linux-kernel - [PATCH] perf test: Switch basic bpf filtering test to use syscall tracepoint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 23 Jan 2023 14:02:24 +0530
From:   "Naveen N. Rao" <naveen.n.rao@...ux.vnet.ibm.com>
To:     Arnaldo Carvalho de Melo <acme@...nel.org>
Cc:     Disha Goel <disgoel@...ux.vnet.ibm.com>,
        Kajol Jain <kjain@...ux.ibm.com>,
        <linux-perf-users@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <bpf@...r.kernel.org>
Subject: [PATCH] perf test: Switch basic bpf filtering test to use syscall tracepoint

BPF filtering tests can sometime fail. Running the test in verbose mode
shows the following:
  $ sudo perf test 42
  42: BPF filter                                                      :
  42.1: Basic BPF filtering                                           : FAILED!
  42.2: BPF pinning                                                   : Skip
  42.3: BPF prologue generation                                       : Skip
  $ perf --version
  perf version 4.18.0-425.3.1.el8.ppc64le
  $ sudo perf test -v 42
  42: BPF filter                                                      :
  42.1: Basic BPF filtering                                           :
  --- start ---
  test child forked, pid 711060
  ...
  bpf: config 'func=do_epoll_wait' is ok
  Looking at the vmlinux_path (8 entries long)
  Using /usr/lib/debug/lib/modules/4.18.0-425.3.1.el8.ppc64le/vmlinux for symbols
  Open Debuginfo file: /usr/lib/debug/.build-id/81/56f5a07f92ccb62c5600ba0e4aacfb5f3a7534.debug
  Try to find probe point from debuginfo.
  Matched function: do_epoll_wait [4ef8cb0]
  found inline addr: 0xc00000000061dbe4
  Probe point found: __se_compat_sys_epoll_pwait+196
  found inline addr: 0xc00000000061d9f4
  Probe point found: __se_sys_epoll_pwait+196
  found inline addr: 0xc00000000061d824
  Probe point found: __se_sys_epoll_wait+36
  Found 3 probe_trace_events.
  Opening /sys/kernel/tracing//kprobe_events write=1
  ...
  BPF filter result incorrect, expected 56, got 56 samples
  test child finished with -1
  ---- end ----
  BPF filter subtest 1: FAILED!

The statement above about the result being incorrect looks weird, and it
is due to that particular perf build missing commit 3e11300cdfd5f1
("perf test: Fix bpf test sample mismatch reporting"). In reality, due
to commit 4b04e0decd2518 ("perf test: Fix basic bpf filtering test"),
perf expects there to be 56*3 samples.

However, the number of samples we receive is going to be dependent on
where the probes are installed, which is dependent on where
do_epoll_wait gets inlined. On s390x, it looks like probes at all the
inlined locations are hit. But, that is not the case on ppc64le.

Fix this by switching the test to instead use the syscall tracepoint.
This ensures that we will only ever install a single event enabling us
to reliably determine the sample count.

Reported-by: Disha Goel <disgoel@...ux.vnet.ibm.com>
Signed-off-by: Naveen N. Rao <naveen.n.rao@...ux.vnet.ibm.com>
---
 tools/perf/tests/bpf-script-example.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/tests/bpf-script-example.c b/tools/perf/tests/bpf-script-example.c
index 7981c69ed1b456..b638cc99d5ae56 100644
--- a/tools/perf/tests/bpf-script-example.c
+++ b/tools/perf/tests/bpf-script-example.c
@@ -43,7 +43,7 @@ struct {
 	__type(value, int);
 } flip_table SEC(".maps");
 
-SEC("func=do_epoll_wait")
+SEC("syscalls:sys_enter_epoll_pwait")
 int bpf_func__SyS_epoll_pwait(void *ctx)
 {
 	int ind =0;

base-commit: 5670ebf54bd26482f57a094c53bdc562c106e0a9
-- 
2.39.1