linux-kernel - Re: [RFC 00/12] perf record: Add event action support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Z0jPPRA8JXSrwyaC@x1>
Date: Thu, 28 Nov 2024 17:14:53 -0300
From: Arnaldo Carvalho de Melo <acme@...nel.org>
To: Yang Jihong <yangjihong@...edance.com>
Cc: peterz@...radead.org, mingo@...hat.com, namhyung@...nel.org,
	mark.rutland@....com, alexander.shishkin@...ux.intel.com,
	jolsa@...nel.org, irogers@...gle.com, adrian.hunter@...el.com,
	kan.liang@...ux.intel.com, james.clark@....com,
	linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [RFC 00/12] perf record: Add event action support

On Thu, Nov 28, 2024 at 09:35:41PM +0800, Yang Jihong wrote:
> In perf-record, when an event is triggered, default behavior is to
> save sample data to perf.data. Sometimes, we may just want to do
> some lightweight actions, such as printing a log.

> Based on this requirement, add the --action option to the event to
> specify the behavior when the event occurs.

'perf record' is centered on saving data to disk without processing
events, while it has sideband events for some needs, like processing BPF
related events (PERF_RECORD_BPF_EVENT to catch PERF_BPF_EVENT_PROG_LOAD
and UNLOAD), doing things in a "live" way as your patchkit does seems
more appropriate to do in 'perf trace' :-)

I'll take a look at the rest of the patch series.

- Arnaldo
 
> This patchset uses bpf prog to attach to tracepoint event, and save sample
> to bpf perf_event ringbuffer in handler. perf-tool read the data and run actions.
> 
> Currently only one call is supported, that is, print(),
> and some commonly used builtin variables are also supported.
> 
> For example:
> 
>   # perf record -e sched:sched_switch --action 'print("[%03d][%llu]comm=%s, pid=%d, tid=%d\n", cpu, time, comm, pid, tid)' true
>   [003][795464100275136]comm=perf, pid=141580, tid=141580
>   [003][795464100278234]comm=swapper/3, pid=0, tid=0
>   [003][795464100288984]comm=perf, pid=141580, tid=141580
>   [003][795464100457865]comm=swapper/3, pid=0, tid=0
>   [003][795464100485547]comm=perf, pid=141580, tid=141580
>   [003][795464100491398]comm=kworker/u36:1, pid=139834, tid=139834
>   [003][795464100493647]comm=perf, pid=141580, tid=141580
>   [003][795464100494967]comm=kworker/u36:1, pid=139834, tid=139834
>   [003][795464100498146]comm=perf, pid=141580, tid=141580
>   ...
> 
>   # perf record -e cycles --action 'print("test\n");' true
>   bpf record action only supports specifying for tracepoint tracer
> 
>   # perf record -e sched:sched_switch --action 'print("[%llu]comm=%s, cpu=%d, pid=%d, tid=%d\n", time, comm, cpu, pid)' true
>   print() arguments number for format string mismatch: 5 expected, 4 provided
>   parse action option failed
> 
>    Usage: perf record [<options>] [<command>]
>       or: perf record [<options>] -- <command> [<options>]
> 
>           --action <action>
>                             event action
> 
>   # perf record -e sched:sched_switch --action 'print("test\n");' true
>   test
>   test
>   test
>   test
>   test
>   test
>   test
>   test
>   test
>   test
>   ...
> 
> This patchset implements simple features and can be extended as needed.
> 
> TODO LIST:
> 1. Support common operations such as logical operations and bit operations
> 2. Support other calls such as dumpstack(), count()
> 3. Support specify actions for kprobe events
> 4. For builds that disable bpf_skel, support real-time parsing of perf record mmap ringbuffer data (similar to perf top)
> 5. Link libllvm to support dynamic generation of bpf progs
> 
> Yang Jihong (12):
>   perf record: Add event action support
>   perf event action: Add parsing const expr support
>   perf event action: Add parsing const integer expr support
>   perf event action: Add parsing const string expr support
>   perf event action: Add parsing call expr support
>   perf event action: Add parsing print() call expr support
>   perf event action: Add parsing builtin expr support
>   perf event action: Add parsing builtin cpu expr support
>   perf event action: Add parsing builtin pid expr support
>   perf event action: Add parsing builtin tid expr support
>   perf event action: Add parsing builtin comm expr support
>   perf event action: Add parsing builtin time expr support
> 
>  tools/perf/Documentation/perf-record.txt     |   8 +
>  tools/perf/Makefile.perf                     |   1 +
>  tools/perf/builtin-record.c                  |  31 +
>  tools/perf/util/Build                        |  18 +
>  tools/perf/util/bpf_skel/bpf_record_action.h |  24 +
>  tools/perf/util/bpf_skel/record_action.bpf.c | 151 ++++
>  tools/perf/util/parse-action.c               | 729 +++++++++++++++++++
>  tools/perf/util/parse-action.h               |  98 +++
>  tools/perf/util/parse-action.l               | 190 +++++
>  tools/perf/util/parse-action.y               | 156 ++++
>  tools/perf/util/record_action.c              | 380 ++++++++++
>  tools/perf/util/record_action.h              |  30 +
>  12 files changed, 1816 insertions(+)
>  create mode 100644 tools/perf/util/bpf_skel/bpf_record_action.h
>  create mode 100644 tools/perf/util/bpf_skel/record_action.bpf.c
>  create mode 100644 tools/perf/util/parse-action.c
>  create mode 100644 tools/perf/util/parse-action.h
>  create mode 100644 tools/perf/util/parse-action.l
>  create mode 100644 tools/perf/util/parse-action.y
>  create mode 100644 tools/perf/util/record_action.c
>  create mode 100644 tools/perf/util/record_action.h
> 
> -- 
> 2.25.1