linux-kernel - Re: [PATCH 0/4] perf tools: Persistent events, changes for perf tool integration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130531134445.GD2132@rric.localhost>
Date:	Fri, 31 May 2013 15:44:45 +0200
From:	Robert Richter <rric@...nel.org>
To:	Ingo Molnar <mingo@...nel.org>
Cc:	Borislav Petkov <bp@...en8.de>,
	Arnaldo Carvalho de Melo <acme@...stprotocols.net>,
	Peter Zijlstra <peterz@...radead.org>,
	Jiri Olsa <jolsa@...hat.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 0/4] perf tools: Persistent events, changes for perf tool
 integration

> > On Fri, May 31, 2013 at 02:07:20PM +0200, Ingo Molnar wrote:
> > > For that I'd like to create a persistent event that just keeps
> > > running, and to which I can occasionally attach to read-only to see
> > > what's going on and maybe attach to it read-write to drain the trace
> > > entries. I.e. basically a global trace buffer. How do I achieve that
> > > with this new tooling?

Actually every system-wide event that is opened with readonly buffers
could be shared between processes, which would be the same as
connecting to a persistent event. I didn't want to implement this in a
first step, but I think this could be implemented without too much
effort.

The main problem is that at least one file descriptor needs to be open
at any time. Otherwise the event would be removed. So there is no
concept (except enabling an in-kernel event) yet to keep the event
running without any process having an event file discriptor open. Even
harder will it be to release such an event, there is no distincition
beetween detaching the event from the process or permanently removing
the event.

So the easiest would be to just open a system-wide event and then put
the process into sleep until we want to remove the event. In between
other processes (maybe duplicate on fork?) could attach to the same
buffer. Only if no process is attached to the event enymore the event
will be removed. Would that fit your purpose?

-Robert
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/