linux-kernel - Re: [RFC 3/4] perf, ftrace: Add new perf ioctl for function trace filter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 27 Jul 2011 14:17:34 +0200
From:	Jiri Olsa <jolsa@...hat.com>
To:	Frederic Weisbecker <fweisbec@...il.com>
Cc:	rostedt@...dmis.org, a.p.zijlstra@...llo.nl,
	linux-kernel@...r.kernel.org, Ingo Molnar <mingo@...e.hu>
Subject: Re: [RFC 3/4] perf, ftrace: Add new perf ioctl for function trace
 filter

On Tue, Jul 26, 2011 at 03:43:44PM +0200, Frederic Weisbecker wrote:

SNIP

> Ideally, the filter engine should split expressions into a tree
> of ops:
> 
> 	ip == func1 + func2 + func3 || ip == func4
> 
> should be parsed into:
> 
>             ||
>             /\
>            /  \
>           /    \
>          /      \
>         ==       ==
>        /  \     /  \
>       /    \   ip   \
>      /      \       func4
>     ip       +       
>             / \
>            /   \
>           +     \
>          /  \   func3
>         /    \
>     func1   func2
> 
> And then pass that to ftrace that interprets that tree
> by building set of functions on top of each node joined to
> the other.
> 
> But that can be complicated to do, and perhaps a bit of
> an overkill even for daily use of it.
> 
> Having a simple "ip == func + func2 + func3" expression support

so the '+' is just shortcut for '||' ... like:

"ip == x1 || ip == x1" AND "ip == x1 + x2" mean the same thing

if we omit the '+' and keep just the whitespace we could use the function
name parser as used in set_ftrace_filter interface with no change ;)
but adding new separator should not be that hard..

> should be enough I think. And we can reject expressions that don't
> fit that pattern. Then if it becomes necessary one day to support
> real expressions there, we can still switch to a real tree.
> 
> Does that look sane? 

I'l make the change and send new version

thanks,
jirka
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/