linux-kernel - Re: [PATCH 08/12] add trace events for each syscall entry/exit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090811114512.GA585@elte.hu>
Date:	Tue, 11 Aug 2009 13:45:12 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Frederic Weisbecker <fweisbec@...il.com>
Cc:	Jason Baron <jbaron@...hat.com>, linux-kernel@...r.kernel.org,
	laijs@...fujitsu.com, rostedt@...dmis.org, peterz@...radead.org,
	mathieu.desnoyers@...ymtl.ca, jiayingz@...gle.com,
	mbligh@...gle.com, lizf@...fujitsu.com
Subject: Re: [PATCH 08/12] add trace events for each syscall entry/exit


* Frederic Weisbecker <fweisbec@...il.com> wrote:

> > +struct trace_event event_syscall_enter = {
> > +	.trace			= print_syscall_enter,
> > +	.type			= TRACE_SYSCALL_ENTER
> > +};
> > +
> > +struct trace_event event_syscall_exit = {
> > +	.trace			= print_syscall_exit,
> > +	.type			= TRACE_SYSCALL_EXIT
> > +};
> > -- 
> > 1.6.2.5
> > 
> 
> Nice.
> 
> It's a bit too bad that enter and exit must be that separated 
> whereas their callbacks are pretty the same.
> 
> But I guess if we want to nicely decouple both, we don't have the 
> choice.

Yeah - and enter and exit are different, in terms of state.

One thing that would be nice in the future (as an add-on - this 
patch-set looks useful already) is to allow the sampling of user 
register state as well via these tracepoints. That way we'd have a 
much faster (and completely transparent) implementation of strace in 
essence, with unique features such as system-wide or per cpu 
strace-ing.

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/