linux-kernel - Re: [PATCH v2 bpf-next 1/4] tracing/probe: Add PERF_EVENT_IOC_QUERY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 13 Aug 2019 12:48:00 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Daniel Xu <dxu@...uu.xyz>
Cc:     Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Andrii Nakryiko <andriin@...com>, peterz@...raded.org,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Alexei Starovoitov <ast@...com>,
        alexander.shishkin@...ux.intel.com, Jiri Olsa <jolsa@...hat.com>,
        Namhyung Kim <namhyung@...nel.org>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 bpf-next 1/4] tracing/probe: Add PERF_EVENT_IOC_QUERY_PROBE
 ioctl

On Mon, Aug 12, 2019 at 5:39 PM Daniel Xu <dxu@...uu.xyz> wrote:
>
> On Mon, Aug 12, 2019, at 8:57 AM, Andrii Nakryiko wrote:
> > On Fri, Aug 9, 2019 at 2:47 PM Daniel Xu <dxu@...uu.xyz> wrote:
> > >
> > > It's useful to know [uk]probe's nmissed and nhit stats. For example with
> > > tracing tools, it's important to know when events may have been lost.
> > > debugfs currently exposes a control file to get this information, but
> > > it is not compatible with probes registered with the perf API.
> > >
> > > While bpf programs may be able to manually count nhit, there is no way
> > > to gather nmissed. In other words, it is currently not possible to
> > > retrieve information about FD-based probes.
> > >
> > > This patch adds a new ioctl that lets users query nmissed (as well as
> > > nhit for completeness). We currently only add support for [uk]probes
> > > but leave the possibility open for other probes like tracepoint.
> > >
> > > Signed-off-by: Daniel Xu <dxu@...uu.xyz>
> > > ---
> > >  include/linux/trace_events.h    | 12 ++++++++++++
> > >  include/uapi/linux/perf_event.h | 19 +++++++++++++++++++
> > >  kernel/events/core.c            | 20 ++++++++++++++++++++
> > >  kernel/trace/trace_kprobe.c     | 23 +++++++++++++++++++++++
> > >  kernel/trace/trace_uprobe.c     | 23 +++++++++++++++++++++++
> > >  5 files changed, 97 insertions(+)
> > >
> [...]
> > > +       struct trace_kprobe *tk = (struct trace_kprobe *)call->data;
> > > +       u64 nmissed, nhit;
> > > +
> > > +       if (!capable(CAP_SYS_ADMIN))
> > > +               return -EPERM;
> > > +       if (copy_from_user(&query, uquery, sizeof(query)))

Not sure why we are reading that struct in, if we never use that? With
size as a first argument (see below about compatiblity), I'd also read
just first 4 or 8 bytes only.

> >
> > what about forward/backward compatibility? Didn't you have a size
> > field for perf_event_query_probe?
>
> I initially did, yes. But after thinking about it more, I'm not convinced it
> is necessary. It seems the last change to the debugfs counterpart was in
> the initial comit cd7e7bd5e4, ~10 years ago. I cannot think of any other
> information that would be useful off the top of my head, so I figured it'd
> be best if we didn't make more complicated something that doesn't seem
> likely to change. If we really needed something else, I figured adding
> another ioctl is pretty cheap.
>
> If you (or anyone) feels strongly about adding it back, I can make it a
> u64 so there's no holes.

Debugfs is not stable API, so I guess that matters less. I think we
should support this forward/backward compatibility mechanism that
kernel implements for a lot of other stable APIs.

>
> >
> > > +               return -EFAULT;
> > > +
> > > +       nhit = trace_kprobe_nhit(tk);
> > > +       nmissed = tk->rp.kp.nmissed;
> > > +
> > > +       if (put_user(nmissed, &uquery->nmissed) ||
> > > +           put_user(nhit, &uquery->nhit))
> >
> > Wouldn't it be nicer to just do one user put for entire struct (or at
> > least relevant part of it with backward/forward compatibility?).
>
> Not sure how that didn't occur to me. Thanks.

Once you add back size field for compatibility, doing it with one call
will make it easier to write only first N requested bytes.