linux-kernel - Re: [PATCH v2] tracing/filters: Improve subsystem filter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 21 Jul 2009 09:25:27 +0800
From:	Li Zefan <lizf@...fujitsu.com>
To:	Steven Rostedt <rostedt@...dmis.org>
CC:	Frederic Weisbecker <fweisbec@...il.com>,
	Ingo Molnar <mingo@...e.hu>, Tom Zanussi <tzanussi@...il.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] tracing/filters: Improve subsystem filter

Steven Rostedt wrote:
> On Mon, 20 Jul 2009, Steven Rostedt wrote:
> 
>>
>> On Mon, 20 Jul 2009, Li Zefan wrote:
>>
>>> Currently a subsystem filter should be applicable to all events
>>> under the subsystem, and if it failed, all the event filters
>>> will be cleared. Those behaviors make subsys filter much less
>>> useful:
>>>
>>>   # echo 'vec == 1' > irq/softirq_entry/filter
>>>   # echo 'irq == 5' > irq/filter
>>>   bash: echo: write error: Invalid argument
>>>   # cat irq/softirq_entry/filter
>>>   none
>>>
>>> I'd expect it set the filter for irq_handler_entry/exit, and
>>> not touch softirq_entry/exit.
>>>
>>> The basic idea is, try to see if the filter can be applied
>>> to which events, and then just apply to the those events:
>>>
>>>   # echo 'vec == 1' > softirq_entry/filter
>>>   # echo 'irq == 5' > filter
>>>   # cat irq_handler_entry/filter
>>>   irq == 5
>>>   # cat softirq_entry/filter
>>>   vec == 1
> 
> OK, I tried this and it worked as you described, but it also does 
> something that I did not like. Basically this:
> 
> # echo 'vec == 1' > filter
> # cat softirq_entry/filter
>  vec == 1
> # cat irq_handler_entry/filter
>  none
> # cat filter
>  vec == 1
> # echo 'irq == 5' > filter
> # cat irq_handler_entry/filter
>  irq == 5
> # cat softirq_entry/filter
>  vec == 1
> # cat filter
>  irq == 5
> 
> 
> That last "cat filter" should show:
>  vec == 1
>  irq == 5
> 

But I did not change the read semantic. For example, when
subsystem filter is not set at all:

 # echo 'irq == 5' > irq_handler_entry/filter
 # echo 'vec == 1' > softirq_entry/filter
 # cat filter
 none

It'll show "none".

> I can keep this version, since I do find it useful (I've now come to the 
> conclusion that having the filter work only for those filters that it 
> would work for is fine). But the top level filter should show all filters.
> 

As I said in an old mail, I think the subsystem filter is much more
useful in "write" than in "read".

I have no strong option about its read semantic, but I can do what
you like.

Suppose:
  irq_handler_entry/filter ->  irq == 5
  irq_handler_exit/filter  ->  none
  softirq_entry/filter     ->  vec == 1
  softirq_exit/filter      ->  vec == 2

Proposal 1:

  # cat filter
  irq == 5
  vec == 1
  vec == 2

Proposal 2:

  # cat filter
  irq_handler_entry: irq == 5
  irq_handler_exit: none
  softirq_entry: vec == 1
  softirq_exit: vec == 2

Which do you think is better? Or do you have some better idea?

And in the failure case:

  # echo 'irq == not_num' > filter
  bash: echo: write error: Invalid argument

1:
  # cat filter
  (still shows filters in each event like above)

or shows error message (the current behavior)

2:
  # cat filter
  irq == not_num
  ^
  parse_error: Couldn't find or set field in one of a subsystem's events

?

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/