linux-kernel - Re: [RFC/PATCHSET 0/8] perf record: Use a pinned BPF program for filter (v2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 21 Jun 2024 15:34:43 -0700
From: Namhyung Kim <namhyung@...nel.org>
To: Arnaldo Carvalho de Melo <acme@...nel.org>, Ian Rogers <irogers@...gle.com>, 
	Kan Liang <kan.liang@...ux.intel.com>
Cc: Jiri Olsa <jolsa@...nel.org>, Adrian Hunter <adrian.hunter@...el.com>, 
	Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...nel.org>, 
	LKML <linux-kernel@...r.kernel.org>, linux-perf-users@...r.kernel.org, 
	KP Singh <kpsingh@...nel.org>, Song Liu <song@...nel.org>, 
	Stephane Eranian <eranian@...gle.com>, bpf <bpf@...r.kernel.org>
Subject: Re: [RFC/PATCHSET 0/8] perf record: Use a pinned BPF program for
 filter (v2)

Ugh, forgot to CC bpf list/folks.. ;-p



On Fri, Jun 21, 2024 at 3:25 PM Namhyung Kim <namhyung@...nel.org> wrote:
>
> Hello,
>
> This is to support the unprivileged BPF filter for profiling per-task events.
> Until now only root (or any user with CAP_BPF) can use the filter and we
> cannot add a new unprivileged BPF program types.  After talking with the BPF
> folks at LSF/MM/BPF 2024, I was told that this is the way to go.  Finally I
> managed to make it working with pinned BPF objects. :)
>
> v2 changes)
>  * rebased onto Ian's UID/GID (non-sample data based) filter term change
>  * support separate lost counts for each use case
>  * update the test case to allow normal users (if supported)
>
>
> This only supports the per-task mode for normal users and root still uses
> its own instance of the same BPF program - not shared with other users.
> But it requires the one-time setup (by root) before using it by normal users
> like below.
>
>   $ sudo perf record --setup-filter pin
>
> This will load the BPF program and maps and pin them in the BPF-fs.  Then
> normal users can use the filter.
>
>   $ perf record -o- -e cycles:u --filter 'period < 10000' perf test -w noploop | perf script -i-
>   [ perf record: Woken up 1 times to write data ]
>   [ perf record: Captured and wrote 0.011 MB - ]
>         perf  759982 448227.214189:          1 cycles:u:      7f153719f4d0 _start+0x0 (/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2)
>         perf  759982 448227.214195:          1 cycles:u:      7f153719f4d0 _start+0x0 (/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2)
>         perf  759982 448227.214196:          7 cycles:u:      7f153719f4d0 _start+0x0 (/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2)
>         perf  759982 448227.214196:        223 cycles:u:      7f153719f4d0 _start+0x0 (/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2)
>         perf  759982 448227.214198:       9475 cycles:u:  ffffffff8ee012a0 [unknown] ([unknown])
>         perf  759982 448227.548608:          1 cycles:u:      559a9f03c81c noploop+0x5c (/home/namhyung/linux/tools/perf/perf)
>         perf  759982 448227.548611:          1 cycles:u:      559a9f03c81c noploop+0x5c (/home/namhyung/linux/tools/perf/perf)
>         perf  759982 448227.548612:         12 cycles:u:      559a9f03c81c noploop+0x5c (/home/namhyung/linux/tools/perf/perf)
>         perf  759982 448227.548613:        466 cycles:u:      559a9f03c81c noploop+0x5c (/home/namhyung/linux/tools/perf/perf)
>
> It's also possible to unload (and unpin, of course) using this command:
>
>   $ sudo perf record --setup-filter unpin
>
> The code is avaiable in 'perf/pinned-filter-v2' branch at
>
>   git://git.kernel.org/pub/scm/linux/kernel/git/namhyung/linux-perf.git
>
> Thanks,
> Namhyung
>
>
> Namhyung Kim (8):
>   perf bpf-filter: Make filters map a single entry hashmap
>   perf bpf-filter: Pass 'target' to perf_bpf_filter__prepare()
>   perf bpf-filter: Split per-task filter use case
>   perf bpf-filter: Support pin/unpin BPF object
>   perf bpf-filter: Support separate lost counts for each filter
>   perf record: Fix a potential error handling issue
>   perf record: Add --setup-filter option
>   perf test: Update sample filtering test
>
>  tools/perf/Documentation/perf-record.txt     |   5 +
>  tools/perf/builtin-record.c                  |  23 +-
>  tools/perf/builtin-stat.c                    |   2 +-
>  tools/perf/builtin-top.c                     |   2 +-
>  tools/perf/builtin-trace.c                   |   2 +-
>  tools/perf/tests/shell/record_bpf_filter.sh  |  13 +-
>  tools/perf/util/bpf-filter.c                 | 406 +++++++++++++++++--
>  tools/perf/util/bpf-filter.h                 |  19 +-
>  tools/perf/util/bpf_skel/sample-filter.h     |   2 +
>  tools/perf/util/bpf_skel/sample_filter.bpf.c |  75 +++-
>  tools/perf/util/evlist.c                     |   5 +-
>  tools/perf/util/evlist.h                     |   4 +-
>  tools/perf/util/python.c                     |   3 +-
>  13 files changed, 485 insertions(+), 76 deletions(-)
>
> --
> 2.45.2.741.gdbec12cfda-goog
>
>