linux-kernel - [PATCH v3 perf, bpf-next 0/4] reveal invisible bpf programs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 11 Dec 2018 15:33:46 -0800
From:   Song Liu <songliubraving@...com>
To:     <linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>
CC:     Song Liu <songliubraving@...com>, <ast@...nel.org>,
        <daniel@...earbox.net>, <kernel-team@...com>,
        <peterz@...radead.org>, <acme@...nel.org>
Subject: [PATCH v3 perf, bpf-next 0/4] reveal invisible bpf programs

This set catches symbol for all BPF programs loaded/unloaded
before/during/after perf-record run in a mmap-like event,
PERF_RECORD_BPF_EVENT.

PERF_RECORD_BPF_EVENT includes key information of a BPF program load and
unload. It is sent through perf ringbuffer, and stored in perf.data.
Before this patch, perf-report will not be able to recover symbols of
BPF programs once the programs are unloaded.

Besides basic mmap-like information (name, addr, size),
PERF_RECORD_BPF_EVENT includes BPF program id, and tag. These information
can be used for detailed performance analysis like annotation.

This is to follow up Alexei's early effort [2] to show bpf programs via
mmap events.

Thanks,
Song

Changes v2 -> PATCH v3:
1. Rebase on bpf-next tree, and on top of BPF sub program tag patches [1]
   for latest information in bpf_prog_info.
2. Complete handling and synthesizing PERF_RECORD_BPF_EVENT in perf.

Changes v1 -> PATCH v2:
1. Only 3 of the 5 patches in v1, to focus on ABI first;
2. Generate PERF_RECORD_BPF_EVENT per bpf sub program instead of per prog;
3. Modify PERF_RECORD_BPF_EVENT with more details (addr, len, name),
   so that it can be used for basic profiling without calling sys_bpf.

Changes RFC -> PATCH v1:
1. In perf-record, poll vip events in a separate thread;
2. Add tag to bpf prog name;
3. Small refactorings.

[1] https://patchwork.ozlabs.org/project/netdev/list/?series=81037
[2] https://www.spinics.net/lists/netdev/msg524232.html

Song Liu (4):
  perf, bpf: Introduce PERF_RECORD_BPF_EVENT
  perf: sync tools/include/uapi/linux/perf_event.h
  perf util: handle PERF_RECORD_BPF_EVENT
  perf tools: synthesize bpf event for loaded BPF programs

 include/linux/filter.h                |   7 +
 include/linux/perf_event.h            |  10 +
 include/uapi/linux/perf_event.h       |  35 +++-
 kernel/bpf/core.c                     |   2 +-
 kernel/bpf/syscall.c                  |   3 +
 kernel/events/core.c                  | 123 ++++++++++++-
 tools/include/uapi/linux/perf_event.h |  35 +++-
 tools/perf/builtin-record.c           |   6 +
 tools/perf/util/Build                 |   2 +
 tools/perf/util/bpf-event.c           | 251 ++++++++++++++++++++++++++
 tools/perf/util/bpf-event.h           |  15 ++
 tools/perf/util/event.c               |  23 +++
 tools/perf/util/event.h               |  26 +++
 tools/perf/util/evsel.c               |   9 +
 tools/perf/util/evsel.h               |   1 +
 tools/perf/util/machine.c             |   3 +
 tools/perf/util/session.c             |   4 +
 tools/perf/util/tool.h                |   4 +-
 18 files changed, 554 insertions(+), 5 deletions(-)
 create mode 100644 tools/perf/util/bpf-event.c
 create mode 100644 tools/perf/util/bpf-event.h

--
2.17.1