
>> This patch allows 'perf script' output messages from BPF program.
>> For example, use test_bpf_output_3.c at the end of this commit
>> message,
>>
>>   # ./perf record -e bpf-output/no-inherit,name=evt/ \
>>                   -e ./test_bpf_output_3.c/map:channel.event=evt/ \
>>                   usleep 100000
> Trying to test this with 'perf trace', i.e. to shortcircuit record +
> analysis:
>
> [root@...et bpf]# perf trace -a --ev bpf-output/no-inherit,name=evt/ --ev ./test_bpf_output_3.c/map:channel.event=evt/ --ev 'perf_bpf_probe:*' usleep 100000
> Failed to set filter "common_pid != 23954" on event evt with 22 (Invalid argument)
>
> Can't we set tracepoint filters on these events?

No we can't. filters can only be set to tracepoint events, but 
bpf-output is a
software event.

In addition, you don't need
   ... --ev 'perf_bpf_probe:*' ...

because they should be already collected by '--ev ./test_bpf_output_3.c'.

You don't see them because the two kprobe events are filtered out by BPF 
program.
See 'return 0' in func.

Thank you.