linux-kernel - Re: perf trace + BPF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 1 Apr 2016 10:50:40 -0300
From:	Arnaldo Carvalho de Melo <acme@...nel.org>
To:	"Wangnan (F)" <wangnan0@...wei.com>
Cc:	David Ahern <dsahern@...il.com>, Jiri Olsa <jolsa@...nel.org>,
	Namhyung Kim <namhyung@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: perf trace + BPF

Em Fri, Apr 01, 2016 at 09:29:52PM +0800, Wangnan (F) escreveu:
> 
> 
> On 2016/4/1 2:08, Arnaldo Carvalho de Melo wrote:
> >Hi Wang,
> >
> >	Trying to get back at working with 'perf trace' + BPF and I'm
> >noticing that the perf_event_attr->sample_type for the BPF events are
> >different than the ones for the raw_syscalls:sys_{enter,exit} or to
> >other tracepoint events we may ask 'perf trace' to set up, for instance,
> >for:
> >
> >perf trace -vv -T --ev sched:sched_switch --ev bpf-output/no-inherit,name=evt/ --ev /home/acme/bpf/test_bpf_trace.c/map:channel.event=evt/ usleep 10
> >
> >We get these sample types (full perf_event_attr dump at the end of this
> >message):
> >
> >sched:sched_switch:
> >sample_type                      IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER
> >
> >[root@...et ~]# perf probe -l
> >   perf_bpf_probe:func_begin (on SyS_nanosleep@...ux/kernel/time/hrtimer.c)
> >   perf_bpf_probe:func_end (on SyS_nanosleep%return@...ux/kernel/time/hrtimer.c)
> >
> >   sample_type                    IP|TID|RAW|IDENTIFIER
> >
> >raw_syscalls:sys_{enter,exit}:
> >
> >   sample_type                    IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER
> >
> >I guess this is an interaction with that "no-inherit" part, probably we need to
> >set PERF_SAMPLE_TIME by some other means...
> 
> Please see [1]. Not related to no-inherit, just because the bpf-output event
> is not a tracepoint.

Right, that was a dead end of mine when investigating this, thanks for
fixing this up!
 
> And glad to see you restart working on my patches again!

Yeah, hopefully this time we'll get most of what is outstanding merged.

I want to at some time experiment with doing things 'perf trace' needs
with BPF, behind the scenes :-)
 
> Thank you.
> 
> [1] http://lkml.kernel.org/g/1459517202-42320-1-git-send-email-wangnan0@huawei.com
> 
> 
> 
> >- Arnaldo
> >
>