linux-kernel - Re: Perf record format portability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1337192248.6724.60.camel@gandalf.stny.rr.com>
Date:	Wed, 16 May 2012 14:17:28 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Arnaldo Carvalho de Melo <acme@...stprotocols.net>
Cc:	Dmitry Antipov <dmitry.antipov@...aro.org>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Paul Mackerras <paulus@...ba.org>,
	Ingo Molnar <mingo@...hat.com>,
	Amit Kucheria <amit.kucheria@...aro.org>,
	linaro-dev@...ts.linaro.org, linux-kernel@...r.kernel.org,
	Jiri Olsa <jolsa@...hat.com>
Subject: Re: Perf record format portability

On Wed, 2012-05-16 at 15:08 -0300, Arnaldo Carvalho de Melo wrote:
> Em Wed, May 16, 2012 at 12:58:23PM -0400, Steven Rostedt escreveu:
> > On Wed, 2012-05-16 at 11:59 -0300, Arnaldo Carvalho de Melo wrote:
> > > 	Was the kernel trace events infrastructure designed with that in
> > > mind? I.e. cross analysis? I must be missing something here, still
> > > ENOCOFFEE :-\
> > 
> > Yes, the libparsevents library was design for this from day one. That's
> > why trace-cmd data file can be run on an ARM and read on x86, or PPC, or
> > whatever. I did all my development testing against 32bit, 64bit and big
> > and little endian. This was the case from the beginning.
> 
> I need to look at the code, but how does it do this? Copy the relevant
> /sys/kernel/debug/events formats in the header and then instead of
> looking at /sys/... look at those?

It does copy the events from .../debug/tracing/events. But it does cheat
about the bits. To determine the size, it looks
at /sys/kernel/debug/tracing/events/header_page and the field of
"commit". On 32bit machines, that's 4bytes, and on 64bit, that's 8
bytes.

For endianess, that is calculated on the machine that the recording is
running on and stored in the file.

The parse-events structure has a way to record the endianess and long
size, for later retrieval.

> 
> Does it still copy /proc/kallsyms?

Yes it does.

-- Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/