linux-kernel - Re: event filtering with trace-cmd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 12 Jun 2013 13:16:25 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Arend van Spriel <arend@...adcom.com>
Cc:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Tom Zanussi <tom.zanussi@...el.com>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
Subject: Re: event filtering with trace-cmd

On Wed, 2013-06-12 at 12:22 -0400, Steven Rostedt wrote:

> > # sudo trace-cmd record -e brcmfmac:brcmf_dbg -f 'level & 0x40000'
> > disable all
> > enable brcmfmac:brcmf_dbg
> > path = /sys/kernel/debug/tracing/events/brcmfmac/brcmf_dbg/enable
> > (level & 0x40000)
> > ^
> > parse_error: Invalid operator
> > 
> 
> The record -f command passes the filter into the kernel
> file /sys/kerne/debug/tracing/events/brcmfmac/brcmf_dbg/filter, and the
> error is actually coming from the kernel itself. Looking at the code, we
> do not currently accept binary operations. Although, it shouldn't be too
> hard to add. I may go and implement it for 3.11.
> 

Here, can you apply this patch and see if it does what you expect?

Thanks,

-- Steve

diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index e1b653f..111eddf 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -35,6 +35,7 @@
 
 enum filter_op_ids
 {
+	OP_BAND,
 	OP_OR,
 	OP_AND,
 	OP_GLOB,
@@ -64,6 +65,7 @@ static struct filter_op filter_ops[] = {
 	{ OP_LE,	"<=",		5 },
 	{ OP_GT,	">",		5 },
 	{ OP_GE,	">=",		5 },
+	{ OP_BAND,	"&",		6 },
 	{ OP_NONE,	"OP_NONE",	0 },
 	{ OP_OPEN_PAREN, "(",		0 },
 };
@@ -156,6 +158,9 @@ static int filter_pred_##type(struct filter_pred *pred, void *event)	\
 	case OP_GE:							\
 		match = (*addr >= val);					\
 		break;							\
+	case OP_BAND:							\
+		match = (*addr & val);					\
+		break;							\
 	default:							\
 		break;							\
 	}								\


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/