linux-kernel - Using perf_event_open() to sample multiple events of a process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 4 Nov 2021 22:57:50 -0700
From:   Nadav Amit <nadav.amit@...il.com>
To:     kan.liang@...ux.intel.com, Peter Zijlstra <peterz@...radead.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        linux-perf-users@...r.kernel.org
Subject: Using perf_event_open() to sample multiple events of a process

Hello Ken, Peter,

I would appreciate some help regarding the use of perf_event_open()
to have multiple samples getting into the same mmap’d memory when they
are both attached to the same process.

I am doing so (using both PERF_FLAG_FD_NO_GROUP and PERF_FLAG_FD_OUTPUT),
but it results in -EINVAL. Debugging the code shows that
perf_event_set_output() fails due to the following check:

        /*
         * If its not a per-cpu rb, it must be the same task.
         */
        if (output_event->cpu == -1 && output_event->ctx != event->ctx)
                goto out;

However, it appears that at this point, event->ctx is not initialized
(it is null) so the test fails and the whole perf_event_open() syscall
fails.

Am I missing something? If not, I am unsure, unfortunately, what the
proper way to fix it is…

I include a small test that fails on my system. The second
perf_event_open fails due to the check in perf_event_set_output():




#define _GNU_SOURCE 1

#include <asm/unistd.h>
#include <linux/perf_event.h>
#include <linux/hw_breakpoint.h>
#include <sys/mman.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>

long perf_event_open(struct perf_event_attr* event_attr, pid_t pid, int cpu,
		     int group_fd, unsigned long flags)
{
    return syscall(__NR_perf_event_open, event_attr, pid, cpu, group_fd, flags);
}

int main(void)
{
	pid_t pid = getpid();
	int group_fd, fd;
	void *p;
	struct perf_event_attr pe = {
		.type = 4,
		.size = sizeof(struct perf_event_attr),
		.config = 0x11d0,
		.sample_type = 0x8,
		.sample_period = 1000,
		.precise_ip = 2,
	};

	group_fd = perf_event_open(&pe, pid, -1, -1, PERF_FLAG_FD_CLOEXEC | 
						     PERF_FLAG_FD_NO_GROUP |
						     PERF_FLAG_FD_OUTPUT);

	if (group_fd < 0) {
		perror("first perf_event_open");
		exit(-1);
	}

	p = mmap(NULL, 3 * 4096, PROT_READ|PROT_WRITE, MAP_SHARED, group_fd, 0);

	if (p == MAP_FAILED) {
		perror("MAP_FAILED");
		exit(-1);
	}
	
	pe.config = 0x12d0;
	
	fd = perf_event_open(&pe, pid, -1, group_fd, PERF_FLAG_FD_CLOEXEC | 
						     PERF_FLAG_FD_NO_GROUP |
						     PERF_FLAG_FD_OUTPUT);

	if (fd < 0) {
		perror("second perf_event_open");
		exit(-1);
	}

	printf("success\n");
}