Re: [PATCH v2 bpf-next 1/4] tracing/probe: Add PERF_EVENT_IOC_QUERY_PROBE ioctl

From: Daniel Xu
Date: Mon Aug 12 2019 - 20:39:09 EST


On Mon, Aug 12, 2019, at 8:57 AM, Andrii Nakryiko wrote:
> On Fri, Aug 9, 2019 at 2:47 PM Daniel Xu <dxu@xxxxxxxxx> wrote:
> >
> > It's useful to know [uk]probe's nmissed and nhit stats. For example with
> > tracing tools, it's important to know when events may have been lost.
> > debugfs currently exposes a control file to get this information, but
> > it is not compatible with probes registered with the perf API.
> >
> > While bpf programs may be able to manually count nhit, there is no way
> > to gather nmissed. In other words, it is currently not possible to
> > retrieve information about FD-based probes.
> >
> > This patch adds a new ioctl that lets users query nmissed (as well as
> > nhit for completeness). We currently only add support for [uk]probes
> > but leave the possibility open for other probes like tracepoint.
> >
> > Signed-off-by: Daniel Xu <dxu@xxxxxxxxx>
> > ---
> > include/linux/trace_events.h | 12 ++++++++++++
> > include/uapi/linux/perf_event.h | 19 +++++++++++++++++++
> > kernel/events/core.c | 20 ++++++++++++++++++++
> > kernel/trace/trace_kprobe.c | 23 +++++++++++++++++++++++
> > kernel/trace/trace_uprobe.c | 23 +++++++++++++++++++++++
> > 5 files changed, 97 insertions(+)
> >
[...]
> > + struct trace_kprobe *tk = (struct trace_kprobe *)call->data;
> > + u64 nmissed, nhit;
> > +
> > + if (!capable(CAP_SYS_ADMIN))
> > + return -EPERM;
> > + if (copy_from_user(&query, uquery, sizeof(query)))
>
> what about forward/backward compatibility? Didn't you have a size
> field for perf_event_query_probe?

I initially did, yes. But after thinking about it more, I'm not convinced it
is necessary. It seems the last change to the debugfs counterpart was in
the initial comit cd7e7bd5e4, ~10 years ago. I cannot think of any other
information that would be useful off the top of my head, so I figured it'd
be best if we didn't make more complicated something that doesn't seem
likely to change. If we really needed something else, I figured adding
another ioctl is pretty cheap.

If you (or anyone) feels strongly about adding it back, I can make it a
u64 so there's no holes.

>
> > + return -EFAULT;
> > +
> > + nhit = trace_kprobe_nhit(tk);
> > + nmissed = tk->rp.kp.nmissed;
> > +
> > + if (put_user(nmissed, &uquery->nmissed) ||
> > + put_user(nhit, &uquery->nhit))
>
> Wouldn't it be nicer to just do one user put for entire struct (or at
> least relevant part of it with backward/forward compatibility?).

Not sure how that didn't occur to me. Thanks.