linux-kernel - Re: [PATCH v3 1/8] perf bpf-filter: Make filters map a single entry hashmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZqFiC4z_EZtsB4Su@google.com>
Date: Wed, 24 Jul 2024 13:20:27 -0700
From: Namhyung Kim <namhyung@...nel.org>
To: Arnaldo Carvalho de Melo <acme@...nel.org>
Cc: Ian Rogers <irogers@...gle.com>, Kan Liang <kan.liang@...ux.intel.com>,
	Jiri Olsa <jolsa@...nel.org>,
	Adrian Hunter <adrian.hunter@...el.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...nel.org>, LKML <linux-kernel@...r.kernel.org>,
	linux-perf-users@...r.kernel.org, KP Singh <kpsingh@...nel.org>,
	Song Liu <song@...nel.org>, bpf@...r.kernel.org,
	Stephane Eranian <eranian@...gle.com>
Subject: Re: [PATCH v3 1/8] perf bpf-filter: Make filters map a single entry
 hashmap

On Wed, Jul 24, 2024 at 04:32:16PM -0300, Arnaldo Carvalho de Melo wrote:
> On Wed, Jul 03, 2024 at 03:30:28PM -0700, Namhyung Kim wrote:
> > And the value is now an array.  This is to support multiple filter
> > entries in the map later.
> > 
> > No functional changes intended.
> 
> Hey how can we test this feature these days?

There's a 'perf record sample filtering (by BPF) tests'.

  $ ./perf test -vv filtering
   95: perf record sample filtering (by BPF) tests:
  --- start ---
  test child forked, pid 1042594
  Checking BPF-filter privilege
  try 'sudo perf record --setup-filter pin' first.
  bpf-filter test [Skipped permission]
  ---- end(-2) ----
   95: perf record sample filtering (by BPF) tests                     : Skip

> 
> With this first patch applied:
> 
> root@...ber:~# perf record -a -W -e cycles:p --filter 'period > 100 || weight > 0' sleep 1
> Error: cpu_atom/cycles/p event does not have PERF_SAMPLE_WEIGHT
>  Hint: please add -W option to perf record
> failed to set filter "BPF" on event cpu_atom/cycles/p with 95 (Operation not supported)
> root@...ber:~# perf record -a -W -e cpu_core/cycles/p --filter 'period > 100 || weight > 0' sleep 1
> Error: cpu_core/cycles/p event does not have PERF_SAMPLE_WEIGHT
>  Hint: please add -W option to perf record
> failed to set filter "BPF" on event cpu_core/cycles/p with 95 (Operation not supported)
> root@...ber:~# perf record -a -W -e cpu_atom/cycles/p --filter 'period > 100 || weight > 0' sleep 1
> Error: cpu_atom/cycles/p event does not have PERF_SAMPLE_WEIGHT
>  Hint: please add -W option to perf record
> failed to set filter "BPF" on event cpu_atom/cycles/p with 95 (Operation not supported)
> root@...ber:~#

Do you say it's failing after the first patch?  It looks like the atom
CPU doesn't support PERF_SAMPLE_WEIGHT and should fail already.

The above test doesn't check the weight field FYI.

> 
> Interesting, it is taking a long time on the BPF prog load:
> 
> bpf(BPF_MAP_UPDATE_ELEM, {map_fd=49, key=0x7ffcc85a545c, value=0x7fee34bc2000, flags=BPF_ANY}, 32) = 0
> bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_PERF_EVENT, insn_cnt=335, insns=0xd1e6480, license="Dual BSD/GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(6, 9, 9), prog_flags=0, prog_name="perf_sample_fil", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=50, func_info_rec_size=8, func_info=0xd1b9c80, func_info_cnt=1, line_info_rec_size=16, line_info=0xd1e5300, line_info_cnt=135, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148^Cstrace: Process 2110180 detached
>  <detached ...>
> 
> <HERE it takes an unusual time, even returning after I cancelled the strace session>
> 
> root@...ber:~# 
> root@...ber:~# Error: cpu_atom/cycles/p event does not have PERF_SAMPLE_WEIGHT
>  Hint: please add -W option to perf record
> failed to set filter "BPF" on event cpu_atom/cycles/p with 11 (Resource temporarily unavailable)
> 
> root@...ber:~#
> 
> 
> root@...ber:~# uname -a
> Linux number 6.9.9-100.fc39.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jul 11 19:26:10 UTC 2024 x86_64 GNU/Linux
> root@...ber:~#
> 
> root@...ber:~# perf -v
> perf version 6.10.g5510fb5c79e9
> root@...ber:~# 
> 
> ⬢[acme@...lbox perf-tools-next]$ git log --oneline -10
> 5510fb5c79e9f500 (HEAD -> perf-tools-next) perf annotate: Set instruction name to be used with insn-stat when using raw instruction
> b35a86e53eb496ea perf annotate: Add support to use libcapstone in powerpc
> f2dc60d11290d53e perf annotate: Use capstone_init and remove open_capstone_handle from disasm.c
> c5bcba602eeee554 perf annotate: Make capstone_init non-static so that it can be used during symbol disassemble
> eef369c562510092 perf annotate: Update instruction tracking for powerpc
> 282701f1d77a3bdb perf annotate: Add more instructions for instruction tracking
> 758ee468ce5721e4 perf annotate: Add some of the arithmetic instructions to support instruction tracking in powerpc
> e8e7c1b6a9572bab perf annotate: Add support to identify memory instructions of opcode 31 in powerpc
> 3b3a0f04c1c6cd10 perf annotate: Add parse function for memory instructions in powerpc
> a159d2acd44e707f perf annotate: Update parameters for reg extract functions to use raw instruction on powerpc
> ⬢[acme@...lbox perf-tools-next]$ 
> 
> Ideas?

I don't know.. is it changed with this patch?

Thanks,
Namhyung