linux-kernel - Re: binary ftrace buffer format

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1247592167.7178.25.camel@johannes.local>
Date:	Tue, 14 Jul 2009 19:22:47 +0200
From:	Johannes Berg <johannes@...solutions.net>
To:	LKML <linux-kernel@...r.kernel.org>
Cc:	Ingo Molnar <mingo@...e.hu>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Steven Rostedt <rostedt@...dmis.org>
Subject: Re: binary ftrace buffer format

So, I've gotten this far, manually:

This was on a powerpc 64-bit (big endian) machine, the contents of
per_cpu/trace_pipe_raw:

00000000  00 00 02 24 15 cd b4 a0  00 00 00 00 00 00 0f f0	page header: time 2354.007880864, 4080 bytes
00000010  00 00 00 00						item header: type_len == 0, time offset = 0
                      00 00 00 94				item length: 148 bytes
                                   00 82			event ID 130
                                         11 02 00 00 00 00
00000020  00 00 00 00 00 00 00 00  c0 00 00 01 03 ca 1a 00
00000030  00 1a 70 00 00 00 01 00  00 80 39 e4 01 00 00 00
00000040  00 00 00 00 00 00 01 09  01 00 7c 10 80 00 ec 0f
00000050  80 00 00 00 00 00 01 00  00 00 ff ff ff ff 1a ff
00000060  ff ff 02 ff ff ff 20 34  00 00 e2 34 00 00 c4 ca
00000070  ff ff 94 c9 ff ff 66 f3  ff ff e6 f2 ff ff 00 00
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
00000090  00 00 00 00 00 00 ff ff  ff ff ff ff ff ff ff ff
000000a0  ff ff 00 00
                      00 00 00 00				item header: type_len == 0, time offset == 0
                                   88 78 3d 40			item length???
                                               00 82		event ID 130
                                                     11 02

at which point it stops making sense. What's with that item length? Can
anyone help?

johannes

Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)