linux-kernel - Re: [PATCH 2/2] convert to syscall tracepoints

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090607132936.GC12088@elte.hu>
Date:	Sun, 7 Jun 2009 15:29:36 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Jason Baron <jbaron@...hat.com>
Cc:	linux-kernel@...r.kernel.org, fweisbec@...il.com,
	laijs@...fujitsu.com, rostedt@...dmis.org, peterz@...radead.org,
	mathieu.desnoyers@...ymtl.ca, jiayingz@...gle.com,
	mbligh@...gle.com, roland@...hat.com, fche@...hat.com
Subject: Re: [PATCH 2/2] convert to syscall tracepoints


* Jason Baron <jbaron@...hat.com> wrote:

> 
> Implements syscall tracer via tracepoints and TRACE_EVENT(). Introduces
> a new tracing flag 'trace_syscalls', which must be toggled to enable this
> feature.
> 
> 
> Signed-off-by: Jason Baron <jbaron@...hat.com>
> 
> ---
>  arch/x86/kernel/ptrace.c        |    8 +-
>  include/asm-generic/syscall.h   |    3 +
>  include/trace/events/syscalls.h | 4202 +++++++++++++++++++++++++++++++++++++++
>  include/trace/syscall.h         |    6 +
>  kernel/trace/Makefile           |    1 -
>  kernel/trace/trace.c            |  101 +
>  kernel/trace/trace_syscalls.c   |  250 ---
>  7 files changed, 4317 insertions(+), 254 deletions(-)
>  create mode 100644 include/trace/events/syscalls.h
>  delete mode 100644 kernel/trace/trace_syscalls.c

the functionality is fine and very desired IMO, but the 
implementation is pretty large and ugly, isnt it?

Wouldnt it be possible to compress this:

> +#ifdef __NR_setgroups
> +trace_event_syscall_enter(2, setgroups, int, gidsetsize, gid_t __user *, grouplist);
> +trace_event_syscall_exit(setgroups);
> +#define ENTERCASEsetgroups create_syscall_enter(2, setgroups, int, gid_t __user *);
> +#define EXITCASEsetgroups create_syscall_exit(setgroups);
> +#else
> +#define ENTERCASEsetgroups
> +#define EXITCASEsetgroups
> +#endif

down to some sane syntax? Do we really want to replicate all the 
DEFINE_SYSCALL() information again in a separate header? Is there no 
way to somehow define the tracepoint in-situ, where the 
DEFINE_SYSCALL macro is present? That would eliminate 
include/trace/events/syscalls.h altogether.

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/