linux-kernel - Re: perf probe and structs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 13 Jun 2015 10:38:14 +0900
From:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
To:	Arnaldo Carvalho de Melo <acme@...nel.org>,
	Alexei Starovoitov <ast@...mgrid.com>
CC:	David Ahern <dsahern@...il.com>, Jiri Olsa <jolsa@...hat.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Ingo Molnar <mingo@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: perf probe and structs

On 2015/06/13 4:27, Arnaldo Carvalho de Melo wrote:
> Hi Masami,
> 
> 	I tried somethig with perf probe today, namely to ask for a
> variable that is a struct perf_event_attr to be collected after
> the perf_event_open syscall copies it from userspace, and got this
> message:
> 
> [root@zoo ~]# perf probe SYSC_perf_event_open:23 args
> Failed to find 'args' in this function.
>   Error: Failed to add events.
> [root@zoo ~]#
> 
> Ok, I guess it should be instead:
> 
> [root@zoo ~]# perf probe SYSC_perf_event_open:23 args
> The 'args' variable is a struct, this is not supported yet.
>   Error: Failed to add events.
> [root@zoo ~]#
> 
> :-)

Hmm, I need to look into it. BTW, could you tried to run
`perf probe --vars SYSC_perf_event_open:23` ?


> 
> That said, can't we just go ahead and collect sizeof(args) into the
> buffer and let userspace cast the result to the right type, etc, i.e.
> kinda like what is done now for a string.

I'd like to add dump data struct feature instead of dumping binary.
Or, at least suggesting which field you can specify :)

Thank you,


> 
> Alexei, is this already possible with eBPF?
> 
> This is all in the context of:
> 
>   [root@zoo ~]# perf trace -e perf_event_open &
>   [1] 20775
>   [root@zoo ~]# perf stat -e cycles usleep 1
>     7304.425 ( 0.519 ms): perf/20776 perf_event_open(attr_uptr: 0x222b220, pid: 20777, cpu: -1, group_fd: -1, flags: FD_CLOEXEC) = 3
> 
>    Performance counter stats for 'usleep 1':
> 
>          2,024,026      cycles                                                      
> 
>        0.005277428 seconds time elapsed
> 
>   [root@zoo ~]#
> 
> I want to decode that attr_uptr thing :-)
> 
> - Arnaldo
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 


-- 
Masami HIRAMATSU
Linux Technology Research Center, System Productivity Research Dept.
Center for Technology Innovation - Systems Engineering
Hitachi, Ltd., Research & Development Group
E-mail: masami.hiramatsu.pt@...achi.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/