1. 03 9月, 2016 5 次提交
    • A
      samples/bpf: add perf_event+bpf example · 1c47910e
      Alexei Starovoitov 提交于
      The bpf program is called 50 times a second and does hashmap[kern&user_stackid]++
      It's primary purpose to check that key bpf helpers like map lookup, update,
      get_stackid, trace_printk and ctx access are all working.
      It checks:
      - PERF_COUNT_HW_CPU_CYCLES on all cpus
      - PERF_COUNT_HW_CPU_CYCLES for current process and inherited perf_events to children
      - PERF_COUNT_SW_CPU_CLOCK on all cpus
      - PERF_COUNT_SW_CPU_CLOCK for current process
      Signed-off-by: NAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1c47910e
    • A
      perf, bpf: add perf events core support for BPF_PROG_TYPE_PERF_EVENT programs · aa6a5f3c
      Alexei Starovoitov 提交于
      Allow attaching BPF_PROG_TYPE_PERF_EVENT programs to sw and hw perf events
      via overflow_handler mechanism.
      When program is attached the overflow_handlers become stacked.
      The program acts as a filter.
      Returning zero from the program means that the normal perf_event_output handler
      will not be called and sampling event won't be stored in the ring buffer.
      
      The overflow_handler_context==NULL is an additional safety check
      to make sure programs are not attached to hw breakpoints and watchdog
      in case other checks (that prevent that now anyway) get accidentally
      relaxed in the future.
      
      The program refcnt is incremented in case perf_events are inhereted
      when target task is forked.
      Similar to kprobe and tracepoint programs there is no ioctl to
      detach the program or swap already attached program. The user space
      expected to close(perf_event_fd) like it does right now for kprobe+bpf.
      That restriction simplifies the code quite a bit.
      
      The invocation of overflow_handler in __perf_event_overflow() is now
      done via READ_ONCE, since that pointer can be replaced when the program
      is attached while perf_event itself could have been active already.
      There is no need to do similar treatment for event->prog, since it's
      assigned only once before it's accessed.
      Signed-off-by: NAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      aa6a5f3c
    • A
      bpf: perf_event progs should only use preallocated maps · fdc15d38
      Alexei Starovoitov 提交于
      Make sure that BPF_PROG_TYPE_PERF_EVENT programs only use
      preallocated hash maps, since doing memory allocation
      in overflow_handler can crash depending on where nmi got triggered.
      Signed-off-by: NAlexei Starovoitov <ast@kernel.org>
      Acked-by: NDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fdc15d38
    • A
      bpf: introduce BPF_PROG_TYPE_PERF_EVENT program type · 0515e599
      Alexei Starovoitov 提交于
      Introduce BPF_PROG_TYPE_PERF_EVENT programs that can be attached to
      HW and SW perf events (PERF_TYPE_HARDWARE and PERF_TYPE_SOFTWARE
      correspondingly in uapi/linux/perf_event.h)
      
      The program visible context meta structure is
      struct bpf_perf_event_data {
          struct pt_regs regs;
           __u64 sample_period;
      };
      which is accessible directly from the program:
      int bpf_prog(struct bpf_perf_event_data *ctx)
      {
        ... ctx->sample_period ...
        ... ctx->regs.ip ...
      }
      
      The bpf verifier rewrites the accesses into kernel internal
      struct bpf_perf_event_data_kern which allows changing
      struct perf_sample_data without affecting bpf programs.
      New fields can be added to the end of struct bpf_perf_event_data
      in the future.
      Signed-off-by: NAlexei Starovoitov <ast@kernel.org>
      Acked-by: NDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      0515e599
    • A
      bpf: support 8-byte metafield access · ea2e7ce5
      Alexei Starovoitov 提交于
      The verifier supported only 4-byte metafields in
      struct __sk_buff and struct xdp_md. The metafields in upcoming
      struct bpf_perf_event are 8-byte to match register width in struct pt_regs.
      Teach verifier to recognize 8-byte metafield access.
      The patch doesn't affect safety of sockets and xdp programs.
      They check for 4-byte only ctx access before these conditions are hit.
      Signed-off-by: NAlexei Starovoitov <ast@kernel.org>
      Acked-by: NDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ea2e7ce5
  2. 02 9月, 2016 27 次提交
  3. 01 9月, 2016 8 次提交