linux-kernel - Re: [PATCH 00/13] perf_events: add support for sampling taken branches (v3)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 26 Jan 2012 17:21:47 +0100
From:	Stephane Eranian <eranian@...gle.com>
To:	David Ahern <dsahern@...il.com>
Cc:	Peter Zijlstra <peterz@...radead.org>,
	linux-kernel@...r.kernel.org, mingo@...e.hu, acme@...radead.org,
	robert.richter@....com, ming.m.lin@...el.com, andi@...stfloor.org,
	asharma@...com, ravitillo@....gov, vweaver1@...s.utk.edu
Subject: Re: [PATCH 00/13] perf_events: add support for sampling taken
 branches (v3)

On Tue, Jan 24, 2012 at 5:08 PM, David Ahern <dsahern@...il.com> wrote:
>
> On 01/24/2012 08:39 AM, Stephane Eranian wrote:
>> Hi,
>>
>> The branch stack sampling patch exposes a flaw in the sampling
>> buffer format as currently exported by the kernel.
>>
>> In the current format, sample records (RECORD_SAMPLE) are NOT
>> self-describing. That means that by looking at the fixed size header, it
>> is not possible to determine which event caused the sample to be recorded
>> and what's in the body of the variable length sample.
>>
>> Such introspection is only possible once we know the event unique id
>> (PERF_SAMPLE_ID). But to get the event ID, we need to parse the
>> sample. But, given that a sample has a variable length, there is no
>> predefined position for that ID in the sample. You have a chicken
>> and egg problem here. There is no room left in the fixed size header
>> to fit this in.
>
> I brought this up last Fall as well. As I recall the response is to move
> each sample_type based stream into its own data file and then merge the
> data files while processing.
>
But then, if you merge the files as is, it does not buy you anything.
You need to
add or overwrite some information in the headers. Unless, you rewrite
the tool to
handle multiple inputs files.

> David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/