linux-kernel - Re: [PATCH v7 bpf-next RESEND 1/2] bpf: Add bpf_read_branch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4Bzam8ikJO7atrSS8s-rLJ0jHKNjahcuVEWFh7AAbGTaoGw@mail.gmail.com>
Date:   Tue, 11 Feb 2020 11:23:02 -0800
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Daniel Xu <dxu@...uu.xyz>
Cc:     bpf <bpf@...r.kernel.org>, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Andrii Nakryiko <andriin@...com>,
        open list <linux-kernel@...r.kernel.org>,
        Kernel Team <kernel-team@...com>,
        Peter Ziljstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>
Subject: Re: [PATCH v7 bpf-next RESEND 1/2] bpf: Add bpf_read_branch_records() helper

On Mon, Feb 10, 2020 at 12:09 PM Daniel Xu <dxu@...uu.xyz> wrote:
>
> Branch records are a CPU feature that can be configured to record
> certain branches that are taken during code execution. This data is
> particularly interesting for profile guided optimizations. perf has had
> branch record support for a while but the data collection can be a bit
> coarse grained.
>
> We (Facebook) have seen in experiments that associating metadata with
> branch records can improve results (after postprocessing). We generally
> use bpf_probe_read_*() to get metadata out of userspace. That's why bpf
> support for branch records is useful.
>
> Aside from this particular use case, having branch data available to bpf
> progs can be useful to get stack traces out of userspace applications
> that omit frame pointers.
>
> Signed-off-by: Daniel Xu <dxu@...uu.xyz>
> ---

LGTM, one typo in description of the helper. bpf-next is still closed,
btw, but should hopefully open soon.

Acked-by: Andrii Nakryiko <andriin@...com>

>  include/uapi/linux/bpf.h | 25 +++++++++++++++++++++++-
>  kernel/trace/bpf_trace.c | 41 ++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 65 insertions(+), 1 deletion(-)
>
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index f1d74a2bd234..3004470b7269 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -2892,6 +2892,25 @@ union bpf_attr {
>   *             Obtain the 64bit jiffies
>   *     Return
>   *             The 64 bit jiffies
> + *
> + * int bpf_read_branch_records(struct bpf_perf_event_data *ctx, void *buf, u32 size, u64 flags)
> + *     Description
> + *             For an eBPF program attached to a perf event, retrieve the
> + *             branch records (struct perf_branch_entry) associated to *ctx*
> + *             and store it in the buffer pointed by *buf* up to size
> + *             *buf_size* bytes.
> + *     Return
> + *             On success, number of bytes written to *buf*. On error, a
> + *             negative value.
> + *
> + *             The *flags* can be set to **BPF_F_GET_BRANCH_RECORDS_SIZE** to
> + *             instead return the number of bytes required to store all the
> + *             branch entries. If this flag is set, *buf* may be NULL.
> + *
> + *             **-EINVAL** if arguments invalid or **buf_size** not a multiple

buf_size -> size

> + *             of sizeof(struct perf_branch_entry).
> + *
> + *             **-ENOENT** if architecture does not support branch records.
>   */

[...]