linux-kernel - [PATCH v4 bpf-next 0/4] tracing/probe: Add PERF_EVENT_IOC_QUERY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190820214819.16154-1-dxu@dxuuu.xyz>
Date:   Tue, 20 Aug 2019 14:48:15 -0700
From:   Daniel Xu <dxu@...uu.xyz>
To:     bpf@...r.kernel.org, songliubraving@...com, yhs@...com,
        andriin@...com, peterz@...radead.org, mingo@...hat.com,
        acme@...nel.org
Cc:     Daniel Xu <dxu@...uu.xyz>, ast@...com,
        alexander.shishkin@...ux.intel.com, jolsa@...hat.com,
        namhyung@...nel.org, linux-kernel@...r.kernel.org,
        kernel-team@...com
Subject: [PATCH v4 bpf-next 0/4] tracing/probe: Add PERF_EVENT_IOC_QUERY_PROBE

It's useful to know [uk]probe's nmissed and nhit stats. For example with
tracing tools, it's important to know when events may have been lost.
debugfs currently exposes a control file to get this information, but
it is not compatible with probes registered with the perf API.

While bpf programs may be able to manually count nhit, there is no way
to gather nmissed. In other words, it is currently not possible to
retrieve information about FD-based probes.

This patch adds a new ioctl that lets users query nmissed (as well as
nhit for completeness). We currently only add support for [uk]probes
but leave the possibility open for other probes like tracepoint.

v3 -> v4:
- Make kernel code set size field on ioctl arg
- Update selftests to check size field
- Remove unnecessary function stubs

v2 -> v3:
- Introduce bpf_link_type and associated getter to track underlying link
  types
- Add back size field in perf_event_query_probe for forward/backwards
  compat
- Remove NULL checks, fix typos

v1 -> v2:
- More descriptive cover letter
- Make API more generic and support uprobes as well
- Use casters/getters for libbpf instead of single getter
- Fix typos
- Remove size field from ioctl struct
- Split out libbpf.h sync to tools dir to separate commit

Daniel Xu (4):
  tracing/probe: Add PERF_EVENT_IOC_QUERY_PROBE ioctl
  libbpf: Add helpers to extract perf fd from bpf_link
  tracing/probe: Sync perf_event.h to tools
  tracing/probe: Add self test for PERF_EVENT_IOC_QUERY_PROBE

 include/linux/trace_events.h                  |   2 +
 include/uapi/linux/perf_event.h               |  23 ++++
 kernel/events/core.c                          |  20 +++
 kernel/trace/trace_kprobe.c                   |  25 ++++
 kernel/trace/trace_uprobe.c                   |  25 ++++
 tools/include/uapi/linux/perf_event.h         |  23 ++++
 tools/lib/bpf/libbpf.c                        |  21 ++++
 tools/lib/bpf/libbpf.h                        |  13 ++
 tools/lib/bpf/libbpf.map                      |   3 +
 .../selftests/bpf/prog_tests/attach_probe.c   | 115 ++++++++++++++++++
 10 files changed, 270 insertions(+)

-- 
2.21.0