linux-kernel - Re: [PATCH] perf, x86: Enabled PEBS event to be exported in a raw format

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 28 Jun 2012 20:35:46 -0700
From:	Andi Kleen <ak@...ux.intel.com>
To:	Feng Tang <feng.tang@...el.com>
Cc:	Peter Zijlstra <peterz@...radead.org>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Ingo Molnar <mingo@...e.hu>, linux-kernel@...r.kernel.org,
	x86@...nel.org, Stephane Eranian <eranian@...gle.com>
Subject: Re: [PATCH] perf, x86: Enabled PEBS event to be exported in a raw
 format

> Yeah, that number scared me too when I first saw it, as the time will make
> the script totally useless. Then after migrating to the RAM based database
> file, the database handling time could be cut down to 1 second.

The problem is just that sqlite does a fdatasync for every insert.
Just need to figure out how to tell it to stop doing that.

Shouldn't be too hard ...

But yes /dev/shm should work well enough for now.

> 
> I guess the sqlite itself realize the shortcoming too, it also provide a
> native way to use in-memory database by specifying ":memory":
> 	con = sqlite3.connect(":memory:")

I think it's better to have a file on disk, then you can easily query
more properties just from the command line.

I can see all kinds of interesting data mining on the events
to be enabled by this. They have all the register values and various
other information.

For example if you look for string operations you could do
a histogram over the ECX values and so do a histogram of
memcpy/memset sizes. 

[Would be easier if perf could pass in the assembler opcode,
but could be done without)

Or when sampling spinlocks look at the addresses.
Or lots of other things people could imagine.

-Andi
-- 
ak@...ux.intel.com -- Speaking for myself only
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/