linux-kernel - Re: [RFC PATCH 2/2] perf script: Print bpf-output events in 'perf script'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160225124924.GJ8720@kernel.org>
Date:	Thu, 25 Feb 2016 09:49:24 -0300
From:	Arnaldo Carvalho de Melo <acme@...nel.org>
To:	"Wangnan (F)" <wangnan0@...wei.com>
Cc:	jolsa@...nel.org, linux-kernel@...r.kernel.org,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Brendan Gregg <brendan.d.gregg@...il.com>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Li Zefan <lizefan@...wei.com>, pi3orama@....com
Subject: Re: [RFC PATCH 2/2] perf script: Print bpf-output events in 'perf
 script'

Em Thu, Feb 25, 2016 at 12:11:11PM +0800, Wangnan (F) escreveu:
> 
> 
> On 2016/2/24 23:19, Arnaldo Carvalho de Melo wrote:
> >Em Wed, Feb 24, 2016 at 11:20:45AM +0000, Wang Nan escreveu:
> >>This patch allows 'perf script' output messages from BPF program.
> >>For example, use test_bpf_output_3.c at the end of this commit
> >>message,
> >>
> >>  # ./perf record -e bpf-output/no-inherit,name=evt/ \
> >>                  -e ./test_bpf_output_3.c/map:channel.event=evt/ \
> >>                  usleep 100000
> >Trying to test this with 'perf trace', i.e. to shortcircuit record +
> >analysis:
> >
> >[root@...et bpf]# perf trace -a --ev bpf-output/no-inherit,name=evt/ --ev ./test_bpf_output_3.c/map:channel.event=evt/ --ev 'perf_bpf_probe:*' usleep 100000
> >Failed to set filter "common_pid != 23954" on event evt with 22 (Invalid argument)
> >
> >Can't we set tracepoint filters on these events?
 
> No we can't. filters can only be set to tracepoint events, but
> bpf-output is a software event.

Gack, should've checked that, I somehow thought that it was a tracepoint
event of some sort.
 
> In addition, you don't need
>   ... --ev 'perf_bpf_probe:*' ...
> 
> because they should be already collected by '--ev ./test_bpf_output_3.c'.

Right, that was me trying to be clever 8-)
 
> You don't see them because the two kprobe events are filtered out by
> BPF program.  See 'return 0' in func.

Thanks for reminding about this part...
 
> Thank you.