linux-kernel - Re: perf trace + BPF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 1 Apr 2016 21:29:52 +0800
From:	"Wangnan (F)" <wangnan0@...wei.com>
To:	Arnaldo Carvalho de Melo <acme@...nel.org>
CC:	David Ahern <dsahern@...il.com>, Jiri Olsa <jolsa@...nel.org>,
	"Namhyung Kim" <namhyung@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: perf trace + BPF



On 2016/4/1 2:08, Arnaldo Carvalho de Melo wrote:
> Hi Wang,
>
> 	Trying to get back at working with 'perf trace' + BPF and I'm
> noticing that the perf_event_attr->sample_type for the BPF events are
> different than the ones for the raw_syscalls:sys_{enter,exit} or to
> other tracepoint events we may ask 'perf trace' to set up, for instance,
> for:
>
> perf trace -vv -T --ev sched:sched_switch --ev bpf-output/no-inherit,name=evt/ --ev /home/acme/bpf/test_bpf_trace.c/map:channel.event=evt/ usleep 10
>
> We get these sample types (full perf_event_attr dump at the end of this
> message):
>
> sched:sched_switch:
> sample_type                      IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER
>
> [root@...et ~]# perf probe -l
>    perf_bpf_probe:func_begin (on SyS_nanosleep@...ux/kernel/time/hrtimer.c)
>    perf_bpf_probe:func_end (on SyS_nanosleep%return@...ux/kernel/time/hrtimer.c)
>
>    sample_type                    IP|TID|RAW|IDENTIFIER
>
> raw_syscalls:sys_{enter,exit}:
>
>    sample_type                    IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER
>
> I guess this is an interaction with that "no-inherit" part, probably we need to
> set PERF_SAMPLE_TIME by some other means...

Please see [1]. Not related to no-inherit, just because the bpf-output event
is not a tracepoint.

And glad to see you restart working on my patches again!

Thank you.

[1] 
http://lkml.kernel.org/g/1459517202-42320-1-git-send-email-wangnan0@huawei.com



> - Arnaldo
>