linux-kernel - Re: [PATCH v2 04/19] perf, tools: Tighten detection of BPF events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 22 Aug 2017 12:00:55 -0300
From:   Arnaldo Carvalho de Melo <acme@...nel.org>
To:     Jiri Olsa <jolsa@...hat.com>
Cc:     Andi Kleen <andi@...stfloor.org>, jolsa@...nel.org,
        linux-kernel@...r.kernel.org, Andi Kleen <ak@...ux.intel.com>
Subject: Re: [PATCH v2 04/19] perf, tools: Tighten detection of BPF events

Em Tue, Aug 22, 2017 at 10:20:07AM +0200, Jiri Olsa escreveu:
> On Fri, Aug 11, 2017 at 04:26:19PM -0700, Andi Kleen wrote:
> > From: Andi Kleen <ak@...ux.intel.com>
> > 
> > perf stat -e cpu/uops_executed.core,cmask=1/
> > 
> > would be detected as a BPF source event because the .c matches the .c
> > source BPF pattern.
> > 
> > v2:
> > 
> > Originally I tried to use lex lookahead, but it doesn't seem to work.
> > 
> > This now extends the BPF pattern to match longer events, but then
> > does an extra check in the C code to reject BPF matches that
> > do not end with .c/.o/.obj
> > 
> > This uses REJECT, which makes the flex scanner slower, but
> > that shouldn't be a big problem for the perf events.
> > 
> > Signed-off-by: Andi Kleen <ak@...ux.intel.com>
> 
> seems ok, Arnaldo, could you run it with BPF/clang test machinery? ;-)

Seems to work now:

[root@...et bpf]# perf trace -e write -e /home/acme/bpf/tracepoint.c cat /etc/passwd > /dev/null
     0.000 ( 0.006 ms): cat/18485 write(fd: 1, buf: 0x7f59eebe1000, count: 3494                         ) ...
     0.006 (         ): raw_syscalls:sys_enter:NR 1 (1, 7f59eebe1000, da6, 22, 7f59eebe0010, 0))
     0.008 (         ): perf_bpf_probe:_write:(ffffffff9626b2c0))
     0.000 ( 0.010 ms): cat/18485  ... [continued]: write()) = 3494
[root@...et bpf]# 

I'll try and add this as a "shell test", looking if all the required
components are in place, etc.

- Arnaldo