linux-kernel - Re: [PATCH v6 2/4] perf: support build BPF skeletons with perf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201229114828.GG521329@kernel.org>
Date:   Tue, 29 Dec 2020 08:48:28 -0300
From:   Arnaldo Carvalho de Melo <acme@...nel.org>
To:     Namhyung Kim <namhyung@...nel.org>
Cc:     Song Liu <songliubraving@...com>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Mark Rutland <mark.rutland@....com>,
        Jiri Olsa <jolsa@...hat.com>, kernel-team@...com
Subject: Re: [PATCH v6 2/4] perf: support build BPF skeletons with perf

Em Tue, Dec 29, 2020 at 04:01:41PM +0900, Namhyung Kim escreveu:
> On Tue, Dec 29, 2020 at 2:41 AM Song Liu <songliubraving@...com> wrote:
> > BPF programs are useful in perf to profile BPF programs. BPF skeleton is
 
> I'm having difficulties understanding the first sentence - looks like a
> recursion. :)  So do you want to use two (or more) BPF programs?

Yeah, we use perf to perf perf, so we need to use bpf with perf to perf
bpf :-)

Look at tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c, the BPF
skeleton used to create the in-kernel scaffold to profile BPF programs.

It uses two BPF programs (fentry/XXX and fexit/XXX) and some a
PERF_EVENT_ARRAY map and an array to diff counters read at exit from
counters read at exit of the profiled BPF programs and then accumulate
those diffs in another PERCPU_ARRAY.

This all ends up composing a "BPF PMU" that is what the userspace perf
tooling will read (from "accum_readings" BPF map)  and 'perf stat' will
consume as if reading from an "old style perf counter" :-)

Song, did I get it right? :-)

For convenience, it is below:

- Arnaldo
 
[acme@...e perf]$ cat tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c 
// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
// Copyright (c) 2020 Facebook
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>

/* map of perf event fds, num_cpu * num_metric entries */
struct {
	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
	__uint(key_size, sizeof(__u32));
	__uint(value_size, sizeof(int));
} events SEC(".maps");

/* readings at fentry */
struct {
	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
	__uint(key_size, sizeof(__u32));
	__uint(value_size, sizeof(struct bpf_perf_event_value));
	__uint(max_entries, 1);
} fentry_readings SEC(".maps");

/* accumulated readings */
struct {
	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
	__uint(key_size, sizeof(__u32));
	__uint(value_size, sizeof(struct bpf_perf_event_value));
	__uint(max_entries, 1);
} accum_readings SEC(".maps");

const volatile __u32 num_cpu = 1;

SEC("fentry/XXX")
int BPF_PROG(fentry_XXX)
{
	__u32 key = bpf_get_smp_processor_id();
	struct bpf_perf_event_value *ptr;
	__u32 zero = 0;
	long err;

	/* look up before reading, to reduce error */
	ptr = bpf_map_lookup_elem(&fentry_readings, &zero);
	if (!ptr)
		return 0;

	err = bpf_perf_event_read_value(&events, key, ptr, sizeof(*ptr));
	if (err)
		return 0;

	return 0;
}

static inline void
fexit_update_maps(struct bpf_perf_event_value *after)
{
	struct bpf_perf_event_value *before, diff, *accum;
	__u32 zero = 0;

	before = bpf_map_lookup_elem(&fentry_readings, &zero);
	/* only account samples with a valid fentry_reading */
	if (before && before->counter) {
		struct bpf_perf_event_value *accum;

		diff.counter = after->counter - before->counter;
		diff.enabled = after->enabled - before->enabled;
		diff.running = after->running - before->running;

		accum = bpf_map_lookup_elem(&accum_readings, &zero);
		if (accum) {
			accum->counter += diff.counter;
			accum->enabled += diff.enabled;
			accum->running += diff.running;
		}
	}
}

SEC("fexit/XXX")
int BPF_PROG(fexit_XXX)
{
	struct bpf_perf_event_value reading;
	__u32 cpu = bpf_get_smp_processor_id();
	__u32 one = 1, zero = 0;
	int err;

	/* read all events before updating the maps, to reduce error */
	err = bpf_perf_event_read_value(&events, cpu, &reading, sizeof(reading));
	if (err)
		return 0;

	fexit_update_maps(&reading);
	return 0;
}

char LICENSE[] SEC("license") = "Dual BSD/GPL";
[acme@...e perf]$