linux-kernel - [PATCH v1 0/2] perf trace: Better -p support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240827092013.1596-1-howardchu95@gmail.com>
Date: Tue, 27 Aug 2024 17:20:11 +0800
From: Howard Chu <howardchu95@...il.com>
To: acme@...nel.org
Cc: namhyung@...nel.org,
	irogers@...gle.com,
	jolsa@...nel.org,
	adrian.hunter@...el.com,
	kan.liang@...ux.intel.com,
	linux-perf-users@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Howard Chu <howardchu95@...il.com>
Subject: [PATCH v1 0/2] perf trace: Better -p support

Currently we don't support only collecting data for certain pids in perf
trace. We either collect nothing or everything.

Another thing is when using -p, becausing it's a per-pid mmap,
bpf_perf_event_output will fail under current per-cpu only
configuration. But since I fixed the -p problem already in the perf
trace augmentation v3 patch series, this method will be an optimization
instead of an actually bug fix.

!! Note that this patch series should be applied on top of the perf
trace v3 patch series.

Before:
perf $ perf trace -e open -p 79768
         ? (         ):  ... [continued]: open())                                             = -1 ENOENT (No such file or directory)
         ? (         ):  ... [continued]: open())                                             = -1 ENOENT (No such file or directory)
         ? (         ):  ... [continued]: open())                                             = -1 ENOENT (No such file or directory)

After:
perf $ ./perf trace -e open -p 79768
     0.000 ( 0.019 ms): open(filename: "DINGZHEN", flags: WRONLY)                             = -1 ENOENT (No such file or directory)
  1000.187 ( 0.031 ms): open(filename: "DINGZHEN", flags: WRONLY)                             = -1 ENOENT (No such file or directory)
  2000.377 ( 0.019 ms): open(filename: "DINGZHEN", flags: WRONLY)                             = -1 ENOENT (No such file or directory)

Howard Chu (2):
  perf trace: Collect data only for certain pids
  perf trace: Use pid to index perf_event in BPF

 tools/perf/builtin-trace.c                    | 100 ++++++++++++++++--
 .../bpf_skel/augmented_raw_syscalls.bpf.c     |  54 ++++++++--
 tools/perf/util/evlist.c                      |   2 +-
 3 files changed, 135 insertions(+), 21 deletions(-)

-- 
2.46.0