linux-kernel - Re: Using perf probe with arguments throws a fatal error.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 25 Aug 2010 14:47:39 +0900
From:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
To:	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>
Cc:	Arnaldo Carvalho de Melo <acme@...radead.org>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Fr?d?ric Weisbecker <fweisbec@...il.com>,
	2nddept-manager@....hitachi.co.jp, Ingo Molnar <mingo@...e.hu>,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: Using perf probe with arguments throws a fatal error.

(2010/08/24 18:56), Srikar Dronamraju wrote:
>>>
>>> 1000 [srikar@...69 uprobesv3.git]$  cat
>>> /sys/kernel/debug/tracing/events/probe/do_fork/format
>>> name: do_fork
>>> ID: 817
>>> format:
>>>         field:unsigned short common_type;       offset:0; size:2; signed:0;
>>>         field:unsigned char common_flags;       offset:2; size:1; signed:0;
>>>         field:unsigned char common_preempt_count;       offset:3; size:1; signed:0;
>>>         field:int common_pid;   offset:4;       size:4; signed:1;
>>>         field:int common_lock_depth;    offset:8;       size:4; signed:1;
>>>
>>>         field:unsigned long __probe_ip; offset:16;      size:8; signed:0;
>>>         field:u64 %ip;  offset:24;      size:8; signed:0;
>>
>> Hmm, it could be caused by "u64"...
>> OK, maybe I should update perf to support those.
>>
>> BTW, let me check that you use perf for the latest kernel?
>>
> 
> 
> Yes, I am using perf from latest kernel and this happens on both x86
> and x86_64 boxes.
> 
> Just for curiosity I tried printing the format for perf probe
> do_fork ip=%ip and here it is 
> 
> 1001 [srikar@...69 uprobesv3.git]$ sudo perf probe do_fork ip=%ip 
> 1001 [srikar@...69 uprobesv3.git]$ cat /sys/kernel/debug/tracing/events/probe/do_fork/format 
> name: do_fork
> ID: 818
> format:
>         field:unsigned short common_type;       offset:0; size:2; signed:0;
>         field:unsigned char common_flags;       offset:2; size:1; signed:0;
>         field:unsigned char common_preempt_count;       offset:3; size:1; signed:0;
>         field:int common_pid;   offset:4;       size:4; signed:1;
>         field:int common_lock_depth;    offset:8;       size:4; signed:1;
> 
>         field:unsigned long __probe_ip; offset:16;      size:8; signed:0;
>         field:u64 ip;   offset:24;      size:8; signed:0;
> 	          ^^
> 
> print fmt: "(%lx) ip=%llx", REC->__probe_ip, REC->ip
>                   ^^				 ^^
> 
> The differences I see when a name is given we refer the name, while in
> the previous case we refer the register %ip.

Ah, I remembered that, yeah, perf doesn't support those raw regsiters,
dereferences, etc.
Hmm, this should be solved, but not so simple as just removing "%",
because there are also special variables ($retval, $stack) and
dereferences(+8(+10(%sp)), etc).

I think the simplest solution is just setting "argX" name for each
argument (if user omitted its name) in kprobe-tracer (because
trace-cmd will face same problem).
e.g.
 # echo "p do_fork %ip" > tracing/kprobe_events
will be translated as below
 # echo "p do_fork arg1=%ip" > tracing/kprobe_events

Thank you,


-- 
Masami HIRAMATSU
2nd Dept. Linux Technology Center
Hitachi, Ltd., Systems Development Laboratory
E-mail: masami.hiramatsu.pt@...achi.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/