linux-kernel - perf report warnings on tracepoint events hidden by ui

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 27 Apr 2017 19:31:12 -0500
From:   David Carrillo-Cisneros <davidcc@...gle.com>
To:     Jiri Olsa <jolsa@...nel.org>, Namhyung Kim <namhyung@...nel.org>,
        Arnaldo Carvalho de Melo <acme@...hat.com>,
        Andi Kleen <andi@...stfloor.org>,
        David Ahern <dsahern@...il.com>,
        Frederic Weisbecker <fweisbec@...il.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Wang Nan <wangnan0@...wei.com>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Stephane Eranian <eranian@...gle.com>
Subject: perf report warnings on tracepoint events hidden by ui

When processing tracepoint events, perf report outputs warnings about
field not founds. The warnings are usually hidden by perf report UI
and appear when using the --stdio option. e.g.

  $ perf record -e syscalls:sys_enter_mmap some_load

  $ perf report --stdio

  Warning: [syscalls:sys_enter_mmap] eval_num_arg: field addr not found
  Warning: [syscalls:sys_enter_mmap] eval_num_arg: field len not found
  Warning: [syscalls:sys_enter_mmap] eval_num_arg: field prot not found
  Warning: [syscalls:sys_enter_mmap] eval_num_arg: field flags not found
  Warning: [syscalls:sys_enter_mmap] eval_num_arg: field fd not found
  Warning: [syscalls:sys_enter_mmap] eval_num_arg: field off not found
  Warning: [syscalls:sys_enter_mmap] eval_num_arg: field addr not found
  Warning: [syscalls:sys_enter_mmap] eval_num_arg: field len not found
  Warning: [syscalls:sys_enter_mmap] eval_num_arg: field prot not found
  Warning: [syscalls:sys_enter_mmap] eval_num_arg: field flags not found
  Warning: [syscalls:sys_enter_mmap] eval_num_arg: field fd not found
  Warning: [syscalls:sys_enter_mmap] eval_num_arg: field off not found

I bisected the warnings to:
  commit d49dadea78624 ("perf tools: Make 'trace' or 'trace_fields'
sort key default for tracepoint events").

that introduced sorting by trace. The event's format in my example is:

  $ cat /sys/kernel/debug/tracing/events/syscalls/sys_enter_socket/format

  name: sys_enter_socket
  ID: 1850
  format:
          field:unsigned short common_type;       offset:0;
size:2; signed:0;
          field:unsigned char common_flags;       offset:2;
size:1; signed:0;
          field:unsigned char common_preempt_count;       offset:3;
   size:1; signed:0;
          field:int common_pid;   offset:4;       size:4; signed:1;

  print fmt: "family: 0x%08lx, type: 0x%08lx, protocol: 0x%08lx",
((unsigned long)(REC->family)), ((unsigned long)(REC->type)),
((unsigned long)(REC->protocol))


An appears to be correctly parsed by event_read_print in
tools/lib/tracevent/event-parse.c . Has anyone seen this before?

Thanks,
David