linux-kernel - Re: [PATCH 0/7] add syscall tracepoints

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 16 Jun 2009 21:32:20 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Jason Baron <jbaron@...hat.com>
Cc:	linux-kernel@...r.kernel.org, fweisbec@...il.com,
	laijs@...fujitsu.com, rostedt@...dmis.org, peterz@...radead.org,
	mathieu.desnoyers@...ymtl.ca, jiayingz@...gle.com,
	bligh@...gle.com, roland@...hat.com, fche@...hat.com
Subject: Re: [PATCH 0/7] add syscall tracepoints


* Jason Baron <jbaron@...hat.com> wrote:

> hi,
> 
> The following is an implementation of Frederic's syscall tracer on 
> top of tracepoints. It adds the ability to toggle the entry/exit 
> of each syscall via the standard 
> events/syscalls/syscall_blah/enable interface. The implementation 
> is done by adding 2 tracepoints. One on entry and one for exit.
> 
> This implementation required a few 'core' api changes. I've added 
> 'DECLARE_TRACE_REG()' macro which takes a register and and an 
> unregister function as arguments. This allowed me to toggle the 
> ftrace tif flag when the first tracepoint callback is added and 
> the last is removed. Current callers of 'DECLARE_TRACE()' are not 
> impacted.
> 
> Another change was to call arch_init_ftrace_syscalls via an 
> 'arch_initall'. In this implmentation I needed to access the 
> syscalls_metadata structure at runtime in order to determine which 
> syscalls were 'traceable'. Although the implementation uses 
> SYSCALL_DEFINE() to set up the the trace events, for some reason 
> at runtime there is no syscalls_metadata, associated with some of 
> the SYSCALL_DEFINE() calls. I'm not quite sure why that is. 
> However, by calling arch_init_ftrace_syscalls() at boot I can make 
> sure the lists are in sync.
> 
> thanks,
> 
> -Jason 
> 
> 
>  arch/x86/include/asm/ftrace.h |    4 +-
>  arch/x86/kernel/ftrace.c      |   24 +++++-
>  arch/x86/kernel/ptrace.c      |    6 +-
>  include/linux/syscalls.h      |   63 +++++++++++++++
>  include/linux/tracepoint.h    |   27 ++++++-
>  include/trace/syscall.h       |   37 +++++++---
>  kernel/trace/trace_events.c   |   29 +++++---
>  kernel/trace/trace_syscalls.c |  172 +++++++++++++++++++----------------------
>  kernel/tracepoint.c           |   38 +++++++++
>  9 files changed, 278 insertions(+), 122 deletions(-)

This looks far nicer structurally. Steve, Frederic, what's your take 
on this series?

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/