linux-kernel - [PATCH v2 0/6] enable creating [k,u]probe with perf_event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 29 Nov 2017 17:44:39 -0800
From:   Song Liu <songliubraving@...com>
To:     <peterz@...radead.org>, <rostedt@...dmis.org>, <mingo@...hat.com>,
        <davem@...emloft.net>, <netdev@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <daniel@...earbox.net>
CC:     <kernel-team@...com>, Song Liu <songliubraving@...com>
Subject: [PATCH v2 0/6] enable creating [k,u]probe with perf_event_open

Changes PATCH v1 to PATCH v2:
  Split PERF_TYPE_PROBE into PERF_TYPE_KPROBE and PERF_TYPE_UPROBE.
  Split perf_probe into perf_kprobe and perf_uprobe.
  Remove struct probe_desc, use config1 and config2 instead.

Changes RFC v2 to PATCH v1:
  Check type PERF_TYPE_PROBE in perf_event_set_filter().
  Rebase on to tip perf/core.

Changes RFC v1 to RFC v2:
  Fix build issue reported by kbuild test bot by adding ifdef of
  CONFIG_KPROBE_EVENTS, and CONFIG_UPROBE_EVENTS.

RFC v1 cover letter:

This is to follow up the discussion over "new kprobe api" at Linux
Plumbers 2017:

https://www.linuxplumbersconf.org/2017/ocw/proposals/4808

With current kernel, user space tools can only create/destroy [k,u]probes
with a text-based API (kprobe_events and uprobe_events in tracefs). This
approach relies on user space to clean up the [k,u]probe after using them.
However, this is not easy for user space to clean up properly.

To solve this problem, we introduce a file descriptor based API.
Specifically, we extended perf_event_open to create [k,u]probe, and attach
this [k,u]probe to the file descriptor created by perf_event_open. These
[k,u]probe are associated with this file descriptor, so they are not
available in tracefs.

We reuse large portion of existing trace_kprobe and trace_uprobe code.
Currently, the file descriptor API does not support arguments as the
text-based API does. This should not be a problem, as user of the file
decriptor based API read data through other methods (bpf, etc.).

I also include a patch to to bcc, and a patch to man-page perf_even_open.
Please see the list below. A fork of bcc with this patch is also available
on github:

  https://github.com/liu-song-6/bcc/tree/perf_event_open

Thanks,
Song

man-pages patch:
  perf_event_open.2: add type PERF_TYPE_KPROBE and PERF_TYPE_UPROBE

bcc patch:
  bcc: Try use new API to create [k,u]probe with perf_event_open

kernel patches:

Song Liu (6):
  perf: Add new types PERF_TYPE_KPROBE and PERF_TYPE_UPROBE
  perf: copy new perf_event.h to tools/include/uapi
  perf: implement support of PERF_TYPE_KPROBE
  perf: implement support of PERF_TYPE_UPROBE
  bpf: add option for bpf_load.c to use PERF_TYPE_KPROBE
  bpf: add new test test_many_kprobe

 include/linux/trace_events.h          |   4 +
 include/uapi/linux/perf_event.h       |   8 ++
 kernel/events/core.c                  |  76 +++++++++++++-
 kernel/trace/trace_event_perf.c       | 111 +++++++++++++++++++++
 kernel/trace/trace_kprobe.c           |  91 +++++++++++++++--
 kernel/trace/trace_probe.h            |  11 ++
 kernel/trace/trace_uprobe.c           |  90 +++++++++++++++--
 samples/bpf/Makefile                  |   3 +
 samples/bpf/bpf_load.c                |  59 ++++++-----
 samples/bpf/bpf_load.h                |  12 +++
 samples/bpf/test_many_kprobe_user.c   | 182 ++++++++++++++++++++++++++++++++++
 tools/include/uapi/linux/perf_event.h |   8 ++
 12 files changed, 611 insertions(+), 44 deletions(-)
 create mode 100644 samples/bpf/test_many_kprobe_user.c

--
2.9.5