lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 29 Dec 2020 08:48:28 -0300
From:   Arnaldo Carvalho de Melo <>
To:     Namhyung Kim <>
Cc:     Song Liu <>,
        linux-kernel <>,
        Peter Zijlstra <>,
        Ingo Molnar <>,
        Alexander Shishkin <>,
        Mark Rutland <>,
        Jiri Olsa <>,
Subject: Re: [PATCH v6 2/4] perf: support build BPF skeletons with perf

Em Tue, Dec 29, 2020 at 04:01:41PM +0900, Namhyung Kim escreveu:
> On Tue, Dec 29, 2020 at 2:41 AM Song Liu <> wrote:
> > BPF programs are useful in perf to profile BPF programs. BPF skeleton is
> I'm having difficulties understanding the first sentence - looks like a
> recursion. :)  So do you want to use two (or more) BPF programs?

Yeah, we use perf to perf perf, so we need to use bpf with perf to perf
bpf :-)

Look at tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c, the BPF
skeleton used to create the in-kernel scaffold to profile BPF programs.

It uses two BPF programs (fentry/XXX and fexit/XXX) and some a
PERF_EVENT_ARRAY map and an array to diff counters read at exit from
counters read at exit of the profiled BPF programs and then accumulate
those diffs in another PERCPU_ARRAY.

This all ends up composing a "BPF PMU" that is what the userspace perf
tooling will read (from "accum_readings" BPF map)  and 'perf stat' will
consume as if reading from an "old style perf counter" :-)

Song, did I get it right? :-)

For convenience, it is below:

- Arnaldo
[acme@...e perf]$ cat tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c 
// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
// Copyright (c) 2020 Facebook
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>

/* map of perf event fds, num_cpu * num_metric entries */
struct {
	__uint(key_size, sizeof(__u32));
	__uint(value_size, sizeof(int));
} events SEC(".maps");

/* readings at fentry */
struct {
	__uint(key_size, sizeof(__u32));
	__uint(value_size, sizeof(struct bpf_perf_event_value));
	__uint(max_entries, 1);
} fentry_readings SEC(".maps");

/* accumulated readings */
struct {
	__uint(key_size, sizeof(__u32));
	__uint(value_size, sizeof(struct bpf_perf_event_value));
	__uint(max_entries, 1);
} accum_readings SEC(".maps");

const volatile __u32 num_cpu = 1;

int BPF_PROG(fentry_XXX)
	__u32 key = bpf_get_smp_processor_id();
	struct bpf_perf_event_value *ptr;
	__u32 zero = 0;
	long err;

	/* look up before reading, to reduce error */
	ptr = bpf_map_lookup_elem(&fentry_readings, &zero);
	if (!ptr)
		return 0;

	err = bpf_perf_event_read_value(&events, key, ptr, sizeof(*ptr));
	if (err)
		return 0;

	return 0;

static inline void
fexit_update_maps(struct bpf_perf_event_value *after)
	struct bpf_perf_event_value *before, diff, *accum;
	__u32 zero = 0;

	before = bpf_map_lookup_elem(&fentry_readings, &zero);
	/* only account samples with a valid fentry_reading */
	if (before && before->counter) {
		struct bpf_perf_event_value *accum;

		diff.counter = after->counter - before->counter;
		diff.enabled = after->enabled - before->enabled;
		diff.running = after->running - before->running;

		accum = bpf_map_lookup_elem(&accum_readings, &zero);
		if (accum) {
			accum->counter += diff.counter;
			accum->enabled += diff.enabled;
			accum->running += diff.running;

int BPF_PROG(fexit_XXX)
	struct bpf_perf_event_value reading;
	__u32 cpu = bpf_get_smp_processor_id();
	__u32 one = 1, zero = 0;
	int err;

	/* read all events before updating the maps, to reduce error */
	err = bpf_perf_event_read_value(&events, cpu, &reading, sizeof(reading));
	if (err)
		return 0;

	return 0;

char LICENSE[] SEC("license") = "Dual BSD/GPL";
[acme@...e perf]$

Powered by blists - more mailing lists