linux-kernel - Re: [patch] trace: Add user-space event tracing/injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 18 Nov 2010 16:25:09 +0000 (UTC)
From:	hp <hp.reichert@....de>
To:	linux-kernel@...r.kernel.org
Subject: Re: [patch] trace: Add user-space event tracing/injection

Ingo Molnar <mingo <at> elte.hu> writes:

> 
> 
> * Darren Hart <dvhart <at> linux.intel.com> wrote:
> 
> > Ideally I would like to see something just like trace_printf()
> > without having to define it myself in each of my testcases. [...]
> 
> We can make the prctl a single-argument thing, at the cost of not allowing \0
in the 
> content. (which is probably sane anyway)
> 
> That way deployment is super-simple:
> 
> 	prctl(35, "My Trace Message");
> 	...
> 
> 	if (asprintf(&msg, "My Trace Message: %d\n", 1234) != -1) {
> 		prctl(35, *msg);
> 		free(*msg);
> 	}
> 
> Thanks,
> 
> 	Ingo
> 
I like this approach - it is doing it nearly the same way I did it with an extra
k-mod (no patch needed) and a debugfs entry handled in that mod.
I only see one thing with the string only data - I am doing stuff where there
are long recording times with also a lot of user events,
in such an environment I need more semantics on the event contents.
In my k-mod solution there's an event ID and the opportunity to log binary data.
As prctl() has 4 additional args after the option, it would be possible to use
it in the following way:
prtctl( 35, int eventID, int data_type, int msglen, void *buf);
or without the data_type
prtctl( 35, int eventID, int msglen, void *buf);
decoding would be of more effort but it would be worth

The event definition would be like this (with data_type):

TRACE_EVENT(user,
        TP_PROTO(int id, int dtype, int dlen, unsigned char *bytes),
        TP_ARGS(id, dtype, dlen, bytes),
        TP_STRUCT__entry(
                __field(int, ev_id)
                __field(int, ev_type)
                __dynamic_array(unsigned char, ev_data, dlen)
        ),
        TP_fast_assign(
                __entry->ev_id = id;
		__entry->ev_type = dtype;
		memcpy(__get_dynamic_array(ev_data), bytes, dlen);
        ),

        TP_printk("ID: %d type: %s data: %s", __entry->ev_id,
__print_symbolic(__entry->ev_type, {0,"V"}, {1,"I"}, {2,"S"}, {4,"B"}),
__entry->ev_type == 0 ? "n/a" : __get_str(ev_data))
);


What do you think about this?
/hp

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/