linux-kernel - [RFC 00/12] perf record: Add event action support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241128133553.823722-1-yangjihong@bytedance.com>
Date: Thu, 28 Nov 2024 21:35:41 +0800
From: Yang Jihong <yangjihong@...edance.com>
To: peterz@...radead.org,
	mingo@...hat.com,
	acme@...nel.org,
	namhyung@...nel.org,
	mark.rutland@....com,
	alexander.shishkin@...ux.intel.com,
	jolsa@...nel.org,
	irogers@...gle.com,
	adrian.hunter@...el.com,
	kan.liang@...ux.intel.com,
	james.clark@....com,
	linux-perf-users@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: yangjihong@...edance.com
Subject: [RFC 00/12] perf record: Add event action support

In perf-record, when an event is triggered, default behavior is to
save sample data to perf.data. Sometimes, we may just want to do
some lightweight actions, such as printing a log.
    
Based on this requirement, add the --action option to the event to
specify the behavior when the event occurs.

This patchset uses bpf prog to attach to tracepoint event, and save sample
to bpf perf_event ringbuffer in handler. perf-tool read the data and run actions.

Currently only one call is supported, that is, print(),
and some commonly used builtin variables are also supported.

For example:

  # perf record -e sched:sched_switch --action 'print("[%03d][%llu]comm=%s, pid=%d, tid=%d\n", cpu, time, comm, pid, tid)' true
  [003][795464100275136]comm=perf, pid=141580, tid=141580
  [003][795464100278234]comm=swapper/3, pid=0, tid=0
  [003][795464100288984]comm=perf, pid=141580, tid=141580
  [003][795464100457865]comm=swapper/3, pid=0, tid=0
  [003][795464100485547]comm=perf, pid=141580, tid=141580
  [003][795464100491398]comm=kworker/u36:1, pid=139834, tid=139834
  [003][795464100493647]comm=perf, pid=141580, tid=141580
  [003][795464100494967]comm=kworker/u36:1, pid=139834, tid=139834
  [003][795464100498146]comm=perf, pid=141580, tid=141580
  ...

  # perf record -e cycles --action 'print("test\n");' true
  bpf record action only supports specifying for tracepoint tracer

  # perf record -e sched:sched_switch --action 'print("[%llu]comm=%s, cpu=%d, pid=%d, tid=%d\n", time, comm, cpu, pid)' true
  print() arguments number for format string mismatch: 5 expected, 4 provided
  parse action option failed

   Usage: perf record [<options>] [<command>]
      or: perf record [<options>] -- <command> [<options>]

          --action <action>
                            event action

  # perf record -e sched:sched_switch --action 'print("test\n");' true
  test
  test
  test
  test
  test
  test
  test
  test
  test
  test
  ...

This patchset implements simple features and can be extended as needed.

TODO LIST:
1. Support common operations such as logical operations and bit operations
2. Support other calls such as dumpstack(), count()
3. Support specify actions for kprobe events
4. For builds that disable bpf_skel, support real-time parsing of perf record mmap ringbuffer data (similar to perf top)
5. Link libllvm to support dynamic generation of bpf progs

Yang Jihong (12):
  perf record: Add event action support
  perf event action: Add parsing const expr support
  perf event action: Add parsing const integer expr support
  perf event action: Add parsing const string expr support
  perf event action: Add parsing call expr support
  perf event action: Add parsing print() call expr support
  perf event action: Add parsing builtin expr support
  perf event action: Add parsing builtin cpu expr support
  perf event action: Add parsing builtin pid expr support
  perf event action: Add parsing builtin tid expr support
  perf event action: Add parsing builtin comm expr support
  perf event action: Add parsing builtin time expr support

 tools/perf/Documentation/perf-record.txt     |   8 +
 tools/perf/Makefile.perf                     |   1 +
 tools/perf/builtin-record.c                  |  31 +
 tools/perf/util/Build                        |  18 +
 tools/perf/util/bpf_skel/bpf_record_action.h |  24 +
 tools/perf/util/bpf_skel/record_action.bpf.c | 151 ++++
 tools/perf/util/parse-action.c               | 729 +++++++++++++++++++
 tools/perf/util/parse-action.h               |  98 +++
 tools/perf/util/parse-action.l               | 190 +++++
 tools/perf/util/parse-action.y               | 156 ++++
 tools/perf/util/record_action.c              | 380 ++++++++++
 tools/perf/util/record_action.h              |  30 +
 12 files changed, 1816 insertions(+)
 create mode 100644 tools/perf/util/bpf_skel/bpf_record_action.h
 create mode 100644 tools/perf/util/bpf_skel/record_action.bpf.c
 create mode 100644 tools/perf/util/parse-action.c
 create mode 100644 tools/perf/util/parse-action.h
 create mode 100644 tools/perf/util/parse-action.l
 create mode 100644 tools/perf/util/parse-action.y
 create mode 100644 tools/perf/util/record_action.c
 create mode 100644 tools/perf/util/record_action.h

-- 
2.25.1