linux-kernel - Re: [PATCHv3 00/12] perf tools: Display eBPF code in intel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190531090940.GA9580@leoy-ThinkPad-X240s>
Date:   Fri, 31 May 2019 17:09:41 +0800
From:   Leo Yan <leo.yan@...aro.org>
To:     Arnaldo Carvalho de Melo <arnaldo.melo@...il.com>
Cc:     Jiri Olsa <jolsa@...hat.com>, Jiri Olsa <jolsa@...nel.org>,
        Jesper Dangaard Brouer <brouer@...hat.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        lkml <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Peter Zijlstra <a.p.zijlstra@...llo.nl>,
        Stanislav Fomichev <sdf@...ichev.me>,
        Song Liu <songliubraving@...com>,
        Adrian Hunter <adrian.hunter@...el.com>,
        Andi Kleen <ak@...ux.intel.com>
Subject: Re: [PATCHv3 00/12] perf tools: Display eBPF code in intel_pt trace

Hi Arnaldo,

On Thu, May 30, 2019 at 10:36:45AM -0300, Arnaldo Carvalho de Melo wrote:

[...]

> One other way of testing this:
> 
> I used perf trace's use of BPF, using:
> 
> [root@...co ~]# cat ~/.perfconfig
> [llvm]
> 	dump-obj = true
> 	clang-opt = -g
> [trace]
> 	add_events = /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c
> 	show_zeros = yes
> 	show_duration = no
> 	no_inherit = yes
> 	show_timestamp = no
> 	show_arg_names = no
> 	args_alignment = 40
> 	show_prefix = yes
> 
> For arm64 this needs fixing, tools/perf/examples/bpf/augmented_raw_syscalls.c
> (its in the kernel sources) is still hard coded for x86_64 syscall numbers :-\

I changed the system call numbers for arm64 respectively in
augmented_raw_syscalls.s; so this if fine.

> Use some other BPF workload, one that has its programs being hit so that
> we get samples in it, in my case running:
> 
>     # perf trace

After I run 'perf trace' command it reports the building failure when
generate eBPF object file, as shown in below log.  I saw the eBPF code
includes the header files unistd.h and pid_filter.h which cannot be
found when clang compiled it.

These two header files are stored in the folder
$linux/tools/perf/include/bpf so I tried to use below command to
specify header path, but still failed:

# clang-7 -target bpf -O2 -I./include/bpf -I./include \
  -I../../usr/include -I../../include \
  -I../../tools/testing/selftests/bpf/ \
  -I../../tools/lib/ \
  -c examples/bpf/augmented_raw_syscalls.c

So now I am stuck for eBPF program building.  Do I miss some
configurations for headers pathes for llvm/clang?

BTW, I notice another potential issue is even the eBPF bytecode
building failed, 'perf trace' command still can continue its work;
after read the code [1], the flow is:
  trace__config();
    `-> parse_events_option();

When building eBPF object failure, parse_events_option() returns 1; for
this case trace__config() needs to detect the erro and return -1 rather
than directly return 1 to caller function.


---8<---

# perf trace
/mnt/linux-kernel/linux-cs-dev/tools/perf/examples/bpf/augmented_raw_syscalls.c:17:10: fatal error: 'unistd.h' file not found
#include <unistd.h>
         ^~~~~~~~~~
1 error generated.
ERROR:  unable to compile /mnt/linux-kernel/linux-cs-dev/tools/perf/examples/bpf/augmented_raw_syscalls.c
Hint:   Check error message shown above.
Hint:   You can also pre-compile it into .o using:
                clang -target bpf -O2 -c /mnt/linux-kernel/linux-cs-dev/tools/perf/examples/bpf/augmented_raw_syscalls.c
        with proper -I and -D options.
event syntax error: '/mnt/linux-kernel/linux-cs-dev/tools/perf/examples/bpf/augmented_raw_syscalls.c'
                     \___ Failed to load /mnt/linux-kernel/linux-cs-dev/tools/perf/examples/bpf/augmented_raw_syscalls.c from source: Error when compiling BPF scriptlet

(add -v to see detail)
Run 'perf list' for a list of valid events

Thanks a lot for help!

Leo.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/perf/builtin-trace.c?h=v5.2-rc2#n3631