linux-kernel - [PATCH bpf-next 0/3] bpf: Add bpf_perf_event_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221101052340.1210239-1-namhyung@kernel.org>
Date:   Mon, 31 Oct 2022 22:23:37 -0700
From:   Namhyung Kim <namhyung@...nel.org>
To:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Song Liu <songliubraving@...com>,
        Peter Zijlstra <peterz@...radead.org>
Cc:     Martin KaFai Lau <kafai@...com>, Yonghong Song <yhs@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...nel.org>, Hao Luo <haoluo@...gle.com>,
        Stanislav Fomichev <sdf@...gle.com>,
        LKML <linux-kernel@...r.kernel.org>, bpf@...r.kernel.org,
        Jiri Olsa <jolsa@...nel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Ingo Molnar <mingo@...nel.org>,
        Arnaldo Carvalho de Melo <acme@...nel.org>
Subject: [PATCH bpf-next 0/3] bpf: Add bpf_perf_event_read_sample() helper (v1)

Hello,

I'd like to add bpf_perf_event_read_sample() helper to get the sample data
of an perf_event from BPF programs.  This enables more sophistigated filtering
for the perf samples.  Initially I'm thinking of code and data address based
filtering.

The original discussion can be seen here:
  https://lore.kernel.org/r/20220823210354.1407473-1-namhyung@kernel.org

The bpf_perf_event_read_sample() will take a buffer and size to save the data
as well as a flag to specify perf sample type.  The flag argument should have
a single value in the enum perf_event_sample_format like PERF_SAMPLE_IP.  If
the buffer is NULL, it will return the size of data instead.  This is to
support variable length data in the future.

The first patch adds bpf_prepare_sample() to setup necessary perf sample data
before calling the bpf overflow handler for the perf event.  The existing
logic for callchain moved to the function and it sets IP and ADDR data if
they are not set already.

The second patch actually adds the bpf_perf_event_read_sample() helper and
supports IP and ADDR data.  The last patch adds a test code for this.

The code is available at 'bpf/perf-sample-v1' branch in

  git://git.kernel.org/pub/scm/linux/kernel/git/namhyung/linux-perf.git

Thanks,
Namhyung

Namhyung Kim (3):
  perf/core: Prepare sample data before calling BPF
  bpf: Add bpf_perf_event_read_sample() helper
  bpf: Add perf_event_read_sample test cases

 include/uapi/linux/bpf.h                      |  23 +++
 kernel/events/core.c                          |  40 +++-
 kernel/trace/bpf_trace.c                      |  49 +++++
 tools/include/uapi/linux/bpf.h                |  23 +++
 .../selftests/bpf/prog_tests/perf_sample.c    | 172 ++++++++++++++++++
 .../selftests/bpf/progs/test_perf_sample.c    |  28 +++
 6 files changed, 326 insertions(+), 9 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/perf_sample.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_perf_sample.c

base-commit: e39e739ab57399f46167d453bbdb8ef8d57c6488
-- 
2.38.1.273.g43a17bfeac-goog