netdev - Re: [PATCH v9 perf,bpf 09/15] perf, bpf: save btf information as headers to perf.data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 15 Mar 2019 16:42:07 -0300
From:   Arnaldo Carvalho de Melo <arnaldo.melo@...il.com>
To:     Song Liu <songliubraving@...com>
Cc:     bpf@...r.kernel.org, Networking <netdev@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Kernel Team <Kernel-team@...com>,
        Peter Zijlstra <peterz@...radead.org>,
        Arnaldo Carvalho de Melo <acme@...hat.com>,
        Jiri Olsa <jolsa@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>, sdf@...ichev.me
Subject: Re: [PATCH v9 perf,bpf 09/15] perf, bpf: save btf information as
 headers to perf.data

Em Fri, Mar 15, 2019 at 04:26:10PM -0300, Arnaldo Carvalho de Melo escreveu:
> Em Fri, Mar 15, 2019 at 04:06:51PM -0300, Arnaldo Carvalho de Melo escreveu:
> > And yes, there are BPF programs with BTF information associated:
>  
> > [root@...co perf]# bpftool map dump pids_filtered
> > [{
> >         "key": 2592,
> >         "value": true
> >     },{
> >         "key": 20511,
> >         "value": true
> >     }
> > ]
> > [root@...co perf]#
>  
> > I.e. bpftool can find the BTF info and thus is able to show the
> > 'pids_filtered' map keys and values pretty printed, not just as hex raw
> > data.
>  
> > I'm trying to find out why 'bpftool map dump' finds the BTF info while
> > perf_event__synthesize_one_bpf_prog() doesn't.
> 
> Humm, the BTF info above is for BPF _maps_ not for _programs_, I think
> you haven't added BTF info for maps in the perf.data header, right?

And then the BPF program I was using to test this had BTF encoded from
DWARF by pahole, so only associated to BPF maps, not to BPF programs, as
soon as I regenerated that BPF .o with clang 9.0, I got the BTF info for
the BPF programs and all works as expected:

[root@...co perf]# clang --version
clang version 9.0.0 (https://git.llvm.org/git/clang.git/ 7906282d3afec5dfdc2b27943fd6c0309086c507) (https://git.llvm.org/git/llvm.git/ a1b5de1ff8ae8bc79dc8e86e1f82565229bd0500)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /opt/llvm/bin
[root@...co perf]# perf record -e /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c sleep 1
LLVM: dumping /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.023 MB perf.data ]
[root@...co perf]# file /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o
/home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o: ELF 64-bit LSB relocatable, eBPF, version 1 (SYSV), with debug_info, not stripped
[root@...co perf]# readelf -SW /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o | grep BTF
  [22] .BTF              PROGBITS        0000000000000000 000ede 000b0e 00      0   0  1
  [23] .BTF.ext          PROGBITS        0000000000000000 0019ec 0002a0 00      0   0  1
  [24] .rel.BTF.ext      REL             0000000000000000 002fa8 000270 10     30  23  8
[root@...co perf]# grep examples ~/.perfconfig
	add_events = /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o
[root@...co perf]# 
[root@...co perf]# perf trace -e recvmmsg

Then, while this runs, using that augmented_raw_syscalls.o BPF program
generated with clang 9.0 and with proper BTF for BPF programs and not
just for BPF maps:

[root@...co ~]# bpftool map dump pids_filtered
[{
        "key": 22459,
        "value": true
    },{
        "key": 2592,
        "value": true
    }
]
[root@...co ~]#

[root@...co ~]# perf record sleep 1
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.020 MB perf.data (7 samples) ]
[root@...co ~]# perf report --header-only | grep b[pt]f
# event : name = cycles:ppp, , id = { 1116204, 1116205, 1116206, 1116207, 1116208, 1116209, 1116210, 1116211 }, size = 112, { sample_period, sample_freq } = 4000, sample_type = IP|TID|TIME|PERIOD, read_format = ID, disabled = 1, inherit = 1, mmap = 1, comm = 1, freq = 1, enable_on_exec = 1, task = 1, precise_ip = 3, sample_id_all = 1, exclude_guest = 1, mmap2 = 1, comm_exec = 1, ksymbol = 1, bpf_event = 1
# bpf_prog_info of id 13
# bpf_prog_info of id 14
# bpf_prog_info of id 15
# bpf_prog_info of id 16
# bpf_prog_info of id 17
# bpf_prog_info of id 18
# bpf_prog_info of id 21
# bpf_prog_info of id 22
# bpf_prog_info of id 51
# bpf_prog_info of id 52
# btf info of id 8
[root@...co ~]#

Moving along the patch queue...

- Arnaldo