linux-kernel - [PATCH v1 0/7] perf auxtrace: Support AUX pause with BPF backend

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241215193436.275278-1-leo.yan@arm.com>
Date: Sun, 15 Dec 2024 19:34:29 +0000
From: Leo Yan <leo.yan@....com>
To: Arnaldo Carvalho de Melo <acme@...nel.org>,
	Adrian Hunter <adrian.hunter@...el.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Jiri Olsa <jolsa@...nel.org>,
	Ian Rogers <irogers@...gle.com>,
	James Clark <james.clark@...aro.org>,
	"Liang, Kan" <kan.liang@...ux.intel.com>,
	Alexei Starovoitov <ast@...nel.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	Andrii Nakryiko <andrii@...nel.org>,
	Martin KaFai Lau <martin.lau@...ux.dev>,
	Eduard Zingerman <eddyz87@...il.com>,
	Song Liu <song@...nel.org>,
	Yonghong Song <yonghong.song@...ux.dev>,
	John Fastabend <john.fastabend@...il.com>,
	KP Singh <kpsingh@...nel.org>,
	Stanislav Fomichev <sdf@...ichev.me>,
	Hao Luo <haoluo@...gle.com>,
	Matt Bobrowski <mattbobrowski@...gle.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Masami Hiramatsu <mhiramat@...nel.org>,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
	linux-kernel@...r.kernel.org,
	linux-perf-users@...r.kernel.org,
	bpf@...r.kernel.org,
	linux-trace-kernel@...r.kernel.org,
	Suzuki K Poulose <suzuki.poulose@....com>,
	Mike Leach <mike.leach@...aro.org>
Cc: Leo Yan <leo.yan@....com>
Subject: [PATCH v1 0/7] perf auxtrace: Support AUX pause with BPF backend

This series extends Perf's ability for fine-grained tracing by attaching
specific trace events to eBPF programs. As the first step, this series
supports kprobe, kretprobe, and tracepoints for dynamically pausing and
resuming AUX trace.

The first two patches expose a BPF API from kernel so the AUX pause and
resume can be invoked from a BPF kernel program.

Syncing UAPI headers between kernel and tools is finished in patch 03.

The main changes in the Perf tool for implementing eBPF skeleton
program, hooking BPF program in a perf record session, and attaching
trace events with BPF programs are finished in patches 04 ~ 06.

The patch 07 updates documentation for usage of the new introduced
option '--bpf-aux-pause'.

This series has been tested on TC platform with ETE / TRBE with
commands:

  perf record -e cs_etm/aux-action=start-paused/ \
  --bpf-aux-pause="kretprobe:__arm64_sys_openat:p,kprobe:__arm64_sys_openat:r,tp:sched:sched_switch:r" -a -- ls

  perf record -e cs_etm/aux-action=start-paused/ \
  --bpf-aux-pause="kretprobe:__arm64_sys_openat:p,kprobe:__arm64_sys_openat:r,tp:sched:sched_switch:r" -i -- ls

Note, as the AUX pause operation cannot be inherited by child tasks, it
requires to specify the '-i' option for default trace mode and
per-thread mode.


Leo Yan (7):
  perf/core: Make perf_event_aux_pause() as external function
  bpf: Add bpf_perf_event_aux_pause kfunc
  bpf: Sync bpf_perf_event_aux_pause in tools UAPI bpf.h
  perf: auxtrace: Introduce eBPF program for AUX pause
  perf: auxtrace: Support BPF backend for AUX pause
  perf record: Support AUX pause with BPF
  perf docs: Document AUX pause with BPF

 include/linux/perf_event.h                    |   1 +
 include/uapi/linux/bpf.h                      |  21 +
 kernel/bpf/verifier.c                         |   2 +
 kernel/events/core.c                          |   2 +-
 kernel/trace/bpf_trace.c                      |  52 +++
 tools/include/uapi/linux/bpf.h                |  21 +
 tools/perf/Documentation/perf-record.txt      |  40 ++
 tools/perf/Makefile.perf                      |   1 +
 tools/perf/builtin-record.c                   |  18 +-
 tools/perf/util/Build                         |   4 +
 tools/perf/util/auxtrace.h                    |  43 ++
 tools/perf/util/bpf_auxtrace_pause.c          | 385 ++++++++++++++++++
 tools/perf/util/bpf_skel/auxtrace_pause.bpf.c | 135 ++++++
 tools/perf/util/evsel.c                       |   6 +
 tools/perf/util/record.h                      |   1 +
 15 files changed, 730 insertions(+), 2 deletions(-)
 create mode 100644 tools/perf/util/bpf_auxtrace_pause.c
 create mode 100644 tools/perf/util/bpf_skel/auxtrace_pause.bpf.c

-- 
2.34.1