linux-kernel - perf: Timestamp COMM and MMAP events for correct attribution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1290490544-14349-1-git-send-email-imunsie@au1.ibm.com>
Date:	Tue, 23 Nov 2010 16:35:38 +1100
From:	"Ian Munsie" <imunsie@....ibm.com>
To:	linux-kernel@...r.kernel.org
Subject: perf: Timestamp COMM and MMAP events for correct attribution

This patch series fixes a bug introduced with the per-task-per-cpu event
support in perf where PERF_RECORD_COMM and PERF_RECORD_MMAP events would arrive
and be recorded via one CPUs buffer much later than samples corresponding to
them arriving on another CPUs buffer, and would cause perf to mis-attribute
those events.

This has been observed on multiple systems, but is more common the more CPUs
present - on 64 CPU systems it is extremely common (one system tested occurred
~50% of the time, while another was >99%), while on my quad Intel i7 it is much
rarer (but I have observed it several times). Examining the data file with perf
report -D shows the COMM and MMAP events a long way through the file (80% or
more), well after many previous events.

This series introduces an ABI change to perf to add the timestamps to the MMAP
and COMM events so that they can be correlated with the samples corresponding
to them. The timestamps are requested from the kernel by setting the all_timed
bit in the attributes when opening the events and is placed just after the
event header of the events in question.

While not necessary to fix this bug (or any other AFAIK), I have also included
changes to the PERF_RECORD_READ and PERF_RECORD_LOST events to add the
timestamp in the same manner. This could be useful to support and if we did
eventually want to add it it would be easier to change all the events in
question at once. Those changes are in separate patches from the COMM and MMAP
changes so they can easily be dropped when merging this upstream if they are
unwanted.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/