linux-kernel - Re: [PATCH 4/4] perf bpf: Automatically create bpf-output event __bpf_stdout_

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160408175428.GA25165@kernel.org>
Date:	Fri, 8 Apr 2016 14:54:28 -0300
From:	Arnaldo Carvalho de Melo <acme@...nel.org>
To:	Wang Nan <wangnan0@...wei.com>
Cc:	pi3orama@....com, linux-kernel@...r.kernel.org, lizefan@...wei.com,
	Wang Nan <wangnan0@...wei.com>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Jiri Olsa <jolsa@...nel.org>
Subject: Re: [PATCH 4/4] perf bpf: Automatically create bpf-output event
 __bpf_stdout__

Em Fri, Apr 08, 2016 at 03:07:25PM +0000, Wang Nan escreveu:
>  struct bpf_map_def SEC("maps") __bpf_stdout__ = {
>         .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
>         .key_size = sizeof(int),
>         .value_size = sizeof(u32),
>         .max_entries = __NR_CPUS__,
>  };
> 
>  static inline int __attribute__((always_inline))
>  func(void *ctx, int type)
>  {
> 	char output_str[] = "Raise a BPF event!";
> 	char err_str[] = "BAD %d\n";
> 	int err;
> 
>         err = perf_event_output(ctx, &channel, get_smp_processor_id(),

I had to change channel here to __bpf_stdout__, then it works :-)

> 			        &output_str, sizeof(output_str));
> 	if (err)
> 		trace_printk(err_str, sizeof(err_str), err);
>         return 1;

Asking for strace-like output for 'nanosleep', the function hooked:

[root@...et bpf]# trace -e nanosleep --ev test_bpf_stdout.c usleep 1
     0.007 ( 0.007 ms): usleep/729 nanosleep(rqtp: 0x7ffc5bbc5fe0) ...
     0.007 (         ): __bpf_stdout__:Raise a BPF event!..)
     0.008 (         ): perf_bpf_probe:func_begin:(ffffffff81112460))
     0.069 (         ): __bpf_stdout__:Raise a BPF event!..)
     0.070 (         ): perf_bpf_probe:func_end:(ffffffff81112460 <- ffffffff81003d92))
     0.072 ( 0.072 ms): usleep/729  ... [continued]: nanosleep()) = 0
[root@...et bpf]# 

Ok, merged those, now lets see how all this mixes with callchains...

- Arnaldo