linux-kernel - Re: [patch] trace: Add user-space event tracing/injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20101118185644.GA10827@elte.hu>
Date:	Thu, 18 Nov 2010 19:56:44 +0100
From:	Ingo Molnar <mingo@...e.hu>
To:	hp <hp.reichert@....de>
Cc:	linux-kernel@...r.kernel.org,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Thomas Gleixner <tglx@...utronix.de>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Frédéric Weisbecker <fweisbec@...il.com>
Subject: Re: [patch] trace: Add user-space event tracing/injection


* hp <hp.reichert@....de> wrote:

> Ingo Molnar <mingo <at> elte.hu> writes:
> 
> > 
> > 
> > * Darren Hart <dvhart <at> linux.intel.com> wrote:
> > 
> > > Ideally I would like to see something just like trace_printf()
> > > without having to define it myself in each of my testcases. [...]
> > 
> > We can make the prctl a single-argument thing, at the cost of not allowing \0
> in the 
> > content. (which is probably sane anyway)
> > 
> > That way deployment is super-simple:
> > 
> > 	prctl(35, "My Trace Message");
> > 	...
> > 
> > 	if (asprintf(&msg, "My Trace Message: %d\n", 1234) != -1) {
> > 		prctl(35, *msg);
> > 		free(*msg);
> > 	}
> > 
> > Thanks,
> > 
> > 	Ingo
> > 
> I like this approach - it is doing it nearly the same way I did it with an extra
> k-mod (no patch needed) and a debugfs entry handled in that mod.
> I only see one thing with the string only data - I am doing stuff where there
> are long recording times with also a lot of user events,
> in such an environment I need more semantics on the event contents.
> In my k-mod solution there's an event ID and the opportunity to log binary data.
> As prctl() has 4 additional args after the option, it would be possible to use
> it in the following way:
> prtctl( 35, int eventID, int data_type, int msglen, void *buf);
> or without the data_type
> prtctl( 35, int eventID, int msglen, void *buf);
> decoding would be of more effort but it would be worth
> 
> The event definition would be like this (with data_type):
> 
> TRACE_EVENT(user,
>         TP_PROTO(int id, int dtype, int dlen, unsigned char *bytes),
>         TP_ARGS(id, dtype, dlen, bytes),
>         TP_STRUCT__entry(
>                 __field(int, ev_id)
>                 __field(int, ev_type)
>                 __dynamic_array(unsigned char, ev_data, dlen)
>         ),
>         TP_fast_assign(
>                 __entry->ev_id = id;
> 		__entry->ev_type = dtype;
> 		memcpy(__get_dynamic_array(ev_data), bytes, dlen);
>         ),
> 
>         TP_printk("ID: %d type: %s data: %s", __entry->ev_id,
> __print_symbolic(__entry->ev_type, {0,"V"}, {1,"I"}, {2,"S"}, {4,"B"}),
> __entry->ev_type == 0 ? "n/a" : __get_str(ev_data))
> );
> 
> 
> What do you think about this?

The transport was not limited to strings - it's a memory buffer of 'len' bytes.

In that sense 'ev_id' and 'ev_type' above is really just hardcoding something that 
the app might not care about.

For example with the patch i sent one could send 1 byte messages - no other 
overhead. (beyond the standard record header)

While if an app does want to use an (ev_id, ev_type), it can still do so. Or if an 
app wants to do some other message type, that can be done too - it's free-form.

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/