linux-kernel - Re: perf probe and structs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sun, 14 Jun 2015 21:18:13 +0900
From:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
To:	Arnaldo Carvalho de Melo <acme@...nel.org>,
	Alexei Starovoitov <ast@...mgrid.com>
CC:	David Ahern <dsahern@...il.com>, Jiri Olsa <jolsa@...hat.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Ingo Molnar <mingo@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: perf probe and structs

On 2015/06/13 4:27, Arnaldo Carvalho de Melo wrote:
> Hi Masami,
> 
> 	I tried somethig with perf probe today, namely to ask for a
> variable that is a struct perf_event_attr to be collected after
> the perf_event_open syscall copies it from userspace, and got this
> message:
> 
> [root@zoo ~]# perf probe SYSC_perf_event_open:23 args
> Failed to find 'args' in this function.
>   Error: Failed to add events.
> [root@zoo ~]#

BTW, would you sure that the args exists at the given place?
I couldn't find it in kernel/events/core.c.

And also, could you make sure to run below command to clarify
the existed variables and its valid ranges?
 # perf probe -V --range SYSC_perf_event_open

For example, I got below outouts.

# perf probe -V SYSC_perf_event_open:23
Available variables at SYSC_perf_event_open:23
        @<SYSC_perf_event_open+502>
                int     cpu
                int     group_fd
                long unsigned int       flags
                pid_t   pid
                struct perf_event_attr  attr
# perf probe SYSC_perf_event_open:23 attr
perf_event_attr exceeds max-bitwidth. Cut down to 64 bits.
Added new event:
  probe:SYSC_perf_event_open (on SYSC_perf_event_open:23 with attr)

You can now use it in all perf tools, such as:

        perf record -e probe:SYSC_perf_event_open -aR sleep 1

Of course, this is still not enough, I must fix this as you suggested.

> 
> Ok, I guess it should be instead:
> 
> [root@zoo ~]# perf probe SYSC_perf_event_open:23 args
> The 'args' variable is a struct, this is not supported yet.
>   Error: Failed to add events.
> [root@zoo ~]#
> 
> :-)
> 
-- 
Masami HIRAMATSU
Linux Technology Research Center, System Productivity Research Dept.
Center for Technology Innovation - Systems Engineering
Hitachi, Ltd., Research & Development Group
E-mail: masami.hiramatsu.pt@...achi.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/