linux-kernel - Re: [PATCH v2 bpf-next 1/4] tracing/probe: Add PERF_EVENT_IOC_QUERY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 12 Aug 2019 17:38:53 -0700
From:   "Daniel Xu" <dxu@...uu.xyz>
To:     "Andrii Nakryiko" <andrii.nakryiko@...il.com>
Cc:     "Song Liu" <songliubraving@...com>, "Yonghong Song" <yhs@...com>,
        "Andrii Nakryiko" <andriin@...com>, peterz@...raded.org,
        "Ingo Molnar" <mingo@...hat.com>,
        "Arnaldo Carvalho de Melo" <acme@...nel.org>,
        "Alexei Starovoitov" <ast@...com>,
        alexander.shishkin@...ux.intel.com, "Jiri Olsa" <jolsa@...hat.com>,
        "Namhyung Kim" <namhyung@...nel.org>,
        "open list" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 bpf-next 1/4] tracing/probe: Add PERF_EVENT_IOC_QUERY_PROBE ioctl

On Mon, Aug 12, 2019, at 8:57 AM, Andrii Nakryiko wrote:
> On Fri, Aug 9, 2019 at 2:47 PM Daniel Xu <dxu@...uu.xyz> wrote:
> >
> > It's useful to know [uk]probe's nmissed and nhit stats. For example with
> > tracing tools, it's important to know when events may have been lost.
> > debugfs currently exposes a control file to get this information, but
> > it is not compatible with probes registered with the perf API.
> >
> > While bpf programs may be able to manually count nhit, there is no way
> > to gather nmissed. In other words, it is currently not possible to
> > retrieve information about FD-based probes.
> >
> > This patch adds a new ioctl that lets users query nmissed (as well as
> > nhit for completeness). We currently only add support for [uk]probes
> > but leave the possibility open for other probes like tracepoint.
> >
> > Signed-off-by: Daniel Xu <dxu@...uu.xyz>
> > ---
> >  include/linux/trace_events.h    | 12 ++++++++++++
> >  include/uapi/linux/perf_event.h | 19 +++++++++++++++++++
> >  kernel/events/core.c            | 20 ++++++++++++++++++++
> >  kernel/trace/trace_kprobe.c     | 23 +++++++++++++++++++++++
> >  kernel/trace/trace_uprobe.c     | 23 +++++++++++++++++++++++
> >  5 files changed, 97 insertions(+)
> >
[...]
> > +       struct trace_kprobe *tk = (struct trace_kprobe *)call->data;
> > +       u64 nmissed, nhit;
> > +
> > +       if (!capable(CAP_SYS_ADMIN))
> > +               return -EPERM;
> > +       if (copy_from_user(&query, uquery, sizeof(query)))
> 
> what about forward/backward compatibility? Didn't you have a size
> field for perf_event_query_probe?

I initially did, yes. But after thinking about it more, I'm not convinced it
is necessary. It seems the last change to the debugfs counterpart was in
the initial comit cd7e7bd5e4, ~10 years ago. I cannot think of any other
information that would be useful off the top of my head, so I figured it'd
be best if we didn't make more complicated something that doesn't seem
likely to change. If we really needed something else, I figured adding
another ioctl is pretty cheap.

If you (or anyone) feels strongly about adding it back, I can make it a
u64 so there's no holes.

> 
> > +               return -EFAULT;
> > +
> > +       nhit = trace_kprobe_nhit(tk);
> > +       nmissed = tk->rp.kp.nmissed;
> > +
> > +       if (put_user(nmissed, &uquery->nmissed) ||
> > +           put_user(nhit, &uquery->nhit))
> 
> Wouldn't it be nicer to just do one user put for entire struct (or at
> least relevant part of it with backward/forward compatibility?).

Not sure how that didn't occur to me. Thanks.