perf bpf filter: Add uid and gid terms

Allow the BPF filter to use the uid and gid terms determined by the
bpf_get_current_uid_gid BPF helper. For example, the following will
record the cpu-clock event system wide discarding samples that don't
belong to the current user.

$ perf record -e cpu-clock --filter "uid == $(id -u)" -a sleep 0.1

Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: Changbin Du <changbin.du@huawei.com>
Cc: Yang Jihong <yangjihong1@huawei.com>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: bpf@vger.kernel.org
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Link: https://lore.kernel.org/r/20240524205227.244375-3-irogers@google.com

diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
index 77578c0a142a96eb914c1c08cf525a4e960f14e5..d6532ed97c02540dee5f9fdddec0959ae6cc9d5c 100644 (file)
--- a/tools/perf/Documentation/perf-record.txt
+++ b/tools/perf/Documentation/perf-record.txt
@@ -200,7 +200,7 @@ OPTIONS
          ip, id, tid, pid, cpu, time, addr, period, txn, weight, phys_addr,
          code_pgsz, data_pgsz, weight1, weight2, weight3, ins_lat, retire_lat,
          p_stage_cyc, mem_op, mem_lvl, mem_snoop, mem_remote, mem_lock,
-         mem_dtlb, mem_blk, mem_hops
+         mem_dtlb, mem_blk, mem_hops, uid, gid
 
        The <operator> can be one of:
          ==, !=, >, >=, <, <=, &

diff --git a/tools/perf/util/bpf-filter.c b/tools/perf/util/bpf-filter.c
index f10148623a8e4a67c2ee739e90b1aa14db7bf587..04f98b6bb291590058e418adceb0291a7394067a 100644 (file)
--- a/tools/perf/util/bpf-filter.c
+++ b/tools/perf/util/bpf-filter.c
@@ -63,6 +63,11 @@ static int check_sample_flags(struct evsel *evsel, struct perf_bpf_filter_expr *
            (evsel->core.attr.sample_type & (1 << (expr->term - PBF_TERM_SAMPLE_START))))
                return 0;
 
+       if (expr->term == PBF_TERM_UID || expr->term == PBF_TERM_GID) {
+               /* Not dependent on the sample_type as computed from a BPF helper. */
+               return 0;
+       }
+
        if (expr->op == PBF_OP_GROUP_BEGIN) {
                struct perf_bpf_filter_expr *group;
 

diff --git a/tools/perf/util/bpf-filter.l b/tools/perf/util/bpf-filter.l
index 62c959813466c185679353f8674d1acdb3d50c0b..2a7c839f3fae2b2236c34fbd532664ee6f788016 100644 (file)
--- a/tools/perf/util/bpf-filter.l
+++ b/tools/perf/util/bpf-filter.l
@@ -95,6 +95,8 @@ mem_lock      { return sample_part(PBF_TERM_DATA_SRC, 5); }
 mem_dtlb       { return sample_part(PBF_TERM_DATA_SRC, 6); }
 mem_blk                { return sample_part(PBF_TERM_DATA_SRC, 7); }
 mem_hops       { return sample_part(PBF_TERM_DATA_SRC, 8); }
+uid            { return sample(PBF_TERM_UID); }
+gid            { return sample(PBF_TERM_GID); }
 
 "=="           { return operator(PBF_OP_EQ); }
 "!="           { return operator(PBF_OP_NEQ); }

diff --git a/tools/perf/util/bpf_skel/sample-filter.h b/tools/perf/util/bpf_skel/sample-filter.h
index 25f78002295111233ad594e0ca43e93862832be8..350efa12102604386479b7b40a62a83a76377e8b 100644 (file)
--- a/tools/perf/util/bpf_skel/sample-filter.h
+++ b/tools/perf/util/bpf_skel/sample-filter.h
@@ -47,6 +47,9 @@ enum perf_bpf_filter_term {
        PBF_TERM_CODE_PAGE_SIZE = PBF_TERM_SAMPLE_START + 23, /* SAMPLE_CODE_PAGE_SIZE = 1U << 23 */
        PBF_TERM_WEIGHT_STRUCT  = PBF_TERM_SAMPLE_START + 24, /* SAMPLE_WEIGHT_STRUCT = 1U << 24 */
        PBF_TERM_SAMPLE_END     = PBF_TERM_WEIGHT_STRUCT,
+       /* Terms computed from BPF helpers. */
+       PBF_TERM_UID,
+       PBF_TERM_GID,
 };
 
 /* BPF map entry for filtering */

diff --git a/tools/perf/util/bpf_skel/sample_filter.bpf.c b/tools/perf/util/bpf_skel/sample_filter.bpf.c
index 5ac1778ff66eb2228e7fc81e8bda72b179ac5d14..f59985101973a9dac49b764cc8ac7eb3ce19956d 100644 (file)
--- a/tools/perf/util/bpf_skel/sample_filter.bpf.c
+++ b/tools/perf/util/bpf_skel/sample_filter.bpf.c
@@ -140,6 +140,10 @@ static inline __u64 perf_get_sample(struct bpf_perf_event_data_kern *kctx,
                }
                /* return the whole word */
                return kctx->data->data_src.val;
+       case PBF_TERM_UID:
+               return bpf_get_current_uid_gid() & 0xFFFFFFFF;
+       case PBF_TERM_GID:
+               return bpf_get_current_uid_gid() >> 32;
        case PBF_TERM_NONE:
        case __PBF_UNUSED_TERM4:
        case __PBF_UNUSED_TERM5: