linux-kernel - Re: event filtering with trace-cmd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1371054120.9844.259.camel@gandalf.local.home>
Date:	Wed, 12 Jun 2013 12:22:00 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Arend van Spriel <arend@...adcom.com>
Cc:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: event filtering with trace-cmd

On Wed, 2013-06-12 at 12:13 +0200, Arend van Spriel wrote:
> Hi Steven
> 
> I wanted to filter my debug events getting only one specific level. So I 
> followed the instruction found online, but I get a parse error.
> 
> Running on 3.10-rc1 using trace-cmd 1.0.3. Should I upgrade?

I would recommend upgrading regardless, but that's not an issue here.

> 
> Regards,
> Arend
> ----8<-----------------------------------------------------------------
> events/brcmfmac/brcmf_dbg# cat format
> name: brcmf_dbg
> ID: 1133
> format: 
> 
>          field:unsigned short common_type;       offset:0;       size:2; 
> signed:0;
>          field:unsigned char common_flags;       offset:2;       size:1; 
> signed:0;
>          field:unsigned char common_preempt_count;       offset:3; 
>   size:1; signed:0;
>          field:int common_pid;   offset:4;       size:4; signed:1;
> 
>          field:u32 level;        offset:8;       size:4; signed:0;
>          field:__data_loc char[] func;   offset:12;      size:4; signed:1;
>          field:__data_loc char[] msg;    offset:16;      size:4; signed:1;
>  
> 
> print fmt: "%s: %s", __get_str(func), __get_str(msg)
> 
> # sudo trace-cmd record -e brcmfmac:brcmf_dbg -f 'level & 0x40000'
> disable all
> enable brcmfmac:brcmf_dbg
> path = /sys/kernel/debug/tracing/events/brcmfmac/brcmf_dbg/enable
> (level & 0x40000)
> ^
> parse_error: Invalid operator
> 

The record -f command passes the filter into the kernel
file /sys/kerne/debug/tracing/events/brcmfmac/brcmf_dbg/filter, and the
error is actually coming from the kernel itself. Looking at the code, we
do not currently accept binary operations. Although, it shouldn't be too
hard to add. I may go and implement it for 3.11.


Thanks!

-- Steve

> trace-cmd: Invalid argument
>    Failed filter of 
> /sys/kernel/debug/tracing/events/brcmfmac/brcmf_dbg/filter


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/